#include <stdio.h>
#include <stdlib.h>
#include <string.h>
-#include <strings.h>
#include <talloc.h>
#include <assert.h>
#include <trp_internal.h>
#include <tid_internal.h>
-const TR_FILTER_TYPE tr_filter_types[] = {
- TR_FILTER_TYPE_TID_INBOUND,
- TR_FILTER_TYPE_TRP_INBOUND,
- TR_FILTER_TYPE_TRP_OUTBOUND
-};
-const size_t tr_num_filter_types=sizeof(tr_filter_types)/sizeof(tr_filter_types[0]);
-static const char *tr_filter_type_strings[] = {
- "tid_inbound",
- "trp_inbound",
- "trp_outbound"
-};
-
-const char *tr_filter_type_to_string(TR_FILTER_TYPE t) {
- int ii;
- for (ii=0; ii<tr_num_filter_types;ii++) {
- if (t==tr_filter_types[ii])
- return tr_filter_type_strings[ii];
- }
- return NULL;
-}
-
-TR_FILTER_TYPE tr_filter_type_from_string(const char *s)
-{
- int ii;
- for (ii=0; ii<tr_num_filter_types; ii++) {
- if (strcasecmp(s, tr_filter_type_strings[ii])==0)
- return tr_filter_types[ii];
- }
- return TR_FILTER_TYPE_UNKNOWN;
-}
-
/* Function types for handling filter fields generally. All target values
* are represented as strings in a TR_NAME.
*/
-typedef int (*TR_FILTER_FIELD_CMP)(void *target, TR_NAME *val); /* returns 1 on match, 0 on no match */
-typedef TR_NAME *(*TR_FILTER_FIELD_GET)(void *target); /* returns string form of the field value */
+typedef int (*TR_FILTER_FIELD_CMP)(TR_FILTER_TARGET *target, TR_NAME *val); /* returns 1 on match, 0 on no match */
+typedef TR_NAME *(*TR_FILTER_FIELD_GET)(TR_FILTER_TARGET *target); /* returns string form of the field value */
/* static handler prototypes */
-static int tr_ff_cmp_tid_rp_realm(void *rp_req_arg, TR_NAME *val);
-static TR_NAME *tr_ff_get_tid_rp_realm(void *rp_req_arg);
-static int tr_ff_cmp_trp_info_type(void *inforec_arg, TR_NAME *val);
-static TR_NAME *tr_ff_get_trp_info_type(void *inforec_arg);
+static int tr_ff_cmp_tid_rp_realm(TR_FILTER_TARGET *target, TR_NAME *val);
+static TR_NAME *tr_ff_get_tid_rp_realm(TR_FILTER_TARGET *target);
+static int tr_ff_cmp_trp_info_type(TR_FILTER_TARGET *target, TR_NAME *val);
+static TR_NAME *tr_ff_get_trp_info_type(TR_FILTER_TARGET *target);
/**
* Filter field handler table
return NULL;
}
-static int tr_ff_cmp_tid_rp_realm(void *rp_req_arg, TR_NAME *val)
+static TR_FILTER_TARGET *tr_filter_target_new(TALLOC_CTX *mem_ctx)
{
- TID_REQ *req=talloc_get_type_abort(rp_req_arg, TID_REQ);
+ TR_FILTER_TARGET *target=talloc(mem_ctx, TR_FILTER_TARGET);
+ if (target) {
+ target->trp_inforec=NULL;
+ target->comm=NULL;
+ target->realm=NULL;
+ target->tid_req=NULL;
+ }
+ return target;
+}
+void tr_filter_target_free(TR_FILTER_TARGET *target)
+{
+ talloc_free(target);
+}
+
+/**
+ * Create a filter target for a TID request. Does not change the context of the request,
+ * so this is only valid until that is freed.
+ *
+ * @param mem_ctx talloc context for the object
+ * @param req TID request object
+ * @return pointer to a TR_FILTER_TARGET structure, or null on allocation failure
+ */
+TR_FILTER_TARGET *tr_filter_target_tid_req(TALLOC_CTX *mem_ctx, TID_REQ *req)
+{
+ TR_FILTER_TARGET *target=tr_filter_target_new(mem_ctx);
+ if (target)
+ target->tid_req=req; /* borrowed, not adding to our context */
+ return target;
+}
+
+/**
+ * Create a filter target for a TRP inforec. Does not change the context of the inforec or duplicate TR_NAMEs,
+ * so this is only valid until those are freed.
