Add isc_rwlock around dns_aclenv .localhost and .localnets member

In order to modify the .localhost and .localnets members of the
dns_aclenv, all other processing on the netmgr loops needed to be
stopped using the task exclusive mode.  Add the isc_rwlock to the
dns_aclenv, so any modifications to the .localhost and .localnets can be
done under the write lock.

diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index f38ce3b64bdf21ff9791c970bcf95b63a7ad461f..cea74f72d54b03aec1a216add15e30142315e830 100644 (file)
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -177,7 +177,7 @@ dns_acl_isnone(dns_acl_t *acl) {
 
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-             const dns_acl_t *acl, const dns_aclenv_t *env, int *match,
+             const dns_acl_t *acl, dns_aclenv_t *env, int *match,
              const dns_aclelement_t **matchelt) {
        uint16_t bitlen;
        isc_prefix_t pfx;
@@ -251,7 +251,7 @@ dns_acl_match_port_transport(const isc_netaddr_t *reqaddr,
                             const in_port_t local_port,
                             const isc_nmsocket_type_t transport,
                             const bool encrypted, const dns_name_t *reqsigner,
-                            const dns_acl_t *acl, const dns_aclenv_t *env,
+                            const dns_acl_t *acl, dns_aclenv_t *env,
                             int *match, const dns_aclelement_t **matchelt) {
        isc_result_t result = ISC_R_SUCCESS;
        dns_acl_port_transports_t *next;
@@ -420,7 +420,7 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos) {
 
 bool
 dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-                    const dns_aclelement_t *e, const dns_aclenv_t *env,
+                    const dns_aclelement_t *e, dns_aclenv_t *env,
                     const dns_aclelement_t **matchelt) {
        dns_acl_t *inner = NULL;
        int indirectmatch;
@@ -439,21 +439,33 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
                }
 
        case dns_aclelementtype_nestedacl:
-               inner = e->nestedacl;
+               dns_acl_attach(e->nestedacl, &inner);
                break;
 
        case dns_aclelementtype_localhost:
-               if (env == NULL || env->localhost == NULL) {
+               if (env == NULL) {
                        return (false);
                }
-               inner = env->localhost;
+               RWLOCK(&env->rwlock, isc_rwlocktype_read);
+               if (env->localhost == NULL) {
+                       RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
+                       return (false);
+               }
+               dns_acl_attach(env->localhost, &inner);
+               RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
                break;
 
        case dns_aclelementtype_localnets:
-               if (env == NULL || env->localnets == NULL) {
+               if (env == NULL) {
+                       return (false);
+               }
+               RWLOCK(&env->rwlock, isc_rwlocktype_read);
+               if (env->localnets == NULL) {
+                       RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
                        return (false);
                }
-               inner = env->localnets;
+               dns_acl_attach(env->localnets, &inner);
+               RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
                break;
 
 #if defined(HAVE_GEOIP2)
@@ -471,6 +483,8 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
                               matchelt);
        INSIST(result == ISC_R_SUCCESS);
 
+       dns_acl_detach(&inner);
+
        /*
         * Treat negative matches in indirect ACLs as "no match".
         * That way, a negated indirect ACL will never become a
@@ -695,10 +709,11 @@ dns_aclenv_create(isc_mem_t *mctx, dns_aclenv_t **envp) {
 
        isc_mem_attach(mctx, &env->mctx);
        isc_refcount_init(&env->references, 1);
+       isc_rwlock_init(&env->rwlock, 0, 0);
 
        result = dns_acl_create(mctx, 0, &env->localhost);
        if (result != ISC_R_SUCCESS) {
-               goto cleanup_nothing;
+               goto cleanup_rwlock;
        }
        result = dns_acl_create(mctx, 0, &env->localnets);
        if (result != ISC_R_SUCCESS) {
@@ -717,15 +732,31 @@ dns_aclenv_create(isc_mem_t *mctx, dns_aclenv_t **envp) {
 
 cleanup_localhost:
        dns_acl_detach(&env->localhost);
-cleanup_nothing:
+cleanup_rwlock:
+       isc_rwlock_destroy(&env->rwlock);
+       isc_mem_putanddetach(&env->mctx, env, sizeof(*env));
        return (result);
 }
 
