X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=common%2Ftr_filter.c;h=1df9aa49c1b397fb80f745a94b6e750e58ca4ca6;hb=b5117dd88f660ee157de3cf96f8fb6d952ac342a;hp=892eb813abc4db4b4c8a396b053f389ac3572919;hpb=e71ac4f7f1666dff5b21c9e6a57bf2a01f9ab469;p=trust_router.git

diff --git a/common/tr_filter.c b/common/tr_filter.c
index 892eb81..1df9aa4 100644
--- a/common/tr_filter.c
+++ b/common/tr_filter.c
@@ -41,55 +41,24 @@
 #include <tr_filter.h>
 #include <trp_internal.h>
 #include <tid_internal.h>
+#include <tr_inet_util.h>
+#include <tr_debug.h>
 
 /* Function types for handling filter fields generally. All target values
  * are represented as strings in a TR_NAME.
  */
-typedef int (*TR_FILTER_FIELD_CMP)(TR_FILTER_TARGET *target, TR_NAME *val); /* returns 1 on match, 0 on no match */
-typedef TR_NAME *(*TR_FILTER_FIELD_GET)(TR_FILTER_TARGET *target); /* returns string form of the field value */
 
-/* static handler prototypes */
-static int tr_ff_cmp_tid_rp_realm(TR_FILTER_TARGET *target, TR_NAME *val);
-static TR_NAME *tr_ff_get_tid_rp_realm(TR_FILTER_TARGET *target);
-static int tr_ff_cmp_trp_info_type(TR_FILTER_TARGET *target, TR_NAME *val);
-static TR_NAME *tr_ff_get_trp_info_type(TR_FILTER_TARGET *target);
-
-/**
- * Filter field handler table
- */
-struct tr_filter_field_entry {
-    TR_FILTER_TYPE filter_type;
-    const char *name;
-    TR_FILTER_FIELD_CMP cmp;
-    TR_FILTER_FIELD_GET get;
-};
-static struct tr_filter_field_entry tr_filter_field_table[] = {
-    {TR_FILTER_TYPE_TID_INBOUND, "rp_realm", tr_ff_cmp_tid_rp_realm, tr_ff_get_tid_rp_realm},
-    {TR_FILTER_TYPE_TRP_INBOUND, "info_type", tr_ff_cmp_trp_info_type, tr_ff_get_trp_info_type},
-    {TR_FILTER_TYPE_TRP_OUTBOUND, "info_type", tr_ff_cmp_trp_info_type, tr_ff_get_trp_info_type},
-    {TR_FILTER_TYPE_UNKNOWN, NULL } /* This must be the final entry */
-};
-
-static struct tr_filter_field_entry *tr_filter_field_entry(TR_FILTER_TYPE filter_type, TR_NAME *field_name)
-{
-  unsigned int ii;
-
-  for (ii=0; tr_filter_field_table[ii].filter_type!=TR_FILTER_TYPE_UNKNOWN; ii++) {
-    if ((tr_filter_field_table[ii].filter_type==filter_type)
-        && (tr_name_cmp_str(field_name, tr_filter_field_table[ii].name)==0)) {
-      return tr_filter_field_table+ii;
-    }
-  }
-  return NULL;
-}
+/* CMP functions return values like strcmp: 0 on match, <0 on target<val, >0 on target>val */
+typedef int (*TR_FILTER_FIELD_CMP)(TR_FILTER_TARGET *target, TR_NAME *val);
+/* get functions return TR_NAME format of the field value. Caller must free it. */
+typedef TR_NAME *(*TR_FILTER_FIELD_GET)(TR_FILTER_TARGET *target);
 
