]> git.ipfire.org Git - thirdparty/bind9.git/commitdiff
libdns refactoring: get rid of two versions of dns_acl_match and dns_aclelement_match
authorWitold Kręcicki <wpk@isc.org>
Tue, 3 Apr 2018 11:09:45 +0000 (13:09 +0200)
committerWitold Kręcicki <wpk@isc.org>
Fri, 6 Apr 2018 06:04:40 +0000 (08:04 +0200)
15 files changed:
bin/named/controlconf.c
bin/named/statschannel.c
lib/dns/acl.c
lib/dns/dispatch.c
lib/dns/dns64.c
lib/dns/include/dns/acl.h
lib/dns/request.c
lib/dns/resolver.c
lib/dns/rrl.c
lib/dns/ssu.c
lib/dns/win32/libdns.def.in
lib/dns/zone.c
lib/ns/client.c
lib/ns/interfacemgr.c
lib/ns/sortlist.c

index fc0a914b172a4596690e7f8907fc1e2c8e4d4e63..c859f1ebd5b074734ba9407b0ce37b1dad539c8a 100644 (file)
@@ -230,7 +230,8 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {
 
        isc_netaddr_fromsockaddr(&netaddr, sockaddr);
 
-       result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
+       result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, acl, env, &match,
+                              NULL);
 
        if (result != ISC_R_SUCCESS || match <= 0)
                return (ISC_FALSE);
index f73eacd32a1daf496948ecddf0713c2b11617d13..3a8a0003a4eceae36c89259423f8bed221c72ebd 100644 (file)
@@ -3177,7 +3177,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
        isc_netaddr_fromsockaddr(&netaddr, fromaddr);
 
        LOCK(&listener->lock);
-       if (dns_acl_match(&netaddr, NULL, listener->acl, env,
+       if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, listener->acl, env,
                          &match, NULL) == ISC_R_SUCCESS && match > 0)
        {
                UNLOCK(&listener->lock);
index 371f4bcc7705637d9a75a3015aace32d3b3cf8a5..f2c550c557e10f0ab0c9da90d20b0920c6a7456a 100644 (file)
@@ -178,28 +178,17 @@ dns_acl_isnone(dns_acl_t *acl)
  * return with a positive value in match; for a match with a negated ACL
  * element or radix entry, return with a negative value in match.
  */
+
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr,
              const dns_name_t *reqsigner,
+             const isc_netaddr_t *ecs,
+             isc_uint8_t ecslen,
+             isc_uint8_t *scope,
              const dns_acl_t *acl,
              const dns_aclenv_t *env,
              int *match,
              const dns_aclelement_t **matchelt)
-{
-       return (dns_acl_match2(reqaddr, reqsigner, NULL, 0, NULL, acl, env,
-                              match, matchelt));
-}
-
-isc_result_t
-dns_acl_match2(const isc_netaddr_t *reqaddr,
-              const dns_name_t *reqsigner,
-              const isc_netaddr_t *ecs,
-              isc_uint8_t ecslen,
-              isc_uint8_t *scope,
-              const dns_acl_t *acl,
-              const dns_aclenv_t *env,
-              int *match,
-              const dns_aclelement_t **matchelt)
 {
        isc_uint16_t bitlen;
        isc_prefix_t pfx;
@@ -290,8 +279,8 @@ dns_acl_match2(const isc_netaddr_t *reqaddr,
                        break;
                }
 
