ceph/src/rgw/rgw_iam_policy.cc

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3
   4
   5 #include <cstring>
   6 #include <sstream>
   7 #include <stack>
   8 #include <utility>
   9
  10 #include <boost/regex.hpp>
  11 #include <iostream>
  12 #include "rapidjson/reader.h"
  13
  14 #include "rgw_auth.h"
  15 #include <arpa/inet.h>
  16 #include "rgw_iam_policy.h"
  17
  18 namespace {
  19 constexpr int dout_subsys = ceph_subsys_rgw;
  20 }
  21
  22 using std::bitset;
  23 using std::find;
  24 using std::int64_t;
  25 using std::move;
  26 using std::pair;
  27 using std::size_t;
  28 using std::string;
  29 using std::stringstream;
  30 using std::ostream;
  31 using std::uint16_t;
  32 using std::uint64_t;
  33 using std::unordered_map;
  34
  35 using boost::container::flat_set;
  36 using boost::none;
  37 using boost::optional;
  38 using boost::regex;
  39 using boost::regex_constants::ECMAScript;
  40 using boost::regex_constants::optimize;
  41 using boost::regex_match;
  42 using boost::smatch;
  43
  44 using rapidjson::BaseReaderHandler;
  45 using rapidjson::UTF8;
  46 using rapidjson::SizeType;
  47 using rapidjson::Reader;
  48 using rapidjson::kParseCommentsFlag;
  49 using rapidjson::kParseNumbersAsStringsFlag;
  50 using rapidjson::StringStream;
  51 using rapidjson::ParseResult;
  52
  53 using rgw::auth::Principal;
  54
  55 namespace rgw {
  56 namespace IAM {
  57 #include "rgw_iam_policy_keywords.frag.cc"
  58
  59 struct actpair {
  60   const char* name;
  61   const uint64_t bit;
  62 };
  63
  64 namespace {
  65 optional<Partition> to_partition(const smatch::value_type& p,
  66                                  bool wildcards) {
  67   if (p == "aws") {
  68     return Partition::aws;
  69   } else if (p == "aws-cn") {
  70     return Partition::aws_cn;
  71   } else if (p == "aws-us-gov") {
  72     return Partition::aws_us_gov;
  73   } else if (p == "*" && wildcards) {
  74     return Partition::wildcard;
  75   } else {
  76     return none;
  77   }
  78
  79   ceph_abort();
  80 }
  81
  82 optional<Service> to_service(const smatch::value_type& s,
  83                              bool wildcards) {
  84   static const unordered_map<string, Service> services = {
  85     { "acm", Service::acm },
  86     { "apigateway", Service::apigateway },
  87     { "appstream", Service::appstream },
  88     { "artifact", Service::artifact },
  89     { "autoscaling", Service::autoscaling },
  90     { "aws-marketplace", Service::aws_marketplace },
  91     { "aws-marketplace-management",
  92       Service::aws_marketplace_management },
  93     { "aws-portal", Service::aws_portal },
  94     { "cloudformation", Service::cloudformation },
  95     { "cloudfront", Service::cloudfront },
  96     { "cloudhsm", Service::cloudhsm },
  97     { "cloudsearch", Service::cloudsearch },
  98     { "cloudtrail", Service::cloudtrail },
  99     { "cloudwatch", Service::cloudwatch },
 100     { "codebuild", Service::codebuild },
 101     { "codecommit", Service::codecommit },
 102     { "codedeploy", Service::codedeploy },
 103     { "codepipeline", Service::codepipeline },
 104     { "cognito-identity", Service::cognito_identity },
 105     { "cognito-idp", Service::cognito_idp },
 106     { "cognito-sync", Service::cognito_sync },
 107     { "config", Service::config },
 108     { "datapipeline", Service::datapipeline },
 109     { "devicefarm", Service::devicefarm },
 110     { "directconnect", Service::directconnect },
 111     { "dms", Service::dms },
 112     { "ds", Service::ds },
 113     { "dynamodb", Service::dynamodb },
 114     { "ec2", Service::ec2 },
 115     { "ecr", Service::ecr },
 116     { "ecs", Service::ecs },
 117     { "elasticache", Service::elasticache },
 118     { "elasticbeanstalk", Service::elasticbeanstalk },
 119     { "elasticfilesystem", Service::elasticfilesystem },
 120     { "elasticloadbalancing", Service::elasticloadbalancing },
 121     { "elasticmapreduce", Service::elasticmapreduce },
 122     { "elastictranscoder", Service::elastictranscoder },
 123     { "es", Service::es },
 124     { "events", Service::events },
 125     { "firehose", Service::firehose },
 126     { "gamelift", Service::gamelift },
 127     { "glacier", Service::glacier },
 128     { "health", Service::health },
 129     { "iam", Service::iam },
 130     { "importexport", Service::importexport },
 131     { "inspector", Service::inspector },
 132     { "iot", Service::iot },
 133     { "kinesis", Service::kinesis },
 134     { "kinesisanalytics", Service::kinesisanalytics },
 135     { "kms", Service::kms },
 136     { "lambda", Service::lambda },
 137     { "lightsail", Service::lightsail },
 138     { "logs", Service::logs },
 139     { "machinelearning", Service::machinelearning },
 140     { "mobileanalytics", Service::mobileanalytics },
 141     { "mobilehub", Service::mobilehub },
 142     { "opsworks", Service::opsworks },
 143     { "opsworks-cm", Service::opsworks_cm },
 144     { "polly", Service::polly },
 145     { "rds", Service::rds },
 146     { "redshift", Service::redshift },
 147     { "route53", Service::route53 },
 148     { "route53domains", Service::route53domains },
 149     { "s3", Service::s3 },
 150     { "sdb", Service::sdb },
 151     { "servicecatalog", Service::servicecatalog },
 152     { "ses", Service::ses },
 153     { "sns", Service::sns },
 154     { "sqs", Service::sqs },
 155     { "ssm", Service::ssm },
 156     { "states", Service::states },
 157     { "storagegateway", Service::storagegateway },
 158     { "sts", Service::sts },
 159     { "support", Service::support },
 160     { "swf", Service::swf },
 161     { "trustedadvisor", Service::trustedadvisor },
 162     { "waf", Service::waf },
 163     { "workmail", Service::workmail },
 164     { "workspaces", Service::workspaces }};
 165
 166   if (wildcards && s == "*") {
 167     return Service::wildcard;
 168   }
 169
 170   auto i = services.find(s);
 171   if (i == services.end()) {
 172     return none;
 173   } else {
 174     return i->second;
 175   }
 176 }
 177 }
 178
 179 ARN::ARN(const rgw_obj& o)
 180   : partition(Partition::aws),
 181     service(Service::s3),
 182     region(),
 183     account(o.bucket.tenant),
 184     resource(o.bucket.name)
 185 {
 186   resource.push_back('/');
 187   resource.append(o.key.name);
 188 }
 189
 190 ARN::ARN(const rgw_bucket& b)
 191   : partition(Partition::aws),
 192     service(Service::s3),
 193     region(),
 194     account(b.tenant),
 195     resource(b.name) { }
 196
 197 ARN::ARN(const rgw_bucket& b, const string& o)
 198   : partition(Partition::aws),
