From: Witold Kręcicki Date: Tue, 3 Apr 2018 11:09:45 +0000 (+0200) Subject: libdns refactoring: get rid of two versions of dns_acl_match and dns_aclelement_match X-Git-Tag: v9.13.0~70^2~17 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=368764838469039a4308e1268a1a6d6932fe7936;p=thirdparty%2Fbind9.git libdns refactoring: get rid of two versions of dns_acl_match and dns_aclelement_match --- diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c index fc0a914b172..c859f1ebd5b 100644 --- a/bin/named/controlconf.c +++ b/bin/named/controlconf.c @@ -230,7 +230,8 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) { isc_netaddr_fromsockaddr(&netaddr, sockaddr); - result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL); + result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, acl, env, &match, + NULL); if (result != ISC_R_SUCCESS || match <= 0) return (ISC_FALSE); diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c index f73eacd32a1..3a8a0003a4e 100644 --- a/bin/named/statschannel.c +++ b/bin/named/statschannel.c @@ -3177,7 +3177,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) { isc_netaddr_fromsockaddr(&netaddr, fromaddr); LOCK(&listener->lock); - if (dns_acl_match(&netaddr, NULL, listener->acl, env, + if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, listener->acl, env, &match, NULL) == ISC_R_SUCCESS && match > 0) { UNLOCK(&listener->lock); diff --git a/lib/dns/acl.c b/lib/dns/acl.c index 371f4bcc770..f2c550c557e 100644 --- a/lib/dns/acl.c +++ b/lib/dns/acl.c @@ -178,28 +178,17 @@ dns_acl_isnone(dns_acl_t *acl) * return with a positive value in match; for a match with a negated ACL * element or radix entry, return with a negative value in match. */ + isc_result_t dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner, + const isc_netaddr_t *ecs, + isc_uint8_t ecslen, + isc_uint8_t *scope, const dns_acl_t *acl, const dns_aclenv_t *env, int *match, const dns_aclelement_t **matchelt) -{ - return (dns_acl_match2(reqaddr, reqsigner, NULL, 0, NULL, acl, env, - match, matchelt)); -} - -isc_result_t -dns_acl_match2(const isc_netaddr_t *reqaddr, - const dns_name_t *reqsigner, - const isc_netaddr_t *ecs, - isc_uint8_t ecslen, - isc_uint8_t *scope, - const dns_acl_t *acl, - const dns_aclenv_t *env, - int *match, - const dns_aclelement_t **matchelt) { isc_uint16_t bitlen; isc_prefix_t pfx; @@ -290,8 +279,8 @@ dns_acl_match2(const isc_netaddr_t *reqaddr, break; } - if (dns_aclelement_match2(reqaddr, reqsigner, ecs, ecslen, - scope, e, env, matchelt)) + if (dns_aclelement_match(reqaddr, reqsigner, ecs, ecslen, + scope, e, env, matchelt)) { if (match_num == -1 || e->node_num < match_num) { if (e->negative) @@ -424,26 +413,16 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos) * a reference to a named ACL or a nested ACL, a matching element * returned through 'matchelt' is not necessarily 'e' itself. */ + isc_boolean_t dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner, + const isc_netaddr_t *ecs, + isc_uint8_t ecslen, + isc_uint8_t *scope, const dns_aclelement_t *e, const dns_aclenv_t *env, const dns_aclelement_t **matchelt) -{ - return (dns_aclelement_match2(reqaddr, reqsigner, NULL, 0, NULL, - e, env, matchelt)); -} - -isc_boolean_t -dns_aclelement_match2(const isc_netaddr_t *reqaddr, - const dns_name_t *reqsigner, - const isc_netaddr_t *ecs, - isc_uint8_t ecslen, - isc_uint8_t *scope, - const dns_aclelement_t *e, - const dns_aclenv_t *env, - const dns_aclelement_t **matchelt) { dns_acl_t *inner = NULL; int indirectmatch; @@ -493,8 +472,8 @@ dns_aclelement_match2(const isc_netaddr_t *reqaddr, INSIST(0); } - result = dns_acl_match2(reqaddr, reqsigner, ecs, ecslen, scope, - inner, env, &indirectmatch, matchelt); + result = dns_acl_match(reqaddr, reqsigner, ecs, ecslen, scope, + inner, env, &indirectmatch, matchelt); INSIST(result == ISC_R_SUCCESS); /* @@ -687,8 +666,8 @@ dns_acl_allowed(isc_netaddr_t *addr, dns_name_t *signer, if (acl == NULL) return (ISC_TRUE); - result = dns_acl_match2(addr, signer, ecs_addr, ecs_addrlen, - ecs_scope, acl, aclenv, &match, NULL); + result = dns_acl_match(addr, signer, ecs_addr, ecs_addrlen, + ecs_scope, acl, aclenv, &match, NULL); if (result == ISC_R_SUCCESS && match > 0) return (ISC_TRUE); return (ISC_FALSE); diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 33e6ace7bc5..68055c0f087 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -1138,7 +1138,8 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) { */ isc_netaddr_fromsockaddr(&netaddr, &ev->address); if (disp->mgr->blackhole != NULL && - dns_acl_match(&netaddr, NULL, disp->mgr->blackhole, + dns_acl_match(&netaddr, NULL, NULL, 0, NULL, + disp->mgr->blackhole, NULL, &match, NULL) == ISC_R_SUCCESS && match > 0) { diff --git a/lib/dns/dns64.c b/lib/dns/dns64.c index 39480491941..cbd8b73be96 100644 --- a/lib/dns/dns64.c +++ b/lib/dns/dns64.c @@ -24,6 +24,7 @@ #include #include #include +#include struct dns_dns64 { unsigned char bits[16]; /* @@ -138,8 +139,8 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr, return (DNS_R_DISALLOWED); if (dns64->clients != NULL) { - result = dns_acl_match(reqaddr, reqsigner, dns64->clients, env, - &match, NULL); + result = dns_acl_match(reqaddr, reqsigner, NULL, 0, NULL, + dns64->clients, env, &match, NULL); if (result != ISC_R_SUCCESS) return (result); if (match <= 0) @@ -152,8 +153,8 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr, memmove(&ina.s_addr, a, 4); isc_netaddr_fromin(&netaddr, &ina); - result = dns_acl_match(&netaddr, NULL, dns64->mapped, env, - &match, NULL); + result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, + dns64->mapped, env, &match, NULL); if (result != ISC_R_SUCCESS) return (result); if (match <= 0) @@ -227,8 +228,8 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr, * Work out if this dns64 structure applies to this client. */ if (dns64->clients != NULL) { - result = dns_acl_match(reqaddr, reqsigner, - dns64->clients, env, + result = dns_acl_match(reqaddr, reqsigner, NULL, 0, + NULL, dns64->clients, env, &match, NULL); if (result != ISC_R_SUCCESS) continue; @@ -266,9 +267,10 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr, memmove(&in6.s6_addr, rdata.data, 16); isc_netaddr_fromin6(&netaddr, &in6); - result = dns_acl_match(&netaddr, NULL, - dns64->excluded, - env, &match, NULL); + result = dns_acl_match(&netaddr, NULL, NULL, + 0, NULL, + dns64->excluded, env, + &match, NULL); if (result == ISC_R_SUCCESS && match <= 0) { answer = ISC_TRUE; if (aaaaok == NULL) diff --git a/lib/dns/include/dns/acl.h b/lib/dns/include/dns/acl.h index b6a92e3f706..e5f703e35ec 100644 --- a/lib/dns/include/dns/acl.h +++ b/lib/dns/include/dns/acl.h @@ -211,21 +211,13 @@ dns_aclenv_destroy(dns_aclenv_t *env); isc_result_t dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner, + const isc_netaddr_t *ecs, + isc_uint8_t ecslen, + isc_uint8_t *scope, const dns_acl_t *acl, const dns_aclenv_t *env, int *match, const dns_aclelement_t **matchelt); - -isc_result_t -dns_acl_match2(const isc_netaddr_t *reqaddr, - const dns_name_t *reqsigner, - const isc_netaddr_t *ecs, - isc_uint8_t ecslen, - isc_uint8_t *scope, - const dns_acl_t *acl, - const dns_aclenv_t *env, - int *match, - const dns_aclelement_t **matchelt); /*%< * General, low-level ACL matching. This is expected to * be useful even for weird stuff like the topology and sortlist statements. @@ -260,19 +252,12 @@ dns_acl_match2(const isc_netaddr_t *reqaddr, isc_boolean_t dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner, + const isc_netaddr_t *ecs, + isc_uint8_t ecslen, + isc_uint8_t *scope, const dns_aclelement_t *e, const dns_aclenv_t *env, const dns_aclelement_t **matchelt); - -isc_boolean_t -dns_aclelement_match2(const isc_netaddr_t *reqaddr, - const dns_name_t *reqsigner, - const isc_netaddr_t *ecs, - isc_uint8_t