-               if (dns_aclelement_match2(reqaddr, reqsigner, ecs, ecslen,
-                                         scope, e, env, matchelt))
+               if (dns_aclelement_match(reqaddr, reqsigner, ecs, ecslen,
+                                        scope, e, env, matchelt))
                {
                        if (match_num == -1 || e->node_num < match_num) {
                                if (e->negative)
@@ -424,26 +413,16 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos)
  * a reference to a named ACL or a nested ACL, a matching element
  * returned through 'matchelt' is not necessarily 'e' itself.
  */
+
 isc_boolean_t
 dns_aclelement_match(const isc_netaddr_t *reqaddr,
                     const dns_name_t *reqsigner,
+                    const isc_netaddr_t *ecs,
+                    isc_uint8_t ecslen,
+                    isc_uint8_t *scope,
                     const dns_aclelement_t *e,
                     const dns_aclenv_t *env,
                     const dns_aclelement_t **matchelt)
-{
-       return (dns_aclelement_match2(reqaddr, reqsigner, NULL, 0, NULL,
-                                     e, env, matchelt));
-}
-
-isc_boolean_t
-dns_aclelement_match2(const isc_netaddr_t *reqaddr,
-                     const dns_name_t *reqsigner,
-                     const isc_netaddr_t *ecs,
-                     isc_uint8_t ecslen,
-                     isc_uint8_t *scope,
-                     const dns_aclelement_t *e,
-                     const dns_aclenv_t *env,
-                     const dns_aclelement_t **matchelt)
 {
        dns_acl_t *inner = NULL;
        int indirectmatch;
@@ -493,8 +472,8 @@ dns_aclelement_match2(const isc_netaddr_t *reqaddr,
                INSIST(0);
        }
 
-       result = dns_acl_match2(reqaddr, reqsigner, ecs, ecslen, scope,
-                               inner, env, &indirectmatch, matchelt);
+       result = dns_acl_match(reqaddr, reqsigner, ecs, ecslen, scope,
+                              inner, env, &indirectmatch, matchelt);
        INSIST(result == ISC_R_SUCCESS);
 
        /*
@@ -687,8 +666,8 @@ dns_acl_allowed(isc_netaddr_t *addr, dns_name_t *signer,
 
        if (acl == NULL)
                return (ISC_TRUE);
-       result = dns_acl_match2(addr, signer, ecs_addr, ecs_addrlen,
-                               ecs_scope, acl, aclenv, &match, NULL);
+       result = dns_acl_match(addr, signer, ecs_addr, ecs_addrlen,
+                              ecs_scope, acl, aclenv, &match, NULL);
        if (result == ISC_R_SUCCESS && match > 0)
                return (ISC_TRUE);
        return (ISC_FALSE);
index 33e6ace7bc5b58ac4af3f51c67d9e1423f80299d..68055c0f0870d85a702ebf5fce18a386bc69d99e 100644 (file)
@@ -1138,7 +1138,8 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
         */
        isc_netaddr_fromsockaddr(&netaddr, &ev->address);
        if (disp->mgr->blackhole != NULL &&
-           dns_acl_match(&netaddr, NULL, disp->mgr->blackhole,
+           dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
+                         disp->mgr->blackhole,
                          NULL, &match, NULL) == ISC_R_SUCCESS &&
            match > 0)
        {
index 39480491941fed55f18d11b752d9ce5d8c90fca2..cbd8b73be96f4df7bc1327ef169d3ac863d97bda 100644 (file)
@@ -24,6 +24,7 @@
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/result.h>
+#include <string.h>
 
 struct dns_dns64 {
        unsigned char           bits[16];       /*
@@ -138,8 +139,8 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
                return (DNS_R_DISALLOWED);
 
        if (dns64->clients != NULL) {
-               result = dns_acl_match(reqaddr, reqsigner, dns64->clients, env,
-                                      &match, NULL);
+               result = dns_acl_match(reqaddr, reqsigner, NULL, 0, NULL,
+                                      dns64->clients, env, &match, NULL);
                if (result != ISC_R_SUCCESS)
                        return (result);
                if (match <= 0)
@@ -152,8 +153,8 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 
                memmove(&ina.s_addr, a, 4);
                isc_netaddr_fromin(&netaddr, &ina);
-               result = dns_acl_match(&netaddr, NULL, dns64->mapped, env,
-                                      &match, NULL);
+               result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
+                                      dns64->mapped, env, &match, NULL);
                if (result != ISC_R_SUCCESS)
                        return (result);
                if (match <= 0)
@@ -227,8 +228,8 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
                 * Work out if this dns64 structure applies to this client.
                 */
                if (dns64->clients != NULL) {
-                       result = dns_acl_match(reqaddr, reqsigner,
-                                              dns64->clients, env,
+                       result = dns_acl_match(reqaddr, reqsigner, NULL, 0,
+                                              NULL, dns64->clients, env,
                                               &match, NULL);
                        if (result != ISC_R_SUCCESS)
                                continue;
@@ -266,9 +267,10 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
                                memmove(&in6.s6_addr, rdata.data, 16);
                                isc_netaddr_fromin6(&netaddr, &in6);
 