 199     service(Service::s3),
 200     region(),
 201     account(b.tenant),
 202     resource(b.name) {
 203   resource.push_back('/');
 204   resource.append(o);
 205 }
 206
 207 optional<ARN> ARN::parse(const string& s, bool wildcards) {
 208   static const char str_wild[] = "arn:([^:]*):([^:]*):([^:]*):([^:]*):([^:]*)";
 209   static const regex rx_wild(str_wild,
 210                                     sizeof(str_wild) - 1,
 211                                     ECMAScript | optimize);
 212   static const char str_no_wild[]
 213     = "arn:([^:*]*):([^:*]*):([^:*]*):([^:*]*):([^:*]*)";
 214   static const regex rx_no_wild(str_no_wild,
 215                                 sizeof(str_no_wild) - 1,
 216                                 ECMAScript | optimize);
 217
 218   smatch match;
 219
 220   if ((s == "*") && wildcards) {
 221     return ARN(Partition::wildcard, Service::wildcard, "*", "*", "*");
 222   } else if (regex_match(s, match, wildcards ? rx_wild : rx_no_wild)) {
 223     ceph_assert(match.size() == 6);
 224
 225     ARN a;
 226     {
 227       auto p = to_partition(match[1], wildcards);
 228       if (!p)
 229         return none;
 230
 231       a.partition = *p;
 232     }
 233     {
 234       auto s = to_service(match[2], wildcards);
 235       if (!s) {
 236         return none;
 237       }
 238       a.service = *s;
 239     }
 240
 241     a.region = match[3];
 242     a.account = match[4];
 243     a.resource = match[5];
 244
 245     return a;
 246   }
 247   return none;
 248 }
 249
 250 string ARN::to_string() const {
 251   string s;
 252
 253   if (partition == Partition::aws) {
 254     s.append("aws:");
 255   } else if (partition == Partition::aws_cn) {
 256     s.append("aws-cn:");
 257   } else if (partition == Partition::aws_us_gov) {
 258     s.append("aws-us-gov:");
 259   } else {
 260     s.append("*:");
 261   }
 262
 263   static const unordered_map<Service, string> services = {
 264     { Service::acm, "acm" },
 265     { Service::apigateway, "apigateway" },
 266     { Service::appstream, "appstream" },
 267     { Service::artifact, "artifact" },
 268     { Service::autoscaling, "autoscaling" },
 269     { Service::aws_marketplace, "aws-marketplace" },
 270     { Service::aws_marketplace_management, "aws-marketplace-management" },
 271     { Service::aws_portal, "aws-portal" },
 272     { Service::cloudformation, "cloudformation" },
 273     { Service::cloudfront, "cloudfront" },
 274     { Service::cloudhsm, "cloudhsm" },
 275     { Service::cloudsearch, "cloudsearch" },
 276     { Service::cloudtrail, "cloudtrail" },
 277     { Service::cloudwatch, "cloudwatch" },
 278     { Service::codebuild, "codebuild" },
 279     { Service::codecommit, "codecommit" },
 280     { Service::codedeploy, "codedeploy" },
 281     { Service::codepipeline, "codepipeline" },
 282     { Service::cognito_identity, "cognito-identity" },
 283     { Service::cognito_idp, "cognito-idp" },
 284     { Service::cognito_sync, "cognito-sync" },
 285     { Service::config, "config" },
 286     { Service::datapipeline, "datapipeline" },
 287     { Service::devicefarm, "devicefarm" },
 288     { Service::directconnect, "directconnect" },
 289     { Service::dms, "dms" },
 290     { Service::ds, "ds" },
 291     { Service::dynamodb, "dynamodb" },
 292     { Service::ec2, "ec2" },
 293     { Service::ecr, "ecr" },
 294     { Service::ecs, "ecs" },
 295     { Service::elasticache, "elasticache" },
 296     { Service::elasticbeanstalk, "elasticbeanstalk" },
 297     { Service::elasticfilesystem, "elasticfilesystem" },
 298     { Service::elasticloadbalancing, "elasticloadbalancing" },
 299     { Service::elasticmapreduce, "elasticmapreduce" },
 300     { Service::elastictranscoder, "elastictranscoder" },
 301     { Service::es, "es" },
 302     { Service::events, "events" },
 303     { Service::firehose, "firehose" },
 304     { Service::gamelift, "gamelift" },
 305     { Service::glacier, "glacier" },
 306     { Service::health, "health" },
 307     { Service::iam, "iam" },
 308     { Service::importexport, "importexport" },
 309     { Service::inspector, "inspector" },
 310     { Service::iot, "iot" },
 311     { Service::kinesis, "kinesis" },
 312     { Service::kinesisanalytics, "kinesisanalytics" },
 313     { Service::kms, "kms" },
 314     { Service::lambda, "lambda" },
 315     { Service::lightsail, "lightsail" },
 316     { Service::logs, "logs" },
 317     { Service::machinelearning, "machinelearning" },
 318     { Service::mobileanalytics, "mobileanalytics" },
 319     { Service::mobilehub, "mobilehub" },
 320     { Service::opsworks, "opsworks" },
 321     { Service::opsworks_cm, "opsworks-cm" },
 322     { Service::polly, "polly" },
 323     { Service::rds, "rds" },
 324     { Service::redshift, "redshift" },
 325     { Service::route53, "route53" },
 326     { Service::route53domains, "route53domains" },
 327     { Service::s3, "s3" },
 328     { Service::sdb, "sdb" },
 329     { Service::servicecatalog, "servicecatalog" },
 330     { Service::ses, "ses" },
 331     { Service::sns, "sns" },
 332     { Service::sqs, "sqs" },
 333     { Service::ssm, "ssm" },
 334     { Service::states, "states" },
 335     { Service::storagegateway, "storagegateway" },
 336     { Service::sts, "sts" },
 337     { Service::support, "support" },
 338     { Service::swf, "swf" },
 339     { Service::trustedadvisor, "trustedadvisor" },
 340     { Service::waf, "waf" },
 341     { Service::workmail, "workmail" },
 342     { Service::workspaces, "workspaces" }};
 343
 344   auto i = services.find(service);
 345   if (i != services.end()) {
 346     s.append(i->second);
 347   } else {
 348     s.push_back('*');
 349   }
 350   s.push_back(':');
 351
 352   s.append(region);
 353   s.push_back(':');
 354
 355   s.append(account);
 356   s.push_back(':');
 357
 358   s.append(resource);
 359
 360   return s;
 361 }
 362
 363 bool operator ==(const ARN& l, const ARN& r) {
 364   return ((l.partition == r.partition) &&
 365           (l.service == r.service) &&
 366           (l.region == r.region) &&
 367           (l.account == r.account) &&
 368           (l.resource == r.resource));
 369 }
 370 bool operator <(const ARN& l, const ARN& r) {
 371   return ((l.partition < r.partition) ||
 372           (l.service < r.service) ||
 373           (l.region < r.region) ||
 374           (l.account < r.account) ||
 375           (l.resource < r.resource));
 376 }
 377
 378 // The candidate is not allowed to have wildcards. The only way to
 379 // do that sanely would be to use unification rather than matching.
