2 * Copyright (c) 2012-2018, JANET(UK)
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of JANET(UK) nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
25 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
27 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
29 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
31 * OF THE POSSIBILITY OF SUCH DAMAGE.
41 #include <tr_cfgwatch.h>
43 #include <tr_config.h>
44 #include <tr_gss_names.h>
46 #include <tr_filter.h>
47 #include <tr_constraint_internal.h>
50 #include <trust_router/trp.h>
52 #if JANSSON_VERSION_HEX < 0x020500
53 #include "jansson_iterators.h"
57 TR_CFG_RC tr_cfg_parse_gss_names(TALLOC_CTX *mem_ctx, json_t *jgss_names, TR_GSS_NAMES **gssn_out)
59 TALLOC_CTX *tmp_ctx=talloc_new(NULL);
60 TR_GSS_NAMES *gn=NULL;
64 TR_CFG_RC rc = TR_CFG_ERROR;
66 if (jgss_names==NULL) {
67 tr_err("tr_cfg_parse_gss_names: Bad parameters.");
72 if (!json_is_array(jgss_names)) {
73 tr_err("tr_cfg_parse_gss_names: gss_names not an array.");
78 gn=tr_gss_names_new(tmp_ctx);
79 for (ii=0; ii<json_array_size(jgss_names); ii++) {
80 jname=json_array_get(jgss_names, ii);
81 if (!json_is_string(jname)) {
82 tr_err("tr_cfg_parse_gss_names: Encountered non-string gss name.");
87 name=tr_new_name(json_string_value(jname));
89 tr_err("tr_cfg_parse_gss_names: Out of memory allocating gss name.");
94 if (tr_gss_names_add(gn, name)!=0) {
96 tr_err("tr_cfg_parse_gss_names: Unable to add gss name to RP client.");
103 talloc_steal(mem_ctx, *gssn_out);
107 talloc_free(tmp_ctx);
111 /* default filter accepts realm and *.realm */
112 static TR_FILTER_SET *tr_cfg_default_filters(TALLOC_CTX *mem_ctx, TR_NAME *realm, TR_CFG_RC *rc)
114 TALLOC_CTX *tmp_ctx=talloc_new(NULL);
115 TR_FILTER *filt=NULL;
116 TR_FLINE *fline = NULL;
117 TR_FSPEC *fspec = NULL;
118 TR_FILTER_SET *filt_set=NULL;
119 TR_CONSTRAINT *cons=NULL;
121 TR_NAME *n_prefix=tr_new_name("*.");
122 TR_NAME *n_rp_realm_1=tr_new_name("rp_realm");
123 TR_NAME *n_rp_realm_2=tr_new_name("rp_realm");
124 TR_NAME *n_domain=tr_new_name("domain");
125 TR_NAME *n_realm=tr_new_name("realm");
128 if ((realm==NULL) || (rc==NULL)) {
129 tr_debug("tr_cfg_default_filters: invalid arguments.");
131 *rc=TR_CFG_BAD_PARAMS;
135 if ((n_prefix==NULL) ||
136 (n_rp_realm_1==NULL) ||
137 (n_rp_realm_2==NULL) ||
140 tr_debug("tr_cfg_default_filters: unable to allocate names.");
145 filt=tr_filter_new(tmp_ctx);
147 tr_debug("tr_cfg_default_filters: could not allocate filter.");
151 tr_filter_set_type(filt, TR_FILTER_TYPE_TID_INBOUND);
153 fline = tr_fline_new(tmp_ctx);
155 tr_debug("tr_cfg_default_filters: could not allocate filter line.");
160 fline->action=TR_FILTER_ACTION_ACCEPT;
162 fspec=tr_fspec_new(tmp_ctx);
163 fspec->field=n_rp_realm_1;
164 n_rp_realm_1=NULL; /* we don't own this name any more */
166 name=tr_dup_name(realm);
168 tr_debug("tr_cfg_default_filters: could not allocate realm name.");
