rgw: Policies now properly evaluate the X-Forwarded-For header.

Signed-off-by: John Gibson <jgibson@mitre.org>

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index edae45f2848d105d848101ea29aa810d1dc2ad27..2bbc74e9c672011c3407cf248f597a0cda5f2aa5 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -607,7 +607,16 @@ rgw::IAM::Environment rgw_build_iam_environment(RGWRados* store,
     i = m.find("REMOTE_ADDR");
   }
   if (i != m.end()) {
-    e.emplace("aws:SourceIp", i->second);
+    const string* ip = &(i->second);
+    string temp;
+    if (remote_addr_param == "HTTP_X_FORWARDED_FOR") {
+      const auto comma = ip->find(',');
+      if (comma != string::npos) {
+       temp.assign(*ip, 0, comma);
+       ip = &temp;
+      }
+    }
+    e.emplace("aws:SourceIp", *ip);
   }
 
   i = m.find("HTTP_USER_AGENT"); {