result = cfg_acl_fromconfig(allow, config, aclctx,
listener->mctx, 0, &new_acl);
} else {
- result = dns_acl_any(listener->mctx, &new_acl);
+ dns_acl_any(listener->mctx, &new_acl);
+ result = ISC_R_SUCCESS;
}
if (control != NULL) {
listener->readonly = cfg_obj_asboolean(readonly);
}
} else {
- CHECK(dns_acl_any(mctx, &new_acl));
+ dns_acl_any(mctx, &new_acl);
}
dns_acl_attach(new_acl, &listener->acl);
}
#endif /* HAVE_DNSTAP */
-static isc_result_t
+static void
create_mapped_acl(void) {
- isc_result_t result;
dns_acl_t *acl = NULL;
struct in6_addr in6 = IN6ADDR_V4MAPPED_INIT;
isc_netaddr_t addr;
isc_netaddr_fromin6(&addr, &in6);
dns_acl_create(isc_g_mctx, 1, &acl);
-
- result = dns_iptable_addprefix(acl->iptable, &addr, 96, true);
- if (result == ISC_R_SUCCESS) {
- dns_acl_attach(acl, &named_g_mapped);
- }
- dns_acl_detach(&acl);
- return result;
+ dns_iptable_addprefix(acl->iptable, &addr, 96, true);
+ named_g_mapped = acl;
}
isc_result_t
mctx, 0, &excluded));
} else {
if (named_g_mapped == NULL) {
- CHECK(create_mapped_acl());
+ create_mapped_acl();
}
dns_acl_attach(named_g_mapped, &excluded);
}
CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
- CHECK(dns_acl_none(mctx, &none));
+ dns_acl_none(mctx, &none);
dns_zone_setqueryacl(zone, none);
dns_zone_setqueryonacl(zone, none);
dns_acl_detach(&none);
allow = cfg_tuple_get(listen_params, "allow");
if (allow != NULL && cfg_obj_islist(allow)) {
- result = cfg_acl_fromconfig(allow, config, aclctx,
- listener->mctx, 0, &new_acl);
+ CHECK(cfg_acl_fromconfig(allow, config, aclctx, listener->mctx,
+ 0, &new_acl));
} else {
- result = dns_acl_any(listener->mctx, &new_acl);
+ dns_acl_any(listener->mctx, &new_acl);
}
- CHECK(result);
dns_acl_attach(new_acl, &listener->acl);
dns_acl_detach(&new_acl);
result = cfg_acl_fromconfig(allow, config, aclctx,
listener->mctx, 0, &new_acl);
} else {
- result = dns_acl_any(listener->mctx, &new_acl);
+ dns_acl_any(listener->mctx, &new_acl);
+ result = ISC_R_SUCCESS;
}
if (result == ISC_R_SUCCESS) {
obj = NULL;
(void)named_config_get(nooptions, "allow-transfer", &obj);
if (obj == NULL) {
- dns_acl_t *none;
- CHECK(dns_acl_none(mctx, &none));
+ dns_acl_t *none = NULL;
+ dns_acl_none(mctx, &none);
dns_zone_setxfracl(zone, none);
dns_acl_detach(&none);
}
(cfg_aclconfctx_t *)aclctx, mctx, 0,
&inst->a_acl));
} else {
- CHECK(dns_acl_any(mctx, &inst->a_acl));
+ dns_acl_any(mctx, &inst->a_acl);
}
cleanup:
(cfg_aclconfctx_t *)aclctx, mctx, 0,
&inst->aaaa_acl));
} else {
- CHECK(dns_acl_any(mctx, &inst->aaaa_acl));
+ dns_acl_any(mctx, &inst->aaaa_acl);
}
cleanup:
result = cfg_map_get(synthrecordcfg, "allow-synth", &obj);
if (result == ISC_R_NOTFOUND) {
- return dns_acl_any(inst->mctx, &inst->allowedsynth);
+ dns_acl_any(inst->mctx, &inst->allowedsynth);
+ return ISC_R_SUCCESS;
}
if (result != ISC_R_SUCCESS) {
}
/* This is completely insecure - use some sensible values instead! */
- result = dns_acl_any(inst->mctx, &acl_any);
- if (result != ISC_R_SUCCESS) {
- log_write(ISC_LOG_ERROR, "create_zone: dns_acl_any -> %s\n",
- isc_result_totext(result));
- goto cleanup;
- }
+ dns_acl_any(inst->mctx, &acl_any);
dns_zone_setupdateacl(raw, acl_any);
dns_zone_setqueryacl(raw, acl_any);
dns_zone_setxfracl(raw, acl_any);
* "any" is a positive iptable entry with bit length 0.
