+ talloc_steal(mem_ctx, gn);
+ *rc=TR_CFG_SUCCESS;
+
+ cleanup:
+ talloc_free(tmp_ctx);
+ if ((*rc!=TR_CFG_SUCCESS) && (gn!=NULL))
+ gn=NULL;
+ return gn;
+}
+
+/* default filter accepts realm and *.realm */
+static TR_FILTER_SET *tr_cfg_default_filters(TALLOC_CTX *mem_ctx, TR_NAME *realm, TR_CFG_RC *rc)
+{
+ TALLOC_CTX *tmp_ctx=talloc_new(NULL);
+ TR_FILTER *filt=NULL;
+ TR_FILTER_SET *filt_set=NULL;
+ TR_CONSTRAINT *cons=NULL;
+ TR_NAME *name=NULL;
+ TR_NAME *n_prefix=tr_new_name("*.");
+ TR_NAME *n_rp_realm_1=tr_new_name("rp_realm");
+ TR_NAME *n_rp_realm_2=tr_new_name("rp_realm");
+ TR_NAME *n_domain=tr_new_name("domain");
+ TR_NAME *n_realm=tr_new_name("realm");
+
+
+ if ((realm==NULL) || (rc==NULL)) {
+ tr_debug("tr_cfg_default_filters: invalid arguments.");
+ if (rc!=NULL)
+ *rc=TR_CFG_BAD_PARAMS;
+ goto cleanup;
+ }
+
+ if ((n_prefix==NULL) ||
+ (n_rp_realm_1==NULL) ||
+ (n_rp_realm_2==NULL) ||
+ (n_domain==NULL) ||
+ (n_realm==NULL)) {
+ tr_debug("tr_cfg_default_filters: unable to allocate names.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+
+ filt=tr_filter_new(tmp_ctx);
+ if (filt==NULL) {
+ tr_debug("tr_cfg_default_filters: could not allocate filter.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+ tr_filter_set_type(filt, TR_FILTER_TYPE_TID_INBOUND);
+ filt->lines[0]=tr_fline_new(filt);
+ if (filt->lines[0]==NULL) {
+ tr_debug("tr_cfg_default_filters: could not allocate filter line.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+
+ filt->lines[0]->action=TR_FILTER_ACTION_ACCEPT;
+ filt->lines[0]->specs[0]=tr_fspec_new(filt->lines[0]);
+ filt->lines[0]->specs[0]->field=n_rp_realm_1;
+ n_rp_realm_1=NULL; /* we don't own this name any more */
+
+ name=tr_dup_name(realm);
+ if (name==NULL) {
+ tr_debug("tr_cfg_default_filters: could not allocate realm name.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+ tr_fspec_add_match(filt->lines[0]->specs[0], name);
+ name=NULL; /* we no longer own the name */
+
+ /* now do the wildcard name */
+ filt->lines[0]->specs[1]=tr_fspec_new(filt->lines[0]);
+ filt->lines[0]->specs[1]->field=n_rp_realm_2;
+ n_rp_realm_2=NULL; /* we don't own this name any more */
+
+ if (NULL==(name=tr_name_cat(n_prefix, realm))) {
+ tr_debug("tr_cfg_default_filters: could not allocate wildcard realm name.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+
+ tr_fspec_add_match(filt->lines[0]->specs[1], name);
+ name=NULL; /* we no longer own the name */
+
+ /* domain constraint */
+ if (NULL==(cons=tr_constraint_new(filt->lines[0]))) {
+ tr_debug("tr_cfg_default_filters: could not allocate domain constraint.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+
+ cons->type=n_domain;
+ n_domain=NULL; /* belongs to the constraint now */
+ name=tr_dup_name(realm);
+ if (name==NULL) {
+ tr_debug("tr_cfg_default_filters: could not allocate realm name for domain constraint.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+ cons->matches[0]=name;
+ name=tr_name_cat(n_prefix, realm);
+ if (name==NULL) {
+ tr_debug("tr_cfg_default_filters: could not allocate wildcard realm name for domain constraint.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+ cons->matches[1]=name;
+ name=NULL;
+ filt->lines[0]->domain_cons=cons;
+
+
+ /* realm constraint */
+ if (NULL==(cons=tr_constraint_new(filt->lines[0]))) {
+ tr_debug("tr_cfg_default_filters: could not allocate realm constraint.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+
+ cons->type=n_realm;
+ n_realm=NULL; /* belongs to the constraint now */
+ name=tr_dup_name(realm);
+ if (name==NULL) {
+ tr_debug("tr_cfg_default_filters: could not allocate realm name for realm constraint.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+ cons->matches[0]=name;
