lib/dns/acl.c

	acl.c revision 175a8bd2b798bbc568cd912b72c8a026cfca8527
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Copyright (C) 1999-2002  Internet Software Consortium.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley *
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Permission to use, copy, modify, and/or distribute this software for any
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * purpose with or without fee is hereby granted, provided that the above
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * copyright notice and this permission notice appear in all copies.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley *
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * PERFORMANCE OF THIS SOFTWARE.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
110d1702731f42dd620879c1d765ebe91f3920ceMichael Graff/* $Id: acl.c,v 1.51 2008/12/01 00:04:21 marka Exp $ */
110d1702731f42dd620879c1d765ebe91f3920ceMichael Graff
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*! \file */
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <config.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <isc/mem.h>
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley#include <isc/once.h>
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley#include <isc/string.h>
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley#include <isc/util.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/acl.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/iptable.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Create a new ACL, including an IP table and an array with room
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * for 'n' ACL elements.  The elements are uninitialized and the
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * length is 0.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyisc_result_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleydns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target) {
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley    isc_result_t result;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    dns_acl_t *acl;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    /*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley     * Work around silly limitation of isc_mem_get().
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley     */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (n == 0)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        n = 1;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl = isc_mem_get(mctx, sizeof(*acl));
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (acl == NULL)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        return (ISC_R_NOMEMORY);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->mctx = mctx;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->name = NULL;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    result = isc_refcount_init(&acl->refcount, 1);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (result != ISC_R_SUCCESS) {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        isc_mem_put(mctx, acl, sizeof(*acl));
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley        return (result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    }
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    result = dns_iptable_create(mctx, &acl->iptable);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (result != ISC_R_SUCCESS) {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        isc_mem_put(mctx, acl, sizeof(*acl));
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        return (result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    }
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->elements = NULL;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->alloc = 0;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->length = 0;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->has_negatives = ISC_FALSE;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    ISC_LINK_INIT(acl, nextincache);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    /*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley     * Must set magic early because we use dns_acl_detach() to clean up.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley     */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->magic = DNS_ACL_MAGIC;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley    acl->elements = isc_mem_get(mctx, n * sizeof(dns_aclelement_t));
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (acl->elements == NULL) {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        result = ISC_R_NOMEMORY;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        goto cleanup;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    }
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    acl->alloc = n;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    memset(acl->elements, 0, n * sizeof(dns_aclelement_t));
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    *target = acl;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    return (ISC_R_SUCCESS);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley cleanup:
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    dns_acl_detach(&acl);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    return (result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley}
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Create a new ACL and initialize it with the value "any" or "none",
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * depending on the value of the "neg" parameter.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * "any" is a positive iptable entry with bit length 0.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * "none" is the same as "!any".
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleystatic isc_result_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleydns_acl_anyornone(isc_mem_t *mctx, isc_boolean_t neg, dns_acl_t **target) {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    isc_result_t result;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    dns_acl_t *acl = NULL;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    result = dns_acl_create(mctx, 0, &acl);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (result != ISC_R_SUCCESS)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        return (result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    result = dns_iptable_addprefix(acl->iptable, NULL, 0, ISC_TF(!neg));
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (result != ISC_R_SUCCESS) {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        dns_acl_detach(&acl);
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley        return (result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    }
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    *target = acl;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    return (result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley}
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Create a new ACL that matches everything.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyisc_result_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleydns_acl_any(isc_mem_t *mctx, dns_acl_t **target) {
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley    return (dns_acl_anyornone(mctx, ISC_FALSE, target));
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley}
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Create a new ACL that matches nothing.
95552051abdb3b6fc4f56b015da27c000742646bBob Halley */
95552051abdb3b6fc4f56b015da27c000742646bBob Halleyisc_result_t
95552051abdb3b6fc4f56b015da27c000742646bBob Halleydns_acl_none(isc_mem_t *mctx, dns_acl_t **target) {
95552051abdb3b6fc4f56b015da27c000742646bBob Halley    return (dns_acl_anyornone(mctx, ISC_TRUE, target));
95552051abdb3b6fc4f56b015da27c000742646bBob Halley}
95552051abdb3b6fc4f56b015da27c000742646bBob Halley
95552051abdb3b6fc4f56b015da27c000742646bBob Halley/*
95552051abdb3b6fc4f56b015da27c000742646bBob Halley * If pos is ISC_TRUE, test whether acl is set to "{ any; }"
95552051abdb3b6fc4f56b015da27c000742646bBob Halley * If pos is ISC_FALSE, test whether acl is set to "{ none; }"
95552051abdb3b6fc4f56b015da27c000742646bBob Halley */
95552051abdb3b6fc4f56b015da27c000742646bBob Halleystatic isc_boolean_t
95552051abdb3b6fc4f56b015da27c000742646bBob Halleydns_acl_isanyornone(dns_acl_t *acl, isc_boolean_t pos)
95552051abdb3b6fc4f56b015da27c000742646bBob Halley{
95552051abdb3b6fc4f56b015da27c000742646bBob Halley    /* Should never happen but let's be safe */
95552051abdb3b6fc4f56b015da27c000742646bBob Halley    if (acl == NULL ||
95552051abdb3b6fc4f56b015da27c000742646bBob Halley        acl->iptable == NULL ||
95552051abdb3b6fc4f56b015da27c000742646bBob Halley        acl->iptable->radix == NULL ||
95552051abdb3b6fc4f56b015da27c000742646bBob Halley        acl->iptable->radix->head == NULL ||
95552051abdb3b6fc4f56b015da27c000742646bBob Halley        acl->iptable->radix->head->prefix == NULL)
95552051abdb3b6fc4f56b015da27c000742646bBob Halley        return (ISC_FALSE);
95552051abdb3b6fc4f56b015da27c000742646bBob Halley
95552051abdb3b6fc4f56b015da27c000742646bBob Halley    if (acl->length != 0 || acl->node_count != 1)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        return (ISC_FALSE);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (acl->iptable->radix->head->prefix->bitlen == 0 &&
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        acl->iptable->radix->head->data[0] != NULL &&