 static TR_FILTER_TARGET *tr_filter_target_new(TALLOC_CTX *mem_ctx)
 {
   TR_FILTER_TARGET *target=talloc(mem_ctx, TR_FILTER_TARGET);
   if (target) {
     target->trp_inforec=NULL;
-    target->comm=NULL;
-    target->realm=NULL;
+    target->trp_upd=NULL;
     target->tid_req=NULL;
   }
   return target;
@@ -120,36 +89,32 @@ TR_FILTER_TARGET *tr_filter_target_tid_req(TALLOC_CTX *mem_ctx, TID_REQ *req)
  * so this is only valid until those are freed.
  *
  * @param mem_ctx talloc context for the object
+ * @param upd Update containing the TRP inforec
  * @param inforec TRP inforec
- * @param realm realm name
- * @param comm community name
  * @return pointer to a TR_FILTER_TARGET structure, or null on allocation failure
  */
-TR_FILTER_TARGET *tr_filter_target_trp_inforec(TALLOC_CTX *mem_ctx, TRP_INFOREC *inforec, TR_NAME *realm, TR_NAME *comm)
+TR_FILTER_TARGET *tr_filter_target_trp_inforec(TALLOC_CTX *mem_ctx, TRP_UPD *upd, TRP_INFOREC *inforec)
 {
   TR_FILTER_TARGET *target=tr_filter_target_new(mem_ctx);
   if (target) {
     target->trp_inforec = inforec; /* borrowed, not adding to our context */
-    target->realm=realm;
-    target->comm=comm;
+    target->trp_upd=upd;
   }
   return target;
 }
 
+/** Handler functions for TID RP_REALM field */
 static int tr_ff_cmp_tid_rp_realm(TR_FILTER_TARGET *target, TR_NAME *val)
 {
-  TID_REQ *req=target->tid_req;
-  assert(req);
-  return 0==tr_name_cmp(val, req->rp_realm);
+  return tr_name_cmp(tid_req_get_rp_realm(target->tid_req), val);
 }
 
 static TR_NAME *tr_ff_get_tid_rp_realm(TR_FILTER_TARGET *target)
 {
-  TID_REQ *req=target->tid_req;
-  assert(req);
-  return tr_dup_name(req->rp_realm);
+  return tr_dup_name(tid_req_get_rp_realm(target->tid_req));
 }
 
+/** Handler functions for TRP info_type field */
 static int tr_ff_cmp_trp_info_type(TR_FILTER_TARGET *target, TR_NAME *val)
 {
   TRP_INFOREC *inforec=target->trp_inforec;
@@ -167,6 +132,7 @@ static int tr_ff_cmp_trp_info_type(TR_FILTER_TARGET *target, TR_NAME *val)
   val_type = trp_inforec_type_from_string(valstr);
   free(valstr);
 
+  /* we do not define an ordering of info types */
   return (val_type==inforec->type);
 }
 
@@ -176,6 +142,299 @@ static TR_NAME *tr_ff_get_trp_info_type(TR_FILTER_TARGET *target)
   return tr_new_name(trp_inforec_type_to_string(inforec->type));
 }
 
