lib/dns/acl.c

	acl.c revision 18d0b5e54be891a1aa938c165b6d439859121ec8
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson/*
69fe9aaafdd6a141610e86a777d325db75422070Mark Andrews * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * Copyright (C) 1999-2002  Internet Software Consortium.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence *
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * Permission to use, copy, modify, and distribute this software for any
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * purpose with or without fee is hereby granted, provided that the above
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * copyright notice and this permission notice appear in all copies.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence *
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * PERFORMANCE OF THIS SOFTWARE.
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews/* $Id: acl.c,v 1.28 2005/07/12 01:00:14 marka Exp $ */
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein/*! \file */
9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <config.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <isc/mem.h>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#include <isc/string.h>
364a82f7c25b62967678027043425201a5e5171aBob Halley#include <isc/util.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <dns/acl.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonisc_result_t
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    isc_result_t result;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    dns_acl_t *acl;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence    /*
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence     * Work around silly limitation of isc_mem_get().
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence     */
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (n == 0)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        n = 1;
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl = isc_mem_get(mctx, sizeof(*acl));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    if (acl == NULL)
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        return (ISC_R_NOMEMORY);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->mctx = mctx;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->name = NULL;
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews    result = isc_refcount_init(&acl->refcount, 1);
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews    if (result != ISC_R_SUCCESS) {
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews        isc_mem_put(mctx, acl, sizeof(*acl));
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews        return (result);
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews    }
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements = NULL;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->alloc = 0;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->length = 0;
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    ISC_LINK_INIT(acl, nextincache);
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence    /*
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence     * Must set magic early because we use dns_acl_detach() to clean up.
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence     */
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence    acl->magic = DNS_ACL_MAGIC;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements = isc_mem_get(mctx, n * sizeof(dns_aclelement_t));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    if (acl->elements == NULL) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        result = ISC_R_NOMEMORY;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        goto cleanup;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    }
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->alloc = n;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    memset(acl->elements, 0, n * sizeof(dns_aclelement_t));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    *target = acl;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (ISC_R_SUCCESS);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson cleanup:
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    dns_acl_detach(&acl);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (result);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssonisc_result_t
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_acl_appendelement(dns_acl_t *acl, dns_aclelement_t *elt) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (acl->length + 1 > acl->alloc) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        /*
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson         * Resize the ACL.
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson         */
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        unsigned int newalloc;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        void *newmem;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        newalloc = acl->alloc * 2;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        if (newalloc < 4)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            newalloc = 4;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        newmem = isc_mem_get(acl->mctx,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                     newalloc * sizeof(dns_aclelement_t));
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        if (newmem == NULL)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            return (ISC_R_NOMEMORY);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        memcpy(newmem, acl->elements,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson               acl->length * sizeof(dns_aclelement_t));
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        isc_mem_put(acl->mctx, acl->elements,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                acl->alloc * sizeof(dns_aclelement_t));
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        acl->elements = newmem;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        acl->alloc = newalloc;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    }
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    /*
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson     * Append the new element.
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson     */
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    acl->elements[acl->length++] = *elt;
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    return (ISC_R_SUCCESS);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonstatic isc_result_t
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_acl_anyornone(isc_mem_t *mctx, isc_boolean_t neg, dns_acl_t **target) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    isc_result_t result;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    dns_acl_t *acl = NULL;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    result = dns_acl_create(mctx, 1, &acl);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    if (result != ISC_R_SUCCESS)
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        return (result);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements[0].negative = neg;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements[0].type = dns_aclelementtype_any;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->length = 1;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    *target = acl;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (result);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonisc_result_t
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssondns_acl_any(isc_mem_t *mctx, dns_acl_t **target) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (dns_acl_anyornone(mctx, ISC_FALSE, target));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonisc_result_t
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssondns_acl_none(isc_mem_t *mctx, dns_acl_t **target) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (dns_acl_anyornone(mctx, ISC_TRUE, target));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonisc_result_t
fd0bc40a2580299d20ae212d89bda13862d78b3aAndreas Gustafssondns_acl_match(isc_netaddr_t *reqaddr,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          dns_name_t *reqsigner,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          dns_acl_t *acl,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson          dns_aclenv_t *env,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          int *match,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          dns_aclelement_t **matchelt)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson{
8bb77cd31b7518fb5d2a6a9d75e16e4abd59df61Andreas Gustafsson    unsigned int i;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
d8d0c5b1bc97ac0f07e35a31b58ced80ce613c55David Lawrence    REQUIRE(reqaddr != NULL);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    REQUIRE(matchelt == NULL || *matchelt == NULL);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
8bb77cd31b7518fb5d2a6a9d75e16e4abd59df61Andreas Gustafsson    for (i = 0; i < acl->length; i++) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        dns_aclelement_t *e = &acl->elements[i];
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence
ba7ea2326d98edb4296098749fc9cf44b5157643David Lawrence        if (dns_aclelement_match(reqaddr, reqsigner,
ba7ea2326d98edb4296098749fc9cf44b5157643David Lawrence                     e, env, matchelt)) {
8bb77cd31b7518fb5d2a6a9d75e16e4abd59df61Andreas Gustafsson            *match = e->negative ? -((int)i+1) : ((int)i+1);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            return (ISC_R_SUCCESS);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    /* No match. */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    *match = 0;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    return (ISC_R_SUCCESS);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrewsisc_result_t