+void
+dns_aclenv_set(dns_aclenv_t *env, dns_acl_t *localhost, dns_acl_t *localnets) {
+       REQUIRE(VALID_ACLENV(env));
+
+       RWLOCK(&env->rwlock, isc_rwlocktype_write);
+       dns_acl_detach(&env->localhost);
+       dns_acl_attach(localhost, &env->localhost);
+       dns_acl_detach(&env->localnets);
+       dns_acl_attach(localnets, &env->localnets);
+       RWUNLOCK(&env->rwlock, isc_rwlocktype_write);
+}
+
 void
 dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
        REQUIRE(VALID_ACLENV(s));
        REQUIRE(VALID_ACLENV(t));
 
+       RWLOCK(&t->rwlock, isc_rwlocktype_write);
+       RWLOCK(&s->rwlock, isc_rwlocktype_read);
        dns_acl_detach(&t->localhost);
        dns_acl_attach(s->localhost, &t->localhost);
        dns_acl_detach(&t->localnets);
@@ -735,6 +766,9 @@ dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
 #if defined(HAVE_GEOIP2)
        t->geoip = s->geoip;
 #endif /* if defined(HAVE_GEOIP2) */
+
+       RWUNLOCK(&s->rwlock, isc_rwlocktype_read);
+       RWUNLOCK(&t->rwlock, isc_rwlocktype_write);
 }
 
 static void
@@ -743,12 +777,10 @@ dns__aclenv_destroy(dns_aclenv_t *aclenv) {
 
        aclenv->magic = 0;
 
-       if (aclenv->localhost != NULL) {
-               dns_acl_detach(&aclenv->localhost);
-       }
-       if (aclenv->localnets != NULL) {
-               dns_acl_detach(&aclenv->localnets);
-       }
+       isc_refcount_destroy(&aclenv->references);
+       dns_acl_detach(&aclenv->localhost);
+       dns_acl_detach(&aclenv->localnets);
+       isc_rwlock_destroy(&aclenv->rwlock);
 
        isc_mem_putanddetach(&aclenv->mctx, aclenv, sizeof(*aclenv));
 }

diff --git a/lib/dns/dns64.c b/lib/dns/dns64.c
index 70304b53b9bd16d52a54bf6a0460eb6e77e608c6..b575726009e0b3f97f6819f2329680f67b3df3ca 100644 (file)
--- a/lib/dns/dns64.c
+++ b/lib/dns/dns64.c
@@ -128,7 +128,7 @@ dns_dns64_destroy(dns_dns64_t **dns64p) {
 
 isc_result_t
 dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-                   const dns_name_t *reqsigner, const dns_aclenv_t *env,
+                   const dns_name_t *reqsigner, dns_aclenv_t *env,
                    unsigned int flags, unsigned char *a, unsigned char *aaaa) {
        unsigned int nbytes, i;
        isc_result_t result;
@@ -212,7 +212,7 @@ dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64) {
 
 bool
 dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-                const dns_name_t *reqsigner, const dns_aclenv_t *env,
+                const dns_name_t *reqsigner, dns_aclenv_t *env,
                 unsigned int flags, dns_rdataset_t *rdataset, bool *aaaaok,
                 size_t aaaaoklen) {
        struct in6_addr in6;

diff --git a/lib/dns/include/dns/acl.h b/lib/dns/include/dns/acl.h
index e6ca53d343d98f6d84d515f330f83a6e728933cd..532b4592cd07c73dcecd72e693e76401c19f385a 100644 (file)
--- a/lib/dns/include/dns/acl.h
+++ b/lib/dns/include/dns/acl.h
@@ -32,6 +32,7 @@
 #include <isc/magic.h>
 #include <isc/netaddr.h>
 #include <isc/refcount.h>
+#include <isc/rwlock.h>
 