 380 bool ARN::match(const ARN& candidate) const {
 381   if ((candidate.partition == Partition::wildcard) ||
 382       (partition != candidate.partition && partition
 383        != Partition::wildcard)) {
 384     return false;
 385   }
 386
 387   if ((candidate.service == Service::wildcard) ||
 388       (service != candidate.service && service != Service::wildcard)) {
 389     return false;
 390   }
 391
 392   if (!::match(region, candidate.region, MATCH_POLICY_ARN)) {
 393     return false;
 394   }
 395
 396   if (!::match(account, candidate.account, MATCH_POLICY_ARN)) {
 397     return false;
 398   }
 399
 400   if (!::match(resource, candidate.resource, MATCH_POLICY_ARN)) {
 401     return false;
 402   }
 403
 404   return true;
 405 }
 406
 407 static const actpair actpairs[] =
 408 {{ "s3:AbortMultipartUpload", s3AbortMultipartUpload },
 409  { "s3:CreateBucket", s3CreateBucket },
 410  { "s3:DeleteBucketPolicy", s3DeleteBucketPolicy },
 411  { "s3:DeleteBucket", s3DeleteBucket },
 412  { "s3:DeleteBucketWebsite", s3DeleteBucketWebsite },
 413  { "s3:DeleteObject", s3DeleteObject },
 414  { "s3:DeleteObjectVersion", s3DeleteObjectVersion },
 415  { "s3:DeleteObjectTagging", s3DeleteObjectTagging },
 416  { "s3:DeleteObjectVersionTagging", s3DeleteObjectVersionTagging },
 417  { "s3:DeleteReplicationConfiguration", s3DeleteReplicationConfiguration },
 418  { "s3:GetAccelerateConfiguration", s3GetAccelerateConfiguration },
 419  { "s3:GetBucketAcl", s3GetBucketAcl },
 420  { "s3:GetBucketCORS", s3GetBucketCORS },
 421  { "s3:GetBucketLocation", s3GetBucketLocation },
 422  { "s3:GetBucketLogging", s3GetBucketLogging },
 423  { "s3:GetBucketNotification", s3GetBucketNotification },
 424  { "s3:GetBucketPolicy", s3GetBucketPolicy },
 425  { "s3:GetBucketRequestPayment", s3GetBucketRequestPayment },
 426  { "s3:GetBucketTagging", s3GetBucketTagging },
 427  { "s3:GetBucketVersioning", s3GetBucketVersioning },
 428  { "s3:GetBucketWebsite", s3GetBucketWebsite },
 429  { "s3:GetLifecycleConfiguration", s3GetLifecycleConfiguration },
 430  { "s3:GetObjectAcl", s3GetObjectAcl },
 431  { "s3:GetObject", s3GetObject },
 432  { "s3:GetObjectTorrent", s3GetObjectTorrent },
 433  { "s3:GetObjectVersionAcl", s3GetObjectVersionAcl },
 434  { "s3:GetObjectVersion", s3GetObjectVersion },
 435  { "s3:GetObjectVersionTorrent", s3GetObjectVersionTorrent },
 436  { "s3:GetObjectTagging", s3GetObjectTagging },
 437  { "s3:GetObjectVersionTagging", s3GetObjectVersionTagging},
 438  { "s3:GetReplicationConfiguration", s3GetReplicationConfiguration },
 439  { "s3:ListAllMyBuckets", s3ListAllMyBuckets },
 440  { "s3:ListBucketMultiPartUploads", s3ListBucketMultiPartUploads },
 441  { "s3:ListBucket", s3ListBucket },
 442  { "s3:ListBucketVersions", s3ListBucketVersions },
 443  { "s3:ListMultipartUploadParts", s3ListMultipartUploadParts },
 444  { "s3:PutAccelerateConfiguration", s3PutAccelerateConfiguration },
 445  { "s3:PutBucketAcl", s3PutBucketAcl },
 446  { "s3:PutBucketCORS", s3PutBucketCORS },
 447  { "s3:PutBucketLogging", s3PutBucketLogging },
 448  { "s3:PutBucketNotification", s3PutBucketNotification },
 449  { "s3:PutBucketPolicy", s3PutBucketPolicy },
 450  { "s3:PutBucketRequestPayment", s3PutBucketRequestPayment },
 451  { "s3:PutBucketTagging", s3PutBucketTagging },
 452  { "s3:PutBucketVersioning", s3PutBucketVersioning },
 453  { "s3:PutBucketWebsite", s3PutBucketWebsite },
 454  { "s3:PutLifecycleConfiguration", s3PutLifecycleConfiguration },
 455  { "s3:PutObjectAcl",  s3PutObjectAcl },
 456  { "s3:PutObject", s3PutObject },
 457  { "s3:PutObjectVersionAcl", s3PutObjectVersionAcl },
 458  { "s3:PutObjectTagging", s3PutObjectTagging },
 459  { "s3:PutObjectVersionTagging", s3PutObjectVersionTagging },
 460  { "s3:PutReplicationConfiguration", s3PutReplicationConfiguration },
 461  { "s3:RestoreObject", s3RestoreObject }};
 462
 463 struct PolicyParser;
 464
 465 const Keyword top[1]{"<Top>", TokenKind::pseudo, TokenID::Top, 0, false,
 466     false};
 467 const Keyword cond_key[1]{"<Condition Key>", TokenKind::cond_key,
 468     TokenID::CondKey, 0, true, false};
 469
 470 struct ParseState {
 471   PolicyParser* pp;
 472   const Keyword* w;
 473
 474   bool arraying = false;
 475   bool objecting = false;
 476   bool cond_ifexists = false;
 477
 478   void reset();
 479
 480   ParseState(PolicyParser* pp, const Keyword* w)
 481     : pp(pp), w(w) {}
 482
 483   bool obj_start();
 484
 485   bool obj_end();
 486
 487   bool array_start() {
 488     if (w->arrayable && !arraying) {
 489       arraying = true;
 490       return true;
 491     }
 492     return false;
 493   }
 494
 495   bool array_end();
 496
 497   bool key(const char* s, size_t l);
 498   bool do_string(CephContext* cct, const char* s, size_t l);
 499   bool number(const char* str, size_t l);
 500 };
 501
 502 // If this confuses you, look up the Curiously Recurring Template Pattern
 503 struct PolicyParser : public BaseReaderHandler<UTF8<>, PolicyParser> {
 504   keyword_hash tokens;
 505   std::vector<ParseState> s;
 506   CephContext* cct;
 507   const string& tenant;
 508   Policy& policy;
 509   std::set<TokenID> v;
 510
 511   uint32_t seen = 0;
 512
 513   uint32_t dex(TokenID in) const {
 514     switch (in) {
 515     case TokenID::Version:
 516       return 0x1;
 517     case TokenID::Id:
 518       return 0x2;
 519     case TokenID::Statement:
 520       return 0x4;
 521     case TokenID::Sid:
 522       return 0x8;
 523     case TokenID::Effect:
 524       return 0x10;
 525     case TokenID::Principal:
 526       return 0x20;
 527     case TokenID::NotPrincipal:
 528       return 0x40;
 529     case TokenID::Action:
 530       return 0x80;
 531     case TokenID::NotAction:
 532       return 0x100;
 533     case TokenID::Resource:
 534       return 0x200;
 535     case TokenID::NotResource:
 536       return 0x400;
 537     case TokenID::Condition:
 538       return 0x800;
 539     case TokenID::AWS:
 540       return 0x1000;
 541     case TokenID::Federated:
 542       return 0x2000;
 543     case TokenID::Service:
 544       return 0x4000;
 545     case TokenID::CanonicalUser:
 546       return 0x8000;
 547     default:
 548       ceph_abort();
 549     }
 550   }
 551   bool test(TokenID in) {
 552     return seen & dex(in);
 553   }
 554   void set(TokenID in) {
 555     seen |= dex(in);
 556     if (in == TokenID::Sid || in == TokenID::Effect || in == TokenID::Principal || in == TokenID::NotPrincipal ||
 557          in == TokenID::Action || in == TokenID::NotAction || in == TokenID::Resource || in == TokenID::NotResource ||
 558             in == TokenID::Condition || in == TokenID::AWS || in == TokenID::Federated || in == TokenID::Service ||
 559               in == TokenID::CanonicalUser) {
 560       v.insert(in);
 561     }
 562   }
 563   void set(std::initializer_list<TokenID> l) {
 564     for (auto in : l) {
 565       seen |= dex(in);
 566       if (in == TokenID::Sid || in == TokenID::Effect || in == TokenID::Principal || in == TokenID::NotPrincipal ||
 567          in == TokenID::Action || in == TokenID::NotAction || in == TokenID::Resource || in == TokenID::NotResource ||
 568             in == TokenID::Condition || in == TokenID::AWS || in == TokenID::Federated || in == TokenID::Service ||
 569               in == TokenID::CanonicalUser) {
 570         v.insert(in);
 571       }
 572     }
 573   }
 574   void reset(TokenID in) {
 575     seen &= ~dex(in);
 576     if (in == TokenID::Sid || in == TokenID::Effect || in == TokenID::Principal || in == TokenID::NotPrincipal ||
 577          in == TokenID::Action || in == TokenID::NotAction || in == TokenID::Resource || in == TokenID::NotResource ||
 578             in == TokenID::Condition || in == TokenID::AWS || in == TokenID::Federated || in == TokenID::Service ||
 579               in == TokenID::CanonicalUser) {
 580       v.erase(in);
 581     }
 582   }
 583   void reset(std::initializer_list<TokenID> l) {
 584     for (auto in : l) {
 585       seen &= ~dex(in);
 586       if (in == TokenID::Sid || in == TokenID::Effect || in == TokenID::Principal || in == TokenID::NotPrincipal ||
 587          in == TokenID::Action || in == TokenID::NotAction || in == TokenID::Resource || in == TokenID::NotResource ||
 588             in == TokenID::Condition || in == TokenID::AWS || in == TokenID::Federated || in == TokenID::Service ||
 589               in == TokenID::CanonicalUser) {
 590         v.erase(in);
 591       }
 592     }
 593   }
 594   void reset(std::set<TokenID> v) {
 595     for (auto in : v) {
 596       seen &= ~dex(in);
 597       v.erase(in);
 598     }
 599   }
 600
 601   PolicyParser(CephContext* cct, const string& tenant, Policy& policy)
 602     : cct(cct), tenant(tenant), policy(policy) {}
 603   PolicyParser(const PolicyParser& policy) = delete;
 604
 605   bool StartObject() {
 606     if (s.empty()) {
 607       s.push_back({this, top});
 608       s.back().objecting = true;
 609       return true;
 610     }
 611
 612     return s.back().obj_start();
 613   }
 614   bool EndObject(SizeType memberCount) {
 615     if (s.empty()) {
 616       return false;
 617     }
 618     return s.back().obj_end();
 619   }
 620   bool Key(const char* str, SizeType length, bool copy) {
 621     if (s.empty()) {
 622       return false;
 623     }
 624     return s.back().key(str, length);
 625   }
 626
 627   bool String(const char* str, SizeType length, bool copy) {
 628     if (s.empty()) {
 629       return false;
 630     }
 631     return s.back().do_string(cct, str, length);
 632   }
 633   bool RawNumber(const char* str, SizeType length, bool copy) {
 634     if (s.empty()) {
 635       return false;
 636     }
 637
 638     return s.back().number(str, length);
 639   }
 640   bool StartArray() {
 641     if (s.empty()) {
 642       return false;
 643     }
 644
 645     return s.back().array_start();
 646   }
 647   bool EndArray(SizeType) {
 648     if (s.empty()) {
 649       return false;
 650     }
 651
 652     return s.back().array_end();
 653   }
 654
 655   bool Default() {
 656     return false;
 657   }
 658 };
 659
 660
 661 // I really despise this misfeature of C++.
 662 //
 663 bool ParseState::obj_end() {
 664   if (objecting) {
 665     objecting = false;
 666     if (!arraying) {
 667       pp->s.pop_back();
 668     } else {
 669       reset();
 670     }
 671     return true;
 672   }
 673   return false;
 674 }
 675
 676 bool ParseState::key(const char* s, size_t l) {
 677   auto token_len = l;
 678   bool ifexists = false;
 679   if (w->id == TokenID::Condition && w->kind == TokenKind::statement) {
 680     static constexpr char IfExists[] = "IfExists";
 681     if (boost::algorithm::ends_with(boost::string_view{s, l}, IfExists)) {
 682       ifexists = true;
 683       token_len -= sizeof(IfExists)-1;
 684     }
 685   }
 686   auto k = pp->tokens.lookup(s, token_len);
 687
 688   if (!k) {
 689     if (w->kind == TokenKind::cond_op) {
 690       auto& t = pp->policy.statements.back();
 691       pp->s.emplace_back(pp, cond_key);
 692       t.conditions.emplace_back(w->id, s, l, cond_ifexists);
 693       return true;
 694     } else {
 695       return false;
 696     }
 697   }
 698
 699   // If the token we're going with belongs within the condition at the
 700   // top of the stack and we haven't already encountered it, push it
 701   // on the stack
 702   // Top
 703   if ((((w->id == TokenID::Top) && (k->kind == TokenKind::top)) ||
 704        // Statement
 705        ((w->id == TokenID::Statement) && (k->kind == TokenKind::statement)) ||
 706
 707        /// Principal
 708        ((w->id == TokenID::Principal || w->id == TokenID::NotPrincipal) &&
 709         (k->kind == TokenKind::princ_type))) &&
 710
 711       // Check that it hasn't been encountered. Note that this
 712       // conjoins with the run of disjunctions above.
 713       !pp->test(k->id)) {
 714     pp->set(k->id);
 715     pp->s.emplace_back(pp, k);
 716     return true;
 717   } else if ((w->id == TokenID::Condition) &&
 718              (k->kind == TokenKind::cond_op)) {
 719     pp->s.emplace_back(pp, k);
 720     pp->s.back().cond_ifexists = ifexists;
 721     return true;
 722   }
 723   return false;
 724 }
 725
 726 // I should just rewrite a few helper functions to use iterators,
 727 // which will make all of this ever so much nicer.