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrewsdns_acl_elementmatch(dns_acl_t *acl,
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews             dns_aclelement_t *elt,
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews             dns_aclelement_t **matchelt)
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews{
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews    unsigned int i;
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews    REQUIRE(elt != NULL);
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews    REQUIRE(matchelt == NULL || *matchelt == NULL);
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews    for (i = 0; i < acl->length; i++) {
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews        dns_aclelement_t *e = &acl->elements[i];
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews        if (dns_aclelement_equal(e, elt) == ISC_TRUE) {
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews            if (matchelt != NULL)
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews                *matchelt = e;
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews            return (ISC_R_SUCCESS);
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews        }
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews    }
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews    return (ISC_R_NOTFOUND);
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews}
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafssonisc_boolean_t
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafssondns_aclelement_match(isc_netaddr_t *reqaddr,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson             dns_name_t *reqsigner,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson             dns_aclelement_t *e,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson             dns_aclenv_t *env,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson             dns_aclelement_t **matchelt)
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson{
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    dns_acl_t *inner = NULL;
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington    isc_netaddr_t *addr;
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington    isc_netaddr_t v4addr;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    int indirectmatch;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    isc_result_t result;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    switch (e->type) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    case dns_aclelementtype_ipprefix:
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington        if (env == NULL ||
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington            env->match_mapped == ISC_FALSE ||
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington            reqaddr->family != AF_INET6 ||
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington            !IN6_IS_ADDR_V4MAPPED(&reqaddr->type.in6))
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington            addr = reqaddr;
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington        else {
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington            isc_netaddr_fromv4mapped(&v4addr, reqaddr);
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington            addr = &v4addr;
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington        }
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington        if (isc_netaddr_eqprefix(addr,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson                     &e->u.ip_prefix.address,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson                     e->u.ip_prefix.prefixlen))
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            goto matched;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        break;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    case dns_aclelementtype_keyname:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        if (reqsigner != NULL &&
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            dns_name_equal(reqsigner, &e->u.keyname))
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            goto matched;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        break;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    case dns_aclelementtype_nestedacl:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        inner = e->u.nestedacl;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    nested:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        result = dns_acl_match(reqaddr, reqsigner,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson                       inner,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson                       env,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson                       &indirectmatch, matchelt);
ba7ea2326d98edb4296098749fc9cf44b5157643David Lawrence        INSIST(result == ISC_R_SUCCESS);
ba7ea2326d98edb4296098749fc9cf44b5157643David Lawrence
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        /*
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         * Treat negative matches in indirect ACLs as
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         * "no match".
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         * That way, a negated indirect ACL will never become
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         * a surprise positive match through double negation.
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         * XXXDCL this should be documented.
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         */
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        if (indirectmatch > 0)
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            goto matchelt_set;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        /*
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         * A negative indirect match may have set *matchelt,
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         * but we don't want it set when we return.
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson         */
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        if (matchelt != NULL)
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            *matchelt = NULL;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        break;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    case dns_aclelementtype_any:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    matched:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        if (matchelt != NULL)
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            *matchelt = e;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    matchelt_set:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        return (ISC_TRUE);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    case dns_aclelementtype_localhost:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        if (env != NULL && env->localhost != NULL) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            inner = env->localhost;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            goto nested;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        } else {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            break;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        }
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    case dns_aclelementtype_localnets:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        if (env != NULL && env->localnets != NULL) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            inner = env->localnets;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            goto nested;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        } else {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson            break;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        }
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    default:
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        INSIST(0);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson        break;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    }
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson    return (ISC_FALSE);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson}
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonvoid
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_acl_attach(dns_acl_t *source, dns_acl_t **target) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    REQUIRE(DNS_ACL_VALID(source));
aa23a35d81a9618a40c4a9b44be48009553e4777Andreas Gustafsson    isc_refcount_increment(&source->refcount, NULL);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    *target = source;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonstatic void
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedestroy(dns_acl_t *dacl) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    unsigned int i;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    for (i = 0; i < dacl->length; i++) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        dns_aclelement_t *de = &dacl->elements[i];
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        switch (de->type) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_keyname:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            dns_name_free(&de->u.keyname, dacl->mctx);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_nestedacl:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            dns_acl_detach(&de->u.nestedacl);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        default:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (dacl->elements != NULL)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        isc_mem_put(dacl->mctx, dacl->elements,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                dacl->alloc * sizeof(dns_aclelement_t));
