if ((s == "*") && wildcards) {
return ARN(Partition::wildcard, Service::wildcard, "*", "*", "*");
- } else if (regex_match(s, match, wildcards ? rx_wild : rx_no_wild)) {
- if (match.size() != 6) {
- return boost::none;
- }
-
- ARN a;
- {
- auto p = to_partition(match[1], wildcards);
- if (!p)
- return none;
-
- a.partition = *p;
- }
- {
- auto s = to_service(match[2], wildcards);
- if (!s) {
- return none;
+ } else if (regex_match(s, match, wildcards ? rx_wild : rx_no_wild) &&
+ match.size() == 6) {
+ if (auto p = to_partition(match[1], wildcards)) {
+ if (auto s = to_service(match[2], wildcards)) {
+ return ARN(*p, *s, match[3], match[4], match[5]);
}
- a.service = *s;
}
-
- a.region = match[3];
- a.account = match[4];
- a.resource = match[5];
-
- return a;
}
return none;
}
{ "s3:GetObjectVersionTagging", s3GetObjectVersionTagging},
{ "s3:GetReplicationConfiguration", s3GetReplicationConfiguration },
{ "s3:ListAllMyBuckets", s3ListAllMyBuckets },
- { "s3:ListBucketMultiPartUploads", s3ListBucketMultiPartUploads },
+ { "s3:ListBucketMultipartUploads", s3ListBucketMultipartUploads },
{ "s3:ListBucket", s3ListBucket },
{ "s3:ListBucketVersions", s3ListBucketVersions },
{ "s3:ListMultipartUploadParts", s3ListMultipartUploadParts },
// I should just rewrite a few helper functions to use iterators,
// which will make all of this ever so much nicer.
static optional<Principal> parse_principal(CephContext* cct, TokenID t,
- string&& s) {
+ string&& s) {
// Wildcard!
if ((t == TokenID::AWS) && (s == "*")) {
return Principal::wildcard();
// AWS ARNs
} else if (t == TokenID::AWS) {
- auto a = ARN::parse(s);
- if (!a) {
+ if (auto a = ARN::parse(s)) {
+ if (a->resource == "root") {
+ return Principal::tenant(std::move(a->account));
+ }
+
+ static const char rx_str[] = "([^/]*)/(.*)";
+ static const regex rx(rx_str, sizeof(rx_str) - 1,
+ ECMAScript | optimize);
+ smatch match;
+ if (regex_match(a->resource, match, rx) && match.size() == 3) {
+ if (match[1] == "user") {
+ return Principal::user(std::move(a->account),
+ match[2]);
+ }
+
+ if (match[1] == "role") {
+ return Principal::role(std::move(a->account),
+ match[2]);
+ }
+ }
+ } else {
if (std::none_of(s.begin(), s.end(),
[](const char& c) {
return (c == ':') || (c == '/');
return Principal::tenant(std::move(s));
}
}
-
- if (a->resource == "root") {
- return Principal::tenant(std::move(a->account));
- }
-
- static const char rx_str[] = "([^/]*)/(.*)";
- static const regex rx(rx_str, sizeof(rx_str) - 1,
- ECMAScript | optimize);
- smatch match;
- if (regex_match(a->resource, match, rx)) {
- if (match.size() != 3) {
- return boost::none;
- }
-
- if (match[1] == "user") {
- return Principal::user(std::move(a->account),
- match[2]);
- }
-
- if (match[1] == "role") {
- return Principal::role(std::move(a->account),
- match[2]);
- }
- }
}
ldout(cct, 0) << "Supplied principal is discarded: " << s << dendl;
} else if (w->id == TokenID::Sid) {
t->sid.emplace(s, l);
- } else if ((w->id == TokenID::Effect) &&
+ } else if ((w->id == TokenID::Effect) && k &&
k->kind == TokenKind::effect_key) {
t->effect = static_cast<Effect>(k->specific);
} else if (w->id == TokenID::Principal && s && *s == '*') {
auto& pri = pp->s[pp->s.size() - 2].w->id == TokenID::Principal ?
t->princ : t->noprinc;
- auto o = parse_principal(pp->cct, w->id, string(s, l));
- if (o)
+
+ if (auto o = parse_principal(pp->cct, w->id, string(s, l))) {
pri.emplace(std::move(*o));
+ }
// Failure
ostream& operator <<(ostream& m, const MaskedIP& ip) {
// I have a theory about why std::bitset is the way it is.
