rgw/sts: code for aws:TagKeys to be used as Condition

element of a role's trust and permission policy.

This also includes implementation of ForAnyValue and
ForAllValues to be used in conjunction with
StringLike, StringEquals and StringEqualsIgnoreCase
which are used alongwith aws:TagKeys.

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>

diff --git a/src/rgw/rgw_auth.cc b/src/rgw/rgw_auth.cc
index af23c23d71c9cd7aac5a30b84b037b3e48d4eece..ea4f9ffd2e7723bb258b402fb839e8990a83b1a2 100644 (file)
--- a/src/rgw/rgw_auth.cc
+++ b/src/rgw/rgw_auth.cc
@@ -473,6 +473,9 @@ void rgw::auth::WebIdentityApplier::modify_request_state(const DoutPrefixProvide
       s->env.emplace(e_key, val);
       ldpp_dout(dpp, 10) << "RGW Env Tag Key: " << e_key << " Value: " << val << dendl;
 
+      s->env.emplace("aws:TagKeys", key);
+        ldpp_dout(dpp, 10) << "aws:TagKeys: " << key << dendl;
+
       if (s->principal_tags.size() == 50) {
         ldpp_dout(dpp, 0) << "ERROR: Number of tag/value pairs exceeding 50, hence skipping the rest" << dendl;
         break;
@@ -867,6 +870,11 @@ void rgw::auth::RoleApplier::modify_request_state(const DoutPrefixProvider *dpp,
 
   for (auto& m : token_attrs.principal_tags) {
     s->env.emplace(m.first, m.second);
+    ldpp_dout(dpp, 10) << "Principal Tag Key: " << m.first << " Value: " << m.second << dendl;
+    std::size_t pos = m.first.find('/');
+    string key = m.first.substr(pos + 1);
+    s->env.emplace("aws:TagKeys", key);
+    ldpp_dout(dpp, 10) << "aws:TagKeys: " << key << dendl;
   }
 
   s->token_claims.emplace_back("sts");

diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc
index f91a349aee7c4e1aa01fb4e290d0e68a8411eccc..8fe9d3a64ccac8e096bf2e419c4139c1e1667cda 100644 (file)
--- a/src/rgw/rgw_iam_policy.cc
+++ b/src/rgw/rgw_iam_policy.cc
@@ -682,7 +682,13 @@ bool Condition::eval(const Environment& env) const {
   }
 
   if (i == env.end()) {
-    return ifexists;
+    if (op == TokenID::ForAllValuesStringEquals ||
+        op == TokenID::ForAllValuesStringEqualsIgnoreCase ||
+        op == TokenID::ForAllValuesStringLike) {
+      return true;
+    } else {
+      return ifexists;
+    }
   }
   const auto& s = i->second;
 
@@ -690,6 +696,7 @@ bool Condition::eval(const Environment& env) const {
 
   switch (op) {
     // String!
+  case TokenID::ForAnyValueStringEquals:
   case TokenID::StringEquals:
     return orrible(std::equal_to<std::string>(), itr, vals);
 
@@ -697,18 +704,29 @@ bool Condition::eval(const Environment& env) const {
     return orrible(std::not_fn(std::equal_to<std::string>()),
                   itr, vals);
 
+  case TokenID::ForAnyValueStringEqualsIgnoreCase:
   case TokenID::StringEqualsIgnoreCase:
     return orrible(ci_equal_to(), itr, vals);
 
   case TokenID::StringNotEqualsIgnoreCase:
     return orrible(std::not_fn(ci_equal_to()), itr, vals);
 
+  case TokenID::ForAnyValueStringLike:
   case TokenID::StringLike:
     return orrible(string_like(), itr, vals);
 
   case TokenID::StringNotLike:
     return orrible(std::not_fn(string_like()), itr, vals);
 