+ *
+ * @param mem_ctx talloc context for the object
+ * @param inforec TRP inforec
+ * @param realm realm name
+ * @param comm community name
+ * @return pointer to a TR_FILTER_TARGET structure, or null on allocation failure
+ */
+TR_FILTER_TARGET *tr_filter_target_trp_inforec(TALLOC_CTX *mem_ctx, TRP_INFOREC *inforec, TR_NAME *realm, TR_NAME *comm)
+{
+ TR_FILTER_TARGET *target=tr_filter_target_new(mem_ctx);
+ if (target) {
+ target->trp_inforec = inforec; /* borrowed, not adding to our context */
+ target->realm=realm;
+ target->comm=comm;
+ }
+ return target;
+}
+
+static int tr_ff_cmp_tid_rp_realm(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+ TID_REQ *req=target->tid_req;
assert(req);
return 0==tr_name_cmp(val, req->rp_realm);
}
-static TR_NAME *tr_ff_get_tid_rp_realm(void *rp_req_arg)
+static TR_NAME *tr_ff_get_tid_rp_realm(TR_FILTER_TARGET *target)
{
- TID_REQ *req=talloc_get_type_abort(rp_req_arg, TID_REQ);
+ TID_REQ *req=target->tid_req;
assert(req);
return tr_dup_name(req->rp_realm);
}
-static int tr_ff_cmp_trp_info_type(void *inforec_arg, TR_NAME *val)
+static int tr_ff_cmp_trp_info_type(TR_FILTER_TARGET *target, TR_NAME *val)
{
- TRP_INFOREC *inforec=talloc_get_type_abort(inforec_arg, TRP_INFOREC);
+ TRP_INFOREC *inforec=target->trp_inforec;
char *valstr=NULL;
int val_type=0;
return (val_type==inforec->type);
}
-static TR_NAME *tr_ff_get_trp_info_type(void *inforec_arg)
+static TR_NAME *tr_ff_get_trp_info_type(TR_FILTER_TARGET *target)
{
- TRP_INFOREC *inforec=talloc_get_type_abort(inforec_arg, TRP_INFOREC);
+ TRP_INFOREC *inforec=target->trp_inforec;
return tr_new_name(trp_inforec_type_to_string(inforec->type));
}
* @param out_action Action to be carried out (output)
* @return TR_FILTER_MATCH or TR_FILTER_NO_MATCH
*/
-int tr_filter_apply(void *target,
+int tr_filter_apply(TR_FILTER_TARGET *target,
TR_FILTER *filt,
TR_CONSTRAINT_SET **constraints,
TR_FILTER_ACTION *out_action)
/* Step through filter lines looking for a match. If a line matches, retval
* will be set to TR_FILTER_MATCH, so stop then. */
for (ii=0, retval=TR_FILTER_NO_MATCH;
- (ii<TR_MAX_FILTER_LINES) && (retval==TR_FILTER_NO_MATCH);
+ ii<TR_MAX_FILTER_LINES;
ii++) {
/* skip empty lines (these shouldn't really happen) */
if (filt->lines[ii]==NULL)
break; /* give up on this filter line */
}
}
+
+ if (retval==TR_FILTER_MATCH)
+ break;
}
if (retval==TR_FILTER_MATCH) {
return retval;
}
-int tr_filter_process_rp_permitted(TR_NAME *rp_realm,
- TR_FILTER *rpp_filter,
- TR_CONSTRAINT_SET *in_constraints,
- TR_CONSTRAINT_SET **out_constraints,
- TR_FILTER_ACTION *out_action)
-{
- int i = 0, j = 0;
-
- *out_action = TR_FILTER_ACTION_REJECT;
- *out_constraints = NULL;
-
- /* If this isn't a valid rp_permitted filter, return no match. */
- if ((!rpp_filter) ||
- (TR_FILTER_TYPE_TID_INBOUND != rpp_filter->type)) {
- return TR_FILTER_NO_MATCH;
- }
-
- /* Check if there is a match for this filter. */
- for (i = 0; i < TR_MAX_FILTER_LINES; i++) {
- for (j = 0; j < TR_MAX_FILTER_SPECS; j++) {
-
- if ((rpp_filter->lines[i]) &&
- (rpp_filter->lines[i]->specs[j]) &&
- (tr_fspec_matches(rpp_filter->lines[i]->specs[j], 0, rp_realm))) { /* todo: fix or remove */
- *out_action = rpp_filter->lines[i]->action;
- *out_constraints = in_constraints;
- if (rpp_filter->lines[i]->realm_cons)
- tr_constraint_add_to_set(out_constraints,
- rpp_filter->lines[i]->realm_cons);
- if (rpp_filter->lines[i]->domain_cons)
- tr_constraint_add_to_set(out_constraints,
- rpp_filter->lines[i]->domain_cons);
-
- return TR_FILTER_MATCH;
- }
- }
- }
- /* If there is no match, indicate that. */
- return TR_FILTER_NO_MATCH;
-}
-
void tr_fspec_free(TR_FSPEC *fspec)
{
