ceph/src/rgw/rgw_iam_policy.cc

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3
   4
   5 #include <cstring>
   6 #include <sstream>
   7 #include <stack>
   8 #include <utility>
   9
  10 #include <boost/regex.hpp>
  11 #include <iostream>
  12 #include "rapidjson/reader.h"
  13
  14 #include "common/backport14.h"
  15 #include "rgw_auth.h"
  16 #include <arpa/inet.h>
  17 #include "rgw_iam_policy.h"
  18
  19 namespace {
  20 constexpr int dout_subsys = ceph_subsys_rgw;
  21 }
  22
  23 using std::bitset;
  24 using std::find;
  25 using std::int64_t;
  26 using std::move;
  27 using std::pair;
  28 using std::size_t;
  29 using std::string;
  30 using std::stringstream;
  31 using std::ostream;
  32 using std::uint16_t;
  33 using std::uint64_t;
  34 using std::unordered_map;
  35
  36 using boost::container::flat_set;
  37 using boost::none;
  38 using boost::optional;
  39 using boost::regex;
  40 using boost::regex_constants::ECMAScript;
  41 using boost::regex_constants::optimize;
  42 using boost::regex_match;
  43 using boost::smatch;
  44
  45 using rapidjson::BaseReaderHandler;
  46 using rapidjson::UTF8;
  47 using rapidjson::SizeType;
  48 using rapidjson::Reader;
  49 using rapidjson::kParseCommentsFlag;
  50 using rapidjson::kParseNumbersAsStringsFlag;
  51 using rapidjson::StringStream;
  52 using rapidjson::ParseResult;
  53
  54 using rgw::auth::Principal;
  55
  56 namespace rgw {
  57 namespace IAM {
  58 #include "rgw_iam_policy_keywords.frag.cc"
  59
  60 struct actpair {
  61   const char* name;
  62   const uint64_t bit;
  63 };
  64
  65 namespace {
  66 optional<Partition> to_partition(const smatch::value_type& p,
  67                                  bool wildcards) {
  68   if (p == "aws") {
  69     return Partition::aws;
  70   } else if (p == "aws-cn") {
  71     return Partition::aws_cn;
  72   } else if (p == "aws-us-gov") {
  73     return Partition::aws_us_gov;
  74   } else if (p == "*" && wildcards) {
  75     return Partition::wildcard;
  76   } else {
  77     return none;
  78   }
  79
  80   ceph_abort();
  81 }
  82
  83 optional<Service> to_service(const smatch::value_type& s,
  84                              bool wildcards) {
  85   static const unordered_map<string, Service> services = {
  86     { "acm", Service::acm },
  87     { "apigateway", Service::apigateway },
  88     { "appstream", Service::appstream },
  89     { "artifact", Service::artifact },
  90     { "autoscaling", Service::autoscaling },
  91     { "aws-marketplace", Service::aws_marketplace },
  92     { "aws-marketplace-management",
  93       Service::aws_marketplace_management },
  94     { "aws-portal", Service::aws_portal },
  95     { "cloudformation", Service::cloudformation },
  96     { "cloudfront", Service::cloudfront },
  97     { "cloudhsm", Service::cloudhsm },
  98     { "cloudsearch", Service::cloudsearch },
  99     { "cloudtrail", Service::cloudtrail },
 100     { "cloudwatch", Service::cloudwatch },
 101     { "codebuild", Service::codebuild },
 102     { "codecommit", Service::codecommit },
 103     { "codedeploy", Service::codedeploy },
 104     { "codepipeline", Service::codepipeline },
 105     { "cognito-identity", Service::cognito_identity },
 106     { "cognito-idp", Service::cognito_idp },
 107     { "cognito-sync", Service::cognito_sync },
 108     { "config", Service::config },
 109     { "datapipeline", Service::datapipeline },
 110     { "devicefarm", Service::devicefarm },
 111     { "directconnect", Service::directconnect },
 112     { "dms", Service::dms },
 113     { "ds", Service::ds },
 114     { "dynamodb", Service::dynamodb },
 115     { "ec2", Service::ec2 },
 116     { "ecr", Service::ecr },
 117     { "ecs", Service::ecs },
 118     { "elasticache", Service::elasticache },
 119     { "elasticbeanstalk", Service::elasticbeanstalk },
 120     { "elasticfilesystem", Service::elasticfilesystem },
 121     { "elasticloadbalancing", Service::elasticloadbalancing },
 122     { "elasticmapreduce", Service::elasticmapreduce },
 123     { "elastictranscoder", Service::elastictranscoder },
 124     { "es", Service::es },
 125     { "events", Service::events },
 126     { "firehose", Service::firehose },
 127     { "gamelift", Service::gamelift },
 128     { "glacier", Service::glacier },
 129     { "health", Service::health },
 130     { "iam", Service::iam },
 131     { "importexport", Service::importexport },
 132     { "inspector", Service::inspector },
 133     { "iot", Service::iot },
 134     { "kinesis", Service::kinesis },
 135     { "kinesisanalytics", Service::kinesisanalytics },
 136     { "kms", Service::kms },
 137     { "lambda", Service::lambda },
 138     { "lightsail", Service::lightsail },
 139     { "logs", Service::logs },
 140     { "machinelearning", Service::machinelearning },
 141     { "mobileanalytics", Service::mobileanalytics },
 142     { "mobilehub", Service::mobilehub },
 143     { "opsworks", Service::opsworks },
 144     { "opsworks-cm", Service::opsworks_cm },
 145     { "polly", Service::polly },
 146     { "rds", Service::rds },
 147     { "redshift", Service::redshift },
 148     { "route53", Service::route53 },
 149     { "route53domains", Service::route53domains },
 150     { "s3", Service::s3 },
 151     { "sdb", Service::sdb },
 152     { "servicecatalog", Service::servicecatalog },
 153     { "ses", Service::ses },
 154     { "sns", Service::sns },
 155     { "sqs", Service::sqs },
 156     { "ssm", Service::ssm },
 157     { "states", Service::states },
 158     { "storagegateway", Service::storagegateway },
 159     { "sts", Service::sts },
 160     { "support", Service::support },
 161     { "swf", Service::swf },
 162     { "trustedadvisor", Service::trustedadvisor },
 163     { "waf", Service::waf },
 164     { "workmail", Service::workmail },
 165     { "workspaces", Service::workspaces }};
 166
 167   if (wildcards && s == "*") {
 168     return Service::wildcard;
 169   }
 170
 171   auto i = services.find(s);
 172   if (i == services.end()) {
 173     return none;
 174   } else {
 175     return i->second;
 176   }
 177 }
 178 }
 179
 180 ARN::ARN(const rgw_obj& o)
 181   : partition(Partition::aws),
 182     service(Service::s3),
 183     region(),
 184     account(o.bucket.tenant),
 185     resource(o.bucket.name)
 186 {
 187   resource.push_back('/');
 188   resource.append(o.key.name);
 189 }
 190
 191 ARN::ARN(const rgw_bucket& b)
 192   : partition(Partition::aws),
 193     service(Service::s3),
 194     region(),
 195     account(b.tenant),
 196     resource(b.name) { }
 197
 198 ARN::ARN(const rgw_bucket& b, const string& o)
