If you set encryption in filer, files are not compressed (gzip).

[dmi3x3]

Launched Filer with encryption and sent text files there using:

weed filer.copy -include 2113/*.txt http://localhost:8888/resources/

files not compressed:

> fs.meta.cat /resources/2113/2113871.txt

{
  "name":  "2113871.txt",
  "isDirectory":  false,
  "chunks":  [
    {
      "fileId":  "5,6b50ef11b0c6",
      "offset":  "0",
      "size":  "1298080",
      "modifiedTsNs":  "1712329854578604118",
      "eTag":  "PhWWmz3MG3/NL46Ri/MCFQ==",
      "sourceFileId":  "",
      "fid":  {
        "volumeId":  5,
        "fileKey":  "27472",
        "cookie":  4010913990
      },
      "sourceFid":  null,
      "cipherKey":  "4TuzlaLm9swzweXWvM5zMDqLv3JROTsLIgceXGdp/LM=",
      "isCompressed":  false,
      "isChunkManifest":  false
    }
  ],
  "attributes":  {
    "fileSize":  "1298080",
    "mtime":  "1712329854",
    "fileMode":  530,
    "uid":  1000,
    "gid":  1000,
    "crtime":  "1712329854",
    "mime":  "text/plain; charset=utf-8",
    "ttlSec":  0,
    "userName":  "",
    "groupName":  [],
    "symlinkTarget":  "",
    "md5":  "",
    "rdev":  0,
    "inode":  "0"
  },
  "extended":  {},
  "hardLinkId":  "",
  "hardLinkCounter":  0,
  "content":  "",
  "remoteEntry":  null,
  "quota":  "0"
}chunks 1 meta size: 172 gzip:200

I had a question, in what order are the files compressed, before encryption or after?
checked in my console, order matters:

Compressed files:

user@comp:~/seaweedfs_vol/filer/aes$ gzip -c did26188.txt > did26188.txt.gz
user@comp:~/seaweedfs_vol/filer/aes$ gzip -c did7903.txt > did7903.txt.gz

user@comp:~/seaweedfs_vol/filer/aes$ ls -lh
итого 12M
-rw-rw-r-- 1 user user 3,3M апр 23 16:12 did26188.txt
-rw-rw-r-- 1 user user 673K апр 23 16:14 did26188.txt.gz
-rw-rw-r-- 1 user user 5,6M апр 23 16:12 did7903.txt
-rw-rw-r-- 1 user user 1,7M апр 23 16:14 did7903.txt.gz

Encrypted uncompressed and compressed files:

user@comp:~/seaweedfs_vol/filer/aes$ openssl aes-256-cbc -in did26188.txt -out did26188.txt.enc
enter AES-256-CBC encryption password:
user@comp:~/seaweedfs_vol/filer/aes$ openssl aes-256-cbc -in did7903.txt -out did7903.txt.enc
enter AES-256-CBC encryption password:

user@comp:~/seaweedfs_vol/filer/aes$ openssl aes-256-cbc -in did7903.txt.gz -out did7903.txt.gz.enc
enter AES-256-CBC encryption password:
user@comp:~/seaweedfs_vol/filer/aes$ openssl aes-256-cbc -in did26188.txt.gz -out did26188.txt.gz.enc
enter AES-256-CBC encryption password:

Compressed encrypted files:

user@comp:~/seaweedfs_vol/filer/aes$ gzip -c did26188.txt.enc > did26188.txt.enc.gz
user@comp:~/seaweedfs_vol/filer/aes$ gzip -c did7903.txt.enc > did7903.txt.enc.gz

We check the result:

user@comp:~/seaweedfs_vol/filer/aes$ ls -lh
итого 32M
-rw-rw-r-- 1 user user 3,3M apr 23 16:12 did26188.txt
-rw-rw-r-- 1 user user 3,3M apr 23 16:16 did26188.txt.enc
-rw-rw-r-- 1 user user 3,3M apr 23 16:18 did26188.txt.enc.gz
-rw-rw-r-- 1 user user 673K apr 23 16:14 did26188.txt.gz
-rw-rw-r-- 1 user user 673K apr 23 16:18 did26188.txt.gz.enc
-rw-rw-r-- 1 user user 5,6M apr 23 16:12 did7903.txt
-rw-rw-r-- 1 user user 5,6M apr 23 16:17 did7903.txt.enc
-rw-rw-r-- 1 user user 5,6M apr 23 16:19 did7903.txt.enc.gz
-rw-rw-r-- 1 user user 1,7M apr 23 16:14 did7903.txt.gz
-rw-rw-r-- 1 user user 1,7M apr 23 16:17 did7903.txt.gz.enc

The size of encrypted and then compressed files has not changed:

3,3M apr 23 16:18 did26188.txt.enc.gz
5,6M apr 23 16:19 did7903.txt.enc.gz

The size of compressed and then encrypted files has become smaller:

673K apr 23 16:18 did26188.txt.gz.enc
1,7M apr 23 16:17 did7903.txt.gz.enc

[dmi3x3]

I tried to see the sources. As far as I understand, there is a condition when uploading files from filer to volume server:
or the file is compressed or encrypted.

        if shouldGzipNow && !option.Cipher {
                compressed, compressErr := util.GzipData(data)
                // fmt.Printf("data is compressed from %d ==> %d\n", len(data), len(compressed))
                if compressErr == nil {
                        data = compressed
                        contentIsGzipped = true
                }
        } else if option.IsInputCompressed {
                // just to get the clear data length
                clearData, err = util.DecompressData(data)
                if err == nil {
                        clearDataLen = len(clearData)
                }
        }

        if option.Cipher {
                // encrypt(gzip(data))

                // encrypt
                cipherKey := util.GenCipherKey()
                encryptedData, encryptionErr := util.Encrypt(clearData, cipherKey)

sed -n '177,278p' ./weed/operation/upload_content.go 

func doUploadData

func doUploadData(data []byte, option *UploadOption) (uploadResult *UploadResult, err error) {
	contentIsGzipped := option.IsInputCompressed
	shouldGzipNow := false
	if !option.IsInputCompressed {
		if option.MimeType == "" {
			option.MimeType = http.DetectContentType(data)
			// println("detect1 mimetype to", MimeType)
			if option.MimeType == "application/octet-stream" {
				option.MimeType = ""
			}
		}
		if shouldBeCompressed, iAmSure := util.IsCompressableFileType(filepath.Base(option.Filename), option.MimeType); iAmSure && shouldBeCompressed {
			shouldGzipNow = true
		} else if !iAmSure && option.MimeType == "" && len(data) > 16*1024 {
			var compressed []byte
			compressed, err = util.GzipData(data[0:128])
			if err != nil {
				return
			}
			shouldGzipNow = len(compressed)*10 < 128*9 // can not compress to less than 90%
		}
	}

	var clearDataLen int

	// gzip if possible
	// this could be double copying
	clearDataLen = len(data)
	clearData := data
	if shouldGzipNow && !option.Cipher {
		compressed, compressErr := util.GzipData(data)
		// fmt.Printf("data is compressed from %d ==> %d\n", len(data), len(compressed))
		if compressErr == nil {
			data = compressed
			contentIsGzipped = true
		}
	} else if option.IsInputCompressed {
		// just to get the clear data length
		clearData, err = util.DecompressData(data)
		if err == nil {
			clearDataLen = len(clearData)
		}
	}

	if option.Cipher {
		// encrypt(gzip(data))

		// encrypt
		cipherKey := util.GenCipherKey()
		encryptedData, encryptionErr := util.Encrypt(clearData, cipherKey)
		if encryptionErr != nil {
			err = fmt.Errorf("encrypt input: %v", encryptionErr)
			return
		}

		// upload data
		uploadResult, err = upload_content(func(w io.Writer) (err error) {
			_, err = w.Write(encryptedData)
			return
		}, len(encryptedData), &UploadOption{
			UploadUrl:         option.UploadUrl,
			Filename:          "",
			Cipher:            false,
			IsInputCompressed: false,
			MimeType:          "",
			PairMap:           nil,
			Jwt:               option.Jwt,
		})
		if uploadResult == nil {
			return
		}
		uploadResult.Name = option.Filename
		uploadResult.Mime = option.MimeType
		uploadResult.CipherKey = cipherKey
		uploadResult.Size = uint32(clearDataLen)
	} else {
		// upload data
		uploadResult, err = upload_content(func(w io.Writer) (err error) {
			_, err = w.Write(data)
			return
		}, len(data), &UploadOption{
			UploadUrl:         option.UploadUrl,
			Filename:          option.Filename,
			Cipher:            false,
			IsInputCompressed: contentIsGzipped,
			MimeType:          option.MimeType,
			PairMap:           option.PairMap,
			Jwt:               option.Jwt,
			Md5:               option.Md5,
			BytesBuffer:       option.BytesBuffer,
		})
		if uploadResult == nil {
			return
		}
		uploadResult.Size = uint32(clearDataLen)
		if contentIsGzipped {
			uploadResult.Gzip = 1
		}
	}

	return uploadResult, err
}

1. Why can't you first compress the file and then encrypt it?
2. Perhaps this is due to a decrease in security?
   Found information about two options for attacking encrypted compressed data CRIME and BREACH, but in seaweedfs they cannot be applied, because it will not be possible to encrypt the same volume server file several times, with different options to explore it.

[chrislusf]

gzip and then encrypt should be possible. But not sure how to migrate to this without affecting existing files.

[dmi3x3]

Thank you.
Could you tell me what places in the code need to be changed to add compression before encryption?