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        acl->iptable->radix->head->data[0] ==
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley            acl->iptable->radix->head->data[1] &&
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley        *(isc_boolean_t *) (acl->iptable->radix->head->data[0]) == pos)
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        return (ISC_TRUE);
95552051abdb3b6fc4f56b015da27c000742646bBob Halley
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley    return (ISC_FALSE); /* All others */
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley}
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley/*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Test whether acl is set to "{ any; }"
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyisc_boolean_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleydns_acl_isany(dns_acl_t *acl)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley{
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley    return (dns_acl_isanyornone(acl, ISC_TRUE));
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley}
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley * Test whether acl is set to "{ none; }"
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley */
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halleyisc_boolean_t
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halleydns_acl_isnone(dns_acl_t *acl)
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley{
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    return (dns_acl_isanyornone(acl, ISC_FALSE));
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley}
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley/*
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley * Determine whether a given address or signer matches a given ACL.
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley * For a match with a positive ACL element or iptable radix entry,
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley * return with a positive value in match; for a match with a negated ACL
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley * element or radix entry, return with a negative value in match.
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley */
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halleyisc_result_t
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halleydns_acl_match(const isc_netaddr_t *reqaddr,
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley          const dns_name_t *reqsigner,
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley          const dns_acl_t *acl,
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley          const dns_aclenv_t *env,
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley          int *match,
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley          const dns_aclelement_t **matchelt)
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley{
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    isc_uint16_t bitlen, family;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    isc_prefix_t pfx;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    isc_radix_node_t *node = NULL;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    const isc_netaddr_t *addr;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    isc_netaddr_t v4addr;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    isc_result_t result;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    int match_num = -1;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    unsigned int i;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    REQUIRE(reqaddr != NULL);
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    REQUIRE(matchelt == NULL || *matchelt == NULL);
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    if (env == NULL || env->match_mapped == ISC_FALSE ||
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        reqaddr->family != AF_INET6 ||
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        !IN6_IS_ADDR_V4MAPPED(&reqaddr->type.in6))
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        addr = reqaddr;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    else {
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        isc_netaddr_fromv4mapped(&v4addr, reqaddr);
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        addr = &v4addr;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    }
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    /* Always match with host addresses. */
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    family = addr->family;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    bitlen = family == AF_INET6 ? 128 : 32;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    /* Assume no match. */
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    *match = 0;
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    /* Search radix. */
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    result = isc_radix_search(acl->iptable->radix, &node, &pfx);
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    /* Found a match. */
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley    if (result == ISC_R_SUCCESS && node != NULL) {
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        match_num = node->node_num[ISC_IS6(family)];
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        if (*(isc_boolean_t *) node->data[ISC_IS6(family)] == ISC_TRUE)
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley            *match = match_num;
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley        else
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley            *match = -match_num;
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley    }
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley    /* Now search non-radix elements for a match with a lower node_num. */
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley    for (i = 0; i < acl->length; i++) {
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley        dns_aclelement_t *e = &acl->elements[i];
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley
0d0d9a9d9895605aba3a44fd03c051e15f88ecf5Bob Halley        /* Already found a better match? */
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley        if (match_num != -1 && match_num < e->node_num) {
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley            isc_refcount_destroy(&pfx.refcount);
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews            return (ISC_R_SUCCESS);
95552051abdb3b6fc4f56b015da27c000742646bBob Halley        }
95552051abdb3b6fc4f56b015da27c000742646bBob Halley
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley        if (dns_aclelement_match(reqaddr, reqsigner,
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley                     e, env, matchelt)) {
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley            if (match_num == -1 || e->node_num < match_num) {
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley                if (e->negative == ISC_TRUE)
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley                    *match = -e->node_num;
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley                else
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley                    *match = e->node_num;
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley            }
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley            isc_refcount_destroy(&pfx.refcount);
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley            return (ISC_R_SUCCESS);
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley        }
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley    }
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    isc_refcount_destroy(&pfx.refcount);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    return (ISC_R_SUCCESS);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley}
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Merge the contents of one ACL into another.  Call dns_iptable_merge()
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * for the IP tables, then concatenate the element arrays.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley *
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * If pos is set to false, then the nested ACL is to be negated.  This
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * means reverse the sense of each *positive* element or IP table node,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * but leave negatives alone, so as to prevent a double-negative causing
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * an unexpected postive match in the parent ACL.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyisc_result_t
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halleydns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos)
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley{
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    isc_result_t result;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    unsigned int newalloc, nelem, i;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    int max_node = 0, nodes;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    /* Resize the element array if needed. */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley    if (dest->length + source->length > dest->alloc) {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley        void *newmem;

