git.sur5r.net Git - openldap/blob - servers/slapd/filterentry.c

   1 /* filterentry.c - apply a filter to an entry */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/socket.h>
  13 #include <ac/string.h>
  14
  15
  16 #include "slap.h"
  17
  18 static int      test_filter_and( Backend *be,
  19         Connection *conn, Operation *op,
  20         Entry *e, Filter *flist );
  21 static int      test_filter_or( Backend *be,
  22         Connection *conn, Operation *op,
  23         Entry *e, Filter *flist );
  24 static int      test_substrings_filter( Backend *be,
  25         Connection *conn, Operation *op,
  26         Entry *e, Filter *f);
  27 static int      test_ava_filter( Backend *be,
  28         Connection *conn, Operation *op,
  29         Entry *e, AttributeAssertion *ava, int type );
  30 static int      test_mra_filter( Backend *be,
  31         Connection *conn, Operation *op,
  32         Entry *e, MatchingRuleAssertion *mra );
  33 static int      test_presence_filter( Backend *be,
  34         Connection *conn, Operation *op,
  35         Entry *e, AttributeDescription *desc );
  36
  37
  38 /*
  39  * test_filter - test a filter against a single entry.
  40  * returns:
  41  *              LDAP_COMPARE_TRUE               filter matched
  42  *              LDAP_COMPARE_FALSE              filter did not match
  43  *              SLAPD_COMPARE_UNDEFINED filter is undefined
  44  *      or an ldap result code indicating error
  45  */
  46
  47 int
  48 test_filter(
  49     Backend     *be,
  50     Connection  *conn,
  51     Operation   *op,
  52     Entry       *e,
  53     Filter      *f
  54 )
  55 {
  56         int     rc;
  57
  58 #ifdef NEW_LOGGING
  59         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
  60                    "test_filter: begin\n" ));
  61 #else
  62         Debug( LDAP_DEBUG_FILTER, "=> test_filter\n", 0, 0, 0 );
  63 #endif
  64
  65
  66         switch ( f->f_choice ) {
  67         case SLAPD_FILTER_COMPUTED:
  68 #ifdef NEW_LOGGING
  69                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
  70                            "test_filter:   COMPUTED %s (%d)\n",
  71                            f->f_result == LDAP_COMPARE_FALSE ? "false" :
  72                            f->f_result == LDAP_COMPARE_TRUE      ? "true"  :
  73                            f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" :
  74                            "error",
  75                            f->f_result ));
  76 #else
  77                 Debug( LDAP_DEBUG_FILTER, "    COMPUTED %s (%d)\n",
  78                         f->f_result == LDAP_COMPARE_FALSE ? "false" :
  79                         f->f_result == LDAP_COMPARE_TRUE ? "true" :
  80                         f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" : "error",
  81                         f->f_result, 0 );
  82 #endif
  83
  84                 rc = f->f_result;
  85                 break;
  86
  87         case LDAP_FILTER_EQUALITY:
  88 #ifdef NEW_LOGGING
  89                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
  90                            "test_filter:   EQUALITY\n" ));
  91 #else
  92                 Debug( LDAP_DEBUG_FILTER, "    EQUALITY\n", 0, 0, 0 );
  93 #endif
  94
  95                 rc = test_ava_filter( be, conn, op, e, f->f_ava,
  96                     LDAP_FILTER_EQUALITY );
  97                 break;
  98
  99         case LDAP_FILTER_SUBSTRINGS:
 100 #ifdef NEW_LOGGING
 101                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
 102                            "test_filter  SUBSTRINGS\n" ));
 103 #else
 104                 Debug( LDAP_DEBUG_FILTER, "    SUBSTRINGS\n", 0, 0, 0 );
 105 #endif
 106
 107                 rc = test_substrings_filter( be, conn, op, e, f );
 108                 break;
 109
 110         case LDAP_FILTER_GE:
 111                 rc = test_ava_filter( be, conn, op, e, f->f_ava,
 112                     LDAP_FILTER_GE );
 113                 break;
 114
 115         case LDAP_FILTER_LE:
 116                 rc = test_ava_filter( be, conn, op, e, f->f_ava,
 117                     LDAP_FILTER_LE );
 118                 break;
 119
 120         case LDAP_FILTER_PRESENT:
 121 #ifdef NEW_LOGGING
 122                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
 123                            "test_filter:        PRESENT\n" ));
 124 #else
 125                 Debug( LDAP_DEBUG_FILTER, "    PRESENT\n", 0, 0, 0 );
 126 #endif
 127
 128                 rc = test_presence_filter( be, conn, op, e, f->f_desc );
