rgw: Policies now properly evaluate the X-Forwarded-For header.

Signed-off-by: John Gibson <jgibson@mitre.org>
(cherry picked from commit 5f7d9c4ff6c78f65d074dbdf8a181cb9ae09851e)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 4127d3254d4e8de212945a2281e9a74bc47a6555..65dd6db318433b6dc9a6ce36aafcda3631c487d5 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -610,7 +610,16 @@ rgw::IAM::Environment rgw_build_iam_environment(RGWRados* store,
     i = m.find("REMOTE_ADDR");
   }
   if (i != m.end()) {
-    e.emplace("aws:SourceIp", i->second);
+    const string* ip = &(i->second);
+    string temp;
+    if (remote_addr_param == "HTTP_X_FORWARDED_FOR") {
+      const auto comma = ip->find(',');
+      if (comma != string::npos) {
+       temp.assign(*ip, 0, comma);
+       ip = &temp;
+      }
+    }
+    e.emplace("aws:SourceIp", *ip);
   }
 
   i = m.find("HTTP_USER_AGENT"); {