1 /* limits.c - routines to handle regex-based size and time limits */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 1998-2004 The OpenLDAP Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted only as authorized by the OpenLDAP
12 * A copy of this license is available in the file LICENSE in the
13 * top-level directory of the distribution or, alternatively, at
14 * <http://www.OpenLDAP.org/license.html>.
22 #include <ac/string.h>
30 struct slap_limits_set **limit
33 struct slap_limits **lm;
41 *limit = &op->o_bd->be_def_limit;
43 if ( op->o_bd->be_limits == NULL ) {
47 for ( lm = op->o_bd->be_limits; lm[0] != NULL; lm++ ) {
48 unsigned style = lm[0]->lm_flags & SLAP_LIMITS_MASK;
49 unsigned type = lm[0]->lm_flags & SLAP_LIMITS_TYPE_MASK;
52 case SLAP_LIMITS_EXACT:
53 if ( ndn->bv_len == 0 ) {
57 if ( type == SLAP_LIMITS_TYPE_GROUP ) {
60 rc = backend_group( op, NULL,
65 *limit = &lm[0]->lm_limits;
70 if ( dn_match( &lm[0]->lm_pat, ndn ) ) {
71 *limit = &lm[0]->lm_limits;
77 case SLAP_LIMITS_SUBTREE:
78 case SLAP_LIMITS_CHILDREN: {
81 if ( ndn->bv_len == 0 ) {
85 /* ndn shorter than dn_pat */
86 if ( ndn->bv_len < lm[0]->lm_pat.bv_len ) {
89 d = ndn->bv_len - lm[0]->lm_pat.bv_len;
91 /* allow exact match for SUBTREE only */
93 if ( style != SLAP_LIMITS_SUBTREE ) {
97 /* check for unescaped rdn separator */
98 if ( !DN_SEPARATOR( ndn->bv_val[d-1] ) ) {
103 /* in case of (sub)match ... */
104 if ( lm[0]->lm_pat.bv_len == ( ndn->bv_len - d )
105 && strcmp( lm[0]->lm_pat.bv_val,
106 &ndn->bv_val[d] ) == 0 )
108 /* check for exactly one rdn in case of ONE */
109 if ( style == SLAP_LIMITS_ONE ) {
111 * if ndn is more that one rdn
112 * below dn_pat, continue
114 if ( (size_t) dn_rdnlen( NULL, ndn )
121 *limit = &lm[0]->lm_limits;
128 case SLAP_LIMITS_REGEX:
129 if ( ndn->bv_len == 0 ) {
132 if ( regexec( &lm[0]->lm_regex, ndn->bv_val,
135 *limit = &lm[0]->lm_limits;
140 case SLAP_LIMITS_ANONYMOUS:
141 if ( ndn->bv_len == 0 ) {
142 *limit = &lm[0]->lm_limits;
147 case SLAP_LIMITS_USERS:
148 if ( ndn->bv_len != 0 ) {
149 *limit = &lm[0]->lm_limits;
154 case SLAP_LIMITS_ANY:
155 *limit = &lm[0]->lm_limits;
159 assert( 0 ); /* unreachable */
172 ObjectClass *group_oc,
173 AttributeDescription *group_ad,
174 struct slap_limits_set *limit
178 struct slap_limits *lm;
179 unsigned type, style;
184 type = flags & SLAP_LIMITS_TYPE_MASK;
185 style = flags & SLAP_LIMITS_MASK;
188 case SLAP_LIMITS_ANONYMOUS:
189 case SLAP_LIMITS_USERS:
190 case SLAP_LIMITS_ANY:
191 for ( i = 0; be->be_limits && be->be_limits[ i ]; i++ ) {
192 if ( be->be_limits[ i ]->lm_flags == style ) {
200 lm = ( struct slap_limits * )ch_calloc( sizeof( struct slap_limits ), 1 );
203 case SLAP_LIMITS_UNDEFINED:
204 style = SLAP_LIMITS_EXACT;
205 /* continue to next cases */
206 case SLAP_LIMITS_EXACT:
207 case SLAP_LIMITS_ONE:
208 case SLAP_LIMITS_SUBTREE:
209 case SLAP_LIMITS_CHILDREN:
210 lm->lm_flags = style | type;
214 bv.bv_val = (char *) pattern;
215 bv.bv_len = strlen( pattern );
