1999-12-16 23:11:07 +00:00
|
|
|
/*
|
2000-02-03 23:50:32 +00:00
|
|
|
* Copyright (C) 1999, 2000 Internet Software Consortium.
|
1999-12-16 23:11:07 +00:00
|
|
|
*
|
|
|
|
* Permission to use, copy, modify, and distribute this software for any
|
|
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
|
|
* copyright notice and this permission notice appear in all copies.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
|
|
|
|
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
|
|
|
|
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
|
|
|
|
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
|
|
|
|
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
|
|
|
|
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
|
|
|
|
* SOFTWARE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
|
2000-05-08 19:23:32 +00:00
|
|
|
#include <isc/string.h> /* Required for HP/UX (and others?) */
|
2000-04-28 01:12:23 +00:00
|
|
|
#include <isc/util.h>
|
1999-12-16 23:11:07 +00:00
|
|
|
|
2000-05-08 14:38:29 +00:00
|
|
|
#include <dns/acl.h>
|
1999-12-16 23:11:07 +00:00
|
|
|
#include <dns/aclconf.h>
|
|
|
|
#include <dns/fixedname.h>
|
2000-01-20 00:59:17 +00:00
|
|
|
#include <dns/log.h>
|
1999-12-16 23:11:07 +00:00
|
|
|
|
2000-05-08 14:38:29 +00:00
|
|
|
void
|
|
|
|
dns_aclconfctx_init(dns_aclconfctx_t *ctx) {
|
1999-12-16 23:11:07 +00:00
|
|
|
ISC_LIST_INIT(ctx->named_acl_cache);
|
|
|
|
}
|
|
|
|
|
2000-05-08 14:38:29 +00:00
|
|
|
void
|
|
|
|
dns_aclconfctx_destroy(dns_aclconfctx_t *ctx) {
|
1999-12-16 23:11:07 +00:00
|
|
|
dns_acl_t *dacl, *next;
|
|
|
|
for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
|
|
|
|
dacl != NULL;
|
|
|
|
dacl = next)
|
|
|
|
{
|
|
|
|
next = ISC_LIST_NEXT(dacl, nextincache);
|
|
|
|
dacl->name = NULL;
|
|
|
|
dns_acl_detach(&dacl);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static isc_result_t
|
|
|
|
convert_named_acl(char *aclname, dns_c_ctx_t *cctx,
|
|
|
|
dns_aclconfctx_t *ctx, isc_mem_t *mctx,
|
|
|
|
dns_acl_t **target)
|
|
|
|
{
|
|
|
|
isc_result_t result;
|
|
|
|
dns_c_acl_t *cacl;
|
|
|
|
dns_acl_t *dacl;
|
|
|
|
|
|
|
|
/* Look for an already-converted version. */
|
|
|
|
for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
|
|
|
|
dacl != NULL;
|
|
|
|
dacl = ISC_LIST_NEXT(dacl, nextincache))
|
|
|
|
{
|
|
|
|
if (strcmp(aclname, dacl->name) == 0) {
|
|
|
|
dns_acl_attach(dacl, target);
|
|
|
|
return ISC_R_SUCCESS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Not yet converted. Convert now. */
|
|
|
|
result = dns_c_acltable_getacl(cctx->acls, aclname, &cacl);
|
2000-04-06 22:03:35 +00:00
|
|
|
if (result != ISC_R_SUCCESS) {
|
1999-12-16 23:11:07 +00:00
|
|
|
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
|
|
|
|
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
|
2000-03-01 22:41:59 +00:00
|
|
|
"undefined ACL '%s'", aclname);
|
1999-12-16 23:11:07 +00:00
