From: Abhishek Lekshmanan <abhishek@suse.com>
Date: Fri, 18 Aug 2017 14:48:18 +0000 (+0200)
Subject: rgw_iam_policy: add has_conditional to Policy
X-Git-Tag: v13.0.2~246^2~19
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=d2ec50999a8206fcc6fa98bd72c86673564ef57d;p=ceph.git

rgw_iam_policy: add has_conditional to Policy

does a linear search of conditional keys and returns if present. Useful
where conditionals specified need an often expensive lookup to add to
the env.

Signed-off-by: Abhishek Lekshmanan <abhishek@suse.com>
---

diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc
index 828399551cf5..8bfb19574e4e 100644
--- a/src/rgw/rgw_iam_policy.cc
+++ b/src/rgw/rgw_iam_policy.cc
@@ -1554,6 +1554,15 @@ Effect Policy::eval(const Environment& e,
   return allowed ? Effect::Allow : Effect::Pass;
 }
 
+bool Policy::has_conditional(const string& conditional, bool partial) const {
+  for (const auto&s: statements){
+    if (std::any_of(s.conditions.begin(), s.conditions.end(),
+		    [&](const Condition& c) { return c.has_key(conditional, partial);}))
+	return true;
+  }
+  return false;
+}
+
 ostream& operator <<(ostream& m, const Policy& p) {
   m << "{ Version: "
     << (p.version == Version::v2008_10_17 ? "2008-10-17" : "2012-10-17");
diff --git a/src/rgw/rgw_iam_policy.h b/src/rgw/rgw_iam_policy.h
index a196575b6d82..0ef6f8503fb9 100644
--- a/src/rgw/rgw_iam_policy.h
+++ b/src/rgw/rgw_iam_policy.h
@@ -394,6 +394,13 @@ struct Condition {
     }
     return false;
   }
+
+  bool has_key(const std::string& _key, bool partial=false) const {
+    if (partial)
+      return boost::algorithm::istarts_with(key, _key);
+    else
+      return boost::algorithm::iequals(key, _key);
+  }
 };
 
 std::ostream& operator <<(std::ostream& m, const Condition& c);
@@ -446,6 +453,8 @@ struct Policy {
   Effect eval(const Environment& e,
 	      boost::optional<const rgw::auth::Identity&> ida,
 	      std::uint64_t action, const ARN& resource) const;
+
+  bool has_conditional(const string& conditional, bool partial=false) const;
 };
 
 std::ostream& operator <<(ostream& m, const Policy& p);