1 /* limits.c - routines to handle regex-based size and time limits */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 1998-2004 The OpenLDAP Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted only as authorized by the OpenLDAP
12 * A copy of this license is available in the file LICENSE in the
13 * top-level directory of the distribution or, alternatively, at
14 * <http://www.OpenLDAP.org/license.html>.
22 #include <ac/string.h>
30 struct slap_limits_set **limit
33 struct slap_limits **lm;
41 *limit = &op->o_bd->be_def_limit;
43 if ( op->o_bd->be_limits == NULL ) {
47 for ( lm = op->o_bd->be_limits; lm[0] != NULL; lm++ ) {
48 unsigned style = lm[0]->lm_flags & SLAP_LIMITS_MASK;
49 unsigned type = lm[0]->lm_flags & SLAP_LIMITS_TYPE_MASK;
52 case SLAP_LIMITS_EXACT:
53 if ( ndn->bv_len == 0 ) {
57 if ( type == SLAP_LIMITS_TYPE_GROUP ) {
60 rc = backend_group( op, NULL,
65 *limit = &lm[0]->lm_limits;
70 if ( dn_match( &lm[0]->lm_pat, ndn ) ) {
71 *limit = &lm[0]->lm_limits;
77 case SLAP_LIMITS_SUBTREE:
78 case SLAP_LIMITS_CHILDREN: {
81 if ( ndn->bv_len == 0 ) {
85 /* ndn shorter than dn_pat */
86 if ( ndn->bv_len < lm[0]->lm_pat.bv_len ) {
89 d = ndn->bv_len - lm[0]->lm_pat.bv_len;
91 /* allow exact match for SUBTREE only */
93 if ( style != SLAP_LIMITS_SUBTREE ) {
97 /* check for unescaped rdn separator */
98 if ( !DN_SEPARATOR( ndn->bv_val[d-1] ) ) {
103 /* in case of (sub)match ... */
104 if ( lm[0]->lm_pat.bv_len == ( ndn->bv_len - d )
105 && strcmp( lm[0]->lm_pat.bv_val,
106 &ndn->bv_val[d] ) == 0 )
108 /* check for exactly one rdn in case of ONE */
109 if ( style == SLAP_LIMITS_ONE ) {
111 * if ndn is more that one rdn
112 * below dn_pat, continue
114 if ( (size_t) dn_rdnlen( NULL, ndn )
121 *limit = &lm[0]->lm_limits;
128 case SLAP_LIMITS_REGEX:
129 if ( ndn->bv_len == 0 ) {
132 if ( regexec( &lm[0]->lm_regex, ndn->bv_val,
135 *limit = &lm[0]->lm_limits;
140 case SLAP_LIMITS_ANONYMOUS:
141 if ( ndn->bv_len == 0 ) {
142 *limit = &lm[0]->lm_limits;
147 case SLAP_LIMITS_USERS:
148 if ( ndn->bv_len != 0 ) {
149 *limit = &lm[0]->lm_limits;
154 case SLAP_LIMITS_ANY:
155 *limit = &lm[0]->lm_limits;
159 assert( 0 ); /* unreachable */
172 ObjectClass *group_oc,
173 AttributeDescription *group_ad,
174 struct slap_limits_set *limit
178 struct slap_limits *lm;
179 unsigned type, style;
184 type = flags & SLAP_LIMITS_TYPE_MASK;
185 style = flags & SLAP_LIMITS_MASK;
188 case SLAP_LIMITS_ANONYMOUS:
189 case SLAP_LIMITS_USERS:
190 case SLAP_LIMITS_ANY:
191 for ( i = 0; be->be_limits && be->be_limits[ i ]; i++ ) {
192 if ( be->be_limits[ i ]->lm_flags == style ) {
200 lm = ( struct slap_limits * )ch_calloc( sizeof( struct slap_limits ), 1 );
203 case SLAP_LIMITS_UNDEFINED:
204 style = SLAP_LIMITS_EXACT;
205 /* continue to next cases */
206 case SLAP_LIMITS_EXACT:
207 case SLAP_LIMITS_ONE:
208 case SLAP_LIMITS_SUBTREE:
209 case SLAP_LIMITS_CHILDREN:
210 lm->lm_flags = style | type;
214 bv.bv_val = (char *) pattern;