217 rc = dnNormalize( 0, NULL, NULL, &bv, &lm->lm_pat, NULL );
218 if ( rc != LDAP_SUCCESS ) {
225 case SLAP_LIMITS_REGEX:
226 lm->lm_flags = style | type;
227 ber_str2bv( pattern, 0, 1, &lm->lm_pat );
228 if ( regcomp( &lm->lm_regex, lm->lm_pat.bv_val,
229 REG_EXTENDED | REG_ICASE ) ) {
230 free( lm->lm_pat.bv_val );
236 case SLAP_LIMITS_ANONYMOUS:
237 case SLAP_LIMITS_USERS:
238 case SLAP_LIMITS_ANY:
239 lm->lm_flags = style | type;
240 lm->lm_pat.bv_val = NULL;
241 lm->lm_pat.bv_len = 0;
246 case SLAP_LIMITS_TYPE_GROUP:
249 lm->lm_group_oc = group_oc;
250 lm->lm_group_ad = group_ad;
254 lm->lm_limits = *limit;
257 if ( be->be_limits != NULL ) {
258 for ( ; be->be_limits[i]; i++ );
261 be->be_limits = ( struct slap_limits ** )ch_realloc( be->be_limits,
262 sizeof( struct slap_limits * ) * ( i + 2 ) );
263 be->be_limits[i] = lm;
264 be->be_limits[i+1] = NULL;
278 int flags = SLAP_LIMITS_UNDEFINED;
280 struct slap_limits_set limit;
282 ObjectClass *group_oc = NULL;
283 AttributeDescription *group_ad = NULL;
289 LDAP_LOG( CONFIG, CRIT,
290 "%s : line %d: missing arg(s) in "
291 "\"limits <pattern> <limits>\" line.\n", fname, lineno, 0 );
293 Debug( LDAP_DEBUG_ANY,
294 "%s : line %d: missing arg(s) in "
295 "\"limits <pattern> <limits>\" line.\n%s",
301 limit = be->be_def_limit;
306 * "limits" <pattern> <limit> [ ... ]
313 * [ "dn" [ "." { "exact" | "base" | "onelevel" | "subtree" | children"
314 * | "regex" | "anonymous" } ] "=" ] <dn pattern>
317 * "exact" and "base" are the same (exact match);
318 * "onelevel" means exactly one rdn below, NOT including pattern
319 * "subtree" means any rdn below, including pattern
320 * "children" means any rdn below, NOT including pattern
322 * "anonymous" may be deprecated in favour
323 * of the pattern = "anonymous" form
325 * "group[/objectClass[/attributeType]]" "=" "<dn pattern>"
329 * "time" [ "." { "soft" | "hard" } ] "=" <integer>
331 * "size" [ "." { "soft" | "hard" | "unchecked" } ] "=" <integer>
335 if ( strcmp( pattern, "*" ) == 0) {
336 flags = SLAP_LIMITS_ANY;
338 } else if ( strcasecmp( pattern, "anonymous" ) == 0 ) {
339 flags = SLAP_LIMITS_ANONYMOUS;
341 } else if ( strcasecmp( pattern, "users" ) == 0 ) {
342 flags = SLAP_LIMITS_USERS;
344 } else if ( strncasecmp( pattern, "dn", sizeof( "dn" ) - 1 ) == 0 ) {
345 pattern += sizeof( "dn" ) - 1;
346 if ( pattern[0] == '.' ) {
348 if ( strncasecmp( pattern, "exact", sizeof( "exact" ) - 1 ) == 0 ) {
349 flags = SLAP_LIMITS_EXACT;
350 pattern += sizeof( "exact" ) - 1;
352 } else if ( strncasecmp( pattern, "base", sizeof( "base" ) - 1 ) == 0 ) {
353 flags = SLAP_LIMITS_BASE;
354 pattern += sizeof( "base" ) - 1;
356 } else if ( strncasecmp( pattern, "one", sizeof( "one" ) - 1 ) == 0 ) {
357 flags = SLAP_LIMITS_ONE;
358 pattern += sizeof( "one" ) - 1;
359 if ( strncasecmp( pattern, "level", sizeof( "level" ) - 1 ) == 0 ) {
360 pattern += sizeof( "level" ) - 1;
364 LDAP_LOG( CONFIG, WARNING ,
365 "%s : line %d: deprecated \"one\" style "