 129                 break;
 130
 131         case LDAP_FILTER_APPROX:
 132 #ifdef NEW_LOGGING
 133                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
 134                            "test_filter: APPROX\n" ));
 135 #else
 136                 Debug( LDAP_DEBUG_FILTER, "    APPROX\n", 0, 0, 0 );
 137 #endif
 138                 rc = test_ava_filter( be, conn, op, e, f->f_ava,
 139                     LDAP_FILTER_APPROX );
 140                 break;
 141
 142         case LDAP_FILTER_AND:
 143 #ifdef NEW_LOGGING
 144                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
 145                            "test_filter:  AND\n" ));
 146 #else
 147                 Debug( LDAP_DEBUG_FILTER, "    AND\n", 0, 0, 0 );
 148 #endif
 149
 150                 rc = test_filter_and( be, conn, op, e, f->f_and );
 151                 break;
 152
 153         case LDAP_FILTER_OR:
 154 #ifdef NEW_LOGGING
 155                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
 156                            "test_filter:        OR\n" ));
 157 #else
 158                 Debug( LDAP_DEBUG_FILTER, "    OR\n", 0, 0, 0 );
 159 #endif
 160
 161                 rc = test_filter_or( be, conn, op, e, f->f_or );
 162                 break;
 163
 164         case LDAP_FILTER_NOT:
 165 #ifdef NEW_LOGGING
 166                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
 167                            "test_filter:        NOT\n" ));
 168 #else
 169                 Debug( LDAP_DEBUG_FILTER, "    NOT\n", 0, 0, 0 );
 170 #endif
 171
 172                 rc = test_filter( be, conn, op, e, f->f_not );
 173
 174                 /* Flip true to false and false to true
 175                  * but leave Undefined alone.
 176                  */
 177                 switch( rc ) {
 178                 case LDAP_COMPARE_TRUE:
 179                         rc = LDAP_COMPARE_FALSE;
 180                         break;
 181                 case LDAP_COMPARE_FALSE:
 182                         rc = LDAP_COMPARE_TRUE;
 183                         break;
 184                 }
 185                 break;
 186
 187         case LDAP_FILTER_EXT:
 188 #ifdef NEW_LOGGING
 189                 LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
 190                            "test_filter:        EXT\n" ));
 191 #else
 192                 Debug( LDAP_DEBUG_FILTER, "    EXT\n", 0, 0, 0 );
 193 #endif
 194
 195                 rc = test_mra_filter( be, conn, op, e, f->f_mra );
 196                 break;
 197
 198         default:
 199 #ifdef NEW_LOGGING
 200                 LDAP_LOG(( "filter", LDAP_LEVEL_INFO,
 201                            "test_filter:  unknown filter type %lu\n",
 202                        f->f_choice ));
 203 #else
 204                 Debug( LDAP_DEBUG_ANY, "    unknown filter type %lu\n",
 205                     f->f_choice, 0, 0 );
 206 #endif
 207
 208                 rc = LDAP_PROTOCOL_ERROR;
 209         }
 210
 211 #ifdef NEW_LOGGING
 212         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
 213                    "test_filter:  return=%d\n", rc ));
 214 #else
 215         Debug( LDAP_DEBUG_FILTER, "<= test_filter %d\n", rc, 0, 0 );
 216 #endif
 217
 218         return( rc );
 219 }
 220
 221 static int test_mra_filter(
 222         Backend *be,
 223         Connection *conn,
 224         Operation *op,
 225         Entry *e,
 226         MatchingRuleAssertion *mra )
 227 {
 228         Attribute       *a;
 229
 230         if( !access_allowed( be, conn, op, e,
 231                 mra->ma_desc, &mra->ma_value, ACL_SEARCH ) )
 232         {
 233                 return LDAP_INSUFFICIENT_ACCESS;
 234         }
 235
 236         if( strcmp(mra->ma_rule->smr_syntax->ssyn_oid,
 237                 mra->ma_desc->ad_type->sat_syntax->ssyn_oid) != 0)
 238         {
 239                 return LDAP_INVALID_SYNTAX;
 240         }
 241
 242         if( mra->ma_rule == NULL )
 243         {
 244                 return LDAP_INAPPROPRIATE_MATCHING;
 245         }
 246
 247         for(a = attrs_find( e->e_attrs, mra->ma_desc );
 248                 a != NULL;
 249                 a = attrs_find( a->a_next, mra->ma_desc ) )
 250         {
 251                 struct berval *bv;
 252                 for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
 253                         int ret;
 254                         int rc;
 255                         const char *text;
 256
 257                         rc = value_match( &ret, a->a_desc, mra->ma_rule,