 199   : partition(Partition::aws),
 200     service(Service::s3),
 201     region(),
 202     account(b.tenant),
 203     resource(b.name) {
 204   resource.push_back('/');
 205   resource.append(o);
 206 }
 207
 208 optional<ARN> ARN::parse(const string& s, bool wildcards) {
 209   static const char str_wild[] = "arn:([^:]*):([^:]*):([^:]*):([^:]*):([^:]*)";
 210   static const regex rx_wild(str_wild,
 211                                     sizeof(str_wild) - 1,
 212                                     ECMAScript | optimize);
 213   static const char str_no_wild[]
 214     = "arn:([^:*]*):([^:*]*):([^:*]*):([^:*]*):([^:*]*)";
 215   static const regex rx_no_wild(str_no_wild,
 216                                 sizeof(str_no_wild) - 1,
 217                                 ECMAScript | optimize);
 218
 219   smatch match;
 220
 221   if ((s == "*") && wildcards) {
 222     return ARN(Partition::wildcard, Service::wildcard, "*", "*", "*");
 223   } else if (regex_match(s, match, wildcards ? rx_wild : rx_no_wild)) {
 224     ceph_assert(match.size() == 6);
 225
 226     ARN a;
 227     {
 228       auto p = to_partition(match[1], wildcards);
 229       if (!p)
 230         return none;
 231
 232       a.partition = *p;
 233     }
 234     {
 235       auto s = to_service(match[2], wildcards);
 236       if (!s) {
 237         return none;
 238       }
 239       a.service = *s;
 240     }
 241
 242     a.region = match[3];
 243     a.account = match[4];
 244     a.resource = match[5];
 245
 246     return a;
 247   }
 248   return none;
 249 }
 250
 251 string ARN::to_string() const {
 252   string s;
 253
 254   if (partition == Partition::aws) {
 255     s.append("aws:");
 256   } else if (partition == Partition::aws_cn) {
 257     s.append("aws-cn:");
 258   } else if (partition == Partition::aws_us_gov) {
 259     s.append("aws-us-gov:");
 260   } else {
 261     s.append("*:");
 262   }
 263
 264   static const unordered_map<Service, string> services = {
 265     { Service::acm, "acm" },
 266     { Service::apigateway, "apigateway" },
 267     { Service::appstream, "appstream" },
 268     { Service::artifact, "artifact" },
 269     { Service::autoscaling, "autoscaling" },
 270     { Service::aws_marketplace, "aws-marketplace" },
 271     { Service::aws_marketplace_management, "aws-marketplace-management" },
 272     { Service::aws_portal, "aws-portal" },
 273     { Service::cloudformation, "cloudformation" },
 274     { Service::cloudfront, "cloudfront" },
 275     { Service::cloudhsm, "cloudhsm" },
 276     { Service::cloudsearch, "cloudsearch" },
 277     { Service::cloudtrail, "cloudtrail" },
 278     { Service::cloudwatch, "cloudwatch" },
 279     { Service::codebuild, "codebuild" },
 280     { Service::codecommit, "codecommit" },
 281     { Service::codedeploy, "codedeploy" },
 282     { Service::codepipeline, "codepipeline" },
 283     { Service::cognito_identity, "cognito-identity" },
 284     { Service::cognito_idp, "cognito-idp" },
 285     { Service::cognito_sync, "cognito-sync" },
 286     { Service::config, "config" },
 287     { Service::datapipeline, "datapipeline" },
 288     { Service::devicefarm, "devicefarm" },
 289     { Service::directconnect, "directconnect" },
 290     { Service::dms, "dms" },
 291     { Service::ds, "ds" },
 292     { Service::dynamodb, "dynamodb" },
 293     { Service::ec2, "ec2" },
 294     { Service::ecr, "ecr" },
 295     { Service::ecs, "ecs" },
 296     { Service::elasticache, "elasticache" },
 297     { Service::elasticbeanstalk, "elasticbeanstalk" },
 298     { Service::elasticfilesystem, "elasticfilesystem" },
 299     { Service::elasticloadbalancing, "elasticloadbalancing" },
 300     { Service::elasticmapreduce, "elasticmapreduce" },
 301     { Service::elastictranscoder, "elastictranscoder" },
 302     { Service::es, "es" },
 303     { Service::events, "events" },
 304     { Service::firehose, "firehose" },
 305     { Service::gamelift, "gamelift" },
 306     { Service::glacier, "glacier" },
 307     { Service::health, "health" },
 308     { Service::iam, "iam" },
 309     { Service::importexport, "importexport" },
 310     { Service::inspector, "inspector" },
 311     { Service::iot, "iot" },
 312     { Service::kinesis, "kinesis" },
 313     { Service::kinesisanalytics, "kinesisanalytics" },
 314     { Service::kms, "kms" },
 315     { Service::lambda, "lambda" },
 316     { Service::lightsail, "lightsail" },
 317     { Service::logs, "logs" },
 318     { Service::machinelearning, "machinelearning" },
 319     { Service::mobileanalytics, "mobileanalytics" },
 320     { Service::mobilehub, "mobilehub" },
 321     { Service::opsworks, "opsworks" },
 322     { Service::opsworks_cm, "opsworks-cm" },
 323     { Service::polly, "polly" },
 324     { Service::rds, "rds" },
 325     { Service::redshift, "redshift" },
 326     { Service::route53, "route53" },
 327     { Service::route53domains, "route53domains" },
 328     { Service::s3, "s3" },
 329     { Service::sdb, "sdb" },
 330     { Service::servicecatalog, "servicecatalog" },
 331     { Service::ses, "ses" },
 332     { Service::sns, "sns" },
 333     { Service::sqs, "sqs" },
 334     { Service::ssm, "ssm" },
 335     { Service::states, "states" },
 336     { Service::storagegateway, "storagegateway" },
 337     { Service::sts, "sts" },
 338     { Service::support, "support" },
 339     { Service::swf, "swf" },
 340     { Service::trustedadvisor, "trustedadvisor" },
 341     { Service::waf, "waf" },
 342     { Service::workmail, "workmail" },
 343     { Service::workspaces, "workspaces" }};
 344
 345   auto i = services.find(service);
 346   if (i != services.end()) {
 347     s.append(i->second);
 348   } else {
 349     s.push_back('*');
 350   }
 351   s.push_back(':');
 352
 353   s.append(region);
 354   s.push_back(':');
 355
 356   s.append(account);
 357   s.push_back(':');
 358
 359   s.append(resource);
 360
 361   return s;
 362 }
 363
 364 bool operator ==(const ARN& l, const ARN& r) {
 365   return ((l.partition == r.partition) &&
 366           (l.service == r.service) &&
 367           (l.region == r.region) &&
 368           (l.account == r.account) &&
 369           (l.resource == r.resource));
 370 }
 371 bool operator <(const ARN& l, const ARN& r) {
 372   return ((l.partition < r.partition) ||
 373           (l.service < r.service) ||
 374           (l.region < r.region) ||
 375           (l.account < r.account) ||
 376           (l.resource < r.resource));
 377 }
 378
 379 // The candidate is not allowed to have wildcards. The only way to
 380 // do that sanely would be to use unification rather than matching.