+/** Handlers for TRP realm field */
+static int tr_ff_cmp_trp_realm(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(trp_upd_get_realm(target->trp_upd), val);
+}
+
+static TR_NAME *tr_ff_get_trp_realm(TR_FILTER_TARGET *target)
+{
+  return tr_dup_name(trp_upd_get_realm(target->trp_upd));
+}
+
+/** Handlers for TID realm field */
+static int tr_ff_cmp_tid_realm(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(tid_req_get_realm(target->tid_req), val);
+}
+
+static TR_NAME *tr_ff_get_tid_realm(TR_FILTER_TARGET *target)
+{
+  return tr_dup_name(tid_req_get_realm(target->tid_req));
+}
+
+/** Handlers for TRP community field */
+static int tr_ff_cmp_trp_comm(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(trp_upd_get_comm(target->trp_upd), val);
+}
+
+static TR_NAME *tr_ff_get_trp_comm(TR_FILTER_TARGET *target)
+{
+  return tr_dup_name(trp_upd_get_comm(target->trp_upd));
+}
+
+/** Handlers for TID community field */
+static int tr_ff_cmp_tid_comm(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(tid_req_get_comm(target->tid_req), val);
+}
+
+static TR_NAME *tr_ff_get_tid_comm(TR_FILTER_TARGET *target)
+{
+  return tr_dup_name(tid_req_get_comm(target->tid_req));
+}
+
+/** Handlers for TRP community_type field */
+static TR_NAME *tr_ff_get_trp_comm_type(TR_FILTER_TARGET *target)
+{
+  TR_NAME *type=NULL;
+
+  switch(trp_inforec_get_comm_type(target->trp_inforec)) {
+    case TR_COMM_APC:
+      type=tr_new_name("apc");
+      break;
+    case TR_COMM_COI:
+      type=tr_new_name("coi");
+      break;
+    default:
+      type=NULL;
+      break; /* unknown types always fail */
+  }
+
+  return type;
+}
+
+static int tr_ff_cmp_trp_comm_type(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  TR_NAME *type=tr_ff_get_trp_comm_type(target);
+  int retval=0;
+
+  if (type==NULL)
+    retval=1;
+  else {
+    retval = tr_name_cmp(val, type);
+    tr_free_name(type);
+  }
+  return retval;
+}
+
+/** Handlers for TRP realm_role field */
+static TR_NAME *tr_ff_get_trp_realm_role(TR_FILTER_TARGET *target)
+{
+  TR_NAME *type=NULL;
+
+  switch(trp_inforec_get_role(target->trp_inforec)) {
+    case TR_ROLE_IDP:
+      type=tr_new_name("idp");
+      break;
+    case TR_ROLE_RP:
+      type=tr_new_name("rp");
+      break;
+    default:
+      type=NULL;
+      break; /* unknown types always fail */
+  }
+
+  return type;
+}
+
+static int tr_ff_cmp_trp_realm_role(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  TR_NAME *type=tr_ff_get_trp_realm_role(target);
+  int retval=0;
+
+  if (type==NULL)
+    retval=1;
+  else {
+    retval = tr_name_cmp(val, type);
+    tr_free_name(type);
+  }
+  return retval;
+}
+
+/** Handlers for TRP apc field */
+/* TODO: Handle multiple APCs, not just the first */
+static int tr_ff_cmp_trp_apc(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(tr_apc_get_id(trp_inforec_get_apcs(target->trp_inforec)), val);
+}
+
+static TR_NAME *tr_ff_get_trp_apc(TR_FILTER_TARGET *target)
+{
+  TR_APC *apc=trp_inforec_get_apcs(target->trp_inforec);
+  if (apc==NULL)
+    return NULL;
+
+  return tr_dup_name(tr_apc_get_id(apc));
+}
+
+/** Handlers for TRP owner_realm field */
+static int tr_ff_cmp_trp_owner_realm(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(trp_inforec_get_owner_realm(target->trp_inforec), val);
+}
+
+static TR_NAME *tr_ff_get_trp_owner_realm(TR_FILTER_TARGET *target)
+{