+ name=tr_name_cat(n_prefix, realm);
+ if (name==NULL) {
+ tr_debug("tr_cfg_default_filters: could not allocate wildcard realm name for realm constraint.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+ cons->matches[1]=name;
+ name=NULL;
+ filt->lines[0]->realm_cons=cons;
+
+ /* put the filter in a set */
+ filt_set=tr_filter_set_new(tmp_ctx);
+ if ((filt_set==NULL)||(0!=tr_filter_set_add(filt_set, filt))) {
+ tr_debug("tr_cfg_default_filters: could not allocate filter set.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+ talloc_steal(mem_ctx, filt_set);
+
+cleanup:
+ talloc_free(tmp_ctx);
+
+ if (*rc!=TR_CFG_SUCCESS)
+ filt=NULL;
+
+ if (n_prefix!=NULL)
+ tr_free_name(n_prefix);
+ if (n_rp_realm_1!=NULL)
+ tr_free_name(n_rp_realm_1);
+ if (n_rp_realm_2!=NULL)
+ tr_free_name(n_rp_realm_2);
+ if (n_realm!=NULL)
+ tr_free_name(n_realm);
+ if (n_domain!=NULL)
+ tr_free_name(n_domain);
+ if (name!=NULL)
+ tr_free_name(name);
+
+ return filt_set;
+}
+
+/* parses rp client */
+static TR_RP_CLIENT *tr_cfg_parse_one_rp_client(TALLOC_CTX *mem_ctx, json_t *jrealm, TR_CFG_RC *rc)
+{
+ TALLOC_CTX *tmp_ctx=talloc_new(NULL);
+ TR_RP_CLIENT *client=NULL;
+ TR_CFG_RC call_rc=TR_CFG_ERROR;
+ TR_FILTER_SET *new_filts=NULL;
+ TR_NAME *realm=NULL;
+ json_t *jfilt=NULL;
+ json_t *jrealm_id=NULL;
+
+ *rc=TR_CFG_ERROR; /* default to error if not set */
+
+ if ((!jrealm) || (!rc)) {
+ tr_err("tr_cfg_parse_one_rp_client: Bad parameters.");
+ if (rc)
+ *rc=TR_CFG_BAD_PARAMS;
+ goto cleanup;
+ }
+
+ if ((NULL==(jrealm_id=json_object_get(jrealm, "realm"))) || (!json_is_string(jrealm_id))) {
+ tr_debug("tr_cfg_parse_one_rp_client: no realm ID found.");
+ *rc=TR_CFG_BAD_PARAMS;
+ goto cleanup;
+ }
+
+ tr_debug("tr_cfg_parse_one_rp_client: realm_id=\"%s\"", json_string_value(jrealm_id));
+ realm=tr_new_name(json_string_value(jrealm_id));
+ if (realm==NULL) {
+ tr_err("tr_cfg_parse_one_rp_client: could not allocate realm ID.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+
+ if (NULL==(client=tr_rp_client_new(tmp_ctx))) {
+ tr_err("tr_cfg_parse_one_rp_client: could not allocate rp client.");
+ *rc=TR_CFG_NOMEM;
+ goto cleanup;
+ }
+
+ client->gss_names=tr_cfg_parse_gss_names(client, json_object_get(jrealm, "gss_names"), &call_rc);
+
+ if (call_rc!=TR_CFG_SUCCESS) {
+ tr_err("tr_cfg_parse_one_rp_client: could not parse gss_names.");
+ *rc=TR_CFG_NOPARSE;
+ goto cleanup;
+ }
+
+ /* parse filters */
+ jfilt=json_object_get(jrealm, "filters");
+ if (jfilt!=NULL) {
+ new_filts=tr_cfg_parse_filters(tmp_ctx, jfilt, &call_rc);
+ if (call_rc!=TR_CFG_SUCCESS) {
+ tr_err("tr_cfg_parse_one_rp_client: could not parse filters.");
+ *rc=TR_CFG_NOPARSE;
+ goto cleanup;
+ }
+ } else {
+ tr_debug("tr_cfg_parse_one_rp_client: no filters specified, using default filters.");
+ new_filts= tr_cfg_default_filters(tmp_ctx, realm, &call_rc);
+ if (call_rc!=TR_CFG_SUCCESS) {
+ tr_err("tr_cfg_parse_one_rp_client: could not set default filters.");
+ *rc=TR_CFG_NOPARSE;
+ goto cleanup;
+ }
+ }
+
+ tr_rp_client_set_filters(client, new_filts);
+ *rc=TR_CFG_SUCCESS;
+
+ cleanup:
+ if (realm!=NULL)
+ tr_free_name(realm);
+
+ if (*rc==TR_CFG_SUCCESS)
+ talloc_steal(mem_ctx, client);
+ else {
+ talloc_free(client);
+ client=NULL;
+ }
+
+ talloc_free(tmp_ctx);
+ return client;
+}
+
+ /* Determine whether the realm is an RP realm */
+static int tr_cfg_is_rp_realm(json_t *jrealm)
+{
+ /* Check that we have a gss name. */
+ if (NULL != json_object_get(jrealm, "gss_names"))
+ return 1;
+ else
+ return 0;
+}
+
+/* Parse any rp clients in the j_realms object. Ignores other realms. */