 258                                 SLAP_MR_ASSERTION_SYNTAX_MATCH,
 259                                 bv, &mra->ma_value,
 260                                 &text );
 261
 262                         if( rc != LDAP_SUCCESS ) {
 263                                 return rc;
 264                         }
 265
 266                         if ( ret ) {
 267                                 return LDAP_COMPARE_TRUE;
 268                         }
 269                 }
 270         }
 271
 272         return LDAP_COMPARE_FALSE;
 273 }
 274
 275 static int
 276 test_ava_filter(
 277     Backend     *be,
 278     Connection  *conn,
 279     Operation   *op,
 280     Entry       *e,
 281         AttributeAssertion *ava,
 282     int         type
 283 )
 284 {
 285         Attribute       *a;
 286
 287         if ( !access_allowed( be, conn, op, e,
 288                 ava->aa_desc, &ava->aa_value, ACL_SEARCH ) )
 289         {
 290                 return LDAP_INSUFFICIENT_ACCESS;
 291         }
 292
 293         for(a = attrs_find( e->e_attrs, ava->aa_desc );
 294                 a != NULL;
 295                 a = attrs_find( a->a_next, ava->aa_desc ) )
 296         {
 297                 MatchingRule *mr;
 298                 struct berval *bv;
 299
 300                 switch ( type ) {
 301                 case LDAP_FILTER_APPROX:
 302                         mr = a->a_desc->ad_type->sat_approx;
 303                         if( mr != NULL ) break;
 304
 305                         /* use EQUALITY matching rule if no APPROX rule */
 306
 307                 case LDAP_FILTER_EQUALITY:
 308                         mr = a->a_desc->ad_type->sat_equality;
 309                         break;
 310
 311                 case LDAP_FILTER_GE:
 312                 case LDAP_FILTER_LE:
 313                         mr = a->a_desc->ad_type->sat_ordering;
 314                         break;
 315
 316                 default:
 317                         mr = NULL;
 318                 }
 319
 320                 if( mr == NULL ) {
 321                         continue;
 322                 }
 323
 324                 for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
 325                         int ret;
 326                         int rc;
 327                         const char *text;
 328
 329                         rc = value_match( &ret, a->a_desc, mr,
 330                                 SLAP_MR_ASSERTION_SYNTAX_MATCH,
 331                                 bv, &ava->aa_value, &text );
 332
 333                         if( rc != LDAP_SUCCESS ) {
 334                                 return rc;
 335                         }
 336
 337                         switch ( type ) {
 338                         case LDAP_FILTER_EQUALITY:
 339                         case LDAP_FILTER_APPROX:
 340                                 if ( ret == 0 ) {
 341                                         return LDAP_COMPARE_TRUE;
 342                                 }
 343                                 break;
 344
 345                         case LDAP_FILTER_GE:
 346                                 if ( ret >= 0 ) {
 347                                         return LDAP_COMPARE_TRUE;
 348                                 }
 349                                 break;
 350
 351                         case LDAP_FILTER_LE:
 352                                 if ( ret <= 0 ) {
 353                                         return LDAP_COMPARE_TRUE;
 354                                 }
 355                                 break;
 356                         }
 357                 }
 358         }
 359
 360         return( LDAP_COMPARE_FALSE );
 361 }
 362
 363
 364 static int
 365 test_presence_filter(
 366     Backend     *be,
 367     Connection  *conn,
 368     Operation   *op,
 369     Entry       *e,
 370         AttributeDescription *desc
 371 )
 372 {
 373         if ( !access_allowed( be, conn, op, e, desc, NULL, ACL_SEARCH ) )
 374         {
 375                 return LDAP_INSUFFICIENT_ACCESS;
 376         }
 377
 378         return attrs_find( e->e_attrs, desc ) != NULL
 379                 ? LDAP_COMPARE_TRUE : LDAP_COMPARE_FALSE;
 380 }
 381
 382
 383 static int
 384 test_filter_and(
 385     Backend     *be,
 386     Connection  *conn,
 387     Operation   *op,
 388     Entry       *e,
 389     Filter      *flist
 390 )
 391 {
 392         Filter  *f;
 393         int rtn = LDAP_COMPARE_TRUE; /* True if empty */
 394
 395 #ifdef NEW_LOGGING
 396         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
