lib/dns/acl.c

	acl.c revision a1747570262ed336c213aaf6bd31bc91993a46de
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson/*
7d32c065c7bb56f281651ae3dd2888f32ce4f1d9Bob Halley * Copyright (C) 1999, 2000  Internet Software Consortium.
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson *
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * Permission to use, copy, modify, and distribute this software for any
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * purpose with or without fee is hereby granted, provided that the above
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * copyright notice and this permission notice appear in all copies.
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson *
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson * SOFTWARE.
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <config.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
dd796c4d62cfd6ad04198537ceaeba385ed3ef4eMark Andrews#include <string.h>
dd796c4d62cfd6ad04198537ceaeba385ed3ef4eMark Andrews
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <isc/assertions.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <isc/error.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <isc/mem.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <isc/result.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <dns/acl.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <dns/log.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <dns/result.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson#include <dns/types.h>
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonisc_result_t
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssondns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target)
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson{
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    isc_result_t result;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    dns_acl_t *acl;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson     /*
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson      * Work around silly limitation of isc_mem_get().
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson      */
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (n == 0)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        n = 1;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl = isc_mem_get(mctx, sizeof(*acl));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    if (acl == NULL)
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        return (ISC_R_NOMEMORY);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->mctx = mctx;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->name = NULL;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->refcount = 1;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements = NULL;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->alloc = 0;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->length = 0;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    ISC_LINK_INIT(acl, nextincache);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    /* Must set magic early because we use dns_acl_detach() to clean up. */
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->magic = DNS_ACL_MAGIC;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements = isc_mem_get(mctx, n * sizeof(dns_aclelement_t));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    if (acl->elements == NULL) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        result = ISC_R_NOMEMORY;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        goto cleanup;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    }
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->alloc = n;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    memset(acl->elements, 0, n * sizeof(dns_aclelement_t));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    *target = acl;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (ISC_R_SUCCESS);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson cleanup:
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    dns_acl_detach(&acl);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (result);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssonisc_result_t
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssondns_acl_appendelement(dns_acl_t *acl, dns_aclelement_t *elt)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson{
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (acl->length + 1 > acl->alloc) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        /*
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson         * Resize the ACL.
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson         */
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        unsigned int newalloc;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        void *newmem;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        newalloc = acl->alloc * 2;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        if (newalloc < 4)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            newalloc = 4;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        newmem = isc_mem_get(acl->mctx,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                     newalloc * sizeof(dns_aclelement_t));
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        if (newmem == NULL)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            return (ISC_R_NOMEMORY);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        memcpy(newmem, acl->elements,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson               acl->length * sizeof(dns_aclelement_t));
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        isc_mem_put(acl->mctx, acl->elements,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                acl->alloc * sizeof(dns_aclelement_t));
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        acl->elements = newmem;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        acl->alloc = newalloc;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    }
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    /*
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson     * Append the new element.
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson     */
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    acl->elements[acl->length++] = *elt;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    return (ISC_R_SUCCESS);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonstatic isc_result_t
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssondns_acl_anyornone(isc_mem_t *mctx, isc_boolean_t neg, dns_acl_t **target)
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson{
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    isc_result_t result;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    dns_acl_t *acl = NULL;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    result = dns_acl_create(mctx, 1, &acl);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    if (result != ISC_R_SUCCESS)
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        return (result);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements[0].negative = neg;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->elements[0].type = dns_aclelementtype_any;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    acl->length = 1;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    *target = acl;
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (result);
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonisc_result_t
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssondns_acl_any(isc_mem_t *mctx, dns_acl_t **target) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (dns_acl_anyornone(mctx, ISC_FALSE, target));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssonisc_result_t
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafssondns_acl_none(isc_mem_t *mctx, dns_acl_t **target) {
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    return (dns_acl_anyornone(mctx, ISC_TRUE, target));
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson}
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonisc_result_t
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondns_acl_checkrequest(dns_name_t *signer, isc_sockaddr_t *reqaddr,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             const char *opname,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             dns_acl_t *main_acl,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             dns_acl_t *fallback_acl,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson             dns_aclenv_t *env,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             isc_boolean_t default_allow)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson{
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    isc_result_t result;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    int match;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    dns_acl_t *acl = NULL;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (main_acl != NULL)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        acl = main_acl;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    else if (fallback_acl != NULL)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        acl = fallback_acl;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    else if (default_allow)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        goto allow;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    else
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        goto deny;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    result = dns_acl_match(reqaddr, signer, acl, env,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                   &match, NULL);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (result != DNS_R_SUCCESS)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        goto deny; /* Internal error, already logged. */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (match > 0)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        goto allow;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    goto deny; /* Negative match or no match. */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson allow:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson              DNS_LOGMODULE_ACL, ISC_LOG_DEBUG(3),
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson              "%s approved", opname);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    return (DNS_R_SUCCESS);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson deny:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson              DNS_LOGMODULE_ACL, ISC_LOG_ERROR,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson              "%s denied", opname);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    return (DNS_R_REFUSED);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonisc_result_t
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondns_acl_match(isc_sockaddr_t *reqaddr,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          dns_name_t *reqsigner,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          dns_acl_t *acl,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson          dns_aclenv_t *env,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          int *match,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson          dns_aclelement_t **matchelt)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson{
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    isc_result_t result;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    unsigned int i;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    int indirectmatch;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    REQUIRE(matchelt == NULL || *matchelt == NULL);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    for (i = 0; i < acl->length; i++) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        dns_aclelement_t *e = &acl->elements[i];
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        dns_acl_t *inner = NULL;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        switch (e->type) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_ipprefix:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            if (isc_sockaddr_eqaddrprefix(reqaddr,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                              &e->u.ip_prefix.address,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                              e->u.ip_prefix.prefixlen))
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                goto matched;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_keyname:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            if (reqsigner != NULL &&
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                dns_name_equal(reqsigner, &e->u.keyname))
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                goto matched;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_nestedacl:
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            inner = e->u.nestedacl;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        nested:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            result = dns_acl_match(reqaddr, reqsigner,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                           inner,
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                           env,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                           &indirectmatch, matchelt);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            if (result != ISC_R_SUCCESS)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                return (result);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            /*
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             * Treat negative matches in indirect ACLs as
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             * "no match".