talloc_free(fspec);
static int tr_fspec_destructor(void *obj)
{
TR_FSPEC *fspec = talloc_get_type_abort(obj, TR_FSPEC);
+ size_t ii;
if (fspec->field != NULL)
tr_free_name(fspec->field);
- if (fspec->match != NULL)
- tr_free_name(fspec->match);
+ for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++) {
+ if (fspec->match[ii] != NULL)
+ tr_free_name(fspec->match[ii]);
+ }
return 0;
}
TR_FSPEC *tr_fspec_new(TALLOC_CTX *mem_ctx)
{
TR_FSPEC *fspec = talloc(mem_ctx, TR_FSPEC);
+ size_t ii=0;
if (fspec != NULL) {
fspec->field = NULL;
- fspec->match = NULL;
- talloc_set_destructor((void *) fspec, tr_fspec_destructor);
+ for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++)
+ fspec->match[ii] = NULL;
+
+ talloc_set_destructor((void *)fspec, tr_fspec_destructor);
}
return fspec;
}
-void tr_fspec_set_match(TR_FSPEC *fspec, TR_NAME *match)
+void tr_fspec_add_match(TR_FSPEC *fspec, TR_NAME *match)
{
- if (fspec->match != NULL)
- tr_free_name(fspec->match);
- fspec->match = match;
+ size_t ii;
+ for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++) {
+ if (fspec->match[ii]==NULL) {
+ fspec->match[ii]=match;
+ break;
+ }
+ }
+ /* TODO: handle case that adding the match failed */
}
/* returns 1 if the spec matches */
-int tr_fspec_matches(TR_FSPEC *fspec, TR_FILTER_TYPE ftype, void *target)
+int tr_fspec_matches(TR_FSPEC *fspec, TR_FILTER_TYPE ftype, TR_FILTER_TARGET *target)
{
struct tr_filter_field_entry *field=NULL;
TR_NAME *name=NULL;
+ size_t ii=0;
- if ((fspec==NULL) || (fspec->match==NULL))
+ if (fspec==NULL)
return 0;
/* Look up how to handle the requested field */
return 0;
name=field->get(target);
- return ((fspec->match != NULL) &&
- (0 != tr_name_prefix_wildcard_match(name, fspec->match)));
+ for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++) {
+ if (fspec->match[ii]!=NULL) {
+ if (tr_name_prefix_wildcard_match(name, fspec->match[ii]))
+ return 1;
+ }
+ }
+ return 0;
}
void tr_fline_free(TR_FLINE *fline)
{
return filt->type;
}
+
+/**
+ * Check that a filter is valid, i.e., can be processed.
+ *
+ * @param filt Filter to verify
+ * @return 1 if the filter is valid, 0 otherwise
+ */
+int tr_filter_validate(TR_FILTER *filt)
+{
+ size_t ii=0, jj=0, kk=0;
+
+ if (!filt)
+ return 0;
+
+ /* check that we recognize the type */
+ switch(filt->type) {
+ case TR_FILTER_TYPE_TID_INBOUND:
+ case TR_FILTER_TYPE_TRP_INBOUND:
+ case TR_FILTER_TYPE_TRP_OUTBOUND:
+ break;
+
+ default:
+ return 0; /* if we get here, either TR_FILTER_TYPE_UNKNOWN or an invalid value was found */
+ }
+ for (ii=0; ii<TR_MAX_FILTER_LINES; ii++) {
+ if (filt->lines[ii]==NULL)
+ continue; /* an empty filter line is valid */
+
+ /* check that we recognize the action */
+ switch(filt->lines[ii]->action) {
+ case TR_FILTER_ACTION_ACCEPT:
+ case TR_FILTER_ACTION_REJECT:
+ break;
+
+ default:
+ /* if we get here, either TR_FILTER_ACTION_UNKNOWN or an invalid value was found */
+ return 0;
+ }
+
+ for (jj=0; jj<TR_MAX_FILTER_SPECS; jj++) {
+ if (filt->lines[ii]->specs[jj]==NULL)
+ continue; /* an empty filter spec is valid */
+
+ if (!tr_filter_validate_spec_field(filt->type, filt->lines[ii]->specs[jj]))
+ return 0;
+
+ /* check that at least one match is non-null */
+ for (kk=0; kk<TR_MAX_FILTER_SPEC_MATCHES; kk++) {
+ if (filt->lines[ii]->specs[jj]->match[kk]!=NULL)
+ break;
+ }
+ if (kk==TR_MAX_FILTER_SPEC_MATCHES)
+ return 0;
+ }
+ }
+
+ /* We ran the gauntlet. Success! */
+ return 1;
+}
+
+int tr_filter_validate_spec_field(TR_FILTER_TYPE ftype, TR_FSPEC *fspec)
+{
+ if ((fspec==NULL) || (tr_filter_field_entry(ftype, fspec->field)==NULL))
+ return 0; /* unknown field */
+
+ return 1;
+}
+
+/**
+ * Allocate a new filter set.
