CLDSRV-872: handle empty object checksum

Author: leif-scality

lib/api/apiUtils/object/createAndStoreObject.js

@@ -14,11 +14,49 @@ const { config } = require('../../../Config');
 const validateWebsiteHeader = require('./websiteServing')
     .validateWebsiteHeader;
 const applyZenkoUserMD = require('./applyZenkoUserMD');
+const {
+    algorithms,
+    getChecksumDataFromHeaders,
+    arsenalErrorFromChecksumError,
+} = require('../integrity/validateChecksums');
 
 const { externalBackends, versioningNotImplBackends } = constants;
 
 const externalVersioningErrorMessage = 'We do not currently support putting ' +
-'a versioned object to a location-constraint of type Azure or GCP.';
+    'a versioned object to a location-constraint of type Azure or GCP.';
+
+/**
+ * Validate and compute the checksum for a zero-size object body.
+ * Parses the checksum headers, validates the client-supplied digest against
+ * the empty-body hash, sets metadataStoreParams.checksum on success, and
+ * calls back with an error on mismatch or invalid headers.
+ *
+ * @param {object} headers - request headers
+ * @param {object} metadataStoreParams - metadata params (checksum field set in-place)
+ * @param {function} callback - (err) callback
+ * @return {undefined}
+ */
+function zeroSizeBodyChecksumCheck(headers, metadataStoreParams, callback) {
+    const checksumData = getChecksumDataFromHeaders(headers);
+    if (checksumData.error) {
+        return callback(arsenalErrorFromChecksumError(checksumData));
+    }
+    // For trailer format with zero decoded bytes, the trailer in the body is
+    // never read (stream bypassed), so expected is always undefined here.
+    // We still compute and store the empty-body hash for the announced algorithm.
+    const { algorithm, expected } = checksumData;
+    return Promise.resolve(algorithms[algorithm].digest(Buffer.alloc(0)))
+        .then(value => {
+            if (expected !== undefined && expected !== value) {
+                return callback(errorInstances.BadDigest.customizeDescription(
+                    `The ${algorithm.toUpperCase()} you specified did not match the calculated checksum.`
+                ));
+            }
+            // eslint-disable-next-line no-param-reassign
+            metadataStoreParams.checksum = { algorithm, value, type: 'FULL_OBJECT' };
+            return callback(null);
+        }, err => callback(err));
+}
 
 function _storeInMDandDeleteData(bucketName, dataGetInfo, cipherBundle,
     metadataStoreParams, dataToDelete, log, requestMethod, callback) {
@@ -217,7 +255,13 @@ function createAndStoreObject(bucketName, bucketMD, objectKey, objMD, authInfo,
             if (size === 0) {
                 if (!dontSkipBackend[locationType]) {
                     metadataStoreParams.contentMD5 = constants.emptyFileMd5;
-                    return next(null, null, null, null);
+                    // Delete markers are zero-byte versioned tombstones with
+                    // no body, ETag, or checksum — skip checksum handling.
+                    if (isDeleteMarker) {
+                        return next(null, null, null, null);
+                    }
+                    return zeroSizeBodyChecksumCheck(request.headers, metadataStoreParams,
+                        err => next(err, null, null, null));
                 }
 
                 // Handle mdOnlyHeader as a metadata only operation. If
@@ -264,7 +308,8 @@ function createAndStoreObject(bucketName, bucketMD, objectKey, objMD, authInfo,
                       : `1:${calculatedHash}`;
             const dataGetInfoArr = [{ key, size, start: 0, dataStoreName,
                 dataStoreType, dataStoreETag: prefixedDataStoreETag,
-                dataStoreVersionId }];
+                dataStoreVersionId
+            }];
             if (cipherBundle) {
                 dataGetInfoArr[0].cryptoScheme = cipherBundle.cryptoScheme;
                 dataGetInfoArr[0].cipheredDataKey =

tests/functional/raw-node/test/checksumPutObjectUploadPart.js

@@ -759,11 +759,11 @@ describe('PutObject: checksum response header per algorithm', () => {
     });
 
     const checksumAlgos = [
-        { name: 'crc32',     computeExpected: () => algorithms.crc32.digest(body) },
-        { name: 'crc32c',    computeExpected: () => algorithms.crc32c.digest(body) },
+        { name: 'crc32', computeExpected: () => algorithms.crc32.digest(body) },
+        { name: 'crc32c', computeExpected: () => algorithms.crc32c.digest(body) },
         { name: 'crc64nvme', computeExpected: () => expectedCrc64nvme },
-        { name: 'sha1',      computeExpected: () => algorithms.sha1.digest(body) },
-        { name: 'sha256',    computeExpected: () => algorithms.sha256.digest(body) },
+        { name: 'sha1', computeExpected: () => algorithms.sha1.digest(body) },
+        { name: 'sha256', computeExpected: () => algorithms.sha256.digest(body) },
     ];
 
     for (const algo of checksumAlgos) {