CLDSRV-872: test checksums are respected in backbeat routes

Author: leif-scality

lib/routes/routeBackbeat.js

@@ -447,7 +447,14 @@ function putData(request, response, bucketInfo, objMd, log, callback) {
         }
         return dataStore(
             context, cipherBundle, request, payloadLen, {},
-            backendInfo, log, (err, retrievalInfo, md5) => {
+            backendInfo, log,
+            // The callback's 4th arg (checksum) is intentionally ignored: any
+            // x-amz-checksum-* header sent by Backbeat is already validated
+            // inside dataStore by ChecksumTransform. The computed value is not
+            // stored here because this is a data-only write — metadata is
+            // written separately by Backbeat, which should propagate the source
+            // object's checksum.
+            (err, retrievalInfo, md5) => {
                 if (err) {
                     log.error('error putting data', {
                         error: err,
@@ -853,6 +860,12 @@ function putObject(request, response, log, callback) {
     const payloadLen = parseInt(request.headers['content-length'], 10);
     const backendInfo = new BackendInfo(config, storageLocation);
     return dataStore(context, CIPHER, request, payloadLen, {}, backendInfo, log,
+        // The callback's 4th arg (checksum) is intentionally ignored: any
+        // x-amz-checksum-* header sent by Backbeat is already validated inside
+        // dataStore by ChecksumTransform. The computed value is not stored here
+        // because this is a data-only write to an external backend — metadata
+        // is managed separately by Backbeat, which should propagate the source
+        // object's checksum.
         (err, retrievalInfo, md5) => {
             if (err) {
                 log.error('error putting data', {

tests/multipleBackend/routes/routeBackbeat.js

@@ -3642,4 +3642,107 @@ describe('backbeat routes', () => {
             ], done);
         });
     });
+
+    describe('checksum validation', () => {
+        const testDataSha256B64 = crypto.createHash('sha256')
+            .update(testData, 'utf-8').digest('base64');
+        // A valid-length but wrong sha256 digest (44 base64 chars).
+        const wrongSha256B64 = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
+
+        describe('putData', () => {
+            it('should return 400 BadDigest when x-amz-checksum-sha256 does not match body', done => {
+                makeBackbeatRequest({
+                    method: 'PUT',
+                    resourceType: 'data',
+                    bucket: TEST_BUCKET,
+                    objectKey: TEST_KEY,
+                    headers: {
+                        'x-scal-canonical-id': testMd['owner-id'],
+                        'content-md5': testDataMd5,
+                        'content-length': testData.length,
+                        'x-amz-checksum-sha256': wrongSha256B64,
+                    },
+                    requestBody: testData,
+                    authCredentials: backbeatAuthCredentials,
+                }, err => {
+                    assert(err, 'expected an error response');
+                    assert.strictEqual(err.statusCode, 400);
+                    assert.strictEqual(err.code, 'BadDigest');
+                    done();
+                });
+            });
+
+            it('should return 200 when x-amz-checksum-sha256 matches body', done => {
+                makeBackbeatRequest({
+                    method: 'PUT',
+                    resourceType: 'data',
+                    bucket: TEST_BUCKET,
+                    objectKey: TEST_KEY,
+                    headers: {
+                        'x-scal-canonical-id': testMd['owner-id'],
+                        'content-md5': testDataMd5,
+                        'content-length': testData.length,
+                        'x-amz-checksum-sha256': testDataSha256B64,
+                    },
+                    requestBody: testData,
+                    authCredentials: backbeatAuthCredentials,
+                }, (err, data) => {
+                    assert.ifError(err);
+                    assert.strictEqual(data.statusCode, 200);
+                    done();
+                });
+            });
+        });
+
+        describe('putObject (multiplebackenddata)', () => {
+            itIfLocationAws('should return 400 BadDigest when x-amz-checksum-sha256 does not match body', done => {
+                makeBackbeatRequest({
+                    method: 'PUT',
+                    resourceType: 'multiplebackenddata',
+                    bucket: TEST_BUCKET,
+                    objectKey: TEST_KEY,
+                    queryObj: { operation: 'putobject' },
+                    headers: {
+                        'x-scal-canonical-id': testMd['owner-id'],
+                        'x-scal-storage-type': 'aws_s3',
+                        'x-scal-storage-class': awsLocation,
+                        'content-md5': testDataMd5,
+                        'content-length': testData.length,
+                        'x-amz-checksum-sha256': wrongSha256B64,
+                    },
+                    requestBody: testData,
+                    authCredentials: backbeatAuthCredentials,
+                }, err => {
+                    assert(err, 'expected an error response');
+                    assert.strictEqual(err.statusCode, 400);
+                    assert.strictEqual(err.code, 'BadDigest');
+                    done();
+                });
+            });
+
+            itIfLocationAws('should return 200 when x-amz-checksum-sha256 matches body', done => {
+                makeBackbeatRequest({
+                    method: 'PUT',
+                    resourceType: 'multiplebackenddata',
+                    bucket: TEST_BUCKET,
+                    objectKey: TEST_KEY,
+                    queryObj: { operation: 'putobject' },
+                    headers: {
+                        'x-scal-canonical-id': testMd['owner-id'],
+                        'x-scal-storage-type': 'aws_s3',
+                        'x-scal-storage-class': awsLocation,
+                        'content-md5': testDataMd5,
+                        'content-length': testData.length,
+                        'x-amz-checksum-sha256': testDataSha256B64,
+                    },
+                    requestBody: testData,
+                    authCredentials: backbeatAuthCredentials,
+                }, (err, data) => {
+                    assert.ifError(err);
+                    assert.strictEqual(data.statusCode, 200);
+                    done();
+                });
+            });
+        });
+    });
 });