OP#792 initial commit after fork

internal/bucket/bandwidth/measurement.go

@@ -0,0 +1,92 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package bandwidth
+
+import (
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+const (
+	// betaBucket is the weight used to calculate exponential moving average
+	betaBucket = 0.1 // Number of averages considered = 1/(1-betaObject)
+)
+
+// bucketMeasurement captures the bandwidth details for one bucket
+type bucketMeasurement struct {
+	lock                 sync.Mutex
+	bytesSinceLastWindow uint64    // Total bytes since last window was processed
+	startTime            time.Time // Start time for window
+	expMovingAvg         float64   // Previously calculate sliding window
+}
+
+// newBucketMeasurement creates a new instance of the measurement with the initial start time.
+func newBucketMeasurement(initTime time.Time) *bucketMeasurement {
+	return &bucketMeasurement{
+		startTime: initTime,
+	}
+}
+
+// incrementBytes add bytes reported for a bucket.
+func (m *bucketMeasurement) incrementBytes(bytes uint64) {
+	atomic.AddUint64(&m.bytesSinceLastWindow, bytes)
+}
+
+// updateExponentialMovingAverage processes the measurements captured so far.
+func (m *bucketMeasurement) updateExponentialMovingAverage(endTime time.Time) {
+	// Calculate aggregate avg bandwidth and exp window avg
+	m.lock.Lock()
+	defer func() {
+		m.startTime = endTime
+		m.lock.Unlock()
+	}()
+
+	if m.startTime.IsZero() {
+		return
+	}
+
+	if endTime.Before(m.startTime) {
+		return
+	}
+
+	duration := endTime.Sub(m.startTime)
+
+	bytesSinceLastWindow := atomic.SwapUint64(&m.bytesSinceLastWindow, 0)
+
+	if m.expMovingAvg == 0 {
+		// Should address initial calculation and should be fine for resuming from 0
+		m.expMovingAvg = float64(bytesSinceLastWindow) / duration.Seconds()
+		return
+	}
+
+	increment := float64(bytesSinceLastWindow) / duration.Seconds()
+	m.expMovingAvg = exponentialMovingAverage(betaBucket, m.expMovingAvg, increment)
+}
+
+// exponentialMovingAverage calculates the exponential moving average
+func exponentialMovingAverage(beta, previousAvg, incrementAvg float64) float64 {
+	return (1-beta)*incrementAvg + beta*previousAvg
+}
+
+// getExpMovingAvgBytesPerSecond returns the exponential moving average for the bucket in bytes
+func (m *bucketMeasurement) getExpMovingAvgBytesPerSecond() float64 {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+	return m.expMovingAvg
+}

internal/bucket/bandwidth/monitor.go

@@ -0,0 +1,215 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package bandwidth
+
+//go:generate msgp -file=$GOFILE -unexported
+
+import (
+	"context"
+	"slices"
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+//msgp:ignore bucketThrottle Monitor
+
+type bucketThrottle struct {
+	*rate.Limiter
+	NodeBandwidthPerSec int64
+}
+
+// Monitor holds the state of the global bucket monitor
+type Monitor struct {
+	tlock sync.RWMutex // mutex for bucket throttling
+	mlock sync.RWMutex // mutex for bucket measurement
+
+	bucketsThrottle    map[BucketOptions]*bucketThrottle
+	bucketsMeasurement map[BucketOptions]*bucketMeasurement // Buckets with objects in flight
+
+	bucketMovingAvgTicker *time.Ticker    // Ticker for calculating moving averages
+	ctx                   context.Context // Context for generate
+	NodeCount             uint64
+}
+
+// NewMonitor returns a monitor with defaults.
+func NewMonitor(ctx context.Context, numNodes uint64) *Monitor {
+	m := &Monitor{
+		bucketsMeasurement:    make(map[BucketOptions]*bucketMeasurement),
+		bucketsThrottle:       make(map[BucketOptions]*bucketThrottle),
+		bucketMovingAvgTicker: time.NewTicker(2 * time.Second),
+		ctx:                   ctx,
+		NodeCount:             numNodes,
+	}
+	go m.trackEWMA()
+	return m
+}
+
+func (m *Monitor) updateMeasurement(opts BucketOptions, bytes uint64) {
+	m.mlock.Lock()
+	defer m.mlock.Unlock()
+
+	tm, ok := m.bucketsMeasurement[opts]
+	if !ok {
+		tm = &bucketMeasurement{}
+	}
+	tm.incrementBytes(bytes)
+	m.bucketsMeasurement[opts] = tm
+}
+
+// SelectionFunction for buckets
+type SelectionFunction func(bucket string) bool
+
+// SelectBuckets will select all the buckets passed in.
+func SelectBuckets(buckets ...string) SelectionFunction {
+	if len(buckets) == 0 {
+		return func(bucket string) bool {
+			return true
+		}
+	}
+	return func(bucket string) bool {
+		return slices.Contains(buckets, bucket)
+	}
+}
+
+// Details for the measured bandwidth
+type Details struct {
+	LimitInBytesPerSecond            int64   `json:"limitInBits"`
+	CurrentBandwidthInBytesPerSecond float64 `json:"currentBandwidth"`
+}
+
+// BucketBandwidthReport captures the details for all buckets.
+type BucketBandwidthReport struct {
+	BucketStats map[BucketOptions]Details `json:"bucketStats,omitempty"`
+}
+
+// GetReport gets the report for all bucket bandwidth details.
+func (m *Monitor) GetReport(selectBucket SelectionFunction) *BucketBandwidthReport {
+	m.mlock.RLock()
+	defer m.mlock.RUnlock()
+	return m.getReport(selectBucket)
+}
+
+func (m *Monitor) getReport(selectBucket SelectionFunction) *BucketBandwidthReport {
+	report := &BucketBandwidthReport{
+		BucketStats: make(map[BucketOptions]Details),
+	}
+	for bucketOpts, bucketMeasurement := range m.bucketsMeasurement {
+		if !selectBucket(bucketOpts.Name) {
+			continue
+		}
+		m.tlock.RLock()
+		if tgtThrottle, ok := m.bucketsThrottle[bucketOpts]; ok {
+			currBw := bucketMeasurement.getExpMovingAvgBytesPerSecond()
+			report.BucketStats[bucketOpts] = Details{
+				LimitInBytesPerSecond:            tgtThrottle.NodeBandwidthPerSec * int64(m.NodeCount),
+				CurrentBandwidthInBytesPerSecond: currBw,
+			}
+		}
+		m.tlock.RUnlock()
+	}
+	return report
+}
+
+func (m *Monitor) trackEWMA() {
+	for {
+		select {
+		case <-m.bucketMovingAvgTicker.C:
+			m.updateMovingAvg()
+		case <-m.ctx.Done():
+			return
+		}
+	}
+}
+
+func (m *Monitor) updateMovingAvg() {
+	m.mlock.Lock()
+	defer m.mlock.Unlock()
+	for _, bucketMeasurement := range m.bucketsMeasurement {
+		bucketMeasurement.updateExponentialMovingAverage(time.Now())
+	}
+}
+
+func (m *Monitor) init(opts BucketOptions) {
+	m.mlock.Lock()
+	defer m.mlock.Unlock()
+
+	_, ok := m.bucketsMeasurement[opts]
+	if !ok {
+		m.bucketsMeasurement[opts] = newBucketMeasurement(time.Now())
+	}
+}
+
+// DeleteBucket deletes monitoring the 'bucket'
+func (m *Monitor) DeleteBucket(bucket string) {
+	m.tlock.Lock()
+	for opts := range m.bucketsThrottle {
+		if opts.Name == bucket {
+			delete(m.bucketsThrottle, opts)
+		}
+	}
+	m.tlock.Unlock()
+
+	m.mlock.Lock()
+	for opts := range m.bucketsMeasurement {
+		if opts.Name == bucket {
+			delete(m.bucketsMeasurement, opts)
+		}
+	}
+	m.mlock.Unlock()
+}
+
+// DeleteBucketThrottle deletes monitoring for a bucket's target
+func (m *Monitor) DeleteBucketThrottle(bucket, arn string) {
+	m.tlock.Lock()
+	delete(m.bucketsThrottle, BucketOptions{Name: bucket, ReplicationARN: arn})
+	m.tlock.Unlock()
+	m.mlock.Lock()
+	delete(m.bucketsMeasurement, BucketOptions{Name: bucket, ReplicationARN: arn})
+	m.mlock.Unlock()
+}
+
+// throttle returns currently configured throttle for this bucket
+func (m *Monitor) throttle(opts BucketOptions) *bucketThrottle {
+	m.tlock.RLock()
+	defer m.tlock.RUnlock()
+	return m.bucketsThrottle[opts]
+}
+
+// SetBandwidthLimit sets the bandwidth limit for a bucket
+func (m *Monitor) SetBandwidthLimit(bucket, arn string, limit int64) {
+	m.tlock.Lock()
+	defer m.tlock.Unlock()
+	limitBytes := limit / int64(m.NodeCount)
+	throttle, ok := m.bucketsThrottle[BucketOptions{Name: bucket, ReplicationARN: arn}]
+	if !ok {
+		throttle = &bucketThrottle{}
+	}
+	throttle.NodeBandwidthPerSec = limitBytes
+	throttle.Limiter = rate.NewLimiter(rate.Limit(float64(limitBytes)), int(limitBytes))
+	m.bucketsThrottle[BucketOptions{Name: bucket, ReplicationARN: arn}] = throttle
+}
+
+// IsThrottled returns true if a bucket has bandwidth throttling enabled.
+func (m *Monitor) IsThrottled(bucket, arn string) bool {
+	m.tlock.RLock()
+	defer m.tlock.RUnlock()
+	_, ok := m.bucketsThrottle[BucketOptions{Name: bucket, ReplicationARN: arn}]
+	return ok
+}

internal/bucket/bandwidth/monitor_gen.go

@@ -0,0 +1,220 @@
+// Code generated by github.com/tinylib/msgp DO NOT EDIT.
+
+package bandwidth
+
+import (
+	"github.com/tinylib/msgp/msgp"
+)
+
+// DecodeMsg implements msgp.Decodable
+func (z *BucketBandwidthReport) DecodeMsg(dc *msgp.Reader) (err error) {
+	var field []byte
+	_ = field
+	var zb0001 uint32
+	zb0001, err = dc.ReadMapHeader()
+	if err != nil {
+		err = msgp.WrapError(err)
+		return
+	}
+	for zb0001 > 0 {
+		zb0001--
+		field, err = dc.ReadMapKeyPtr()
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		switch msgp.UnsafeString(field) {
+		default:
+			err = dc.Skip()
+			if err != nil {
+				err = msgp.WrapError(err)
+				return
+			}
+		}
+	}
+	return
+}
+
+// EncodeMsg implements msgp.Encodable
+func (z BucketBandwidthReport) EncodeMsg(en *msgp.Writer) (err error) {
+	// map header, size 0
+	_ = z
+	err = en.Append(0x80)
+	if err != nil {
+		return
+	}
+	return
+}
+
+// MarshalMsg implements msgp.Marshaler
+func (z BucketBandwidthReport) MarshalMsg(b []byte) (o []byte, err error) {
+	o = msgp.Require(b, z.Msgsize())
+	// map header, size 0
+	_ = z
+	o = append(o, 0x80)
+	return
+}
+
+// UnmarshalMsg implements msgp.Unmarshaler
+func (z *BucketBandwidthReport) UnmarshalMsg(bts []byte) (o []byte, err error) {
+	var field []byte
+	_ = field
+	var zb0001 uint32
+	zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
+	if err != nil {
+		err = msgp.WrapError(err)
+		return
+	}
+	for zb0001 > 0 {
+		zb0001--
+		field, bts, err = msgp.ReadMapKeyZC(bts)
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		switch msgp.UnsafeString(field) {
+		default:
+			bts, err = msgp.Skip(bts)
+			if err != nil {
+				err = msgp.WrapError(err)
+				return
+			}
+		}
+	}
+	o = bts
+	return
+}
+
+// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
+func (z BucketBandwidthReport) Msgsize() (s int) {
+	s = 1
+	return
+}
+
+// DecodeMsg implements msgp.Decodable
+func (z *Details) DecodeMsg(dc *msgp.Reader) (err error) {
+	var field []byte
+	_ = field
+	var zb0001 uint32
+	zb0001, err = dc.ReadMapHeader()
+	if err != nil {
+		err = msgp.WrapError(err)
+		return
+	}
+	for zb0001 > 0 {
+		zb0001--
+		field, err = dc.ReadMapKeyPtr()
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		switch msgp.UnsafeString(field) {
+		case "LimitInBytesPerSecond":
+			z.LimitInBytesPerSecond, err = dc.ReadInt64()
+			if err != nil {
+				err = msgp.WrapError(err, "LimitInBytesPerSecond")
+				return
+			}
+		case "CurrentBandwidthInBytesPerSecond":
+			z.CurrentBandwidthInBytesPerSecond, err = dc.ReadFloat64()
+			if err != nil {
+				err = msgp.WrapError(err, "CurrentBandwidthInBytesPerSecond")
+				return
+			}
+		default:
+			err = dc.Skip()
+			if err != nil {
+				err = msgp.WrapError(err)
+				return
+			}
+		}
+	}
+	return
+}
+
+// EncodeMsg implements msgp.Encodable
+func (z Details) EncodeMsg(en *msgp.Writer) (err error) {
+	// map header, size 2
+	// write "LimitInBytesPerSecond"
+	err = en.Append(0x82, 0xb5, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x49, 0x6e, 0x42, 0x79, 0x74, 0x65, 0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64)
+	if err != nil {
+		return
+	}
+	err = en.WriteInt64(z.LimitInBytesPerSecond)
+	if err != nil {
+		err = msgp.WrapError(err, "LimitInBytesPerSecond")
+		return
+	}
+	// write "CurrentBandwidthInBytesPerSecond"
+	err = en.Append(0xd9, 0x20, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x42, 0x61, 0x6e, 0x64, 0x77, 0x69, 0x64, 0x74, 0x68, 0x49, 0x6e, 0x42, 0x79, 0x74, 0x65, 0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64)
+	if err != nil {
+		return
+	}
+	err = en.WriteFloat64(z.CurrentBandwidthInBytesPerSecond)
+	if err != nil {
+		err = msgp.WrapError(err, "CurrentBandwidthInBytesPerSecond")
+		return
+	}
+	return
+}
+
+// MarshalMsg implements msgp.Marshaler
+func (z Details) MarshalMsg(b []byte) (o []byte, err error) {
+	o = msgp.Require(b, z.Msgsize())
+	// map header, size 2
+	// string "LimitInBytesPerSecond"
+	o = append(o, 0x82, 0xb5, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x49, 0x6e, 0x42, 0x79, 0x74, 0x65, 0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64)
+	o = msgp.AppendInt64(o, z.LimitInBytesPerSecond)
+	// string "CurrentBandwidthInBytesPerSecond"
+	o = append(o, 0xd9, 0x20, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x42, 0x61, 0x6e, 0x64, 0x77, 0x69, 0x64, 0x74, 0x68, 0x49, 0x6e, 0x42, 0x79, 0x74, 0x65, 0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64)
+	o = msgp.AppendFloat64(o, z.CurrentBandwidthInBytesPerSecond)
+	return
+}
+
+// UnmarshalMsg implements msgp.Unmarshaler
+func (z *Details) UnmarshalMsg(bts []byte) (o []byte, err error) {
+	var field []byte
+	_ = field
+	var zb0001 uint32
+	zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
+	if err != nil {
+		err = msgp.WrapError(err)
+		return
+	}
+	for zb0001 > 0 {
+		zb0001--
+		field, bts, err = msgp.ReadMapKeyZC(bts)
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		switch msgp.UnsafeString(field) {
+		case "LimitInBytesPerSecond":
+			z.LimitInBytesPerSecond, bts, err = msgp.ReadInt64Bytes(bts)
+			if err != nil {
+				err = msgp.WrapError(err, "LimitInBytesPerSecond")
+				return
+			}
+		case "CurrentBandwidthInBytesPerSecond":
+			z.CurrentBandwidthInBytesPerSecond, bts, err = msgp.ReadFloat64Bytes(bts)
+			if err != nil {
+				err = msgp.WrapError(err, "CurrentBandwidthInBytesPerSecond")
+				return
+			}
+		default:
+			bts, err = msgp.Skip(bts)
+			if err != nil {
+				err = msgp.WrapError(err)
+				return
+			}
+		}
+	}
+	o = bts
+	return
+}
+
+// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
+func (z Details) Msgsize() (s int) {
+	s = 1 + 22 + msgp.Int64Size + 34 + msgp.Float64Size
+	return
+}

internal/bucket/bandwidth/monitor_gen_test.go

@@ -0,0 +1,236 @@
+// Code generated by github.com/tinylib/msgp DO NOT EDIT.
+
+package bandwidth
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/tinylib/msgp/msgp"
+)
+
+func TestMarshalUnmarshalBucketBandwidthReport(t *testing.T) {
+	v := BucketBandwidthReport{}
+	bts, err := v.MarshalMsg(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	left, err := v.UnmarshalMsg(bts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) > 0 {
+		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
+	}
+
+	left, err = msgp.Skip(bts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) > 0 {
+		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
+	}
+}
+
+func BenchmarkMarshalMsgBucketBandwidthReport(b *testing.B) {
+	v := BucketBandwidthReport{}
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		v.MarshalMsg(nil)
+	}
+}
+
+func BenchmarkAppendMsgBucketBandwidthReport(b *testing.B) {
+	v := BucketBandwidthReport{}
+	bts := make([]byte, 0, v.Msgsize())
+	bts, _ = v.MarshalMsg(bts[0:0])
+	b.SetBytes(int64(len(bts)))
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		bts, _ = v.MarshalMsg(bts[0:0])
+	}
+}
+
+func BenchmarkUnmarshalBucketBandwidthReport(b *testing.B) {
+	v := BucketBandwidthReport{}
+	bts, _ := v.MarshalMsg(nil)
+	b.ReportAllocs()
+	b.SetBytes(int64(len(bts)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := v.UnmarshalMsg(bts)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func TestEncodeDecodeBucketBandwidthReport(t *testing.T) {
+	v := BucketBandwidthReport{}
+	var buf bytes.Buffer
+	msgp.Encode(&buf, &v)
+
+	m := v.Msgsize()
+	if buf.Len() > m {
+		t.Log("WARNING: TestEncodeDecodeBucketBandwidthReport Msgsize() is inaccurate")
+	}
+
+	vn := BucketBandwidthReport{}
+	err := msgp.Decode(&buf, &vn)
+	if err != nil {
+		t.Error(err)
+	}
+
+	buf.Reset()
+	msgp.Encode(&buf, &v)
+	err = msgp.NewReader(&buf).Skip()
+	if err != nil {
+		t.Error(err)
+	}
+}
+
+func BenchmarkEncodeBucketBandwidthReport(b *testing.B) {
+	v := BucketBandwidthReport{}
+	var buf bytes.Buffer
+	msgp.Encode(&buf, &v)
+	b.SetBytes(int64(buf.Len()))
+	en := msgp.NewWriter(msgp.Nowhere)
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		v.EncodeMsg(en)
+	}
+	en.Flush()
+}
+
+func BenchmarkDecodeBucketBandwidthReport(b *testing.B) {
+	v := BucketBandwidthReport{}
+	var buf bytes.Buffer
+	msgp.Encode(&buf, &v)
+	b.SetBytes(int64(buf.Len()))
+	rd := msgp.NewEndlessReader(buf.Bytes(), b)
+	dc := msgp.NewReader(rd)
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		err := v.DecodeMsg(dc)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func TestMarshalUnmarshalDetails(t *testing.T) {
+	v := Details{}
+	bts, err := v.MarshalMsg(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	left, err := v.UnmarshalMsg(bts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) > 0 {
+		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
+	}
+
+	left, err = msgp.Skip(bts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) > 0 {
+		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
+	}
+}
+
+func BenchmarkMarshalMsgDetails(b *testing.B) {
+	v := Details{}
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		v.MarshalMsg(nil)
+	}
+}
+
+func BenchmarkAppendMsgDetails(b *testing.B) {
+	v := Details{}
+	bts := make([]byte, 0, v.Msgsize())
+	bts, _ = v.MarshalMsg(bts[0:0])
+	b.SetBytes(int64(len(bts)))
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		bts, _ = v.MarshalMsg(bts[0:0])
+	}
+}
+
+func BenchmarkUnmarshalDetails(b *testing.B) {
+	v := Details{}
+	bts, _ := v.MarshalMsg(nil)
+	b.ReportAllocs()
+	b.SetBytes(int64(len(bts)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := v.UnmarshalMsg(bts)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func TestEncodeDecodeDetails(t *testing.T) {
+	v := Details{}
+	var buf bytes.Buffer
+	msgp.Encode(&buf, &v)
+
+	m := v.Msgsize()
+	if buf.Len() > m {
+		t.Log("WARNING: TestEncodeDecodeDetails Msgsize() is inaccurate")
+	}
+
+	vn := Details{}
+	err := msgp.Decode(&buf, &vn)
+	if err != nil {
+		t.Error(err)
+	}
+
+	buf.Reset()
+	msgp.Encode(&buf, &v)
+	err = msgp.NewReader(&buf).Skip()
+	if err != nil {
+		t.Error(err)
+	}
+}
+
+func BenchmarkEncodeDetails(b *testing.B) {
+	v := Details{}
+	var buf bytes.Buffer
+	msgp.Encode(&buf, &v)
+	b.SetBytes(int64(buf.Len()))
+	en := msgp.NewWriter(msgp.Nowhere)
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		v.EncodeMsg(en)
+	}
+	en.Flush()
+}
+
+func BenchmarkDecodeDetails(b *testing.B) {
+	v := Details{}
+	var buf bytes.Buffer
+	msgp.Encode(&buf, &v)
+	b.SetBytes(int64(buf.Len()))
+	rd := msgp.NewEndlessReader(buf.Bytes(), b)
+	dc := msgp.NewReader(rd)
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		err := v.DecodeMsg(dc)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}

internal/bucket/bandwidth/monitor_test.go

@@ -0,0 +1,127 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package bandwidth
+
+import (
+	"reflect"
+	"testing"
+	"time"
+)
+
+const (
+	oneMiB uint64 = 1024 * 1024
+)
+
+func TestMonitor_GetReport(t *testing.T) {
+	type fields struct {
+		activeBuckets map[BucketOptions]*bucketMeasurement
+		endTime       time.Time
+		update2       uint64
+		endTime2      time.Time
+	}
+	start := time.Now()
+	m0 := newBucketMeasurement(start)
+	m0.incrementBytes(0)
+	m1MiBPS := newBucketMeasurement(start)
+	m1MiBPS.incrementBytes(oneMiB)
+
+	test1Want := make(map[BucketOptions]Details)
+	test1Want[BucketOptions{Name: "bucket", ReplicationARN: "arn"}] = Details{LimitInBytesPerSecond: 1024 * 1024, CurrentBandwidthInBytesPerSecond: 0}
+	test1Want2 := make(map[BucketOptions]Details)
+	test1Want2[BucketOptions{Name: "bucket", ReplicationARN: "arn"}] = Details{
+		LimitInBytesPerSecond:            1024 * 1024,
+		CurrentBandwidthInBytesPerSecond: (1024 * 1024) / start.Add(2*time.Second).Sub(start.Add(1*time.Second)).Seconds(),
+	}
+
+	test2Want := make(map[BucketOptions]Details)
+	test2Want[BucketOptions{Name: "bucket", ReplicationARN: "arn"}] = Details{LimitInBytesPerSecond: 1024 * 1024, CurrentBandwidthInBytesPerSecond: float64(oneMiB)}
+	test2Want2 := make(map[BucketOptions]Details)
+	test2Want2[BucketOptions{Name: "bucket", ReplicationARN: "arn"}] = Details{
+		LimitInBytesPerSecond:            1024 * 1024,
+		CurrentBandwidthInBytesPerSecond: exponentialMovingAverage(betaBucket, float64(oneMiB), 2*float64(oneMiB)),
+	}
+
+	test1ActiveBuckets := make(map[BucketOptions]*bucketMeasurement)
+	test1ActiveBuckets[BucketOptions{Name: "bucket", ReplicationARN: "arn"}] = m0
+	test1ActiveBuckets2 := make(map[BucketOptions]*bucketMeasurement)
+	test1ActiveBuckets2[BucketOptions{Name: "bucket", ReplicationARN: "arn"}] = m1MiBPS
+
+	tests := []struct {
+		name   string
+		fields fields
+		want   *BucketBandwidthReport
+		want2  *BucketBandwidthReport
+	}{
+		{
+			name: "ZeroToOne",
+			fields: fields{
+				activeBuckets: test1ActiveBuckets,
+				endTime:       start.Add(1 * time.Second),
+				update2:       oneMiB,
+				endTime2:      start.Add(2 * time.Second),
+			},
+			want: &BucketBandwidthReport{
+				BucketStats: test1Want,
+			},
+			want2: &BucketBandwidthReport{
+				BucketStats: test1Want2,
+			},
+		},
+		{
+			name: "OneToTwo",
+			fields: fields{
+				activeBuckets: test1ActiveBuckets2,
+				endTime:       start.Add(1 * time.Second),
+				update2:       2 * oneMiB,
+				endTime2:      start.Add(2 * time.Second),
+			},
+			want: &BucketBandwidthReport{
+				BucketStats: test2Want,
+			},
+			want2: &BucketBandwidthReport{
+				BucketStats: test2Want2,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			thr := bucketThrottle{
+				NodeBandwidthPerSec: 1024 * 1024,
+			}
+			th := make(map[BucketOptions]*bucketThrottle)
+			th[BucketOptions{Name: "bucket", ReplicationARN: "arn"}] = &thr
+			m := &Monitor{
+				bucketsMeasurement: tt.fields.activeBuckets,
+				bucketsThrottle:    th,
+				NodeCount:          1,
+			}
+			m.bucketsMeasurement[BucketOptions{Name: "bucket", ReplicationARN: "arn"}].updateExponentialMovingAverage(tt.fields.endTime)
+			got := m.GetReport(SelectBuckets())
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("GetReport() = %v, want %v", got, tt.want)
+			}
+			m.bucketsMeasurement[BucketOptions{Name: "bucket", ReplicationARN: "arn"}].incrementBytes(tt.fields.update2)
+			m.bucketsMeasurement[BucketOptions{Name: "bucket", ReplicationARN: "arn"}].updateExponentialMovingAverage(tt.fields.endTime2)
+			got = m.GetReport(SelectBuckets())
+			if !reflect.DeepEqual(got.BucketStats, tt.want2.BucketStats) {
+				t.Errorf("GetReport() = %v, want %v", got.BucketStats, tt.want2.BucketStats)
+			}
+		})
+	}
+}

internal/bucket/bandwidth/reader.go

@@ -0,0 +1,107 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package bandwidth
+
+import (
+	"context"
+	"io"
+	"math"
+)
+
+// MonitoredReader represents a throttled reader subject to bandwidth monitoring
+type MonitoredReader struct {
+	r        io.Reader
+	throttle *bucketThrottle
+	ctx      context.Context // request context
+	lastErr  error           // last error reported, if this non-nil all reads will fail.
+	m        *Monitor
+	opts     *MonitorReaderOptions
+}
+
+// BucketOptions represents the bucket and optionally its replication target pair.
+type BucketOptions struct {
+	Name           string
+	ReplicationARN string // This is optional, and not mandatory.
+}
+
+// MonitorReaderOptions provides configurable options for monitor reader implementation.
+type MonitorReaderOptions struct {
+	BucketOptions
+	HeaderSize int
+}
+
+// Read implements a throttled read
+func (r *MonitoredReader) Read(buf []byte) (n int, err error) {
+	if r.throttle == nil {
+		return r.r.Read(buf)
+	}
+	if r.lastErr != nil {
+		err = r.lastErr
+		return n, err
+	}
+	b := r.throttle.Burst()  // maximum available tokens
+	need := len(buf)         // number of bytes requested by caller
+	hdr := r.opts.HeaderSize // remaining header bytes
+	var tokens int           // number of tokens to request
+
+	if hdr > 0 { // available tokens go towards header first
+		if hdr < b { // all of header can be accommodated
+			r.opts.HeaderSize = 0
+			need = int(math.Min(float64(b-hdr), float64(need))) // use remaining tokens towards payload
+			tokens = need + hdr
+		} else { // part of header can be accommodated
+			r.opts.HeaderSize -= b - 1
+			need = 1 // to ensure we read at least one byte for every Read
+			tokens = b
+		}
+	} else { // all tokens go towards payload
+		need = int(math.Min(float64(b), float64(need)))
+		tokens = need
+	}
+	// reduce tokens requested according to availability
+	av := int(r.throttle.Tokens())
+	if av < tokens && av > 0 {
+		tokens = av
+		need = int(math.Min(float64(tokens), float64(need)))
+	}
+	err = r.throttle.WaitN(r.ctx, tokens)
+	if err != nil {
+		return n, err
+	}
+	n, err = r.r.Read(buf[:need])
+	if err != nil {
+		r.lastErr = err
+		return n, err
+	}
+	r.m.updateMeasurement(r.opts.BucketOptions, uint64(tokens))
+	return n, err
+}
+
+// NewMonitoredReader returns reference to a monitored reader that throttles reads to configured bandwidth for the
+// bucket.
+func NewMonitoredReader(ctx context.Context, m *Monitor, r io.Reader, opts *MonitorReaderOptions) *MonitoredReader {
+	reader := MonitoredReader{
+		r:        r,
+		throttle: m.throttle(opts.BucketOptions),
+		m:        m,
+		opts:     opts,
+		ctx:      ctx,
+	}
+	reader.m.init(opts.BucketOptions)
+	return &reader
+}