-                               result = dns_acl_match(&netaddr, NULL,
-                                                      dns64->excluded,
-                                                      env, &match, NULL);
+                               result = dns_acl_match(&netaddr, NULL, NULL,
+                                                      0, NULL,
+                                                      dns64->excluded, env,
+                                                      &match, NULL);
                                if (result == ISC_R_SUCCESS && match <= 0) {
                                        answer = ISC_TRUE;
                                        if (aaaaok == NULL)
index b6a92e3f70612fc26dd933c75a5d9a9769c9dc05..e5f703e35ec7b451dee5244ddb14e3143bd2263a 100644 (file)
@@ -211,21 +211,13 @@ dns_aclenv_destroy(dns_aclenv_t *env);
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr,
              const dns_name_t *reqsigner,
+             const isc_netaddr_t *ecs,
+             isc_uint8_t ecslen,
+             isc_uint8_t *scope,
              const dns_acl_t *acl,
              const dns_aclenv_t *env,
              int *match,
              const dns_aclelement_t **matchelt);
-
-isc_result_t
-dns_acl_match2(const isc_netaddr_t *reqaddr,
-              const dns_name_t *reqsigner,
-              const isc_netaddr_t *ecs,
-              isc_uint8_t ecslen,
-              isc_uint8_t *scope,
-              const dns_acl_t *acl,
-              const dns_aclenv_t *env,
-              int *match,
-              const dns_aclelement_t **matchelt);
 /*%<
  * General, low-level ACL matching.  This is expected to
  * be useful even for weird stuff like the topology and sortlist statements.
@@ -260,19 +252,12 @@ dns_acl_match2(const isc_netaddr_t *reqaddr,
 isc_boolean_t
 dns_aclelement_match(const isc_netaddr_t *reqaddr,
                     const dns_name_t *reqsigner,
+                    const isc_netaddr_t *ecs,
+                    isc_uint8_t ecslen,
+                    isc_uint8_t *scope,
                     const dns_aclelement_t *e,
                     const dns_aclenv_t *env,
                     const dns_aclelement_t **matchelt);
-
-isc_boolean_t
-dns_aclelement_match2(const isc_netaddr_t *reqaddr,
-                     const dns_name_t *reqsigner,
-                     const isc_netaddr_t *ecs,
-                     isc_uint8_t ecslen,
-                     isc_uint8_t *scope,
-                     const dns_aclelement_t *e,
-                     const dns_aclenv_t *env,
-                     const dns_aclelement_t **matchelt);
 /*%<
  * Like dns_acl_match, but matches against the single ACL element 'e'
  * rather than a complete ACL, and returns ISC_TRUE iff it matched.
index 4d9b989135e0b0d54800c6852abf20c9ba3a054f..a5d522d575b0dd7aaf187b43356a7199b4b5ae74 100644 (file)
@@ -508,7 +508,7 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) {
        blackhole = dns_dispatchmgr_getblackhole(dispatchmgr);
        if (blackhole != NULL) {
                isc_netaddr_fromsockaddr(&netaddr, destaddr);
-               if (dns_acl_match(&netaddr, NULL, blackhole,
+               if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, blackhole,
                                  NULL, &match, NULL) == ISC_R_SUCCESS &&
                    match > 0)
                        drop = ISC_TRUE;
index bdb07df2451475027da5014555a8a32036b9b188..86a45a6849809afebffaeb6c37c9b3f85fa3af29 100644 (file)
@@ -3754,7 +3754,7 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) {
        if (blackhole != NULL) {
                int match;
 
-               if (dns_acl_match(&ipaddr, NULL, blackhole,
+               if (dns_acl_match(&ipaddr, NULL, NULL, 0, NULL, blackhole,
                                  &res->view->aclenv,
                                  &match, NULL) == ISC_R_SUCCESS &&
                    match > 0)
@@ -6519,8 +6519,9 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
                        isc_netaddr_fromin6(&netaddr, &in6a);
                }
 
