/* -*- Mode: C; eval: (c-set-style "GNU") -*- ****************************************************************************** * $Id: url_filt.c,v 1.2 2000-01-14 22:25:29 leif%netscape.com Exp $ * * The contents of this file are subject to the Mozilla Public License * Version 1.1 (the "License"); you may not use this file except in * compliance with the License. You may obtain a copy of the License at * http://www.mozilla.org/MPL/ * * Software distributed under the License is distributed on an "AS IS" * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the * License for the specific language governing rights and limitations * under the License. * * The Original Code is Netscape DS Plugins. The Initial Developer of the * Original Code is Leif Hedstrom and Netscape Communications Corp. * Portions created by Netscape are Copyright (C) Netscape Communications * Corp. All Rights Reserved. * * Contributor(s): * * DESCRIPTION: * Do an LDAP search before doing a MOD/ADD operations, if there is a match, * deny/allow the modification. You can use this plugin any number of times * from the slapd.conf file, it will extend the filter rules accordingly. * * USAGE: * plugin preoperation url_filt.so urlPlugInit attr1,2 0/1 filter1 * plugin preoperation url_filt.so urlPlugInit attr3,4 0/1 filter2 * * The filter specification is an LDAP URL, where a substring of $$ is * replaced with the LDAP operations attribute value. Examples: * * mail 0 ldap:///dc=foo,dc=com??sub?(|(mail=$$)(mailAlternateAddess=$$)) * uid 0 ldap:///dc=foo,dc=com??sub?(uid=$$) * uniqueMember,owner 1 ldap:///$$??base?(objectclass=*) * *****************************************************************************/ #include #include "lulu.h" /****************************************************************************** * Defines, for this particular plugin only. */ #define PLUGIN_NAME "url_filt" #define PLUGIN_VERS "1.1" #define ERR_NOMATCH "An entry does not match a server LDAP URL rule.\n" #define ERR_MATCH "An entry already matches a server LDAP URL rule.\n" /****************************************************************************** * Typedefs and structures. Note that some of the members of this structure * are for performance reason, e.g. the "len" fields. */ typedef struct _URL_Filter { char *string; /* Original LDAP URL string, not used. */ int match; /* Should we pass if URL matches (yes/no)? */ LDAPURLDesc *url; /* The components of the URL, parsed. */ char *dn; /* The DN component. */ int dn_len; /* Length of the DN component. */ char *search; /* The LDAP filter/search component. */ int search_len; /* Length of the filter component. */ int num_dn_subs; /* The number of $$'s in the Base-DN */ int num_search_subs; /* The number of $$'s in the search filter. */ Plugin_Attrs *attrs; /* Attributes to apply this filter to. */ struct _URL_Filter *next; } URL_Filter; /****************************************************************************** * Globals, "private" to this module. */ PRIVATE int url_num_filters = 0; /* Number of filters. */ PRIVATE URL_Filter *url_filter_list = NULL; /* List of filters. */ PRIVATE Slapi_PluginDesc urlDesc = { PLUGIN_NAME, "Leif Hedstrom", PLUGIN_VERS, "LDAP URL filter plugin" }; PRIVATE char *urlAttrs[2] = { "dn", NULLCP }; /****************************************************************************** * Count the number of $$'s in a string, if any. */ PRIVATE int count_subs(char *str) { int count = 0; while(*str) if ((*(str++) == '$') && (*(str++) == '$')) count ++; return count; } /****************************************************************************** * Allocate a string for a new string, and do the necessary string subs, with * the supplied berval value. This looks kludgy, any better/smarter ways * of doing this (remember, the $$ can occur more than once)... */ PRIVATE INLINE char * do_subs(char *str, int len, char *val, int valLen) { char *sub, *tmp; if (!(sub = (char *)slapi_ch_malloc(len))) return NULLCP; tmp = sub; while (*str) { if (*str == '$') { if (*(++str) == '$') { memcpy(tmp, val, valLen); tmp += valLen; str++; } else *(tmp++) = '$'; } else *(tmp++) = *(str++); } *tmp = '\0'; return sub; } /****************************************************************************** * Setup a filter structure, used when parsing the plugin arguments from the * registration routien. */ PRIVATE int create_filter(URL_Filter *filter, char *attributes, char *string) { int res; if (!filter || filter->attrs || !attributes || !string) return 0; if (!(filter->string = slapi_ch_strdup(string))) return 0; if (!