contrib/bind9/lib/dns/iptable.c

   1 /*
   2  * Copyright (C) 2007-2009, 2013  Internet Systems Consortium, Inc. ("ISC")
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
   9  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  10  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  11  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  12  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  13  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  14  * PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* $Id: iptable.c,v 1.15 2009/02/18 23:47:48 tbox Exp $ */
  18
  19 #include <config.h>
  20
  21 #include <isc/mem.h>
  22 #include <isc/radix.h>
  23
  24 #include <dns/acl.h>
  25
  26 static void destroy_iptable(dns_iptable_t *dtab);
  27
  28 /*
  29  * Create a new IP table and the underlying radix structure
  30  */
  31 isc_result_t
  32 dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) {
  33         isc_result_t result;
  34         dns_iptable_t *tab;
  35
  36         tab = isc_mem_get(mctx, sizeof(*tab));
  37         if (tab == NULL)
  38                 return (ISC_R_NOMEMORY);
  39         tab->mctx = NULL;
  40         isc_mem_attach(mctx, &tab->mctx);
  41         isc_refcount_init(&tab->refcount, 1);
  42         tab->radix = NULL;
  43         tab->magic = DNS_IPTABLE_MAGIC;
  44
  45         result = isc_radix_create(mctx, &tab->radix, RADIX_MAXBITS);
  46         if (result != ISC_R_SUCCESS)
  47                 goto cleanup;
  48
  49         *target = tab;
  50         return (ISC_R_SUCCESS);
  51
  52  cleanup:
  53         dns_iptable_detach(&tab);
  54         return (result);
  55 }
  56
  57 isc_boolean_t dns_iptable_neg = ISC_FALSE;
  58 isc_boolean_t dns_iptable_pos = ISC_TRUE;
  59
  60 /*
  61  * Add an IP prefix to an existing IP table
  62  */
  63 isc_result_t
  64 dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
  65                       isc_uint16_t bitlen, isc_boolean_t pos)
  66 {
  67         isc_result_t result;
  68         isc_prefix_t pfx;
  69         isc_radix_node_t *node = NULL;
  70         int family;
  71
  72         INSIST(DNS_IPTABLE_VALID(tab));
  73         INSIST(tab->radix);
  74
  75         NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
  76
  77         result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
  78         if (result != ISC_R_SUCCESS) {
  79                 isc_refcount_destroy(&pfx.refcount);
  80                 return(result);
  81         }
  82
  83         /* If a node already contains data, don't overwrite it */
  84         family = pfx.family;
  85         if (family == AF_UNSPEC) {
  86                 /* "any" or "none" */
  87                 INSIST(pfx.bitlen == 0);
  88                 if (pos) {
  89                         if (node->data[0] == NULL)
  90                                 node->data[0] = &dns_iptable_pos;
  91                         if (node->data[1] == NULL)
  92                                 node->data[1] = &dns_iptable_pos;
  93                 } else {
  94                         if (node->data[0] == NULL)
  95                                 node->data[0] = &dns_iptable_neg;
  96                         if (node->data[1] == NULL)
  97                                 node->data[1] = &dns_iptable_neg;
  98                 }
  99         } else {
 100                 /* any other prefix */
 101                 if (node->data[ISC_IS6(family)] == NULL) {
 102                         if (pos)
 103                                 node->data[ISC_IS6(family)] = &dns_iptable_pos;
 104                         else
 105                                 node->data[ISC_IS6(family)] = &dns_iptable_neg;
 106                 }
 107         }
 108
 109         isc_refcount_destroy(&pfx.refcount);
 110         return (ISC_R_SUCCESS);
 111 }
 112
 113 /*
 114  * Merge one IP table into another one.
 115  */
 116 isc_result_t
 117 dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos)
 118 {
 119         isc_result_t result;
 120         isc_radix_node_t *node, *new_node;
 121         int max_node = 0;
 122
 123         RADIX_WALK (source->radix->head, node) {
 124                 new_node = NULL;
 125                 result = isc_radix_insert (tab->radix, &new_node, node, NULL);
 126
 127                 if (result != ISC_R_SUCCESS)
 128                         return(result);
 129
 130                 /*
 131                  * If we're negating a nested ACL, then we should
 132                  * reverse the sense of every node.  However, this
 133                  * could lead to a negative node in a nested ACL
 134                  * becoming a positive match in the parent, which
 135                  * could be a security risk.  To prevent this, we
 136                  * just leave the negative nodes negative.
 137                  */
 138                 if (!pos) {
 139                         if (node->data[0] &&
 140                             *(isc_boolean_t *) node->data[0] == ISC_TRUE)
 141                                 new_node->data[0] = &dns_iptable_neg;
 142
 143                         if (node->data[1] &&
 144                             *(isc_boolean_t *) node->data[1] == ISC_TRUE)
 145                                 new_node->data[1] = &dns_iptable_neg;
 146                 }
 147
 148                 if (node->node_num[0] > max_node)
 149                         max_node = node->node_num[0];
 150                 if (node->node_num[1] > max_node)
 151                         max_node = node->node_num[1];
 152         } RADIX_WALK_END;
 153
 154         tab->radix->num_added_node += max_node;
 155         return (ISC_R_SUCCESS);
 156 }
 157
 158 void
 159 dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target) {
 160         REQUIRE(DNS_IPTABLE_VALID(source));
 161         isc_refcount_increment(&source->refcount, NULL);
 162         *target = source;
 163 }
 164
 165 void
 166 dns_iptable_detach(dns_iptable_t **tabp) {
 167         dns_iptable_t *tab = *tabp;
 168         unsigned int refs;
 169         REQUIRE(DNS_IPTABLE_VALID(tab));
 170         isc_refcount_decrement(&tab->refcount, &refs);
 171         if (refs == 0)
 172                 destroy_iptable(tab);
 173         *tabp = NULL;
 174 }
 175
 176 static void
 177 destroy_iptable(dns_iptable_t *dtab) {
 178
 179         REQUIRE(DNS_IPTABLE_VALID(dtab));
 180
 181         if (dtab->radix != NULL) {
 182                 isc_radix_destroy(dtab->radix, NULL);
 183                 dtab->radix = NULL;
 184         }
 185
 186         isc_refcount_destroy(&dtab->refcount);
 187         dtab->magic = 0;
 188         isc_mem_putanddetach(&dtab->mctx, dtab, sizeof(*dtab));
 189 }