 381 bool ARN::match(const ARN& candidate) const {
 382   if ((candidate.partition == Partition::wildcard) ||
 383       (partition != candidate.partition && partition
 384        != Partition::wildcard)) {
 385     return false;
 386   }
 387
 388   if ((candidate.service == Service::wildcard) ||
 389       (service != candidate.service && service != Service::wildcard)) {
 390     return false;
 391   }
 392
 393   if (!match_policy(region, candidate.region, MATCH_POLICY_ARN)) {
 394     return false;
 395   }
 396
 397   if (!match_policy(account, candidate.account, MATCH_POLICY_ARN)) {
 398     return false;
 399   }
 400
 401   if (!match_policy(resource, candidate.resource, MATCH_POLICY_ARN)) {
 402     return false;
 403   }
 404
 405   return true;
 406 }
 407
 408 static const actpair actpairs[] =
 409 {{ "s3:AbortMultipartUpload", s3AbortMultipartUpload },
 410  { "s3:CreateBucket", s3CreateBucket },
 411  { "s3:DeleteBucketPolicy", s3DeleteBucketPolicy },
 412  { "s3:DeleteBucket", s3DeleteBucket },
 413  { "s3:DeleteBucketWebsite", s3DeleteBucketWebsite },
 414  { "s3:DeleteObject", s3DeleteObject },
 415  { "s3:DeleteObjectVersion", s3DeleteObjectVersion },
 416  { "s3:DeleteObjectTagging", s3DeleteObjectTagging },
 417  { "s3:DeleteObjectVersionTagging", s3DeleteObjectVersionTagging },
 418  { "s3:DeleteReplicationConfiguration", s3DeleteReplicationConfiguration },
 419  { "s3:GetAccelerateConfiguration", s3GetAccelerateConfiguration },
 420  { "s3:GetBucketAcl", s3GetBucketAcl },
 421  { "s3:GetBucketCORS", s3GetBucketCORS },
 422  { "s3:GetBucketLocation", s3GetBucketLocation },
 423  { "s3:GetBucketLogging", s3GetBucketLogging },
 424  { "s3:GetBucketNotification", s3GetBucketNotification },
 425  { "s3:GetBucketPolicy", s3GetBucketPolicy },
 426  { "s3:GetBucketRequestPayment", s3GetBucketRequestPayment },
 427  { "s3:GetBucketTagging", s3GetBucketTagging },
 428  { "s3:GetBucketVersioning", s3GetBucketVersioning },
 429  { "s3:GetBucketWebsite", s3GetBucketWebsite },
 430  { "s3:GetLifecycleConfiguration", s3GetLifecycleConfiguration },
 431  { "s3:GetObjectAcl", s3GetObjectAcl },
 432  { "s3:GetObject", s3GetObject },
 433  { "s3:GetObjectTorrent", s3GetObjectTorrent },
 434  { "s3:GetObjectVersionAcl", s3GetObjectVersionAcl },
 435  { "s3:GetObjectVersion", s3GetObjectVersion },
 436  { "s3:GetObjectVersionTorrent", s3GetObjectVersionTorrent },
 437  { "s3:GetObjectTagging", s3GetObjectTagging },
 438  { "s3:GetObjectVersionTagging", s3GetObjectVersionTagging},
 439  { "s3:GetReplicationConfiguration", s3GetReplicationConfiguration },
 440  { "s3:ListAllMyBuckets", s3ListAllMyBuckets },
 441  { "s3:ListBucketMultiPartUploads", s3ListBucketMultiPartUploads },
 442  { "s3:ListBucket", s3ListBucket },
 443  { "s3:ListBucketVersions", s3ListBucketVersions },
 444  { "s3:ListMultipartUploadParts", s3ListMultipartUploadParts },
 445  { "s3:PutAccelerateConfiguration", s3PutAccelerateConfiguration },
 446  { "s3:PutBucketAcl", s3PutBucketAcl },
 447  { "s3:PutBucketCORS", s3PutBucketCORS },
 448  { "s3:PutBucketLogging", s3PutBucketLogging },
 449  { "s3:PutBucketNotification", s3PutBucketNotification },
 450  { "s3:PutBucketPolicy", s3PutBucketPolicy },
 451  { "s3:PutBucketRequestPayment", s3PutBucketRequestPayment },
 452  { "s3:PutBucketTagging", s3PutBucketTagging },
 453  { "s3:PutBucketVersioning", s3PutBucketVersioning },
 454  { "s3:PutBucketWebsite", s3PutBucketWebsite },
 455  { "s3:PutLifecycleConfiguration", s3PutLifecycleConfiguration },
 456  { "s3:PutObjectAcl",  s3PutObjectAcl },
 457  { "s3:PutObject", s3PutObject },
 458  { "s3:PutObjectVersionAcl", s3PutObjectVersionAcl },
 459  { "s3:PutObjectTagging", s3PutObjectTagging },
 460  { "s3:PutObjectVersionTagging", s3PutObjectVersionTagging },
 461  { "s3:PutReplicationConfiguration", s3PutReplicationConfiguration },
 462  { "s3:RestoreObject", s3RestoreObject }};
 463
 464 struct PolicyParser;
 465
 466 const Keyword top[1]{"<Top>", TokenKind::pseudo, TokenID::Top, 0, false,
 467     false};
 468 const Keyword cond_key[1]{"<Condition Key>", TokenKind::cond_key,
 469     TokenID::CondKey, 0, true, false};
 470
 471 struct ParseState {
 472   PolicyParser* pp;
 473   const Keyword* w;
 474
 475   bool arraying = false;
 476   bool objecting = false;
 477   bool cond_ifexists = false;
 478
 479   void reset();
 480
 481   ParseState(PolicyParser* pp, const Keyword* w)
 482     : pp(pp), w(w) {}
 483
 484   bool obj_start();
 485
 486   bool obj_end();
 487
 488   bool array_start() {
 489     if (w->arrayable && !arraying) {
 490       arraying = true;
 491       return true;
 492     }
 493     return false;
 494   }
 495
 496   bool array_end();
 497
 498   bool key(const char* s, size_t l);
 499   bool do_string(CephContext* cct, const char* s, size_t l);
 500   bool number(const char* str, size_t l);
 501 };
 502
 503 // If this confuses you, look up the Curiously Recurring Template Pattern
 504 struct PolicyParser : public BaseReaderHandler<UTF8<>, PolicyParser> {
 505   keyword_hash tokens;
 506   std::vector<ParseState> s;
 507   CephContext* cct;
 508   const string& tenant;
 509   Policy& policy;
 510   uint32_t v = 0;
 511
 512   uint32_t seen = 0;
 513
 514   uint32_t dex(TokenID in) const {
 515     switch (in) {
 516     case TokenID::Version:
 517       return 0x1;
 518     case TokenID::Id:
 519       return 0x2;
 520     case TokenID::Statement:
 521       return 0x4;
 522     case TokenID::Sid:
 523       return 0x8;
 524     case TokenID::Effect:
 525       return 0x10;
 526     case TokenID::Principal:
 527       return 0x20;
 528     case TokenID::NotPrincipal:
 529       return 0x40;
 530     case TokenID::Action:
 531       return 0x80;
 532     case TokenID::NotAction:
 533       return 0x100;
 534     case TokenID::Resource:
 535       return 0x200;
 536     case TokenID::NotResource:
 537       return 0x400;
 538     case TokenID::Condition:
 539       return 0x800;
 540     case TokenID::AWS:
 541       return 0x1000;
 542     case TokenID::Federated:
 543       return 0x2000;
 544     case TokenID::Service:
 545       return 0x4000;