internal/bucket/encryption/bucket-sse-config.go

@@ -0,0 +1,171 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package sse
+
+import (
+	"encoding/xml"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/minio/minio/internal/crypto"
+	xhttp "github.com/minio/minio/internal/http"
+)
+
+const (
+	// AES256 is used with SSE-S3
+	AES256 Algorithm = "AES256"
+	// AWSKms is used with SSE-KMS
+	AWSKms Algorithm = "aws:kms"
+)
+
+// Algorithm - represents valid SSE algorithms supported; currently only AES256 is supported
+type Algorithm string
+
+// UnmarshalXML - Unmarshals XML tag to valid SSE algorithm
+func (alg *Algorithm) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	var s string
+	if err := d.DecodeElement(&s, &start); err != nil {
+		return err
+	}
+
+	switch s {
+	case string(AES256):
+		*alg = AES256
+	case string(AWSKms):
+		*alg = AWSKms
+	default:
+		return errors.New("Unknown SSE algorithm")
+	}
+
+	return nil
+}
+
+// MarshalXML - Marshals given SSE algorithm to valid XML
+func (alg *Algorithm) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	return e.EncodeElement(string(*alg), start)
+}
+
+// EncryptionAction - for ApplyServerSideEncryptionByDefault XML tag
+type EncryptionAction struct {
+	Algorithm   Algorithm `xml:"SSEAlgorithm,omitempty"`
+	MasterKeyID string    `xml:"KMSMasterKeyID,omitempty"`
+}
+
+// Rule - for ServerSideEncryptionConfiguration XML tag
+type Rule struct {
+	DefaultEncryptionAction EncryptionAction `xml:"ApplyServerSideEncryptionByDefault"`
+}
+
+const xmlNS = "http://s3.amazonaws.com/doc/2006-03-01/"
+
+// BucketSSEConfig - represents default bucket encryption configuration
+type BucketSSEConfig struct {
+	XMLNS   string   `xml:"xmlns,attr,omitempty"`
+	XMLName xml.Name `xml:"ServerSideEncryptionConfiguration"`
+	Rules   []Rule   `xml:"Rule"`
+}
+
+// ParseBucketSSEConfig - Decodes given XML to a valid default bucket encryption config
+func ParseBucketSSEConfig(r io.Reader) (*BucketSSEConfig, error) {
+	var config BucketSSEConfig
+	err := xml.NewDecoder(r).Decode(&config)
+	if err != nil {
+		return nil, err
+	}
+
+	// Validates server-side encryption config rules
+	// Only one rule is allowed on AWS S3
+	if len(config.Rules) != 1 {
+		return nil, errors.New("only one server-side encryption rule is allowed at a time")
+	}
+
+	for _, rule := range config.Rules {
+		switch rule.DefaultEncryptionAction.Algorithm {
+		case AES256:
+			if rule.DefaultEncryptionAction.MasterKeyID != "" {
+				return nil, errors.New("MasterKeyID is allowed with aws:kms only")
+			}
+		case AWSKms:
+			keyID := rule.DefaultEncryptionAction.MasterKeyID
+			if keyID == "" {
+				return nil, errors.New("MasterKeyID is missing with aws:kms")
+			}
+			spaces := strings.HasPrefix(keyID, " ") || strings.HasSuffix(keyID, " ")
+			if spaces {
+				return nil, errors.New("MasterKeyID contains unsupported characters")
+			}
+		}
+	}
+
+	if config.XMLNS == "" {
+		config.XMLNS = xmlNS
+	}
+	return &config, nil
+}
+
+// ApplyOptions ask for specific features to be enabled,
+// when bucketSSEConfig is empty.
+type ApplyOptions struct {
+	AutoEncrypt bool
+}
+
+// Apply applies the SSE bucket configuration on the given HTTP headers and
+// sets the specified SSE headers.
+//
+// Apply does not overwrite any existing SSE headers. Further, it will
+// set minimal SSE-KMS headers if autoEncrypt is true and the BucketSSEConfig
+// is nil.
+func (b *BucketSSEConfig) Apply(headers http.Header, opts ApplyOptions) {
+	if crypto.Requested(headers) {
+		return
+	}
+	if b == nil {
+		if opts.AutoEncrypt {
+			headers.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
+		}
+		return
+	}
+
+	switch b.Algo() {
+	case xhttp.AmzEncryptionAES:
+		headers.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionAES)
+	case xhttp.AmzEncryptionKMS:
+		headers.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
+		headers.Set(xhttp.AmzServerSideEncryptionKmsID, b.KeyID())
+	}
+}
+
+// Algo returns the SSE algorithm specified by the SSE configuration.
+func (b *BucketSSEConfig) Algo() Algorithm {
+	for _, rule := range b.Rules {
+		return rule.DefaultEncryptionAction.Algorithm
+	}
+	return ""
+}
+
+// KeyID returns the KMS key ID specified by the SSE configuration.
+// If the SSE configuration does not specify SSE-KMS it returns an
+// empty key ID.
+func (b *BucketSSEConfig) KeyID() string {
+	for _, rule := range b.Rules {
+		return strings.TrimPrefix(rule.DefaultEncryptionAction.MasterKeyID, crypto.ARNPrefix)
+	}
+	return ""
+}

internal/bucket/encryption/bucket-sse-config_test.go

@@ -0,0 +1,153 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package sse
+
+import (
+	"bytes"
+	"encoding/xml"
+	"errors"
+	"testing"
+)
+
+// TestParseBucketSSEConfig performs basic sanity tests on ParseBucketSSEConfig
+func TestParseBucketSSEConfig(t *testing.T) {
+	actualAES256NoNSConfig := &BucketSSEConfig{
+		XMLName: xml.Name{
+			Local: "ServerSideEncryptionConfiguration",
+		},
+		Rules: []Rule{
+			{
+				DefaultEncryptionAction: EncryptionAction{
+					Algorithm: AES256,
+				},
+			},
+		},
+	}
+
+	actualAES256Config := &BucketSSEConfig{
+		XMLNS: xmlNS,
+		XMLName: xml.Name{
+			Local: "ServerSideEncryptionConfiguration",
+		},
+		Rules: []Rule{
+			{
+				DefaultEncryptionAction: EncryptionAction{
+					Algorithm: AES256,
+				},
+			},
+		},
+	}
+
+	actualKMSConfig := &BucketSSEConfig{
+		XMLNS: xmlNS,
+		XMLName: xml.Name{
+			Local: "ServerSideEncryptionConfiguration",
+		},
+		Rules: []Rule{
+			{
+				DefaultEncryptionAction: EncryptionAction{
+					Algorithm:   AWSKms,
+					MasterKeyID: "arn:aws:kms:my-minio-key",
+				},
+			},
+		},
+	}
+
+	testCases := []struct {
+		inputXML       string
+		keyID          string
+		expectedErr    error
+		shouldPass     bool
+		expectedConfig *BucketSSEConfig
+	}{
+		// 1. Valid XML SSE-S3
+		{
+			inputXML:       `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr:    nil,
+			shouldPass:     true,
+			expectedConfig: actualAES256Config,
+		},
+		// 2. Valid XML SSE-KMS
+		{
+			inputXML:       `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>aws:kms</SSEAlgorithm><KMSMasterKeyID>arn:aws:kms:my-minio-key</KMSMasterKeyID></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr:    nil,
+			shouldPass:     true,
+			expectedConfig: actualKMSConfig,
+			keyID:          "my-minio-key",
+		},
+		// 3. Invalid - more than one rule
+		{
+			inputXML:    `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr: errors.New("only one server-side encryption rule is allowed at a time"),
+			shouldPass:  false,
+		},
+		// 4. Invalid XML - master key ID present along with AES256
+		{
+			inputXML:    `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm><KMSMasterKeyID>arn:aws:kms:us-east-1:1234/5678example</KMSMasterKeyID></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr: errors.New("MasterKeyID is allowed with aws:kms only"),
+			shouldPass:  false,
+		},
+		// 5. Invalid XML - master key ID not provided when algorithm is set to aws:kms algorithm
+		{
+			inputXML:    `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>aws:kms</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr: errors.New("MasterKeyID is missing with aws:kms"),
+			shouldPass:  false,
+		},
+		// 6. Invalid Algorithm
+		{
+			inputXML:    `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>InvalidAlgorithm</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr: errors.New("Unknown SSE algorithm"),
+			shouldPass:  false,
+		},
+		// 7. Valid XML without the namespace set
+		{
+			inputXML:       `<ServerSideEncryptionConfiguration><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr:    nil,
+			shouldPass:     true,
+			expectedConfig: actualAES256NoNSConfig,
+		},
+		// 8. Space characters in MasterKeyID
+		{
+			inputXML:    `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>aws:kms</SSEAlgorithm><KMSMasterKeyID> arn:aws:kms:my-minio-key </KMSMasterKeyID></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
+			expectedErr: errors.New("MasterKeyID contains unsupported characters"),
+			shouldPass:  false,
+		},
+	}
+
+	for i, tc := range testCases {
+		ssec, err := ParseBucketSSEConfig(bytes.NewReader([]byte(tc.inputXML)))
+		if tc.shouldPass && err != nil {
+			t.Errorf("Test case %d: Expected to succeed but got %s", i+1, err)
+		}
+
+		if !tc.shouldPass {
+			if err == nil || err != nil && err.Error() != tc.expectedErr.Error() {
+				t.Errorf("Test case %d: Expected %s but got %s", i+1, tc.expectedErr, err)
+			}
+			continue
+		}
+
+		if tc.keyID != "" && tc.keyID != ssec.KeyID() {
+			t.Errorf("Test case %d: Expected bucket encryption KeyID %s but got %s", i+1, tc.keyID, ssec.KeyID())
+		}
+
+		if expectedXML, err := xml.Marshal(tc.expectedConfig); err != nil || !bytes.Equal(expectedXML, []byte(tc.inputXML)) {
+			t.Errorf("Test case %d: Expected bucket encryption XML %s but got %s", i+1, string(expectedXML), tc.inputXML)
+		}
+	}
+}

internal/bucket/lifecycle/action_string.go

@@ -0,0 +1,32 @@
+// Code generated by "stringer -type Action lifecycle.go"; DO NOT EDIT.
+
+package lifecycle
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[NoneAction-0]
+	_ = x[DeleteAction-1]
+	_ = x[DeleteVersionAction-2]
+	_ = x[TransitionAction-3]
+	_ = x[TransitionVersionAction-4]
+	_ = x[DeleteRestoredAction-5]
+	_ = x[DeleteRestoredVersionAction-6]
+	_ = x[DeleteAllVersionsAction-7]
+	_ = x[DelMarkerDeleteAllVersionsAction-8]
+	_ = x[ActionCount-9]
+}
+
+const _Action_name = "NoneActionDeleteActionDeleteVersionActionTransitionActionTransitionVersionActionDeleteRestoredActionDeleteRestoredVersionActionDeleteAllVersionsActionDelMarkerDeleteAllVersionsActionActionCount"
+
+var _Action_index = [...]uint8{0, 10, 22, 41, 57, 80, 100, 127, 150, 182, 193}
+
+func (i Action) String() string {
+	if i < 0 || i >= Action(len(_Action_index)-1) {
+		return "Action(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _Action_name[_Action_index[i]:_Action_index[i+1]]
+}

internal/bucket/lifecycle/and.go

@@ -0,0 +1,105 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+)
+
+var errDuplicateTagKey = Errorf("Duplicate Tag Keys are not allowed")
+
+// And - a tag to combine a prefix and multiple tags for lifecycle configuration rule.
+type And struct {
+	XMLName               xml.Name `xml:"And"`
+	ObjectSizeGreaterThan int64    `xml:"ObjectSizeGreaterThan,omitempty"`
+	ObjectSizeLessThan    int64    `xml:"ObjectSizeLessThan,omitempty"`
+	Prefix                Prefix   `xml:"Prefix,omitempty"`
+	Tags                  []Tag    `xml:"Tag,omitempty"`
+}
+
+// isEmpty returns true if Tags field is null
+func (a And) isEmpty() bool {
+	return len(a.Tags) == 0 && !a.Prefix.set &&
+		a.ObjectSizeGreaterThan == 0 && a.ObjectSizeLessThan == 0
+}
+
+// Validate - validates the And field
+func (a And) Validate() error {
+	// > This is used in a Lifecycle Rule Filter to apply a logical AND to two or more predicates.
+	// ref: https://docs.aws.amazon.com/AmazonS3/latest/API/API_LifecycleRuleAndOperator.html
+	// i.e, predCount >= 2
+	var predCount int
+	if a.Prefix.set {
+		predCount++
+	}
+	predCount += len(a.Tags)
+	if a.ObjectSizeGreaterThan > 0 {
+		predCount++
+	}
+	if a.ObjectSizeLessThan > 0 {
+		predCount++
+	}
+
+	if predCount < 2 {
+		return errXMLNotWellFormed
+	}
+
+	if a.ContainsDuplicateTag() {
+		return errDuplicateTagKey
+	}
+	for _, t := range a.Tags {
+		if err := t.Validate(); err != nil {
+			return err
+		}
+	}
+
+	if a.ObjectSizeGreaterThan < 0 || a.ObjectSizeLessThan < 0 {
+		return errXMLNotWellFormed
+	}
+	return nil
+}
+
+// ContainsDuplicateTag - returns true if duplicate keys are present in And
+func (a And) ContainsDuplicateTag() bool {
+	x := make(map[string]struct{}, len(a.Tags))
+
+	for _, t := range a.Tags {
+		if _, has := x[t.Key]; has {
+			return true
+		}
+		x[t.Key] = struct{}{}
+	}
+
+	return false
+}
+
+// BySize returns true when sz satisfies a
+// ObjectSizeLessThan/ObjectSizeGreaterthan or a logical AND of these predicates
+// Note: And combines size and other predicates like Tags, Prefix, etc. This
+// method applies exclusively to size predicates only.
+func (a And) BySize(sz int64) bool {
+	if a.ObjectSizeGreaterThan > 0 &&
+		sz <= a.ObjectSizeGreaterThan {
+		return false
+	}
+	if a.ObjectSizeLessThan > 0 &&
+		sz >= a.ObjectSizeLessThan {
+		return false
+	}
+	return true
+}

internal/bucket/lifecycle/delmarker-expiration.go

@@ -0,0 +1,74 @@
+// Copyright (c) 2024 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"time"
+)
+
+var errInvalidDaysDelMarkerExpiration = Errorf("Days must be a positive integer with DelMarkerExpiration")
+
+// DelMarkerExpiration used to xml encode/decode ILM action by the same name
+type DelMarkerExpiration struct {
+	XMLName xml.Name `xml:"DelMarkerExpiration"`
+	Days    int      `xml:"Days,omitempty"`
+}
+
+// Empty returns if a DelMarkerExpiration XML element is empty.
+// Used to detect if lifecycle.Rule contained a DelMarkerExpiration element.
+func (de DelMarkerExpiration) Empty() bool {
+	return de.Days == 0
+}
+
+// UnmarshalXML decodes a single XML element into a DelMarkerExpiration value
+func (de *DelMarkerExpiration) UnmarshalXML(dec *xml.Decoder, start xml.StartElement) error {
+	type delMarkerExpiration DelMarkerExpiration
+	var dexp delMarkerExpiration
+	err := dec.DecodeElement(&dexp, &start)
+	if err != nil {
+		return err
+	}
+
+	if dexp.Days <= 0 {
+		return errInvalidDaysDelMarkerExpiration
+	}
+
+	*de = DelMarkerExpiration(dexp)
+	return nil
+}
+
+// MarshalXML encodes a DelMarkerExpiration value into an XML element
+func (de DelMarkerExpiration) MarshalXML(enc *xml.Encoder, start xml.StartElement) error {
+	if de.Empty() {
+		return nil
+	}
+
+	type delMarkerExpiration DelMarkerExpiration
+	return enc.EncodeElement(delMarkerExpiration(de), start)
+}
+
+// NextDue returns upcoming DelMarkerExpiration date for obj if
+// applicable, returns false otherwise.
+func (de DelMarkerExpiration) NextDue(obj ObjectOpts) (time.Time, bool) {
+	if !obj.IsLatest || !obj.DeleteMarker {
+		return time.Time{}, false
+	}
+
+	return ExpectedExpiryTime(obj.ModTime, de.Days), true
+}

internal/bucket/lifecycle/delmarker-expiration_test.go

@@ -0,0 +1,63 @@
+// Copyright (c) 2024 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"fmt"
+	"testing"
+)
+
+func TestDelMarkerExpParseAndValidate(t *testing.T) {
+	tests := []struct {
+		xml string
+		err error
+	}{
+		{
+			xml: `<DelMarkerExpiration> <Days> 1 </Days> </DelMarkerExpiration>`,
+			err: nil,
+		},
+		{
+			xml: `<DelMarkerExpiration> <Days> -1 </Days> </DelMarkerExpiration>`,
+			err: errInvalidDaysDelMarkerExpiration,
+		},
+	}
+
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("TestDelMarker-%d", i), func(t *testing.T) {
+			var dexp DelMarkerExpiration
+			var fail bool
+			err := xml.Unmarshal([]byte(test.xml), &dexp)
+			if test.err == nil {
+				if err != nil {
+					fail = true
+				}
+			} else {
+				if err == nil {
+					fail = true
+				}
+				if test.err.Error() != err.Error() {
+					fail = true
+				}
+			}
+			if fail {
+				t.Fatalf("Expected %v but got %v", test.err, err)
+			}
+		})
+	}
+}

internal/bucket/lifecycle/error.go

@@ -0,0 +1,45 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"fmt"
+)
+
+// Error is the generic type for any error happening during tag
+// parsing.
+type Error struct {
+	err error
+}
+
+// Errorf - formats according to a format specifier and returns
+// the string as a value that satisfies error of type tagging.Error
+func Errorf(format string, a ...any) error {
+	return Error{err: fmt.Errorf(format, a...)}
+}
+
+// Unwrap the internal error.
+func (e Error) Unwrap() error { return e.err }
+
+// Error 'error' compatible method.
+func (e Error) Error() string {
+	if e.err == nil {
+		return "lifecycle: cause <nil>"
+	}
+	return e.err.Error()
+}

internal/bucket/lifecycle/evaluator.go

@@ -0,0 +1,156 @@
+// Copyright (c) 2015-2025 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"fmt"
+	"time"
+
+	objlock "github.com/minio/minio/internal/bucket/object/lock"
+	"github.com/minio/minio/internal/bucket/replication"
+)
+
+// Evaluator - evaluates lifecycle policy on objects for the given lifecycle
+// configuration, lock retention configuration and replication configuration.
+type Evaluator struct {
+	policy        Lifecycle
+	lockRetention *objlock.Retention
+	replCfg       *replication.Config
+}
+
+// NewEvaluator - creates a new evaluator with the given lifecycle
+func NewEvaluator(policy Lifecycle) *Evaluator {
+	return &Evaluator{
+		policy: policy,
+	}
+}
+
+// WithLockRetention - sets the lock retention configuration for the evaluator
+func (e *Evaluator) WithLockRetention(lr *objlock.Retention) *Evaluator {
+	e.lockRetention = lr
+	return e
+}
+
+// WithReplicationConfig - sets the replication configuration for the evaluator
+func (e *Evaluator) WithReplicationConfig(rcfg *replication.Config) *Evaluator {
+	e.replCfg = rcfg
+	return e
+}
+
+// IsPendingReplication checks if the object is pending replication.
+func (e *Evaluator) IsPendingReplication(obj ObjectOpts) bool {
+	if e.replCfg == nil {
+		return false
+	}
+	if e.replCfg.HasActiveRules(obj.Name, true) && !obj.VersionPurgeStatus.Empty() {
+		return true
+	}
+
+	return false
+}
+
+// IsObjectLocked checks if it is appropriate to remove an
+// object according to locking configuration when this is lifecycle/ bucket quota asking.
+// (copied over from enforceRetentionForDeletion)
+func (e *Evaluator) IsObjectLocked(obj ObjectOpts) bool {
+	if e.lockRetention == nil || !e.lockRetention.LockEnabled {
+		return false
+	}
+
+	if obj.DeleteMarker {
+		return false
+	}
+
+	lhold := objlock.GetObjectLegalHoldMeta(obj.UserDefined)
+	if lhold.Status.Valid() && lhold.Status == objlock.LegalHoldOn {
+		return true
+	}
+
+	ret := objlock.GetObjectRetentionMeta(obj.UserDefined)
+	if ret.Mode.Valid() && (ret.Mode == objlock.RetCompliance || ret.Mode == objlock.RetGovernance) {
+		t, err := objlock.UTCNowNTP()
+		if err != nil {
+			// it is safe to assume that the object is locked when
+			// we can't get the current time
+			return true
+		}
+		if ret.RetainUntilDate.After(t) {
+			return true
+		}
+	}
+	return false
+}
+
+// eval will return a lifecycle event for each object in objs for a given time.
+func (e *Evaluator) eval(objs []ObjectOpts, now time.Time) []Event {
+	events := make([]Event, len(objs))
+	var newerNoncurrentVersions int
+loop:
+	for i, obj := range objs {
+		event := e.policy.eval(obj, now, newerNoncurrentVersions)
+		switch event.Action {
+		case DeleteAllVersionsAction, DelMarkerDeleteAllVersionsAction:
+			// Skip if bucket has object locking enabled; To prevent the
+			// possibility of violating an object retention on one of the
+			// noncurrent versions of this object.
+			if e.lockRetention != nil && e.lockRetention.LockEnabled {
+				event = Event{}
+			} else {
+				// No need to evaluate remaining versions' lifecycle
+				// events after DeleteAllVersionsAction*
+				events[i] = event
+				break loop
+			}
+
+		case DeleteVersionAction, DeleteRestoredVersionAction:
+			// Defensive code, should never happen
+			if obj.VersionID == "" {
+				event.Action = NoneAction
+			}
+			if e.IsObjectLocked(obj) {
+				event = Event{}
+			}
+
+			if e.IsPendingReplication(obj) {
+				event = Event{}
+			}
+		}
+		if !obj.IsLatest {
+			switch event.Action {
+			case DeleteVersionAction:
+				// this noncurrent version will be expired, nothing to add
+			default:
+				// this noncurrent version will be spared
+				newerNoncurrentVersions++
+			}
+		}
+		events[i] = event
+	}
+	return events
+}
+
+// Eval will return a lifecycle event for each object in objs
+func (e *Evaluator) Eval(objs []ObjectOpts) ([]Event, error) {
+	if len(objs) == 0 {
+		return nil, nil
+	}
+	if len(objs) != objs[0].NumVersions {
+		return nil, fmt.Errorf("number of versions mismatch, expected %d, got %d", objs[0].NumVersions, len(objs))
+	}
+	return e.eval(objs, time.Now().UTC()), nil
+}

internal/bucket/lifecycle/evaluator_test.go

@@ -0,0 +1,183 @@
+// Copyright (c) 2015-2025 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func TestNewerNoncurrentVersions(t *testing.T) {
+	prepLifecycleCfg := func(tagKeys []string, retainVersions []int) Lifecycle {
+		var lc Lifecycle
+		for i := range retainVersions {
+			ruleID := fmt.Sprintf("rule-%d", i)
+			tag := Tag{
+				Key:   tagKeys[i],
+				Value: "minio",
+			}
+			lc.Rules = append(lc.Rules, Rule{
+				ID:     ruleID,
+				Status: "Enabled",
+				Filter: Filter{
+					Tag: tag,
+					set: true,
+				},
+				NoncurrentVersionExpiration: NoncurrentVersionExpiration{
+					NewerNoncurrentVersions: retainVersions[i],
+					set:                     true,
+				},
+			})
+		}
+		return lc
+	}
+
+	lc := prepLifecycleCfg([]string{"tag3", "tag4", "tag5"}, []int{3, 4, 5})
+	evaluator := NewEvaluator(lc)
+	tagKeys := []string{"tag3", "tag3", "tag3", "tag4", "tag4", "tag5", "tag5"}
+	verIDs := []string{
+		"0NdAikoUVNGEpCUuB9vl.XyoMftMXCSg", "19M6Z405yFZuYygnnU9jKzsOBamTZK_7", "0PmlJdFWi_9d6l_dAkWrrhP.bBgtFk6V", // spellchecker:disable-line
+		".MmRalFNNJyOLymgCtQ3.qsdoYpy8qkB", "Bjb4OlMW9Agx.Nrggh15iU6frGu2CLde", "ngBmUd_cVl6ckONI9XsKGpJjzimohrzZ", // spellchecker:disable-line
+		"T6m1heTHLUtnByW2IOWJ3zM4JP9xXt2O", // spellchecker:disable-line
+	}
+	wantEvents := []Event{
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: DeleteVersionAction},
+	}
+	var objs []ObjectOpts
+	curModTime := time.Date(2025, time.February, 10, 23, 0, 0, 0, time.UTC)
+	for i := range tagKeys {
+		obj := ObjectOpts{
+			Name:        "obj",
+			VersionID:   verIDs[i],
+			ModTime:     curModTime.Add(time.Duration(-i) * time.Second),
+			UserTags:    fmt.Sprintf("%s=minio", tagKeys[i]),
+			NumVersions: len(verIDs),
+		}
+		if i == 0 {
+			obj.IsLatest = true
+		} else {
+			obj.SuccessorModTime = curModTime.Add(time.Duration(-i+1) * time.Second)
+		}
+		objs = append(objs, obj)
+	}
+	now := time.Date(2025, time.February, 10, 23, 0, 0, 0, time.UTC)
+	gotEvents := evaluator.eval(objs, now)
+	for i := range wantEvents {
+		if gotEvents[i].Action != wantEvents[i].Action {
+			t.Fatalf("got %v, want %v", gotEvents[i], wantEvents[i])
+		}
+	}
+
+	lc = prepLifecycleCfg([]string{"tag3", "tag4", "tag5"}, []int{1, 2, 3})
+	objs = objs[:len(objs)-1]
+	wantEvents = []Event{
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: DeleteVersionAction},
+		{Action: NoneAction},
+		{Action: DeleteVersionAction},
+		{Action: NoneAction},
+	}
+	evaluator = NewEvaluator(lc)
+	gotEvents = evaluator.eval(objs, now)
+	for i := range wantEvents {
+		if gotEvents[i].Action != wantEvents[i].Action {
+			t.Fatalf("test-%d: got %v, want %v", i+1, gotEvents[i], wantEvents[i])
+		}
+	}
+
+	lc = Lifecycle{
+		Rules: []Rule{
+			{
+				ID:     "AllVersionsExpiration",
+				Status: "Enabled",
+				Filter: Filter{},
+				Expiration: Expiration{
+					Days: 1,
+					DeleteAll: Boolean{
+						val: true,
+						set: true,
+					},
+					set: true,
+				},
+			},
+		},
+	}
+
+	now = time.Date(2025, time.February, 12, 23, 0, 0, 0, time.UTC)
+	evaluator = NewEvaluator(lc)
+	gotEvents = evaluator.eval(objs, now)
+	wantEvents = []Event{
+		{Action: DeleteAllVersionsAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+		{Action: NoneAction},
+	}
+	for i := range wantEvents {
+		if gotEvents[i].Action != wantEvents[i].Action {
+			t.Fatalf("test-%d: got %v, want %v", i+1, gotEvents[i], wantEvents[i])
+		}
+	}
+
+	// Test with zero versions
+	events, err := evaluator.Eval(nil)
+	if len(events) != 0 || err != nil {
+		t.Fatal("expected no events nor error")
+	}
+}
+
+func TestEmptyEvaluator(t *testing.T) {
+	var objs []ObjectOpts
+	curModTime := time.Date(2025, time.February, 10, 23, 0, 0, 0, time.UTC)
+	for i := range 5 {
+		obj := ObjectOpts{
+			Name:        "obj",
+			VersionID:   uuid.New().String(),
+			ModTime:     curModTime.Add(time.Duration(-i) * time.Second),
+			NumVersions: 5,
+		}
+		if i == 0 {
+			obj.IsLatest = true
+		} else {
+			obj.SuccessorModTime = curModTime.Add(time.Duration(-i+1) * time.Second)
+		}
+		objs = append(objs, obj)
+	}
+
+	evaluator := NewEvaluator(Lifecycle{})
+	events, err := evaluator.Eval(objs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, event := range events {
+		if event.Action != NoneAction {
+			t.Fatalf("got %v, want %v", event.Action, NoneAction)
+		}
+	}
+}

internal/bucket/lifecycle/expiration.go

@@ -0,0 +1,211 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"time"
+)
+
+var (
+	errLifecycleInvalidDate         = Errorf("Date must be provided in ISO 8601 format")
+	errLifecycleInvalidDays         = Errorf("Days must be positive integer when used with Expiration")
+	errLifecycleInvalidExpiration   = Errorf("Exactly one of Days (positive integer) or Date (positive ISO 8601 format) should be present inside Expiration.")
+	errLifecycleInvalidDeleteMarker = Errorf("Delete marker cannot be specified with Days or Date in a Lifecycle Expiration Policy")
+	errLifecycleDateNotMidnight     = Errorf("'Date' must be at midnight GMT")
+	errLifecycleInvalidDeleteAll    = Errorf("Days (positive integer) should be present inside Expiration with ExpiredObjectAllVersions.")
+)
+
+// ExpirationDays is a type alias to unmarshal Days in Expiration
+type ExpirationDays int
+
+// UnmarshalXML parses number of days from Expiration and validates if
+// greater than zero
+func (eDays *ExpirationDays) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	var numDays int
+	err := d.DecodeElement(&numDays, &startElement)
+	if err != nil {
+		return err
+	}
+	if numDays <= 0 {
+		return errLifecycleInvalidDays
+	}
+	*eDays = ExpirationDays(numDays)
+	return nil
+}
+
+// MarshalXML encodes number of days to expire if it is non-zero and
+// encodes empty string otherwise
+func (eDays ExpirationDays) MarshalXML(e *xml.Encoder, startElement xml.StartElement) error {
+	if eDays == 0 {
+		return nil
+	}
+	return e.EncodeElement(int(eDays), startElement)
+}
+
+// ExpirationDate is a embedded type containing time.Time to unmarshal
+// Date in Expiration
+type ExpirationDate struct {
+	time.Time
+}
+
+// UnmarshalXML parses date from Expiration and validates date format
+func (eDate *ExpirationDate) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	var dateStr string
+	err := d.DecodeElement(&dateStr, &startElement)
+	if err != nil {
+		return err
+	}
+	// While AWS documentation mentions that the date specified
+	// must be present in ISO 8601 format, in reality they allow
+	// users to provide RFC 3339 compliant dates.
+	expDate, err := time.Parse(time.RFC3339, dateStr)
+	if err != nil {
+		return errLifecycleInvalidDate
+	}
+	// Allow only date timestamp specifying midnight GMT
+	hr, m, sec := expDate.Clock()
+	nsec := expDate.Nanosecond()
+	loc := expDate.Location()
+	if hr != 0 || m != 0 || sec != 0 || nsec != 0 || loc.String() != time.UTC.String() {
+		return errLifecycleDateNotMidnight
+	}
+
+	*eDate = ExpirationDate{expDate}
+	return nil
+}
+
+// MarshalXML encodes expiration date if it is non-zero and encodes
+// empty string otherwise
+func (eDate ExpirationDate) MarshalXML(e *xml.Encoder, startElement xml.StartElement) error {
+	if eDate.IsZero() {
+		return nil
+	}
+	return e.EncodeElement(eDate.Format(time.RFC3339), startElement)
+}
+
+// ExpireDeleteMarker represents value of ExpiredObjectDeleteMarker field in Expiration XML element.
+type ExpireDeleteMarker struct {
+	Boolean
+}
+
+// Boolean signifies a boolean XML struct with custom marshaling
+type Boolean struct {
+	val    bool
+	set    bool
+	Unused struct{} // Needed for GOB compatibility
+}
+
+// Expiration - expiration actions for a rule in lifecycle configuration.
+type Expiration struct {
+	XMLName      xml.Name           `xml:"Expiration"`
+	Days         ExpirationDays     `xml:"Days,omitempty"`
+	Date         ExpirationDate     `xml:"Date,omitempty"`
+	DeleteMarker ExpireDeleteMarker `xml:"ExpiredObjectDeleteMarker"`
+	// Indicates whether MinIO will remove all versions. If set to true, all versions will be deleted;
+	// if set to false the policy takes no action. This action uses the Days/Date to expire objects.
+	// This check is verified for latest version of the object.
+	DeleteAll Boolean `xml:"ExpiredObjectAllVersions"`
+
+	set bool
+}
+
+// MarshalXML encodes delete marker boolean into an XML form.
+func (b Boolean) MarshalXML(e *xml.Encoder, startElement xml.StartElement) error {
+	if !b.set {
+		return nil
+	}
+	return e.EncodeElement(b.val, startElement)
+}
+
+// UnmarshalXML decodes delete marker boolean from the XML form.
+func (b *Boolean) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	var exp bool
+	err := d.DecodeElement(&exp, &startElement)
+	if err != nil {
+		return err
+	}
+	b.val = exp
+	b.set = true
+	return nil
+}
+
+// MarshalXML encodes expiration field into an XML form.
+func (e Expiration) MarshalXML(enc *xml.Encoder, startElement xml.StartElement) error {
+	if !e.set {
+		return nil
+	}
+	type expirationWrapper Expiration
+	return enc.EncodeElement(expirationWrapper(e), startElement)
+}
+
+// UnmarshalXML decodes expiration field from the XML form.
+func (e *Expiration) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	type expirationWrapper Expiration
+	var exp expirationWrapper
+	err := d.DecodeElement(&exp, &startElement)
+	if err != nil {
+		return err
+	}
+	*e = Expiration(exp)
+	e.set = true
+	return nil
+}
+
+// Validate - validates the "Expiration" element
+func (e Expiration) Validate() error {
+	if !e.set {
+		return nil
+	}
+
+	// DeleteMarker cannot be specified if date or dates are specified.
+	if (!e.IsDaysNull() || !e.IsDateNull()) && e.DeleteMarker.set {
+		return errLifecycleInvalidDeleteMarker
+	}
+
+	if !e.DeleteMarker.set && !e.DeleteAll.set && e.IsDaysNull() && e.IsDateNull() {
+		return errXMLNotWellFormed
+	}
+
+	// Both expiration days and date are specified
+	if !e.IsDaysNull() && !e.IsDateNull() {
+		return errLifecycleInvalidExpiration
+	}
+
+	// DeleteAll set without expiration days
+	if e.DeleteAll.set && e.IsDaysNull() {
+		return errLifecycleInvalidDeleteAll
+	}
+
+	return nil
+}
+
+// IsDaysNull returns true if days field is null
+func (e Expiration) IsDaysNull() bool {
+	return e.Days == ExpirationDays(0)
+}
+
+// IsDateNull returns true if date field is null
+func (e Expiration) IsDateNull() bool {
+	return e.Date.IsZero()
+}
+
+// IsNull returns true if both date and days fields are null
+func (e Expiration) IsNull() bool {
+	return e.IsDaysNull() && e.IsDateNull()
+}