215 bv.bv_len = strlen( pattern );
217 rc = dnNormalize( 0, NULL, NULL, &bv, &lm->lm_pat, NULL );
218 if ( rc != LDAP_SUCCESS ) {
225 case SLAP_LIMITS_REGEX:
226 lm->lm_flags = style | type;
227 ber_str2bv( pattern, 0, 1, &lm->lm_pat );
228 if ( regcomp( &lm->lm_regex, lm->lm_pat.bv_val,
229 REG_EXTENDED | REG_ICASE ) ) {
230 free( lm->lm_pat.bv_val );
236 case SLAP_LIMITS_ANONYMOUS:
237 case SLAP_LIMITS_USERS:
238 case SLAP_LIMITS_ANY:
239 lm->lm_flags = style | type;
240 lm->lm_pat.bv_val = NULL;
241 lm->lm_pat.bv_len = 0;
246 case SLAP_LIMITS_TYPE_GROUP:
249 lm->lm_group_oc = group_oc;
250 lm->lm_group_ad = group_ad;
254 lm->lm_limits = *limit;
257 if ( be->be_limits != NULL ) {
258 for ( ; be->be_limits[i]; i++ );
261 be->be_limits = ( struct slap_limits ** )ch_realloc( be->be_limits,
262 sizeof( struct slap_limits * ) * ( i + 2 ) );
263 be->be_limits[i] = lm;
264 be->be_limits[i+1] = NULL;
278 int flags = SLAP_LIMITS_UNDEFINED;
280 struct slap_limits_set limit;
282 ObjectClass *group_oc = NULL;
283 AttributeDescription *group_ad = NULL;
289 LDAP_LOG( CONFIG, CRIT,
290 "%s : line %d: missing arg(s) in "
291 "\"limits <pattern> <limits>\" line.\n", fname, lineno, 0 );
293 Debug( LDAP_DEBUG_ANY,
294 "%s : line %d: missing arg(s) in "
295 "\"limits <pattern> <limits>\" line.\n%s",
301 limit = be->be_def_limit;
306 * "limits" <pattern> <limit> [ ... ]
313 * [ "dn" [ "." { "exact" | "base" | "one" | "sub" | children"
314 * | "regex" | "anonymous" } ] "=" ] <dn pattern>
317 * "exact" and "base" are the same (exact match);
318 * "one" means exactly one rdn below, NOT including the pattern
319 * "sub" means any rdn below, including the pattern
320 * "children" means any rdn below, NOT including the pattern
322 * "anonymous" may be deprecated in favour
323 * of the pattern = "anonymous" form
328 * "time" [ "." { "soft" | "hard" } ] "=" <integer>
330 * "size" [ "." { "soft" | "hard" | "unchecked" } ] "=" <integer>
334 if ( strcmp( pattern, "*" ) == 0) {
335 flags = SLAP_LIMITS_ANY;
337 } else if ( strcasecmp( pattern, "anonymous" ) == 0 ) {
338 flags = SLAP_LIMITS_ANONYMOUS;
340 } else if ( strcasecmp( pattern, "users" ) == 0 ) {
341 flags = SLAP_LIMITS_USERS;
343 } else if ( strncasecmp( pattern, "dn", sizeof( "dn" ) - 1 ) == 0 ) {
344 pattern += sizeof( "dn" ) - 1;
345 if ( pattern[0] == '.' ) {
347 if ( strncasecmp( pattern, "exact", sizeof( "exact" ) - 1 ) == 0 ) {
348 flags = SLAP_LIMITS_EXACT;
349 pattern += sizeof( "exact" ) - 1;
351 } else if ( strncasecmp( pattern, "base", sizeof( "base" ) - 1 ) == 0 ) {
352 flags = SLAP_LIMITS_BASE;
353 pattern += sizeof( "base" ) - 1;
355 } else if ( strncasecmp( pattern, "one", sizeof( "one" ) - 1 ) == 0 ) {
356 flags = SLAP_LIMITS_ONE;
357 pattern += sizeof( "one" ) - 1;
359 } else if ( strncasecmp( pattern, "subtree", sizeof( "subtree" ) - 1 ) == 0 ) {
360 flags = SLAP_LIMITS_SUBTREE;
361 pattern += sizeof( "subtree" ) - 1;
363 } else if ( strncasecmp( pattern, "children", sizeof( "children" ) - 1 ) == 0 ) {