 #include <dns/geoip.h>
 #include <dns/iptable.h>
@@ -101,9 +102,12 @@ struct dns_aclenv {
        unsigned int   magic;
        isc_mem_t         *mctx;
        isc_refcount_t references;
+
+       isc_rwlock_t rwlock; /*%< Locks localhost and localnets */
        dns_acl_t         *localhost;
        dns_acl_t         *localnets;
-       bool           match_mapped;
+
+       bool match_mapped;
 #if defined(HAVE_GEOIP2)
        dns_geoip_databases_t *geoip;
 #endif /* HAVE_GEOIP2 */
@@ -219,6 +223,12 @@ dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s);
  *\li  both 's' and 't' are valid ACL environments.
  */
 
+void
+dns_aclenv_set(dns_aclenv_t *env, dns_acl_t *localhost, dns_acl_t *localnets);
+/*%<
+ * Attach the 'localhost' and 'localnets' arguments to 'env' ACL environment
+ */
+
 void
 dns_aclenv_attach(dns_aclenv_t *source, dns_aclenv_t **targetp);
 /*%<
@@ -240,7 +250,7 @@ dns_aclenv_detach(dns_aclenv_t **aclenvp);
 
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-             const dns_acl_t *acl, const dns_aclenv_t *env, int *match,
+             const dns_acl_t *acl, dns_aclenv_t *env, int *match,
              const dns_aclelement_t **matchelt);
 /*%<
  * General, low-level ACL matching.  This is expected to
@@ -270,7 +280,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 
 bool
 dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-                    const dns_aclelement_t *e, const dns_aclenv_t *env,
+                    const dns_aclelement_t *e, dns_aclenv_t *env,
                     const dns_aclelement_t **matchelt);
 /*%<
  * Like dns_acl_match, but matches against the single ACL element 'e'
@@ -287,7 +297,7 @@ dns_acl_match_port_transport(const isc_netaddr_t     *reqaddr,
                             const in_port_t           local_port,
                             const isc_nmsocket_type_t transport,
                             const bool encrypted, const dns_name_t *reqsigner,
-                            const dns_acl_t *acl, const dns_aclenv_t *env,
+                            const dns_acl_t *acl, dns_aclenv_t *env,
                             int *match, const dns_aclelement_t **matchelt);
 /*%<
  * Like dns_acl_match, but able to match the server port and

diff --git a/lib/dns/include/dns/dns64.h b/lib/dns/include/dns/dns64.h
index 069a491f5f0a6ab55c15c7fec09a22cd131f7c78..8dd01032b2a2dc5cb43627a5a2a0ef35668c560a 100644 (file)
--- a/lib/dns/include/dns/dns64.h
+++ b/lib/dns/include/dns/dns64.h
@@ -99,7 +99,7 @@ dns_dns64_destroy(dns_dns64_t **dns64p);
 
 isc_result_t
 dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-                   const dns_name_t *reqsigner, const dns_aclenv_t *env,
+                   const dns_name_t *reqsigner, dns_aclenv_t *env,
                    unsigned int flags, unsigned char *a, unsigned char *aaaa);
 /*
  * dns_dns64_aaaafroma() determines whether to perform a DNS64 address
@@ -147,7 +147,7 @@ dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64);
 
 bool
 dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-                const dns_name_t *reqsigner, const dns_aclenv_t *env,
+                const dns_name_t *reqsigner, dns_aclenv_t *env,
                 unsigned int flags, dns_rdataset_t *rdataset, bool *aaaaok,
                 size_t aaaaoklen);
 /*

diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
index 2adf7162590e9bd54783b647263be9c235f6258c..a4246ee613ad8ccbf45473745d56938e54752b47 100644 (file)
--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
@@ -238,7 +238,7 @@ typedef struct dns_msgblock dns_msgblock_t;
 
 struct dns_sortlist_arg {
        dns_aclenv_t         *env;
-       const dns_acl_t *acl;
+       dns_acl_t                 *acl;
        const dns_aclelement_t *element;
 };
 