internal/bucket/lifecycle/expiration_test.go

@@ -0,0 +1,126 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"fmt"
+	"testing"
+)
+
+// appropriate errors on validation
+func TestInvalidExpiration(t *testing.T) {
+	testCases := []struct {
+		inputXML    string
+		expectedErr error
+	}{
+		{ // Expiration with zero days
+			inputXML: ` <Expiration>
+                                    <Days>0</Days>
+                                    </Expiration>`,
+			expectedErr: errLifecycleInvalidDays,
+		},
+		{ // Expiration with invalid date
+			inputXML: ` <Expiration>
+                                    <Date>invalid date</Date>
+                                    </Expiration>`,
+			expectedErr: errLifecycleInvalidDate,
+		},
+		{ // Expiration with both number of days nor a date
+			inputXML: `<Expiration>
+		                    <Date>2019-04-20T00:01:00Z</Date>
+		                    </Expiration>`,
+			expectedErr: errLifecycleDateNotMidnight,
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("Test %d", i+1), func(t *testing.T) {
+			var expiration Expiration
+			err := xml.Unmarshal([]byte(tc.inputXML), &expiration)
+			if err != tc.expectedErr {
+				t.Fatalf("%d: Expected %v but got %v", i+1, tc.expectedErr, err)
+			}
+		})
+	}
+
+	validationTestCases := []struct {
+		inputXML    string
+		expectedErr error
+	}{
+		{ // Expiration with a valid ISO 8601 date
+			inputXML: `<Expiration>
+                                    <Date>2019-04-20T00:00:00Z</Date>
+                                    </Expiration>`,
+			expectedErr: nil,
+		},
+		{ // Expiration with a valid number of days
+			inputXML: `<Expiration>
+                                    <Days>3</Days>
+                                    </Expiration>`,
+			expectedErr: nil,
+		},
+		{ // Expiration with neither number of days nor a date
+			inputXML: `<Expiration>
+                                    </Expiration>`,
+			expectedErr: errXMLNotWellFormed,
+		},
+		{ // Expiration with both number of days and a date
+			inputXML: `<Expiration>
+                                    <Days>3</Days>
+                                    <Date>2019-04-20T00:00:00Z</Date>
+                                    </Expiration>`,
+			expectedErr: errLifecycleInvalidExpiration,
+		},
+		{ // Expiration with both ExpiredObjectDeleteMarker and days
+			inputXML: `<Expiration>
+                                    <Days>3</Days>
+			            <ExpiredObjectDeleteMarker>false</ExpiredObjectDeleteMarker>
+                                    </Expiration>`,
+			expectedErr: errLifecycleInvalidDeleteMarker,
+		},
+		{ // Expiration with a valid number of days and ExpiredObjectAllVersions
+			inputXML: `<Expiration>
+									<Days>3</Days>
+			            <ExpiredObjectAllVersions>true</ExpiredObjectAllVersions>
+                                    </Expiration>`,
+			expectedErr: nil,
+		},
+		{ // Expiration with a valid ISO 8601 date and ExpiredObjectAllVersions
+			inputXML: `<Expiration>
+									<Date>2019-04-20T00:00:00Z</Date>
+			            <ExpiredObjectAllVersions>true</ExpiredObjectAllVersions>
+                                    </Expiration>`,
+			expectedErr: errLifecycleInvalidDeleteAll,
+		},
+	}
+	for i, tc := range validationTestCases {
+		t.Run(fmt.Sprintf("Test %d", i+1), func(t *testing.T) {
+			var expiration Expiration
+			err := xml.Unmarshal([]byte(tc.inputXML), &expiration)
+			if err != nil {
+				t.Fatalf("%d: %v", i+1, err)
+			}
+
+			err = expiration.Validate()
+			if err != tc.expectedErr {
+				t.Fatalf("%d: got: %v, expected: %v", i+1, err, tc.expectedErr)
+			}
+		})
+	}
+}

internal/bucket/lifecycle/filter.go

@@ -0,0 +1,270 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"io"
+
+	"github.com/minio/minio-go/v7/pkg/tags"
+)
+
+var errInvalidFilter = Errorf("Filter must have exactly one of Prefix, Tag, or And specified")
+
+// Filter - a filter for a lifecycle configuration Rule.
+type Filter struct {
+	XMLName xml.Name `xml:"Filter"`
+	set     bool
+
+	Prefix Prefix
+
+	ObjectSizeGreaterThan int64 `xml:"ObjectSizeGreaterThan,omitempty"`
+	ObjectSizeLessThan    int64 `xml:"ObjectSizeLessThan,omitempty"`
+
+	And    And
+	andSet bool
+
+	Tag    Tag
+	tagSet bool
+
+	// Caching tags, only once
+	cachedTags map[string]string
+}
+
+// MarshalXML - produces the xml representation of the Filter struct
+// only one of Prefix, And and Tag should be present in the output.
+func (f Filter) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if !f.set {
+		return nil
+	}
+
+	if err := e.EncodeToken(start); err != nil {
+		return err
+	}
+
+	switch {
+	case !f.And.isEmpty():
+		if err := e.EncodeElement(f.And, xml.StartElement{Name: xml.Name{Local: "And"}}); err != nil {
+			return err
+		}
+	case !f.Tag.IsEmpty():
+		if err := e.EncodeElement(f.Tag, xml.StartElement{Name: xml.Name{Local: "Tag"}}); err != nil {
+			return err
+		}
+	default:
+		// Always print Prefix field when both And & Tag are empty
+		if err := e.EncodeElement(f.Prefix, xml.StartElement{Name: xml.Name{Local: "Prefix"}}); err != nil {
+			return err
+		}
+
+		if f.ObjectSizeLessThan > 0 {
+			if err := e.EncodeElement(f.ObjectSizeLessThan, xml.StartElement{Name: xml.Name{Local: "ObjectSizeLessThan"}}); err != nil {
+				return err
+			}
+		}
+		if f.ObjectSizeGreaterThan > 0 {
+			if err := e.EncodeElement(f.ObjectSizeGreaterThan, xml.StartElement{Name: xml.Name{Local: "ObjectSizeGreaterThan"}}); err != nil {
+				return err
+			}
+		}
+	}
+
+	return e.EncodeToken(xml.EndElement{Name: start.Name})
+}
+
+// UnmarshalXML - decodes XML data.
+func (f *Filter) UnmarshalXML(d *xml.Decoder, start xml.StartElement) (err error) {
+	f.set = true
+	for {
+		// Read tokens from the XML document in a stream.
+		t, err := d.Token()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+
+		if se, ok := t.(xml.StartElement); ok {
+			switch se.Name.Local {
+			case "Prefix":
+				var p Prefix
+				if err = d.DecodeElement(&p, &se); err != nil {
+					return err
+				}
+				f.Prefix = p
+			case "And":
+				var and And
+				if err = d.DecodeElement(&and, &se); err != nil {
+					return err
+				}
+				f.And = and
+				f.andSet = true
+			case "Tag":
+				var tag Tag
+				if err = d.DecodeElement(&tag, &se); err != nil {
+					return err
+				}
+				f.Tag = tag
+				f.tagSet = true
+			case "ObjectSizeLessThan":
+				var sz int64
+				if err = d.DecodeElement(&sz, &se); err != nil {
+					return err
+				}
+				f.ObjectSizeLessThan = sz
+			case "ObjectSizeGreaterThan":
+				var sz int64
+				if err = d.DecodeElement(&sz, &se); err != nil {
+					return err
+				}
+				f.ObjectSizeGreaterThan = sz
+			default:
+				return errUnknownXMLTag
+			}
+		}
+	}
+	return nil
+}
+
+// IsEmpty returns true if Filter is not specified in the XML
+func (f Filter) IsEmpty() bool {
+	return !f.set
+}
+
+// Validate - validates the filter element
+func (f Filter) Validate() error {
+	if f.IsEmpty() {
+		return errXMLNotWellFormed
+	}
+	// A Filter must have exactly one of Prefix, Tag,
+	// ObjectSize{LessThan,GreaterThan} or And specified.
+	type predType uint8
+	const (
+		nonePred predType = iota
+		prefixPred
+		andPred
+		tagPred
+		sizeLtPred
+		sizeGtPred
+	)
+	var predCount int
+	var pType predType
+	if !f.And.isEmpty() {
+		pType = andPred
+		predCount++
+	}
+	if f.Prefix.set {
+		pType = prefixPred
+		predCount++
+	}
+	if !f.Tag.IsEmpty() {
+		pType = tagPred
+		predCount++
+	}
+	if f.ObjectSizeGreaterThan != 0 {
+		pType = sizeGtPred
+		predCount++
+	}
+	if f.ObjectSizeLessThan != 0 {
+		pType = sizeLtPred
+		predCount++
+	}
+	// Note: S3 supports empty <Filter></Filter>, so predCount == 0 is
+	// valid.
+	if predCount > 1 {
+		return errInvalidFilter
+	}
+
+	var err error
+	switch pType {
+	case nonePred:
+	// S3 supports empty <Filter></Filter>
+	case prefixPred:
+	case andPred:
+		err = f.And.Validate()
+	case tagPred:
+		err = f.Tag.Validate()
+	case sizeLtPred:
+		if f.ObjectSizeLessThan < 0 {
+			err = errXMLNotWellFormed
+		}
+	case sizeGtPred:
+		if f.ObjectSizeGreaterThan < 0 {
+			err = errXMLNotWellFormed
+		}
+	}
+	return err
+}
+
+// TestTags tests if the object tags satisfy the Filter tags requirement,
+// it returns true if there is no tags in the underlying Filter.
+func (f Filter) TestTags(userTags string) bool {
+	if f.cachedTags == nil {
+		cache := make(map[string]string)
+		for _, t := range append(f.And.Tags, f.Tag) {
+			if !t.IsEmpty() {
+				cache[t.Key] = t.Value
+			}
+		}
+		f.cachedTags = cache
+	}
+
+	// This filter does not have any tags, always return true
+	if len(f.cachedTags) == 0 {
+		return true
+	}
+
+	parsedTags, err := tags.ParseObjectTags(userTags)
+	if err != nil {
+		return false
+	}
+	tagsMap := parsedTags.ToMap()
+
+	// Not enough tags on object to satisfy the rule filter's tags
+	if len(tagsMap) < len(f.cachedTags) {
+		return false
+	}
+
+	var mismatch bool
+	for k, cv := range f.cachedTags {
+		v, ok := tagsMap[k]
+		if !ok || v != cv {
+			mismatch = true
+			break
+		}
+	}
+	return !mismatch
+}
+
+// BySize returns true if sz satisfies one of ObjectSizeGreaterThan,
+// ObjectSizeLessThan predicates or a combination of them via And.
+func (f Filter) BySize(sz int64) bool {
+	if f.ObjectSizeGreaterThan > 0 &&
+		sz <= f.ObjectSizeGreaterThan {
+		return false
+	}
+	if f.ObjectSizeLessThan > 0 &&
+		sz >= f.ObjectSizeLessThan {
+		return false
+	}
+	if !f.And.isEmpty() {
+		return f.And.BySize(sz)
+	}
+	return true
+}

internal/bucket/lifecycle/filter_test.go

@@ -0,0 +1,343 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"fmt"
+	"testing"
+
+	"github.com/dustin/go-humanize"
+)
+
+// TestUnsupportedFilters checks if parsing Filter xml with
+// unsupported elements returns appropriate errors
+func TestUnsupportedFilters(t *testing.T) {
+	testCases := []struct {
+		inputXML    string
+		expectedErr error
+	}{
+		{ // Filter with And tags
+			inputXML: ` <Filter>
+						<And>
+							<Prefix>key-prefix</Prefix>
+						</And>
+						</Filter>`,
+			expectedErr: errXMLNotWellFormed,
+		},
+		{ // Filter with Tag tags
+			inputXML: ` <Filter>
+						<Tag>
+							<Key>key1</Key>
+							<Value>value1</Value>
+						</Tag>
+						</Filter>`,
+			expectedErr: nil,
+		},
+		{ // Filter with Prefix tag
+			inputXML: ` <Filter>
+							<Prefix>key-prefix</Prefix>
+						</Filter>`,
+			expectedErr: nil,
+		},
+		{ // Filter without And and multiple Tag tags
+			inputXML: ` <Filter>
+							<Prefix>key-prefix</Prefix>
+							<Tag>
+								<Key>key1</Key>
+								<Value>value1</Value>
+							</Tag>
+							<Tag>
+								<Key>key2</Key>
+								<Value>value2</Value>
+							</Tag>
+						</Filter>`,
+			expectedErr: errInvalidFilter,
+		},
+		{ // Filter with And, Prefix & multiple Tag tags
+			inputXML: ` <Filter>
+							<And>
+							<Prefix>key-prefix</Prefix>
+							<Tag>
+								<Key>key1</Key>
+								<Value>value1</Value>
+							</Tag>
+							<Tag>
+								<Key>key2</Key>
+								<Value>value2</Value>
+							</Tag>
+							</And>
+						</Filter>`,
+			expectedErr: nil,
+		},
+		{ // Filter with And and multiple Tag tags
+			inputXML: ` <Filter>
+							<And>
+							<Prefix></Prefix>
+							<Tag>
+								<Key>key1</Key>
+								<Value>value1</Value>
+							</Tag>
+							<Tag>
+								<Key>key2</Key>
+								<Value>value2</Value>
+							</Tag>
+							</And>
+						</Filter>`,
+			expectedErr: nil,
+		},
+		{ // Filter without And and single Tag tag
+			inputXML: ` <Filter>
+							<Prefix>key-prefix</Prefix>
+							<Tag>
+								<Key>key1</Key>
+								<Value>value1</Value>
+							</Tag>
+						</Filter>`,
+			expectedErr: errInvalidFilter,
+		},
+	}
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("Test %d", i+1), func(t *testing.T) {
+			var filter Filter
+			err := xml.Unmarshal([]byte(tc.inputXML), &filter)
+			if err != nil {
+				t.Fatalf("%d: Expected no error but got %v", i+1, err)
+			}
+			err = filter.Validate()
+			if err != tc.expectedErr {
+				t.Fatalf("%d: Expected %v but got %v", i+1, tc.expectedErr, err)
+			}
+		})
+	}
+}
+
+func TestObjectSizeFilters(t *testing.T) {
+	f1 := Filter{
+		set: true,
+		Prefix: Prefix{
+			string: "doc/",
+			set:    true,
+			Unused: struct{}{},
+		},
+		ObjectSizeGreaterThan: 100 * humanize.MiByte,
+		ObjectSizeLessThan:    100 * humanize.GiByte,
+	}
+	b, err := xml.Marshal(f1)
+	if err != nil {
+		t.Fatalf("Failed to marshal %v", f1)
+	}
+	var f2 Filter
+	err = xml.Unmarshal(b, &f2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal %s", string(b))
+	}
+	if f1.ObjectSizeLessThan != f2.ObjectSizeLessThan {
+		t.Fatalf("Expected %v but got %v", f1.ObjectSizeLessThan, f2.And.ObjectSizeLessThan)
+	}
+	if f1.ObjectSizeGreaterThan != f2.ObjectSizeGreaterThan {
+		t.Fatalf("Expected %v but got %v", f1.ObjectSizeGreaterThan, f2.And.ObjectSizeGreaterThan)
+	}
+
+	f1 = Filter{
+		set: true,
+		And: And{
+			ObjectSizeGreaterThan: 100 * humanize.MiByte,
+			ObjectSizeLessThan:    1 * humanize.GiByte,
+			Prefix:                Prefix{},
+		},
+		andSet: true,
+	}
+	b, err = xml.Marshal(f1)
+	if err != nil {
+		t.Fatalf("Failed to marshal %v", f1)
+	}
+	f2 = Filter{}
+	err = xml.Unmarshal(b, &f2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal %s", string(b))
+	}
+	if f1.And.ObjectSizeLessThan != f2.And.ObjectSizeLessThan {
+		t.Fatalf("Expected %v but got %v", f1.And.ObjectSizeLessThan, f2.And.ObjectSizeLessThan)
+	}
+	if f1.And.ObjectSizeGreaterThan != f2.And.ObjectSizeGreaterThan {
+		t.Fatalf("Expected %v but got %v", f1.And.ObjectSizeGreaterThan, f2.And.ObjectSizeGreaterThan)
+	}
+
+	fiGt := Filter{
+		ObjectSizeGreaterThan: 1 * humanize.MiByte,
+	}
+	fiLt := Filter{
+		ObjectSizeLessThan: 100 * humanize.MiByte,
+	}
+	fiLtAndGt := Filter{
+		And: And{
+			ObjectSizeGreaterThan: 1 * humanize.MiByte,
+			ObjectSizeLessThan:    100 * humanize.MiByte,
+		},
+	}
+
+	tests := []struct {
+		filter  Filter
+		objSize int64
+		want    bool
+	}{
+		{
+			filter:  fiLt,
+			objSize: 101 * humanize.MiByte,
+			want:    false,
+		},
+		{
+			filter:  fiLt,
+			objSize: 99 * humanize.MiByte,
+			want:    true,
+		},
+		{
+			filter:  fiGt,
+			objSize: 1*humanize.MiByte - 1,
+			want:    false,
+		},
+		{
+			filter:  fiGt,
+			objSize: 1*humanize.MiByte + 1,
+			want:    true,
+		},
+		{
+			filter:  fiLtAndGt,
+			objSize: 1*humanize.MiByte - 1,
+			want:    false,
+		},
+		{
+			filter:  fiLtAndGt,
+			objSize: 2 * humanize.MiByte,
+			want:    true,
+		},
+		{
+			filter:  fiLtAndGt,
+			objSize: 100*humanize.MiByte + 1,
+			want:    false,
+		},
+	}
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("Test %d", i+1), func(t *testing.T) {
+			if got := test.filter.BySize(test.objSize); got != test.want {
+				t.Fatalf("Expected %v but got %v", test.want, got)
+			}
+		})
+	}
+}
+
+func TestTestTags(t *testing.T) {
+	noTags := Filter{
+		set: true,
+		And: And{
+			Tags: []Tag{},
+		},
+		andSet: true,
+	}
+
+	oneTag := Filter{
+		set: true,
+		And: And{
+			Tags: []Tag{{Key: "FOO", Value: "1"}},
+		},
+		andSet: true,
+	}
+
+	twoTags := Filter{
+		set: true,
+		And: And{
+			Tags: []Tag{{Key: "FOO", Value: "1"}, {Key: "BAR", Value: "2"}},
+		},
+		andSet: true,
+	}
+
+	tests := []struct {
+		filter   Filter
+		userTags string
+		want     bool
+	}{
+		{
+			filter:   noTags,
+			userTags: "",
+			want:     true,
+		},
+		{
+			filter:   noTags,
+			userTags: "A=3",
+			want:     true,
+		},
+		{
+			filter:   oneTag,
+			userTags: "A=3",
+			want:     false,
+		},
+		{
+			filter:   oneTag,
+			userTags: "FOO=1",
+			want:     true,
+		},
+		{
+			filter:   oneTag,
+			userTags: "A=B&FOO=1",
+			want:     true,
+		},
+		{
+			filter:   twoTags,
+			userTags: "",
+			want:     false,
+		},
+		{
+			filter:   twoTags,
+			userTags: "FOO=1",
+			want:     false,
+		},
+		{
+			filter:   twoTags,
+			userTags: "BAR=2",
+			want:     false,
+		},
+		{
+			filter:   twoTags,
+			userTags: "FOO=2&BAR=2",
+			want:     false,
+		},
+		{
+			filter:   twoTags,
+			userTags: "F=1&B=2",
+			want:     false,
+		},
+		{
+			filter:   twoTags,
+			userTags: "FOO=1&BAR=2",
+			want:     true,
+		},
+		{
+			filter:   twoTags,
+			userTags: "BAR=2&FOO=1",
+			want:     true,
+		},
+	}
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("Test %d", i+1), func(t *testing.T) {
+			if got := test.filter.TestTags(test.userTags); got != test.want {
+				t.Errorf("Expected %v but got %v", test.want, got)
+			}
+		})
+	}
+}