ecslen, - isc_uint8_t *scope, - const dns_aclelement_t *e, - const dns_aclenv_t *env, - const dns_aclelement_t **matchelt); /*%< * Like dns_acl_match, but matches against the single ACL element 'e' * rather than a complete ACL, and returns ISC_TRUE iff it matched. diff --git a/lib/dns/request.c b/lib/dns/request.c index 4d9b989135e..a5d522d575b 100644 --- a/lib/dns/request.c +++ b/lib/dns/request.c @@ -508,7 +508,7 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) { blackhole = dns_dispatchmgr_getblackhole(dispatchmgr); if (blackhole != NULL) { isc_netaddr_fromsockaddr(&netaddr, destaddr); - if (dns_acl_match(&netaddr, NULL, blackhole, + if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, blackhole, NULL, &match, NULL) == ISC_R_SUCCESS && match > 0) drop = ISC_TRUE; diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index bdb07df2451..86a45a68498 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -3754,7 +3754,7 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) { if (blackhole != NULL) { int match; - if (dns_acl_match(&ipaddr, NULL, blackhole, + if (dns_acl_match(&ipaddr, NULL, NULL, 0, NULL, blackhole, &res->view->aclenv, &match, NULL) == ISC_R_SUCCESS && match > 0) @@ -6519,8 +6519,9 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name, isc_netaddr_fromin6(&netaddr, &in6a); } - result = dns_acl_match(&netaddr, NULL, view->denyansweracl, - &view->aclenv, &match, NULL); + result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, + view->denyansweracl, &view->aclenv, + &match, NULL); if (result == ISC_R_SUCCESS && match > 0) { isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf)); diff --git a/lib/dns/rrl.c b/lib/dns/rrl.c index a6616c55502..22860ad3495 100644 --- a/lib/dns/rrl.c +++ b/lib/dns/rrl.c @@ -1022,8 +1022,9 @@ dns_rrl(dns_view_t *view, rrl = view->rrl; if (rrl->exempt != NULL) { isc_netaddr_fromsockaddr(&netclient, client_addr); - result = dns_acl_match(&netclient, NULL, rrl->exempt, - &view->aclenv, &exempt_match, NULL); + result = dns_acl_match(&netclient, NULL, NULL, 0, NULL, + rrl->exempt, &view->aclenv, + &exempt_match, NULL); if (result == ISC_R_SUCCESS && exempt_match > 0) return (DNS_RRL_RESULT_OK); } diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c index ed671871166..2fc9c61435f 100644 --- a/lib/dns/ssu.c +++ b/lib/dns/ssu.c @@ -430,8 +430,9 @@ dns_ssutable_checkrules2(dns_ssutable_t *table, const dns_name_t *signer, if (!dns_name_issubdomain(name, rule->name)) { continue; } - dns_acl_match(addr, NULL, env->localhost, - NULL, &match, NULL); + dns_acl_match(addr, NULL, NULL, 0, NULL, + env->localhost, NULL, &match, + NULL); if (match == 0) { if (signer != NULL) { isc_log_write(dns_lctx, diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in index fc7ab3eae03..0a00eb6aa95 100644 --- a/lib/dns/win32/libdns.def.in +++ b/lib/dns/win32/libdns.def.in @@ -18,11 +18,9 @@ dns_acl_isany dns_acl_isinsecure dns_acl_isnone dns_acl_match -dns_acl_match2 dns_acl_merge dns_acl_none dns_aclelement_match -dns_aclelement_match2 dns_aclenv_copy dns_aclenv_destroy dns_aclenv_init diff --git a/lib/dns/zone.c b/lib/dns/zone.c index ea19a8fa2cb..5e402f95adc 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -13245,9 +13245,9 @@ dns_zone_notifyreceive2(dns_zone_t *zone, isc_sockaddr_t *from, tsigkey = dns_message_gettsigkey(msg); tsig = dns_tsigkey_identity(tsigkey); if (i >= zone->masterscnt && zone->notify_acl != NULL && - dns_acl_match(&netaddr, tsig, zone->notify_acl, - &zone->view->aclenv, - &match, NULL) == ISC_R_SUCCESS && + dns_acl_match(&netaddr, tsig, NULL, 0, NULL, zone->notify_acl, + &zone->view->aclenv, &match, + NULL) == ISC_R_SUCCESS && match > 0) { /* Accept notify. */ diff --git a/lib/ns/client.c b/lib/ns/client.c index fda05b89aae..b69e5e87b79 100644 --- a/lib/ns/client.c +++ b/lib/ns/client.c @@ -950,7 +950,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) { isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); if (client->sctx->blackholeacl != NULL && - dns_acl_match(&netaddr, NULL, + dns_acl_match(&netaddr, NULL, NULL, 0, NULL, client->sctx->blackholeacl, env, &match, NULL) == ISC_R_SUCCESS && match > 0) @@ -1756,8 +1756,9 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message, int match; isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); - result = dns_acl_match(&netaddr, NULL, view->pad_acl, - env, &match, NULL); + result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, + view->pad_acl, env, &match, + NULL); if (result == ISC_R_SUCCESS && match > 0) { INSIST(count < DNS_EDNSOPTIONS); @@ -2379,8 +2380,9 @@ ns__client_request(isc_task_t *task, isc_event_t *event) { env = ns_interfacemgr_getaclenv(client->interface->mgr); if (!TCP_CLIENT(client)) { if (client->sctx->blackholeacl != NULL && - dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl, - env, &match, NULL) == ISC_R_SUCCESS && + dns_acl_match(&netaddr, NULL, NULL, 0, NULL, + client->sctx->blackholeacl, env, &match, + NULL) == ISC_R_SUCCESS && match > 0) { ns_client_log(client, DNS_LOGCATEGORY_SECURITY, @@ -3199,9 +3201,9 @@ client_newconn(isc_task_t *task, isc_event_t *event) { isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); if (client->sctx->blackholeacl != NULL && - dns_acl_match(&netaddr, NULL, - client->sctx->blackholeacl, - env, &match, NULL) == ISC_R_SUCCESS && + dns_acl_match(&netaddr, NULL, NULL, 0, NULL, + client->sctx->blackholeacl, + env, &match, NULL) == ISC_R_SUCCESS && match > 0) { ns_client_log(client, DNS_LOGCATEGORY_SECURITY, @@ -3753,9 +3755,9 @@ ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr, ecs_addrlen = client->ecs.source; } - result = dns_acl_match2(netaddr, client->signer, - ecs_addr, ecs_addrlen, NULL, acl, - env, &match, NULL); + result = dns_acl_match(netaddr, client->signer, + ecs_addr, ecs_addrlen, NULL, acl, + env, &match, NULL); if (result != ISC_R_SUCCESS) goto deny; /* Internal error, already logged. */ diff --git a/lib/ns/interfacemgr.c b/lib/ns/interfacemgr.c index ca53ec6650c..358caeb2d28 100644 --- a/lib/ns/interfacemgr.c +++ b/lib/ns/interfacemgr.c @@ -1049,8 +1049,9 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, * See if the address matches the listen-on statement; * if not, ignore the interface. */ - (void)dns_acl_match(&listen_netaddr, NULL, le->acl, - &mgr->aclenv, &match, NULL); + (void)dns_acl_match(&listen_netaddr, NULL, NULL, 0, + NULL, le->acl, &mgr->aclenv, + &match, NULL); if (match <= 0) continue; @@ -1082,8 +1083,10 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, ele != NULL; ele = ISC_LIST_NEXT(ele, link)) { (void)dns_acl_match(&listen_netaddr, + NULL, NULL, 0, NULL, ele->acl, - NULL, &match, NULL); + NULL, &match, + NULL); if (match > 0 && (ele->port == le->port || ele->port == 0)) diff --git a/lib/ns/sortlist.c b/lib/ns/sortlist.c index c3cc2fc9ec3..f83689bc57c 100644 --- a/lib/ns/sortlist.c +++ b/lib/ns/sortlist.c @@ -64,8 +64,8 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, try_elt = e; } - if (dns_aclelement_match(clientaddr, NULL, try_elt, env, - &matched_elt)) + if (dns_aclelement_match(clientaddr, NULL, NULL, 0, NULL, + try_elt, env, &matched_elt)) { if (order_elt != NULL) { if (order_elt->type == @@ -115,7 +115,8 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) { const dns_acl_t *sortacl = sla->acl; int match; - (void)dns_acl_match(addr, NULL, sortacl, env, &match, NULL); + (void)dns_acl_match(addr, NULL, NULL, 0, NULL, sortacl, env, &match, + NULL); if (match > 0) return (match); else if (match < 0) @@ -130,7 +131,8 @@ ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) { const dns_aclenv_t *env = sla->env; const dns_aclelement_t *element = sla->element; - if (dns_aclelement_match(addr, NULL, element, env, NULL)) { + if (dns_aclelement_match(addr, NULL, NULL, 0, NULL, element, env, + NULL)) { return (0); }