 546     case TokenID::CanonicalUser:
 547       return 0x8000;
 548     default:
 549       ceph_abort();
 550     }
 551   }
 552   bool test(TokenID in) {
 553     return seen & dex(in);
 554   }
 555   void set(TokenID in) {
 556     seen |= dex(in);
 557     if (dex(in) & (dex(TokenID::Sid) | dex(TokenID::Effect) |
 558                    dex(TokenID::Principal) | dex(TokenID::NotPrincipal) |
 559                    dex(TokenID::Action) | dex(TokenID::NotAction) |
 560                    dex(TokenID::Resource) | dex(TokenID::NotResource) |
 561                    dex(TokenID::Condition) | dex(TokenID::AWS) |
 562                    dex(TokenID::Federated) | dex(TokenID::Service) |
 563                    dex(TokenID::CanonicalUser))) {
 564       v |= dex(in);
 565     }
 566   }
 567   void set(std::initializer_list<TokenID> l) {
 568     for (auto in : l) {
 569       seen |= dex(in);
 570       if (dex(in) & (dex(TokenID::Sid) | dex(TokenID::Effect) |
 571                      dex(TokenID::Principal) | dex(TokenID::NotPrincipal) |
 572                      dex(TokenID::Action) | dex(TokenID::NotAction) |
 573                      dex(TokenID::Resource) | dex(TokenID::NotResource) |
 574                      dex(TokenID::Condition) | dex(TokenID::AWS) |
 575                      dex(TokenID::Federated) | dex(TokenID::Service) |
 576                      dex(TokenID::CanonicalUser))) {
 577         v |= dex(in);
 578       }
 579     }
 580   }
 581   void reset(TokenID in) {
 582     seen &= ~dex(in);
 583     if (dex(in) & (dex(TokenID::Sid) | dex(TokenID::Effect) |
 584                    dex(TokenID::Principal) | dex(TokenID::NotPrincipal) |
 585                    dex(TokenID::Action) | dex(TokenID::NotAction) |
 586                    dex(TokenID::Resource) | dex(TokenID::NotResource) |
 587                    dex(TokenID::Condition) | dex(TokenID::AWS) |
 588                    dex(TokenID::Federated) | dex(TokenID::Service) |
 589                    dex(TokenID::CanonicalUser))) {
 590       v &= ~dex(in);
 591     }
 592   }
 593   void reset(std::initializer_list<TokenID> l) {
 594     for (auto in : l) {
 595       seen &= ~dex(in);
 596       if (dex(in) & (dex(TokenID::Sid) | dex(TokenID::Effect) |
 597                      dex(TokenID::Principal) | dex(TokenID::NotPrincipal) |
 598                      dex(TokenID::Action) | dex(TokenID::NotAction) |
 599                      dex(TokenID::Resource) | dex(TokenID::NotResource) |
 600                      dex(TokenID::Condition) | dex(TokenID::AWS) |
 601                      dex(TokenID::Federated) | dex(TokenID::Service) |
 602                      dex(TokenID::CanonicalUser))) {
 603         v &= ~dex(in);
 604       }
 605     }
 606   }
 607   void reset(uint32_t& v) {
 608     seen &= ~v;
 609     v = 0;
 610   }
 611
 612   PolicyParser(CephContext* cct, const string& tenant, Policy& policy)
 613     : cct(cct), tenant(tenant), policy(policy) {}
 614   PolicyParser(const PolicyParser& policy) = delete;
 615
 616   bool StartObject() {
 617     if (s.empty()) {
 618       s.push_back({this, top});
 619       s.back().objecting = true;
 620       return true;
 621     }
 622
 623     return s.back().obj_start();
 624   }
 625   bool EndObject(SizeType memberCount) {
 626     if (s.empty()) {
 627       return false;
 628     }
 629     return s.back().obj_end();
 630   }
 631   bool Key(const char* str, SizeType length, bool copy) {
 632     if (s.empty()) {
 633       return false;
 634     }
 635     return s.back().key(str, length);
 636   }
 637
 638   bool String(const char* str, SizeType length, bool copy) {
 639     if (s.empty()) {
 640       return false;
 641     }
 642     return s.back().do_string(cct, str, length);
 643   }
 644   bool RawNumber(const char* str, SizeType length, bool copy) {
 645     if (s.empty()) {
 646       return false;
 647     }
 648
 649     return s.back().number(str, length);
 650   }
 651   bool StartArray() {
 652     if (s.empty()) {
 653       return false;
 654     }
 655
 656     return s.back().array_start();
 657   }
 658   bool EndArray(SizeType) {
 659     if (s.empty()) {
 660       return false;
 661     }
 662
 663     return s.back().array_end();
 664   }
 665
 666   bool Default() {
 667     return false;
 668   }
 669 };
 670
 671
 672 // I really despise this misfeature of C++.
 673 //
 674 bool ParseState::obj_end() {
 675   if (objecting) {
 676     objecting = false;
 677     if (!arraying) {
 678       pp->s.pop_back();
 679     } else {
 680       reset();
 681     }
 682     return true;
 683   }
 684   return false;
 685 }
 686
 687 bool ParseState::key(const char* s, size_t l) {
 688   auto token_len = l;
 689   bool ifexists = false;
 690   if (w->id == TokenID::Condition && w->kind == TokenKind::statement) {
 691     static constexpr char IfExists[] = "IfExists";
 692     if (boost::algorithm::ends_with(boost::string_view{s, l}, IfExists)) {
 693       ifexists = true;
 694       token_len -= sizeof(IfExists)-1;
 695     }
 696   }
 697   auto k = pp->tokens.lookup(s, token_len);
 698
 699   if (!k) {
 700     if (w->kind == TokenKind::cond_op) {
 701       auto id = w->id;
 702       auto& t = pp->policy.statements.back();
 703       auto c_ife =  cond_ifexists;
 704       pp->s.emplace_back(pp, cond_key);
 705       t.conditions.emplace_back(id, s, l, c_ife);
 706       return true;
 707     } else {
 708       return false;
 709     }
 710   }
 711
 712   // If the token we're going with belongs within the condition at the
 713   // top of the stack and we haven't already encountered it, push it
 714   // on the stack
 715   // Top
 716   if ((((w->id == TokenID::Top) && (k->kind == TokenKind::top)) ||
 717        // Statement
 718        ((w->id == TokenID::Statement) && (k->kind == TokenKind::statement)) ||
 719
 720        /// Principal
 721        ((w->id == TokenID::Principal || w->id == TokenID::NotPrincipal) &&
 722         (k->kind == TokenKind::princ_type))) &&
 723
 724       // Check that it hasn't been encountered. Note that this
 725       // conjoins with the run of disjunctions above.
