job-list: limit constraint comparisons to avoid DoS

src/cmd/job/list.c

@@ -119,7 +119,7 @@ int cmd_list (optparse_t *p, int argc, char **argv)
                              "constraint", c)))
         log_err_exit ("flux_rpc_pack");
     if (flux_rpc_get_unpack (f, "{s:o}", "jobs", &jobs) < 0)
-        log_err_exit ("flux job-list.list");
+        log_msg_exit ("flux job-list.list: %s", future_strerror (f, errno));
     json_array_foreach (jobs, index, value) {
         char *str;
         str = json_dumps (value, 0);
@@ -173,7 +173,7 @@ int cmd_list_inactive (optparse_t *p, int argc, char **argv)
                              "constraint", c)))
         log_err_exit ("flux_rpc_pack");
     if (flux_rpc_get_unpack (f, "{s:o}", "jobs", &jobs) < 0)
-        log_err_exit ("flux job-list.list");
+        log_msg_exit ("flux job-list.list: %s", future_strerror (f, errno));
     json_array_foreach (jobs, index, value) {
         char *str;
         str = json_dumps (value, 0);
@@ -193,7 +193,7 @@ void list_id_continuation (flux_future_t *f, void *arg)
     json_t *job;
     char *str;
     if (flux_rpc_get_unpack (f, "{s:o}", "job", &job) < 0)
-        log_err_exit ("flux_job_list_id");
+        log_msg_exit ("flux job-list.list-d: %s", future_strerror (f, errno));
     str = json_dumps (job, 0);
     if (!str)
         log_msg_exit ("error parsing list-id response");

src/modules/job-list/job-list.c

@@ -138,6 +138,10 @@ static void config_reload_cb (flux_t *h,
         errstr = error.text;
         goto error;
     }
+    if (job_match_config_reload (ctx->mctx, conf, &error) < 0) {
+        errstr = error.text;
+        goto error;
+    }
     if (flux_respond (h, msg, NULL) < 0)
         flux_log_error (h, "error responding to config-reload request");
     return;
@@ -206,6 +210,8 @@ static void list_ctx_destroy (struct list_ctx *ctx)
             job_state_destroy (ctx->jsctx);
         if (ctx->isctx)
             idsync_ctx_destroy (ctx->isctx);
+        if (ctx->mctx)
+            match_ctx_destroy (ctx->mctx);
         free (ctx);
         errno = saved_errno;
     }
@@ -227,6 +233,8 @@ static struct list_ctx *list_ctx_create (flux_t *h)
         goto error;
     if (!(ctx->deferred_requests = flux_msglist_create ()))
         goto error;
+    if (!(ctx->mctx = match_ctx_create (ctx->h)))
+        goto error;
     return ctx;
 error:
     list_ctx_destroy (ctx);

src/modules/job-list/job-list.h

@@ -17,13 +17,15 @@
 
 #include "job_state.h"
 #include "idsync.h"
+#include "match.h"
 
 struct list_ctx {
     flux_t *h;
     flux_msg_handler_t **handlers;
     struct job_state_ctx *jsctx;
     struct idsync_ctx *isctx;
     struct flux_msglist *deferred_requests;
+    struct match_ctx *mctx;
 };
 
 const char **job_attrs (void);

src/modules/job-list/list.c

@@ -56,6 +56,7 @@ int get_jobs_from_list (json_t *jobs,
 
     job = zlistx_first (list);
     while (job) {
+        int ret;
 
         /*  If job->t_inactive > 0. we're on the inactive jobs list and jobs are
          *  sorted on the inactive list, larger t_inactive first.
@@ -68,7 +69,9 @@ int get_jobs_from_list (json_t *jobs,
         if (job->t_inactive > 0. && job->t_inactive <= since)
             break;
 
-        if (job_match (job, c)) {
+        if ((ret = job_match (job, c, errp)) < 0)
+            return -1;
+        if (ret) {
             json_t *o;
             if (!(o = job_to_json (job, attrs, errp)))
                 return -1;
@@ -311,7 +314,7 @@ void list_cb (flux_t *h, flux_msg_handler_t *mh,
         errno = EPROTO;
         goto error;
     }
-    if (!(c = list_constraint_create (constraint, &error))) {
+    if (!(c = list_constraint_create (ctx->mctx, constraint, &error))) {
         errprintf (&err,
                    "invalid payload: constraint object invalid: %s",
                    error.text);