Full support for rp_permitted filters using new filter structures, etc.

[trust_router.git] / tr / tr_main.c

diff --git a/tr/tr_main.c b/tr/tr_main.c
index e141bd0..70d8b06 100644 (file)
--- a/tr/tr_main.c
+++ b/tr/tr_main.c
@@ -36,10 +36,12 @@
 #include <jansson.h>
 
 #include <tr.h>
+#include <tr_filter.h>
 #include <trust_router/tid.h>
 #include <tr_config.h>
 #include <tr_comm.h>
 #include <tr_idp.h>
+#include <tr_rp.h>
 
 /* Structure to hold TR instance and original request in one cookie */
 typedef struct tr_resp_cookie {
@@ -64,7 +66,7 @@ static void tr_tidc_resp_handler (TIDC_INSTANCE *tidc,
   return;
 }
 
-static int tr_tids_req_handler (TIDS_INSTANCE * tids,
+static int tr_tids_req_handler (TIDS_INSTANCE *tids,
                      TID_REQ *orig_req, 
                      TID_RESP **resp,
                      void *tr)
@@ -76,9 +78,11 @@ static int tr_tids_req_handler (TIDS_INSTANCE * tids,
   TID_REQ *fwd_req = NULL;
   TR_COMM *cfg_comm = NULL;
   TR_COMM *cfg_apc = NULL;
-  int rc;
+  TR_CONSTRAINT *ocons = NULL;
+  int oaction = TR_FILTER_ACTION_REJECT;
+  int rc = 0;
 
-  if ((!tids) || (!orig_req) || (!resp) || (!(*resp))) {
+  if ((!tids) || (!orig_req) || (!resp) || (!(*resp)) || (!tr)) {
     fprintf(stderr, "tids_req_handler: Bad parameters\n");
     return -1;
   }
@@ -100,6 +104,24 @@ static int tr_tids_req_handler (TIDS_INSTANCE * tids,
     return -1;
   }
 
+  /* Check that the rp_realm matches the filter for the GSS name that 
+   * was received. */
+
+  if ((!((TR_INSTANCE *)tr)->rp_gss) || 
+      (!((TR_INSTANCE *)tr)->rp_gss->filter)) {
+    fprintf(stderr, "tr_tids_req_handler: No GSS name for incoming request.\n");
+    tids_send_err_response(tids, orig_req, "No GSS name for request");
+    return -1;
+  }
+
+  if ((TR_FILTER_NO_MATCH == tr_filter_process_rp_permitted(orig_req->rp_realm, ((TR_INSTANCE *)tr)->rp_gss->filter, NULL, &ocons, &oaction)) ||
+      (TR_FILTER_ACTION_REJECT == oaction)) {
+    fprintf(stderr, "tr_tids_req_handler: RP realm (%s) does not match RP Realm filter for GSS name\n");
+    tids_send_err_response(tids, orig_req, "RP Realm filter error");
+  }
+
+  /* TBD -- add constraints to request for further forwarding. */
+
   /* Check that the rp_realm and target_realm are members of the community in the request */
   if (NULL == (tr_find_comm_rp(cfg_comm, orig_req->rp_realm))) {
     fprintf(stderr, "tr_tids_req_hander: RP Realm (%s) not member of community (%s).\n", orig_req->rp_realm->buf, orig_req->comm->buf);
@@ -192,29 +214,25 @@ static int tr_tids_req_handler (TIDS_INSTANCE * tids,
   return 0;
 }
 
-static int tr_tidc_gss_handler(gss_name_t *clientName, TR_NAME *displayName,
+static int tr_tids_gss_handler(gss_name_t client_name, TR_NAME *gss_name,
                        void *tr)
 {
-  RP_CLIENT *rp;
+  TR_RP_CLIENT *rp;
 
-  if ((!client_name) || (!display_name) || (!tr)) {
+  if ((!client_name) || (!gss_name) || (!tr)) {
     fprintf(stderr, "tr_tidc_gss_handler: Bad parameters.\n");
     return -1;
   }
   
   /* look up the RP client matching the GSS name */
   if ((NULL == (rp = tr_rp_client_lookup(tr, gss_name)))) {
-    fprintf(stderr, "tr_tids_gss_handler: Unknown GSS name %s", gss_name->buf);
-    return -1;
-  }
-
-  /* check if the gss name matches the filter in the rp realm */
-  if (!tr_prefix_wildcard_match(gss_name->buf, rp->rp_match->buf)) {
-    fprintf(stderr, "tr_tids_gss_handler: RP realm does not match, realm %s, math %s\n", gss_name_buf, rp->rp_match->buf);
+    fprintf(stderr, "tr_tids_gss_handler: Unknown GSS name %s\n", gss_name->buf);
     return -1;
   }
 
-  /* Otherwise, all is well... */
+  /* Store the rp client in the TR_INSTANCE structure for now... 
+   * TBD -- fix me for new tasking model. */
+  ((TR_INSTANCE *)tr)->rp_gss = rp;
   return 0;
 }