internal/bucket/lifecycle/lifecycle.go

@@ -0,0 +1,570 @@
+// Copyright (c) 2015-2024 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"fmt"
+	"io"
+	"net/http"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/minio/minio/internal/bucket/object/lock"
+	"github.com/minio/minio/internal/bucket/replication"
+	xhttp "github.com/minio/minio/internal/http"
+)
+
+var (
+	errLifecycleTooManyRules = Errorf("Lifecycle configuration allows a maximum of 1000 rules")
+	errLifecycleNoRule       = Errorf("Lifecycle configuration should have at least one rule")
+	errLifecycleDuplicateID  = Errorf("Rule ID must be unique. Found same ID for more than one rule")
+	errXMLNotWellFormed      = Errorf("The XML you provided was not well-formed or did not validate against our published schema")
+	errLifecycleBucketLocked = Errorf("ExpiredObjectAllVersions element and DelMarkerExpiration action cannot be used on an object locked bucket")
+)
+
+const (
+	// TransitionComplete marks completed transition
+	TransitionComplete = "complete"
+	// TransitionPending - transition is yet to be attempted
+	TransitionPending = "pending"
+)
+
+// Action represents a delete action or other transition
+// actions that will be implemented later.
+type Action int
+
+//go:generate stringer -type Action $GOFILE
+
+const (
+	// NoneAction means no action required after evaluating lifecycle rules
+	NoneAction Action = iota
+	// DeleteAction means the object needs to be removed after evaluating lifecycle rules
+	DeleteAction
+	// DeleteVersionAction deletes a particular version
+	DeleteVersionAction
+	// TransitionAction transitions a particular object after evaluating lifecycle transition rules
+	TransitionAction
+	// TransitionVersionAction transitions a particular object version after evaluating lifecycle transition rules
+	TransitionVersionAction
+	// DeleteRestoredAction means the temporarily restored object needs to be removed after evaluating lifecycle rules
+	DeleteRestoredAction
+	// DeleteRestoredVersionAction deletes a particular version that was temporarily restored
+	DeleteRestoredVersionAction
+	// DeleteAllVersionsAction deletes all versions when an object expires
+	DeleteAllVersionsAction
+	// DelMarkerDeleteAllVersionsAction deletes all versions when an object with delete marker as latest version expires
+	DelMarkerDeleteAllVersionsAction
+	// ActionCount must be the last action and shouldn't be used as a regular action.
+	ActionCount
+)
+
+// DeleteRestored - Returns true if action demands delete on restored objects
+func (a Action) DeleteRestored() bool {
+	return a == DeleteRestoredAction || a == DeleteRestoredVersionAction
+}
+
+// DeleteVersioned - Returns true if action demands delete on a versioned object
+func (a Action) DeleteVersioned() bool {
+	return a == DeleteVersionAction || a == DeleteRestoredVersionAction
+}
+
+// DeleteAll - Returns true if the action demands deleting all versions of an object
+func (a Action) DeleteAll() bool {
+	return a == DeleteAllVersionsAction || a == DelMarkerDeleteAllVersionsAction
+}
+
+// Delete - Returns true if action demands delete on all objects (including restored)
+func (a Action) Delete() bool {
+	if a.DeleteRestored() {
+		return true
+	}
+	return a == DeleteVersionAction || a == DeleteAction || a == DeleteAllVersionsAction || a == DelMarkerDeleteAllVersionsAction
+}
+
+// Lifecycle - Configuration for bucket lifecycle.
+type Lifecycle struct {
+	XMLName         xml.Name   `xml:"LifecycleConfiguration"`
+	Rules           []Rule     `xml:"Rule"`
+	ExpiryUpdatedAt *time.Time `xml:"ExpiryUpdatedAt,omitempty"`
+}
+
+// HasTransition returns 'true' if lifecycle document has Transition enabled.
+func (lc Lifecycle) HasTransition() bool {
+	for _, rule := range lc.Rules {
+		if rule.Transition.IsEnabled() {
+			return true
+		}
+	}
+	return false
+}
+
+// HasExpiry returns 'true' if lifecycle document has Expiry enabled.
+func (lc Lifecycle) HasExpiry() bool {
+	for _, rule := range lc.Rules {
+		if !rule.Expiration.IsNull() || !rule.NoncurrentVersionExpiration.IsNull() {
+			return true
+		}
+	}
+	return false
+}
+
+// UnmarshalXML - decodes XML data.
+func (lc *Lifecycle) UnmarshalXML(d *xml.Decoder, start xml.StartElement) (err error) {
+	switch start.Name.Local {
+	case "LifecycleConfiguration", "BucketLifecycleConfiguration":
+	default:
+		return xml.UnmarshalError(fmt.Sprintf("expected element type <LifecycleConfiguration>/<BucketLifecycleConfiguration> but have <%s>",
+			start.Name.Local))
+	}
+	for {
+		// Read tokens from the XML document in a stream.
+		t, err := d.Token()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+
+		if se, ok := t.(xml.StartElement); ok {
+			switch se.Name.Local {
+			case "Rule":
+				var r Rule
+				if err = d.DecodeElement(&r, &se); err != nil {
+					return err
+				}
+				lc.Rules = append(lc.Rules, r)
+			case "ExpiryUpdatedAt":
+				var t time.Time
+				if err = d.DecodeElement(&t, &start); err != nil {
+					return err
+				}
+				lc.ExpiryUpdatedAt = &t
+			default:
+				return xml.UnmarshalError(fmt.Sprintf("expected element type <Rule> but have <%s>", se.Name.Local))
+			}
+		}
+	}
+	return nil
+}
+
+// HasActiveRules - returns whether lc has active rules at any level below or at prefix.
+func (lc Lifecycle) HasActiveRules(prefix string) bool {
+	if len(lc.Rules) == 0 {
+		return false
+	}
+	for _, rule := range lc.Rules {
+		if rule.Status == Disabled {
+			continue
+		}
+
+		if len(prefix) > 0 && len(rule.GetPrefix()) > 0 {
+			// we can skip this rule if it doesn't match the tested
+			// prefix.
+			if !strings.HasPrefix(prefix, rule.GetPrefix()) && !strings.HasPrefix(rule.GetPrefix(), prefix) {
+				continue
+			}
+		}
+
+		if rule.NoncurrentVersionExpiration.NoncurrentDays > 0 {
+			return true
+		}
+		if rule.NoncurrentVersionExpiration.NewerNoncurrentVersions > 0 {
+			return true
+		}
+		if !rule.NoncurrentVersionTransition.IsNull() {
+			return true
+		}
+		if !rule.Expiration.IsDateNull() && rule.Expiration.Date.Before(time.Now().UTC()) {
+			return true
+		}
+		if !rule.Expiration.IsDaysNull() {
+			return true
+		}
+		if rule.Expiration.DeleteMarker.val {
+			return true
+		}
+		if !rule.Transition.IsDateNull() && rule.Transition.Date.Before(time.Now().UTC()) {
+			return true
+		}
+		if !rule.Transition.IsNull() { // this allows for Transition.Days to be zero.
+			return true
+		}
+	}
+	return false
+}
+
+// ParseLifecycleConfigWithID - parses for a Lifecycle config and assigns
+// unique id to rules with empty ID.
+func ParseLifecycleConfigWithID(r io.Reader) (*Lifecycle, error) {
+	var lc Lifecycle
+	if err := xml.NewDecoder(r).Decode(&lc); err != nil {
+		return nil, err
+	}
+	// assign a unique id for rules with empty ID
+	for i := range lc.Rules {
+		if lc.Rules[i].ID == "" {
+			lc.Rules[i].ID = uuid.New().String()
+		}
+	}
+	return &lc, nil
+}
+
+// ParseLifecycleConfig - parses data in given reader to Lifecycle.
+func ParseLifecycleConfig(reader io.Reader) (*Lifecycle, error) {
+	var lc Lifecycle
+	if err := xml.NewDecoder(reader).Decode(&lc); err != nil {
+		return nil, err
+	}
+	return &lc, nil
+}
+
+// Validate - validates the lifecycle configuration
+func (lc Lifecycle) Validate(lr lock.Retention) error {
+	// Lifecycle config can't have more than 1000 rules
+	if len(lc.Rules) > 1000 {
+		return errLifecycleTooManyRules
+	}
+	// Lifecycle config should have at least one rule
+	if len(lc.Rules) == 0 {
+		return errLifecycleNoRule
+	}
+
+	// Validate all the rules in the lifecycle config
+	for _, r := range lc.Rules {
+		if err := r.Validate(); err != nil {
+			return err
+		}
+		if lr.LockEnabled && (r.Expiration.DeleteAll.val || !r.DelMarkerExpiration.Empty()) {
+			return errLifecycleBucketLocked
+		}
+	}
+	// Make sure Rule ID is unique
+	for i := range lc.Rules {
+		if i == len(lc.Rules)-1 {
+			break
+		}
+		otherRules := lc.Rules[i+1:]
+		for _, otherRule := range otherRules {
+			if lc.Rules[i].ID == otherRule.ID {
+				return errLifecycleDuplicateID
+			}
+		}
+	}
+	return nil
+}
+
+// FilterRules returns the rules filtered by the status, prefix and tags
+func (lc Lifecycle) FilterRules(obj ObjectOpts) []Rule {
+	if obj.Name == "" {
+		return nil
+	}
+	var rules []Rule
+	for _, rule := range lc.Rules {
+		if rule.Status == Disabled {
+			continue
+		}
+		if !strings.HasPrefix(obj.Name, rule.GetPrefix()) {
+			continue
+		}
+		if !rule.Filter.TestTags(obj.UserTags) {
+			continue
+		}
+		if !obj.DeleteMarker && !rule.Filter.BySize(obj.Size) {
+			continue
+		}
+		rules = append(rules, rule)
+	}
+	return rules
+}
+
+// ObjectOpts provides information to deduce the lifecycle actions
+// which can be triggered on the resultant object.
+type ObjectOpts struct {
+	Name             string
+	UserTags         string
+	ModTime          time.Time
+	Size             int64
+	VersionID        string
+	IsLatest         bool
+	DeleteMarker     bool
+	NumVersions      int
+	SuccessorModTime time.Time
+	TransitionStatus string
+	RestoreOngoing   bool
+	RestoreExpires   time.Time
+	// to determine if object is locked due to retention
+	UserDefined        map[string]string
+	VersionPurgeStatus replication.VersionPurgeStatusType
+	ReplicationStatus  replication.StatusType
+}
+
+// ExpiredObjectDeleteMarker returns true if an object version referred to by o
+// is the only version remaining and is a delete marker. It returns false
+// otherwise.
+func (o ObjectOpts) ExpiredObjectDeleteMarker() bool {
+	return o.DeleteMarker && o.NumVersions == 1
+}
+
+// Event contains a lifecycle action with associated info
+type Event struct {
+	Action                  Action
+	RuleID                  string
+	Due                     time.Time
+	NoncurrentDays          int
+	NewerNoncurrentVersions int
+	StorageClass            string
+}
+
+// Eval returns the lifecycle event applicable now.
+func (lc Lifecycle) Eval(obj ObjectOpts) Event {
+	return lc.eval(obj, time.Now().UTC(), 0)
+}
+
+// eval returns the lifecycle event applicable at the given now. If now is the
+// zero value of time.Time, it returns the upcoming lifecycle event.
+func (lc Lifecycle) eval(obj ObjectOpts, now time.Time, remainingVersions int) Event {
+	var events []Event
+	if obj.ModTime.IsZero() {
+		return Event{}
+	}
+
+	// Handle expiry of restored object; NB Restored Objects have expiry set on
+	// them as part of RestoreObject API. They aren't governed by lifecycle
+	// rules.
+	if !obj.RestoreExpires.IsZero() && now.After(obj.RestoreExpires) {
+		action := DeleteRestoredAction
+		if !obj.IsLatest {
+			action = DeleteRestoredVersionAction
+		}
+
+		events = append(events, Event{
+			Action: action,
+			Due:    now,
+		})
+	}
+
+	for _, rule := range lc.FilterRules(obj) {
+		if obj.ExpiredObjectDeleteMarker() {
+			if rule.Expiration.DeleteMarker.val {
+				// Indicates whether MinIO will remove a delete marker with no noncurrent versions.
+				// Only latest marker is removed. If set to true, the delete marker will be expired;
+				// if set to false the policy takes no action. This cannot be specified with Days or
+				// Date in a Lifecycle Expiration Policy.
+				events = append(events, Event{
+					Action: DeleteVersionAction,
+					RuleID: rule.ID,
+					Due:    now,
+				})
+				// No other conflicting actions apply to an expired object delete marker
+				break
+			}
+
+			if !rule.Expiration.IsDaysNull() {
+				// Specifying the Days tag will automatically perform ExpiredObjectDeleteMarker cleanup
+				// once delete markers are old enough to satisfy the age criteria.
+				// https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html
+				if expectedExpiry := ExpectedExpiryTime(obj.ModTime, int(rule.Expiration.Days)); now.IsZero() || now.After(expectedExpiry) {
+					events = append(events, Event{
+						Action: DeleteVersionAction,
+						RuleID: rule.ID,
+						Due:    expectedExpiry,
+					})
+					// No other conflicting actions apply to an expired object delete marker
+					break
+				}
+			}
+		}
+
+		// DelMarkerExpiration
+		if obj.IsLatest && obj.DeleteMarker && !rule.DelMarkerExpiration.Empty() {
+			if due, ok := rule.DelMarkerExpiration.NextDue(obj); ok && (now.IsZero() || now.After(due)) {
+				events = append(events, Event{
+					Action: DelMarkerDeleteAllVersionsAction,
+					RuleID: rule.ID,
+					Due:    due,
+				})
+			}
+			// No other conflicting actions in this rule can apply to an object with current version as DEL marker
+			// Note: There could be other rules with earlier expiration which need to be considered.
+			// See TestDelMarkerExpiration
+			continue
+		}
+
+		// NoncurrentVersionExpiration
+		if !obj.IsLatest && rule.NoncurrentVersionExpiration.set {
+			var (
+				retainedEnough bool
+				oldEnough      bool
+			)
+			if rule.NoncurrentVersionExpiration.NewerNoncurrentVersions == 0 || remainingVersions >= rule.NoncurrentVersionExpiration.NewerNoncurrentVersions {
+				retainedEnough = true
+			}
+			expectedExpiry := ExpectedExpiryTime(obj.SuccessorModTime, int(rule.NoncurrentVersionExpiration.NoncurrentDays))
+			if now.IsZero() || now.After(expectedExpiry) {
+				oldEnough = true
+			}
+			// > For the deletion to occur, both the <NoncurrentDays> and the <NewerNoncurrentVersions> values must be exceeded.
+			// ref: https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecycle-rules.html#intro-lifecycle-rules-actions
+			if retainedEnough && oldEnough {
+				events = append(events, Event{
+					Action: DeleteVersionAction,
+					RuleID: rule.ID,
+					Due:    expectedExpiry,
+				})
+			}
+		}
+
+		if !obj.IsLatest && !rule.NoncurrentVersionTransition.IsNull() {
+			if !obj.DeleteMarker && obj.TransitionStatus != TransitionComplete {
+				// Non current versions should be transitioned if their age exceeds non current days configuration
+				// https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecycle-rules.html#intro-lifecycle-rules-actions
+				if due, ok := rule.NoncurrentVersionTransition.NextDue(obj); ok && (now.IsZero() || now.After(due)) {
+					events = append(events, Event{
+						Action:       TransitionVersionAction,
+						RuleID:       rule.ID,
+						Due:          due,
+						StorageClass: rule.NoncurrentVersionTransition.StorageClass,
+					})
+				}
+			}
+		}
+
+		// Remove the object or simply add a delete marker (once) in a versioned bucket
+		if obj.IsLatest && !obj.DeleteMarker {
+			switch {
+			case !rule.Expiration.IsDateNull():
+				if now.IsZero() || now.After(rule.Expiration.Date.Time) {
+					events = append(events, Event{
+						Action: DeleteAction,
+						RuleID: rule.ID,
+						Due:    rule.Expiration.Date.Time,
+					})
+				}
+			case !rule.Expiration.IsDaysNull():
+				if expectedExpiry := ExpectedExpiryTime(obj.ModTime, int(rule.Expiration.Days)); now.IsZero() || now.After(expectedExpiry) {
+					event := Event{
+						Action: DeleteAction,
+						RuleID: rule.ID,
+						Due:    expectedExpiry,
+					}
+					if rule.Expiration.DeleteAll.val {
+						// Expires all versions of this object once the latest object is old enough.
+						// This is a MinIO only extension.
+						event.Action = DeleteAllVersionsAction
+					}
+					events = append(events, event)
+				}
+			}
+
+			if obj.TransitionStatus != TransitionComplete {
+				if due, ok := rule.Transition.NextDue(obj); ok && (now.IsZero() || now.After(due)) {
+					events = append(events, Event{
+						Action:       TransitionAction,
+						RuleID:       rule.ID,
+						Due:          due,
+						StorageClass: rule.Transition.StorageClass,
+					})
+				}
+			}
+		}
+	}
+
+	if len(events) > 0 {
+		slices.SortFunc(events, func(a, b Event) int {
+			// Prefer Expiration over Transition for both current
+			// and noncurrent versions when,
+			// - now is past the expected time to action
+			// - expected time to action is the same for both actions
+			if now.After(a.Due) && now.After(b.Due) || a.Due.Equal(b.Due) {
+				switch a.Action {
+				case DeleteAllVersionsAction, DelMarkerDeleteAllVersionsAction,
+					DeleteAction, DeleteVersionAction:
+					return -1
+				}
+				switch b.Action {
+				case DeleteAllVersionsAction, DelMarkerDeleteAllVersionsAction,
+					DeleteAction, DeleteVersionAction:
+					return 1
+				}
+				return -1
+			}
+
+			// Prefer earlier occurring event
+			if a.Due.Before(b.Due) {
+				return -1
+			}
+			return 1
+		})
+		return events[0]
+	}
+
+	return Event{
+		Action: NoneAction,
+	}
+}
+
+// ExpectedExpiryTime calculates the expiry, transition or restore date/time based on a object modtime.
+// The expected transition or restore time is always a midnight time following the object
+// modification time plus the number of transition/restore days.
+//
+//	e.g. If the object modtime is `Thu May 21 13:42:50 GMT 2020` and the object should
+//	    transition in 1 day, then the expected transition time is `Fri, 23 May 2020 00:00:00 GMT`
+func ExpectedExpiryTime(modTime time.Time, days int) time.Time {
+	if days == 0 {
+		return modTime
+	}
+	t := modTime.UTC().Add(time.Duration(days+1) * 24 * time.Hour)
+	return t.Truncate(24 * time.Hour)
+}
+
+// SetPredictionHeaders sets time to expiry and transition headers on w for a
+// given obj.
+func (lc Lifecycle) SetPredictionHeaders(w http.ResponseWriter, obj ObjectOpts) {
+	event := lc.eval(obj, time.Time{}, 0)
+	switch event.Action {
+	case DeleteAction, DeleteVersionAction, DeleteAllVersionsAction, DelMarkerDeleteAllVersionsAction:
+		w.Header()[xhttp.AmzExpiration] = []string{
+			fmt.Sprintf(`expiry-date="%s", rule-id="%s"`, event.Due.Format(http.TimeFormat), event.RuleID),
+		}
+	case TransitionAction, TransitionVersionAction:
+		w.Header()[xhttp.MinIOTransition] = []string{
+			fmt.Sprintf(`transition-date="%s", rule-id="%s"`, event.Due.Format(http.TimeFormat), event.RuleID),
+		}
+	}
+}
+
+// NoncurrentVersionsExpirationLimit returns the number of noncurrent versions
+// to be retained from the first applicable rule per S3 behavior.
+func (lc Lifecycle) NoncurrentVersionsExpirationLimit(obj ObjectOpts) Event {
+	for _, rule := range lc.FilterRules(obj) {
+		if rule.NoncurrentVersionExpiration.NewerNoncurrentVersions == 0 {
+			continue
+		}
+		return Event{
+			Action:                  DeleteVersionAction,
+			RuleID:                  rule.ID,
+			NoncurrentDays:          int(rule.NoncurrentVersionExpiration.NoncurrentDays),
+			NewerNoncurrentVersions: rule.NoncurrentVersionExpiration.NewerNoncurrentVersions,
+		}
+	}
+	return Event{}
+}

internal/bucket/lifecycle/noncurrentversion.go

@@ -0,0 +1,156 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"time"
+)
+
+// NoncurrentVersionExpiration - an action for lifecycle configuration rule.
+type NoncurrentVersionExpiration struct {
+	XMLName                 xml.Name       `xml:"NoncurrentVersionExpiration"`
+	NoncurrentDays          ExpirationDays `xml:"NoncurrentDays,omitempty"`
+	NewerNoncurrentVersions int            `xml:"NewerNoncurrentVersions,omitempty"`
+	set                     bool
+}
+
+// MarshalXML if non-current days not set to non zero value
+func (n NoncurrentVersionExpiration) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if n.IsNull() {
+		return nil
+	}
+	type noncurrentVersionExpirationWrapper NoncurrentVersionExpiration
+	return e.EncodeElement(noncurrentVersionExpirationWrapper(n), start)
+}
+
+// UnmarshalXML decodes NoncurrentVersionExpiration
+func (n *NoncurrentVersionExpiration) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	// To handle xml with MaxNoncurrentVersions from older MinIO releases.
+	// note: only one of MaxNoncurrentVersions or NewerNoncurrentVersions would be present.
+	type noncurrentExpiration struct {
+		XMLName                 xml.Name       `xml:"NoncurrentVersionExpiration"`
+		NoncurrentDays          ExpirationDays `xml:"NoncurrentDays,omitempty"`
+		NewerNoncurrentVersions int            `xml:"NewerNoncurrentVersions,omitempty"`
+		MaxNoncurrentVersions   int            `xml:"MaxNoncurrentVersions,omitempty"`
+	}
+
+	var val noncurrentExpiration
+	err := d.DecodeElement(&val, &startElement)
+	if err != nil {
+		return err
+	}
+	if val.MaxNoncurrentVersions > 0 {
+		val.NewerNoncurrentVersions = val.MaxNoncurrentVersions
+	}
+	*n = NoncurrentVersionExpiration{
+		XMLName:                 val.XMLName,
+		NoncurrentDays:          val.NoncurrentDays,
+		NewerNoncurrentVersions: val.NewerNoncurrentVersions,
+	}
+	n.set = true
+	return nil
+}
+
+// IsNull returns if both NoncurrentDays and NoncurrentVersions are empty
+func (n NoncurrentVersionExpiration) IsNull() bool {
+	return n.IsDaysNull() && n.NewerNoncurrentVersions == 0
+}
+
+// IsDaysNull returns true if days field is null
+func (n NoncurrentVersionExpiration) IsDaysNull() bool {
+	return n.NoncurrentDays == ExpirationDays(0)
+}
+
+// Validate returns an error with wrong value
+func (n NoncurrentVersionExpiration) Validate() error {
+	if !n.set {
+		return nil
+	}
+	val := int(n.NoncurrentDays)
+	switch {
+	case val == 0 && n.NewerNoncurrentVersions == 0:
+		// both fields can't be zero
+		return errXMLNotWellFormed
+
+	case val < 0, n.NewerNoncurrentVersions < 0:
+		// negative values are not supported
+		return errXMLNotWellFormed
+	}
+	return nil
+}
+
+// NoncurrentVersionTransition - an action for lifecycle configuration rule.
+type NoncurrentVersionTransition struct {
+	NoncurrentDays TransitionDays `xml:"NoncurrentDays"`
+	StorageClass   string         `xml:"StorageClass"`
+	set            bool
+}
+
+// MarshalXML is extended to leave out
+// <NoncurrentVersionTransition></NoncurrentVersionTransition> tags
+func (n NoncurrentVersionTransition) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if n.IsNull() {
+		return nil
+	}
+	type noncurrentVersionTransitionWrapper NoncurrentVersionTransition
+	return e.EncodeElement(noncurrentVersionTransitionWrapper(n), start)
+}
+
+// UnmarshalXML decodes NoncurrentVersionExpiration
+func (n *NoncurrentVersionTransition) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	type noncurrentVersionTransitionWrapper NoncurrentVersionTransition
+	var val noncurrentVersionTransitionWrapper
+	err := d.DecodeElement(&val, &startElement)
+	if err != nil {
+		return err
+	}
+	*n = NoncurrentVersionTransition(val)
+	n.set = true
+	return nil
+}
+
+// IsNull returns true if NoncurrentTransition doesn't refer to any storage-class.
+// Note: It supports immediate transition, i.e zero noncurrent days.
+func (n NoncurrentVersionTransition) IsNull() bool {
+	return n.StorageClass == ""
+}
+
+// Validate returns an error with wrong value
+func (n NoncurrentVersionTransition) Validate() error {
+	if !n.set {
+		return nil
+	}
+	if n.StorageClass == "" {
+		return errXMLNotWellFormed
+	}
+	return nil
+}
+
+// NextDue returns upcoming NoncurrentVersionTransition date for obj if
+// applicable, returns false otherwise.
+func (n NoncurrentVersionTransition) NextDue(obj ObjectOpts) (time.Time, bool) {
+	if obj.IsLatest || n.StorageClass == "" {
+		return time.Time{}, false
+	}
+	// Days == 0 indicates immediate tiering, i.e object is eligible for tiering since it became noncurrent.
+	if n.NoncurrentDays == 0 {
+		return obj.SuccessorModTime, true
+	}
+	return ExpectedExpiryTime(obj.SuccessorModTime, int(n.NoncurrentDays)), true
+}

internal/bucket/lifecycle/noncurrentversion_test.go

@@ -0,0 +1,82 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import "testing"
+
+func Test_NoncurrentVersionsExpiration_Validation(t *testing.T) {
+	testcases := []struct {
+		n   NoncurrentVersionExpiration
+		err error
+	}{
+		{
+			n: NoncurrentVersionExpiration{
+				NoncurrentDays:          0,
+				NewerNoncurrentVersions: 0,
+				set:                     true,
+			},
+			err: errXMLNotWellFormed,
+		},
+		{
+			n: NoncurrentVersionExpiration{
+				NoncurrentDays:          90,
+				NewerNoncurrentVersions: 0,
+				set:                     true,
+			},
+			err: nil,
+		},
+		{
+			n: NoncurrentVersionExpiration{
+				NoncurrentDays:          90,
+				NewerNoncurrentVersions: 2,
+				set:                     true,
+			},
+			err: nil,
+		},
+		{
+			n: NoncurrentVersionExpiration{
+				NoncurrentDays: -1,
+				set:            true,
+			},
+			err: errXMLNotWellFormed,
+		},
+		{
+			n: NoncurrentVersionExpiration{
+				NoncurrentDays:          90,
+				NewerNoncurrentVersions: -2,
+				set:                     true,
+			},
+			err: errXMLNotWellFormed,
+		},
+		// MinIO extension: supports zero NoncurrentDays when NewerNoncurrentVersions > 0
+		{
+			n: NoncurrentVersionExpiration{
+				NoncurrentDays:          0,
+				NewerNoncurrentVersions: 5,
+				set:                     true,
+			},
+			err: nil,
+		},
+	}
+
+	for i, tc := range testcases {
+		if got := tc.n.Validate(); got != tc.err {
+			t.Fatalf("%d: expected %v but got %v", i+1, tc.err, got)
+		}
+	}
+}

internal/bucket/lifecycle/prefix.go

@@ -0,0 +1,52 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+)
+
+// Prefix holds the prefix xml tag in <Rule> and <Filter>
+type Prefix struct {
+	string
+	set    bool
+	Unused struct{} // Needed for GOB compatibility
+}
+
+// UnmarshalXML - decodes XML data.
+func (p *Prefix) UnmarshalXML(d *xml.Decoder, start xml.StartElement) (err error) {
+	var s string
+	if err = d.DecodeElement(&s, &start); err != nil {
+		return err
+	}
+	*p = Prefix{string: s, set: true}
+	return nil
+}
+
+// MarshalXML - decodes XML data.
+func (p Prefix) MarshalXML(e *xml.Encoder, startElement xml.StartElement) error {
+	if !p.set {
+		return nil
+	}
+	return e.EncodeElement(p.string, startElement)
+}
+
+// String returns the prefix string
+func (p Prefix) String() string {
+	return p.string
+}

internal/bucket/lifecycle/rule.go

@@ -0,0 +1,194 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"bytes"
+	"encoding/xml"
+)
+
+// Status represents lifecycle configuration status
+type Status string
+
+// Supported status types
+const (
+	Enabled  Status = "Enabled"
+	Disabled Status = "Disabled"
+)
+
+// Rule - a rule for lifecycle configuration.
+type Rule struct {
+	XMLName             xml.Name            `xml:"Rule"`
+	ID                  string              `xml:"ID,omitempty"`
+	Status              Status              `xml:"Status"`
+	Filter              Filter              `xml:"Filter,omitempty"`
+	Prefix              Prefix              `xml:"Prefix,omitempty"`
+	Expiration          Expiration          `xml:"Expiration,omitempty"`
+	Transition          Transition          `xml:"Transition,omitempty"`
+	DelMarkerExpiration DelMarkerExpiration `xml:"DelMarkerExpiration,omitempty"`
+	// FIXME: add a type to catch unsupported AbortIncompleteMultipartUpload AbortIncompleteMultipartUpload `xml:"AbortIncompleteMultipartUpload,omitempty"`
+	NoncurrentVersionExpiration NoncurrentVersionExpiration `xml:"NoncurrentVersionExpiration,omitempty"`
+	NoncurrentVersionTransition NoncurrentVersionTransition `xml:"NoncurrentVersionTransition,omitempty"`
+}
+
+var (
+	errInvalidRuleID                  = Errorf("ID length is limited to 255 characters")
+	errEmptyRuleStatus                = Errorf("Status should not be empty")
+	errInvalidRuleStatus              = Errorf("Status must be set to either Enabled or Disabled")
+	errInvalidRuleDelMarkerExpiration = Errorf("Rule with DelMarkerExpiration cannot have tags based filtering")
+)
+
+// validateID - checks if ID is valid or not.
+func (r Rule) validateID() error {
+	if len(r.ID) > 255 {
+		return errInvalidRuleID
+	}
+	return nil
+}
+
+// validateStatus - checks if status is valid or not.
+func (r Rule) validateStatus() error {
+	// Status can't be empty
+	if len(r.Status) == 0 {
+		return errEmptyRuleStatus
+	}
+
+	// Status must be one of Enabled or Disabled
+	if r.Status != Enabled && r.Status != Disabled {
+		return errInvalidRuleStatus
+	}
+	return nil
+}
+
+func (r Rule) validateExpiration() error {
+	return r.Expiration.Validate()
+}
+
+func (r Rule) validateNoncurrentExpiration() error {
+	return r.NoncurrentVersionExpiration.Validate()
+}
+
+func (r Rule) validatePrefixAndFilter() error {
+	// In the now deprecated PutBucketLifecycle API, Rule had a mandatory Prefix element and there existed no Filter field.
+	// See https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycle.html
+	// In the newer PutBucketLifecycleConfiguration API, Rule has a prefix field that is deprecated, and there exists an optional
+	// Filter field, and within it, an optional Prefix field.
+	// See https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycleConfiguration.html
+	// A valid rule could be a pre-existing one created using the now deprecated PutBucketLifecycle.
+	// Or, a valid rule could also be either a pre-existing or a new rule that is created using PutBucketLifecycleConfiguration.
+	// Prefix validation below may check that either Rule.Prefix or Rule.Filter.Prefix exist but not both.
+	// Here, we assume the pre-existing rule created using PutBucketLifecycle API is already valid and won't fail the validation if Rule.Prefix is empty.
+
+	if r.Prefix.set && !r.Filter.IsEmpty() && r.Filter.Prefix.set {
+		return errXMLNotWellFormed
+	}
+
+	if r.Filter.set {
+		return r.Filter.Validate()
+	}
+	return nil
+}
+
+func (r Rule) validateTransition() error {
+	return r.Transition.Validate()
+}
+
+func (r Rule) validateNoncurrentTransition() error {
+	return r.NoncurrentVersionTransition.Validate()
+}
+
+// GetPrefix - a rule can either have prefix under <rule></rule>, <filter></filter>
+// or under <filter><and></and></filter>. This method returns the prefix from the
+// location where it is available.
+func (r Rule) GetPrefix() string {
+	if p := r.Prefix.String(); p != "" {
+		return p
+	}
+	if p := r.Filter.Prefix.String(); p != "" {
+		return p
+	}
+	if p := r.Filter.And.Prefix.String(); p != "" {
+		return p
+	}
+	return ""
+}
+
+// Tags - a rule can either have tag under <filter></filter> or under
+// <filter><and></and></filter>. This method returns all the tags from the
+// rule in the format tag1=value1&tag2=value2
+func (r Rule) Tags() string {
+	if !r.Filter.Tag.IsEmpty() {
+		return r.Filter.Tag.String()
+	}
+	if len(r.Filter.And.Tags) != 0 {
+		var buf bytes.Buffer
+		for _, t := range r.Filter.And.Tags {
+			if buf.Len() > 0 {
+				buf.WriteString("&")
+			}
+			buf.WriteString(t.String())
+		}
+		return buf.String()
+	}
+	return ""
+}
+
+// Validate - validates the rule element
+func (r Rule) Validate() error {
+	if err := r.validateID(); err != nil {
+		return err
+	}
+	if err := r.validateStatus(); err != nil {
+		return err
+	}
+	if err := r.validateExpiration(); err != nil {
+		return err
+	}
+	if err := r.validateNoncurrentExpiration(); err != nil {
+		return err
+	}
+	if err := r.validatePrefixAndFilter(); err != nil {
+		return err
+	}
+	if err := r.validateTransition(); err != nil {
+		return err
+	}
+	if err := r.validateNoncurrentTransition(); err != nil {
+		return err
+	}
+	if (!r.Filter.Tag.IsEmpty() || len(r.Filter.And.Tags) != 0) && !r.DelMarkerExpiration.Empty() {
+		return errInvalidRuleDelMarkerExpiration
+	}
+	if !r.Expiration.set && !r.Transition.set && !r.NoncurrentVersionExpiration.set && !r.NoncurrentVersionTransition.set && r.DelMarkerExpiration.Empty() {
+		return errXMLNotWellFormed
+	}
+	return nil
+}
+
+// CloneNonTransition - returns a clone of the object containing non transition rules
+func (r Rule) CloneNonTransition() Rule {
+	return Rule{
+		XMLName:                     r.XMLName,
+		ID:                          r.ID,
+		Status:                      r.Status,
+		Filter:                      r.Filter,
+		Prefix:                      r.Prefix,
+		Expiration:                  r.Expiration,
+		NoncurrentVersionExpiration: r.NoncurrentVersionExpiration,
+	}
+}

internal/bucket/lifecycle/rule_test.go

@@ -0,0 +1,148 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"fmt"
+	"testing"
+)
+
+// TestInvalidRules checks if Rule xml with invalid elements returns
+// appropriate errors on validation
+func TestInvalidRules(t *testing.T) {
+	invalidTestCases := []struct {
+		inputXML    string
+		expectedErr error
+	}{
+		{ // Rule with ID longer than 255 characters
+			inputXML: ` <Rule>
+	                    <ID> babababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab </ID>
+	                    </Rule>`,
+			expectedErr: errInvalidRuleID,
+		},
+		{ // Rule with empty ID
+			inputXML: `<Rule>
+							<ID></ID>
+							<Filter><Prefix></Prefix></Filter>
+							<Expiration>
+								<Days>365</Days>
+							</Expiration>
+                            <Status>Enabled</Status>
+	                    </Rule>`,
+			expectedErr: nil,
+		},
+		{ // Rule with empty status
+			inputXML: ` <Rule>
+			                  <ID>rule with empty status</ID>
+                              <Status></Status>
+	                    </Rule>`,
+			expectedErr: errEmptyRuleStatus,
+		},
+		{ // Rule with invalid status
+			inputXML: ` <Rule>
+			                  <ID>rule with invalid status</ID>
+                              <Status>OK</Status>
+	                    </Rule>`,
+			expectedErr: errInvalidRuleStatus,
+		},
+		{ // Rule with negative values for ObjectSizeLessThan
+			inputXML: `<Rule>
+				<ID>negative-obj-size-less-than</ID>
+				<Filter><ObjectSizeLessThan>-1</ObjectSizeLessThan></Filter>
+				<Expiration>
+					<Days>365</Days>
+				</Expiration>
+                            <Status>Enabled</Status>
+	                    </Rule>`,
+			expectedErr: errXMLNotWellFormed,
+		},
+		{ // Rule with negative values for And>ObjectSizeLessThan
+			inputXML: `<Rule>
+				<ID>negative-and-obj-size-less-than</ID>
+				<Filter><And><ObjectSizeLessThan>-1</ObjectSizeLessThan></And></Filter>
+				<Expiration>
+					<Days>365</Days>
+				</Expiration>
+                            <Status>Enabled</Status>
+	                    </Rule>`,
+			expectedErr: errXMLNotWellFormed,
+		},
+		{ // Rule with negative values for ObjectSizeGreaterThan
+			inputXML: `<Rule>
+				<ID>negative-obj-size-greater-than</ID>
+				<Filter><ObjectSizeGreaterThan>-1</ObjectSizeGreaterThan></Filter>
+				<Expiration>
+					<Days>365</Days>
+				</Expiration>
+                            <Status>Enabled</Status>
+	                    </Rule>`,
+			expectedErr: errXMLNotWellFormed,
+		},
+		{ // Rule with negative values for And>ObjectSizeGreaterThan
+			inputXML: `<Rule>
+				<ID>negative-and-obj-size-greater-than</ID>
+				<Filter><And><ObjectSizeGreaterThan>-1</ObjectSizeGreaterThan></And></Filter>
+				<Expiration>
+					<Days>365</Days>
+				</Expiration>
+                            <Status>Enabled</Status>
+	                    </Rule>`,
+			expectedErr: errXMLNotWellFormed,
+		},
+		{
+			inputXML: `<Rule>
+				<ID>Rule with a tag and DelMarkerExpiration</ID>
+				<Filter><Tag><Key>k1</Key><Value>v1</Value></Tag></Filter>
+				<DelMarkerExpiration>
+					<Days>365</Days>
+				</DelMarkerExpiration>
+                            <Status>Enabled</Status>
+	                    </Rule>`,
+			expectedErr: errInvalidRuleDelMarkerExpiration,
+		},
+		{
+			inputXML: `<Rule>
+				<ID>Rule with multiple tags and DelMarkerExpiration</ID>
+				<Filter><And>
+				<Tag><Key>k1</Key><Value>v1</Value></Tag>
+				<Tag><Key>k2</Key><Value>v2</Value></Tag>
+				</And></Filter>
+				<DelMarkerExpiration>
+					<Days>365</Days>
+				</DelMarkerExpiration>
+                            <Status>Enabled</Status>
+	                    </Rule>`,
+			expectedErr: errInvalidRuleDelMarkerExpiration,
+		},
+	}
+
+	for i, tc := range invalidTestCases {
+		t.Run(fmt.Sprintf("Test %d", i+1), func(t *testing.T) {
+			var rule Rule
+			err := xml.Unmarshal([]byte(tc.inputXML), &rule)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if err := rule.Validate(); err != tc.expectedErr {
+				t.Fatalf("%d: Expected %v but got %v", i+1, tc.expectedErr, err)
+			}
+		})
+	}
+}