366 "\"limits <pattern> <limits>\" line; "
367 "use \"onelevel\" instead.\n", fname, lineno, 0 );
369 Debug( LDAP_DEBUG_ANY,
370 "%s : line %d: deprecated \"one\" style "
371 "\"limits <pattern> <limits>\" line; "
372 "use \"onelevel\" instead.\n", fname, lineno, 0 );
376 } else if ( strncasecmp( pattern, "sub", sizeof( "sub" ) - 1 ) == 0 ) {
377 flags = SLAP_LIMITS_SUBTREE;
378 pattern += sizeof( "sub" ) - 1;
379 if ( strncasecmp( pattern, "tree", sizeof( "tree" ) - 1 ) == 0 ) {
380 pattern += sizeof( "tree" ) - 1;
384 LDAP_LOG( CONFIG, WARNING ,
385 "%s : line %d: deprecated \"sub\" style "
386 "\"limits <pattern> <limits>\" line; "
387 "use \"subtree\" instead.\n", fname, lineno, 0 );
389 Debug( LDAP_DEBUG_ANY,
390 "%s : line %d: deprecated \"sub\" style "
391 "\"limits <pattern> <limits>\" line; "
392 "use \"subtree\" instead.\n", fname, lineno, 0 );
396 } else if ( strncasecmp( pattern, "children", sizeof( "children" ) - 1 ) == 0 ) {
397 flags = SLAP_LIMITS_CHILDREN;
398 pattern += sizeof( "children" ) - 1;
400 } else if ( strncasecmp( pattern, "regex", sizeof( "regex" ) - 1 ) == 0 ) {
401 flags = SLAP_LIMITS_REGEX;
402 pattern += sizeof( "regex" ) - 1;
405 * this could be deprecated in favour
406 * of the pattern = "anonymous" form
408 } else if ( strncasecmp( pattern, "anonymous", sizeof( "anonymous" ) - 1 ) == 0 ) {
409 flags = SLAP_LIMITS_ANONYMOUS;
414 /* pre-check the data */
416 case SLAP_LIMITS_ANONYMOUS:
417 case SLAP_LIMITS_USERS:
419 /* no need for pattern */
424 if ( pattern[0] != '=' ) {
426 LDAP_LOG( CONFIG, CRIT,
427 "%s : line %d: missing '=' in "
428 "\"dn[.{exact|base|onelevel|subtree"
429 "|children|regex|anonymous}]" "=<pattern>\" in "
430 "\"limits <pattern> <limits>\" line.\n", fname, lineno, 0 );
432 Debug( LDAP_DEBUG_ANY,
433 "%s : line %d: missing '=' in "
434 "\"dn[.{exact|base|onelevel|subtree"
435 "|children|regex|anonymous}]"
437 "\"limits <pattern> <limits>\" "
444 /* skip '=' (required) */
447 /* trim obvious cases */
448 if ( strcmp( pattern, "*" ) == 0 ) {
449 flags = SLAP_LIMITS_ANY;
452 } else if ( flags == SLAP_LIMITS_REGEX
453 && strcmp( pattern, ".*" ) == 0 ) {
454 flags = SLAP_LIMITS_ANY;
459 } else if (strncasecmp( pattern, "group", sizeof( "group" ) - 1 ) == 0 ) {
460 pattern += sizeof( "group" ) - 1;
462 if ( pattern[0] == '/' ) {
463 struct berval oc, ad;
465 oc.bv_val = pattern + 1;
467 ad.bv_val = strchr(pattern, '/');
468 if ( ad.bv_val != NULL ) {
469 const char *text = NULL;
472 oc.bv_len = ad.bv_val - oc.bv_val;
475 ad.bv_len = strlen( ad.bv_val );
476 rc = slap_bv2ad( &ad, &group_ad, &text );
477 if ( rc != LDAP_SUCCESS ) {
481 pattern = ad.bv_val + ad.bv_len;
484 oc.bv_len = strlen( oc.bv_val );
486 pattern = oc.bv_val + oc.bv_len;
489 group_oc = oc_bvfind( &oc );
490 if ( group_oc == NULL ) {
495 if ( group_oc == NULL ) {
496 group_oc = oc_find( SLAPD_GROUP_CLASS );
497 if ( group_oc == NULL ) {
503 if ( group_ad == NULL ) {
504 const char *text = NULL;
507 rc = slap_str2ad( SLAPD_GROUP_ATTR, &group_ad, &text );