 726       !pp->test(k->id)) {
 727     pp->set(k->id);
 728     pp->s.emplace_back(pp, k);
 729     return true;
 730   } else if ((w->id == TokenID::Condition) &&
 731              (k->kind == TokenKind::cond_op)) {
 732     pp->s.emplace_back(pp, k);
 733     pp->s.back().cond_ifexists = ifexists;
 734     return true;
 735   }
 736   return false;
 737 }
 738
 739 // I should just rewrite a few helper functions to use iterators,
 740 // which will make all of this ever so much nicer.
 741 static optional<Principal> parse_principal(CephContext* cct, TokenID t,
 742                                     string&& s) {
 743   // Wildcard!
 744   if ((t == TokenID::AWS) && (s == "*")) {
 745     return Principal::wildcard();
 746
 747     // Do nothing for now.
 748   } else if (t == TokenID::CanonicalUser) {
 749
 750     // AWS ARNs
 751   } else if (t == TokenID::AWS) {
 752     auto a = ARN::parse(s);
 753     if (!a) {
 754       if (std::none_of(s.begin(), s.end(),
 755                        [](const char& c) {
 756                          return (c == ':') || (c == '/');
 757                        })) {
 758         // Since tenants are simply prefixes, there's no really good
 759         // way to see if one exists or not. So we return the thing and
 760         // let them try to match against it.
 761         return Principal::tenant(std::move(s));
 762       }
 763     }
 764
 765     if (a->resource == "root") {
 766       return Principal::tenant(std::move(a->account));
 767     }
 768
 769     static const char rx_str[] = "([^/]*)/(.*)";
 770     static const regex rx(rx_str, sizeof(rx_str) - 1,
 771                           ECMAScript | optimize);
 772     smatch match;
 773     if (regex_match(a->resource, match, rx)) {
 774       ceph_assert(match.size() == 3);
 775
 776       if (match[1] == "user") {
 777         return Principal::user(std::move(a->account),
 778                                match[2]);
 779       }
 780
 781       if (match[1] == "role") {
 782         return Principal::role(std::move(a->account),
 783                                match[2]);
 784       }
 785     }
 786   }
 787
 788   ldout(cct, 0) << "Supplied principal is discarded: " << s << dendl;
 789   return boost::none;
 790 }
 791
 792 bool ParseState::do_string(CephContext* cct, const char* s, size_t l) {
 793   auto k = pp->tokens.lookup(s, l);
 794   Policy& p = pp->policy;
 795   Statement* t = p.statements.empty() ? nullptr : &(p.statements.back());
 796
 797   // Top level!
 798   if ((w->id == TokenID::Version) && k &&
 799       k->kind == TokenKind::version_key) {
 800     p.version = static_cast<Version>(k->specific);
 801   } else if (w->id == TokenID::Id) {
 802     p.id = string(s, l);
 803
 804     // Statement
 805
 806   } else if (w->id == TokenID::Sid) {
 807     t->sid.emplace(s, l);
 808   } else if ((w->id == TokenID::Effect) &&
 809              k->kind == TokenKind::effect_key) {
 810     t->effect = static_cast<Effect>(k->specific);
 811   } else if (w->id == TokenID::Principal && s && *s == '*') {
 812     t->princ.emplace(Principal::wildcard());
 813   } else if (w->id == TokenID::NotPrincipal && s && *s == '*') {
 814     t->noprinc.emplace(Principal::wildcard());
 815   } else if ((w->id == TokenID::Action) ||
 816              (w->id == TokenID::NotAction)) {
 817     for (auto& p : actpairs) {
 818       if (match_policy({s, l}, p.name, MATCH_POLICY_ACTION)) {
 819         (w->id == TokenID::Action ? t->action : t->notaction) |= p.bit;
 820       }
 821     }
 822   } else if (w->id == TokenID::Resource || w->id == TokenID::NotResource) {
 823     auto a = ARN::parse({s, l}, true);
 824     // You can't specify resources for someone ELSE'S account.
 825     if (a && (a->account.empty() || a->account == pp->tenant ||
 826               a->account == "*")) {
 827       if (a->account.empty() || a->account == "*")
 828         a->account = pp->tenant;
 829       (w->id == TokenID::Resource ? t->resource : t->notresource)
 830         .emplace(std::move(*a));
 831     }
 832     else
 833       ldout(cct, 0) << "Supplied resource is discarded: " << string(s, l)
 834                     << dendl;
 835   } else if (w->kind == TokenKind::cond_key) {
 836     auto& t = pp->policy.statements.back();
 837     t.conditions.back().vals.emplace_back(s, l);
 838
 839     // Principals
 840
 841   } else if (w->kind == TokenKind::princ_type) {
 842     ceph_assert(pp->s.size() > 1);
 843     auto& pri = pp->s[pp->s.size() - 2].w->id == TokenID::Principal ?
 844       t->princ : t->noprinc;
 845
 846     auto o = parse_principal(pp->cct, w->id, string(s, l));
 847     if (o)
 848       pri.emplace(std::move(*o));
 849
 850     // Failure
 851
 852   } else {
 853     return false;
 854   }
 855
 856   if (!arraying) {
 857     pp->s.pop_back();
 858   }
 859
 860   return true;
 861 }
 862
 863 bool ParseState::number(const char* s, size_t l) {
 864   // Top level!
 865   if (w->kind == TokenKind::cond_key) {
 866     auto& t = pp->policy.statements.back();
 867     t.conditions.back().vals.emplace_back(s, l);
 868
 869     // Failure
 870
 871   } else {
 872     return false;
 873   }
 874
 875   if (!arraying) {
 876     pp->s.pop_back();
 877   }
 878
 879   return true;
 880 }
 881
 882 void ParseState::reset() {
 883   pp->reset(pp->v);
 884 }
 885
 886 bool ParseState::obj_start() {
 887   if (w->objectable && !objecting) {
 888     objecting = true;
 889     if (w->id == TokenID::Statement) {
 890       pp->policy.statements.push_back({});
 891     }
 892
 893     return true;
 894   }
 895
 896   return false;
 897 }
 898
 899
 900 bool ParseState::array_end() {
 901   if (arraying && !objecting) {
 902     pp->s.pop_back();
 903     return true;
 904   }
 905
 906   return false;
 907 }
 908
 909 ostream& operator <<(ostream& m, const MaskedIP& ip) {
 910   // I have a theory about why std::bitset is the way it is.
 911   if (ip.v6) {
 912     for (int i = 15; i >= 0; --i) {
 913       uint8_t b = 0;
 914       for (int j = 7; j >= 0; --j) {
 915         b |= (ip.addr[(i * 8) + j] << j);
 916       }
 917       m << hex << b;
 918       if (i != 0) {
 919         m << "::";
 920       }
 921     }
 922   } else {
 923     // It involves Satan.
 924     for (int i = 3; i >= 0; --i) {
 925       uint8_t b = 0;
 926       for (int j = 7; j >= 0; --j) {
 927         b |= (ip.addr[(i * 8) + j] << j);
 928       }
 929       m << b;
 930       if (i != 0) {
 931         m << ".";
 932       }
 933     }
 934   }
 935   m << "/" << ip.prefix;
 936   // It would explain a lot
 937   return m;
 938 }
 939
 940 string to_string(const MaskedIP& m) {
 941   stringstream ss;
 942   ss << m;
 943   return ss.str();
 944 }
 945
 946 bool Condition::eval(const Environment& env) const {
 947   auto i = env.find(key);
 948   if (op == TokenID::Null) {
 949     return i == env.end() ? true : false;
 950   }
 951
 952   if (i == env.end()) {
 953     return ifexists;
 954   }
 955   const auto& s = i->second;
 956
 957   switch (op) {
 958     // String!