internal/bucket/lifecycle/tag.go

@@ -0,0 +1,101 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"io"
+	"unicode/utf8"
+)
+
+// Tag - a tag for a lifecycle configuration Rule filter.
+type Tag struct {
+	XMLName xml.Name `xml:"Tag"`
+	Key     string   `xml:"Key,omitempty"`
+	Value   string   `xml:"Value,omitempty"`
+}
+
+var (
+	errInvalidTagKey   = Errorf("The TagKey you have provided is invalid")
+	errInvalidTagValue = Errorf("The TagValue you have provided is invalid")
+
+	errDuplicatedXMLTag = Errorf("duplicated XML Tag")
+	errUnknownXMLTag    = Errorf("unknown XML Tag")
+)
+
+// UnmarshalXML - decodes XML data.
+func (tag *Tag) UnmarshalXML(d *xml.Decoder, start xml.StartElement) (err error) {
+	var keyAlreadyParsed, valueAlreadyParsed bool
+	for {
+		// Read tokens from the XML document in a stream.
+		t, err := d.Token()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+
+		if se, ok := t.(xml.StartElement); ok {
+			var s string
+			if err = d.DecodeElement(&s, &se); err != nil {
+				return err
+			}
+			switch se.Name.Local {
+			case "Key":
+				if keyAlreadyParsed {
+					return errDuplicatedXMLTag
+				}
+				tag.Key = s
+				keyAlreadyParsed = true
+			case "Value":
+				if valueAlreadyParsed {
+					return errDuplicatedXMLTag
+				}
+				tag.Value = s
+				valueAlreadyParsed = true
+			default:
+				return errUnknownXMLTag
+			}
+		}
+	}
+
+	return nil
+}
+
+func (tag Tag) String() string {
+	return tag.Key + "=" + tag.Value
+}
+
+// IsEmpty returns whether this tag is empty or not.
+func (tag Tag) IsEmpty() bool {
+	return tag.Key == ""
+}
+
+// Validate checks this tag.
+func (tag Tag) Validate() error {
+	if len(tag.Key) == 0 || utf8.RuneCountInString(tag.Key) > 128 {
+		return errInvalidTagKey
+	}
+
+	if utf8.RuneCountInString(tag.Value) > 256 {
+		return errInvalidTagValue
+	}
+
+	return nil
+}

internal/bucket/lifecycle/transition.go

@@ -0,0 +1,178 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"time"
+)
+
+var (
+	errTransitionInvalidDays     = Errorf("Days must be 0 or greater when used with Transition")
+	errTransitionInvalidDate     = Errorf("Date must be provided in ISO 8601 format")
+	errTransitionInvalid         = Errorf("Exactly one of Days (0 or greater) or Date (positive ISO 8601 format) should be present in Transition.")
+	errTransitionDateNotMidnight = Errorf("'Date' must be at midnight GMT")
+)
+
+// TransitionDate is a embedded type containing time.Time to unmarshal
+// Date in Transition
+type TransitionDate struct {
+	time.Time
+}
+
+// UnmarshalXML parses date from Transition and validates date format
+func (tDate *TransitionDate) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	var dateStr string
+	err := d.DecodeElement(&dateStr, &startElement)
+	if err != nil {
+		return err
+	}
+	// While AWS documentation mentions that the date specified
+	// must be present in ISO 8601 format, in reality they allow
+	// users to provide RFC 3339 compliant dates.
+	trnDate, err := time.Parse(time.RFC3339, dateStr)
+	if err != nil {
+		return errTransitionInvalidDate
+	}
+	// Allow only date timestamp specifying midnight GMT
+	hr, m, sec := trnDate.Clock()
+	nsec := trnDate.Nanosecond()
+	loc := trnDate.Location()
+	if hr != 0 || m != 0 || sec != 0 || nsec != 0 || loc.String() != time.UTC.String() {
+		return errTransitionDateNotMidnight
+	}
+
+	*tDate = TransitionDate{trnDate}
+	return nil
+}
+
+// MarshalXML encodes expiration date if it is non-zero and encodes
+// empty string otherwise
+func (tDate TransitionDate) MarshalXML(e *xml.Encoder, startElement xml.StartElement) error {
+	if tDate.IsZero() {
+		return nil
+	}
+	return e.EncodeElement(tDate.Format(time.RFC3339), startElement)
+}
+
+// TransitionDays is a type alias to unmarshal Days in Transition
+type TransitionDays int
+
+// UnmarshalXML parses number of days from Transition and validates if
+// >= 0
+func (tDays *TransitionDays) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	var days int
+	err := d.DecodeElement(&days, &startElement)
+	if err != nil {
+		return err
+	}
+
+	if days < 0 {
+		return errTransitionInvalidDays
+	}
+	*tDays = TransitionDays(days)
+
+	return nil
+}
+
+// MarshalXML encodes number of days to expire if it is non-zero and
+// encodes empty string otherwise
+func (tDays TransitionDays) MarshalXML(e *xml.Encoder, startElement xml.StartElement) error {
+	return e.EncodeElement(int(tDays), startElement)
+}
+
+// Transition - transition actions for a rule in lifecycle configuration.
+type Transition struct {
+	XMLName      xml.Name       `xml:"Transition"`
+	Days         TransitionDays `xml:"Days,omitempty"`
+	Date         TransitionDate `xml:"Date,omitempty"`
+	StorageClass string         `xml:"StorageClass,omitempty"`
+
+	set bool
+}
+
+// IsEnabled returns if transition is enabled.
+func (t Transition) IsEnabled() bool {
+	return t.set
+}
+
+// MarshalXML encodes transition field into an XML form.
+func (t Transition) MarshalXML(enc *xml.Encoder, start xml.StartElement) error {
+	if !t.set {
+		return nil
+	}
+	type transitionWrapper Transition
+	return enc.EncodeElement(transitionWrapper(t), start)
+}
+
+// UnmarshalXML decodes transition field from the XML form.
+func (t *Transition) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	type transitionWrapper Transition
+	var trw transitionWrapper
+	err := d.DecodeElement(&trw, &startElement)
+	if err != nil {
+		return err
+	}
+	*t = Transition(trw)
+	t.set = true
+	return nil
+}
+
+// Validate - validates the "Transition" element
+func (t Transition) Validate() error {
+	if !t.set {
+		return nil
+	}
+
+	if !t.IsDateNull() && t.Days > 0 {
+		return errTransitionInvalid
+	}
+
+	if t.StorageClass == "" {
+		return errXMLNotWellFormed
+	}
+	return nil
+}
+
+// IsDateNull returns true if date field is null
+func (t Transition) IsDateNull() bool {
+	return t.Date.IsZero()
+}
+
+// IsNull returns true if both date and days fields are null
+func (t Transition) IsNull() bool {
+	return t.StorageClass == ""
+}
+
+// NextDue returns upcoming transition date for obj and true if applicable,
+// returns false otherwise.
+func (t Transition) NextDue(obj ObjectOpts) (time.Time, bool) {
+	if !obj.IsLatest || t.IsNull() {
+		return time.Time{}, false
+	}
+
+	if !t.IsDateNull() {
+		return t.Date.Time, true
+	}
+
+	// Days == 0 indicates immediate tiering, i.e object is eligible for tiering since its creation.
+	if t.Days == 0 {
+		return obj.ModTime, true
+	}
+	return ExpectedExpiryTime(obj.ModTime, int(t.Days)), true
+}

internal/bucket/lifecycle/transition_test.go

@@ -0,0 +1,93 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lifecycle
+
+import (
+	"encoding/xml"
+	"testing"
+)
+
+func TestTransitionUnmarshalXML(t *testing.T) {
+	trTests := []struct {
+		input string
+		err   error
+	}{
+		{
+			input: `<Transition>
+			<Days>0</Days>
+			<StorageClass>S3TIER-1</StorageClass>
+		  </Transition>`,
+			err: nil,
+		},
+		{
+			input: `<Transition>
+			<Days>1</Days>
+			<Date>2021-01-01T00:00:00Z</Date>
+			<StorageClass>S3TIER-1</StorageClass>
+		  </Transition>`,
+			err: errTransitionInvalid,
+		},
+		{
+			input: `<Transition>
+			<Days>1</Days>
+		  </Transition>`,
+			err: errXMLNotWellFormed,
+		},
+	}
+
+	for i, tc := range trTests {
+		var tr Transition
+		err := xml.Unmarshal([]byte(tc.input), &tr)
+		if err != nil {
+			t.Fatalf("%d: xml unmarshal failed with %v", i+1, err)
+		}
+		if err = tr.Validate(); err != tc.err {
+			t.Fatalf("%d: Invalid transition %v: err %v", i+1, tr, err)
+		}
+	}
+
+	ntrTests := []struct {
+		input string
+		err   error
+	}{
+		{
+			input: `<NoncurrentVersionTransition>
+			<NoncurrentDays>0</NoncurrentDays>
+			<StorageClass>S3TIER-1</StorageClass>
+		  </NoncurrentVersionTransition>`,
+			err: nil,
+		},
+		{
+			input: `<NoncurrentVersionTransition>
+			<Days>1</Days>
+		  </NoncurrentVersionTransition>`,
+			err: errXMLNotWellFormed,
+		},
+	}
+
+	for i, tc := range ntrTests {
+		var ntr NoncurrentVersionTransition
+		err := xml.Unmarshal([]byte(tc.input), &ntr)
+		if err != nil {
+			t.Fatalf("%d: xml unmarshal failed with %v", i+1, err)
+		}
+		if err = ntr.Validate(); err != tc.err {
+			t.Fatalf("%d: Invalid noncurrent version transition %v: err %v", i+1, ntr, err)
+		}
+	}
+}

internal/bucket/object/lock/lock.go

@@ -0,0 +1,622 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lock
+
+import (
+	"bytes"
+	"context"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+	"net/textproto"
+	"strings"
+	"time"
+
+	"github.com/beevik/ntp"
+	"github.com/minio/minio/internal/amztime"
+	xhttp "github.com/minio/minio/internal/http"
+
+	"github.com/minio/minio/internal/logger"
+	"github.com/minio/pkg/v3/env"
+)
+
+const (
+	logSubsys = "locking"
+)
+
+func lockLogIf(ctx context.Context, err error) {
+	logger.LogIf(ctx, logSubsys, err)
+}
+
+// Enabled indicates object locking is enabled
+const Enabled = "Enabled"
+
+// RetMode - object retention mode.
+type RetMode string
+
+const (
+	// RetGovernance - governance mode.
+	RetGovernance RetMode = "GOVERNANCE"
+
+	// RetCompliance - compliance mode.
+	RetCompliance RetMode = "COMPLIANCE"
+)
+
+// Valid - returns if retention mode is valid
+func (r RetMode) Valid() bool {
+	switch r {
+	case RetGovernance, RetCompliance:
+		return true
+	}
+	return false
+}
+
+func parseRetMode(modeStr string) (mode RetMode) {
+	switch strings.ToUpper(modeStr) {
+	case "GOVERNANCE":
+		mode = RetGovernance
+	case "COMPLIANCE":
+		mode = RetCompliance
+	}
+	return mode
+}
+
+// LegalHoldStatus - object legal hold status.
+type LegalHoldStatus string
+
+const (
+	// LegalHoldOn - legal hold is on.
+	LegalHoldOn LegalHoldStatus = "ON"
+
+	// LegalHoldOff - legal hold is off.
+	LegalHoldOff LegalHoldStatus = "OFF"
+)
+
+// Valid - returns true if legal hold status has valid values
+func (l LegalHoldStatus) Valid() bool {
+	switch l {
+	case LegalHoldOn, LegalHoldOff:
+		return true
+	}
+	return false
+}
+
+func parseLegalHoldStatus(holdStr string) (st LegalHoldStatus) {
+	switch strings.ToUpper(holdStr) {
+	case "ON":
+		st = LegalHoldOn
+	case "OFF":
+		st = LegalHoldOff
+	}
+	return st
+}
+
+// Bypass retention governance header.
+const (
+	AmzObjectLockBypassRetGovernance = "X-Amz-Bypass-Governance-Retention"
+	AmzObjectLockRetainUntilDate     = "X-Amz-Object-Lock-Retain-Until-Date"
+	AmzObjectLockMode                = "X-Amz-Object-Lock-Mode"
+	AmzObjectLockLegalHold           = "X-Amz-Object-Lock-Legal-Hold"
+)
+
+var (
+	// ErrMalformedBucketObjectConfig -indicates that the bucket object lock config is malformed
+	ErrMalformedBucketObjectConfig = errors.New("invalid bucket object lock config")
+	// ErrInvalidRetentionDate - indicates that retention date needs to be in ISO 8601 format
+	ErrInvalidRetentionDate = errors.New("date must be provided in ISO 8601 format")
+	// ErrPastObjectLockRetainDate - indicates that retention date must be in the future
+	ErrPastObjectLockRetainDate = errors.New("the retain until date must be in the future")
+	// ErrUnknownWORMModeDirective - indicates that the retention mode is invalid
+	ErrUnknownWORMModeDirective = errors.New("unknown WORM mode directive")
+	// ErrObjectLockMissingContentMD5 - indicates missing Content-MD5 header for put object requests with locking
+	ErrObjectLockMissingContentMD5 = errors.New("content-MD5 HTTP header is required for Put Object requests with Object Lock parameters")
+	// ErrObjectLockInvalidHeaders indicates that object lock headers are missing
+	ErrObjectLockInvalidHeaders = errors.New("x-amz-object-lock-retain-until-date and x-amz-object-lock-mode must both be supplied")
+	// ErrMalformedXML - generic error indicating malformed XML
+	ErrMalformedXML = errors.New("the XML you provided was not well-formed or did not validate against our published schema")
+)
+
+const (
+	ntpServerEnv = "MINIO_NTP_SERVER"
+)
+
+var ntpServer = env.Get(ntpServerEnv, "")
+
+// UTCNowNTP - is similar in functionality to UTCNow()
+// but only used when we do not wish to rely on system
+// time.
+func UTCNowNTP() (time.Time, error) {
+	// ntp server is disabled
+	if ntpServer == "" {
+		return time.Now().UTC(), nil
+	}
+	return ntp.Time(ntpServer)
+}
+
+// Retention - bucket level retention configuration.
+type Retention struct {
+	Mode        RetMode
+	Validity    time.Duration
+	LockEnabled bool
+}
+
+// Retain - check whether given date is retainable by validity time.
+func (r Retention) Retain(created time.Time) bool {
+	t, err := UTCNowNTP()
+	if err != nil {
+		lockLogIf(context.Background(), err)
+		// Retain
+		return true
+	}
+	return created.Add(r.Validity).After(t)
+}
+
+// DefaultRetention - default retention configuration.
+type DefaultRetention struct {
+	XMLName xml.Name `xml:"DefaultRetention"`
+	Mode    RetMode  `xml:"Mode"`
+	Days    *uint64  `xml:"Days"`
+	Years   *uint64  `xml:"Years"`
+}
+
+// Maximum support retention days and years supported by AWS S3.
+const (
+	// This tested by using `mc lock` command
+	maximumRetentionDays  = 36500
+	maximumRetentionYears = 100
+)
+
+// UnmarshalXML - decodes XML data.
+func (dr *DefaultRetention) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	// Make subtype to avoid recursive UnmarshalXML().
+	type defaultRetention DefaultRetention
+	retention := defaultRetention{}
+
+	if err := d.DecodeElement(&retention, &start); err != nil {
+		return err
+	}
+
+	switch retention.Mode {
+	case RetGovernance, RetCompliance:
+	default:
+		return fmt.Errorf("unknown retention mode %v", retention.Mode)
+	}
+
+	if retention.Days == nil && retention.Years == nil {
+		return fmt.Errorf("either Days or Years must be specified")
+	}
+
+	if retention.Days != nil && retention.Years != nil {
+		return fmt.Errorf("either Days or Years must be specified, not both")
+	}
+
+	//nolint:gocritic
+	if retention.Days != nil {
+		if *retention.Days == 0 {
+			return fmt.Errorf("Default retention period must be a positive integer value for 'Days'")
+		}
+		if *retention.Days > maximumRetentionDays {
+			return fmt.Errorf("Default retention period too large for 'Days' %d", *retention.Days)
+		}
+	} else if *retention.Years == 0 {
+		return fmt.Errorf("Default retention period must be a positive integer value for 'Years'")
+	} else if *retention.Years > maximumRetentionYears {
+		return fmt.Errorf("Default retention period too large for 'Years' %d", *retention.Years)
+	}
+
+	*dr = DefaultRetention(retention)
+
+	return nil
+}
+
+// Config - object lock configuration specified in
+// https://docs.aws.amazon.com/AmazonS3/latest/API/Type_API_ObjectLockConfiguration.html
+type Config struct {
+	XMLNS             string   `xml:"xmlns,attr,omitempty"`
+	XMLName           xml.Name `xml:"ObjectLockConfiguration"`
+	ObjectLockEnabled string   `xml:"ObjectLockEnabled"`
+	Rule              *struct {
+		DefaultRetention DefaultRetention `xml:"DefaultRetention"`
+	} `xml:"Rule,omitempty"`
+}
+
+// String returns the human readable format of object lock configuration, used in audit logs.
+func (config Config) String() string {
+	parts := []string{
+		fmt.Sprintf("Enabled: %v", config.Enabled()),
+	}
+	if config.Rule != nil {
+		if config.Rule.DefaultRetention.Mode != "" {
+			parts = append(parts, fmt.Sprintf("Mode: %s", config.Rule.DefaultRetention.Mode))
+		}
+		if config.Rule.DefaultRetention.Days != nil {
+			parts = append(parts, fmt.Sprintf("Days: %d", *config.Rule.DefaultRetention.Days))
+		}
+		if config.Rule.DefaultRetention.Years != nil {
+			parts = append(parts, fmt.Sprintf("Years: %d", *config.Rule.DefaultRetention.Years))
+		}
+	}
+	return strings.Join(parts, ", ")
+}
+
+// Enabled returns true if config.ObjectLockEnabled is set to Enabled
+func (config *Config) Enabled() bool {
+	return config.ObjectLockEnabled == Enabled
+}
+
+// UnmarshalXML - decodes XML data.
+func (config *Config) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	// Make subtype to avoid recursive UnmarshalXML().
+	type objectLockConfig Config
+	parsedConfig := objectLockConfig{}
+
+	if err := d.DecodeElement(&parsedConfig, &start); err != nil {
+		return err
+	}
+
+	if parsedConfig.ObjectLockEnabled != Enabled {
+		return fmt.Errorf("only 'Enabled' value is allowed to ObjectLockEnabled element")
+	}
+
+	*config = Config(parsedConfig)
+	return nil
+}
+
+// ToRetention - convert to Retention type.
+func (config *Config) ToRetention() Retention {
+	r := Retention{
+		LockEnabled: config.ObjectLockEnabled == Enabled,
+	}
+	if config.Rule != nil {
+		r.Mode = config.Rule.DefaultRetention.Mode
+
+		t, err := UTCNowNTP()
+		if err != nil {
+			lockLogIf(context.Background(), err)
+			// Do not change any configuration
+			// upon NTP failure.
+			return r
+		}
+
+		if config.Rule.DefaultRetention.Days != nil {
+			r.Validity = t.AddDate(0, 0, int(*config.Rule.DefaultRetention.Days)).Sub(t)
+		} else {
+			r.Validity = t.AddDate(int(*config.Rule.DefaultRetention.Years), 0, 0).Sub(t)
+		}
+	}
+
+	return r
+}
+
+// Maximum 4KiB size per object lock config.
+const maxObjectLockConfigSize = 1 << 12
+
+// ParseObjectLockConfig parses ObjectLockConfig from xml
+func ParseObjectLockConfig(reader io.Reader) (*Config, error) {
+	config := Config{}
+	if err := xml.NewDecoder(io.LimitReader(reader, maxObjectLockConfigSize)).Decode(&config); err != nil {
+		return nil, err
+	}
+
+	return &config, nil
+}
+
+// NewObjectLockConfig returns a initialized lock.Config struct
+func NewObjectLockConfig() *Config {
+	return &Config{
+		ObjectLockEnabled: Enabled,
+	}
+}
+
+// RetentionDate is a embedded type containing time.Time to unmarshal
+// Date in Retention
+type RetentionDate struct {
+	time.Time
+}
+
+// UnmarshalXML parses date from Retention and validates date format
+func (rDate *RetentionDate) UnmarshalXML(d *xml.Decoder, startElement xml.StartElement) error {
+	var dateStr string
+	err := d.DecodeElement(&dateStr, &startElement)
+	if err != nil {
+		return err
+	}
+	// While AWS documentation mentions that the date specified
+	// must be present in ISO 8601 format, in reality they allow
+	// users to provide RFC 3339 compliant dates.
+	retDate, err := amztime.ISO8601Parse(dateStr)
+	if err != nil {
+		return ErrInvalidRetentionDate
+	}
+
+	*rDate = RetentionDate{retDate}
+	return nil
+}
+
+// MarshalXML encodes expiration date if it is non-zero and encodes
+// empty string otherwise
+func (rDate RetentionDate) MarshalXML(e *xml.Encoder, startElement xml.StartElement) error {
+	if rDate.IsZero() {
+		return nil
+	}
+	return e.EncodeElement(amztime.ISO8601Format(rDate.Time), startElement)
+}
+
+// ObjectRetention specified in
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html
+type ObjectRetention struct {
+	XMLNS           string        `xml:"xmlns,attr,omitempty"`
+	XMLName         xml.Name      `xml:"Retention"`
+	Mode            RetMode       `xml:"Mode,omitempty"`
+	RetainUntilDate RetentionDate `xml:"RetainUntilDate,omitempty"`
+}
+
+func (o ObjectRetention) String() string {
+	return fmt.Sprintf("Mode: %s, RetainUntilDate: %s", o.Mode, o.RetainUntilDate.Time)
+}
+
+// Maximum 4KiB size per object retention config.
+const maxObjectRetentionSize = 1 << 12
+
+// ParseObjectRetention constructs ObjectRetention struct from xml input
+func ParseObjectRetention(reader io.Reader) (*ObjectRetention, error) {
+	ret := ObjectRetention{}
+	if err := xml.NewDecoder(io.LimitReader(reader, maxObjectRetentionSize)).Decode(&ret); err != nil {
+		return nil, err
+	}
+	if ret.Mode != "" && !ret.Mode.Valid() {
+		return &ret, ErrUnknownWORMModeDirective
+	}
+
+	if ret.Mode.Valid() && ret.RetainUntilDate.IsZero() {
+		return &ret, ErrMalformedXML
+	}
+
+	if !ret.Mode.Valid() && !ret.RetainUntilDate.IsZero() {
+		return &ret, ErrMalformedXML
+	}
+
+	t, err := UTCNowNTP()
+	if err != nil {
+		lockLogIf(context.Background(), err)
+		return &ret, ErrPastObjectLockRetainDate
+	}
+
+	if !ret.RetainUntilDate.IsZero() && ret.RetainUntilDate.Before(t) {
+		return &ret, ErrPastObjectLockRetainDate
+	}
+
+	return &ret, nil
+}
+
+// IsObjectLockRetentionRequested returns true if object lock retention headers are set.
+func IsObjectLockRetentionRequested(h http.Header) bool {
+	if _, ok := h[AmzObjectLockMode]; ok {
+		return true
+	}
+	if _, ok := h[AmzObjectLockRetainUntilDate]; ok {
+		return true
+	}
+	return false
+}
+
+// IsObjectLockLegalHoldRequested returns true if object lock legal hold header is set.
+func IsObjectLockLegalHoldRequested(h http.Header) bool {
+	_, ok := h[AmzObjectLockLegalHold]
+	return ok
+}
+
+// IsObjectLockGovernanceBypassSet returns true if object lock governance bypass header is set.
+func IsObjectLockGovernanceBypassSet(h http.Header) bool {
+	return strings.EqualFold(h.Get(AmzObjectLockBypassRetGovernance), "true")
+}
+
+// IsObjectLockRequested returns true if legal hold or object lock retention headers are requested.
+func IsObjectLockRequested(h http.Header) bool {
+	return IsObjectLockLegalHoldRequested(h) || IsObjectLockRetentionRequested(h)
+}
+
+// ParseObjectLockRetentionHeaders parses http headers to extract retention mode and retention date
+func ParseObjectLockRetentionHeaders(h http.Header) (rmode RetMode, r RetentionDate, err error) {
+	retMode := h.Get(AmzObjectLockMode)
+	dateStr := h.Get(AmzObjectLockRetainUntilDate)
+	if len(retMode) == 0 || len(dateStr) == 0 {
+		return rmode, r, ErrObjectLockInvalidHeaders
+	}
+
+	rmode = parseRetMode(retMode)
+	if !rmode.Valid() {
+		return rmode, r, ErrUnknownWORMModeDirective
+	}
+
+	var retDate time.Time
+	// While AWS documentation mentions that the date specified
+	// must be present in ISO 8601 format, in reality they allow
+	// users to provide RFC 3339 compliant dates.
+	retDate, err = amztime.ISO8601Parse(dateStr)
+	if err != nil {
+		return rmode, r, ErrInvalidRetentionDate
+	}
+	_, replReq := h[textproto.CanonicalMIMEHeaderKey(xhttp.MinIOSourceReplicationRequest)]
+
+	t, err := UTCNowNTP()
+	if err != nil {
+		lockLogIf(context.Background(), err)
+		return rmode, r, ErrPastObjectLockRetainDate
+	}
+
+	if retDate.Before(t) && !replReq {
+		return rmode, r, ErrPastObjectLockRetainDate
+	}
+
+	return rmode, RetentionDate{retDate}, nil
+}
+
+// GetObjectRetentionMeta constructs ObjectRetention from metadata
+func GetObjectRetentionMeta(meta map[string]string) ObjectRetention {
+	var mode RetMode
+	var retainTill RetentionDate
+
+	var modeStr, tillStr string
+	ok := false
+
+	modeStr, ok = meta[strings.ToLower(AmzObjectLockMode)]
+	if !ok {
+		modeStr, ok = meta[AmzObjectLockMode]
+	}
+	if ok {
+		mode = parseRetMode(modeStr)
+	} else {
+		return ObjectRetention{}
+	}
+
+	tillStr, ok = meta[strings.ToLower(AmzObjectLockRetainUntilDate)]
+	if !ok {
+		tillStr, ok = meta[AmzObjectLockRetainUntilDate]
+	}
+	if ok {
+		if t, e := amztime.ISO8601Parse(tillStr); e == nil {
+			retainTill = RetentionDate{t.UTC()}
+		}
+	}
+	return ObjectRetention{XMLNS: "http://s3.amazonaws.com/doc/2006-03-01/", Mode: mode, RetainUntilDate: retainTill}
+}
+
+// GetObjectLegalHoldMeta constructs ObjectLegalHold from metadata
+func GetObjectLegalHoldMeta(meta map[string]string) ObjectLegalHold {
+	holdStr, ok := meta[strings.ToLower(AmzObjectLockLegalHold)]
+	if !ok {
+		holdStr, ok = meta[AmzObjectLockLegalHold]
+	}
+	if ok {
+		return ObjectLegalHold{XMLNS: "http://s3.amazonaws.com/doc/2006-03-01/", Status: parseLegalHoldStatus(holdStr)}
+	}
+	return ObjectLegalHold{}
+}
+
+// ParseObjectLockLegalHoldHeaders parses request headers to construct ObjectLegalHold
+func ParseObjectLockLegalHoldHeaders(h http.Header) (lhold ObjectLegalHold, err error) {
+	holdStatus, ok := h[AmzObjectLockLegalHold]
+	if ok {
+		lh := parseLegalHoldStatus(holdStatus[0])
+		if !lh.Valid() {
+			return lhold, ErrUnknownWORMModeDirective
+		}
+		lhold = ObjectLegalHold{XMLNS: "http://s3.amazonaws.com/doc/2006-03-01/", Status: lh}
+	}
+	return lhold, nil
+}
+
+// ObjectLegalHold specified in
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLegalHold.html
+type ObjectLegalHold struct {
+	XMLNS   string          `xml:"xmlns,attr,omitempty"`
+	XMLName xml.Name        `xml:"LegalHold"`
+	Status  LegalHoldStatus `xml:"Status,omitempty"`
+}
+
+// UnmarshalXML - decodes XML data.
+func (l *ObjectLegalHold) UnmarshalXML(d *xml.Decoder, start xml.StartElement) (err error) {
+	switch start.Name.Local {
+	case "LegalHold", "ObjectLockLegalHold":
+	default:
+		return xml.UnmarshalError(fmt.Sprintf("expected element type <LegalHold>/<ObjectLockLegalHold> but have <%s>",
+			start.Name.Local))
+	}
+	for {
+		// Read tokens from the XML document in a stream.
+		t, err := d.Token()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+
+		if se, ok := t.(xml.StartElement); ok {
+			switch se.Name.Local {
+			case "Status":
+				var st LegalHoldStatus
+				if err = d.DecodeElement(&st, &se); err != nil {
+					return err
+				}
+				l.Status = st
+			default:
+				return xml.UnmarshalError(fmt.Sprintf("expected element type <Status> but have <%s>", se.Name.Local))
+			}
+		}
+	}
+	return nil
+}
+
+// IsEmpty returns true if struct is empty
+func (l *ObjectLegalHold) IsEmpty() bool {
+	return !l.Status.Valid()
+}
+
+// ParseObjectLegalHold decodes the XML into ObjectLegalHold
+func ParseObjectLegalHold(reader io.Reader) (hold *ObjectLegalHold, err error) {
+	buf, err := io.ReadAll(io.LimitReader(reader, maxObjectLockConfigSize))
+	if err != nil {
+		return nil, err
+	}
+
+	hold = &ObjectLegalHold{}
+	if err = xml.NewDecoder(bytes.NewReader(buf)).Decode(hold); err != nil {
+		return nil, err
+	}
+
+	if !hold.Status.Valid() {
+		return nil, ErrMalformedXML
+	}
+	return hold, err
+}
+
+// FilterObjectLockMetadata filters object lock metadata if s3:GetObjectRetention permission is denied or if isCopy flag set.
+func FilterObjectLockMetadata(metadata map[string]string, filterRetention, filterLegalHold bool) map[string]string {
+	// Copy on write
+	dst := metadata
+	var copied bool
+	delKey := func(key string) {
+		key = strings.ToLower(key)
+		if _, ok := metadata[key]; !ok {
+			return
+		}
+		if !copied {
+			dst = make(map[string]string, len(metadata))
+			maps.Copy(dst, metadata)
+			copied = true
+		}
+		delete(dst, key)
+	}
+	legalHold := GetObjectLegalHoldMeta(metadata)
+	if !legalHold.Status.Valid() || filterLegalHold {
+		delKey(AmzObjectLockLegalHold)
+	}
+
+	ret := GetObjectRetentionMeta(metadata)
+	if !ret.Mode.Valid() || filterRetention {
+		delKey(AmzObjectLockMode)
+		delKey(AmzObjectLockRetainUntilDate)
+		return dst
+	}
+	return dst
+}

