2696. [bug] named failed to successfully process some valid

                        acl constructs. [RT #20308]

diff --git a/CHANGES b/CHANGES
index d2b8eff2714a80ae0265edf0c4f2206681d9a985..0b829189b1cdb130b828333dc1c39289d576451e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2696.  [bug]           named failed to successfully process some valid
+                       acl constructs. [RT #20308]
+
 2692.  [port]          win32: 32/64 bit cleanups. [RT #20335]
 
 2690.  [bug]           win32: fix isc_thread_key_getspecific() prototype.
@@ -81,6 +84,8 @@
 
 2625.  [bug]           Missing UNLOCK in rbtdb.c. [RT #19865]
 
+2623.  [bug]           Named started seaches for DS non-optimally. [RT #19915]
+
 2621.  [doc]           Made copyright boilterplate consistent.  [RT #19833]
 
 2920.  [bug]           Delay thawing the zone until the reload of it has
@@ -361,7 +366,7 @@
 2515.  [port]          win32: build dnssec-dsfromkey and dnssec-keyfromlabel.
                        [RT #19063]
 
-2513   [bug]           Fix windows cli build. [RT #19062]
+2513.  [bug]           Fix windows cli build. [RT #19062]
 
 2510.  [bug]           "dig +sigchase" could trigger REQUIRE failures.
                        [RT #19033]
@@ -1641,8 +1646,6 @@
                        res_init() failures better.
 
 2095.  [port]          libbind: alway prototype inet_cidr_ntop_ipv6() and
-2623.  [bug]           Named started seaches for DS non-optimally. [RT #19915]
-
                        net_cidr_ntop_ipv6(). [RT #16388]
  
 2094.  [contrib]       Update named-bootconf.  [RT# 16404]

diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index ad3d58e2c14800785a8691b572adbb8f2d158d1f..ad095d2dc21efb28ae32c259bee958494323a22a 100644 (file)
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: aclconf.c,v 1.22.34.2 2009/01/18 23:47:41 tbox Exp $ */
+/* $Id: aclconf.c,v 1.22.34.3 2009/10/01 04:15:47 marka Exp $ */
 
 #include <config.h>
 
@@ -168,26 +168,36 @@ convert_keyname(const cfg_obj_t *keyobj, isc_log_t *lctx, isc_mem_t *mctx,
  * parent.
  */
 static int
-count_acl_elements(const cfg_obj_t *caml, const cfg_obj_t *cctx)
+count_acl_elements(const cfg_obj_t *caml, const cfg_obj_t *cctx,
+                  isc_boolean_t *has_negative)
 {
        const cfg_listelt_t *elt;
        const cfg_obj_t *cacl = NULL;
        isc_result_t result;
        int n = 0;
 
+       if (has_negative != NULL)
+               *has_negative = ISC_FALSE;
+
        for (elt = cfg_list_first(caml);
             elt != NULL;
             elt = cfg_list_next(elt)) {
                const cfg_obj_t *ce = cfg_listelt_value(elt);
 
                /* negated element; just get the value. */
-               if (cfg_obj_istuple(ce))
+               if (cfg_obj_istuple(ce)) {
                        ce = cfg_tuple_get(ce, "value");
+                       if (has_negative != NULL)
+                               *has_negative = ISC_TRUE;
+               }
 
                if (cfg_obj_istype(ce, &cfg_type_keyref)) {
                        n++;
                } else if (cfg_obj_islist(ce)) {
-                       n += count_acl_elements(ce, cctx);
+                       isc_boolean_t negative;
+                       n += count_acl_elements(ce, cctx, &negative);
+                       if (negative)
+                               n++;
                } else if (cfg_obj_isstring(ce)) {
                        const char *name = cfg_obj_asstring(ce);
                        if (strcasecmp(name, "localhost") == 0 ||
@@ -197,7 +207,8 @@ count_acl_elements(const cfg_obj_t *caml, const cfg_obj_t *cctx)
                                   strcasecmp(name, "none") != 0) {
                                result = get_acl_def(cctx, name, &cacl);
                                if (result == ISC_R_SUCCESS)
-                                       n += count_acl_elements(cacl, cctx) + 1;
+                                       n += count_acl_elements(cacl, cctx,
+                                                               NULL) + 1;
                        }
                }
        }
@@ -246,7 +257,7 @@ cfg_acl_fromconfig(const cfg_obj_t *caml,
                int nelem;
 
                if (nest_level == 0)
-                       nelem = count_acl_elements(caml, cctx);
+                       nelem = count_acl_elements(caml, cctx, NULL);
                else
                        nelem = cfg_list_length(caml, ISC_FALSE);