ea419adc4eca4c3e44f2c282035b5dce6b795fe2Andreas Gustafsson    if (dacl->name != NULL)
ea419adc4eca4c3e44f2c282035b5dce6b795fe2Andreas Gustafsson        isc_mem_free(dacl->mctx, dacl->name);
aa23a35d81a9618a40c4a9b44be48009553e4777Andreas Gustafsson    isc_refcount_destroy(&dacl->refcount);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    dacl->magic = 0;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    isc_mem_put(dacl->mctx, dacl, sizeof(*dacl));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonvoid
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_acl_detach(dns_acl_t **aclp) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    dns_acl_t *acl = *aclp;
aa23a35d81a9618a40c4a9b44be48009553e4777Andreas Gustafsson    unsigned int refs;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    REQUIRE(DNS_ACL_VALID(acl));
aa23a35d81a9618a40c4a9b44be48009553e4777Andreas Gustafsson    isc_refcount_decrement(&acl->refcount, &refs);
aa23a35d81a9618a40c4a9b44be48009553e4777Andreas Gustafsson    if (refs == 0)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        destroy(acl);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    *aclp = NULL;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonisc_boolean_t
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_aclelement_equal(dns_aclelement_t *ea, dns_aclelement_t *eb) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (ea->type != eb->type)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    switch (ea->type) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_ipprefix:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        if (ea->u.ip_prefix.prefixlen !=
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            eb->u.ip_prefix.prefixlen)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            return (ISC_FALSE);
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews        return (isc_netaddr_eqprefix(&ea->u.ip_prefix.address,
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews                         &eb->u.ip_prefix.address,
aa39170da817cae7b4c6c735cc832e05ec3d2351Mark Andrews                         ea->u.ip_prefix.prefixlen));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_keyname:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (dns_name_equal(&ea->u.keyname, &eb->u.keyname));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_nestedacl:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (dns_acl_equal(ea->u.nestedacl, eb->u.nestedacl));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_localhost:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_localnets:
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    case dns_aclelementtype_any:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_TRUE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    default:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        INSIST(0);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonisc_boolean_t
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondns_acl_equal(dns_acl_t *a, dns_acl_t *b) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    unsigned int i;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (a == b)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_TRUE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (a->length != b->length)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    for (i = 0; i < a->length; i++) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        if (! dns_aclelement_equal(&a->elements[i],
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                       &b->elements[i]))
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    return (ISC_TRUE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafssonstatic isc_boolean_t
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafssonis_loopback(dns_aclipprefix_t *p) {
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    switch (p->address.family) {
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    case AF_INET:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        if (p->prefixlen == 32 &&
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            htonl(p->address.type.in.s_addr) == INADDR_LOOPBACK)
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            return (ISC_TRUE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        break;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    case AF_INET6:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        if (p->prefixlen == 128 &&
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            IN6_IS_ADDR_LOOPBACK(&p->address.type.in6))
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            return (ISC_TRUE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        break;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    default:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        break;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    }
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    return (ISC_FALSE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson}
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafssonisc_boolean_t
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafssondns_acl_isinsecure(dns_acl_t *a) {
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    unsigned int i;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    for (i = 0; i < a->length; i++) {
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        dns_aclelement_t *e = &a->elements[i];
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        /* A negated match can never be insecure. */
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        if (e->negative)
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            continue;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        switch (e->type) {
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        case dns_aclelementtype_ipprefix:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            /* The loopback address is considered secure. */
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            if (! is_loopback(&e->u.ip_prefix))
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson                return (ISC_TRUE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            continue;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        case dns_aclelementtype_keyname:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        case dns_aclelementtype_localhost:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            continue;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        case dns_aclelementtype_nestedacl:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            if (dns_acl_isinsecure(e->u.nestedacl))
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson                return (ISC_TRUE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            continue;
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        case dns_aclelementtype_localnets:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        case dns_aclelementtype_any:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            return (ISC_TRUE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        default:
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            INSIST(0);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson            return (ISC_TRUE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson        }
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    }
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    /* No insecure elements were found. */
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson    return (ISC_FALSE);
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson}
9c566a852f31c3a5d0b9d6eaf11463114339c01dAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssonisc_result_t
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    isc_result_t result;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    env->localhost = NULL;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    env->localnets = NULL;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    result = dns_acl_create(mctx, 0, &env->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (result != ISC_R_SUCCESS)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        goto cleanup_nothing;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    result = dns_acl_create(mctx, 0, &env->localnets);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (result != ISC_R_SUCCESS)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        goto cleanup_localhost;
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington    env->match_mapped = ISC_FALSE;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    return (ISC_R_SUCCESS);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson cleanup_localhost:
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&env->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson cleanup_nothing:
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    return (result);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencevoid
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&t->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_attach(s->localhost, &t->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&t->localnets);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_attach(s->localnets, &t->localnets);
6eccf5bd07eb9abf65cc08fec4a8fc97b62c0e1bBrian Wellington    t->match_mapped = s->match_mapped;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencevoid
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencedns_aclenv_destroy(dns_aclenv_t *env) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&env->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&env->localnets);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}