+  return tr_dup_name(trp_inforec_get_owner_realm(target->trp_inforec));
+}
+
+/** Generic handlers for host:port fields*/
+static TR_NAME *tr_ff_get_hostname_and_port(TR_NAME *hn, int port)
+{
+  return tr_hostname_and_port_to_name(hn, port);
+}
+
+static int tr_ff_cmp_hostname_and_port(TR_NAME *hn, int port, int default_port, TR_NAME *val)
+{
+  int cmp = -1;
+  TR_NAME *n = NULL;
+
+  /* allow a match without :port if the default port is in use */
+  if ((port == default_port) && (tr_name_cmp(hn, val) == 0))
+    return 0;
+
+  /* need to match with the :port */
+  n = tr_ff_get_hostname_and_port(hn, port);
+
+  if (n) {
+    cmp = tr_name_cmp(n, val);
+    tr_free_name(n);
+  }
+  return cmp;
+}
+
+/** Handlers for TRP trust_router field */
+static int tr_ff_cmp_trp_trust_router(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_ff_cmp_hostname_and_port(trp_inforec_get_trust_router(target->trp_inforec),
+                                     trp_inforec_get_trust_router_port(target->trp_inforec),
+                                     TRP_PORT,
+                                     val);
+}
+
+static TR_NAME *tr_ff_get_trp_trust_router(TR_FILTER_TARGET *target)
+{
+  return tr_ff_get_hostname_and_port(trp_inforec_get_trust_router(target->trp_inforec),
+                                     trp_inforec_get_trust_router_port(target->trp_inforec));
+}
+
+/** Handlers for TRP next_hop field */
+static int tr_ff_cmp_trp_next_hop(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_ff_cmp_hostname_and_port(trp_inforec_get_next_hop(target->trp_inforec),
+                                     trp_inforec_get_next_hop_port(target->trp_inforec),
+                                     TID_PORT,
+                                     val);
+}
+
+static TR_NAME *tr_ff_get_trp_next_hop(TR_FILTER_TARGET *target)
+{
+  return tr_ff_get_hostname_and_port(trp_inforec_get_next_hop(target->trp_inforec),
+                                     trp_inforec_get_next_hop_port(target->trp_inforec));
+}
+
+/** Handlers for TRP owner_contact field */
+static int tr_ff_cmp_trp_owner_contact(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(trp_inforec_get_owner_contact(target->trp_inforec), val);
+}
+
+static TR_NAME *tr_ff_get_trp_owner_contact(TR_FILTER_TARGET *target)
+{
+  return tr_dup_name(trp_inforec_get_owner_contact(target->trp_inforec));
+}
+
+/** Handlers for TID req original_coi field */
+static int tr_ff_cmp_tid_orig_coi(TR_FILTER_TARGET *target, TR_NAME *val)
+{
+  return tr_name_cmp(tid_req_get_orig_coi(target->tid_req), val);
+}
+
+static TR_NAME *tr_ff_get_tid_orig_coi(TR_FILTER_TARGET *target)
+{
+  return tr_dup_name(tid_req_get_orig_coi(target->tid_req));
+}
+
+/**
+ * Filter field handler table
+ */
+struct tr_filter_field_entry {
+  TR_FILTER_TYPE filter_type;
+  const char *name;
+  TR_FILTER_FIELD_CMP cmp;
+  TR_FILTER_FIELD_GET get;
+};
+static struct tr_filter_field_entry tr_filter_field_table[] = {
+    /* realm */
+    {TR_FILTER_TYPE_TID_INBOUND, "realm", tr_ff_cmp_tid_realm, tr_ff_get_tid_realm},
+    {TR_FILTER_TYPE_TRP_INBOUND, "realm", tr_ff_cmp_trp_realm, tr_ff_get_trp_realm},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "realm", tr_ff_cmp_trp_realm, tr_ff_get_trp_realm},
+
+    /* community */
+    {TR_FILTER_TYPE_TID_INBOUND, "comm", tr_ff_cmp_tid_comm, tr_ff_get_tid_comm},