 959   case TokenID::StringEquals:
 960     return orrible(std::equal_to<std::string>(), s, vals);
 961
 962   case TokenID::StringNotEquals:
 963     return orrible(ceph::not_fn(std::equal_to<std::string>()),
 964                    s, vals);
 965
 966   case TokenID::StringEqualsIgnoreCase:
 967     return orrible(ci_equal_to(), s, vals);
 968
 969   case TokenID::StringNotEqualsIgnoreCase:
 970     return orrible(ceph::not_fn(ci_equal_to()), s, vals);
 971
 972   case TokenID::StringLike:
 973     return orrible(string_like(), s, vals);
 974
 975   case TokenID::StringNotLike:
 976     return orrible(ceph::not_fn(string_like()), s, vals);
 977
 978     // Numeric
 979   case TokenID::NumericEquals:
 980     return shortible(std::equal_to<double>(), as_number, s, vals);
 981
 982   case TokenID::NumericNotEquals:
 983     return shortible(ceph::not_fn(std::equal_to<double>()),
 984                      as_number, s, vals);
 985
 986
 987   case TokenID::NumericLessThan:
 988     return shortible(std::less<double>(), as_number, s, vals);
 989
 990
 991   case TokenID::NumericLessThanEquals:
 992     return shortible(std::less_equal<double>(), as_number, s, vals);
 993
 994   case TokenID::NumericGreaterThan:
 995     return shortible(std::greater<double>(), as_number, s, vals);
 996
 997   case TokenID::NumericGreaterThanEquals:
 998     return shortible(std::greater_equal<double>(), as_number, s, vals);
 999
1000     // Date!
1001   case TokenID::DateEquals:
1002     return shortible(std::equal_to<ceph::real_time>(), as_date, s, vals);
1003
1004   case TokenID::DateNotEquals:
1005     return shortible(ceph::not_fn(std::equal_to<ceph::real_time>()),
1006                      as_date, s, vals);
1007
1008   case TokenID::DateLessThan:
1009     return shortible(std::less<ceph::real_time>(), as_date, s, vals);
1010
1011
1012   case TokenID::DateLessThanEquals:
1013     return shortible(std::less_equal<ceph::real_time>(), as_date, s, vals);
1014
1015   case TokenID::DateGreaterThan:
1016     return shortible(std::greater<ceph::real_time>(), as_date, s, vals);
1017
1018   case TokenID::DateGreaterThanEquals:
1019     return shortible(std::greater_equal<ceph::real_time>(), as_date, s,
1020                      vals);
1021
1022     // Bool!
1023   case TokenID::Bool:
1024     return shortible(std::equal_to<bool>(), as_bool, s, vals);
1025
1026     // Binary!
1027   case TokenID::BinaryEquals:
1028     return shortible(std::equal_to<ceph::bufferlist>(), as_binary, s,
1029                      vals);
1030
1031     // IP Address!
1032   case TokenID::IpAddress:
1033     return shortible(std::equal_to<MaskedIP>(), as_network, s, vals);
1034
1035   case TokenID::NotIpAddress:
1036     return shortible(ceph::not_fn(std::equal_to<MaskedIP>()), as_network, s,
1037                      vals);
1038
1039 #if 0
1040     // Amazon Resource Names! (Does S3 need this?)
1041     TokenID::ArnEquals, TokenID::ArnNotEquals, TokenID::ArnLike,
1042       TokenID::ArnNotLike,
1043 #endif
1044
1045   default:
1046     return false;
1047   }
1048 }
1049
1050 optional<MaskedIP> Condition::as_network(const string& s) {
1051   MaskedIP m;
1052   if (s.empty()) {
1053     return none;
1054   }
1055
1056   m.v6 = s.find(':');
1057   auto slash = s.find('/');
1058   if (slash == string::npos) {
1059     m.prefix = m.v6 ? 128 : 32;
1060   } else {
1061     char* end = 0;
1062     m.prefix = strtoul(s.data() + slash + 1, &end, 10);
1063     if (*end != 0 || (m.v6 && m.prefix > 128) ||
1064         (!m.v6 && m.prefix > 32)) {
1065       return none;
1066     }
1067   }
1068
1069   string t;
1070   auto p = &s;
1071
1072   if (slash != string::npos) {
1073     t.assign(s, 0, slash);
1074     p = &t;
1075   }
1076
1077   if (m.v6) {
1078     struct sockaddr_in6 a;
1079     if (inet_pton(AF_INET6, p->c_str(), static_cast<void*>(&a)) != 1) {
1080       return none;
1081     }
1082
1083     m.addr |= Address(a.sin6_addr.s6_addr[0]) << 0;
1084     m.addr |= Address(a.sin6_addr.s6_addr[1]) << 8;
1085     m.addr |= Address(a.sin6_addr.s6_addr[2]) << 16;
1086     m.addr |= Address(a.sin6_addr.s6_addr[3]) << 24;
1087     m.addr |= Address(a.sin6_addr.s6_addr[4]) << 32;
1088     m.addr |= Address(a.sin6_addr.s6_addr[5]) << 40;
1089     m.addr |= Address(a.sin6_addr.s6_addr[6]) << 48;
1090     m.addr |= Address(a.sin6_addr.s6_addr[7]) << 56;
1091     m.addr |= Address(a.sin6_addr.s6_addr[8]) << 64;
1092     m.addr |= Address(a.sin6_addr.s6_addr[9]) << 72;
1093     m.addr |= Address(a.sin6_addr.s6_addr[10]) << 80;
1094     m.addr |= Address(a.sin6_addr.s6_addr[11]) << 88;
1095     m.addr |= Address(a.sin6_addr.s6_addr[12]) << 96;
1096     m.addr |= Address(a.sin6_addr.s6_addr[13]) << 104;
1097     m.addr |= Address(a.sin6_addr.s6_addr[14]) << 112;
1098     m.addr |= Address(a.sin6_addr.s6_addr[15]) << 120;
1099   } else {
1100     struct sockaddr_in a;
1101     if (inet_pton(AF_INET, p->c_str(), static_cast<void*>(&a)) != 1) {
1102       return none;
1103     }
1104     m.addr = ntohl(a.sin_addr.s_addr);
1105   }
1106
1107   return none;
1108 }
1109
1110 namespace {
1111 const char* condop_string(const TokenID t) {
1112   switch (t) {
1113   case TokenID::StringEquals:
1114     return "StringEquals";
1115
1116   case TokenID::StringNotEquals:
1117     return "StringNotEquals";
1118
1119   case TokenID::StringEqualsIgnoreCase:
1120     return "StringEqualsIgnoreCase";
1121
1122   case TokenID::StringNotEqualsIgnoreCase:
1123     return "StringNotEqualsIgnoreCase";
1124
1125   case TokenID::StringLike:
1126     return "StringLike";
1127
1128   case TokenID::StringNotLike:
1129     return "StringNotLike";
1130
1131   // Numeric!
