return retval;
}
-int tr_filter_process_rp_permitted(TR_NAME *rp_realm,
- TR_FILTER *rpp_filter,
- TR_CONSTRAINT_SET *in_constraints,
- TR_CONSTRAINT_SET **out_constraints,
- TR_FILTER_ACTION *out_action)
-{
- int i = 0, j = 0;
-
- *out_action = TR_FILTER_ACTION_REJECT;
- *out_constraints = NULL;
-
- /* If this isn't a valid rp_permitted filter, return no match. */
- if ((!rpp_filter) ||
- (TR_FILTER_TYPE_TID_INBOUND != rpp_filter->type)) {
- return TR_FILTER_NO_MATCH;
- }
-
- /* Check if there is a match for this filter. */
- for (i = 0; i < TR_MAX_FILTER_LINES; i++) {
- for (j = 0; j < TR_MAX_FILTER_SPECS; j++) {
-
- if ((rpp_filter->lines[i]) &&
- (rpp_filter->lines[i]->specs[j]) &&
- (tr_fspec_matches(rpp_filter->lines[i]->specs[j], 0, rp_realm))) { /* todo: fix or remove */
- *out_action = rpp_filter->lines[i]->action;
- *out_constraints = in_constraints;
- if (rpp_filter->lines[i]->realm_cons)
- tr_constraint_add_to_set(out_constraints,
- rpp_filter->lines[i]->realm_cons);
- if (rpp_filter->lines[i]->domain_cons)
- tr_constraint_add_to_set(out_constraints,
- rpp_filter->lines[i]->domain_cons);
-
- return TR_FILTER_MATCH;
- }
- }
- }
- /* If there is no match, indicate that. */
- return TR_FILTER_NO_MATCH;
-}
-
void tr_fspec_free(TR_FSPEC *fspec)
{
talloc_free(fspec);
int TR_EXPORT tr_prefix_wildcard_match(const char *str, const char *wc_str);
int tr_filter_apply(void *target, TR_FILTER *filt, TR_CONSTRAINT_SET **constraints, TR_FILTER_ACTION *out_action);
-int tr_filter_process_rp_permitted(TR_NAME *rp_realm, TR_FILTER *rpp_filter, TR_CONSTRAINT_SET *in_constraints,
- TR_CONSTRAINT_SET **out_constraints, TR_FILTER_ACTION *out_action);
TR_CONSTRAINT_SET *tr_constraint_set_from_fline(TR_FLINE *fline);
goto cleanup;
}
- if ((TR_FILTER_NO_MATCH == tr_filter_process_rp_permitted(orig_req->rp_realm,
- tr_filter_set_get(tids->rp_gss->filters,
- TR_FILTER_TYPE_TID_INBOUND),
- orig_req->cons,
- &fwd_req->cons,
- &oaction)) ||
- (TR_FILTER_ACTION_REJECT == oaction)) {
+ /* Keep original constraints, may add more from the filter. These will be added to orig_req as
+ * well. Need to verify that this is acceptable behavior, but it's what we've always done. */
+ fwd_req->cons=orig_req->cons;
+
+ if ((TR_FILTER_NO_MATCH == tr_filter_apply(orig_req,
+ tr_filter_set_get(tids->rp_gss->filters,
+ TR_FILTER_TYPE_TID_INBOUND),
+ &(fwd_req->cons),
+ &oaction)) ||
+ (TR_FILTER_ACTION_ACCEPT != oaction)) {
tr_notice("tr_tids_req_handler: RP realm (%s) does not match RP Realm filter for GSS name", orig_req->rp_realm->buf);
tids_send_err_response(tids, orig_req, "RP Realm filter error");
retval=-1;