-               result = dns_acl_match(&netaddr, NULL, view->denyansweracl,
-                                      &view->aclenv, &match, NULL);
+               result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
+                                      view->denyansweracl, &view->aclenv,
+                                      &match, NULL);
 
                if (result == ISC_R_SUCCESS && match > 0) {
                        isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf));
index a6616c555022bad2d74b808c424ddf84effd6736..22860ad3495762e34c96f5dc37b0613cf1bb46c0 100644 (file)
@@ -1022,8 +1022,9 @@ dns_rrl(dns_view_t *view,
        rrl = view->rrl;
        if (rrl->exempt != NULL) {
                isc_netaddr_fromsockaddr(&netclient, client_addr);
-               result = dns_acl_match(&netclient, NULL, rrl->exempt,
-                                      &view->aclenv, &exempt_match, NULL);
+               result = dns_acl_match(&netclient, NULL, NULL, 0, NULL,
+                                      rrl->exempt, &view->aclenv,
+                                      &exempt_match, NULL);
                if (result == ISC_R_SUCCESS && exempt_match > 0)
                        return (DNS_RRL_RESULT_OK);
        }
index ed671871166e9715331af65e81f2b8abe26ac541..2fc9c61435fad3abb0b00ba7d5c2a4c46310f104 100644 (file)
@@ -430,8 +430,9 @@ dns_ssutable_checkrules2(dns_ssutable_t *table, const dns_name_t *signer,
                        if (!dns_name_issubdomain(name, rule->name)) {
                                continue;
                        }
-                       dns_acl_match(addr, NULL, env->localhost,
-                                     NULL, &match, NULL);
+                               dns_acl_match(addr, NULL, NULL, 0, NULL,
+                                             env->localhost, NULL, &match,
+                                             NULL);
                        if (match == 0) {
                                if (signer != NULL) {
                                        isc_log_write(dns_lctx,
index fc7ab3eae03d9ce629a22a64afa152c1395e3eb3..0a00eb6aa95328e370e97587bdbd58ffb64cdc05 100644 (file)
@@ -18,11 +18,9 @@ dns_acl_isany
 dns_acl_isinsecure
 dns_acl_isnone
 dns_acl_match
-dns_acl_match2
 dns_acl_merge
 dns_acl_none
 dns_aclelement_match
-dns_aclelement_match2
 dns_aclenv_copy
 dns_aclenv_destroy
 dns_aclenv_init
index ea19a8fa2cb933c2890f730f9bfcbd91ecf5e872..5e402f95adc1800960eaa24b6d9bb964cc10db83 100644 (file)
@@ -13245,9 +13245,9 @@ dns_zone_notifyreceive2(dns_zone_t *zone, isc_sockaddr_t *from,
        tsigkey = dns_message_gettsigkey(msg);
        tsig = dns_tsigkey_identity(tsigkey);
        if (i >= zone->masterscnt && zone->notify_acl != NULL &&
-           dns_acl_match(&netaddr, tsig, zone->notify_acl,
-                         &zone->view->aclenv,
-                         &match, NULL) == ISC_R_SUCCESS &&
+           dns_acl_match(&netaddr, tsig, NULL, 0, NULL, zone->notify_acl,
+                         &zone->view->aclenv, &match,
+                         NULL) == ISC_R_SUCCESS &&
            match > 0)
        {
                /* Accept notify. */
index fda05b89aaee6e3fa2c177523dcab5d4f11e0eae..b69e5e87b79a01a22ebad18ddd8a2ad52e1bfe22 100644 (file)
@@ -950,7 +950,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 
                isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
                if (client->sctx->blackholeacl != NULL &&
-                   dns_acl_match(&netaddr, NULL,
+                   dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
                                  client->sctx->blackholeacl,
                                  env, &match, NULL) == ISC_R_SUCCESS &&
                    match > 0)
@@ -1756,8 +1756,9 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
                int match;
 
                isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-               result = dns_acl_match(&netaddr, NULL, view->pad_acl,
-                                      env, &match, NULL);
+               result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
+                                      view->pad_acl, env, &match,
+                                      NULL);
                if (result == ISC_R_SUCCESS && match > 0) {
                        INSIST(count < DNS_EDNSOPTIONS);
 