364 flags = SLAP_LIMITS_CHILDREN;
365 pattern += sizeof( "children" ) - 1;
367 } else if ( strncasecmp( pattern, "regex", sizeof( "regex" ) - 1 ) == 0 ) {
368 flags = SLAP_LIMITS_REGEX;
369 pattern += sizeof( "regex" ) - 1;
372 * this could be deprecated in favour
373 * of the pattern = "anonymous" form
375 } else if ( strncasecmp( pattern, "anonymous", sizeof( "anonymous" ) - 1 ) == 0 ) {
376 flags = SLAP_LIMITS_ANONYMOUS;
381 /* pre-check the data */
383 case SLAP_LIMITS_ANONYMOUS:
384 case SLAP_LIMITS_USERS:
386 /* no need for pattern */
391 if ( pattern[0] != '=' ) {
393 LDAP_LOG( CONFIG, CRIT,
394 "%s : line %d: missing '=' in "
395 "\"dn[.{exact|base|one|subtree"
396 "|children|regex|anonymous}]" "=<pattern>\" in "
397 "\"limits <pattern> <limits>\" line.\n", fname, lineno, 0 );
399 Debug( LDAP_DEBUG_ANY,
400 "%s : line %d: missing '=' in "
401 "\"dn[.{exact|base|one|subtree"
402 "|children|regex|anonymous}]"
404 "\"limits <pattern> <limits>\" "
411 /* skip '=' (required) */
414 /* trim obvious cases */
415 if ( strcmp( pattern, "*" ) == 0 ) {
416 flags = SLAP_LIMITS_ANY;
419 } else if ( flags == SLAP_LIMITS_REGEX
420 && strcmp( pattern, ".*" ) == 0 ) {
421 flags = SLAP_LIMITS_ANY;
426 } else if (strncasecmp( pattern, "group", sizeof( "group" ) - 1 ) == 0 ) {
427 pattern += sizeof( "group" ) - 1;
429 if ( pattern[0] == '/' ) {
430 struct berval oc, ad;
432 oc.bv_val = pattern + 1;
434 ad.bv_val = strchr(pattern, '/');
435 if ( ad.bv_val != NULL ) {
436 const char *text = NULL;
439 oc.bv_len = ad.bv_val - oc.bv_val;
442 ad.bv_len = strlen( ad.bv_val );
443 rc = slap_bv2ad( &ad, &group_ad, &text );
444 if ( rc != LDAP_SUCCESS ) {
448 pattern = ad.bv_val + ad.bv_len;
451 oc.bv_len = strlen( oc.bv_val );
453 pattern = oc.bv_val + oc.bv_len;
456 group_oc = oc_bvfind( &oc );
457 if ( group_oc == NULL ) {
462 if ( group_oc == NULL ) {
463 group_oc = oc_find( SLAPD_GROUP_CLASS );
464 if ( group_oc == NULL ) {
470 if ( group_ad == NULL ) {
471 const char *text = NULL;
474 rc = slap_str2ad( SLAPD_GROUP_ATTR, &group_ad, &text );
476 if ( rc != LDAP_SUCCESS ) {
482 flags = SLAP_LIMITS_TYPE_GROUP | SLAP_LIMITS_EXACT;
484 if ( pattern[0] != '=' ) {
486 LDAP_LOG( CONFIG, CRIT,
487 "%s : line %d: missing '=' in "
488 "\"group[/objectClass[/attributeType]]"
490 "\"limits <pattern> <limits>\" line.\n",
493 Debug( LDAP_DEBUG_ANY,
494 "%s : line %d: missing '=' in "
495 "\"group[/objectClass[/attributeType]]"
497 "\"limits <pattern> <limits>\" line.\n",
503 /* skip '=' (required) */
508 for ( i = 2; i < argc; i++ ) {
509 if ( parse_limit( argv[i], &limit ) ) {
512 LDAP_LOG( CONFIG, CRIT,
513 "%s : line %d: unknown limit values \"%s\" in "
514 "\"limits <pattern> <limits>\" line.\n",
515 fname, lineno, argv[i] );
517 Debug( LDAP_DEBUG_ANY,
518 "%s : line %d: unknown limit values \"%s\" in "
519 "\"limits <pattern> <limits>\" line.\n",
520 fname, lineno, argv[i] );
530 if ( limit.lms_t_hard > 0 &&
531 ( limit.lms_t_hard < limit.lms_t_soft