internal/bucket/object/lock/lock_test.go

@@ -0,0 +1,680 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package lock
+
+import (
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	xhttp "github.com/minio/minio/internal/http"
+)
+
+func TestParseMode(t *testing.T) {
+	testCases := []struct {
+		value        string
+		expectedMode RetMode
+	}{
+		{
+			value:        "governance",
+			expectedMode: RetGovernance,
+		},
+		{
+			value:        "complIAnce",
+			expectedMode: RetCompliance,
+		},
+		{
+			value:        "gce",
+			expectedMode: "",
+		},
+	}
+
+	for _, tc := range testCases {
+		if parseRetMode(tc.value) != tc.expectedMode {
+			t.Errorf("Expected Mode %s, got %s", tc.expectedMode, parseRetMode(tc.value))
+		}
+	}
+}
+
+func TestParseLegalHoldStatus(t *testing.T) {
+	tests := []struct {
+		value          string
+		expectedStatus LegalHoldStatus
+	}{
+		{
+			value:          "ON",
+			expectedStatus: LegalHoldOn,
+		},
+		{
+			value:          "Off",
+			expectedStatus: LegalHoldOff,
+		},
+		{
+			value:          "x",
+			expectedStatus: "",
+		},
+	}
+
+	for _, tt := range tests {
+		actualStatus := parseLegalHoldStatus(tt.value)
+		if actualStatus != tt.expectedStatus {
+			t.Errorf("Expected legal hold status %s, got %s", tt.expectedStatus, actualStatus)
+		}
+	}
+}
+
+// TestUnmarshalDefaultRetention checks if default retention
+// marshaling and unmarshalling work as expected
+func TestUnmarshalDefaultRetention(t *testing.T) {
+	days := uint64(4)
+	years := uint64(1)
+	zerodays := uint64(0)
+	invalidDays := uint64(maximumRetentionDays + 1)
+	tests := []struct {
+		value       DefaultRetention
+		expectedErr error
+		expectErr   bool
+	}{
+		{
+			value:       DefaultRetention{Mode: "retain"},
+			expectedErr: fmt.Errorf("unknown retention mode retain"),
+			expectErr:   true,
+		},
+		{
+			value:       DefaultRetention{Mode: RetGovernance},
+			expectedErr: fmt.Errorf("either Days or Years must be specified"),
+			expectErr:   true,
+		},
+		{
+			value:       DefaultRetention{Mode: RetGovernance, Days: &days},
+			expectedErr: nil,
+			expectErr:   false,
+		},
+		{
+			value:       DefaultRetention{Mode: RetGovernance, Years: &years},
+			expectedErr: nil,
+			expectErr:   false,
+		},
+		{
+			value:       DefaultRetention{Mode: RetGovernance, Days: &days, Years: &years},
+			expectedErr: fmt.Errorf("either Days or Years must be specified, not both"),
+			expectErr:   true,
+		},
+		{
+			value:       DefaultRetention{Mode: RetGovernance, Days: &zerodays},
+			expectedErr: fmt.Errorf("Default retention period must be a positive integer value for 'Days'"),
+			expectErr:   true,
+		},
+		{
+			value:       DefaultRetention{Mode: RetGovernance, Days: &invalidDays},
+			expectedErr: fmt.Errorf("Default retention period too large for 'Days' %d", invalidDays),
+			expectErr:   true,
+		},
+	}
+	for _, tt := range tests {
+		d, err := xml.MarshalIndent(&tt.value, "", "\t")
+		if err != nil {
+			t.Fatal(err)
+		}
+		var dr DefaultRetention
+		err = xml.Unmarshal(d, &dr)
+		//nolint:gocritic
+		if tt.expectedErr == nil {
+			if err != nil {
+				t.Fatalf("error: expected = <nil>, got = %v", err)
+			}
+		} else if err == nil {
+			t.Fatalf("error: expected = %v, got = <nil>", tt.expectedErr)
+		} else if tt.expectedErr.Error() != err.Error() {
+			t.Fatalf("error: expected = %v, got = %v", tt.expectedErr, err)
+		}
+	}
+}
+
+func TestParseObjectLockConfig(t *testing.T) {
+	tests := []struct {
+		value       string
+		expectedErr error
+		expectErr   bool
+	}{
+		{
+			value:       `<ObjectLockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><ObjectLockEnabled>yes</ObjectLockEnabled></ObjectLockConfiguration>`,
+			expectedErr: fmt.Errorf("only 'Enabled' value is allowed to ObjectLockEnabled element"),
+			expectErr:   true,
+		},
+		{
+			value:       `<ObjectLockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><ObjectLockEnabled>Enabled</ObjectLockEnabled><Rule><DefaultRetention><Mode>COMPLIANCE</Mode><Days>0</Days></DefaultRetention></Rule></ObjectLockConfiguration>`,
+			expectedErr: fmt.Errorf("Default retention period must be a positive integer value for 'Days'"),
+			expectErr:   true,
+		},
+		{
+			value:       `<ObjectLockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><ObjectLockEnabled>Enabled</ObjectLockEnabled><Rule><DefaultRetention><Mode>COMPLIANCE</Mode><Days>30</Days></DefaultRetention></Rule></ObjectLockConfiguration>`,
+			expectedErr: nil,
+			expectErr:   false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run("", func(t *testing.T) {
+			_, err := ParseObjectLockConfig(strings.NewReader(tt.value))
+			//nolint:gocritic
+			if tt.expectedErr == nil {
+				if err != nil {
+					t.Fatalf("error: expected = <nil>, got = %v", err)
+				}
+			} else if err == nil {
+				t.Fatalf("error: expected = %v, got = <nil>", tt.expectedErr)
+			} else if tt.expectedErr.Error() != err.Error() {
+				t.Fatalf("error: expected = %v, got = %v", tt.expectedErr, err)
+			}
+		})
+	}
+}
+
+func TestParseObjectRetention(t *testing.T) {
+	tests := []struct {
+		value       string
+		expectedErr error
+		expectErr   bool
+	}{
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><Retention xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Mode>string</Mode><RetainUntilDate>2020-01-02T15:04:05Z</RetainUntilDate></Retention>`,
+			expectedErr: ErrUnknownWORMModeDirective,
+			expectErr:   true,
+		},
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><Retention xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Mode>COMPLIANCE</Mode><RetainUntilDate>2017-01-02T15:04:05Z</RetainUntilDate></Retention>`,
+			expectedErr: ErrPastObjectLockRetainDate,
+			expectErr:   true,
+		},
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><Retention xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Mode>GOVERNANCE</Mode><RetainUntilDate>2057-01-02T15:04:05Z</RetainUntilDate></Retention>`,
+			expectedErr: nil,
+			expectErr:   false,
+		},
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><Retention xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Mode>GOVERNANCE</Mode><RetainUntilDate>2057-01-02T15:04:05.000Z</RetainUntilDate></Retention>`,
+			expectedErr: nil,
+			expectErr:   false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run("", func(t *testing.T) {
+			_, err := ParseObjectRetention(strings.NewReader(tt.value))
+			//nolint:gocritic
+			if tt.expectedErr == nil {
+				if err != nil {
+					t.Fatalf("error: expected = <nil>, got = %v", err)
+				}
+			} else if err == nil {
+				t.Fatalf("error: expected = %v, got = <nil>", tt.expectedErr)
+			} else if tt.expectedErr.Error() != err.Error() {
+				t.Fatalf("error: expected = %v, got = %v", tt.expectedErr, err)
+			}
+		})
+	}
+}
+
+func TestIsObjectLockRequested(t *testing.T) {
+	tests := []struct {
+		header      http.Header
+		expectedVal bool
+	}{
+		{
+			header: http.Header{
+				"Authorization":        []string{"AWS4-HMAC-SHA256 <cred_string>"},
+				"X-Amz-Content-Sha256": []string{""},
+				"Content-Encoding":     []string{""},
+			},
+			expectedVal: false,
+		},
+		{
+			header: http.Header{
+				AmzObjectLockLegalHold: []string{""},
+			},
+			expectedVal: true,
+		},
+		{
+			header: http.Header{
+				AmzObjectLockRetainUntilDate: []string{""},
+				AmzObjectLockMode:            []string{""},
+			},
+			expectedVal: true,
+		},
+		{
+			header: http.Header{
+				AmzObjectLockBypassRetGovernance: []string{""},
+			},
+			expectedVal: false,
+		},
+	}
+	for _, tt := range tests {
+		actualVal := IsObjectLockRequested(tt.header)
+		if actualVal != tt.expectedVal {
+			t.Fatalf("error: expected %v, actual %v", tt.expectedVal, actualVal)
+		}
+	}
+}
+
+func TestIsObjectLockGovernanceBypassSet(t *testing.T) {
+	tests := []struct {
+		header      http.Header
+		expectedVal bool
+	}{
+		{
+			header: http.Header{
+				"Authorization":        []string{"AWS4-HMAC-SHA256 <cred_string>"},
+				"X-Amz-Content-Sha256": []string{""},
+				"Content-Encoding":     []string{""},
+			},
+			expectedVal: false,
+		},
+		{
+			header: http.Header{
+				AmzObjectLockLegalHold: []string{""},
+			},
+			expectedVal: false,
+		},
+		{
+			header: http.Header{
+				AmzObjectLockRetainUntilDate: []string{""},
+				AmzObjectLockMode:            []string{""},
+			},
+			expectedVal: false,
+		},
+		{
+			header: http.Header{
+				AmzObjectLockBypassRetGovernance: []string{""},
+			},
+			expectedVal: false,
+		},
+		{
+			header: http.Header{
+				AmzObjectLockBypassRetGovernance: []string{"true"},
+			},
+			expectedVal: true,
+		},
+	}
+	for _, tt := range tests {
+		actualVal := IsObjectLockGovernanceBypassSet(tt.header)
+		if actualVal != tt.expectedVal {
+			t.Fatalf("error: expected %v, actual %v", tt.expectedVal, actualVal)
+		}
+	}
+}
+
+func TestParseObjectLockRetentionHeaders(t *testing.T) {
+	tests := []struct {
+		header      http.Header
+		expectedErr error
+	}{
+		{
+			header: http.Header{
+				"Authorization":        []string{"AWS4-HMAC-SHA256 <cred_string>"},
+				"X-Amz-Content-Sha256": []string{""},
+				"Content-Encoding":     []string{""},
+			},
+			expectedErr: ErrObjectLockInvalidHeaders,
+		},
+		{
+			header: http.Header{
+				xhttp.AmzObjectLockMode:            []string{"lock"},
+				xhttp.AmzObjectLockRetainUntilDate: []string{"2017-01-02"},
+			},
+			expectedErr: ErrUnknownWORMModeDirective,
+		},
+		{
+			header: http.Header{
+				xhttp.AmzObjectLockMode: []string{"governance"},
+			},
+			expectedErr: ErrObjectLockInvalidHeaders,
+		},
+		{
+			header: http.Header{
+				xhttp.AmzObjectLockRetainUntilDate: []string{"2017-01-02"},
+				xhttp.AmzObjectLockMode:            []string{"governance"},
+			},
+			expectedErr: ErrInvalidRetentionDate,
+		},
+		{
+			header: http.Header{
+				xhttp.AmzObjectLockRetainUntilDate: []string{"2017-01-02T15:04:05Z"},
+				xhttp.AmzObjectLockMode:            []string{"governance"},
+			},
+			expectedErr: ErrPastObjectLockRetainDate,
+		},
+		{
+			header: http.Header{
+				xhttp.AmzObjectLockMode:            []string{"governance"},
+				xhttp.AmzObjectLockRetainUntilDate: []string{"2017-01-02T15:04:05Z"},
+			},
+			expectedErr: ErrPastObjectLockRetainDate,
+		},
+		{
+			header: http.Header{
+				xhttp.AmzObjectLockMode:            []string{"governance"},
+				xhttp.AmzObjectLockRetainUntilDate: []string{"2087-01-02T15:04:05Z"},
+			},
+			expectedErr: nil,
+		},
+		{
+			header: http.Header{
+				xhttp.AmzObjectLockMode:            []string{"governance"},
+				xhttp.AmzObjectLockRetainUntilDate: []string{"2087-01-02T15:04:05.000Z"},
+			},
+			expectedErr: nil,
+		},
+	}
+
+	for i, tt := range tests {
+		_, _, err := ParseObjectLockRetentionHeaders(tt.header)
+		//nolint:gocritic
+		if tt.expectedErr == nil {
+			if err != nil {
+				t.Fatalf("Case %d error: expected = <nil>, got = %v", i, err)
+			}
+		} else if err == nil {
+			t.Fatalf("Case %d error: expected = %v, got = <nil>", i, tt.expectedErr)
+		} else if tt.expectedErr.Error() != err.Error() {
+			t.Fatalf("Case %d error: expected = %v, got = %v", i, tt.expectedErr, err)
+		}
+	}
+}
+
+func TestGetObjectRetentionMeta(t *testing.T) {
+	tests := []struct {
+		metadata map[string]string
+		expected ObjectRetention
+	}{
+		{
+			metadata: map[string]string{
+				"Authorization":        "AWS4-HMAC-SHA256 <cred_string>",
+				"X-Amz-Content-Sha256": "",
+				"Content-Encoding":     "",
+			},
+			expected: ObjectRetention{},
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-mode": "governance",
+			},
+			expected: ObjectRetention{Mode: RetGovernance},
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-retain-until-date": "2020-02-01",
+			},
+			expected: ObjectRetention{RetainUntilDate: RetentionDate{time.Date(2020, 2, 1, 12, 0, 0, 0, time.UTC)}},
+		},
+	}
+
+	for i, tt := range tests {
+		o := GetObjectRetentionMeta(tt.metadata)
+		if o.Mode != tt.expected.Mode {
+			t.Fatalf("Case %d expected %v, got %v", i, tt.expected.Mode, o.Mode)
+		}
+	}
+}
+
+func TestGetObjectLegalHoldMeta(t *testing.T) {
+	tests := []struct {
+		metadata map[string]string
+		expected ObjectLegalHold
+	}{
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-mode": "governance",
+			},
+			expected: ObjectLegalHold{},
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-legal-hold": "on",
+			},
+			expected: ObjectLegalHold{Status: LegalHoldOn},
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-legal-hold": "off",
+			},
+			expected: ObjectLegalHold{Status: LegalHoldOff},
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-legal-hold": "X",
+			},
+			expected: ObjectLegalHold{Status: ""},
+		},
+	}
+
+	for i, tt := range tests {
+		o := GetObjectLegalHoldMeta(tt.metadata)
+		if o.Status != tt.expected.Status {
+			t.Fatalf("Case %d expected %v, got %v", i, tt.expected.Status, o.Status)
+		}
+	}
+}
+
+func TestParseObjectLegalHold(t *testing.T) {
+	tests := []struct {
+		value       string
+		expectedErr error
+		expectErr   bool
+	}{
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><LegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Status>string</Status></LegalHold>`,
+			expectedErr: ErrMalformedXML,
+			expectErr:   true,
+		},
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><LegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Status>ON</Status></LegalHold>`,
+			expectedErr: nil,
+			expectErr:   false,
+		},
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><ObjectLockLegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Status>ON</Status></ObjectLockLegalHold>`,
+			expectedErr: nil,
+			expectErr:   false,
+		},
+		// invalid Status key
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><ObjectLockLegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><MyStatus>ON</MyStatus></ObjectLockLegalHold>`,
+			expectedErr: errors.New("expected element type <Status> but have <MyStatus>"),
+			expectErr:   true,
+		},
+		// invalid XML attr
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><UnknownLegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Status>ON</Status></UnknownLegalHold>`,
+			expectedErr: errors.New("expected element type <LegalHold>/<ObjectLockLegalHold> but have <UnknownLegalHold>"),
+			expectErr:   true,
+		},
+		{
+			value:       `<?xml version="1.0" encoding="UTF-8"?><LegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Status>On</Status></LegalHold>`,
+			expectedErr: ErrMalformedXML,
+			expectErr:   true,
+		},
+	}
+	for i, tt := range tests {
+		_, err := ParseObjectLegalHold(strings.NewReader(tt.value))
+		//nolint:gocritic
+		if tt.expectedErr == nil {
+			if err != nil {
+				t.Fatalf("Case %d error: expected = <nil>, got = %v", i, err)
+			}
+		} else if err == nil {
+			t.Fatalf("Case %d error: expected = %v, got = <nil>", i, tt.expectedErr)
+		} else if tt.expectedErr.Error() != err.Error() {
+			t.Fatalf("Case %d error: expected = %v, got = %v", i, tt.expectedErr, err)
+		}
+	}
+}
+
+func TestFilterObjectLockMetadata(t *testing.T) {
+	tests := []struct {
+		metadata        map[string]string
+		filterRetention bool
+		filterLegalHold bool
+		expected        map[string]string
+	}{
+		{
+			metadata: map[string]string{
+				"Authorization":        "AWS4-HMAC-SHA256 <cred_string>",
+				"X-Amz-Content-Sha256": "",
+				"Content-Encoding":     "",
+			},
+			expected: map[string]string{
+				"Authorization":        "AWS4-HMAC-SHA256 <cred_string>",
+				"X-Amz-Content-Sha256": "",
+				"Content-Encoding":     "",
+			},
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-mode": "governance",
+			},
+			expected: map[string]string{
+				"x-amz-object-lock-mode": "governance",
+			},
+			filterRetention: false,
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-mode":              "governance",
+				"x-amz-object-lock-retain-until-date": "2020-02-01",
+			},
+			expected:        map[string]string{},
+			filterRetention: true,
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-legal-hold": "off",
+			},
+			expected:        map[string]string{},
+			filterLegalHold: true,
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-legal-hold": "on",
+			},
+			expected:        map[string]string{"x-amz-object-lock-legal-hold": "on"},
+			filterLegalHold: false,
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-legal-hold":        "on",
+				"x-amz-object-lock-mode":              "governance",
+				"x-amz-object-lock-retain-until-date": "2020-02-01",
+			},
+			expected:        map[string]string{},
+			filterRetention: true,
+			filterLegalHold: true,
+		},
+		{
+			metadata: map[string]string{
+				"x-amz-object-lock-legal-hold":        "on",
+				"x-amz-object-lock-mode":              "governance",
+				"x-amz-object-lock-retain-until-date": "2020-02-01",
+			},
+			expected: map[string]string{
+				"x-amz-object-lock-legal-hold":        "on",
+				"x-amz-object-lock-mode":              "governance",
+				"x-amz-object-lock-retain-until-date": "2020-02-01",
+			},
+		},
+	}
+
+	for i, tt := range tests {
+		o := FilterObjectLockMetadata(tt.metadata, tt.filterRetention, tt.filterLegalHold)
+		if !reflect.DeepEqual(o, tt.expected) {
+			t.Fatalf("Case %d expected %v, got %v", i, tt.metadata, o)
+		}
+	}
+}
+
+func TestToString(t *testing.T) {
+	days := uint64(30)
+	daysPtr := &days
+	years := uint64(2)
+	yearsPtr := &years
+
+	tests := []struct {
+		name string
+		c    Config
+		want string
+	}{
+		{
+			name: "happy case",
+			c: Config{
+				ObjectLockEnabled: "Enabled",
+			},
+			want: "Enabled: true",
+		},
+		{
+			name: "with default retention days",
+			c: Config{
+				ObjectLockEnabled: "Enabled",
+				Rule: &struct {
+					DefaultRetention DefaultRetention `xml:"DefaultRetention"`
+				}{
+					DefaultRetention: DefaultRetention{
+						Mode: RetGovernance,
+						Days: daysPtr,
+					},
+				},
+			},
+			want: "Enabled: true, Mode: GOVERNANCE, Days: 30",
+		},
+		{
+			name: "with default retention years",
+			c: Config{
+				ObjectLockEnabled: "Enabled",
+				Rule: &struct {
+					DefaultRetention DefaultRetention `xml:"DefaultRetention"`
+				}{
+					DefaultRetention: DefaultRetention{
+						Mode:  RetCompliance,
+						Years: yearsPtr,
+					},
+				},
+			},
+			want: "Enabled: true, Mode: COMPLIANCE, Years: 2",
+		},
+		{
+			name: "disabled case",
+			c: Config{
+				ObjectLockEnabled: "Disabled",
+			},
+			want: "Enabled: false",
+		},
+		{
+			name: "empty case",
+			c:    Config{},
+			want: "Enabled: false",
+		},
+	}
+	for _, tt := range tests {
+		got := tt.c.String()
+		if got != tt.want {
+			t.Errorf("test: %s, got: '%v', want: '%v'", tt.name, got, tt.want)
+		}
+	}
+}

internal/bucket/replication/and.go

@@ -0,0 +1,63 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"encoding/xml"
+)
+
+// And - a tag to combine a prefix and multiple tags for replication configuration rule.
+type And struct {
+	XMLName xml.Name `xml:"And" json:"And"`
+	Prefix  string   `xml:"Prefix,omitempty" json:"Prefix,omitempty"`
+	Tags    []Tag    `xml:"Tag,omitempty" json:"Tag,omitempty"`
+}
+
+var errDuplicateTagKey = Errorf("Duplicate Tag Keys are not allowed")
+
+// isEmpty returns true if Tags field is null
+func (a And) isEmpty() bool {
+	return len(a.Tags) == 0 && a.Prefix == ""
+}
+
+// Validate - validates the And field
+func (a And) Validate() error {
+	if a.ContainsDuplicateTag() {
+		return errDuplicateTagKey
+	}
+	for _, t := range a.Tags {
+		if err := t.Validate(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ContainsDuplicateTag - returns true if duplicate keys are present in And
+func (a And) ContainsDuplicateTag() bool {
+	x := make(map[string]struct{}, len(a.Tags))
+
+	for _, t := range a.Tags {
+		if _, has := x[t.Key]; has {
+			return true
+		}
+		x[t.Key] = struct{}{}
+	}
+
+	return false
+}

internal/bucket/replication/datatypes.go

@@ -0,0 +1,77 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+//go:generate msgp -file=$GOFILE
+
+// StatusType of Replication for x-amz-replication-status header
+type StatusType string
+
+// Type - replication type enum
+type Type int
+
+const (
+	// Pending - replication is pending.
+	Pending StatusType = "PENDING"
+
+	// Completed - replication completed ok.
+	Completed StatusType = "COMPLETED"
+
+	// CompletedLegacy was called "COMPLETE" incorrectly.
+	CompletedLegacy StatusType = "COMPLETE"
+
+	// Failed - replication failed.
+	Failed StatusType = "FAILED"
+
+	// Replica - this is a replica.
+	Replica StatusType = "REPLICA"
+)
+
+// String returns string representation of status
+func (s StatusType) String() string {
+	return string(s)
+}
+
+// Empty returns true if this status is not set
+func (s StatusType) Empty() bool {
+	return string(s) == ""
+}
+
+// VersionPurgeStatusType represents status of a versioned delete or permanent delete w.r.t bucket replication
+type VersionPurgeStatusType string
+
+const (
+	// VersionPurgePending - versioned delete replication is pending.
+	VersionPurgePending VersionPurgeStatusType = "PENDING"
+
+	// VersionPurgeComplete - versioned delete replication is now complete, erase version on disk.
+	VersionPurgeComplete VersionPurgeStatusType = "COMPLETE"
+
+	// VersionPurgeFailed - versioned delete replication failed.
+	VersionPurgeFailed VersionPurgeStatusType = "FAILED"
+)
+
+// Empty returns true if purge status was not set.
+func (v VersionPurgeStatusType) Empty() bool {
+	return string(v) == ""
+}
+
+// Pending returns true if the version is pending purge.
+func (v VersionPurgeStatusType) Pending() bool {
+	return v == VersionPurgePending || v == VersionPurgeFailed
+}

internal/bucket/replication/datatypes_gen.go

@@ -0,0 +1,163 @@
+// Code generated by github.com/tinylib/msgp DO NOT EDIT.
+
+package replication
+
+import (
+	"github.com/tinylib/msgp/msgp"
+)
+
+// DecodeMsg implements msgp.Decodable
+func (z *StatusType) DecodeMsg(dc *msgp.Reader) (err error) {
+	{
+		var zb0001 string
+		zb0001, err = dc.ReadString()
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		(*z) = StatusType(zb0001)
+	}
+	return
+}
+
+// EncodeMsg implements msgp.Encodable
+func (z StatusType) EncodeMsg(en *msgp.Writer) (err error) {
+	err = en.WriteString(string(z))
+	if err != nil {
+		err = msgp.WrapError(err)
+		return
+	}
+	return
+}
+
+// MarshalMsg implements msgp.Marshaler
+func (z StatusType) MarshalMsg(b []byte) (o []byte, err error) {
+	o = msgp.Require(b, z.Msgsize())
+	o = msgp.AppendString(o, string(z))
+	return
+}
+
+// UnmarshalMsg implements msgp.Unmarshaler
+func (z *StatusType) UnmarshalMsg(bts []byte) (o []byte, err error) {
+	{
+		var zb0001 string
+		zb0001, bts, err = msgp.ReadStringBytes(bts)
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		(*z) = StatusType(zb0001)
+	}
+	o = bts
+	return
+}
+
+// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
+func (z StatusType) Msgsize() (s int) {
+	s = msgp.StringPrefixSize + len(string(z))
+	return
+}
+
+// DecodeMsg implements msgp.Decodable
+func (z *Type) DecodeMsg(dc *msgp.Reader) (err error) {
+	{
+		var zb0001 int
+		zb0001, err = dc.ReadInt()
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		(*z) = Type(zb0001)
+	}
+	return
+}
+
+// EncodeMsg implements msgp.Encodable
+func (z Type) EncodeMsg(en *msgp.Writer) (err error) {
+	err = en.WriteInt(int(z))
+	if err != nil {
+		err = msgp.WrapError(err)
+		return
+	}
+	return
+}
+
+// MarshalMsg implements msgp.Marshaler
+func (z Type) MarshalMsg(b []byte) (o []byte, err error) {
+	o = msgp.Require(b, z.Msgsize())
+	o = msgp.AppendInt(o, int(z))
+	return
+}
+
+// UnmarshalMsg implements msgp.Unmarshaler
+func (z *Type) UnmarshalMsg(bts []byte) (o []byte, err error) {
+	{
+		var zb0001 int
+		zb0001, bts, err = msgp.ReadIntBytes(bts)
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		(*z) = Type(zb0001)
+	}
+	o = bts
+	return
+}
+
+// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
+func (z Type) Msgsize() (s int) {
+	s = msgp.IntSize
+	return
+}
+
+// DecodeMsg implements msgp.Decodable
+func (z *VersionPurgeStatusType) DecodeMsg(dc *msgp.Reader) (err error) {
+	{
+		var zb0001 string
+		zb0001, err = dc.ReadString()
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		(*z) = VersionPurgeStatusType(zb0001)
+	}
+	return
+}
+
+// EncodeMsg implements msgp.Encodable
+func (z VersionPurgeStatusType) EncodeMsg(en *msgp.Writer) (err error) {
+	err = en.WriteString(string(z))
+	if err != nil {
+		err = msgp.WrapError(err)
+		return
+	}
+	return
+}
+
+// MarshalMsg implements msgp.Marshaler
+func (z VersionPurgeStatusType) MarshalMsg(b []byte) (o []byte, err error) {
+	o = msgp.Require(b, z.Msgsize())
+	o = msgp.AppendString(o, string(z))
+	return
+}
+
+// UnmarshalMsg implements msgp.Unmarshaler
+func (z *VersionPurgeStatusType) UnmarshalMsg(bts []byte) (o []byte, err error) {
+	{
+		var zb0001 string
+		zb0001, bts, err = msgp.ReadStringBytes(bts)
+		if err != nil {
+			err = msgp.WrapError(err)
+			return
+		}
+		(*z) = VersionPurgeStatusType(zb0001)
+	}
+	o = bts
+	return
+}
+
+// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
+func (z VersionPurgeStatusType) Msgsize() (s int) {
+	s = msgp.StringPrefixSize + len(string(z))
+	return
+}

internal/bucket/replication/datatypes_gen_test.go

@@ -0,0 +1,3 @@
+// Code generated by github.com/tinylib/msgp DO NOT EDIT.
+
+package replication

internal/bucket/replication/destination.go

@@ -0,0 +1,136 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"encoding/xml"
+	"fmt"
+	"strings"
+
+	"github.com/minio/pkg/v3/wildcard"
+)
+
+// DestinationARNPrefix - destination ARN prefix as per AWS S3 specification.
+const DestinationARNPrefix = "arn:aws:s3:::"
+
+// DestinationARNMinIOPrefix - destination ARN prefix for MinIO.
+const DestinationARNMinIOPrefix = "arn:minio:replication:"
+
+// Destination - destination in ReplicationConfiguration.
+type Destination struct {
+	XMLName      xml.Name `xml:"Destination" json:"Destination"`
+	Bucket       string   `xml:"Bucket" json:"Bucket"`
+	StorageClass string   `xml:"StorageClass" json:"StorageClass"`
+	ARN          string
+	// EncryptionConfiguration TODO: not needed for MinIO
+}
+
+func (d Destination) isValidStorageClass() bool {
+	if d.StorageClass == "" {
+		return true
+	}
+	return d.StorageClass == "STANDARD" || d.StorageClass == "REDUCED_REDUNDANCY"
+}
+
+// IsValid - checks whether Destination is valid or not.
+func (d Destination) IsValid() bool {
+	return d.Bucket != "" || !d.isValidStorageClass()
+}
+
+func (d Destination) String() string {
+	return d.ARN
+}
+
+// LegacyArn returns true if arn format has prefix "arn:aws:s3:::" which was
+// used prior to multi-destination
+func (d Destination) LegacyArn() bool {
+	return strings.HasPrefix(d.ARN, DestinationARNPrefix)
+}
+
+// TargetArn returns true if arn format has prefix  "arn:minio:replication:::"
+// used for multi-destination targets
+func (d Destination) TargetArn() bool {
+	return strings.HasPrefix(d.ARN, DestinationARNMinIOPrefix)
+}
+
+// MarshalXML - encodes to XML data.
+func (d Destination) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if err := e.EncodeToken(start); err != nil {
+		return err
+	}
+	if err := e.EncodeElement(d.String(), xml.StartElement{Name: xml.Name{Local: "Bucket"}}); err != nil {
+		return err
+	}
+	if d.StorageClass != "" {
+		if err := e.EncodeElement(d.StorageClass, xml.StartElement{Name: xml.Name{Local: "StorageClass"}}); err != nil {
+			return err
+		}
+	}
+	return e.EncodeToken(xml.EndElement{Name: start.Name})
+}
+
+// UnmarshalXML - decodes XML data.
+func (d *Destination) UnmarshalXML(dec *xml.Decoder, start xml.StartElement) (err error) {
+	// Make subtype to avoid recursive UnmarshalXML().
+	type destination Destination
+	dest := destination{}
+
+	if err := dec.DecodeElement(&dest, &start); err != nil {
+		return err
+	}
+	parsedDest, err := parseDestination(dest.Bucket)
+	if err != nil {
+		return err
+	}
+	if dest.StorageClass != "" {
+		switch dest.StorageClass {
+		case "STANDARD", "REDUCED_REDUNDANCY":
+		default:
+			return fmt.Errorf("unknown storage class %s", dest.StorageClass)
+		}
+	}
+	parsedDest.StorageClass = dest.StorageClass
+	*d = parsedDest
+	return nil
+}
+
+// Validate - validates Resource is for given bucket or not.
+func (d Destination) Validate(bucketName string) error {
+	if !d.IsValid() {
+		return Errorf("invalid destination")
+	}
+
+	if !wildcard.Match(d.Bucket, bucketName) {
+		return Errorf("bucket name does not match")
+	}
+	return nil
+}
+
+// parseDestination - parses string to Destination.
+func parseDestination(s string) (Destination, error) {
+	if !strings.HasPrefix(s, DestinationARNPrefix) && !strings.HasPrefix(s, DestinationARNMinIOPrefix) {
+		return Destination{}, Errorf("invalid destination '%s'", s)
+	}
+
+	bucketName := strings.TrimPrefix(s, DestinationARNPrefix)
+
+	return Destination{
+		Bucket: bucketName,
+		ARN:    s,
+	}, nil
+}