172 tr_fspec_add_match(fspec, name);
173 name=NULL; /* we no longer own the name */
175 if (tr_fline_add_spec(fline, fspec) == NULL) {
176 tr_debug("tr_cfg_default_filters: could not add first spec to filter line");
181 /* now do the wildcard name */
182 fspec=tr_fspec_new(tmp_ctx);
183 fspec->field=n_rp_realm_2;
184 n_rp_realm_2=NULL; /* we don't own this name any more */
186 if (NULL==(name=tr_name_cat(n_prefix, realm))) {
187 tr_debug("tr_cfg_default_filters: could not allocate wildcard realm name.");
192 tr_fspec_add_match(fspec, name);
193 name=NULL; /* we no longer own the name */
195 if (tr_fline_add_spec(fline, fspec) == NULL) {
196 tr_debug("tr_cfg_default_filters: could not add second spec to filter line");
201 /* domain constraint */
202 if (NULL==(cons=tr_constraint_new(fline))) {
203 tr_debug("tr_cfg_default_filters: could not allocate domain constraint.");
209 n_domain=NULL; /* belongs to the constraint now */
210 name=tr_dup_name(realm);
212 tr_debug("tr_cfg_default_filters: could not allocate realm name for domain constraint.");
216 if (NULL == tr_constraint_add_match(cons, name)) {
217 tr_debug("tr_cfg_default_filters: could not add realm name for domain constraint.");
221 name=tr_name_cat(n_prefix, realm);
223 tr_debug("tr_cfg_default_filters: could not allocate wildcard realm name for domain constraint.");
227 if (NULL == tr_constraint_add_match(cons, name)) {
228 tr_debug("tr_cfg_default_filters: could not add wildcard realm name for domain constraint.");
233 fline->domain_cons=cons;
236 /* realm constraint */
237 if (NULL==(cons=tr_constraint_new(fline))) {
238 tr_debug("tr_cfg_default_filters: could not allocate realm constraint.");
244 n_realm=NULL; /* belongs to the constraint now */
245 name=tr_dup_name(realm);
247 tr_debug("tr_cfg_default_filters: could not allocate realm name for realm constraint.");
251 if (NULL == tr_constraint_add_match(cons, name)) {
252 tr_debug("tr_cfg_default_filters: could not add realm name for realm constraint.");
256 name=tr_name_cat(n_prefix, realm);
258 tr_debug("tr_cfg_default_filters: could not allocate wildcard realm name for realm constraint.");
262 if (NULL == tr_constraint_add_match(cons, name)) {
263 tr_debug("tr_cfg_default_filters: could not add wildcard realm name for realm constraint.");
268 fline->realm_cons=cons;
270 /* put the fline in the filter */
271 if (NULL == tr_filter_add_line(filt, fline)) {
272 tr_debug("tr_cfg_default_filters: could not add line to filter.");
277 /* put the filter in a set */
278 filt_set=tr_filter_set_new(tmp_ctx);
279 if ((filt_set==NULL)||(0!=tr_filter_set_add(filt_set, filt))) {
280 tr_debug("tr_cfg_default_filters: could not allocate filter set.");
284 talloc_steal(mem_ctx, filt_set);
287 talloc_free(tmp_ctx);
289 if (*rc!=TR_CFG_SUCCESS)
293 tr_free_name(n_prefix);
294 if (n_rp_realm_1!=NULL)
295 tr_free_name(n_rp_realm_1);
296 if (n_rp_realm_2!=NULL)
297 tr_free_name(n_rp_realm_2);
299 tr_free_name(n_realm);
