Home | History | Annotate | Line # | Download | only in dns 
      1 /*	$NetBSD: iptable.c,v 1.1 2024/02/18 20:57:32 christos Exp $	*/
      2 
      3 /*
      4  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
      5  *
      6  * SPDX-License-Identifier: MPL-2.0
      7  *
      8  * This Source Code Form is subject to the terms of the Mozilla Public
      9  * License, v. 2.0. If a copy of the MPL was not distributed with this
     10  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
     11  *
     12  * See the COPYRIGHT file distributed with this work for additional
     13  * information regarding copyright ownership.
     14  */
     15 
     16 #include <inttypes.h>
     17 #include <stdbool.h>
     18 
     19 #include <isc/mem.h>
     20 #include <isc/radix.h>
     21 #include <isc/util.h>
     22 
     23 #include <dns/acl.h>
     24 
     25 static void
     26 destroy_iptable(dns_iptable_t *dtab);
     27 
     28 /*
     29  * Create a new IP table and the underlying radix structure
     30  */
     31 isc_result_t
     32 dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) {
     33 	isc_result_t result;
     34 	dns_iptable_t *tab;
     35 
     36 	tab = isc_mem_get(mctx, sizeof(*tab));
     37 	tab->mctx = NULL;
     38 	isc_mem_attach(mctx, &tab->mctx);
     39 	isc_refcount_init(&tab->refcount, 1);
     40 	tab->radix = NULL;
     41 	tab->magic = DNS_IPTABLE_MAGIC;
     42 
     43 	result = isc_radix_create(mctx, &tab->radix, RADIX_MAXBITS);
     44 	if (result != ISC_R_SUCCESS) {
     45 		goto cleanup;
     46 	}
     47 
     48 	*target = tab;
     49 	return (ISC_R_SUCCESS);
     50 
     51 cleanup:
     52 	dns_iptable_detach(&tab);
     53 	return (result);
     54 }
     55 
     56 static bool dns_iptable_neg = false;
     57 static bool dns_iptable_pos = true;
     58 
     59 /*
     60  * Add an IP prefix to an existing IP table
     61  */
     62 isc_result_t
     63 dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
     64 		      uint16_t bitlen, bool pos) {
     65 	isc_result_t result;
     66 	isc_prefix_t pfx;
     67 	isc_radix_node_t *node = NULL;
     68 	int i;
     69 
     70 	INSIST(DNS_IPTABLE_VALID(tab));
     71 	INSIST(tab->radix != NULL);
     72 
     73 	NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
     74 
     75 	result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
     76 	if (result != ISC_R_SUCCESS) {
     77 		isc_refcount_destroy(&pfx.refcount);
     78 		return (result);
     79 	}
     80 
     81 	/* If a node already contains data, don't overwrite it */
     82 	if (pfx.family == AF_UNSPEC) {
     83 		/* "any" or "none" */
     84 		INSIST(pfx.bitlen == 0);
     85 		for (i = 0; i < RADIX_FAMILIES; i++) {
     86 			if (node->data[i] == NULL) {
     87 				node->data[i] = pos ? &dns_iptable_pos
     88 						    : &dns_iptable_neg;
     89 			}
     90 		}
     91 	} else {
     92 		/* any other prefix */
     93 		int fam = ISC_RADIX_FAMILY(&pfx);
     94 		if (node->data[fam] == NULL) {
     95 			node->data[fam] = pos ? &dns_iptable_pos
     96 					      : &dns_iptable_neg;
     97 		}
     98 	}
     99 
    100 	isc_refcount_destroy(&pfx.refcount);
    101 	return (ISC_R_SUCCESS);
    102 }
    103 
    104 /*
    105  * Merge one IP table into another one.
    106  */
    107 isc_result_t
    108 dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, bool pos) {
    109 	isc_result_t result;
    110 	isc_radix_node_t *node, *new_node;
    111 	int i, max_node = 0;
    112 
    113 	RADIX_WALK(source->radix->head, node) {
    114 		new_node = NULL;
    115 		result = isc_radix_insert(tab->radix, &new_node, node, NULL);
    116 
    117 		if (result != ISC_R_SUCCESS) {
    118 			return (result);
    119 		}
    120 
    121 		/*
    122 		 * If we're negating a nested ACL, then we should
    123 		 * reverse the sense of every node.  However, this
    124 		 * could lead to a negative node in a nested ACL
    125 		 * becoming a positive match in the parent, which
    126 		 * could be a security risk.  To prevent this, we
    127 		 * just leave the negative nodes negative.
    128 		 */
    129 		for (i = 0; i < RADIX_FAMILIES; i++) {
    130 			if (!pos) {
    131 				if (node->data[i] && *(bool *)node->data[i]) {
    132 					new_node->data[i] = &dns_iptable_neg;
    133 				}
    134 			}
    135 			if (node->node_num[i] > max_node) {
    136 				max_node = node->node_num[i];
    137 			}
    138 		}
    139 	}
    140 	RADIX_WALK_END;
    141 
    142 	tab->radix->num_added_node += max_node;
    143 	return (ISC_R_SUCCESS);
    144 }
    145 
    146 void
    147 dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target) {
    148 	REQUIRE(DNS_IPTABLE_VALID(source));
    149 	isc_refcount_increment(&source->refcount);
    150 	*target = source;
    151 }
    152 
    153 void
    154 dns_iptable_detach(dns_iptable_t **tabp) {
    155 	REQUIRE(tabp != NULL && DNS_IPTABLE_VALID(*tabp));
    156 	dns_iptable_t *tab = *tabp;
    157 	*tabp = NULL;
    158 
    159 	if (isc_refcount_decrement(&tab->refcount) == 1) {
    160 		isc_refcount_destroy(&tab->refcount);
    161 		destroy_iptable(tab);
    162 	}
    163 }
    164 
    165 static void
    166 destroy_iptable(dns_iptable_t *dtab) {
    167 	REQUIRE(DNS_IPTABLE_VALID(dtab));
    168 
    169 	if (dtab->radix != NULL) {
    170 		isc_radix_destroy(dtab->radix, NULL);
    171 		dtab->radix = NULL;
    172 	}
    173 
    174 	dtab->magic = 0;
    175 	isc_mem_putanddetach(&dtab->mctx, dtab, sizeof(*dtab));
    176 }
    177