rgw_iam_policy: add has_conditional to Policy

does a linear search of conditional keys and returns if present. Useful
where conditionals specified need an often expensive lookup to add to
the env.

Signed-off-by: Abhishek Lekshmanan <abhishek@suse.com>

diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc
index 828399551cf562dabcfa650c6ff6f963dbae03b7..8bfb19574e4ee2a70e28de9b4cf532c20e4af463 100644 (file)
--- a/src/rgw/rgw_iam_policy.cc
+++ b/src/rgw/rgw_iam_policy.cc
@@ -1554,6 +1554,15 @@ Effect Policy::eval(const Environment& e,
   return allowed ? Effect::Allow : Effect::Pass;
 }
 
+bool Policy::has_conditional(const string& conditional, bool partial) const {
+  for (const auto&s: statements){
+    if (std::any_of(s.conditions.begin(), s.conditions.end(),
+                   [&](const Condition& c) { return c.has_key(conditional, partial);}))
+       return true;
+  }
+  return false;
+}
+
 ostream& operator <<(ostream& m, const Policy& p) {
   m << "{ Version: "
     << (p.version == Version::v2008_10_17 ? "2008-10-17" : "2012-10-17");

diff --git a/src/rgw/rgw_iam_policy.h b/src/rgw/rgw_iam_policy.h
index a196575b6d82d06d455fb4e9636e28125df0e184..0ef6f8503fb93ba2f9e6de8d2c44f7d33a06bab4 100644 (file)
--- a/src/rgw/rgw_iam_policy.h
+++ b/src/rgw/rgw_iam_policy.h
@@ -394,6 +394,13 @@ struct Condition {
     }
     return false;
   }
+
+  bool has_key(const std::string& _key, bool partial=false) const {
+    if (partial)
+      return boost::algorithm::istarts_with(key, _key);
+    else
+      return boost::algorithm::iequals(key, _key);
+  }
 };
 
 std::ostream& operator <<(std::ostream& m, const Condition& c);
@@ -446,6 +453,8 @@ struct Policy {
   Effect eval(const Environment& e,
              boost::optional<const rgw::auth::Identity&> ida,
              std::uint64_t action, const ARN& resource) const;
+
+  bool has_conditional(const string& conditional, bool partial=false) const;
 };
 
 std::ostream& operator <<(ostream& m, const Policy& p);