301 tr_free_name(n_domain);
308 /* parses rp client */
309 static TR_RP_CLIENT *tr_cfg_parse_one_rp_client(TALLOC_CTX *mem_ctx, json_t *jrealm, TR_CFG_RC *rc)
311 TALLOC_CTX *tmp_ctx=talloc_new(NULL);
312 TR_RP_CLIENT *client=NULL;
313 TR_CFG_RC call_rc=TR_CFG_ERROR;
314 TR_FILTER_SET *new_filts=NULL;
317 json_t *jrealm_id=NULL;
319 *rc=TR_CFG_ERROR; /* default to error if not set */
321 if ((!jrealm) || (!rc)) {
322 tr_err("tr_cfg_parse_one_rp_client: Bad parameters.");
324 *rc=TR_CFG_BAD_PARAMS;
328 if ((NULL==(jrealm_id=json_object_get(jrealm, "realm"))) || (!json_is_string(jrealm_id))) {
329 tr_debug("tr_cfg_parse_one_rp_client: no realm ID found.");
330 *rc=TR_CFG_BAD_PARAMS;
334 tr_debug("tr_cfg_parse_one_rp_client: realm_id=\"%s\"", json_string_value(jrealm_id));
335 realm=tr_new_name(json_string_value(jrealm_id));
337 tr_err("tr_cfg_parse_one_rp_client: could not allocate realm ID.");
342 if (NULL==(client=tr_rp_client_new(tmp_ctx))) {
343 tr_err("tr_cfg_parse_one_rp_client: could not allocate rp client.");
348 call_rc = tr_cfg_parse_gss_names(client, json_object_get(jrealm, "gss_names"), &(client->gss_names));
350 if (call_rc!=TR_CFG_SUCCESS) {
351 tr_err("tr_cfg_parse_one_rp_client: could not parse gss_names.");
357 jfilt=json_object_get(jrealm, "filters");
359 new_filts=tr_cfg_parse_filters(tmp_ctx, jfilt, &call_rc);
360 if (call_rc!=TR_CFG_SUCCESS) {
361 tr_err("tr_cfg_parse_one_rp_client: could not parse filters.");
366 tr_debug("tr_cfg_parse_one_rp_client: no filters specified, using default filters.");
367 new_filts= tr_cfg_default_filters(tmp_ctx, realm, &call_rc);
368 if (call_rc!=TR_CFG_SUCCESS) {
369 tr_err("tr_cfg_parse_one_rp_client: could not set default filters.");
375 tr_rp_client_set_filters(client, new_filts);
382 if (*rc==TR_CFG_SUCCESS)
383 talloc_steal(mem_ctx, client);
389 talloc_free(tmp_ctx);
393 /* Determine whether the realm is an RP realm */
394 static int tr_cfg_is_rp_realm(json_t *jrealm)
396 /* Check that we have a gss name. */
397 if (NULL != json_object_get(jrealm, "gss_names"))
403 /* Parse any rp clients in the j_realms object. Ignores other realms. */
404 TR_RP_CLIENT *tr_cfg_parse_rp_clients(TALLOC_CTX *mem_ctx, json_t *jrealms, TR_CFG_RC *rc)
406 TALLOC_CTX *tmp_ctx=talloc_new(NULL);
407 TR_RP_CLIENT *clients=NULL;
408 TR_RP_CLIENT *new_client=NULL;
409 json_t *this_jrealm=NULL;
413 if ((jrealms==NULL) || (!json_is_array(jrealms))) {
414 tr_err("tr_cfg_parse_rp_clients: realms not an array");
415 *rc=TR_CFG_BAD_PARAMS;
419 for (ii=0; ii<json_array_size(jrealms); ii++) {
420 this_jrealm=json_array_get(jrealms, ii);
421 if (tr_cfg_is_rp_realm(this_jrealm)) {
422 new_client=tr_cfg_parse_one_rp_client(tmp_ctx, this_jrealm, rc);
423 if ((*rc)!=TR_CFG_SUCCESS) {
424 tr_err("tr_cfg_parse_rp_clients: error decoding realm entry %d", ii+1);
428 tr_rp_client_add(clients, new_client);
433 talloc_steal(mem_ctx, clients);
436 talloc_free(tmp_ctx);