Reject overly-taxing ranged-GET requests

[OpenStack Infra]

https://review.openstack.org/117579
commit 4d23a0fcf5faa6339a1a58fcbdab8687a6c88feb
Author: Samuel Merritt <email address hidden>
Date: Thu Aug 28 09:39:38 2014 -0800

    Reject overly-taxing ranged-GET requests

    RFC 7233 says that servers MAY reject egregious range-GET requests
    such as requests with hundreds of ranges, requests with non-ascending
    ranges, and so on.

    Such requests are fairly hard for Swift to process. Consider a Range
    header that asks for the first byte of every 10th MiB in a 4 GiB
    object, but in some random order. That'll cause a lot of seeks on the
    object server, but the corresponding response body is quite small in
    comparison to the workload.

    This commit makes Swift reject, with a 416 response, any ranged GET
    request with more than fifty ranges, more than three overlapping
    ranges, or more than eight non-increasing ranges.

    This is a necessary prerequisite for supporting multi-range GETs on
    large objects. Otherwise, a malicious user could construct a Range
    header with hundreds of byte ranges where each individual byterange
    requires the proxy to contact a different object server. If seeking
    all over a disk is bad, connecting all over the cluster is way worse.

    DocImpact

    Change-Id: I4dcedcaae6c3deada06a0223479e611094d57234

[Atsushi SAKAI (sakaia)]

This seems "Range" issue.
And this is not a problem for usual case.
The problematic case is overlapping the range (to attack data transfer)
So I think it is no need to write down.
If it still needs description, it needs to write Note on Range.
http://developer.openstack.org/api-ref-objectstorage-v1.html#getObject

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/262871

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/262871
Committed: https://git.openstack.org/cgit/openstack/api-site/commit/?id=40c0e291b5af2a6083e3a54df15413ae03e16342
Submitter: Jenkins
Branch: master

commit 40c0e291b5af2a6083e3a54df15413ae03e16342
Author: Diane Fleming <email address hidden>
Date: Fri Jan 1 11:43:16 2016 -0600

    Add note about 416 return code for overtaxed ranged GET requests

    Change-Id: I4eda8f1c22ba12863340f8050ecb18d9ce04cd13
    Closes-Bug: #1373732