+ *
+ * @param mem_ctx Talloc context for the new set
+ * @return Pointer to new set, or null on error
+ */
+TR_FILTER_SET *tr_filter_set_new(TALLOC_CTX *mem_ctx)
+{
+ TR_FILTER_SET *set=talloc(mem_ctx, TR_FILTER_SET);
+ if (set!=NULL) {
+ set->next=NULL;
+ set->this=NULL;
+ }
+ return set;
+}
+
+/**
+ * Free a filter set
+ *
+ * @param fs Filter set to free
+ */
+void tr_filter_set_free(TR_FILTER_SET *fs)
+{
+ talloc_free(fs);
+}
+
+/**
+ * Find the tail of the filter set linked list.
+ *
+ * @param set Set to find tail of
+ * @return Last element in the list
+ */
+static TR_FILTER_SET *tr_filter_set_tail(TR_FILTER_SET *set)
+{
+ while (set->next)
+ set=set->next;
+ return set;
+}
+
+/**
+ * Add new filter to filter set.
+ *
+ * @param set Filter set
+ * @param new New filter to add
+ * @return 0 on success, nonzero on error
+ */
+int tr_filter_set_add(TR_FILTER_SET *set, TR_FILTER *new)
+{
+ TR_FILTER_SET *tail=NULL;
+
+ if (set->this==NULL)
+ tail=set;
+ else {
+ tail=tr_filter_set_tail(set);
+ tail->next=tr_filter_set_new(set);
+ if (tail->next==NULL)
+ return 1;
+ tail=tail->next;
+ }
+ tail->this=new;
+ talloc_steal(tail, new);
+ return 0;
+}
+
+/**
+ * Find a filter of a given type in the filter set. If there are multiple, returns the first one.
+ *
+ * @param set Filter set to search
+ * @param type Type of filter to find
+ * @return Borrowed pointer to the filter, or null if no filter of that type is found
+ */
+TR_FILTER *tr_filter_set_get(TR_FILTER_SET *set, TR_FILTER_TYPE type)
+{
+ TR_FILTER_SET *cur=set;
+ while(cur!=NULL) {
+ if ((cur->this != NULL) && (cur->this->type == type))
+ return cur->this;
+ cur=cur->next;
+ }
+ return NULL;
+}
+
+TR_FILTER_TYPE filter_type[]={TR_FILTER_TYPE_TID_INBOUND,
+ TR_FILTER_TYPE_TRP_INBOUND,
+ TR_FILTER_TYPE_TRP_OUTBOUND};
+const char *filter_label[]={"tid_inbound",
+ "trp_inbound",
+ "trp_outbound"};
+size_t num_filter_types=sizeof(filter_type)/sizeof(filter_type[0]);
+
+const char *tr_filter_type_to_string(TR_FILTER_TYPE ftype)
+{
+ size_t ii=0;
+
+ for (ii=0; ii<num_filter_types; ii++) {
+ if (ftype==filter_type[ii])
+ return filter_label[ii];
+ }
+ return "unknown";
+}
+
+TR_FILTER_TYPE tr_filter_type_from_string(const char *s)
+{
+ size_t ii=0;
+
+ for(ii=0; ii<num_filter_types; ii++) {
+ if (0==strcmp(s, filter_label[ii]))
+ return filter_type[ii];
+ }
+ return TR_FILTER_TYPE_UNKNOWN;
+}
+
projects / trust_router.git / blobdiff