1132   case TokenID::NumericEquals:
1133     return "NumericEquals";
1134
1135   case TokenID::NumericNotEquals:
1136     return "NumericNotEquals";
1137
1138   case TokenID::NumericLessThan:
1139     return "NumericLessThan";
1140
1141   case TokenID::NumericLessThanEquals:
1142     return "NumericLessThanEquals";
1143
1144   case TokenID::NumericGreaterThan:
1145     return "NumericGreaterThan";
1146
1147   case TokenID::NumericGreaterThanEquals:
1148     return "NumericGreaterThanEquals";
1149
1150   case TokenID::DateEquals:
1151     return "DateEquals";
1152
1153   case TokenID::DateNotEquals:
1154     return "DateNotEquals";
1155
1156   case TokenID::DateLessThan:
1157     return "DateLessThan";
1158
1159   case TokenID::DateLessThanEquals:
1160     return "DateLessThanEquals";
1161
1162   case TokenID::DateGreaterThan:
1163     return "DateGreaterThan";
1164
1165   case TokenID::DateGreaterThanEquals:
1166     return "DateGreaterThanEquals";
1167
1168   case TokenID::Bool:
1169     return "Bool";
1170
1171   case TokenID::BinaryEquals:
1172     return "BinaryEquals";
1173
1174   case TokenID::IpAddress:
1175     return "case TokenID::IpAddress";
1176
1177   case TokenID::NotIpAddress:
1178     return "NotIpAddress";
1179
1180   case TokenID::ArnEquals:
1181     return "ArnEquals";
1182
1183   case TokenID::ArnNotEquals:
1184     return "ArnNotEquals";
1185
1186   case TokenID::ArnLike:
1187     return "ArnLike";
1188
1189   case TokenID::ArnNotLike:
1190     return "ArnNotLike";
1191
1192   case TokenID::Null:
1193     return "Null";
1194
1195   default:
1196     return "InvalidConditionOperator";
1197   }
1198 }
1199
1200 template<typename Iterator>
1201 ostream& print_array(ostream& m, Iterator begin, Iterator end) {
1202   if (begin == end) {
1203     m << "[";
1204   } else {
1205     auto beforelast = end - 1;
1206     m << "[ ";
1207     for (auto i = begin; i != end; ++i) {
1208       m << *i;
1209       if (i != beforelast) {
1210         m << ", ";
1211       } else {
1212         m << " ";
1213       }
1214     }
1215   }
1216   m << "]";
1217   return m;
1218 }
1219 }
1220
1221 ostream& operator <<(ostream& m, const Condition& c) {
1222   m << "{ " << condop_string(c.op);
1223   if (c.ifexists) {
1224     m << "IfExists";
1225   }
1226   m << ": { " << c.key;
1227   print_array(m, c.vals.cbegin(), c.vals.cend());
1228   return m << "}";
1229 }
1230
1231 string to_string(const Condition& c) {
1232   stringstream ss;
1233   ss << c;
1234   return ss.str();
1235 }
1236
1237 Effect Statement::eval(const Environment& e,
1238                        optional<const rgw::auth::Identity&> ida,
1239                        uint64_t act, const ARN& res) const {
1240   if (ida && (!ida->is_identity(princ) || ida->is_identity(noprinc))) {
1241     return Effect::Pass;
1242   }
1243
1244
1245   if (!std::any_of(resource.begin(), resource.end(),
1246                    [&res](const ARN& pattern) {
1247                      return pattern.match(res);
1248                    }) ||
1249       (std::any_of(notresource.begin(), notresource.end(),
1250                    [&res](const ARN& pattern) {
1251                      return pattern.match(res);
1252                    }))) {
1253     return Effect::Pass;
1254   }
1255
1256   if (!(action & act) || (notaction & act)) {
1257     return Effect::Pass;
1258   }
1259
1260   if (std::all_of(conditions.begin(),
1261                   conditions.end(),
1262                   [&e](const Condition& c) { return c.eval(e);})) {
1263     return effect;
1264   }
1265
1266   return Effect::Pass;
1267 }
1268
1269 namespace {
1270 const char* action_bit_string(uint64_t action) {
1271   switch (action) {
1272   case s3GetObject:
1273     return "s3:GetObject";
1274
1275   case s3GetObjectVersion:
1276     return "s3:GetObjectVersion";
1277
1278   case s3PutObject:
1279     return "s3:PutObject";
1280
1281   case s3GetObjectAcl:
1282     return "s3:GetObjectAcl";
1283
1284   case s3GetObjectVersionAcl:
1285     return "s3:GetObjectVersionAcl";
1286
1287   case s3PutObjectAcl:
1288     return "s3:PutObjectAcl";
1289
1290   case s3PutObjectVersionAcl:
1291     return "s3:PutObjectVersionAcl";
1292
1293   case s3DeleteObject:
1294     return "s3:DeleteObject";
1295
1296   case s3DeleteObjectVersion:
1297     return "s3:DeleteObjectVersion";
1298
1299   case s3ListMultipartUploadParts:
1300     return "s3:ListMultipartUploadParts";
1301
1302   case s3AbortMultipartUpload:
1303     return "s3:AbortMultipartUpload";
1304
1305   case s3GetObjectTorrent:
1306     return "s3:GetObjectTorrent";
1307
1308   case s3GetObjectVersionTorrent:
1309     return "s3:GetObjectVersionTorrent";
1310
1311   case s3RestoreObject:
1312     return "s3:RestoreObject";
1313
1314   case s3CreateBucket:
1315     return "s3:CreateBucket";
1316
1317   case s3DeleteBucket:
1318     return "s3:DeleteBucket";
1319
1320   case s3ListBucket:
1321     return "s3:ListBucket";
1322
1323   case s3ListBucketVersions:
1324     return "s3:ListBucketVersions";
1325   case s3ListAllMyBuckets:
1326     return "s3:ListAllMyBuckets";
1327
1328   case s3ListBucketMultiPartUploads:
1329     return "s3:ListBucketMultiPartUploads";
1330
1331   case s3GetAccelerateConfiguration:
1332     return "s3:GetAccelerateConfiguration";
1333
1334   case s3PutAccelerateConfiguration:
1335     return "s3:PutAccelerateConfiguration";
1336
1337   case s3GetBucketAcl:
1338     return "s3:GetBucketAcl";
1339
1340   case s3PutBucketAcl:
1341     return "s3:PutBucketAcl";
1342
1343   case s3GetBucketCORS:
1344     return "s3:GetBucketCORS";
1345
1346   case s3PutBucketCORS:
1347     return "s3:PutBucketCORS";
1348
1349   case s3GetBucketVersioning:
1350     return "s3:GetBucketVersioning";
1351
1352   case s3PutBucketVersioning:
1353     return "s3:PutBucketVersioning";
1354
1355   case s3GetBucketRequestPayment:
1356     return "s3:GetBucketRequestPayment";
1357
1358   case s3PutBucketRequestPayment:
1359     return "s3:PutBucketRequestPayment";
1360
1361   case s3GetBucketLocation:
1362     return "s3:GetBucketLocation";
1363
