RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-02-24 11:37:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

rgw: add helper function rgw_transport_is_secure()

Browse Source 
Signed-off-by: Casey Bodley <cbodley@redhat.com>
This commit is contained in:
Casey Bodley 2018-10-22 14:13:21 -04:00
parent d3dd5a996d
commit 73d355fc51
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/rgw/rgw_common.cc
View File

@ -1044,6 +1044,31 @@ string RGWHTTPArgs::sys_get(const string& name, bool * const exists) const
return e ? iter->second : string();
}
bool rgw_transport_is_secure(CephContext *cct, const RGWEnv& env)
{
const auto& m = env.get_map();
// frontend connected with ssl
if (m.count("SERVER_PORT_SECURE")) {
return true;
}
// ignore proxy headers unless explicitly enabled
if (!cct->_conf->rgw_trust_forwarded_https) {
return false;
}
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
// Forwarded: by=<identifier>; for=<identifier>; host=<host>; proto=<http|https>
auto i = m.find("HTTP_FORWARDED");
if (i != m.end() && i->second.find("proto=https") != std::string::npos) {
return true;
}
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
i = m.find("HTTP_X_FORWARDED_PROTO");
if (i != m.end() && i->second == "https") {
return true;
}
return false;
}
namespace {
Effect eval_or_pass(const boost::optional<Policy>& policy,
const rgw::IAM::Environment& env,

4
src/rgw/rgw_common.h
View File

@ -437,6 +437,10 @@ public:
}
};
// return true if the connection is secure. this either means that the
// connection arrived via ssl, or was forwarded as https by a trusted proxy
bool rgw_transport_is_secure(CephContext *cct, const RGWEnv& env);
enum http_op {
OP_GET,
OP_PUT,