+    {TR_FILTER_TYPE_TRP_INBOUND, "comm", tr_ff_cmp_trp_comm, tr_ff_get_trp_comm},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "comm", tr_ff_cmp_trp_comm, tr_ff_get_trp_comm},
+
+    /* community type */
+    {TR_FILTER_TYPE_TRP_INBOUND, "comm_type", tr_ff_cmp_trp_comm_type, tr_ff_get_trp_comm_type},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "comm_type", tr_ff_cmp_trp_comm_type, tr_ff_get_trp_comm_type},
+
+    /* realm role */
+    {TR_FILTER_TYPE_TRP_INBOUND, "realm_role", tr_ff_cmp_trp_realm_role, tr_ff_get_trp_realm_role},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "realm_role", tr_ff_cmp_trp_realm_role, tr_ff_get_trp_realm_role},
+
+    /* apc */
+    {TR_FILTER_TYPE_TRP_INBOUND, "apc", tr_ff_cmp_trp_apc, tr_ff_get_trp_apc},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "apc", tr_ff_cmp_trp_apc, tr_ff_get_trp_apc},
+
+    /* trust_router */
+    {TR_FILTER_TYPE_TRP_INBOUND, "trust_router", tr_ff_cmp_trp_trust_router, tr_ff_get_trp_trust_router},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "trust_router", tr_ff_cmp_trp_trust_router, tr_ff_get_trp_trust_router},
+
+    /* next_hop */
+    {TR_FILTER_TYPE_TRP_INBOUND, "next_hop", tr_ff_cmp_trp_next_hop, tr_ff_get_trp_next_hop},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "next_hop", tr_ff_cmp_trp_next_hop, tr_ff_get_trp_next_hop},
+
+    /* owner_realm */
+    {TR_FILTER_TYPE_TRP_INBOUND, "owner_realm", tr_ff_cmp_trp_owner_realm, tr_ff_get_trp_owner_realm},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "owner_realm", tr_ff_cmp_trp_owner_realm, tr_ff_get_trp_owner_realm},
+
+    /* owner_contact */
+    {TR_FILTER_TYPE_TRP_INBOUND, "owner_contact", tr_ff_cmp_trp_owner_contact, tr_ff_get_trp_owner_contact},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "owner_contact", tr_ff_cmp_trp_owner_contact, tr_ff_get_trp_owner_contact},
+
+    /* rp_realm */
+    {TR_FILTER_TYPE_TID_INBOUND, "rp_realm", tr_ff_cmp_tid_rp_realm, tr_ff_get_tid_rp_realm},
+
+    /* original coi */
+    {TR_FILTER_TYPE_TID_INBOUND, "original_coi", tr_ff_cmp_tid_orig_coi, tr_ff_get_tid_orig_coi},
+
+    /* info_type */
+    {TR_FILTER_TYPE_TRP_INBOUND, "info_type", tr_ff_cmp_trp_info_type, tr_ff_get_trp_info_type},
+    {TR_FILTER_TYPE_TRP_OUTBOUND, "info_type", tr_ff_cmp_trp_info_type, tr_ff_get_trp_info_type},
+
+    /* Unknown */
+    {TR_FILTER_TYPE_UNKNOWN, NULL } /* This must be the final entry */
+};
+
+/* TODO: support TRP metric field (requires > < comparison instead of wildcard match) */
+
+static struct tr_filter_field_entry *tr_filter_field_entry(TR_FILTER_TYPE filter_type, TR_NAME *field_name)
+{
+  unsigned int ii;
+
+  for (ii=0; tr_filter_field_table[ii].filter_type!=TR_FILTER_TYPE_UNKNOWN; ii++) {
+    if ((tr_filter_field_table[ii].filter_type==filter_type)
+        && (tr_name_cmp_str(field_name, tr_filter_field_table[ii].name)==0)) {
+      return tr_filter_field_table+ii;
+    }
+  }
+  return NULL;
+}
+
 /**
  * Apply a filter to a target record or TID request.
  *
@@ -198,34 +457,34 @@ int tr_filter_apply(TR_FILTER_TARGET *target,
                     TR_CONSTRAINT_SET **constraints,
                     TR_FILTER_ACTION *out_action)
 {
-  unsigned int ii=0, jj=0;
+  TALLOC_CTX *tmp_ctx = talloc_new(NULL);
+  TR_FILTER_ITER *filt_iter = tr_filter_iter_new(tmp_ctx);
+  TR_FLINE *this_fline = NULL;
+  TR_FLINE_ITER *fline_iter = tr_fline_iter_new(tmp_ctx);
+  TR_FSPEC *this_fspec = NULL;
   int retval=TR_FILTER_NO_MATCH;
 