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             * That way, a negated indirect ACL will never become
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             * a surprise positive match through double negation.
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            if (indirectmatch > 0)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                goto matched;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            /*
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             * A negative indirect match may have set *matchelt,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             * but we don't want it set when we return.
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson             */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            if (matchelt != NULL)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                *matchelt = NULL;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson        case dns_aclelementtype_any:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        matched:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            *match = e->negative ? -(i+1) : (i+1);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            if (matchelt != NULL)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                *matchelt = e;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            return (ISC_R_SUCCESS);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_localhost:
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            if (env != NULL && env->localhost != NULL) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                inner = env->localhost;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                goto nested;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            } else {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                break;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            }
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_localnets:
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            if (env != NULL && env->localnets != NULL) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                inner = env->localnets;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                goto nested;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            } else {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson                break;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson            }
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        default:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            INSIST(0);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    /* No match. */
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    *match = 0;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    return (ISC_R_SUCCESS);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonvoid
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondns_acl_attach(dns_acl_t *source, dns_acl_t **target)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson{
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    REQUIRE(DNS_ACL_VALID(source));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    INSIST(source->refcount > 0);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    source->refcount++;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    *target = source;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonstatic void
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondestroy(dns_acl_t *dacl)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson{
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    unsigned int i;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    for (i = 0; i < dacl->length; i++) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        dns_aclelement_t *de = &dacl->elements[i];
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        switch (de->type) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_keyname:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            dns_name_free(&de->u.keyname, dacl->mctx);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        case dns_aclelementtype_nestedacl:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            dns_acl_detach(&de->u.nestedacl);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        default:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            break;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (dacl->elements != NULL)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        isc_mem_put(dacl->mctx, dacl->elements,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                dacl->alloc * sizeof(dns_aclelement_t));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    dacl->magic = 0;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    isc_mem_put(dacl->mctx, dacl, sizeof(*dacl));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonvoid
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondns_acl_detach(dns_acl_t **aclp)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson{
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    dns_acl_t *acl = *aclp;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    REQUIRE(DNS_ACL_VALID(acl));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    INSIST(acl->refcount > 0);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    acl->refcount--;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (acl->refcount == 0)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        destroy(acl);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    *aclp = NULL;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonisc_boolean_t
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondns_aclelement_equal(dns_aclelement_t *ea, dns_aclelement_t *eb)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson{
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (ea->type != eb->type)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    switch (ea->type) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_ipprefix:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        if (ea->u.ip_prefix.prefixlen !=
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            eb->u.ip_prefix.prefixlen)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (isc_sockaddr_equal(&ea->u.ip_prefix.address,
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                       &eb->u.ip_prefix.address));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_keyname:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (dns_name_equal(&ea->u.keyname, &eb->u.keyname));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_nestedacl:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (dns_acl_equal(ea->u.nestedacl, eb->u.nestedacl));
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_localhost:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    case dns_aclelementtype_localnets:
7693d4de8fca501dfe6989a7f30d8d3c86fe096aAndreas Gustafsson    case dns_aclelementtype_any:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_TRUE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    default:
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        INSIST(0);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssonisc_boolean_t
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafssondns_acl_equal(dns_acl_t *a, dns_acl_t *b) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    unsigned int i;
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (a == b)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_TRUE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    if (a->length != b->length)
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    for (i = 0; i < a->length; i++) {
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson        if (! dns_aclelement_equal(&a->elements[i],
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson                       &b->elements[i]))
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson            return (ISC_FALSE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    }
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson    return (ISC_TRUE);
6017f424ee3c02d7f22132c77576ea38542fa949Andreas Gustafsson}
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssonisc_result_t
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssondns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson{
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    isc_result_t result;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    env->localhost = NULL;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    env->localnets = NULL;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    result = dns_acl_create(mctx, 0, &env->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (result != ISC_R_SUCCESS)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        goto cleanup_nothing;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    result = dns_acl_create(mctx, 0, &env->localnets);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    if (result != ISC_R_SUCCESS)
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson        goto cleanup_localhost;
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    return (ISC_R_SUCCESS);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson cleanup_localhost:
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&env->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson cleanup_nothing:
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    return (result);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssonvoid dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&t->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_attach(s->localhost, &t->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&t->localnets);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_attach(s->localnets, &t->localnets);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafssonvoid dns_aclenv_destroy(dns_aclenv_t *env) {
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&env->localhost);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson    dns_acl_detach(&env->localnets);
a1747570262ed336c213aaf6bd31bc91993a46deAndreas Gustafsson}