509 if ( rc != LDAP_SUCCESS ) {
515 flags = SLAP_LIMITS_TYPE_GROUP | SLAP_LIMITS_EXACT;
517 if ( pattern[0] != '=' ) {
519 LDAP_LOG( CONFIG, CRIT,
520 "%s : line %d: missing '=' in "
521 "\"group[/objectClass[/attributeType]]"
523 "\"limits <pattern> <limits>\" line.\n",
526 Debug( LDAP_DEBUG_ANY,
527 "%s : line %d: missing '=' in "
528 "\"group[/objectClass[/attributeType]]"
530 "\"limits <pattern> <limits>\" line.\n",
536 /* skip '=' (required) */
541 for ( i = 2; i < argc; i++ ) {
542 if ( limits_parse_one( argv[i], &limit ) ) {
545 LDAP_LOG( CONFIG, CRIT,
546 "%s : line %d: unknown limit values \"%s\" in "
547 "\"limits <pattern> <limits>\" line.\n",
548 fname, lineno, argv[i] );
550 Debug( LDAP_DEBUG_ANY,
551 "%s : line %d: unknown limit values \"%s\" in "
552 "\"limits <pattern> <limits>\" line.\n",
553 fname, lineno, argv[i] );
563 if ( limit.lms_t_hard > 0 &&
564 ( limit.lms_t_hard < limit.lms_t_soft
565 || limit.lms_t_soft == -1 ) ) {
566 limit.lms_t_hard = limit.lms_t_soft;
569 if ( limit.lms_s_hard > 0 &&
570 ( limit.lms_s_hard < limit.lms_s_soft
571 || limit.lms_s_soft == -1 ) ) {
572 limit.lms_s_hard = limit.lms_s_soft;
575 rc = limits_add( be, flags, pattern, group_oc, group_ad, &limit );
579 LDAP_LOG( CONFIG, CRIT,
580 "%s : line %d: unable to add limit in "
581 "\"limits <pattern> <limits>\" line.\n",
584 Debug( LDAP_DEBUG_ANY,
585 "%s : line %d: unable to add limit in "
586 "\"limits <pattern> <limits>\" line.\n",
597 struct slap_limits_set *limit
603 if ( strncasecmp( arg, "time", sizeof( "time" ) - 1 ) == 0 ) {
606 if ( arg[0] == '.' ) {
608 if ( strncasecmp( arg, "soft", sizeof( "soft" ) - 1 ) == 0 ) {
610 if ( arg[0] != '=' ) {
614 if ( strcasecmp( arg, "none" ) == 0 ) {
615 limit->lms_t_soft = -1;
620 strtol( arg, &next, 10 );
621 if ( next == arg || limit->lms_t_soft < -1 ) {
626 } else if ( strncasecmp( arg, "hard", sizeof( "hard" ) - 1 ) == 0 ) {
628 if ( arg[0] != '=' ) {
632 if ( strcasecmp( arg, "soft" ) == 0 ) {
633 limit->lms_t_hard = 0;
634 } else if ( strcasecmp( arg, "none" ) == 0 ) {
635 limit->lms_t_hard = -1;
640 strtol( arg, &next, 10 );
641 if ( next == arg || limit->lms_t_hard < -1 ) {
650 } else if ( arg[0] == '=' ) {
652 if ( strcasecmp( arg, "none" ) == 0 ) {
653 limit->lms_t_soft = -1;
657 limit->lms_t_soft = strtol( arg, &next, 10 );
658 if ( next == arg || limit->lms_t_soft < -1 ) {
662 limit->lms_t_hard = 0;
668 } else if ( strncasecmp( arg, "size", sizeof( "size" ) - 1 ) == 0 ) {
671 if ( arg[0] == '.' ) {
673 if ( strncasecmp( arg, "soft", sizeof( "soft" ) - 1 ) == 0 ) {
675 if ( arg[0] != '=' ) {
679 if ( strcasecmp( arg, "none" ) == 0 ) {
680 limit->lms_s_soft = -1;
685 strtol( arg, &next, 10 );
686 if ( next == arg || limit->lms_s_soft < -1 ) {
691 } else if ( strncasecmp( arg, "hard", sizeof( "hard" ) - 1 ) == 0 ) {
693 if ( arg[0] != '=' ) {
697 if ( strcasecmp( arg, "soft" ) == 0 ) {
698 limit->lms_s_hard = 0;
699 } else if ( strcasecmp( arg, "none" ) == 0 ) {