* "none" is the same as "!any".
*/
-static isc_result_t
+static void
dns_acl_anyornone(isc_mem_t *mctx, bool neg, dns_acl_t **target) {
- isc_result_t result;
dns_acl_t *acl = NULL;
dns_acl_create(mctx, 0, &acl);
-
- result = dns_iptable_addprefix(acl->iptable, NULL, 0, !neg);
- if (result != ISC_R_SUCCESS) {
- dns_acl_detach(&acl);
- return result;
- }
+ dns_iptable_addprefix(acl->iptable, NULL, 0, !neg);
*target = acl;
- return result;
}
/*
* Create a new ACL that matches everything.
*/
-isc_result_t
+void
dns_acl_any(isc_mem_t *mctx, dns_acl_t **target) {
- return dns_acl_anyornone(mctx, false, target);
+ dns_acl_anyornone(mctx, false, target);
}
/*
* Create a new ACL that matches nothing.
*/
-isc_result_t
+void
dns_acl_none(isc_mem_t *mctx, dns_acl_t **target) {
- return dns_acl_anyornone(mctx, true, target);
+ dns_acl_anyornone(mctx, true, target);
}
/*
* node_count value is set correctly afterward.
*/
nodes = max_node + dns_acl_node_count(dest);
- RETERR(dns_iptable_merge(dest->iptable, source->iptable, pos));
+ dns_iptable_merge(dest->iptable, source->iptable, pos);
if (nodes > dns_acl_node_count(dest)) {
dns_acl_node_count(dest) = nodes;
}
* length is 0.
*/
-isc_result_t
+void
dns_acl_any(isc_mem_t *mctx, dns_acl_t **target);
/*%<
* Create a new ACL that matches everything.
*/
-isc_result_t
+void
dns_acl_none(isc_mem_t *mctx, dns_acl_t **target);
/*%<
* Create a new ACL that matches nothing.
* Create a new IP table and the underlying radix structure
*/
-isc_result_t
+void
dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
uint16_t bitlen, bool pos);
/*
* Add an IP prefix to an existing IP table
*/
-isc_result_t
+void
dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, bool pos);
/*
* Merge one IP table into another one.
/*
* Add an IP prefix to an existing IP table
*/
-static isc_result_t
+static void
iptable_addentry(dns_iptable_t *tab, isc_prefix_t *pfx, bool pos) {
isc_radix_node_t *node = NULL;
- isc_result_t result;
- result = isc_radix_insert(tab->radix, &node, NULL, pfx);
- if (result != ISC_R_SUCCESS) {
- return result;
- }
+ isc_radix_insert(tab->radix, &node, NULL, pfx);
/* Preserve first-match semantics: don't overwrite existing data */
int fam = ISC_RADIX_FAMILY(pfx);
if (node->data[fam] == NULL) {
node->data[fam] = pos ? &dns_iptable_pos : &dns_iptable_neg;
}
-
- return ISC_R_SUCCESS;
}
-isc_result_t
+void
dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
uint16_t bitlen, bool pos) {
- isc_result_t result;
-
INSIST(DNS_IPTABLE_VALID(tab));
INSIST(tab->radix != NULL);
isc_prefix_t pfx4 = { .family = AF_INET, .bitlen = 0 };
isc_prefix_t pfx6 = { .family = AF_INET6, .bitlen = 0 };
- result = iptable_addentry(tab, &pfx4, pos);
- if (result != ISC_R_SUCCESS) {
- return result;
- }
- return iptable_addentry(tab, &pfx6, pos);
+ iptable_addentry(tab, &pfx4, pos);
+ iptable_addentry(tab, &pfx6, pos);
+ return;
}
isc_prefix_t pfx;
NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
- return iptable_addentry(tab, &pfx, pos);
+ iptable_addentry(tab, &pfx, pos);
}
/*
* Merge one IP table into another one.
*/
-isc_result_t
+void
dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, bool pos) {
isc_radix_node_t *node, *new_node;
- int i, max_node = 0;
+ int max_node = 0;
RADIX_WALK(source->radix->head, node) {
new_node = NULL;
- RETERR(isc_radix_insert(tab->radix, &new_node, node, NULL));
+ isc_radix_insert(tab->radix, &new_node, node, NULL);
/*
* If we're negating a nested ACL, then we should
* could be a security risk. To prevent this, we
* just leave the negative nodes negative.