 728 static optional<Principal> parse_principal(CephContext* cct, TokenID t,
 729                                     string&& s) {
 730   // Wildcard!
 731   if ((t == TokenID::AWS) && (s == "*")) {
 732     return Principal::wildcard();
 733
 734     // Do nothing for now.
 735   } else if (t == TokenID::CanonicalUser) {
 736
 737     // AWS ARNs
 738   } else if (t == TokenID::AWS) {
 739     auto a = ARN::parse(s);
 740     if (!a) {
 741       if (std::none_of(s.begin(), s.end(),
 742                        [](const char& c) {
 743                          return (c == ':') || (c == '/');
 744                        })) {
 745         // Since tenants are simply prefixes, there's no really good
 746         // way to see if one exists or not. So we return the thing and
 747         // let them try to match against it.
 748         return Principal::tenant(std::move(s));
 749       }
 750     }
 751
 752     if (a->resource == "root") {
 753       return Principal::tenant(std::move(a->account));
 754     }
 755
 756     static const char rx_str[] = "([^/]*)/(.*)";
 757     static const regex rx(rx_str, sizeof(rx_str) - 1,
 758                           ECMAScript | optimize);
 759     smatch match;
 760     if (regex_match(a->resource, match, rx)) {
 761       ceph_assert(match.size() == 3);
 762
 763       if (match[1] == "user") {
 764         return Principal::user(std::move(a->account),
 765                                match[2]);
 766       }
 767
 768       if (match[1] == "role") {
 769         return Principal::role(std::move(a->account),
 770                                match[2]);
 771       }
 772     }
 773   }
 774
 775   ldout(cct, 0) << "Supplied principal is discarded: " << s << dendl;
 776   return boost::none;
 777 }
 778
 779 bool ParseState::do_string(CephContext* cct, const char* s, size_t l) {
 780   auto k = pp->tokens.lookup(s, l);
 781   Policy& p = pp->policy;
 782   Statement* t = p.statements.empty() ? nullptr : &(p.statements.back());
 783
 784   // Top level!
 785   if ((w->id == TokenID::Version) && k &&
 786       k->kind == TokenKind::version_key) {
 787     p.version = static_cast<Version>(k->specific);
 788   } else if (w->id == TokenID::Id) {
 789     p.id = string(s, l);
 790
 791     // Statement
 792
 793   } else if (w->id == TokenID::Sid) {
 794     t->sid.emplace(s, l);
 795   } else if ((w->id == TokenID::Effect) &&
 796              k->kind == TokenKind::effect_key) {
 797     t->effect = static_cast<Effect>(k->specific);
 798   } else if (w->id == TokenID::Principal && s && *s == '*') {
 799     t->princ.emplace(Principal::wildcard());
 800   } else if (w->id == TokenID::NotPrincipal && s && *s == '*') {
 801     t->noprinc.emplace(Principal::wildcard());
 802   } else if ((w->id == TokenID::Action) ||
 803              (w->id == TokenID::NotAction)) {
 804     for (auto& p : actpairs) {
 805       if (match({s, l}, p.name, MATCH_POLICY_ACTION)) {
 806         (w->id == TokenID::Action ? t->action : t->notaction) |= p.bit;
 807       }
 808     }
 809   } else if (w->id == TokenID::Resource || w->id == TokenID::NotResource) {
 810     auto a = ARN::parse({s, l}, true);
 811     // You can't specify resources for someone ELSE'S account.
 812     if (a && (a->account.empty() || a->account == pp->tenant ||
 813               a->account == "*")) {
 814       if (a->account.empty() || a->account == "*")
 815         a->account = pp->tenant;
 816       (w->id == TokenID::Resource ? t->resource : t->notresource)
 817         .emplace(std::move(*a));
 818     }
 819     else
 820       ldout(cct, 0) << "Supplied resource is discarded: " << string(s, l)
 821                     << dendl;
 822   } else if (w->kind == TokenKind::cond_key) {
 823     auto& t = pp->policy.statements.back();
 824     t.conditions.back().vals.emplace_back(s, l);
 825
 826     // Principals
 827
 828   } else if (w->kind == TokenKind::princ_type) {
 829     ceph_assert(pp->s.size() > 1);
 830     auto& pri = pp->s[pp->s.size() - 2].w->id == TokenID::Principal ?
 831       t->princ : t->noprinc;
 832
 833     auto o = parse_principal(pp->cct, w->id, string(s, l));
 834     if (o)
 835       pri.emplace(std::move(*o));
 836
 837     // Failure
 838
 839   } else {
 840     return false;
 841   }
 842
 843   if (!arraying) {
 844     pp->s.pop_back();
 845   }
 846
 847   return true;
 848 }
 849
 850 bool ParseState::number(const char* s, size_t l) {
 851   // Top level!
 852   if (w->kind == TokenKind::cond_key) {
 853     auto& t = pp->policy.statements.back();
 854     t.conditions.back().vals.emplace_back(s, l);
 855
 856     // Failure
 857
 858   } else {
 859     return false;
 860   }
 861
 862   if (!arraying) {
 863     pp->s.pop_back();
 864   }
 865
 866   return true;
 867 }
 868
 869 void ParseState::reset() {
 870   pp->reset(pp->v);
 871 }
 872
 873 bool ParseState::obj_start() {
 874   if (w->objectable && !objecting) {
 875     objecting = true;
 876     if (w->id == TokenID::Statement) {
 877       pp->policy.statements.push_back({});
 878     }
 879
 880     return true;
 881   }
 882
 883   return false;
 884 }
 885
 886
 887 bool ParseState::array_end() {
 888   if (arraying && !objecting) {
 889     pp->s.pop_back();
 890     return true;
 891   }
 892
 893   return false;
 894 }
 895
 896 ostream& operator <<(ostream& m, const MaskedIP& ip) {
 897   // I have a theory about why std::bitset is the way it is.
 898   if (ip.v6) {
 899     for (int i = 15; i >= 0; --i) {
 900       uint8_t b = 0;
 901       for (int j = 7; j >= 0; --j) {
 902         b |= (ip.addr[(i * 8) + j] << j);
 903       }
 904       m << hex << b;
 905       if (i != 0) {
 906         m << "::";
 907       }
 908     }
 909   } else {
 910     // It involves Satan.
 911     for (int i = 3; i >= 0; --i) {
 912       uint8_t b = 0;
 913       for (int j = 7; j >= 0; --j) {
 914         b |= (ip.addr[(i * 8) + j] << j);
 915       }
 916       m << b;
 917       if (i != 0) {
 918         m << ".";
 919       }
 920     }
 921   }
 922   m << "/" << ip.prefix;
 923   // It would explain a lot
 924   return m;
 925 }
 926
 927 string to_string(const MaskedIP& m) {
 928   stringstream ss;
 929   ss << m;
 930   return ss.str();
 931 }
 932
 933 bool Condition::eval(const Environment& env) const {
 934   auto i = env.find(key);
 935   if (op == TokenID::Null) {
 936     return i == env.end() ? true : false;
 937   }
 938
 939   if (i == env.end()) {
 940     return ifexists;
 941   }
 942   const auto& s = i->second;
 943
 944   switch (op) {
 945     // String!