   /* Default action is reject */
   *out_action = TR_FILTER_ACTION_REJECT;
 
   /* Validate filter */
-  if ((filt==NULL) || (filt->type==TR_FILTER_TYPE_UNKNOWN))
+  if ((filt_iter == NULL) || (fline_iter == NULL) || (filt==NULL) || (filt->type==TR_FILTER_TYPE_UNKNOWN)) {
+    talloc_free(tmp_ctx);
     return TR_FILTER_NO_MATCH;
+  }
 
   /* Step through filter lines looking for a match. If a line matches, retval
    * will be set to TR_FILTER_MATCH, so stop then. */
-  for (ii=0, retval=TR_FILTER_NO_MATCH;
-       ii<TR_MAX_FILTER_LINES;
-       ii++) {
-    /* skip empty lines (these shouldn't really happen) */
-    if (filt->lines[ii]==NULL)
-      continue;
-
+  for (this_fline = tr_filter_iter_first(filt_iter, filt);
+       this_fline != NULL;
+       this_fline = tr_filter_iter_next(filt_iter)) {
     /* Assume we are going to succeed. If any specs fail to match, we'll set
      * this to TR_FILTER_NO_MATCH. */
     retval=TR_FILTER_MATCH;
-    for (jj=0; jj<TR_MAX_FILTER_SPECS; jj++) {
-      /* skip empty specs (these shouldn't really happen either) */
-      if (filt->lines[ii]->specs[jj]==NULL)
-        continue;
-
-      if (!tr_fspec_matches(filt->lines[ii]->specs[jj], filt->type, target)) {
+    for (this_fspec = tr_fline_iter_first(fline_iter, this_fline);
+         this_fspec != NULL;
+         this_fspec = tr_fline_iter_next(fline_iter)) {
+      if (!tr_fspec_matches(this_fspec, filt->type, target)) {
         retval=TR_FILTER_NO_MATCH; /* set this in case this is the last filter line */
         break; /* give up on this filter line */
       }
@@ -233,15 +492,16 @@ int tr_filter_apply(TR_FILTER_TARGET *target,
 
     if (retval==TR_FILTER_MATCH)
       break;
+
   }
 
   if (retval==TR_FILTER_MATCH) {
     /* Matched line ii. Grab its action and constraints. */
-    *out_action = filt->lines[ii]->action;
+    *out_action = this_fline->action;
     if (constraints!=NULL) {
       /* if either constraint is missing, these are no-ops */
-      tr_constraint_add_to_set(constraints, filt->lines[ii]->realm_cons);
-      tr_constraint_add_to_set(constraints, filt->lines[ii]->domain_cons);
+      tr_constraint_add_to_set(constraints, this_fline->realm_cons);
+      tr_constraint_add_to_set(constraints, this_fline->domain_cons);
     }
   }
 
@@ -253,70 +513,99 @@ void tr_fspec_free(TR_FSPEC *fspec)
   talloc_free(fspec);
 }
 
+/**
+ * Helper for tr_fspec_destructor - calls tr_free_name on its first argument
+ *
+ * @param item void pointer to a TR_NAME
+ * @param cookie ignored
+ */
+static void fspec_destruct_helper(void *item, void *cookie)
+{
+  TR_NAME *name = (TR_NAME *) item;
+  tr_free_name(name);
+}
 static int tr_fspec_destructor(void *obj)
 {
   TR_FSPEC *fspec = talloc_get_type_abort(obj, TR_FSPEC);
-  size_t ii;
 
   if (fspec->field != NULL)
     tr_free_name(fspec->field);
-  for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++) {
-    if (fspec->match[ii] != NULL)
-      tr_free_name(fspec->match[ii]);
-  }
+
+  if (fspec->match)
+    tr_list_foreach(fspec->match, fspec_destruct_helper, NULL);
+
   return 0;
 }
 
 TR_FSPEC *tr_fspec_new(TALLOC_CTX *mem_ctx)
 {
   TR_FSPEC *fspec = talloc(mem_ctx, TR_FSPEC);
-  size_t ii=0;
 
   if (fspec != NULL) {
     fspec->field = NULL;
-    for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++)
-      fspec->match[ii] = NULL;
-
+    fspec->match = tr_list_new(fspec);
+    if (fspec->match == NULL) {
+      talloc_free(fspec);
+      return NULL;
+    }
     talloc_set_destructor((void *)fspec, tr_fspec_destructor);
   }
   return fspec;
 }
 