internal/bucket/replication/error.go

@@ -0,0 +1,45 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"fmt"
+)
+
+// Error is the generic type for any error happening during tag
+// parsing.
+type Error struct {
+	err error
+}
+
+// Errorf - formats according to a format specifier and returns
+// the string as a value that satisfies error of type tagging.Error
+func Errorf(format string, a ...any) error {
+	return Error{err: fmt.Errorf(format, a...)}
+}
+
+// Unwrap the internal error.
+func (e Error) Unwrap() error { return e.err }
+
+// Error 'error' compatible method.
+func (e Error) Error() string {
+	if e.err == nil {
+		return "replication: cause <nil>"
+	}
+	return e.err.Error()
+}

internal/bucket/replication/filter.go

@@ -0,0 +1,138 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"encoding/xml"
+
+	"github.com/minio/minio-go/v7/pkg/tags"
+)
+
+var errInvalidFilter = Errorf("Filter must have exactly one of Prefix, Tag, or And specified")
+
+// Filter - a filter for a replication configuration Rule.
+type Filter struct {
+	XMLName xml.Name `xml:"Filter" json:"Filter"`
+	Prefix  string
+	And     And
+	Tag     Tag
+
+	// Caching tags, only once
+	cachedTags map[string]string
+}
+
+// IsEmpty returns true if filter is not set
+func (f Filter) IsEmpty() bool {
+	return f.And.isEmpty() && f.Tag.IsEmpty() && f.Prefix == ""
+}
+
+// MarshalXML - produces the xml representation of the Filter struct
+// only one of Prefix, And and Tag should be present in the output.
+func (f Filter) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if err := e.EncodeToken(start); err != nil {
+		return err
+	}
+
+	switch {
+	case !f.And.isEmpty():
+		if err := e.EncodeElement(f.And, xml.StartElement{Name: xml.Name{Local: "And"}}); err != nil {
+			return err
+		}
+	case !f.Tag.IsEmpty():
+		if err := e.EncodeElement(f.Tag, xml.StartElement{Name: xml.Name{Local: "Tag"}}); err != nil {
+			return err
+		}
+	default:
+		// Always print Prefix field when both And & Tag are empty
+		if err := e.EncodeElement(f.Prefix, xml.StartElement{Name: xml.Name{Local: "Prefix"}}); err != nil {
+			return err
+		}
+	}
+
+	return e.EncodeToken(xml.EndElement{Name: start.Name})
+}
+
+// Validate - validates the filter element
+func (f Filter) Validate() error {
+	// A Filter must have exactly one of Prefix, Tag, or And specified.
+	if !f.And.isEmpty() {
+		if f.Prefix != "" {
+			return errInvalidFilter
+		}
+		if !f.Tag.IsEmpty() {
+			return errInvalidFilter
+		}
+		if err := f.And.Validate(); err != nil {
+			return err
+		}
+	}
+	if f.Prefix != "" {
+		if !f.Tag.IsEmpty() {
+			return errInvalidFilter
+		}
+	}
+	if !f.Tag.IsEmpty() {
+		if err := f.Tag.Validate(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// TestTags tests if the object tags satisfy the Filter tags requirement,
+// it returns true if there is no tags in the underlying Filter.
+func (f *Filter) TestTags(userTags string) bool {
+	if f.cachedTags == nil {
+		cached := make(map[string]string)
+		for _, t := range append(f.And.Tags, f.Tag) {
+			if !t.IsEmpty() {
+				cached[t.Key] = t.Value
+			}
+		}
+		f.cachedTags = cached
+	}
+
+	// This filter does not have any tags, always return true
+	if len(f.cachedTags) == 0 {
+		return true
+	}
+
+	parsedTags, err := tags.ParseObjectTags(userTags)
+	if err != nil {
+		return false
+	}
+
+	tagsMap := parsedTags.ToMap()
+
+	// This filter has tags configured but this object
+	// does not have any tag, skip this object
+	if len(tagsMap) == 0 {
+		return false
+	}
+
+	// Both filter and object have tags, find a match,
+	// skip this object otherwise
+	for k, cv := range f.cachedTags {
+		v, ok := tagsMap[k]
+		if ok && v == cv {
+			return true
+		}
+	}
+
+	return false
+}

internal/bucket/replication/replication.go

@@ -0,0 +1,294 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"encoding/xml"
+	"io"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+var (
+	errReplicationTooManyRules          = Errorf("Replication configuration allows a maximum of 1000 rules")
+	errReplicationNoRule                = Errorf("Replication configuration should have at least one rule")
+	errReplicationUniquePriority        = Errorf("Replication configuration has duplicate priority")
+	errRoleArnMissingLegacy             = Errorf("Missing required parameter `Role` in ReplicationConfiguration")
+	errDestinationArnMissing            = Errorf("Missing required parameter `Destination` in Replication rule")
+	errInvalidSourceSelectionCriteria   = Errorf("Invalid ReplicaModification status")
+	errRoleArnPresentForMultipleTargets = Errorf("`Role` should be empty in ReplicationConfiguration for multiple targets")
+)
+
+// Config - replication configuration specified in
+// https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html
+type Config struct {
+	XMLName xml.Name `xml:"ReplicationConfiguration" json:"-"`
+	Rules   []Rule   `xml:"Rule" json:"Rules"`
+	// RoleArn is being reused for MinIO replication ARN
+	RoleArn string `xml:"Role" json:"Role"`
+}
+
+// Maximum 2MiB size per replication config.
+const maxReplicationConfigSize = 2 << 20
+
+// ParseConfig parses ReplicationConfiguration from xml
+func ParseConfig(reader io.Reader) (*Config, error) {
+	config := Config{}
+	if err := xml.NewDecoder(io.LimitReader(reader, maxReplicationConfigSize)).Decode(&config); err != nil {
+		return nil, err
+	}
+	// By default, set replica modification to enabled if unset.
+	for i := range config.Rules {
+		if len(config.Rules[i].SourceSelectionCriteria.ReplicaModifications.Status) == 0 {
+			config.Rules[i].SourceSelectionCriteria = SourceSelectionCriteria{
+				ReplicaModifications: ReplicaModifications{
+					Status: Enabled,
+				},
+			}
+		}
+		// Default DeleteReplication to disabled if unset.
+		if len(config.Rules[i].DeleteReplication.Status) == 0 {
+			config.Rules[i].DeleteReplication = DeleteReplication{
+				Status: Disabled,
+			}
+		}
+	}
+	return &config, nil
+}
+
+// Validate - validates the replication configuration
+func (c Config) Validate(bucket string, sameTarget bool) error {
+	// replication config can't have more than 1000 rules
+	if len(c.Rules) > 1000 {
+		return errReplicationTooManyRules
+	}
+	// replication config should have at least one rule
+	if len(c.Rules) == 0 {
+		return errReplicationNoRule
+	}
+
+	// Validate all the rules in the replication config
+	targetMap := make(map[string]struct{})
+	priorityMap := make(map[string]struct{})
+	var legacyArn bool
+	for _, r := range c.Rules {
+		if _, ok := targetMap[r.Destination.Bucket]; !ok {
+			targetMap[r.Destination.Bucket] = struct{}{}
+		}
+		if err := r.Validate(bucket, sameTarget); err != nil {
+			return err
+		}
+		if _, ok := priorityMap[strconv.Itoa(r.Priority)]; ok {
+			return errReplicationUniquePriority
+		}
+		priorityMap[strconv.Itoa(r.Priority)] = struct{}{}
+
+		if r.Destination.LegacyArn() {
+			legacyArn = true
+		}
+		if c.RoleArn == "" && !r.Destination.TargetArn() {
+			return errDestinationArnMissing
+		}
+	}
+	// disallow combining old replication configuration which used RoleArn as target ARN with multiple
+	// destination replication
+	if c.RoleArn != "" && len(targetMap) > 1 {
+		return errRoleArnPresentForMultipleTargets
+	}
+	// validate RoleArn if destination used legacy ARN format.
+	if c.RoleArn == "" && legacyArn {
+		return errRoleArnMissingLegacy
+	}
+	return nil
+}
+
+// Types of replication
+const (
+	UnsetReplicationType Type = 0 + iota
+	ObjectReplicationType
+	DeleteReplicationType
+	MetadataReplicationType
+	HealReplicationType
+	ExistingObjectReplicationType
+	ResyncReplicationType
+	AllReplicationType
+)
+
+// Valid returns true if replication type is set
+func (t Type) Valid() bool {
+	return t > 0
+}
+
+// IsDataReplication returns true if content being replicated
+func (t Type) IsDataReplication() bool {
+	switch t {
+	case ObjectReplicationType, HealReplicationType, ExistingObjectReplicationType:
+		return true
+	}
+	return false
+}
+
+// ObjectOpts provides information to deduce whether replication
+// can be triggered on the resultant object.
+type ObjectOpts struct {
+	Name           string
+	UserTags       string
+	VersionID      string
+	DeleteMarker   bool
+	SSEC           bool
+	OpType         Type
+	Replica        bool
+	ExistingObject bool
+	TargetArn      string
+}
+
+// HasExistingObjectReplication returns true if any of the rule returns 'ExistingObjects' replication.
+func (c Config) HasExistingObjectReplication(arn string) (hasARN, isEnabled bool) {
+	for _, rule := range c.Rules {
+		if rule.Destination.ARN == arn || c.RoleArn == arn {
+			if !hasARN {
+				hasARN = true
+			}
+			if rule.ExistingObjectReplication.Status == Enabled {
+				return true, true
+			}
+		}
+	}
+	return hasARN, false
+}
+
+// FilterActionableRules returns the rules actions that need to be executed
+// after evaluating prefix/tag filtering
+func (c Config) FilterActionableRules(obj ObjectOpts) []Rule {
+	if obj.Name == "" && (obj.OpType != ResyncReplicationType && obj.OpType != AllReplicationType) {
+		return nil
+	}
+	var rules []Rule
+	for _, rule := range c.Rules {
+		if rule.Status == Disabled {
+			continue
+		}
+
+		if obj.TargetArn != "" && rule.Destination.ARN != obj.TargetArn && c.RoleArn != obj.TargetArn {
+			continue
+		}
+		// Ignore other object level and prefix filters for resyncing target/listing bucket targets
+		if obj.OpType == ResyncReplicationType || obj.OpType == AllReplicationType {
+			rules = append(rules, rule)
+			continue
+		}
+		if obj.ExistingObject && rule.ExistingObjectReplication.Status == Disabled {
+			continue
+		}
+		if !strings.HasPrefix(obj.Name, rule.Prefix()) {
+			continue
+		}
+		if rule.Filter.TestTags(obj.UserTags) {
+			rules = append(rules, rule)
+		}
+	}
+	sort.Slice(rules, func(i, j int) bool {
+		return rules[i].Priority > rules[j].Priority && rules[i].Destination.String() == rules[j].Destination.String()
+	})
+
+	return rules
+}
+
+// GetDestination returns destination bucket and storage class.
+func (c Config) GetDestination() Destination {
+	if len(c.Rules) > 0 {
+		return c.Rules[0].Destination
+	}
+	return Destination{}
+}
+
+// Replicate returns true if the object should be replicated.
+func (c Config) Replicate(obj ObjectOpts) bool {
+	for _, rule := range c.FilterActionableRules(obj) {
+		if rule.Status == Disabled {
+			continue
+		}
+		if obj.ExistingObject && rule.ExistingObjectReplication.Status == Disabled {
+			return false
+		}
+		if obj.OpType == DeleteReplicationType {
+			switch {
+			case obj.VersionID != "":
+				// check MinIO extension for versioned deletes
+				return rule.DeleteReplication.Status == Enabled
+			default:
+				return rule.DeleteMarkerReplication.Status == Enabled
+			}
+		} // regular object/metadata replication
+		return rule.MetadataReplicate(obj)
+	}
+	return false
+}
+
+// HasActiveRules - returns whether replication policy has active rules
+// Optionally a prefix can be supplied.
+// If recursive is specified the function will also return true if any level below the
+// prefix has active rules. If no prefix is specified recursive is effectively true.
+func (c Config) HasActiveRules(prefix string, recursive bool) bool {
+	if len(c.Rules) == 0 {
+		return false
+	}
+	for _, rule := range c.Rules {
+		if rule.Status == Disabled {
+			continue
+		}
+		if len(prefix) > 0 && len(rule.Filter.Prefix) > 0 {
+			// incoming prefix must be in rule prefix
+			if !recursive && !strings.HasPrefix(prefix, rule.Filter.Prefix) {
+				continue
+			}
+			// If recursive, we can skip this rule if it doesn't match the tested prefix or level below prefix
+			// does not match
+			if recursive && !strings.HasPrefix(rule.Prefix(), prefix) && !strings.HasPrefix(prefix, rule.Prefix()) {
+				continue
+			}
+		}
+		return true
+	}
+	return false
+}
+
+// FilterTargetArns returns a slice of distinct target arns in the config
+func (c Config) FilterTargetArns(obj ObjectOpts) []string {
+	var arns []string
+
+	tgtsMap := make(map[string]struct{})
+	rules := c.FilterActionableRules(obj)
+	for _, rule := range rules {
+		if rule.Status == Disabled {
+			continue
+		}
+		if c.RoleArn != "" {
+			arns = append(arns, c.RoleArn) // use legacy RoleArn if present
+			return arns
+		}
+		if _, ok := tgtsMap[rule.Destination.ARN]; !ok {
+			tgtsMap[rule.Destination.ARN] = struct{}{}
+		}
+	}
+	for k := range tgtsMap {
+		arns = append(arns, k)
+	}
+	return arns
+}

internal/bucket/replication/replication_test.go

@@ -0,0 +1,417 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+)
+
+func TestParseAndValidateReplicationConfig(t *testing.T) {
+	testCases := []struct {
+		inputConfig           string
+		expectedParsingErr    error
+		expectedValidationErr error
+		destBucket            string
+		sameTarget            bool
+	}{
+		{ // 1 Invalid delete marker status in replication config
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>string</Status></DeleteMarkerReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: errInvalidDeleteMarkerReplicationStatus,
+		},
+		// 2 No delete replication status in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: nil,
+		},
+		// 3 valid replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: nil,
+		},
+		// 4 missing role in config and destination ARN is in legacy format
+		{
+			inputConfig: `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			// destination bucket in config different from bucket specified
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: errDestinationArnMissing,
+		},
+		// 5 replication destination in different rules not identical
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role></Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:minio:replication:::destinationbucket</Bucket></Destination></Rule><Rule><Status>Enabled</Status><Priority>3</Priority><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:minio:replication:::destinationbucket2</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: nil,
+		},
+		// 6 missing rule status in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: errEmptyRuleStatus,
+		},
+		// 7 invalid rule status in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enssabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: errInvalidRuleStatus,
+		},
+		// 8 invalid rule id exceeds length allowed in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><ID>vsUVERgOc8zZYagLSzSa5lE8qeI6nh1lyLNS4R9W052yfecrhhepGboswSWMMNO8CPcXM4GM3nKyQ72EadlMzzZBFoYWKn7ju5GoE5w9c57a0piHR1vexpdd9FrMquiruvAJ0MTGVupm0EegMVxoIOdjx7VgZhGrmi2XDvpVEFT7WmYMA9fSK297XkTHWyECaNHBySJ1Qp4vwX8tPNauKpfHx4kzUpnKe1PZbptGMWbY5qTcwlNuMhVSmgFffShq</ID><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: errInvalidRuleID,
+		},
+		// 9 invalid priority status in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: errReplicationUniquePriority,
+		},
+		// 10 no rule in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: errReplicationNoRule,
+		},
+		// 11 no destination in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    Errorf("invalid destination '%v'", ""),
+			expectedValidationErr: nil,
+		},
+		// 12 destination not matching ARN in replication config
+		{
+			inputConfig:           `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>destinationbucket2</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    fmt.Errorf("invalid destination '%v'", "destinationbucket2"),
+			expectedValidationErr: nil,
+		},
+		// 13 missing role in config and destination ARN has target ARN
+		{
+			inputConfig: `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:minio:replication::8320b6d18f9032b4700f1f03b50d8d1853de8f22cab86931ee794e12f190852c:destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			// destination bucket in config different from bucket specified
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    nil,
+			expectedValidationErr: nil,
+		},
+		// 14 role absent in config and destination ARN has target ARN in invalid format
+		{
+			inputConfig: `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:xx:replication::8320b6d18f9032b4700f1f03b50d8d1853de8f22cab86931ee794e12f190852c:destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			// destination bucket in config different from bucket specified
+			destBucket:            "destinationbucket",
+			sameTarget:            false,
+			expectedParsingErr:    fmt.Errorf("invalid destination '%v'", "arn:xx:replication::8320b6d18f9032b4700f1f03b50d8d1853de8f22cab86931ee794e12f190852c:destinationbucket"),
+			expectedValidationErr: nil,
+		},
+	}
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("Test %d", i+1), func(t *testing.T) {
+			cfg, err := ParseConfig(bytes.NewReader([]byte(tc.inputConfig)))
+			if err != nil && tc.expectedParsingErr != nil && err.Error() != tc.expectedParsingErr.Error() {
+				t.Fatalf("%d: Expected '%v' during parsing but got '%v'", i+1, tc.expectedParsingErr, err)
+			}
+			if err == nil && tc.expectedParsingErr != nil {
+				t.Fatalf("%d: Expected '%v' during parsing but got '%v'", i+1, tc.expectedParsingErr, err)
+			}
+			if tc.expectedParsingErr != nil {
+				// We already expect a parsing error,
+				// no need to continue this test.
+				return
+			}
+			err = cfg.Validate(tc.destBucket, tc.sameTarget)
+			if err != tc.expectedValidationErr {
+				t.Fatalf("%d: Expected %v during parsing but got %v", i+1, tc.expectedValidationErr, err)
+			}
+		})
+	}
+}
+
+func TestReplicate(t *testing.T) {
+	cfgs := []Config{
+		{ // Config0 - Replication config has no filters, all replication enabled
+			Rules: []Rule{
+				{
+					Status:                  Enabled,
+					Priority:                3,
+					DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled},
+					DeleteReplication:       DeleteReplication{Status: Enabled},
+					Filter:                  Filter{},
+				},
+			},
+		},
+		{ // Config1 - Replication config has no filters, delete,delete-marker replication disabled
+			Rules: []Rule{
+				{
+					Status:                  Enabled,
+					Priority:                3,
+					DeleteMarkerReplication: DeleteMarkerReplication{Status: Disabled},
+					DeleteReplication:       DeleteReplication{Status: Disabled},
+					Filter:                  Filter{},
+				},
+			},
+		},
+		{ // Config2 - Replication config has filters and more than 1 matching rule, delete,delete-marker replication disabled
+			Rules: []Rule{
+				{
+					Status:                  Enabled,
+					Priority:                2,
+					DeleteMarkerReplication: DeleteMarkerReplication{Status: Disabled},
+					DeleteReplication:       DeleteReplication{Status: Enabled},
+					Filter:                  Filter{Prefix: "xy", And: And{}, Tag: Tag{Key: "k1", Value: "v1"}},
+				},
+				{
+					Status:                  Enabled,
+					Priority:                1,
+					DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled},
+					DeleteReplication:       DeleteReplication{Status: Disabled},
+					Filter:                  Filter{Prefix: "xyz"},
+				},
+			},
+		},
+		{ // Config3 - Replication config has filters and no overlapping rules
+			Rules: []Rule{
+				{
+					Status:                  Enabled,
+					Priority:                2,
+					DeleteMarkerReplication: DeleteMarkerReplication{Status: Disabled},
+					DeleteReplication:       DeleteReplication{Status: Enabled},
+					Filter:                  Filter{Prefix: "xy", And: And{}, Tag: Tag{Key: "k1", Value: "v1"}},
+				},
+				{
+					Status:                  Enabled,
+					Priority:                1,
+					DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled},
+					DeleteReplication:       DeleteReplication{Status: Disabled},
+					Filter:                  Filter{Prefix: "abc"},
+				},
+			},
+		},
+		{ // Config4 - Replication config has filters and SourceSelectionCriteria Disabled
+			Rules: []Rule{
+				{
+					Status:                  Enabled,
+					Priority:                2,
+					DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled},
+					DeleteReplication:       DeleteReplication{Status: Enabled},
+					SourceSelectionCriteria: SourceSelectionCriteria{ReplicaModifications: ReplicaModifications{Status: Disabled}},
+				},
+			},
+		},
+	}
+	testCases := []struct {
+		opts           ObjectOpts
+		c              Config
+		expectedResult bool
+	}{
+		// using config 1 - no filters, all replication enabled
+		{ObjectOpts{}, cfgs[0], false},                                // 1. invalid ObjectOpts missing object name
+		{ObjectOpts{Name: "c1test"}, cfgs[0], true},                   // 2. valid ObjectOpts passing empty Filter
+		{ObjectOpts{Name: "c1test", VersionID: "vid"}, cfgs[0], true}, // 3. valid ObjectOpts passing empty Filter
+
+		{ObjectOpts{Name: "c1test", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[0], true},                               // 4. DeleteMarker version replication valid case - matches DeleteMarkerReplication status
+		{ObjectOpts{Name: "c1test", VersionID: "vid", OpType: DeleteReplicationType}, cfgs[0], true},                                 // 5. permanent delete of version, matches DeleteReplication status - valid case
+		{ObjectOpts{Name: "c1test", VersionID: "vid", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[0], true},             // 6. permanent delete of version, matches DeleteReplication status
+		{ObjectOpts{Name: "c1test", VersionID: "vid", DeleteMarker: true, SSEC: true, OpType: DeleteReplicationType}, cfgs[0], true}, // 7. permanent delete of version
+		{ObjectOpts{Name: "c1test", DeleteMarker: true, SSEC: true, OpType: DeleteReplicationType}, cfgs[0], true},                   // 8. setting DeleteMarker on SSE-C encrypted object
+		{ObjectOpts{Name: "c1test", SSEC: true}, cfgs[0], true},                                                                      // 9. replication of SSE-C encrypted object
+
+		//  using config 2 - no filters, only replication of object, metadata enabled
+		{ObjectOpts{Name: "c2test"}, cfgs[1], true},                                                                                   // 10. valid ObjectOpts passing empty Filter
+		{ObjectOpts{Name: "c2test", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[1], false},                               // 11. DeleteMarker version replication  not allowed due to DeleteMarkerReplication status
+		{ObjectOpts{Name: "c2test", VersionID: "vid", OpType: DeleteReplicationType}, cfgs[1], false},                                 // 12. permanent delete of version, disallowed by DeleteReplication status
+		{ObjectOpts{Name: "c2test", VersionID: "vid", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[1], false},             // 13. permanent delete of DeleteMarker version, disallowed by DeleteReplication status
+		{ObjectOpts{Name: "c2test", VersionID: "vid", DeleteMarker: true, SSEC: true, OpType: DeleteReplicationType}, cfgs[1], false}, // 14. permanent delete of version, disqualified by SSE-C & DeleteReplication status
+		{ObjectOpts{Name: "c2test", DeleteMarker: true, SSEC: true, OpType: DeleteReplicationType}, cfgs[1], false},                   // 15. setting DeleteMarker on SSE-C encrypted object, disqualified by SSE-C & DeleteMarkerReplication status
+		{ObjectOpts{Name: "c2test", SSEC: true}, cfgs[1], true},                                                                       // 16. replication of SSE-C encrypted object
+		// using config 2 - has more than one rule with overlapping prefixes
+		{ObjectOpts{Name: "xy/c3test", UserTags: "k1=v1"}, cfgs[2], true},                                                                       // 17. matches rule 1 for replication of content/metadata
+		{ObjectOpts{Name: "xyz/c3test", UserTags: "k1=v1"}, cfgs[2], true},                                                                      // 18. matches rule 1 for replication of content/metadata
+		{ObjectOpts{Name: "xyz/c3test", UserTags: "k1=v1", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[2], false},                  // 19. matches rule 1 - DeleteMarker replication disallowed by rule
+		{ObjectOpts{Name: "xyz/c3test", UserTags: "k1=v1", DeleteMarker: true, VersionID: "vid", OpType: DeleteReplicationType}, cfgs[2], true}, // 20. matches rule 1 - DeleteReplication allowed by rule for permanent delete of DeleteMarker
+		{ObjectOpts{Name: "xyz/c3test", UserTags: "k1=v1", VersionID: "vid", OpType: DeleteReplicationType}, cfgs[2], true},                     // 21. matches rule 1 - DeleteReplication allowed by rule for permanent delete of version
+		{ObjectOpts{Name: "xyz/c3test"}, cfgs[2], true},                                                                                         // 22. matches rule 2 for replication of content/metadata
+		{ObjectOpts{Name: "xy/c3test", UserTags: "k1=v2"}, cfgs[2], false},                                                                      // 23. does not match rule1 because tag value does not pass filter
+		{ObjectOpts{Name: "xyz/c3test", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[2], true},                                      // 24. matches rule 2 - DeleteMarker replication allowed by rule
+		{ObjectOpts{Name: "xyz/c3test", DeleteMarker: true, VersionID: "vid", OpType: DeleteReplicationType}, cfgs[2], false},                   // 25. matches rule 2 - DeleteReplication disallowed by rule for permanent delete of DeleteMarker
+		{ObjectOpts{Name: "xyz/c3test", VersionID: "vid", OpType: DeleteReplicationType}, cfgs[2], false},                                       // 26. matches rule 1 - DeleteReplication disallowed by rule for permanent delete of version
+		{ObjectOpts{Name: "abc/c3test"}, cfgs[2], false},                                                                                        // 27. matches no rule because object prefix does not match
+
+		// using config 3 - has no overlapping rules
+		{ObjectOpts{Name: "xy/c4test", UserTags: "k1=v1"}, cfgs[3], true},                                                                       // 28. matches rule 1 for replication of content/metadata
+		{ObjectOpts{Name: "xa/c4test", UserTags: "k1=v1"}, cfgs[3], false},                                                                      // 29. no rule match object prefix not in rules
+		{ObjectOpts{Name: "xyz/c4test", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[3], false},                                     // 30. rule 1 not matched because of tags filter
+		{ObjectOpts{Name: "xyz/c4test", UserTags: "k1=v1", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[3], false},                  // 31. matches rule 1 - DeleteMarker replication disallowed by rule
+		{ObjectOpts{Name: "xyz/c4test", UserTags: "k1=v1", DeleteMarker: true, VersionID: "vid", OpType: DeleteReplicationType}, cfgs[3], true}, // 32. matches rule 1 - DeleteReplication allowed by rule for permanent delete of DeleteMarker
+		{ObjectOpts{Name: "xyz/c4test", UserTags: "k1=v1", VersionID: "vid", OpType: DeleteReplicationType}, cfgs[3], true},                     // 33. matches rule 1 - DeleteReplication allowed by rule for permanent delete of version
+		{ObjectOpts{Name: "abc/c4test"}, cfgs[3], true},                                                                                         // 34. matches rule 2 for replication of content/metadata
+		{ObjectOpts{Name: "abc/c4test", UserTags: "k1=v2"}, cfgs[3], true},                                                                      // 35. matches rule 2 for replication of content/metadata
+		{ObjectOpts{Name: "abc/c4test", DeleteMarker: true, OpType: DeleteReplicationType}, cfgs[3], true},                                      // 36. matches rule 2 - DeleteMarker replication allowed by rule
+		{ObjectOpts{Name: "abc/c4test", DeleteMarker: true, VersionID: "vid", OpType: DeleteReplicationType}, cfgs[3], false},                   // 37. matches rule 2 - DeleteReplication disallowed by rule for permanent delete of DeleteMarker
+		{ObjectOpts{Name: "abc/c4test", VersionID: "vid", OpType: DeleteReplicationType}, cfgs[3], false},                                       // 38. matches rule 2 - DeleteReplication disallowed by rule for permanent delete of version
+		//  using config 4 - with replica modification sync disabled.
+		{ObjectOpts{Name: "xy/c5test", UserTags: "k1=v1", Replica: true}, cfgs[4], false}, // 39. replica syncing disabled, this object is a replica
+		{ObjectOpts{Name: "xa/c5test", UserTags: "k1=v1", Replica: false}, cfgs[4], true}, // 40. replica syncing disabled, this object is NOT a replica
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.opts.Name, func(t *testing.T) {
+			result := testCase.c.Replicate(testCase.opts)
+			if result != testCase.expectedResult {
+				t.Errorf("expected: %v, got: %v", testCase.expectedResult, result)
+			}
+		})
+	}
+}
+
+func TestHasActiveRules(t *testing.T) {
+	testCases := []struct {
+		inputConfig    string
+		prefix         string
+		expectedNonRec bool
+		expectedRec    bool
+	}{
+		// case 1 - only one rule which is in Disabled status
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Disabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:         "miss/prefix",
+			expectedNonRec: false,
+			expectedRec:    false,
+		},
+		// case 2 - only one rule which matches prefix filter
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Filter><Prefix>key/prefix</Prefix></Filter><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:         "key/prefix1",
+			expectedNonRec: true,
+			expectedRec:    true,
+		},
+		// case 3 - empty prefix
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:         "key-prefix",
+			expectedNonRec: true,
+			expectedRec:    true,
+		},
+		// case 4 - has Filter based on prefix
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Filter><Prefix>testdir/dir1/</Prefix></Filter><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:         "testdir/",
+			expectedNonRec: false,
+			expectedRec:    true,
+		},
+		// case 5 - has filter with prefix and tags, here we are not matching on tags
+		{
+			inputConfig: `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Filter>
+		<And><Prefix>key-prefix</Prefix><Tag><Key>key1</Key><Value>value1</Value></Tag><Tag><Key>key2</Key><Value>value2</Value></Tag></And></Filter><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:         "testdir/",
+			expectedNonRec: true,
+			expectedRec:    true,
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("Test_%d", i+1), func(t *testing.T) {
+			cfg, err := ParseConfig(bytes.NewReader([]byte(tc.inputConfig)))
+			if err != nil {
+				t.Fatalf("Got unexpected error: %v", err)
+			}
+			if got := cfg.HasActiveRules(tc.prefix, false); got != tc.expectedNonRec {
+				t.Fatalf("Expected result with recursive set to false: `%v`, got: `%v`", tc.expectedNonRec, got)
+			}
+			if got := cfg.HasActiveRules(tc.prefix, true); got != tc.expectedRec {
+				t.Fatalf("Expected result with recursive set to true: `%v`, got: `%v`", tc.expectedRec, got)
+			}
+		})
+	}
+}
+
+func TestFilterActionableRules(t *testing.T) {
+	testCases := []struct {
+		inputConfig   string
+		prefix        string
+		ExpectedRules []Rule
+	}{
+		// case 1 - only one rule
+		{
+			inputConfig:   `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>prefix</Prefix><Priority>1</Priority><Destination><Bucket>arn:minio:replication:xxx::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:        "prefix",
+			ExpectedRules: []Rule{{Status: Enabled, Priority: 1, DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled}, DeleteReplication: DeleteReplication{Status: Disabled}, Destination: Destination{Bucket: "destinationbucket", ARN: "arn:minio:replication:xxx::destinationbucket"}}},
+		},
+		// case 2 - multiple rules for same target, overlapping rules with different priority
+		{
+			inputConfig: `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>prefix</Prefix><Priority>3</Priority><Destination><Bucket>arn:minio:replication:xxx::destinationbucket</Bucket></Destination></Rule><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>prefix</Prefix><Priority>1</Priority><Destination><Bucket>arn:minio:replication:xxx::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:      "prefix",
+			ExpectedRules: []Rule{
+				{Status: Enabled, Priority: 3, DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled}, DeleteReplication: DeleteReplication{Status: Disabled}, Destination: Destination{Bucket: "destinationbucket", ARN: "arn:minio:replication:xxx::destinationbucket"}},
+				{Status: Enabled, Priority: 1, DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled}, DeleteReplication: DeleteReplication{Status: Disabled}, Destination: Destination{Bucket: "destinationbucket", ARN: "arn:minio:replication:xxx::destinationbucket"}},
+			},
+		},
+		// case 3 - multiple rules for different target, overlapping rules on a target
+		{
+			inputConfig: `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>prefix</Prefix><Priority>2</Priority><Destination><Bucket>arn:minio:replication:xxx::destinationbucket2</Bucket></Destination></Rule><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>prefix</Prefix><Priority>4</Priority><Destination><Bucket>arn:minio:replication:xxx::destinationbucket2</Bucket></Destination></Rule><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>prefix</Prefix><Priority>3</Priority><Destination><Bucket>arn:minio:replication:xxx::destinationbucket</Bucket></Destination></Rule><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>prefix</Prefix><Priority>1</Priority><Destination><Bucket>arn:minio:replication:xxx::destinationbucket</Bucket></Destination></Rule></ReplicationConfiguration>`,
+			prefix:      "prefix",
+			ExpectedRules: []Rule{
+				{Status: Enabled, Priority: 4, DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled}, DeleteReplication: DeleteReplication{Status: Disabled}, Destination: Destination{Bucket: "destinationbucket2", ARN: "arn:minio:replication:xxx::destinationbucket2"}},
+				{Status: Enabled, Priority: 2, DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled}, DeleteReplication: DeleteReplication{Status: Disabled}, Destination: Destination{Bucket: "destinationbucket2", ARN: "arn:minio:replication:xxx::destinationbucket2"}},
+				{Status: Enabled, Priority: 3, DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled}, DeleteReplication: DeleteReplication{Status: Disabled}, Destination: Destination{Bucket: "destinationbucket", ARN: "arn:minio:replication:xxx::destinationbucket"}},
+				{Status: Enabled, Priority: 1, DeleteMarkerReplication: DeleteMarkerReplication{Status: Enabled}, DeleteReplication: DeleteReplication{Status: Disabled}, Destination: Destination{Bucket: "destinationbucket", ARN: "arn:minio:replication:xxx::destinationbucket"}},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		cfg, err := ParseConfig(bytes.NewReader([]byte(tc.inputConfig)))
+		if err != nil {
+			t.Fatalf("Got unexpected error: %v", err)
+		}
+		got := cfg.FilterActionableRules(ObjectOpts{Name: tc.prefix})
+		if len(got) != len(tc.ExpectedRules) {
+			t.Fatalf("Expected matching number of actionable rules: `%v`, got: `%v`", tc.ExpectedRules, got)
+		}
+		for i := range got {
+			if got[i].Destination.ARN != tc.ExpectedRules[i].Destination.ARN || got[i].Priority != tc.ExpectedRules[i].Priority {
+				t.Fatalf("Expected order of filtered rules to be identical: `%v`, got: `%v`", tc.ExpectedRules, got)
+			}
+		}
+	}
+}