@@ -2379,8 +2380,9 @@ ns__client_request(isc_task_t *task, isc_event_t *event) {
        env = ns_interfacemgr_getaclenv(client->interface->mgr);
        if (!TCP_CLIENT(client)) {
                if (client->sctx->blackholeacl != NULL &&
-                   dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl,
-                                 env, &match, NULL) == ISC_R_SUCCESS &&
+                       dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
+                                     client->sctx->blackholeacl, env, &match,
+                                     NULL) == ISC_R_SUCCESS &&
                    match > 0)
                {
                        ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -3199,9 +3201,9 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
                isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 
                if (client->sctx->blackholeacl != NULL &&
-                   dns_acl_match(&netaddr, NULL,
-                                 client->sctx->blackholeacl,
-                                 env, &match, NULL) == ISC_R_SUCCESS &&
+                       dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
+                                     client->sctx->blackholeacl,
+                                     env, &match, NULL) == ISC_R_SUCCESS &&
                    match > 0)
                {
                        ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -3753,9 +3755,9 @@ ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr,
                ecs_addrlen = client->ecs.source;
        }
 
-       result = dns_acl_match2(netaddr, client->signer,
-                               ecs_addr, ecs_addrlen, NULL, acl,
-                               env, &match, NULL);
+       result = dns_acl_match(netaddr, client->signer,
+                              ecs_addr, ecs_addrlen, NULL, acl,
+                              env, &match, NULL);
 
        if (result != ISC_R_SUCCESS)
                goto deny; /* Internal error, already logged. */
index ca53ec6650ce0dba058af22a2b6fa171d29ec1ed..358caeb2d284c8808116c6063f357955d260d54c 100644 (file)
@@ -1049,8 +1049,9 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
                         * See if the address matches the listen-on statement;
                         * if not, ignore the interface.
                         */
-                       (void)dns_acl_match(&listen_netaddr, NULL, le->acl,
-                                           &mgr->aclenv, &match, NULL);
+                       (void)dns_acl_match(&listen_netaddr, NULL, NULL, 0,
+                                           NULL, le->acl, &mgr->aclenv,
+                                           &match, NULL);
                        if (match <= 0)
                                continue;
 
@@ -1082,8 +1083,10 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
                                     ele != NULL;
                                     ele = ISC_LIST_NEXT(ele, link)) {
                                        (void)dns_acl_match(&listen_netaddr,
+                                                           NULL, NULL, 0,
                                                            NULL, ele->acl,
-                                                           NULL, &match, NULL);
+                                                           NULL, &match,
+                                                            NULL);
                                        if (match > 0 &&
                                            (ele->port == le->port ||
                                            ele->port == 0))
index c3cc2fc9ec33fb77c2821beab13e4dad1306c662..f83689bc57c126f77d2c29f0308888560f3c7aeb 100644 (file)
@@ -64,8 +64,8 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env,
                        try_elt = e;
                }
 
-               if (dns_aclelement_match(clientaddr, NULL, try_elt, env,
-                                        &matched_elt))
+               if (dns_aclelement_match(clientaddr, NULL, NULL, 0, NULL,
+                                        try_elt, env, &matched_elt))
                {
                        if (order_elt != NULL) {
                                if (order_elt->type ==
@@ -115,7 +115,8 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
        const dns_acl_t *sortacl = sla->acl;
        int match;
 
-       (void)dns_acl_match(addr, NULL, sortacl, env, &match, NULL);
+       (void)dns_acl_match(addr, NULL, NULL, 0, NULL, sortacl, env, &match,
+                            NULL);
        if (match > 0)
                return (match);
        else if (match < 0)
@@ -130,7 +131,8 @@ ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
        const dns_aclenv_t *env = sla->env;
        const dns_aclelement_t *element = sla->element;
 
-       if (dns_aclelement_match(addr, NULL, element, env, NULL)) {
+       if (dns_aclelement_match(addr, NULL, NULL, 0, NULL, element, env,
+                                NULL)) {
                return (0);
        }