From a7a63aa3ffef1db3788e90e25192a53ee323c69c Mon Sep 17 00:00:00 2001 From: Casey Bodley Date: Thu, 13 Mar 2025 19:48:23 -0400 Subject: [PATCH] rgw/iam: match_policy() treats MATCH_POLICY_ARN as case-sensitive now that the ArnLike conditions are the only user of MATCH_POLICY_ARN, change their case-sensitivity to comply with Amazon Resource Name (ARN) condition operators[1] [1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN Signed-off-by: Casey Bodley --- src/rgw/rgw_common.cc | 2 +- src/test/rgw/test_rgw_iam_policy.cc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc index ed627c3bed3b1..c61db1c4ccc5c 100644 --- a/src/rgw/rgw_common.cc +++ b/src/rgw/rgw_common.cc @@ -2186,7 +2186,7 @@ int rgw_parse_op_type_list(const string& str, uint32_t *perm) bool match_policy(const std::string& pattern, const std::string& input, uint32_t flag) { - const uint32_t flag2 = flag & (MATCH_POLICY_ACTION|MATCH_POLICY_ARN) ? + const uint32_t flag2 = (flag & MATCH_POLICY_ACTION) ? MATCH_CASE_INSENSITIVE : 0; std::string_view::size_type last_pos_input = 0, last_pos_pattern = 0; diff --git a/src/test/rgw/test_rgw_iam_policy.cc b/src/test/rgw/test_rgw_iam_policy.cc index eb724dd132352..bacf517d3f5a8 100644 --- a/src/test/rgw/test_rgw_iam_policy.cc +++ b/src/test/rgw/test_rgw_iam_policy.cc @@ -1468,7 +1468,7 @@ TEST(MatchPolicy, ARN) { constexpr auto flag = MATCH_POLICY_ARN; EXPECT_TRUE(match_policy("a:b:c", "a:b:c", flag)); - EXPECT_TRUE(match_policy("a:b:c", "A:B:C", flag)); // case insensitive + EXPECT_FALSE(match_policy("a:b:c", "A:B:C", flag)); // case sensitive EXPECT_TRUE(match_policy("a:*:e", "a:bcd:e", flag)); EXPECT_FALSE(match_policy("a:*", "a:b:c", flag)); // cannot span segments } -- 2.39.5