 946   case TokenID::StringEquals:
 947     return orrible(std::equal_to<std::string>(), s, vals);
 948
 949   case TokenID::StringNotEquals:
 950     return orrible(std::not2(std::equal_to<std::string>()),
 951                    s, vals);
 952
 953   case TokenID::StringEqualsIgnoreCase:
 954     return orrible(ci_equal_to(), s, vals);
 955
 956   case TokenID::StringNotEqualsIgnoreCase:
 957     return orrible(std::not2(ci_equal_to()), s, vals);
 958
 959     // Implement actual StringLike with wildcarding later
 960   case TokenID::StringLike:
 961     return orrible(std::equal_to<std::string>(), s, vals);
 962   case TokenID::StringNotLike:
 963     return orrible(std::not2(std::equal_to<std::string>()),
 964                    s, vals);
 965
 966     // Numeric
 967   case TokenID::NumericEquals:
 968     return shortible(std::equal_to<double>(), as_number, s, vals);
 969
 970   case TokenID::NumericNotEquals:
 971     return shortible(std::not2(std::equal_to<double>()),
 972                      as_number, s, vals);
 973
 974
 975   case TokenID::NumericLessThan:
 976     return shortible(std::less<double>(), as_number, s, vals);
 977
 978
 979   case TokenID::NumericLessThanEquals:
 980     return shortible(std::less_equal<double>(), as_number, s, vals);
 981
 982   case TokenID::NumericGreaterThan:
 983     return shortible(std::greater<double>(), as_number, s, vals);
 984
 985   case TokenID::NumericGreaterThanEquals:
 986     return shortible(std::greater_equal<double>(), as_number, s, vals);
 987
 988     // Date!
 989   case TokenID::DateEquals:
 990     return shortible(std::equal_to<ceph::real_time>(), as_date, s, vals);
 991
 992   case TokenID::DateNotEquals:
 993     return shortible(std::not2(std::equal_to<ceph::real_time>()),
 994                      as_date, s, vals);
 995
 996   case TokenID::DateLessThan:
 997     return shortible(std::less<ceph::real_time>(), as_date, s, vals);
 998
 999
1000   case TokenID::DateLessThanEquals:
1001     return shortible(std::less_equal<ceph::real_time>(), as_date, s, vals);
1002
1003   case TokenID::DateGreaterThan:
1004     return shortible(std::greater<ceph::real_time>(), as_date, s, vals);
1005
1006   case TokenID::DateGreaterThanEquals:
1007     return shortible(std::greater_equal<ceph::real_time>(), as_date, s,
1008                      vals);
1009
1010     // Bool!
1011   case TokenID::Bool:
1012     return shortible(std::equal_to<bool>(), as_bool, s, vals);
1013
1014     // Binary!
1015   case TokenID::BinaryEquals:
1016     return shortible(std::equal_to<ceph::bufferlist>(), as_binary, s,
1017                      vals);
1018
1019     // IP Address!
1020   case TokenID::IpAddress:
1021     return shortible(std::equal_to<MaskedIP>(), as_network, s, vals);
1022
1023   case TokenID::NotIpAddress:
1024     return shortible(std::not2(std::equal_to<MaskedIP>()), as_network, s,
1025                      vals);
1026
1027 #if 0
1028     // Amazon Resource Names! (Does S3 need this?)
1029     TokenID::ArnEquals, TokenID::ArnNotEquals, TokenID::ArnLike,
1030       TokenID::ArnNotLike,
1031 #endif
1032
1033   default:
1034     return false;
1035   }
1036 }
1037
1038 optional<MaskedIP> Condition::as_network(const string& s) {
1039   MaskedIP m;
1040   if (s.empty()) {
1041     return none;
1042   }
1043
1044   m.v6 = s.find(':');
1045   auto slash = s.find('/');
1046   if (slash == string::npos) {
1047     m.prefix = m.v6 ? 128 : 32;
1048   } else {
1049     char* end = 0;
1050     m.prefix = strtoul(s.data() + slash + 1, &end, 10);
1051     if (*end != 0 || (m.v6 && m.prefix > 128) ||
1052         (!m.v6 && m.prefix > 32)) {
1053       return none;
1054     }
1055   }
1056
1057   string t;
1058   auto p = &s;
1059
1060   if (slash != string::npos) {
1061     t.assign(s, 0, slash);
1062     p = &t;
1063   }
1064
1065   if (m.v6) {
1066     struct sockaddr_in6 a;
1067     if (inet_pton(AF_INET6, p->c_str(), static_cast<void*>(&a)) != 1) {
1068       return none;
1069     }
1070
1071     m.addr |= Address(a.sin6_addr.s6_addr[0]) << 0;
1072     m.addr |= Address(a.sin6_addr.s6_addr[1]) << 8;
1073     m.addr |= Address(a.sin6_addr.s6_addr[2]) << 16;
1074     m.addr |= Address(a.sin6_addr.s6_addr[3]) << 24;
1075     m.addr |= Address(a.sin6_addr.s6_addr[4]) << 32;
1076     m.addr |= Address(a.sin6_addr.s6_addr[5]) << 40;
1077     m.addr |= Address(a.sin6_addr.s6_addr[6]) << 48;
1078     m.addr |= Address(a.sin6_addr.s6_addr[7]) << 56;
1079     m.addr |= Address(a.sin6_addr.s6_addr[8]) << 64;
1080     m.addr |= Address(a.sin6_addr.s6_addr[9]) << 72;
1081     m.addr |= Address(a.sin6_addr.s6_addr[10]) << 80;
1082     m.addr |= Address(a.sin6_addr.s6_addr[11]) << 88;
1083     m.addr |= Address(a.sin6_addr.s6_addr[12]) << 96;
1084     m.addr |= Address(a.sin6_addr.s6_addr[13]) << 104;
1085     m.addr |= Address(a.sin6_addr.s6_addr[14]) << 112;
1086     m.addr |= Address(a.sin6_addr.s6_addr[15]) << 120;
1087   } else {
1088     struct sockaddr_in a;
1089     if (inet_pton(AF_INET, p->c_str(), static_cast<void*>(&a)) != 1) {
1090       return none;
1091     }
1092     m.addr = ntohl(a.sin_addr.s_addr);
1093   }
1094
1095   return none;
1096 }
1097
1098 namespace {
1099 const char* condop_string(const TokenID t) {
1100   switch (t) {
1101   case TokenID::StringEquals:
1102     return "StringEquals";
1103
1104   case TokenID::StringNotEquals:
1105     return "StringNotEquals";
1106
1107   case TokenID::StringEqualsIgnoreCase:
1108     return "StringEqualsIgnoreCase";
1109
1110   case TokenID::StringNotEqualsIgnoreCase:
1111     return "StringNotEqualsIgnoreCase";
1112
1113   case TokenID::StringLike:
1114     return "StringLike";
1115
1116   case TokenID::StringNotLike:
1117     return "StringNotLike";
1118
1119   // Numeric!