-void tr_fspec_add_match(TR_FSPEC *fspec, TR_NAME *match)
+/* Helper function and cookie structure for finding a match. The helper is called
+ * for every item in the match list, even after a match is found. If a match is found,
+ * match should be pointed to the matching item. If this is not NULL, do not change it
+ * because a match has already been found. */
+struct fspec_match_cookie { TR_NAME *name; TR_NAME *match;};
+static void fspec_match_helper(void *item, void *data)
 {
-  size_t ii;
-  for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++) {
-    if (fspec->match[ii]==NULL) {
-      fspec->match[ii]=match;
-      break;
-    }
+  TR_NAME *this_name = (TR_NAME *) item;
+  struct fspec_match_cookie *cookie = (struct fspec_match_cookie *) data;
+  if (cookie->match == NULL) {
+    if (tr_name_prefix_wildcard_match(cookie->name, this_name))
+      cookie->match = this_name;
   }
-  /* TODO: handle case that adding the match failed */
 }
-
 /* returns 1 if the spec matches */
 int tr_fspec_matches(TR_FSPEC *fspec, TR_FILTER_TYPE ftype, TR_FILTER_TARGET *target)
 {
   struct tr_filter_field_entry *field=NULL;
-  TR_NAME *name=NULL;
-  size_t ii=0;
+  struct fspec_match_cookie cookie = {0};
 
   if (fspec==NULL)
     return 0;
 
   /* Look up how to handle the requested field */
   field = tr_filter_field_entry(ftype, fspec->field);
-  if (field==NULL)
+  if (field==NULL) {
+    tr_err("tr_fspec_matches: No entry to handle field %.*s for %*s filter.",
+           fspec->field->len, fspec->field->buf,
+           tr_filter_type_to_string(ftype));
     return 0;
+  }
 
-  name=field->get(target);
-  for (ii=0; ii<TR_MAX_FILTER_SPEC_MATCHES; ii++) {
-    if (fspec->match[ii]!=NULL) {
-      if (tr_name_prefix_wildcard_match(name, fspec->match[ii]))
-        return 1;
-    }
+  cookie.name = field->get(target);
+  if (cookie.name==NULL)
+    return 0; /* if there's no value, there's no match */
+
+  cookie.match = NULL;
+  tr_list_foreach(fspec->match,
+                  fspec_match_helper,
+                  &cookie);
+  if (cookie.match) {
+    tr_debug("tr_fspec_matches: Field %.*s value \"%.*s\" matches \"%.*s\" for %s filter.",
+             fspec->field->len, fspec->field->buf,
+             cookie.name->len, cookie.name->buf,
+             cookie.match->len, cookie.match->buf,
+             tr_filter_type_to_string(ftype));
+  } else {
+        tr_debug("tr_fspec_matches: Field %.*s value \"%.*s\" does not match for %s filter.",
+                 fspec->field->len, fspec->field->buf,
+                 cookie.name->len, cookie.name->buf,
+                 tr_filter_type_to_string(ftype));
   }
-  return 0;
+  return (cookie.match != NULL);
 }
 
 void tr_fline_free(TR_FLINE *fline)
@@ -327,14 +616,16 @@ void tr_fline_free(TR_FLINE *fline)
 TR_FLINE *tr_fline_new(TALLOC_CTX *mem_ctx)
 {
   TR_FLINE *fl = talloc(mem_ctx, TR_FLINE);
-  int ii = 0;
 
   if (fl != NULL) {
     fl->action = TR_FILTER_ACTION_UNKNOWN;
     fl->realm_cons = NULL;
     fl->domain_cons = NULL;
-    for (ii = 0; ii < TR_MAX_FILTER_SPECS; ii++)
-      fl->specs[ii] = NULL;
+    fl->specs = tr_list_new(fl);
+    if (fl->specs == NULL) {
+      talloc_free(fl);
+      return NULL;
+    }
   }
   return fl;
 }
@@ -342,12 +633,14 @@ TR_FLINE *tr_fline_new(TALLOC_CTX *mem_ctx)
 TR_FILTER *tr_filter_new(TALLOC_CTX *mem_ctx)
 {
   TR_FILTER *f = talloc(mem_ctx, TR_FILTER);
-  int ii = 0;
 