700 limit->lms_s_hard = -1;
705 strtol( arg, &next, 10 );
706 if ( next == arg || limit->lms_s_hard < -1 ) {
711 } else if ( strncasecmp( arg, "unchecked", sizeof( "unchecked" ) - 1 ) == 0 ) {
713 if ( arg[0] != '=' ) {
717 if ( strcasecmp( arg, "none" ) == 0 ) {
718 limit->lms_s_unchecked = -1;
722 limit->lms_s_unchecked =
723 strtol( arg, &next, 10 );
724 if ( next == arg || limit->lms_s_unchecked < -1 ) {
729 } else if ( strncasecmp( arg, "pr", sizeof( "pr" ) - 1 ) == 0 ) {
730 arg += sizeof( "pr" ) - 1;
731 if ( arg[0] != '=' ) {
735 if ( strcasecmp( arg, "noEstimate" ) == 0 ) {
736 limit->lms_s_pr_hide = 1;
741 strtol( arg, &next, 10 );
742 if ( next == arg || limit->lms_s_pr < -1 ) {
751 } else if ( arg[0] == '=' ) {
753 if ( strcasecmp( arg, "none" ) == 0 ) {
754 limit->lms_s_soft = -1;
758 limit->lms_s_soft = strtol( arg, &next, 10 );
759 if ( next == arg || limit->lms_s_soft < -1 ) {
763 limit->lms_s_hard = 0;
775 limits_check( Operation *op, SlapReply *rs )
779 /* FIXME: should this be always true? */
780 assert( op->o_tag == LDAP_REQ_SEARCH);
782 /* allow root to set no limit */
783 if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
784 op->ors_limit = NULL;
786 if ( op->ors_tlimit == 0 ) {
790 if ( op->ors_slimit == 0 ) {
794 /* if not root, get appropriate limits */
796 ( void ) limits_get( op, &op->o_ndn, &op->ors_limit );
798 assert( op->ors_limit != NULL );
800 /* if no limit is required, use soft limit */
801 if ( op->ors_tlimit <= 0 ) {
802 op->ors_tlimit = op->ors_limit->lms_t_soft;
804 /* if requested limit higher than hard limit, abort */
805 } else if ( op->ors_tlimit > op->ors_limit->lms_t_hard ) {
806 /* no hard limit means use soft instead */
807 if ( op->ors_limit->lms_t_hard == 0
808 && op->ors_limit->lms_t_soft > -1
809 && op->ors_tlimit > op->ors_limit->lms_t_soft ) {
810 op->ors_tlimit = op->ors_limit->lms_t_soft;
812 /* positive hard limit means abort */
813 } else if ( op->ors_limit->lms_t_hard > 0 ) {
814 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
815 send_ldap_result( op, rs );
816 rs->sr_err = LDAP_SUCCESS;
820 /* negative hard limit means no limit */
823 /* if no limit is required, use soft limit */
824 if ( op->ors_slimit <= 0 ) {
825 if ( get_pagedresults( op ) && op->ors_limit->lms_s_pr != 0 ) {
826 op->ors_slimit = op->ors_limit->lms_s_pr;
828 op->ors_slimit = op->ors_limit->lms_s_soft;
831 /* if requested limit higher than hard limit, abort */
832 } else if ( op->ors_slimit > op->ors_limit->lms_s_hard ) {
833 /* no hard limit means use soft instead */
834 if ( op->ors_limit->lms_s_hard == 0
835 && op->ors_limit->lms_s_soft > -1
836 && op->ors_slimit > op->ors_limit->lms_s_soft ) {
837 op->ors_slimit = op->ors_limit->lms_s_soft;
839 /* positive hard limit means abort */
840 } else if ( op->ors_limit->lms_s_hard > 0 ) {
841 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
842 send_ldap_result( op, rs );
843 rs->sr_err = LDAP_SUCCESS;
847 /* negative hard limit means no limit */