@@ -1417,7 +1417,7 @@ dns_message_getrawmessage(dns_message_t *msg);
 
 void
 dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
-                        dns_aclenv_t *env, const dns_acl_t *acl,
+                        dns_aclenv_t *env, dns_acl_t *acl,
                         const dns_aclelement_t *element);
 /*%<
  * Define the order in which RR sets get rendered by

diff --git a/lib/dns/include/dns/ssu.h b/lib/dns/include/dns/ssu.h
index 002ccc808dc33a4b4ab6747d83f157438ca56d82..ead0097632321242d7ba02dd0fa2468d71edcc10 100644 (file)
--- a/lib/dns/include/dns/ssu.h
+++ b/lib/dns/include/dns/ssu.h
@@ -143,7 +143,7 @@ dns_ssutable_addrule(dns_ssutable_t *table, bool grant,
 bool
 dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
                        const dns_name_t *name, const isc_netaddr_t *addr,
-                       bool tcp, const dns_aclenv_t *env, dns_rdatatype_t type,
+                       bool tcp, dns_aclenv_t *env, dns_rdatatype_t type,
                        const dns_name_t *target, const dst_key_t *key,
                        const dns_ssurule_t **rulep);
 /*%<

diff --git a/lib/dns/message.c b/lib/dns/message.c
index 84f750e93d21420e6de82042142cb3a6b463eb76..ccfd6b61e57d096a02a6cfb3b859d3c9db0eea9e 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -642,6 +642,13 @@ msgreset(dns_message_t *msg, bool everything) {
                dynbuf = next_dynbuf;
        }
 
+       if (msg->order_arg.env != NULL) {
+               dns_aclenv_detach(&msg->order_arg.env);
+       }
+       if (msg->order_arg.acl != NULL) {
+               dns_acl_detach(&msg->order_arg.acl);
+       }
+
        /*
         * Set other bits to normal default values.
         */
@@ -4457,15 +4464,19 @@ dns_message_getrawmessage(dns_message_t *msg) {
 
 void
 dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
-                        dns_aclenv_t *env, const dns_acl_t *acl,
+                        dns_aclenv_t *env, dns_acl_t *acl,
                         const dns_aclelement_t *elem) {
        REQUIRE(DNS_MESSAGE_VALID(msg));
        REQUIRE((order == NULL) == (env == NULL));
        REQUIRE(env == NULL || (acl != NULL || elem != NULL));
 
        msg->order = order;
-       msg->order_arg.env = env;
-       msg->order_arg.acl = acl;
+       if (env != NULL) {
+               dns_aclenv_attach(env, &msg->order_arg.env);
+       }
+       if (acl != NULL) {
+               dns_acl_attach(acl, &msg->order_arg.acl);
+       }
        msg->order_arg.element = elem;
 }
 

diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c
index bc240ce669119a930c1d123a93357c11902c0d82..5f3df90062b23a4fa6c8a8130000421e8cd5674d 100644 (file)
--- a/lib/dns/ssu.c
+++ b/lib/dns/ssu.c
@@ -279,7 +279,7 @@ stf_from_address(dns_name_t *stfself, const isc_netaddr_t *tcpaddr) {
 bool
 dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
                        const dns_name_t *name, const isc_netaddr_t *addr,
-                       bool tcp, const dns_aclenv_t *env, dns_rdatatype_t type,
+                       bool tcp, dns_aclenv_t *env, dns_rdatatype_t type,
                        const dns_name_t *target, const dst_key_t *key,
                        const dns_ssurule_t **rulep) {
        dns_fixedname_t fixed;
@@ -367,8 +367,10 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
                        if (!dns_name_issubdomain(name, rule->name)) {
                                continue;
                        }
+                       RWLOCK(&env->rwlock, isc_rwlocktype_read);
                        dns_acl_match(addr, NULL, env->localhost, NULL, &match,
                                      NULL);
+                       RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
                        if (match == 0) {
                                if (signer != NULL) {
                                        isc_log_write(dns_lctx,