if (ip.v6) {
- for (int i = 15; i >= 0; --i) {
- uint8_t b = 0;
- for (int j = 7; j >= 0; --j) {
- b |= (ip.addr[(i * 8) + j] << j);
+ for (int i = 7; i >= 0; --i) {
+ uint16_t hextet = 0;
+ for (int j = 15; j >= 0; --j) {
+ hextet |= (ip.addr[(i * 16) + j] << j);
}
- m << hex << b;
+ m << hex << (unsigned int) hextet;
if (i != 0) {
- m << "::";
+ m << ":";
}
}
} else {
for (int j = 7; j >= 0; --j) {
b |= (ip.addr[(i * 8) + j] << j);
}
- m << b;
+ m << (unsigned int) b;
if (i != 0) {
m << ".";
}
}
}
- m << "/" << ip.prefix;
+ m << "/" << dec << ip.prefix;
// It would explain a lot
return m;
}
return shortible(std::equal_to<MaskedIP>(), as_network, s, vals);
case TokenID::NotIpAddress:
- return shortible(ceph::not_fn(std::equal_to<MaskedIP>()), as_network, s,
- vals);
+ {
+ auto xc = as_network(s);
+ if (!xc) {
+ return false;
+ }
+
+ for (const string& d : vals) {
+ auto xd = as_network(d);
+ if (!xd) {
+ continue;
+ }
+
+ if (xc == xd) {
+ return false;
+ }
+ }
+ return true;
+ }
#if 0
// Amazon Resource Names! (Does S3 need this?)
return none;
}
- m.v6 = s.find(':');
+ m.v6 = (s.find(':') == string::npos) ? false : true;
auto slash = s.find('/');
if (slash == string::npos) {
m.prefix = m.v6 ? 128 : 32;
}
if (m.v6) {
- struct sockaddr_in6 a;
+ struct in6_addr a;
if (inet_pton(AF_INET6, p->c_str(), static_cast<void*>(&a)) != 1) {
return none;
}
- m.addr |= Address(a.sin6_addr.s6_addr[0]) << 0;
- m.addr |= Address(a.sin6_addr.s6_addr[1]) << 8;
- m.addr |= Address(a.sin6_addr.s6_addr[2]) << 16;
- m.addr |= Address(a.sin6_addr.s6_addr[3]) << 24;
- m.addr |= Address(a.sin6_addr.s6_addr[4]) << 32;
- m.addr |= Address(a.sin6_addr.s6_addr[5]) << 40;
- m.addr |= Address(a.sin6_addr.s6_addr[6]) << 48;
- m.addr |= Address(a.sin6_addr.s6_addr[7]) << 56;
- m.addr |= Address(a.sin6_addr.s6_addr[8]) << 64;
- m.addr |= Address(a.sin6_addr.s6_addr[9]) << 72;
- m.addr |= Address(a.sin6_addr.s6_addr[10]) << 80;
- m.addr |= Address(a.sin6_addr.s6_addr[11]) << 88;
- m.addr |= Address(a.sin6_addr.s6_addr[12]) << 96;
- m.addr |= Address(a.sin6_addr.s6_addr[13]) << 104;
- m.addr |= Address(a.sin6_addr.s6_addr[14]) << 112;
- m.addr |= Address(a.sin6_addr.s6_addr[15]) << 120;
+ m.addr |= Address(a.s6_addr[15]) << 0;
+ m.addr |= Address(a.s6_addr[14]) << 8;
+ m.addr |= Address(a.s6_addr[13]) << 16;
+ m.addr |= Address(a.s6_addr[12]) << 24;
+ m.addr |= Address(a.s6_addr[11]) << 32;
+ m.addr |= Address(a.s6_addr[10]) << 40;
+ m.addr |= Address(a.s6_addr[9]) << 48;
+ m.addr |= Address(a.s6_addr[8]) << 56;
+ m.addr |= Address(a.s6_addr[7]) << 64;
+ m.addr |= Address(a.s6_addr[6]) << 72;
+ m.addr |= Address(a.s6_addr[5]) << 80;
+ m.addr |= Address(a.s6_addr[4]) << 88;
+ m.addr |= Address(a.s6_addr[3]) << 96;
+ m.addr |= Address(a.s6_addr[2]) << 104;
+ m.addr |= Address(a.s6_addr[1]) << 112;
+ m.addr |= Address(a.s6_addr[0]) << 120;
} else {
- struct sockaddr_in a;
+ struct in_addr a;
if (inet_pton(AF_INET, p->c_str(), static_cast<void*>(&a)) != 1) {
return none;
}
- m.addr = ntohl(a.sin_addr.s_addr);
+
+ m.addr = ntohl(a.s_addr);
}
- return none;
+ return m;
}
namespace {
case s3ListAllMyBuckets:
return "s3:ListAllMyBuckets";
- case s3ListBucketMultiPartUploads:
- return "s3:ListBucketMultiPartUploads";
+ case s3ListBucketMultipartUploads:
+ return "s3:ListBucketMultipartUploads";
case s3GetAccelerateConfiguration:
return "s3:GetAccelerateConfiguration";
projects / ceph.git / blobdiff