        newalloc = dest->alloc + source->alloc;
        if (newalloc < 4)
            newalloc = 4;

        newmem = isc_mem_get(dest->mctx,
                     newalloc * sizeof(dns_aclelement_t));
        if (newmem == NULL)
            return (ISC_R_NOMEMORY);

        /* Copy in the original elements */
        memcpy(newmem, dest->elements,
               dest->length * sizeof(dns_aclelement_t));

        /* Release the memory for the old elements array */
        isc_mem_put(dest->mctx, dest->elements,
                dest->alloc * sizeof(dns_aclelement_t));
        dest->elements = newmem;
        dest->alloc = newalloc;
    }

    /*
     * Now copy in the new elements, increasing their node_num
     * values so as to keep the new ACL consistent.  If we're
     * negating, then negate positive elements, but keep negative
     * elements the same for security reasons.
     */
    nelem = dest->length;
    dest->length += source->length;
    for (i = 0; i < source->length; i++) {
        if (source->elements[i].node_num > max_node)
            max_node = source->elements[i].node_num;

        /* Copy type. */
        dest->elements[nelem + i].type = source->elements[i].type;

        /* Adjust node numbering. */
        dest->elements[nelem + i].node_num =
            source->elements[i].node_num + dest->node_count;

        /* Duplicate nested acl. */
        if (source->elements[i].type == dns_aclelementtype_nestedacl &&
           source->elements[i].nestedacl != NULL)
            dns_acl_attach(source->elements[i].nestedacl,
                       &dest->elements[nelem + i].nestedacl);

        /* Duplicate key name. */
        if (source->elements[i].type == dns_aclelementtype_keyname) {
            dns_name_init(&dest->elements[nelem+i].keyname, NULL);
            result = dns_name_dup(&source->elements[i].keyname,
                          dest->mctx,
                          &dest->elements[nelem+i].keyname);
            if (result != ISC_R_SUCCESS)
                return result;
        }