+static TR_RP_CLIENT *tr_cfg_parse_rp_clients(TALLOC_CTX *mem_ctx, json_t *jrealms, TR_CFG_RC *rc)
+{
+ TALLOC_CTX *tmp_ctx=talloc_new(NULL);
+ TR_RP_CLIENT *clients=NULL;
+ TR_RP_CLIENT *new_client=NULL;
+ json_t *this_jrealm=NULL;
+ int ii=0;
+
+ *rc=TR_CFG_ERROR;
+ if ((jrealms==NULL) || (!json_is_array(jrealms))) {
+ tr_err("tr_cfg_parse_rp_clients: realms not an array");
+ *rc=TR_CFG_BAD_PARAMS;
+ goto cleanup;
+ }
+
+ for (ii=0; ii<json_array_size(jrealms); ii++) {
+ this_jrealm=json_array_get(jrealms, ii);
+ if (tr_cfg_is_rp_realm(this_jrealm)) {
+ new_client=tr_cfg_parse_one_rp_client(tmp_ctx, this_jrealm, rc);
+ if ((*rc)!=TR_CFG_SUCCESS) {
+ tr_err("tr_cfg_parse_rp_clients: error decoding realm entry %d", ii+1);
+ *rc=TR_CFG_NOPARSE;
+ goto cleanup;
+ }
+ tr_rp_client_add(clients, new_client);
+ }
+ }
+
+ *rc=TR_CFG_SUCCESS;
+ talloc_steal(mem_ctx, clients);
+
+cleanup:
+ talloc_free(tmp_ctx);
+ return clients;
+}
+
+/* takes a talloc context, but currently does not use it */
+static TR_NAME *tr_cfg_parse_org_name(TALLOC_CTX *mem_ctx, json_t *j_org, TR_CFG_RC *rc)
+{
+ TR_NAME *name=NULL;
+
+ if ((j_org==NULL) || (rc==NULL) || (!json_is_string(j_org))) {
+ tr_debug("tr_cfg_parse_org_name: Bad parameters.");
+ if (rc!=NULL)
+ *rc = TR_CFG_BAD_PARAMS; /* fill in return value if we can */
+ return NULL;
+ }
+
+ name=tr_new_name(json_string_value(j_org));
+ if (name==NULL)
+ *rc=TR_CFG_NOMEM;
+ else
+ *rc=TR_CFG_SUCCESS;
+ return name;
+}
+
+static TR_CFG_RC tr_cfg_parse_one_local_org(TR_CFG *trc, json_t *jlorg)
+{
+ TALLOC_CTX *tmp_ctx=talloc_new(NULL);
+ TR_CFG_RC retval=TR_CFG_ERROR; /* our return code */
+ TR_CFG_RC rc=TR_CFG_ERROR; /* return code from functions we call */
+ TR_NAME *org_name=NULL;
+ json_t *j_org=NULL;
+ json_t *j_realms=NULL;
+ TR_IDP_REALM *new_idp_realms=NULL;
+ TR_RP_CLIENT *new_rp_clients=NULL;
+
+ tr_debug("tr_cfg_parse_one_local_org: parsing local organization");
+
+ /* get organization_name (optional) */
+ if (NULL==(j_org=json_object_get(jlorg, "organization_name"))) {
+ tr_debug("tr_cfg_parse_one_local_org: organization_name unspecified");
+ } else {
+ org_name=tr_cfg_parse_org_name(tmp_ctx, j_org, &rc);
+ if (rc==TR_CFG_SUCCESS) {
+ tr_debug("tr_cfg_parse_one_local_org: organization_name=\"%.*s\"",
+ org_name->len,
+ org_name->buf);
+ /* we don't actually do anything with this, but we could */
+ tr_free_name(org_name);
+ org_name=NULL;
+ }
+ }
+
+ /* Now get realms. Allow this to be missing; even though that is a pointless organization entry,
+ * it's harmless. Report a warning because that might be unintentional. */
+ if (NULL==(j_realms=json_object_get(jlorg, "realms"))) {
+ tr_warning("tr_cfg_parse_one_local_org: warning - no realms in this local organization");
+ } else {
+ /* Allocate in the tmp_ctx so these will be cleaned up if we do not complete successfully. */
+ new_idp_realms=tr_cfg_parse_idp_realms(tmp_ctx, j_realms, &rc);
+ if (rc!=TR_CFG_SUCCESS)
+ goto cleanup;
+
+ new_rp_clients=tr_cfg_parse_rp_clients(tmp_ctx, j_realms, &rc);
+ if (rc!=TR_CFG_SUCCESS)
+ goto cleanup;
+ }
+ retval=TR_CFG_SUCCESS;
+
+cleanup:
+ /* if we succeeded, link things to the configuration and move out of tmp context */
+ if (retval==TR_CFG_SUCCESS) {
+ if (new_idp_realms!=NULL) {
+ tr_idp_realm_add(trc->ctable->idp_realms, new_idp_realms); /* fixes talloc contexts except for head*/
+ talloc_steal(trc, trc->ctable->idp_realms); /* make sure the head is in the right context */
+ }
+
+ if (new_rp_clients!=NULL) {
+ tr_rp_client_add(trc->rp_clients, new_rp_clients); /* fixes talloc contexts */
+ talloc_steal(trc, trc->rp_clients); /* make sure head is in the right context */
+ }
+ }
+
+ talloc_free(tmp_ctx);