← Back to branch summary

~ubuntu-branches/ubuntu/maverick/bind9/maverick

« back to all changes in this revision

Viewing changes to lib/dns/iptable.c

  • Committer: Bazaar Package Importer
  • Author(s): LaMont Jones, LaMont Jones, Internet Software Consortium, Inc, localization folks
  • Date: 2008-08-02 14:20:20 UTC
  • mfrom: (1.2.1 upstream) (6.1.24 intrepid)
  • Revision ID: james.westby@ubuntu.com-20080802142020-l1hon9jy8lbbjxmg
http://bugs.debian.org/149259
http://bugs.debian.org/492418
http://bugs.debian.org/493392
http://bugs.debian.org/492564
http://bugs.debian.org/490027
http://bugs.debian.org/492949
http://bugs.debian.org/492425
http://bugs.debian.org/491369
http://bugs.debian.org/492048
http://bugs.debian.org/490630
http://bugs.debian.org/492587
[LaMont Jones]

* default to using resolvconf if it is installed
* fix sonames and dependencies.  Closes: #149259, #492418
* Do not build-depend libcap2-dev on non-linux.  Closes: #493392
* drop unused query-loc manpage.  Closes: #492564
* lwresd: Deliver /etc/bind directory.  Closes: #490027
* fix query-source comment in default install

[Internet Software Consortium, Inc]

* 9.5.0-P2.  Closes: #492949

[localization folks]

* l10n: Spanish debconf translation.  Closes: #492425 (Ignacio Mondino)
* l10n: Swedish debconf templates.  Closes: #491369 (Martin Ågren)
* l10n: Japanese debconf translations.  Closes: #492048 (Hideki Yamane
  (Debian-JP))
* l10n: Finnish translation.  Closes: #490630 (Esko Arajärvi)
* l10n: Italian debconf translations.  Closes: #492587 (Alessandro Vietta)

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/dns/iptable.c
 
1
/*
 
2
 * Copyright (C) 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
 
3
 *
 
4
 * Permission to use, copy, modify, and/or distribute this software for any
 
5
 * purpose with or without fee is hereby granted, provided that the above
 
6
 * copyright notice and this permission notice appear in all copies.
 
7
 *
 
8
 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 
9
 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 
10
 * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 
11
 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 
12
 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 
13
 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 
14
 * PERFORMANCE OF THIS SOFTWARE.
 
15
 */
 
16
 
 
17
/* $Id: iptable.c,v 1.5.46.3 2008/01/21 21:02:24 each Exp $ */
 
18
 
 
19
#include <isc/mem.h>
 
20
#include <isc/radix.h>
 
21
 
 
22
#include <dns/acl.h>
 
23
 
 
24
static void destroy_iptable(dns_iptable_t *dtab);
 
25
 
 
26
/*
 
27
 * Create a new IP table and the underlying radix structure
 
28
 */
 
29
isc_result_t
 
30
dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) {
 
31
        isc_result_t result;
 
32
        dns_iptable_t *tab;
 
33
 
 
34
        tab = isc_mem_get(mctx, sizeof(*tab));
 
35
        if (tab == NULL)
 
36
                return (ISC_R_NOMEMORY);
 
37
        tab->mctx = mctx;
 
38
        isc_refcount_init(&tab->refcount, 1);
 
39
        tab->magic = DNS_IPTABLE_MAGIC;
 
40
 
 
41
        result = isc_radix_create(mctx, &tab->radix, RADIX_MAXBITS);
 
42
        if (result != ISC_R_SUCCESS)
 
43
                goto cleanup;
 
44
 
 
45
        *target = tab;
 
46
        return (ISC_R_SUCCESS);
 
47
 
 
48
 cleanup:
 
49
        dns_iptable_detach(&tab);
 
50
        return (result);
 
51
}
 
52
 
 
53
isc_boolean_t dns_iptable_neg = ISC_FALSE;
 
54
isc_boolean_t dns_iptable_pos = ISC_TRUE;
 
55
 
 
56
/*
 
57
 * Add an IP prefix to an existing IP table
 
58
 */
 
59
isc_result_t
 
60
dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
 
61
                      isc_uint16_t bitlen, isc_boolean_t pos)
 
62
{
 
63
        isc_result_t result;
 
64
        isc_prefix_t pfx;
 
