rich7420 opened a new pull request, #11222: URL: https://github.com/apache/ozone/pull/11222
## What changes were proposed in this pull request? S3 Gateway currently accepts `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER` uploads without verifying their signatures. Extend the existing chunk verification to authenticate the final zero-byte chunk and checksum trailer before committing the key or multipart part. Validate the declared checksum header and trailer framing, including the final CRLF. This verifies the trailer signature; checksum calculation and storage are unchanged. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-15142 ## How was this patch tested? - 140 unit/endpoint tests passed, covering AWS signature vectors, malformed trailers, and valid/tampered PUT, multipart and datastream uploads. - Verified compatibility with bodies produced by the AWS SDK v2.54.2 chunk encoder. - Checkstyle passed. [Fork CI passed](https://github.com/rich7420/ozone/actions/runs/34317896799). Generated-by: Codex (GPT-6) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