+  case TokenID::ForAllValuesStringEquals:
+    return andible(std::equal_to<std::string>(), itr, vals);
+
+  case TokenID::ForAllValuesStringLike:
+    return andible(string_like(), itr, vals);
+
+  case TokenID::ForAllValuesStringEqualsIgnoreCase:
+    return andible(ci_equal_to(), itr, vals);
+
     // Numeric
   case TokenID::NumericEquals:
     return shortible(std::equal_to<double>(), as_number, s, vals);

diff --git a/src/rgw/rgw_iam_policy.h b/src/rgw/rgw_iam_policy.h
index 84dce04cf24728771b3a0be5d8c3835d20c2f515..4a0f8f3b30f4285b8efc26a3fef032766a067313 100644 (file)
--- a/src/rgw/rgw_iam_policy.h
+++ b/src/rgw/rgw_iam_policy.h
@@ -391,6 +391,23 @@ struct Condition {
   };
 
   using unordered_multimap_it_pair = std::pair <std::unordered_multimap<std::string,std::string>::const_iterator, std::unordered_multimap<std::string,std::string>::const_iterator>;
+
+  template<typename F>
+  static bool andible(F&& f, const unordered_multimap_it_pair& it,
+                     const std::vector<std::string>& v) {
+    for (auto itr = it.first; itr != it.second; itr++) {
+      bool matched = false;
+      for (const auto& d : v) {
+        if (std::forward<F>(f)(itr->second, d)) {
+               matched = true;
+      }
+     }
+     if (!matched)
+      return false;
+    }
+    return true;
+  }
+
   template<typename F>
   static bool orrible(F&& f, const unordered_multimap_it_pair& it,
                      const std::vector<std::string>& v) {

diff --git a/src/rgw/rgw_iam_policy_keywords.gperf b/src/rgw/rgw_iam_policy_keywords.gperf
index 4f6f22a9b73a7ffd01a71b68da7ed31668ee9151..af73dd130749a0807b3e8d5ff0639db5137f1b5b 100644 (file)
--- a/src/rgw/rgw_iam_policy_keywords.gperf
+++ b/src/rgw/rgw_iam_policy_keywords.gperf
@@ -41,6 +41,12 @@ StringEqualsIgnoreCase, TokenKind::cond_op, TokenID::StringEqualsIgnoreCase, (ui
 StringNotEqualsIgnoreCase, TokenKind::cond_op, TokenID::StringNotEqualsIgnoreCase, (uint64_t) Type::string, true, true
 StringLike, TokenKind::cond_op, TokenID::StringLike, (uint64_t) Type::string, true, true,
 StringNotLike, TokenKind::cond_op, TokenID::StringNotLike, (uint64_t) Type::string, true, true
+ForAllValues:StringEquals, TokenKind::cond_op, TokenID::ForAllValuesStringEquals, (uint64_t) Type::string, true, true
+ForAnyValue:StringEquals, TokenKind::cond_op, TokenID::ForAnyValueStringEquals, (uint64_t) Type::string, true, true
+ForAllValues:StringLike, TokenKind::cond_op, TokenID::ForAllValuesStringLike, (uint64_t) Type::string, true, true
+ForAnyValue:StringLike, TokenKind::cond_op, TokenID::ForAnyValueStringLike, (uint64_t) Type::string, true, true
+ForAllValues:StringEqualsIgnoreCase, TokenKind::cond_op, TokenID::ForAllValuesStringEqualsIgnoreCase, (uint64_t) Type::string, true, true
+ForAnyValue:StringEqualsIgnoreCase, TokenKind::cond_op, TokenID::ForAnyValueStringEqualsIgnoreCase, (uint64_t) Type::string, true, true
 # Numeric
 NumericEquals, TokenKind::cond_op, TokenID::NumericEquals, (uint64_t) Type::number, true, true
 NumericNotEquals, TokenKind::cond_op, TokenID::NumericNotEquals, (uint64_t) Type::number, true, true

diff --git a/src/rgw/rgw_iam_policy_keywords.h b/src/rgw/rgw_iam_policy_keywords.h
index 584a2580b6d672843beceb851eddf51007b4e0d5..1c94dfe17103956c95c0acd7c43880da0cc239f8 100644 (file)
--- a/src/rgw/rgw_iam_policy_keywords.h
+++ b/src/rgw/rgw_iam_policy_keywords.h
@@ -29,6 +29,9 @@ enum class TokenID {
   // String!
   StringEquals, StringNotEquals, StringEqualsIgnoreCase,
   StringNotEqualsIgnoreCase, StringLike, StringNotLike,
+  ForAllValuesStringEquals, ForAnyValueStringEquals,
+  ForAllValuesStringLike, ForAnyValueStringLike,
+  ForAllValuesStringEqualsIgnoreCase, ForAnyValueStringEqualsIgnoreCase,
 
   // Numeric!
   NumericEquals, NumericNotEquals, NumericLessThan, NumericLessThanEquals,