]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
rgw/iam: match value of Null condition 67188/head
authorCasey Bodley <cbodley@redhat.com>
Tue, 3 Feb 2026 16:44:45 +0000 (11:44 -0500)
committerCasey Bodley <cbodley@redhat.com>
Tue, 3 Feb 2026 18:39:11 +0000 (13:39 -0500)
commit1d0c8c286ccb39ca1afd809dec7669001853e4b2
tree6d798a630d6c3a338c17706904c0deca6f60d373
parentd40ccd10f7bfb1919c07e7acdd7ad25a22abdd50
rgw/iam: match value of Null condition

quoting https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Null:
> Use a Null condition operator to check if a condition key is absent at the time of authorization. In the policy statement, use either true (the key doesn't exist — it is null) or false (the key exists and its value is not null).

previously, this check acted as if it was always given a value of
"true". instead, convert this decision to a "true"/"false" string
and use `typed_any()` to match that against the parsed `vals`

`runtime_vals` are ignored here because the same document says:
> You can not use a policy variable with the Null condition operator.

Fixes: https://tracker.ceph.com/issues/74736
Signed-off-by: Casey Bodley <cbodley@redhat.com>
src/rgw/rgw_iam_policy.cc
src/test/rgw/test_rgw_iam_policy.cc