532 || limit.lms_t_soft == -1 ) ) {
533 limit.lms_t_hard = limit.lms_t_soft;
536 if ( limit.lms_s_hard > 0 &&
537 ( limit.lms_s_hard < limit.lms_s_soft
538 || limit.lms_s_soft == -1 ) ) {
539 limit.lms_s_hard = limit.lms_s_soft;
542 rc = add_limits( be, flags, pattern, group_oc, group_ad, &limit );
546 LDAP_LOG( CONFIG, CRIT,
547 "%s : line %d: unable to add limit in "
548 "\"limits <pattern> <limits>\" line.\n",
551 Debug( LDAP_DEBUG_ANY,
552 "%s : line %d: unable to add limit in "
553 "\"limits <pattern> <limits>\" line.\n",
564 struct slap_limits_set *limit
570 if ( strncasecmp( arg, "time", sizeof( "time" ) - 1 ) == 0 ) {
573 if ( arg[0] == '.' ) {
575 if ( strncasecmp( arg, "soft", sizeof( "soft" ) - 1 ) == 0 ) {
577 if ( arg[0] != '=' ) {
581 if ( strcasecmp( arg, "none" ) == 0 ) {
582 limit->lms_t_soft = -1;
587 strtol( arg, &next, 10 );
588 if ( next == arg || limit->lms_t_soft < -1 ) {
593 } else if ( strncasecmp( arg, "hard", sizeof( "hard" ) - 1 ) == 0 ) {
595 if ( arg[0] != '=' ) {
599 if ( strcasecmp( arg, "soft" ) == 0 ) {
600 limit->lms_t_hard = 0;
601 } else if ( strcasecmp( arg, "none" ) == 0 ) {
602 limit->lms_t_hard = -1;
607 strtol( arg, &next, 10 );
608 if ( next == arg || limit->lms_t_hard < -1 ) {
617 } else if ( arg[0] == '=' ) {
619 if ( strcasecmp( arg, "none" ) == 0 ) {
620 limit->lms_t_soft = -1;
624 limit->lms_t_soft = strtol( arg, &next, 10 );
625 if ( next == arg || limit->lms_t_soft < -1 ) {
629 limit->lms_t_hard = 0;
635 } else if ( strncasecmp( arg, "size", sizeof( "size" ) - 1 ) == 0 ) {
638 if ( arg[0] == '.' ) {
640 if ( strncasecmp( arg, "soft", sizeof( "soft" ) - 1 ) == 0 ) {
642 if ( arg[0] != '=' ) {
646 if ( strcasecmp( arg, "none" ) == 0 ) {
647 limit->lms_s_soft = -1;
652 strtol( arg, &next, 10 );
653 if ( next == arg || limit->lms_s_soft < -1 ) {
658 } else if ( strncasecmp( arg, "hard", sizeof( "hard" ) - 1 ) == 0 ) {
660 if ( arg[0] != '=' ) {
664 if ( strcasecmp( arg, "soft" ) == 0 ) {
665 limit->lms_s_hard = 0;
666 } else if ( strcasecmp( arg, "none" ) == 0 ) {
667 limit->lms_s_hard = -1;
672 strtol( arg, &next, 10 );
673 if ( next == arg || limit->lms_s_hard < -1 ) {
678 } else if ( strncasecmp( arg, "unchecked", sizeof( "unchecked" ) - 1 ) == 0 ) {
680 if ( arg[0] != '=' ) {
684 if ( strcasecmp( arg, "none" ) == 0 ) {
685 limit->lms_s_unchecked = -1;
689 limit->lms_s_unchecked =
690 strtol( arg, &next, 10 );
691 if ( next == arg || limit->lms_s_unchecked < -1 ) {
696 } else if ( strncasecmp( arg, "pr", sizeof( "pr" ) - 1 ) == 0 ) {
697 arg += sizeof( "pr" ) - 1;
698 if ( arg[0] != '=' ) {
702 if ( strcasecmp( arg, "noEstimate" ) == 0 ) {
703 limit->lms_s_pr_hide = 1;
708 strtol( arg, &next, 10 );
709 if ( next == arg || limit->lms_s_pr < -1 ) {
718 } else if ( arg[0] == '=' ) {
720 if ( strcasecmp( arg, "none" ) == 0 ) {
721 limit->lms_s_soft = -1;
725 limit->lms_s_soft = strtol( arg, &next, 10 );
726 if ( next == arg || limit->lms_s_soft < -1 ) {
730 limit->lms_s_hard = 0;