        /* reverse sense of positives if this is a negative acl */
        if (!pos && source->elements[i].negative == ISC_FALSE) {
            dest->elements[nelem + i].negative = ISC_TRUE;
        } else {
            dest->elements[nelem + i].negative =
                source->elements[i].negative;
        }
    }


    /*
     * Merge the iptables.  Make sure the destination ACL's
     * node_count value is set correctly afterward.
     */
    nodes = max_node + dest->node_count;
    result = dns_iptable_merge(dest->iptable, source->iptable, pos);
    if (result != ISC_R_SUCCESS)
        return (result);
    if (nodes > dest->node_count)
        dest->node_count = nodes;

    return (ISC_R_SUCCESS);
}

/*
 * Like dns_acl_match, but matches against the single ACL element 'e'
 * rather than a complete ACL, and returns ISC_TRUE iff it matched.
 *
 * To determine whether the match was prositive or negative, the
 * caller should examine e->negative.  Since the element 'e' may be
 * a reference to a named ACL or a nested ACL, a matching element
 * returned through 'matchelt' is not necessarily 'e' itself.
 */
isc_boolean_t
dns_aclelement_match(const isc_netaddr_t *reqaddr,
             const dns_name_t *reqsigner,
             const dns_aclelement_t *e,
             const dns_aclenv_t *env,
             const dns_aclelement_t **matchelt)
{
    dns_acl_t *inner = NULL;
    int indirectmatch;
    isc_result_t result;

    switch (e->type) {
    case dns_aclelementtype_keyname:
        if (reqsigner != NULL &&
            dns_name_equal(reqsigner, &e->keyname)) {
            if (matchelt != NULL)
                *matchelt = e;
            return (ISC_TRUE);
        } else {
            return (ISC_FALSE);
        }

    case dns_aclelementtype_nestedacl:
        inner = e->nestedacl;
        break;

    case dns_aclelementtype_localhost:
        if (env == NULL || env->localhost == NULL)
            return (ISC_FALSE);
        inner = env->localhost;
        break;

    case dns_aclelementtype_localnets:
        if (env == NULL || env->localnets == NULL)
            return (ISC_FALSE);
        inner = env->localnets;
        break;

    default:
        /* Should be impossible. */
        INSIST(0);
    }

    result = dns_acl_match(reqaddr, reqsigner, inner, env,
                   &indirectmatch, matchelt);
    INSIST(result == ISC_R_SUCCESS);

    /*
     * Treat negative matches in indirect ACLs as "no match".
     * That way, a negated indirect ACL will never become a
     * surprise positive match through double negation.
     * XXXDCL this should be documented.
     */

    if (indirectmatch > 0) {
        if (matchelt != NULL)
            *matchelt = e;
        return (ISC_TRUE);
    }

    /*
     * A negative indirect match may have set *matchelt, but we don't
     * want it set when we return.
     */

    if (matchelt != NULL)
        *matchelt = NULL;

    return (ISC_FALSE);
}

void
dns_acl_attach(dns_acl_t *source, dns_acl_t **target) {
    REQUIRE(DNS_ACL_VALID(source));
    isc_refcount_increment(&source->refcount, NULL);
    *target = source;
}

static void
destroy(dns_acl_t *dacl) {
    unsigned int i;
    for (i = 0; i < dacl->length; i++) {
        dns_aclelement_t *de = &dacl->elements[i];
        if (de->type == dns_aclelementtype_keyname) {
            dns_name_free(&de->keyname, dacl->mctx);
        } else if (de->type == dns_aclelementtype_nestedacl) {
            dns_acl_detach(&de->nestedacl);
        }
    }
    if (dacl->elements != NULL)
        isc_mem_put(dacl->mctx, dacl->elements,
                dacl->alloc * sizeof(dns_aclelement_t));
    if (dacl->name != NULL)
        isc_mem_free(dacl->mctx, dacl->name);
    if (dacl->iptable != NULL)
        dns_iptable_detach(&dacl->iptable);
    isc_refcount_destroy(&dacl->refcount);
    dacl->magic = 0;
    isc_mem_put(dacl->mctx, dacl, sizeof(*dacl));
}

void
dns_acl_detach(dns_acl_t **aclp) {
    dns_acl_t *acl = *aclp;
    unsigned int refs;
    REQUIRE(DNS_ACL_VALID(acl));
    isc_refcount_decrement(&acl->refcount, &refs);
    if (refs == 0)
        destroy(acl);
    *aclp = NULL;
}


static isc_once_t   insecure_prefix_once = ISC_ONCE_INIT;
static isc_mutex_t  insecure_prefix_lock;
static isc_boolean_t    insecure_prefix_found;

static void
initialize_action(void) {
    RUNTIME_CHECK(isc_mutex_init(&insecure_prefix_lock) == ISC_R_SUCCESS);
}

