From: Casey Bodley <cbodley@redhat.com>
Date: Wed, 19 Feb 2025 15:13:04 +0000 (-0500)
Subject: rgw/cksum: GetObject omits checksum headers for Range requests
X-Git-Tag: v20.0.0~15^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F61901%2Fhead;p=ceph.git

rgw/cksum: GetObject omits checksum headers for Range requests

if we send response headers containing full-object checksums, clients
will compare them with the returned data and fail with:

> botocore.exceptions.FlexibleChecksumError: Expected checksum 4AAr8A== did not match calculated checksum: WbxXZw==

the only thing aws docs[1] say about Range requests refers to multipart
uploads:

> For completed uploads, you can get an individual part's checksum by using the GetObject or HeadObject operations and specifying a part number or byte range that aligns with a single part.

Fixes: https://tracker.ceph.com/issues/69936

[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html#Part-level-checksums

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index d2ce7ca6afe21..1f476b6cc8e97 100644
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -501,7 +501,10 @@ int RGWGetObj_ObjStore_S3::send_response_data(bufferlist& bl, off_t bl_ofs,
       }
     }
 
-    if (checksum_mode) {
+    // omit the stored full-object checksum headers if a Range is requested
+    // TODO: detect when a Range coincides with a single part of a multipart
+    // upload, and return its part checksum?
+    if (checksum_mode && !range_str) {
       if (auto i = attrs.find(RGW_ATTR_CKSUM); i != attrs.end()) {
 	try {
 	  rgw::cksum::Cksum cksum;