diff --git a/lib/ns/include/ns/sortlist.h b/lib/ns/include/ns/sortlist.h
index 96f41e034888eac5df455f468d951f55199c8739..f3ad3cb7f58c485172d0ab579ae142808291789b 100644 (file)
--- a/lib/ns/include/ns/sortlist.h
+++ b/lib/ns/include/ns/sortlist.h
@@ -37,7 +37,7 @@ typedef enum {
 
 ns_sortlisttype_t
 ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
-                 const void **argp);
+                 void **argp);
 /*%<
  * Find the sortlist statement in 'acl' (for ACL environment 'env')
  * that applies to 'clientaddr', if any.
@@ -70,7 +70,7 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg);
 void
 ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, dns_aclenv_t *env,
                        isc_netaddr_t         *client_addr,
-                       dns_addressorderfunc_t *orderp, const void **argp);
+                       dns_addressorderfunc_t *orderp, void **argp);
 /*%<
  * Find the sortlist statement in 'acl' that applies to 'clientaddr', if any.
  * If a sortlist statement applies, return in '*orderp' a pointer to a function

diff --git a/lib/ns/query.c b/lib/ns/query.c
index b9e76eb8971ee5b0e67bd13871dc80cb76a341cd..ec6b379a0d1f5bfc8ed507d6aedf5aefd17879a9 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -11584,20 +11584,25 @@ query_setup_sortlist(query_ctx_t *qctx) {
        isc_netaddr_t netaddr;
        ns_client_t *client = qctx->client;
        dns_aclenv_t *env = client->manager->aclenv;
-       const void *order_arg = NULL;
+       dns_acl_t *acl = NULL;
+       dns_aclelement_t *elt = NULL;
+       void *order_arg = NULL;
 
        isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
        switch (ns_sortlist_setup(client->view->sortlist, env, &netaddr,
                                  &order_arg)) {
        case NS_SORTLISTTYPE_1ELEMENT:
+               elt = order_arg;
                dns_message_setsortorder(client->message,
                                         query_sortlist_order_1element, env,
-                                        NULL, order_arg);
+                                        NULL, elt);
                break;
        case NS_SORTLISTTYPE_2ELEMENT:
+               acl = order_arg;
                dns_message_setsortorder(client->message,
                                         query_sortlist_order_2element, env,
-                                        order_arg, NULL);
+                                        acl, NULL);
+               dns_acl_detach(&acl);
                break;
        case NS_SORTLISTTYPE_NONE:
                break;

diff --git a/lib/ns/sortlist.c b/lib/ns/sortlist.c
index 0c3dc40bf223817026b20fc991225f9701c16c6f..3e6a3517e9001688123ce681a95910a3acc39802 100644 (file)
--- a/lib/ns/sortlist.c
+++ b/lib/ns/sortlist.c
@@ -25,14 +25,12 @@
 
 ns_sortlisttype_t
 ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
-                 const void **argp) {
-       unsigned int i;
-
+                 void **argp) {
        if (acl == NULL) {
                goto dont_sort;
        }
 
-       for (i = 0; i < acl->length; i++) {
+       for (size_t i = 0; i < acl->length; i++) {
                /*
                 * 'e' refers to the current 'top level statement'
                 * in the sortlist (see ARM).
@@ -40,7 +38,7 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
                dns_aclelement_t *e = &acl->elements[i];
                dns_aclelement_t *try_elt;
                dns_aclelement_t *order_elt = NULL;
-               const dns_aclelement_t *matched_elt = NULL;
+               dns_aclelement_t *matched_elt = NULL;
 
                if (e->type == dns_aclelementtype_nestedacl) {
                        dns_acl_t *inner = e->nestedacl;
@@ -65,43 +63,62 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
                        try_elt = e;
                }
 
