rgw/cksum: GetObject omits checksum headers for Range requests

if we send response headers containing full-object checksums, clients
will compare them with the returned data and fail with:

> botocore.exceptions.FlexibleChecksumError: Expected checksum 4AAr8A== did not match calculated checksum: WbxXZw==

the only thing aws docs[1] say about Range requests refers to multipart
uploads:

> For completed uploads, you can get an individual part's checksum by using the GetObject or HeadObject operations and specifying a part number or byte range that aligns with a single part.

Fixes: https://tracker.ceph.com/issues/69936
[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html#Part-level-checksums

Signed-off-by: Casey Bodley <cbodley@redhat.com>

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index d2ce7ca6afe210f386433e8abdd071294016c7db..1f476b6cc8e971266e42e004256d88aeb1f08121 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -501,7 +501,10 @@ int RGWGetObj_ObjStore_S3::send_response_data(bufferlist& bl, off_t bl_ofs,
       }
     }
 
-    if (checksum_mode) {
+    // omit the stored full-object checksum headers if a Range is requested
+    // TODO: detect when a Range coincides with a single part of a multipart
+    // upload, and return its part checksum?
+    if (checksum_mode && !range_str) {
       if (auto i = attrs.find(RGW_ATTR_CKSUM); i != attrs.end()) {
        try {
          rgw::cksum::Cksum cksum;