internal/bucket/replication/rule.go

@@ -0,0 +1,256 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"bytes"
+	"encoding/xml"
+)
+
+// Status represents Enabled/Disabled status
+type Status string
+
+// Supported status types
+const (
+	Enabled  Status = "Enabled"
+	Disabled Status = "Disabled"
+)
+
+// DeleteMarkerReplication - whether delete markers are replicated - https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html
+type DeleteMarkerReplication struct {
+	Status Status `xml:"Status"` // should be set to "Disabled" by default
+}
+
+// IsEmpty returns true if DeleteMarkerReplication is not set
+func (d DeleteMarkerReplication) IsEmpty() bool {
+	return len(d.Status) == 0
+}
+
+// Validate validates whether the status is disabled.
+func (d DeleteMarkerReplication) Validate() error {
+	if d.IsEmpty() {
+		return errDeleteMarkerReplicationMissing
+	}
+	if d.Status != Disabled && d.Status != Enabled {
+		return errInvalidDeleteMarkerReplicationStatus
+	}
+	return nil
+}
+
+// DeleteReplication - whether versioned deletes are replicated - this is a MinIO only
+// extension.
+type DeleteReplication struct {
+	Status Status `xml:"Status"` // should be set to "Disabled" by default
+}
+
+// IsEmpty returns true if DeleteReplication is not set
+func (d DeleteReplication) IsEmpty() bool {
+	return len(d.Status) == 0
+}
+
+// Validate validates whether the status is disabled.
+func (d DeleteReplication) Validate() error {
+	if d.IsEmpty() {
+		return errDeleteReplicationMissing
+	}
+	if d.Status != Disabled && d.Status != Enabled {
+		return errInvalidDeleteReplicationStatus
+	}
+	return nil
+}
+
+// UnmarshalXML - decodes XML data.
+func (d *DeleteReplication) UnmarshalXML(dec *xml.Decoder, start xml.StartElement) (err error) {
+	// Make subtype to avoid recursive UnmarshalXML().
+	type deleteReplication DeleteReplication
+	drep := deleteReplication{}
+
+	if err := dec.DecodeElement(&drep, &start); err != nil {
+		return err
+	}
+	if len(drep.Status) == 0 {
+		drep.Status = Disabled
+	}
+	d.Status = drep.Status
+	return nil
+}
+
+// ExistingObjectReplication - whether existing object replication is enabled
+type ExistingObjectReplication struct {
+	Status Status `xml:"Status"` // should be set to "Disabled" by default
+}
+
+// IsEmpty returns true if ExistingObjectReplication is not set
+func (e ExistingObjectReplication) IsEmpty() bool {
+	return len(e.Status) == 0
+}
+
+// Validate validates whether the status is disabled.
+func (e ExistingObjectReplication) Validate() error {
+	if e.IsEmpty() {
+		return nil
+	}
+	if e.Status != Disabled && e.Status != Enabled {
+		return errInvalidExistingObjectReplicationStatus
+	}
+	return nil
+}
+
+// UnmarshalXML - decodes XML data. Default to Disabled unless specified
+func (e *ExistingObjectReplication) UnmarshalXML(dec *xml.Decoder, start xml.StartElement) (err error) {
+	// Make subtype to avoid recursive UnmarshalXML().
+	type existingObjectReplication ExistingObjectReplication
+	erep := existingObjectReplication{}
+
+	if err := dec.DecodeElement(&erep, &start); err != nil {
+		return err
+	}
+	if len(erep.Status) == 0 {
+		erep.Status = Disabled
+	}
+	e.Status = erep.Status
+	return nil
+}
+
+// Rule - a rule for replication configuration.
+type Rule struct {
+	XMLName                 xml.Name                `xml:"Rule" json:"Rule"`
+	ID                      string                  `xml:"ID,omitempty" json:"ID,omitempty"`
+	Status                  Status                  `xml:"Status" json:"Status"`
+	Priority                int                     `xml:"Priority" json:"Priority"`
+	DeleteMarkerReplication DeleteMarkerReplication `xml:"DeleteMarkerReplication" json:"DeleteMarkerReplication"`
+	// MinIO extension to replicate versioned deletes
+	DeleteReplication         DeleteReplication         `xml:"DeleteReplication" json:"DeleteReplication"`
+	Destination               Destination               `xml:"Destination" json:"Destination"`
+	SourceSelectionCriteria   SourceSelectionCriteria   `xml:"SourceSelectionCriteria" json:"SourceSelectionCriteria"`
+	Filter                    Filter                    `xml:"Filter" json:"Filter"`
+	ExistingObjectReplication ExistingObjectReplication `xml:"ExistingObjectReplication,omitempty" json:"ExistingObjectReplication"`
+}
+
+var (
+	errInvalidRuleID                          = Errorf("ID must be less than 255 characters")
+	errEmptyRuleStatus                        = Errorf("Status should not be empty")
+	errInvalidRuleStatus                      = Errorf("Status must be set to either Enabled or Disabled")
+	errDeleteMarkerReplicationMissing         = Errorf("DeleteMarkerReplication must be specified")
+	errPriorityMissing                        = Errorf("Priority must be specified")
+	errInvalidDeleteMarkerReplicationStatus   = Errorf("Delete marker replication status is invalid")
+	errDestinationSourceIdentical             = Errorf("Destination bucket cannot be the same as the source bucket.")
+	errDeleteReplicationMissing               = Errorf("Delete replication must be specified")
+	errInvalidDeleteReplicationStatus         = Errorf("Delete replication is either enable|disable")
+	errInvalidExistingObjectReplicationStatus = Errorf("Existing object replication status is invalid")
+	errTagsDeleteMarkerReplicationDisallowed  = Errorf("Delete marker replication is not supported if any Tag filter is specified")
+)
+
+// validateID - checks if ID is valid or not.
+func (r Rule) validateID() error {
+	// cannot be longer than 255 characters
+	if len(r.ID) > 255 {
+		return errInvalidRuleID
+	}
+	return nil
+}
+
+// validateStatus - checks if status is valid or not.
+func (r Rule) validateStatus() error {
+	// Status can't be empty
+	if len(r.Status) == 0 {
+		return errEmptyRuleStatus
+	}
+
+	// Status must be one of Enabled or Disabled
+	if r.Status != Enabled && r.Status != Disabled {
+		return errInvalidRuleStatus
+	}
+	return nil
+}
+
+func (r Rule) validateFilter() error {
+	return r.Filter.Validate()
+}
+
+// Prefix - a rule can either have prefix under <filter></filter> or under
+// <filter><and></and></filter>. This method returns the prefix from the
+// location where it is available
+func (r Rule) Prefix() string {
+	if r.Filter.Prefix != "" {
+		return r.Filter.Prefix
+	}
+	return r.Filter.And.Prefix
+}
+
+// Tags - a rule can either have tag under <filter></filter> or under
+// <filter><and></and></filter>. This method returns all the tags from the
+// rule in the format tag1=value1&tag2=value2
+func (r Rule) Tags() string {
+	if !r.Filter.Tag.IsEmpty() {
+		return r.Filter.Tag.String()
+	}
+	if len(r.Filter.And.Tags) != 0 {
+		var buf bytes.Buffer
+		for _, t := range r.Filter.And.Tags {
+			if buf.Len() > 0 {
+				buf.WriteString("&")
+			}
+			buf.WriteString(t.String())
+		}
+		return buf.String()
+	}
+	return ""
+}
+
+// Validate - validates the rule element
+func (r Rule) Validate(bucket string, sameTarget bool) error {
+	if err := r.validateID(); err != nil {
+		return err
+	}
+	if err := r.validateStatus(); err != nil {
+		return err
+	}
+	if err := r.validateFilter(); err != nil {
+		return err
+	}
+	if err := r.DeleteMarkerReplication.Validate(); err != nil {
+		return err
+	}
+	if err := r.DeleteReplication.Validate(); err != nil {
+		return err
+	}
+	if err := r.SourceSelectionCriteria.Validate(); err != nil {
+		return err
+	}
+
+	if r.Priority < 0 {
+		return errPriorityMissing
+	}
+	if r.Destination.Bucket == bucket && sameTarget {
+		return errDestinationSourceIdentical
+	}
+	if !r.Filter.Tag.IsEmpty() && (r.DeleteMarkerReplication.Status == Enabled) {
+		return errTagsDeleteMarkerReplicationDisallowed
+	}
+	return r.ExistingObjectReplication.Validate()
+}
+
+// MetadataReplicate  returns true if object is not a replica or in the case of replicas,
+// replica modification sync is enabled.
+func (r Rule) MetadataReplicate(obj ObjectOpts) bool {
+	if !obj.Replica {
+		return true
+	}
+	return obj.Replica && r.SourceSelectionCriteria.ReplicaModifications.Status == Enabled
+}

internal/bucket/replication/rule_test.go

@@ -0,0 +1,70 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+)
+
+func TestMetadataReplicate(t *testing.T) {
+	testCases := []struct {
+		inputConfig    string
+		opts           ObjectOpts
+		expectedResult bool
+	}{
+		// case 1 - rule with replica modification enabled; not a replica
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination><SourceSelectionCriteria><ReplicaModifications><Status>Enabled</Status></ReplicaModifications></SourceSelectionCriteria></Rule></ReplicationConfiguration>`,
+			opts:           ObjectOpts{Name: "c1test", DeleteMarker: false, OpType: ObjectReplicationType, Replica: false}, // 1. Replica mod sync enabled; not a replica
+			expectedResult: true,
+		},
+		// case 2 - rule with replica modification disabled; a replica
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination><SourceSelectionCriteria><ReplicaModifications><Status>Disabled</Status></ReplicaModifications></SourceSelectionCriteria></Rule></ReplicationConfiguration>`,
+			opts:           ObjectOpts{Name: "c2test", DeleteMarker: false, OpType: ObjectReplicationType, Replica: true}, // 1. Replica mod sync enabled; a replica
+			expectedResult: false,
+		},
+		// case 3 - rule with replica modification disabled; not a replica
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination><SourceSelectionCriteria><ReplicaModifications><Status>Disabled</Status></ReplicaModifications></SourceSelectionCriteria></Rule></ReplicationConfiguration>`,
+			opts:           ObjectOpts{Name: "c2test", DeleteMarker: false, OpType: ObjectReplicationType, Replica: false}, // 1. Replica mod sync disabled; not a replica
+			expectedResult: true,
+		},
+
+		// case 4 - rule with replica modification enabled; a replica
+		{
+			inputConfig:    `<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Role>arn:aws:iam::AcctID:role/role-name</Role><Rule><Status>Enabled</Status><DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication><DeleteReplication><Status>Disabled</Status></DeleteReplication><Prefix>key-prefix</Prefix><Destination><Bucket>arn:aws:s3:::destinationbucket</Bucket></Destination><SourceSelectionCriteria><ReplicaModifications><Status>Enabled</Status></ReplicaModifications></SourceSelectionCriteria></Rule></ReplicationConfiguration>`,
+			opts:           ObjectOpts{Name: "c2test", DeleteMarker: false, OpType: MetadataReplicationType, Replica: true}, // 1. Replica mod sync enabled;  a replica
+			expectedResult: true,
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("Test_%d", i+1), func(t *testing.T) {
+			cfg, err := ParseConfig(bytes.NewReader([]byte(tc.inputConfig)))
+			if err != nil {
+				t.Fatalf("Got unexpected error: %v", err)
+			}
+			if got := cfg.Rules[0].MetadataReplicate(tc.opts); got != tc.expectedResult {
+				t.Fatalf("Expected result with recursive set to false: `%v`, got: `%v`", tc.expectedResult, got)
+			}
+		})
+	}
+}

internal/bucket/replication/sourceselectioncriteria.go

@@ -0,0 +1,76 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"encoding/xml"
+)
+
+// ReplicaModifications specifies if replica modification sync is enabled
+type ReplicaModifications struct {
+	Status Status `xml:"Status" json:"Status"`
+}
+
+// SourceSelectionCriteria - specifies additional source selection criteria in ReplicationConfiguration.
+type SourceSelectionCriteria struct {
+	ReplicaModifications ReplicaModifications `xml:"ReplicaModifications" json:"ReplicaModifications"`
+}
+
+// IsValid - checks whether SourceSelectionCriteria is valid or not.
+func (s SourceSelectionCriteria) IsValid() bool {
+	return s.ReplicaModifications.Status == Enabled || s.ReplicaModifications.Status == Disabled
+}
+
+// Validate source selection criteria
+func (s SourceSelectionCriteria) Validate() error {
+	if (s == SourceSelectionCriteria{}) {
+		return nil
+	}
+	if !s.IsValid() {
+		return errInvalidSourceSelectionCriteria
+	}
+	return nil
+}
+
+// UnmarshalXML - decodes XML data.
+func (s *SourceSelectionCriteria) UnmarshalXML(dec *xml.Decoder, start xml.StartElement) (err error) {
+	// Make subtype to avoid recursive UnmarshalXML().
+	type sourceSelectionCriteria SourceSelectionCriteria
+	ssc := sourceSelectionCriteria{}
+	if err := dec.DecodeElement(&ssc, &start); err != nil {
+		return err
+	}
+	if len(ssc.ReplicaModifications.Status) == 0 {
+		ssc.ReplicaModifications.Status = Enabled
+	}
+	*s = SourceSelectionCriteria(ssc)
+	return nil
+}
+
+// MarshalXML - encodes to XML data.
+func (s SourceSelectionCriteria) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if err := e.EncodeToken(start); err != nil {
+		return err
+	}
+	if s.IsValid() {
+		if err := e.EncodeElement(s.ReplicaModifications, xml.StartElement{Name: xml.Name{Local: "ReplicaModifications"}}); err != nil {
+			return err
+		}
+	}
+	return e.EncodeToken(xml.EndElement{Name: start.Name})
+}

internal/bucket/replication/tag.go

@@ -0,0 +1,57 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package replication
+
+import (
+	"encoding/xml"
+	"unicode/utf8"
+)
+
+// Tag - a tag for a replication configuration Rule filter.
+type Tag struct {
+	XMLName xml.Name `xml:"Tag" json:"Tag"`
+	Key     string   `xml:"Key,omitempty" json:"Key,omitempty"`
+	Value   string   `xml:"Value,omitempty" json:"Value,omitempty"`
+}
+
+var (
+	errInvalidTagKey   = Errorf("The TagKey you have provided is invalid")
+	errInvalidTagValue = Errorf("The TagValue you have provided is invalid")
+)
+
+func (tag Tag) String() string {
+	return tag.Key + "=" + tag.Value
+}
+
+// IsEmpty returns whether this tag is empty or not.
+func (tag Tag) IsEmpty() bool {
+	return tag.Key == ""
+}
+
+// Validate checks this tag.
+func (tag Tag) Validate() error {
+	if len(tag.Key) == 0 || utf8.RuneCountInString(tag.Key) > 128 {
+		return errInvalidTagKey
+	}
+
+	if utf8.RuneCountInString(tag.Value) > 256 {
+		return errInvalidTagValue
+	}
+
+	return nil
+}

internal/bucket/versioning/error.go

@@ -0,0 +1,45 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package versioning
+
+import (
+	"fmt"
+)
+
+// Error is the generic type for any error happening during tag
+// parsing.
+type Error struct {
+	err error
+}
+
+// Errorf - formats according to a format specifier and returns
+// the string as a value that satisfies error of type tagging.Error
+func Errorf(format string, a ...any) error {
+	return Error{err: fmt.Errorf(format, a...)}
+}
+
+// Unwrap the internal error.
+func (e Error) Unwrap() error { return e.err }
+
+// Error 'error' compatible method.
+func (e Error) Error() string {
+	if e.err == nil {
+		return "versioning: cause <nil>"
+	}
+	return e.err.Error()
+}

internal/bucket/versioning/versioning.go

@@ -0,0 +1,167 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package versioning
+
+import (
+	"encoding/xml"
+	"io"
+	"strings"
+
+	"github.com/minio/pkg/v3/wildcard"
+)
+
+// State - enabled/disabled/suspended states
+// for multifactor and status of versioning.
+type State string
+
+// Various supported states
+const (
+	Enabled State = "Enabled"
+	// Disabled  State = "Disabled" only used by MFA Delete not supported yet.
+	Suspended State = "Suspended"
+)
+
+var (
+	errExcludedPrefixNotSupported = Errorf("excluded prefixes extension supported only when versioning is enabled")
+	errTooManyExcludedPrefixes    = Errorf("too many excluded prefixes")
+)
+
+// ExcludedPrefix - holds individual prefixes excluded from being versioned.
+type ExcludedPrefix struct {
+	Prefix string
+}
+
+// Versioning - Configuration for bucket versioning.
+type Versioning struct {
+	XMLNS   string   `xml:"xmlns,attr,omitempty"`
+	XMLName xml.Name `xml:"VersioningConfiguration"`
+	// MFADelete State    `xml:"MFADelete,omitempty"` // not supported yet.
+	Status State `xml:"Status,omitempty"`
+	// MinIO extension - allows selective, prefix-level versioning exclusion.
+	// Requires versioning to be enabled
+	ExcludedPrefixes []ExcludedPrefix `xml:",omitempty"`
+	ExcludeFolders   bool             `xml:",omitempty"`
+}
+
+// Validate - validates the versioning configuration
+func (v Versioning) Validate() error {
+	// Not supported yet
+	// switch v.MFADelete {
+	// case Enabled, Disabled:
+	// default:
+	// 	return Errorf("unsupported MFADelete state %s", v.MFADelete)
+	// }
+	switch v.Status {
+	case Enabled:
+		const maxExcludedPrefixes = 10
+		if len(v.ExcludedPrefixes) > maxExcludedPrefixes {
+			return errTooManyExcludedPrefixes
+		}
+
+	case Suspended:
+		if len(v.ExcludedPrefixes) > 0 {
+			return errExcludedPrefixNotSupported
+		}
+	default:
+		return Errorf("unsupported Versioning status %s", v.Status)
+	}
+	return nil
+}
+
+// Enabled - returns true if versioning is enabled
+func (v Versioning) Enabled() bool {
+	return v.Status == Enabled
+}
+
+// Versioned returns if 'prefix' has versioning enabled or suspended.
+func (v Versioning) Versioned(prefix string) bool {
+	return v.PrefixEnabled(prefix) || v.PrefixSuspended(prefix)
+}
+
+// PrefixEnabled - returns true if versioning is enabled at the bucket and given
+// prefix, false otherwise.
+func (v Versioning) PrefixEnabled(prefix string) bool {
+	if v.Status != Enabled {
+		return false
+	}
+
+	if prefix == "" {
+		return true
+	}
+	if v.ExcludeFolders && strings.HasSuffix(prefix, "/") {
+		return false
+	}
+
+	for _, sprefix := range v.ExcludedPrefixes {
+		// Note: all excluded prefix patterns end with `/` (See Validate)
+		sprefix.Prefix += "*"
+
+		if matched := wildcard.MatchSimple(sprefix.Prefix, prefix); matched {
+			return false
+		}
+	}
+	return true
+}
+
+// Suspended - returns true if versioning is suspended
+func (v Versioning) Suspended() bool {
+	return v.Status == Suspended
+}
+
+// PrefixSuspended - returns true if versioning is suspended at the bucket level
+// or suspended on the given prefix.
+func (v Versioning) PrefixSuspended(prefix string) bool {
+	if v.Status == Suspended {
+		return true
+	}
+	if v.Status == Enabled {
+		if prefix == "" {
+			return false
+		}
+		if v.ExcludeFolders && strings.HasSuffix(prefix, "/") {
+			return true
+		}
+
+		for _, sprefix := range v.ExcludedPrefixes {
+			// Note: all excluded prefix patterns end with `/` (See Validate)
+			sprefix.Prefix += "*"
+			if matched := wildcard.MatchSimple(sprefix.Prefix, prefix); matched {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// PrefixesExcluded returns true if v contains one or more excluded object
+// prefixes or if ExcludeFolders is true.
+func (v Versioning) PrefixesExcluded() bool {
+	return len(v.ExcludedPrefixes) > 0 || v.ExcludeFolders
+}
+
+// ParseConfig - parses data in given reader to VersioningConfiguration.
+func ParseConfig(reader io.Reader) (*Versioning, error) {
+	var v Versioning
+	if err := xml.NewDecoder(reader).Decode(&v); err != nil {
+		return nil, err
+	}
+	if err := v.Validate(); err != nil {
+		return nil, err
+	}
+	return &v, nil
+}

internal/bucket/versioning/versioning_test.go

@@ -0,0 +1,241 @@
+// Copyright (c) 2015-2022 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package versioning
+
+import (
+	"encoding/xml"
+	"strings"
+	"testing"
+)
+
+func TestParseConfig(t *testing.T) {
+	testcases := []struct {
+		input            string
+		err              error
+		excludedPrefixes []string
+		excludeFolders   bool
+	}{
+		{
+			input: `<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+                                  <Status>Enabled</Status>
+                                </VersioningConfiguration>`,
+			err: nil,
+		},
+		{
+			input: `<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+                                  <Status>Enabled</Status>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_temporary/</Prefix>
+                                  </ExcludedPrefixes>
+                                </VersioningConfiguration>`,
+			err:              nil,
+			excludedPrefixes: []string{"path/to/my/workload/_staging/", "path/to/my/workload/_temporary/"},
+		},
+		{
+			input: `<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+                                  <Status>Suspended</Status>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging</Prefix>
+                                  </ExcludedPrefixes>
+                                </VersioningConfiguration>`,
+			err: errExcludedPrefixNotSupported,
+		},
+		{
+			input: `<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+                                  <Status>Enabled</Status>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/ab/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/cd/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/ef/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/gh/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/ij/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/kl/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/mn/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/op/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/qr/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/st/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/uv/</Prefix>
+                                  </ExcludedPrefixes>
+                                </VersioningConfiguration>`,
+			err: errTooManyExcludedPrefixes,
+		},
+		{
+			input: `<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+                                  <Status>Enabled</Status>
+                                  <ExcludeFolders>true</ExcludeFolders>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_staging/</Prefix>
+                                  </ExcludedPrefixes>
+                                  <ExcludedPrefixes>
+                                    <Prefix>path/to/my/workload/_temporary/</Prefix>
+                                  </ExcludedPrefixes>
+                                </VersioningConfiguration>`,
+			err:              nil,
+			excludedPrefixes: []string{"path/to/my/workload/_staging/", "path/to/my/workload/_temporary/"},
+			excludeFolders:   true,
+		},
+	}
+
+	for i, tc := range testcases {
+		var v *Versioning
+		var err error
+		v, err = ParseConfig(strings.NewReader(tc.input))
+		if tc.err != err {
+			t.Fatalf("Test %d: expected %v but got %v", i+1, tc.err, err)
+		}
+		if err != nil {
+			if tc.err == nil {
+				t.Fatalf("Test %d: failed due to %v", i+1, err)
+			}
+		} else {
+			if err := v.Validate(); tc.err != err {
+				t.Fatalf("Test %d: validation failed due to %v", i+1, err)
+			}
+			if len(tc.excludedPrefixes) > 0 {
+				var mismatch bool
+				if len(v.ExcludedPrefixes) != len(tc.excludedPrefixes) {
+					t.Fatalf("Test %d: Expected length of excluded prefixes %d but got %d", i+1, len(tc.excludedPrefixes), len(v.ExcludedPrefixes))
+				}
+				var i int
+				var eprefix string
+				for i, eprefix = range tc.excludedPrefixes {
+					if eprefix != v.ExcludedPrefixes[i].Prefix {
+						mismatch = true
+						break
+					}
+				}
+				if mismatch {
+					t.Fatalf("Test %d: Expected excluded prefix %s but got %s", i+1, tc.excludedPrefixes[i], v.ExcludedPrefixes[i].Prefix)
+				}
+			}
+			if tc.excludeFolders != v.ExcludeFolders {
+				t.Fatalf("Test %d: Expected ExcludeFoldersr=%v but got %v", i+1, tc.excludeFolders, v.ExcludeFolders)
+			}
+		}
+	}
+}
+
+func TestMarshalXML(t *testing.T) {
+	// Validates if Versioning with no excluded prefixes omits
+	// ExcludedPrefixes tags
+	v := Versioning{
+		Status: Enabled,
+	}
+	buf, err := xml.Marshal(v)
+	if err != nil {
+		t.Fatalf("Failed to marshal %v: %v", v, err)
+	}
+
+	str := string(buf)
+	if strings.Contains(str, "ExcludedPrefixes") {
+		t.Fatalf("XML shouldn't contain ExcludedPrefixes tag - %s", str)
+	}
+}
+
+func TestVersioningZero(t *testing.T) {
+	var v Versioning
+	if v.Enabled() {
+		t.Fatalf("Expected to be disabled but got enabled")
+	}
+	if v.Suspended() {
+		t.Fatalf("Expected to be disabled but got suspended")
+	}
+}
+
+func TestExcludeFolders(t *testing.T) {
+	v := Versioning{
+		Status:         Enabled,
+		ExcludeFolders: true,
+	}
+	testPrefixes := []string{"jobs/output/_temporary/", "jobs/output/", "jobs/"}
+	for i, prefix := range testPrefixes {
+		if v.PrefixEnabled(prefix) || !v.PrefixSuspended(prefix) {
+			t.Fatalf("Test %d: Expected versioning to be excluded for %s", i+1, prefix)
+		}
+	}
+
+	// Test applicability for regular objects
+	if prefix := "prefix-1/obj-1"; !v.PrefixEnabled(prefix) || v.PrefixSuspended(prefix) {
+		t.Fatalf("Expected versioning to be enabled for %s", prefix)
+	}
+
+	// Test when ExcludeFolders is disabled
+	v.ExcludeFolders = false
+	for i, prefix := range testPrefixes {
+		if !v.PrefixEnabled(prefix) || v.PrefixSuspended(prefix) {
+			t.Fatalf("Test %d: Expected versioning to be enabled for %s", i+1, prefix)
+		}
+	}
+}
+
+func TestExcludedPrefixesMatch(t *testing.T) {
+	v := Versioning{
+		Status:           Enabled,
+		ExcludedPrefixes: []ExcludedPrefix{{"*/_temporary/"}},
+	}
+
+	if err := v.Validate(); err != nil {
+		t.Fatalf("Invalid test versioning config %v: %v", v, err)
+	}
+	tests := []struct {
+		prefix   string
+		excluded bool
+	}{
+		{
+			prefix:   "app1-jobs/output/_temporary/attempt1/data.csv",
+			excluded: true,
+		},
+		{
+			prefix:   "app1-jobs/output/final/attempt1/data.csv",
+			excluded: false,
+		},
+	}
+
+	for i, test := range tests {
+		if v.PrefixSuspended(test.prefix) != test.excluded {
+			if test.excluded {
+				t.Fatalf("Test %d: Expected prefix %s to be excluded from versioning", i+1, test.prefix)
+			} else {
+				t.Fatalf("Test %d: Expected prefix %s to have versioning enabled", i+1, test.prefix)
+			}
+		}
+	}
+}