1120   case TokenID::NumericEquals:
1121     return "NumericEquals";
1122
1123   case TokenID::NumericNotEquals:
1124     return "NumericNotEquals";
1125
1126   case TokenID::NumericLessThan:
1127     return "NumericLessThan";
1128
1129   case TokenID::NumericLessThanEquals:
1130     return "NumericLessThanEquals";
1131
1132   case TokenID::NumericGreaterThan:
1133     return "NumericGreaterThan";
1134
1135   case TokenID::NumericGreaterThanEquals:
1136     return "NumericGreaterThanEquals";
1137
1138   case TokenID::DateEquals:
1139     return "DateEquals";
1140
1141   case TokenID::DateNotEquals:
1142     return "DateNotEquals";
1143
1144   case TokenID::DateLessThan:
1145     return "DateLessThan";
1146
1147   case TokenID::DateLessThanEquals:
1148     return "DateLessThanEquals";
1149
1150   case TokenID::DateGreaterThan:
1151     return "DateGreaterThan";
1152
1153   case TokenID::DateGreaterThanEquals:
1154     return "DateGreaterThanEquals";
1155
1156   case TokenID::Bool:
1157     return "Bool";
1158
1159   case TokenID::BinaryEquals:
1160     return "BinaryEquals";
1161
1162   case TokenID::IpAddress:
1163     return "case TokenID::IpAddress";
1164
1165   case TokenID::NotIpAddress:
1166     return "NotIpAddress";
1167
1168   case TokenID::ArnEquals:
1169     return "ArnEquals";
1170
1171   case TokenID::ArnNotEquals:
1172     return "ArnNotEquals";
1173
1174   case TokenID::ArnLike:
1175     return "ArnLike";
1176
1177   case TokenID::ArnNotLike:
1178     return "ArnNotLike";
1179
1180   case TokenID::Null:
1181     return "Null";
1182
1183   default:
1184     return "InvalidConditionOperator";
1185   }
1186 }
1187
1188 template<typename Iterator>
1189 ostream& print_array(ostream& m, Iterator begin, Iterator end) {
1190   if (begin == end) {
1191     m << "[";
1192   } else {
1193     auto beforelast = end - 1;
1194     m << "[ ";
1195     for (auto i = begin; i != end; ++i) {
1196       m << *i;
1197       if (i != beforelast) {
1198         m << ", ";
1199       } else {
1200         m << " ";
1201       }
1202     }
1203   }
1204   m << "]";
1205   return m;
1206 }
1207 }
1208
1209 ostream& operator <<(ostream& m, const Condition& c) {
1210   m << "{ " << condop_string(c.op);
1211   if (c.ifexists) {
1212     m << "IfExists";
1213   }
1214   m << ": { " << c.key;
1215   print_array(m, c.vals.cbegin(), c.vals.cend());
1216   return m << "}";
1217 }
1218
1219 string to_string(const Condition& c) {
1220   stringstream ss;
1221   ss << c;
1222   return ss.str();
1223 }
1224
1225 Effect Statement::eval(const Environment& e,
1226                        optional<const rgw::auth::Identity&> ida,
1227                        uint64_t act, const ARN& res) const {
1228   if (ida && (!ida->is_identity(princ) || ida->is_identity(noprinc))) {
1229     return Effect::Pass;
1230   }
1231
1232
1233   if (!std::any_of(resource.begin(), resource.end(),
1234                    [&res](const ARN& pattern) {
1235                      return pattern.match(res);
1236                    }) ||
1237       (std::any_of(notresource.begin(), notresource.end(),
1238                    [&res](const ARN& pattern) {
1239                      return pattern.match(res);
1240                    }))) {
1241     return Effect::Pass;
1242   }
1243
1244   if (!(action & act) || (notaction & act)) {
1245     return Effect::Pass;
1246   }
1247
1248   if (std::all_of(conditions.begin(),
1249                   conditions.end(),
1250                   [&e](const Condition& c) { return c.eval(e);})) {
1251     return effect;
1252   }
1253
1254   return Effect::Pass;
1255 }
1256
1257 namespace {
1258 const char* action_bit_string(uint64_t action) {
1259   switch (action) {
1260   case s3GetObject:
1261     return "s3:GetObject";
1262
1263   case s3GetObjectVersion:
1264     return "s3:GetObjectVersion";
1265
1266   case s3PutObject:
1267     return "s3:PutObject";
1268
1269   case s3GetObjectAcl:
1270     return "s3:GetObjectAcl";
1271
1272   case s3GetObjectVersionAcl:
1273     return "s3:GetObjectVersionAcl";
1274
1275   case s3PutObjectAcl:
1276     return "s3:PutObjectAcl";
1277
1278   case s3PutObjectVersionAcl:
1279     return "s3:PutObjectVersionAcl";
1280
1281   case s3DeleteObject:
1282     return "s3:DeleteObject";
1283
1284   case s3DeleteObjectVersion:
1285     return "s3:DeleteObjectVersion";
1286
1287   case s3ListMultipartUploadParts:
1288     return "s3:ListMultipartUploadParts";
1289
1290   case s3AbortMultipartUpload:
1291     return "s3:AbortMultipartUpload";
1292
1293   case s3GetObjectTorrent:
1294     return "s3:GetObjectTorrent";
1295
1296   case s3GetObjectVersionTorrent:
1297     return "s3:GetObjectVersionTorrent";
1298
1299   case s3RestoreObject:
1300     return "s3:RestoreObject";
1301
1302   case s3CreateBucket:
1303     return "s3:CreateBucket";
1304
1305   case s3DeleteBucket:
1306     return "s3:DeleteBucket";
1307
1308   case s3ListBucket:
1309     return "s3:ListBucket";
1310
1311   case s3ListBucketVersions:
1312     return "s3:ListBucketVersions";
1313   case s3ListAllMyBuckets:
1314     return "s3:ListAllMyBuckets";
1315
1316   case s3ListBucketMultiPartUploads:
1317     return "s3:ListBucketMultiPartUploads";
1318
1319   case s3GetAccelerateConfiguration:
1320     return "s3:GetAccelerateConfiguration";
1321
1322   case s3PutAccelerateConfiguration:
1323     return "s3:PutAccelerateConfiguration";
1324
1325   case s3GetBucketAcl:
1326     return "s3:GetBucketAcl";
1327
1328   case s3PutBucketAcl:
1329     return "s3:PutBucketAcl";
1330
1331   case s3GetBucketCORS:
1332     return "s3:GetBucketCORS";
1333
1334   case s3PutBucketCORS:
1335     return "s3:PutBucketCORS";
1336
1337   case s3GetBucketVersioning:
1338     return "s3:GetBucketVersioning";
1339
1340   case s3PutBucketVersioning:
1341     return "s3:PutBucketVersioning";
1342
1343   case s3GetBucketRequestPayment:
1344     return "s3:GetBucketRequestPayment";
1345
1346   case s3PutBucketRequestPayment:
1347     return "s3:PutBucketRequestPayment";
1348
1349   case s3GetBucketLocation:
1350     return "s3:GetBucketLocation";
1351