   if (f != NULL) {
     f->type = TR_FILTER_TYPE_UNKNOWN;
-    for (ii = 0; ii < TR_MAX_FILTER_LINES; ii++)
-      f->lines[ii] = NULL;
+    f->lines = tr_list_new(f);
+    if (f->lines == NULL) {
+      talloc_free(f);
+      return NULL;
+    }
   }
   return f;
 }
@@ -375,10 +668,16 @@ TR_FILTER_TYPE tr_filter_get_type(TR_FILTER *filt)
  */
 int tr_filter_validate(TR_FILTER *filt)
 {
-  size_t ii=0, jj=0, kk=0;
-
-  if (!filt)
+  TALLOC_CTX *tmp_ctx = talloc_new(NULL);
+  TR_FILTER_ITER *filt_iter = tr_filter_iter_new(tmp_ctx);
+  TR_FLINE *this_fline = NULL;
+  TR_FLINE_ITER *fline_iter = tr_fline_iter_new(tmp_ctx);
+  TR_FSPEC *this_fspec = NULL;
+  
+  if ((!filt) || (!filt_iter) || (!fline_iter)) {
+    talloc_free(tmp_ctx);
     return 0;
+  }
 
   /* check that we recognize the type */
   switch(filt->type) {
@@ -388,41 +687,43 @@ int tr_filter_validate(TR_FILTER *filt)
       break;
 
     default:
+      talloc_free(tmp_ctx);
       return 0; /* if we get here, either TR_FILTER_TYPE_UNKNOWN or an invalid value was found */
   }
-  for (ii=0; ii<TR_MAX_FILTER_LINES; ii++) {
-    if (filt->lines[ii]==NULL)
-      continue; /* an empty filter line is valid */
-
+  
+  for (this_fline = tr_filter_iter_first(filt_iter, filt);
+       this_fline != NULL;
+       this_fline = tr_filter_iter_next(filt_iter)) {
     /* check that we recognize the action */
-    switch(filt->lines[ii]->action) {
+    switch(this_fline->action) {
       case TR_FILTER_ACTION_ACCEPT:
       case TR_FILTER_ACTION_REJECT:
         break;
 
       default:
         /* if we get here, either TR_FILTER_ACTION_UNKNOWN or an invalid value was found */
+        talloc_free(tmp_ctx);
         return 0;
     }
 
-    for (jj=0; jj<TR_MAX_FILTER_SPECS; jj++) {
-      if (filt->lines[ii]->specs[jj]==NULL)
-        continue; /* an empty filter spec is valid */
-
-      if (!tr_filter_validate_spec_field(filt->type, filt->lines[ii]->specs[jj]))
+    for (this_fspec = tr_fline_iter_first(fline_iter, this_fline);
+         this_fspec != NULL;
+         this_fspec = tr_fline_iter_next(fline_iter)) {
+      if (!tr_filter_validate_spec_field(filt->type, this_fspec)) {
+        talloc_free(tmp_ctx);
         return 0;
-
-      /* check that at least one match is non-null */
-      for (kk=0; kk<TR_MAX_FILTER_SPEC_MATCHES; kk++) {
-        if (filt->lines[ii]->specs[jj]->match[kk]!=NULL)
-          break;
       }
-      if (kk==TR_MAX_FILTER_SPEC_MATCHES)
+
+      /* check that at least one match is defined*/
+      if (tr_list_length(this_fspec->match) == 0) {
+        talloc_free(tmp_ctx);
         return 0;
+      }
     }
   }
 
   /* We ran the gauntlet. Success! */
+  talloc_free(tmp_ctx);
   return 1;
 }