 397                    "test_filter_and: begin\n" ));
 398 #else
 399         Debug( LDAP_DEBUG_FILTER, "=> test_filter_and\n", 0, 0, 0 );
 400 #endif
 401
 402
 403         for ( f = flist; f != NULL; f = f->f_next ) {
 404                 int rc = test_filter( be, conn, op, e, f );
 405
 406                 if ( rc == LDAP_COMPARE_FALSE ) {
 407                         /* filter is False */
 408                         rtn = rc;
 409                         break;
 410                 }
 411
 412                 if ( rc != LDAP_COMPARE_TRUE ) {
 413                         /* filter is Undefined unless later elements are False */
 414                         rtn = rc;
 415                 }
 416         }
 417
 418 #ifdef NEW_LOGGING
 419         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
 420                    "test_filter_and:  rc=%d\n", rtn ));
 421 #else
 422         Debug( LDAP_DEBUG_FILTER, "<= test_filter_and %d\n", rtn, 0, 0 );
 423 #endif
 424
 425         return rtn;
 426 }
 427
 428 static int
 429 test_filter_or(
 430     Backend     *be,
 431     Connection  *conn,
 432     Operation   *op,
 433     Entry       *e,
 434     Filter      *flist
 435 )
 436 {
 437         Filter  *f;
 438         int rtn = LDAP_COMPARE_FALSE; /* False if empty */
 439
 440 #ifdef NEW_LOGGING
 441         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
 442                    "test_filter_or: begin\n" ));
 443 #else
 444         Debug( LDAP_DEBUG_FILTER, "=> test_filter_or\n", 0, 0, 0 );
 445 #endif
 446
 447
 448         for ( f = flist; f != NULL; f = f->f_next ) {
 449                 int rc = test_filter( be, conn, op, e, f );
 450
 451                 if ( rc == LDAP_COMPARE_TRUE ) {
 452                         /* filter is True */
 453                         rtn = rc;
 454                         break;
 455                 }
 456
 457                 if ( rc != LDAP_COMPARE_FALSE ) {
 458                         /* filter is Undefined unless later elements are True */
 459                         rtn = rc;
 460                 }
 461         }
 462
 463 #ifdef NEW_LOGGING
 464         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
 465                    "test_filter_or: result=%d\n", rtn ));
 466 #else
 467         Debug( LDAP_DEBUG_FILTER, "<= test_filter_or %d\n", rtn, 0, 0 );
 468 #endif
 469
 470         return rtn;
 471 }
 472
 473
 474 static int
 475 test_substrings_filter(
 476     Backend     *be,
 477     Connection  *conn,
 478     Operation   *op,
 479     Entry       *e,
 480     Filter      *f
 481 )
 482 {
 483         Attribute       *a;
 484
 485 #ifdef NEW_LOGGING
 486         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
 487                    "test_substrings_filter: begin\n" ));
 488 #else
 489         Debug( LDAP_DEBUG_FILTER, "begin test_substrings_filter\n", 0, 0, 0 );
 490 #endif
 491
 492
 493         if ( !access_allowed( be, conn, op, e,
 494                 f->f_sub_desc, NULL, ACL_SEARCH ) )
 495         {
 496                 return LDAP_INSUFFICIENT_ACCESS;
 497         }
 498
 499         for(a = attrs_find( e->e_attrs, f->f_sub_desc );
 500                 a != NULL;
 501                 a = attrs_find( a->a_next, f->f_sub_desc ) )
 502         {
 503                 MatchingRule *mr = a->a_desc->ad_type->sat_substr;
 504                 struct berval *bv;
 505
 506                 if( mr == NULL ) {
 507                         continue;
 508                 }
 509
 510                 for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
 511                         int ret;
 512                         int rc;
 513                         const char *text;
 514
 515                         rc = value_match( &ret, a->a_desc, mr,
 516                                 SLAP_MR_ASSERTION_SYNTAX_MATCH,
 517                                 bv, f->f_sub, &text );
 518
 519                         if( rc != LDAP_SUCCESS ) {
 520                                 return rc;
 521                         }
 522
 523                         if ( ret == 0 ) {
 524                                 return LDAP_COMPARE_TRUE;
 525                         }
 526                 }
 527         }
 528
 529 #ifdef NEW_LOGGING
 530         LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
 531                    "test_substrings_filter: return FALSE\n" ));
 532 #else
 533         Debug( LDAP_DEBUG_FILTER, "end test_substrings_filter 1\n", 0, 0, 0 );
 534 #endif
 535
 536         return LDAP_COMPARE_FALSE;
 537 }