/*
 * Called via isc_radix_walk() to find IP table nodes that are
 * insecure.
 */
static void
is_insecure(isc_prefix_t *prefix, void **data) {
    isc_boolean_t secure;
    int bitlen, family;

    bitlen = prefix->bitlen;
    family = prefix->family;

    /* Negated entries are always secure. */
    secure = * (isc_boolean_t *)data[ISC_IS6(family)];
    if (!secure) {
        return;
    }

    /* If loopback prefix found, return */
    switch (family) {
    case AF_INET:
        if (bitlen == 32 &&
            htonl(prefix->add.sin.s_addr) == INADDR_LOOPBACK)
            return;
        break;
    case AF_INET6:
        if (bitlen == 128 && IN6_IS_ADDR_LOOPBACK(&prefix->add.sin6))
            return;
        break;
    default:
        break;
    }

    /* Non-negated, non-loopback */
    insecure_prefix_found = ISC_TRUE;   /* LOCKED */
    return;
}

/*
 * Return ISC_TRUE iff the acl 'a' is considered insecure, that is,
 * if it contains IP addresses other than those of the local host.
 * This is intended for applications such as printing warning
 * messages for suspect ACLs; it is not intended for making access
 * control decisions.  We make no guarantee that an ACL for which
 * this function returns ISC_FALSE is safe.
 */
isc_boolean_t
dns_acl_isinsecure(const dns_acl_t *a) {
    unsigned int i;
    isc_boolean_t insecure;

    RUNTIME_CHECK(isc_once_do(&insecure_prefix_once,
                  initialize_action) == ISC_R_SUCCESS);

    /*
     * Walk radix tree to find out if there are any non-negated,
     * non-loopback prefixes.
     */
    LOCK(&insecure_prefix_lock);
    insecure_prefix_found = ISC_FALSE;
    isc_radix_process(a->iptable->radix, is_insecure);
    insecure = insecure_prefix_found;
    UNLOCK(&insecure_prefix_lock);
    if (insecure)
        return(ISC_TRUE);

    /* Now check non-radix elements */
    for (i = 0; i < a->length; i++) {
        dns_aclelement_t *e = &a->elements[i];

        /* A negated match can never be insecure. */
        if (e->negative)
            continue;

        switch (e->type) {
        case dns_aclelementtype_keyname:
        case dns_aclelementtype_localhost:
            continue;

        case dns_aclelementtype_nestedacl:
            if (dns_acl_isinsecure(e->nestedacl))
                return (ISC_TRUE);
            continue;

        case dns_aclelementtype_localnets:
            return (ISC_TRUE);

        default:
            INSIST(0);
            return (ISC_TRUE);
        }
    }

    /* No insecure elements were found. */
    return (ISC_FALSE);
}

/*
 * Initialize ACL environment, setting up localhost and localnets ACLs
 */
isc_result_t
dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env) {
    isc_result_t result;
    env->localhost = NULL;
    env->localnets = NULL;
    result = dns_acl_create(mctx, 0, &env->localhost);
    if (result != ISC_R_SUCCESS)
        goto cleanup_nothing;
    result = dns_acl_create(mctx, 0, &env->localnets);
    if (result != ISC_R_SUCCESS)
        goto cleanup_localhost;
    env->match_mapped = ISC_FALSE;
    return (ISC_R_SUCCESS);

 cleanup_localhost:
    dns_acl_detach(&env->localhost);
 cleanup_nothing:
    return (result);
}

void
dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
    dns_acl_detach(&t->localhost);
    dns_acl_attach(s->localhost, &t->localhost);
    dns_acl_detach(&t->localnets);
    dns_acl_attach(s->localnets, &t->localnets);
    t->match_mapped = s->match_mapped;
}

void
dns_aclenv_destroy(dns_aclenv_t *env) {
    dns_acl_detach(&env->localhost);
    dns_acl_detach(&env->localnets);
}