(filter->attrs = parse_attributes(attributes))) { slapi_ch_free((void **)&(filter->string)); return 0; } /* Parse the URL, and make sure it's of proper syntax. */ if ((res = ldap_url_parse(filter->string, &(filter->url)))) { /* Produce a proper Error Message... */ free_attributes(filter->attrs); return 0; } /* Let's fill in some more stuff about the filter. */ filter->dn = filter->url->lud_dn; filter->search = filter->url->lud_filter; filter->dn_len = strlen(filter->dn); filter->search_len = strlen(filter->search); filter->num_dn_subs = count_subs(filter->dn); filter->num_search_subs = count_subs(filter->search); return 1; } /****************************************************************************** * Perform the URL LDAP test, and set the return code properly if we do have * have a violation. Return 1 if we did run trigger a rule. */ PRIVATE INLINE int test_filter(Slapi_PBlock *pb, URL_Filter *filter, char *type, char *value, int len) { Slapi_PBlock *resPB; char *tmpDN, *tmpSearch; Slapi_Entry **entries; int res, retval; /* Let's first do the appropriate substitutions, on DN and Filters. */ if (filter->num_dn_subs) { if (!(tmpDN = do_subs(filter->dn, filter->dn_len + filter->num_dn_subs * len, value, len))) return 0; } else tmpDN = filter->dn; if (filter->num_search_subs) { if (!(tmpSearch = do_subs(filter->search, filter->search_len + filter->num_search_subs * len, value, len))) { slapi_ch_free((void **)&tmpDN); return 0; } } else tmpSearch = filter->search; /* Now we'll do the actual lookup in the internal DB. We only care if the search finds something or not, the actual data is irrelevant. */ resPB = slapi_search_internal(tmpDN, filter->url->lud_scope, tmpSearch, (LDAPControl **)NULL, urlAttrs, 1); if (resPB) { if (slapi_pblock_get(resPB, SLAPI_PLUGIN_INTOP_RESULT, &res)) res = LDAP_OPERATIONS_ERROR; else if (res == LDAP_SUCCESS) { if (slapi_pblock_get(resPB, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries)) res = LDAP_OPERATIONS_ERROR; else if (entries && *entries) res = LDAP_SUCCESS; else res = LDAP_NO_SUCH_OBJECT; } slapi_free_search_results_internal(resPB); slapi_ch_free((void **)&resPB); } else res = LDAP_OPERATIONS_ERROR; retval = 0; if ((!res && !filter->match) || (res && filter->match)) { slapi_log_error(LOG_FACILITY, PLUGIN_NAME, "Violation: %s on '%s: %s'\n", filter->string, type, value); send_constraint_err(pb, filter->match ? ERR_NOMATCH : ERR_MATCH); retval = 1; } if (filter->num_dn_subs) slapi_ch_free((void **)&tmpDN); if (filter->num_search_subs) slapi_ch_free((void **)&tmpSearch); return retval; } PRIVATE INLINE int loop_ber_values(Slapi_PBlock *pb, URL_Filter *filter, BerVal **bvals, char *type) { while (*bvals) { if (test_filter(pb, filter, type, (*bvals)->bv_val, (*bvals)->bv_len)) return 1; bvals++; } return 0; } /****************************************************************************** * Handle ADD operations. */ PUBLIC int eval_add_filter(Slapi_PBlock *pb) { URL_Filter *filter; Plugin_Attrs *attrs; Slapi_Entry *entry; Slapi_Attr *att; BerVal **bvals; if (!get_add_entry(pb, &entry, PLUGIN_NAME)) return (-1); filter = url_filter_list; while (filter) { attrs = filter->attrs; while (attrs) { if (!slapi_entry_attr_find(entry, attrs->type, &att)) { slapi_attr_get_values(att, &bvals); if (loop_ber_values(pb, filter, bvals, attrs->type)) return (-1); } attrs = attrs->next; } filter = filter->next; } return 0; } /****************************************************************************** * Handle MOD operations. */ PUBLIC int eval_mod_filter(Slapi_PBlock *pb) { URL_Filter *filter; LDAPMod **mods, *mod; if (!get_modify_mods(pb, &mods, PLUGIN_NAME)) return (-1); while ((mod = *mods)) { if (!(mod->mod_op & LDAP_MOD_DELETE)) { filter = url_filter_list; while (filter) { if (list_has_attribute(filter->attrs, mod->mod_type) && loop_ber_values(pb, filter, mod->mod_bvalues, mod->mod_type)) return (-1); filter = filter->next; } } mods++; } return 0; } /****************************************************************************** * Register the pre-op functions. */ PUBLIC int url_filter_init(Slapi_PBlock *pb) { char **argv; int argc; URL_Filter *new, *last; if (!get_slapi_args(pb, &argc, &argv, 3, PLUGIN_NAME)) return (-1); /* Allocate memory for the new Filter rule. */ if (!(new = (URL_Filter *)slapi_ch_malloc(sizeof(URL_Filter)))) { slapi_log_error(LOG_FACILITY, PLUGIN_NAME, ERR_MALLOC); return (-1); } /* Create the new filter, using the filter options in argv. */ new->next = (URL_Filter *)NULL; new->attrs = (Plugin_Attrs *)NULL; new->match = (*(argv[1]) == '0' ? 0 : 1); if (!create_filter(new, argv[0], argv[2]) || !new || !new->attrs) { slapi_ch_free((void **)&new); slapi_log_error(LOG_FACILITY, PLUGIN_NAME, ERR_SYNTAX); return (-1); } /* Find the last filter in the chain of filters, and link in the new. */ if ((last = url_filter_list)) { while (last && last->next) last = last->next; last->next = new; } else url_filter_list = new; url_num_filters++; /* Ok, everything looks grovy, so let's register the filter, but only if we haven't done so already... */ if (url_num_filters > 1) return 0; if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01) || slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, &urlDesc) || slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_MODIFY_FN, (void *)&eval_mod_filter) || slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_ADD_FN, (void *)&eval_add_filter)) { slapi_log_error(LOG_FACILITY, PLUGIN_NAME, ERR_REG); return (-1); } return 0; }