1352   case s3GetBucketPolicy:
1353     return "s3:GetBucketPolicy";
1354
1355   case s3DeleteBucketPolicy:
1356     return "s3:DeleteBucketPolicy";
1357
1358   case s3PutBucketPolicy:
1359     return "s3:PutBucketPolicy";
1360
1361   case s3GetBucketNotification:
1362     return "s3:GetBucketNotification";
1363
1364   case s3PutBucketNotification:
1365     return "s3:PutBucketNotification";
1366
1367   case s3GetBucketLogging:
1368     return "s3:GetBucketLogging";
1369
1370   case s3PutBucketLogging:
1371     return "s3:PutBucketLogging";
1372
1373   case s3GetBucketTagging:
1374     return "s3:GetBucketTagging";
1375
1376   case s3PutBucketTagging:
1377     return "s3:PutBucketTagging";
1378
1379   case s3GetBucketWebsite:
1380     return "s3:GetBucketWebsite";
1381
1382   case s3PutBucketWebsite:
1383     return "s3:PutBucketWebsite";
1384
1385   case s3DeleteBucketWebsite:
1386     return "s3:DeleteBucketWebsite";
1387
1388   case s3GetLifecycleConfiguration:
1389     return "s3:GetLifecycleConfiguration";
1390
1391   case s3PutLifecycleConfiguration:
1392     return "s3:PutLifecycleConfiguration";
1393
1394   case s3PutReplicationConfiguration:
1395     return "s3:PutReplicationConfiguration";
1396
1397   case s3GetReplicationConfiguration:
1398     return "s3:GetReplicationConfiguration";
1399
1400   case s3DeleteReplicationConfiguration:
1401     return "s3:DeleteReplicationConfiguration";
1402
1403   case s3PutObjectTagging:
1404     return "s3:PutObjectTagging";
1405
1406   case s3PutObjectVersionTagging:
1407     return "s3:PutObjectVersionTagging";
1408
1409   case s3GetObjectTagging:
1410     return "s3:GetObjectTagging";
1411
1412   case s3GetObjectVersionTagging:
1413     return "s3:GetObjectVersionTagging";
1414
1415   case s3DeleteObjectTagging:
1416     return "s3:DeleteObjectTagging";
1417
1418   case s3DeleteObjectVersionTagging:
1419     return "s3:DeleteObjectVersionTagging";
1420   }
1421   return "s3Invalid";
1422 }
1423
1424 ostream& print_actions(ostream& m, const uint64_t a) {
1425   bool begun = false;
1426   m << "[ ";
1427   for (auto i = 0U; i < s3Count; ++i) {
1428     if (a & (1 << i)) {
1429       if (begun) {
1430         m << ", ";
1431       } else {
1432         begun = true;
1433       }
1434       m << action_bit_string(1 << i);
1435     }
1436   }
1437   if (begun) {
1438     m << " ]";
1439   } else {
1440     m << "]";
1441   }
1442   return m;
1443 }
1444 }
1445
1446 ostream& operator <<(ostream& m, const Statement& s) {
1447   m << "{ ";
1448   if (s.sid) {
1449     m << "Sid: " << *s.sid << ", ";
1450   }
1451   if (!s.princ.empty()) {
1452     m << "Principal: ";
1453     print_array(m, s.princ.cbegin(), s.princ.cend());
1454     m << ", ";
1455   }
1456   if (!s.noprinc.empty()) {
1457     m << "NotPrincipal: ";
1458     print_array(m, s.noprinc.cbegin(), s.noprinc.cend());
1459     m << ", ";
1460   }
1461
1462   m << "Effect: " <<
1463     (s.effect == Effect::Allow ?
1464      (const char*) "Allow" :
1465      (const char*) "Deny");
1466
1467   if (s.action || s.notaction || !s.resource.empty() ||
1468       !s.notresource.empty() || !s.conditions.empty()) {
1469     m << ", ";
1470   }
1471
1472   if (s.action) {
1473     m << "Action: ";
1474     print_actions(m, s.action);
1475
1476     if (s.notaction || !s.resource.empty() ||
1477         !s.notresource.empty() || !s.conditions.empty()) {
1478       m << ", ";
1479     }
1480   }
1481
1482   if (s.notaction) {
1483     m << "NotAction: ";
1484     print_actions(m, s.notaction);
1485
1486     if (!s.resource.empty() || !s.notresource.empty() ||
1487         !s.conditions.empty()) {
1488       m << ", ";
1489     }
1490   }
1491
1492   if (!s.resource.empty()) {
1493     m << "Resource: ";
1494     print_array(m, s.resource.cbegin(), s.resource.cend());
1495
1496     if (!s.notresource.empty() || !s.conditions.empty()) {
1497       m << ", ";
1498     }
1499   }
1500
1501   if (!s.notresource.empty()) {
1502     m << "NotResource: ";
1503     print_array(m, s.notresource.cbegin(), s.notresource.cend());
1504
1505     if (!s.conditions.empty()) {
1506       m << ", ";
1507     }
1508   }
1509
1510   if (!s.conditions.empty()) {
1511     m << "Condition: ";
1512     print_array(m, s.conditions.cbegin(), s.conditions.cend());
1513   }
1514
1515   return m << " }";
1516 }
1517
1518 string to_string(const Statement& s) {
1519   stringstream m;
1520   m << s;
1521   return m.str();
1522 }
1523
1524 Policy::Policy(CephContext* cct, const string& tenant,
1525                const bufferlist& _text)
1526   : text(_text.to_str()) {
1527   StringStream ss(text.data());
1528   PolicyParser pp(cct, tenant, *this);
1529   auto pr = Reader{}.Parse<kParseNumbersAsStringsFlag |
1530                            kParseCommentsFlag>(ss, pp);
1531   if (!pr) {
1532     throw PolicyParseException(std::move(pr));
1533   }
1534 }
1535
1536 Effect Policy::eval(const Environment& e,
1537                     optional<const rgw::auth::Identity&> ida,
1538                     std::uint64_t action, const ARN& resource) const {
1539   auto allowed = false;
1540   for (auto& s : statements) {
1541     auto g = s.eval(e, ida, action, resource);
1542     if (g == Effect::Deny) {
1543       return g;
1544     } else if (g == Effect::Allow) {
1545       allowed = true;
1546     }
1547   }
1548   return allowed ? Effect::Allow : Effect::Pass;
1549 }
1550
1551 ostream& operator <<(ostream& m, const Policy& p) {
1552   m << "{ Version: "
1553     << (p.version == Version::v2008_10_17 ? "2008-10-17" : "2012-10-17");
1554
1555   if (p.id || !p.statements.empty()) {
1556     m << ", ";
1557   }
1558
1559   if (p.id) {
1560     m << "Id: " << *p.id;
1561     if (!p.statements.empty()) {
1562       m << ", ";
1563     }
1564   }
1565
1566   if (!p.statements.empty()) {
1567     m << "Statements: ";
1568     print_array(m, p.statements.cbegin(), p.statements.cend());
1569     m << ", ";
1570   }
1571   return m << " }";
1572 }
1573
1574 string to_string(const Policy& p) {
1575   stringstream s;
1576   s << p;
1577   return s.str();
1578 }
1579
1580 }
1581 }