From 53098baf693353f65e19c8958ca2408b82b2b7a3 Mon Sep 17 00:00:00 2001 From: Casey Bodley Date: Wed, 19 Feb 2025 10:13:04 -0500 Subject: [PATCH] rgw/cksum: GetObject omits checksum headers for Range requests if we send response headers containing full-object checksums, clients will compare them with the returned data and fail with: > botocore.exceptions.FlexibleChecksumError: Expected checksum 4AAr8A== did not match calculated checksum: WbxXZw== the only thing aws docs[1] say about Range requests refers to multipart uploads: > For completed uploads, you can get an individual part's checksum by using the GetObject or HeadObject operations and specifying a part number or byte range that aligns with a single part. Fixes: https://tracker.ceph.com/issues/69936 [1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html#Part-level-checksums Signed-off-by: Casey Bodley --- src/rgw/rgw_rest_s3.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc index d2ce7ca6afe21..1f476b6cc8e97 100644 --- a/src/rgw/rgw_rest_s3.cc +++ b/src/rgw/rgw_rest_s3.cc @@ -501,7 +501,10 @@ int RGWGetObj_ObjStore_S3::send_response_data(bufferlist& bl, off_t bl_ofs, } } - if (checksum_mode) { + // omit the stored full-object checksum headers if a Range is requested + // TODO: detect when a Range coincides with a single part of a multipart + // upload, and return its part checksum? + if (checksum_mode && !range_str) { if (auto i = attrs.find(RGW_ATTR_CKSUM); i != attrs.end()) { try { rgw::cksum::Cksum cksum; -- 2.39.5