From 8be212d38adf19dc18bdae7c560d001d82fc44d8 Mon Sep 17 00:00:00 2001 From: Casey Bodley Date: Wed, 28 Jun 2023 14:43:55 -0400 Subject: [PATCH] rgw: fetch_remote_obj() will never verify etags of encrypted objects fetch_remote_obj() transfers objects in their encrypted form, so does not have access to the decrypted data for checksum verification Signed-off-by: Casey Bodley (cherry picked from commit ea45da747d5fa898b4aa4ec9223cd7b6983ca177) --- src/rgw/driver/rados/rgw_rados.cc | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/src/rgw/driver/rados/rgw_rados.cc b/src/rgw/driver/rados/rgw_rados.cc index 9e2cfe67794..caf6e70bf17 100644 --- a/src/rgw/driver/rados/rgw_rados.cc +++ b/src/rgw/driver/rados/rgw_rados.cc @@ -3377,6 +3377,7 @@ public: int process_attrs(void) { + bool encrypted = false; if (extra_data_bl.length()) { JSONParser jp; if (!jp.parse(extra_data_bl.c_str(), extra_data_bl.length())) { @@ -3386,6 +3387,12 @@ public: JSONDecoder::decode_json("attrs", src_attrs, &jp); + encrypted = src_attrs.count(RGW_ATTR_CRYPT_MODE); + if (encrypted) { + // we won't have access to the decrypted data for checksumming + try_etag_verify = false; + } + auto iter = src_attrs.find(RGW_ATTR_COMPRESSION); if (iter != src_attrs.end()) { const bufferlist bl = std::move(iter->second); @@ -3428,8 +3435,8 @@ public: return ret; } - if (plugin && src_attrs.find(RGW_ATTR_CRYPT_MODE) == src_attrs.end()) { - //do not compress if object is encrypted + // do not compress if object is encrypted + if (plugin && !encrypted) { compressor = boost::in_place(cct, plugin, filter); // add a filter that buffers data so we don't try to compress tiny blocks. // libcurl reads in 16k at a time, and we need at least 64k to get a good @@ -3439,12 +3446,7 @@ public: filter = &*buffering; } - /* - * Presently we don't support ETag based verification if encryption is - * requested. We can enable simultaneous support once we have a mechanism - * to know the sequence in which the filters must be applied. - */ - if (try_etag_verify && src_attrs.find(RGW_ATTR_CRYPT_MODE) == src_attrs.end()) { + if (try_etag_verify) { ret = rgw::putobj::create_etag_verifier(dpp, cct, filter, manifest_bl, compression_info, etag_verifier); -- 2.39.5