*/
- for (i = 0; i < RADIX_FAMILIES; i++) {
+ for (int i = 0; i < RADIX_FAMILIES; i++) {
if (!pos) {
- if (node->data[i] && *(bool *)node->data[i]) {
+ if (node->data[i] != NULL &&
+ *(bool *)node->data[i])
+ {
new_node->data[i] = &dns_iptable_neg;
}
}
RADIX_WALK_END;
tab->radix->num_added_node += max_node;
- return ISC_R_SUCCESS;
}
static void
* \li ISC_R_SUCCESS
*/
-isc_result_t
+void
isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
isc_radix_node_t *source, isc_prefix_t *prefix);
/*%<
* \li 'target' is not NULL and "*target" is NULL.
* \li 'prefix' to be valid or 'source' to be non NULL and contain
* a valid prefix.
- *
- * Returns:
- * \li ISC_R_SUCCESS
*/
void
* information regarding copyright ownership.
*/
-/*
- * This source was adapted from MRT's RCS Ids:
- * Id: radix.c,v 1.10.2.1 1999/11/29 05:16:24 masaki Exp
- * Id: prefix.c,v 1.37.2.9 2000/03/10 02:53:19 labovit Exp
- */
-
#include <inttypes.h>
#include <isc/mem.h>
return ISC_R_SUCCESS;
}
-isc_result_t
+void
isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
isc_radix_node_t *source, isc_prefix_t *prefix) {
isc_radix_node_t *node;
radix->head = node;
radix->num_active_node++;
*target = node;
- return ISC_R_SUCCESS;
+ return;
}
u_char *addr = isc_prefix_touchar(prefix);
}
}
*target = node;
- return ISC_R_SUCCESS;
+ return;
} else {
node->prefix = *prefix;
}
node->node_num[ISC_RADIX_FAMILY(prefix)] = next;
}
*target = node;
- return ISC_R_SUCCESS;
+ return;
}
isc_radix_node_t *new_node = radix_node_create(radix->mctx, prefix,
node->left = new_node;
}
*target = new_node;
- return ISC_R_SUCCESS;
+ return;
}
if (bitlen == differ_bit) {
}
*target = new_node;
- return ISC_R_SUCCESS;
+ return;
}
void
* the nestedacl element, not the iptable entry.
*/
setpos = (nest_level != 0 || !neg);
- CHECK(dns_iptable_addprefix(iptab, &addr, bitlen,
- setpos));
+ dns_iptable_addprefix(iptab, &addr, bitlen, setpos);
if (nest_level > 0) {
INSIST(dacl->length < dacl->alloc);
if (strcasecmp(name, "any") == 0) {
/* Iptable entry with zero bit length. */
setpos = (nest_level != 0 || !neg);
- CHECK(dns_iptable_addprefix(iptab, NULL, 0,
- setpos));
+ dns_iptable_addprefix(iptab, NULL, 0, setpos);
if (nest_level != 0) {
INSIST(dacl->length < dacl->alloc);
* "!none;".
*/
setpos = (nest_level != 0 || neg);
- CHECK(dns_iptable_addprefix(iptab, NULL, 0,
- setpos));
+ dns_iptable_addprefix(iptab, NULL, 0, setpos);
if (!neg) {
dacl->has_negatives = !neg;
/* First add localhost address */
prefixlen = (netaddr->family == AF_INET) ? 32 : 128;
- RETERR(dns_iptable_addprefix(localhost->iptable, netaddr, prefixlen,
- true));
+ dns_iptable_addprefix(localhost->iptable, netaddr, prefixlen, true);
/* Then add localnets prefix */
result = isc_netaddr_masktoprefixlen(&interface->netmask, &prefixlen);
return ISC_R_SUCCESS;
}
- RETERR(dns_iptable_addprefix(localnets->iptable, netaddr, prefixlen,
- true));
+ dns_iptable_addprefix(localnets->iptable, netaddr, prefixlen, true);
return ISC_R_SUCCESS;
}
UNUSED(state);
- result = dns_acl_any(isc_g_mctx, &any);
- assert_int_equal(result, ISC_R_SUCCESS);
+ dns_acl_any(isc_g_mctx, &any);
- result = dns_acl_none(isc_g_mctx, &none);
- assert_int_equal(result, ISC_R_SUCCESS);
+ dns_acl_none(isc_g_mctx, &none);
dns_acl_create(isc_g_mctx, 1, ¬none);
prefix_from_str(str, bitlen, &pfx);
- isc_result_t result = isc_radix_insert(radix, &node, NULL, &pfx);
- assert_int_equal(result, ISC_R_SUCCESS);
+ isc_radix_insert(radix, &node, NULL, &pfx);
node->data[RADIX_V4] = data;
return node;