65
        isc_radix_node_t *node;
 
66
        int family;
 
67
 
 
68
        INSIST(DNS_IPTABLE_VALID(tab));
 
69
        INSIST(tab->radix);
 
70
 
 
71
        NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
 
72
 
 
73
        /* Bitlen 0 means "any" or "none", which is always treated as IPv4 */
 
74
        family = bitlen ? pfx.family : AF_INET;
 
75
 
 
76
        result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
 
77
 
 
78
        if (result != ISC_R_SUCCESS)
 
79
                return(result);
 
80
 
 
81
        /* If the node already contains data, don't overwrite it */
 
82
        if (node->data[ISC_IS6(family)] == NULL) {
 
83
                if (pos)
 
84
                        node->data[ISC_IS6(family)] = &dns_iptable_pos;
 
85
                else
 
86
                        node->data[ISC_IS6(family)] = &dns_iptable_neg;
 
87
        }
 
88
 
 
89
        return (ISC_R_SUCCESS);
 
90
}
 
91
 
 
92
/*
 
93
 * Merge one IP table into another one.
 
94
 */
 
95
isc_result_t
 
96
dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos)
 
97
{
 
98
        isc_result_t result;
 
99
        isc_radix_node_t *node, *new_node;
 
100
        int max_node = 0;
 
101
 
 
102
        RADIX_WALK (source->radix->head, node) {
 
103
                result = isc_radix_insert (tab->radix, &new_node, node, NULL);
 
104
 
 
105
                if (result != ISC_R_SUCCESS)
 
106
                        return(result);
 
107
 
 
108
                /*
 
109
                 * If we're negating a nested ACL, then we should
 
110
                 * reverse the sense of every node.  However, this
 
111
                 * could lead to a negative node in a nested ACL
 
112
                 * becoming a positive match in the parent, which
 
113
                 * could be a security risk.  To prevent this, we
 
114
                 * just leave the negative nodes negative.
 
115
                 */
 
116
                if (!pos) {
 
117
                        if (node->data[0] &&
 
118
                            *(isc_boolean_t *) node->data[0] == ISC_TRUE)
 
119
                                new_node->data[0] = &dns_iptable_neg;
 
120
                        else
 
121
                                new_node->data[0] = node->data[0];
 
122
 
 
123
                        if (node->data[1] &&
 
124
                            *(isc_boolean_t *) node->data[1] == ISC_TRUE)
 
125
                                new_node->data[1] = &dns_iptable_neg;
 
126
                        else
 
127
                                new_node->data[1] = node->data[0];
 
128
                }
 
129
 
 
130
                if (node->node_num[0] > max_node)
 
131
                        max_node = node->node_num[0];
 
132
                if (node->node_num[1] > max_node)
 
133
                        max_node = node->node_num[1];
 
134
        } RADIX_WALK_END;
 
135
 
 
136
        tab->radix->num_added_node += max_node;
 
137
        return (ISC_R_SUCCESS);
 
138
}
 
139
 
 
140
void
 
141
dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target) {
 
142
        REQUIRE(DNS_IPTABLE_VALID(source));
 
143
        isc_refcount_increment(&source->refcount, NULL);
 
144
        *target = source;
 
145
}
 
146
 
 
147
void
 
148
dns_iptable_detach(dns_iptable_t **tabp) {
 
149
        dns_iptable_t *tab = *tabp;
 
150
        unsigned int refs;
 
151
        REQUIRE(DNS_IPTABLE_VALID(tab));
 
152
        isc_refcount_decrement(&tab->refcount, &refs);
 
153
        if (refs == 0)
 
154
                destroy_iptable(tab);
 
155
        *tabp = NULL;
 
156
}
 
157
 
 
158
static void
 
159
destroy_iptable(dns_iptable_t *dtab) {
 
160
 
 
161
        REQUIRE(DNS_IPTABLE_VALID(dtab));
 
162
 
 
163
        if (dtab->radix != NULL) {
 
164
                isc_radix_destroy(dtab->radix, NULL);
 
165
                dtab->radix = NULL;
 
166
        }
 
167
 
 
168
        isc_refcount_destroy(&dtab->refcount);
 
169
        dtab->magic = 0;
 
170
        isc_mem_put(dtab->mctx, dtab, sizeof(*dtab));
 
171
}