fix: content-md5 header should be removed as it's altered by the proxy

Author: LeSim

src/http/handlers/forward.rs

@@ -12,11 +12,14 @@ use std::time::Duration;
 
 const UPLOAD_TIMEOUT: Duration = Duration::from_secs(60 * 60);
 
-static FORWARD_REQUEST_HEADERS_TO_REMOVE: [header::HeaderName; 4] = [
+static FORWARD_REQUEST_HEADERS_TO_REMOVE: [header::HeaderName; 5] = [
     // Connection settings (keepalived) must not be resend
     header::CONNECTION,
     // Encryption changes the length of the content
     header::CONTENT_LENGTH,
+    // The Content-MD5 sent by the client is the checksum of the cleartext
+    // data, it does not match the encrypted body forwarded to the storage
+    header::HeaderName::from_static("content-md5"),
     // Openstack checks the ETAG header as a md5 checksum of the data
     // the encryption change the data and thus the etag
     header::ETAG,

tests/helpers/curl.rs

@@ -26,6 +26,10 @@ pub fn curl_put(file_path: &str, url: &str) -> Output {
         .arg(url)
         .arg("--data-binary")
         .arg(format!("@{}", file_path))
+        // checksum of the cleartext data, it must be removed by the proxy
+        // as the encrypted body no longer matches it
+        .arg("-H")
+        .arg("Content-MD5: Q2hlY2tJbnRlZ3JpdHk=")
         .arg("--dump-header")
         .arg(RETURNED_HEADER)
         .output()

tests/upload_and_download.rs

@@ -36,6 +36,7 @@ fn upload_and_download() {
     );
     assert!(node_received_header("x-amz-date").is_some());
     assert!(node_received_header("authorization").is_some());
+    assert!(node_received_header("content-md5").is_none());
 
     let uploaded_bytes = std::fs::read(uploaded_path).expect("uploaded should exist !");
     assert_eq!(&uploaded_bytes[0..PREFIX_SIZE], PREFIX);