1364   case s3GetBucketPolicy:
1365     return "s3:GetBucketPolicy";
1366
1367   case s3DeleteBucketPolicy:
1368     return "s3:DeleteBucketPolicy";
1369
1370   case s3PutBucketPolicy:
1371     return "s3:PutBucketPolicy";
1372
1373   case s3GetBucketNotification:
1374     return "s3:GetBucketNotification";
1375
1376   case s3PutBucketNotification:
1377     return "s3:PutBucketNotification";
1378
1379   case s3GetBucketLogging:
1380     return "s3:GetBucketLogging";
1381
1382   case s3PutBucketLogging:
1383     return "s3:PutBucketLogging";
1384
1385   case s3GetBucketTagging:
1386     return "s3:GetBucketTagging";
1387
1388   case s3PutBucketTagging:
1389     return "s3:PutBucketTagging";
1390
1391   case s3GetBucketWebsite:
1392     return "s3:GetBucketWebsite";
1393
1394   case s3PutBucketWebsite:
1395     return "s3:PutBucketWebsite";
1396
1397   case s3DeleteBucketWebsite:
1398     return "s3:DeleteBucketWebsite";
1399
1400   case s3GetLifecycleConfiguration:
1401     return "s3:GetLifecycleConfiguration";
1402
1403   case s3PutLifecycleConfiguration:
1404     return "s3:PutLifecycleConfiguration";
1405
1406   case s3PutReplicationConfiguration:
1407     return "s3:PutReplicationConfiguration";
1408
1409   case s3GetReplicationConfiguration:
1410     return "s3:GetReplicationConfiguration";
1411
1412   case s3DeleteReplicationConfiguration:
1413     return "s3:DeleteReplicationConfiguration";
1414
1415   case s3PutObjectTagging:
1416     return "s3:PutObjectTagging";
1417
1418   case s3PutObjectVersionTagging:
1419     return "s3:PutObjectVersionTagging";
1420
1421   case s3GetObjectTagging:
1422     return "s3:GetObjectTagging";
1423
1424   case s3GetObjectVersionTagging:
1425     return "s3:GetObjectVersionTagging";
1426
1427   case s3DeleteObjectTagging:
1428     return "s3:DeleteObjectTagging";
1429
1430   case s3DeleteObjectVersionTagging:
1431     return "s3:DeleteObjectVersionTagging";
1432   }
1433   return "s3Invalid";
1434 }
1435
1436 ostream& print_actions(ostream& m, const uint64_t a) {
1437   bool begun = false;
1438   m << "[ ";
1439   for (auto i = 0U; i < s3Count; ++i) {
1440     if (a & (1 << i)) {
1441       if (begun) {
1442         m << ", ";
1443       } else {
1444         begun = true;
1445       }
1446       m << action_bit_string(1 << i);
1447     }
1448   }
1449   if (begun) {
1450     m << " ]";
1451   } else {
1452     m << "]";
1453   }
1454   return m;
1455 }
1456 }
1457
1458 ostream& operator <<(ostream& m, const Statement& s) {
1459   m << "{ ";
1460   if (s.sid) {
1461     m << "Sid: " << *s.sid << ", ";
1462   }
1463   if (!s.princ.empty()) {
1464     m << "Principal: ";
1465     print_array(m, s.princ.cbegin(), s.princ.cend());
1466     m << ", ";
1467   }
1468   if (!s.noprinc.empty()) {
1469     m << "NotPrincipal: ";
1470     print_array(m, s.noprinc.cbegin(), s.noprinc.cend());
1471     m << ", ";
1472   }
1473
1474   m << "Effect: " <<
1475     (s.effect == Effect::Allow ?
1476      (const char*) "Allow" :
1477      (const char*) "Deny");
1478
1479   if (s.action || s.notaction || !s.resource.empty() ||
1480       !s.notresource.empty() || !s.conditions.empty()) {
1481     m << ", ";
1482   }
1483
1484   if (s.action) {
1485     m << "Action: ";
1486     print_actions(m, s.action);
1487
1488     if (s.notaction || !s.resource.empty() ||
1489         !s.notresource.empty() || !s.conditions.empty()) {
1490       m << ", ";
1491     }
1492   }
1493
1494   if (s.notaction) {
1495     m << "NotAction: ";
1496     print_actions(m, s.notaction);
1497
1498     if (!s.resource.empty() || !s.notresource.empty() ||
1499         !s.conditions.empty()) {
1500       m << ", ";
1501     }
1502   }
1503
1504   if (!s.resource.empty()) {
1505     m << "Resource: ";
1506     print_array(m, s.resource.cbegin(), s.resource.cend());
1507
1508     if (!s.notresource.empty() || !s.conditions.empty()) {
1509       m << ", ";
1510     }
1511   }
1512
1513   if (!s.notresource.empty()) {
1514     m << "NotResource: ";
1515     print_array(m, s.notresource.cbegin(), s.notresource.cend());
1516
1517     if (!s.conditions.empty()) {
1518       m << ", ";
1519     }
1520   }
1521
1522   if (!s.conditions.empty()) {
1523     m << "Condition: ";
1524     print_array(m, s.conditions.cbegin(), s.conditions.cend());
1525   }
1526
1527   return m << " }";
1528 }
1529
1530 string to_string(const Statement& s) {
1531   stringstream m;
1532   m << s;
1533   return m.str();
1534 }
1535
1536 Policy::Policy(CephContext* cct, const string& tenant,
1537                const bufferlist& _text)
1538   : text(_text.to_str()) {
1539   StringStream ss(text.data());
1540   PolicyParser pp(cct, tenant, *this);
1541   auto pr = Reader{}.Parse<kParseNumbersAsStringsFlag |
1542                            kParseCommentsFlag>(ss, pp);
1543   if (!pr) {
1544     throw PolicyParseException(std::move(pr));
1545   }
1546 }
1547
1548 Effect Policy::eval(const Environment& e,
1549                     optional<const rgw::auth::Identity&> ida,
1550                     std::uint64_t action, const ARN& resource) const {
1551   auto allowed = false;
1552   for (auto& s : statements) {
1553     auto g = s.eval(e, ida, action, resource);
1554     if (g == Effect::Deny) {
1555       return g;
1556     } else if (g == Effect::Allow) {
1557       allowed = true;
1558     }
1559   }
1560   return allowed ? Effect::Allow : Effect::Pass;
1561 }
1562
1563 ostream& operator <<(ostream& m, const Policy& p) {
1564   m << "{ Version: "
1565     << (p.version == Version::v2008_10_17 ? "2008-10-17" : "2012-10-17");
1566
1567   if (p.id || !p.statements.empty()) {
1568     m << ", ";
1569   }
1570
1571   if (p.id) {
1572     m << "Id: " << *p.id;
1573     if (!p.statements.empty()) {
1574       m << ", ";
1575     }
1576   }
1577
1578   if (!p.statements.empty()) {
1579     m << "Statements: ";
1580     print_array(m, p.statements.cbegin(), p.statements.cend());
1581     m << ", ";
1582   }
1583   return m << " }";
1584 }
1585
1586 string to_string(const Policy& p) {
1587   stringstream s;
1588   s << p;
1589   return s.str();
1590 }
1591
1592 }
1593 }