-               if (dns_aclelement_match(clientaddr, NULL, try_elt, env,
-                                        &matched_elt)) {
-                       if (order_elt != NULL) {
-                               if (order_elt->type ==
-                                   dns_aclelementtype_nestedacl) {
-                                       *argp = order_elt->nestedacl;
-                                       return (NS_SORTLISTTYPE_2ELEMENT);
-                               } else if (order_elt->type ==
-                                                  dns_aclelementtype_localhost &&
-                                          env->localhost != NULL)
-                               {
-                                       *argp = env->localhost;
-                                       return (NS_SORTLISTTYPE_2ELEMENT);
-                               } else if (order_elt->type ==
-                                                  dns_aclelementtype_localnets &&
-                                          env->localnets != NULL)
-                               {
-                                       *argp = env->localnets;
-                                       return (NS_SORTLISTTYPE_2ELEMENT);
-                               } else {
-                                       /*
-                                        * BIND 8 allows a bare IP prefix as
-                                        * the 2nd element of a 2-element
-                                        * sortlist statement.
-                                        */
-                                       *argp = order_elt;
-                                       return (NS_SORTLISTTYPE_1ELEMENT);
-                               }
-                       } else {
-                               INSIST(matched_elt != NULL);
-                               *argp = matched_elt;
-                               return (NS_SORTLISTTYPE_1ELEMENT);
+               if (!dns_aclelement_match(
+                           clientaddr, NULL, try_elt, env,
+                           (const dns_aclelement_t **)&matched_elt))
+               {
+                       continue;
+               }
+
+               if (order_elt == NULL) {
+                       INSIST(matched_elt != NULL);
+                       *argp = matched_elt;
+                       return (NS_SORTLISTTYPE_1ELEMENT);
+               }
+
+               if (order_elt->type == dns_aclelementtype_nestedacl) {
+                       dns_acl_t *inner = NULL;
+                       dns_acl_attach(order_elt->nestedacl, &inner);
+                       *argp = inner;
+                       return (NS_SORTLISTTYPE_2ELEMENT);
+               }
+
+               if (order_elt->type == dns_aclelementtype_localhost) {
+                       dns_acl_t *inner = NULL;
+                       RWLOCK(&env->rwlock, isc_rwlocktype_read);
+                       if (env->localhost != NULL) {
+                               dns_acl_attach(env->localhost, &inner);
+                       }
+                       RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
+
+                       if (inner != NULL) {
+                               *argp = inner;
+                               return (NS_SORTLISTTYPE_2ELEMENT);
                        }
                }
+
+               if (order_elt->type == dns_aclelementtype_localnets) {
+                       dns_acl_t *inner = NULL;
+                       RWLOCK(&env->rwlock, isc_rwlocktype_read);
+                       if (env->localnets != NULL) {
+                               dns_acl_attach(env->localnets, &inner);
+                       }
+                       RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
+                       if (inner != NULL) {
+                               *argp = inner;
+                               return (NS_SORTLISTTYPE_2ELEMENT);
+                       }
+               }
+
+               /*
+                * BIND 8 allows a bare IP prefix as
+                * the 2nd element of a 2-element
+                * sortlist statement.
+                */
+               *argp = order_elt;
+               return (NS_SORTLISTTYPE_1ELEMENT);
        }
 
-       /* No match; don't sort. */
 dont_sort:
        *argp = NULL;
        return (NS_SORTLISTTYPE_NONE);
@@ -110,7 +127,7 @@ dont_sort:
 int
 ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
        const dns_sortlist_arg_t *sla = (const dns_sortlist_arg_t *)arg;
-       const dns_aclenv_t *env = sla->env;
+       dns_aclenv_t *env = sla->env;
        const dns_acl_t *sortacl = sla->acl;
        int match;
 
@@ -127,7 +144,7 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
 int
 ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
        const dns_sortlist_arg_t *sla = (const dns_sortlist_arg_t *)arg;
-       const dns_aclenv_t *env = sla->env;
+       dns_aclenv_t *env = sla->env;
        const dns_aclelement_t *element = sla->element;
 
        if (dns_aclelement_match(addr, NULL, element, env, NULL)) {
@@ -140,7 +157,7 @@ ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
 void
 ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, dns_aclenv_t *env,
                        isc_netaddr_t *client_addr,
-                       dns_addressorderfunc_t *orderp, const void **argp) {
+                       dns_addressorderfunc_t *orderp, void **argp) {
        ns_sortlisttype_t sortlisttype;
 
        sortlisttype = ns_sortlist_setup(sortlist_acl, env, client_addr, argp);