|
|
|
return (result);
|
|
|
|
}
|
|
|
|
result = dns_acl_fromconfig(cacl->ipml, cctx, ctx, mctx, &dacl);
|
2000-04-06 22:03:35 +00:00
|
|
|
if (result != ISC_R_SUCCESS)
|
1999-12-16 23:11:07 +00:00
|
|
|
return (result);
|
|
|
|
dacl->name = aclname;
|
|
|
|
ISC_LIST_APPEND(ctx->named_acl_cache, dacl, nextincache);
|
|
|
|
dns_acl_attach(dacl, target);
|
|
|
|
return (ISC_R_SUCCESS);
|
|
|
|
}
|
|
|
|
|
|
|
|
static isc_result_t
|
|
|
|
convert_keyname(char *txtname, isc_mem_t *mctx, dns_name_t *dnsname) {
|
|
|
|
isc_result_t result;
|
|
|
|
isc_buffer_t buf;
|
|
|
|
dns_fixedname_t fixname;
|
|
|
|
unsigned int keylen;
|
|
|
|
|
|
|
|
keylen = strlen(txtname);
|
103. [func] libisc buffer API changes for <isc/buffer.h>:
Added:
isc_buffer_base(b) (pointer)
isc_buffer_current(b) (pointer)
isc_buffer_active(b) (pointer)
isc_buffer_used(b) (pointer)
isc_buffer_length(b) (int)
isc_buffer_usedlength(b) (int)
isc_buffer_consumedlength(b) (int)
isc_buffer_remaininglength(b) (int)
isc_buffer_activelength(b) (int)
isc_buffer_availablelength(b) (int)
Removed:
ISC_BUFFER_USEDCOUNT(b)
ISC_BUFFER_AVAILABLECOUNT(b)
isc_buffer_type(b)
Changed names:
isc_buffer_used(b, r) ->
isc_buffer_usedregion(b, r)
isc_buffer_available(b, r) ->
isc_buffer_available_region(b, r)
isc_buffer_consumed(b, r) ->
isc_buffer_consumedregion(b, r)
isc_buffer_active(b, r) ->
isc_buffer_activeregion(b, r)
isc_buffer_remaining(b, r) ->
isc_buffer_remainingregion(b, r)
Buffer types were removed, so the ISC_BUFFERTYPE_*
macros are no more, and the type argument to
isc_buffer_init and isc_buffer_allocate were removed.
isc_buffer_putstr is now void (instead of isc_result_t)
and requires that the caller ensure that there
is enough available buffer space for the string.
2000-04-27 00:03:12 +00:00
|
|
|
isc_buffer_init(&buf, txtname, keylen);
|
1999-12-16 23:11:07 +00:00
|
|
|
isc_buffer_add(&buf, keylen);
|
|
|
|
dns_fixedname_init(&fixname);
|
|
|
|
result = dns_name_fromtext(dns_fixedname_name(&fixname), &buf,
|
|
|
|
dns_rootname, ISC_FALSE, NULL);
|
|
|
|
if (result != ISC_R_SUCCESS) {
|
|
|
|
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
|
|
|
|
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
|
|
|
|
"key name \"%s\" is not a valid domain name",
|
|
|
|
txtname);
|
|
|
|
return (result);
|
|
|
|
}
|
|
|
|
return (dns_name_dup(dns_fixedname_name(&fixname), mctx, dnsname));
|
|
|
|
}
|
2000-01-13 23:38:55 +00:00
|
|
|
|
1999-12-16 23:11:07 +00:00
|
|
|
isc_result_t
|
|
|
|
dns_acl_fromconfig(dns_c_ipmatchlist_t *caml,
|
|
|
|
dns_c_ctx_t *cctx,
|
|
|
|
dns_aclconfctx_t *ctx,
|
|
|
|
isc_mem_t *mctx,
|
|
|
|
dns_acl_t **target)
|
|
|
|
{
|
|
|
|
isc_result_t result;
|
|
|
|
unsigned int count;
|
|
|
|
dns_acl_t *dacl = NULL;
|
|
|
|
dns_aclelement_t *de;
|
|
|
|
dns_c_ipmatchelement_t *ce;
|
|
|
|
|
|
|
|
REQUIRE(target != NULL && *target == NULL);
|
|
|
|
|
|
|
|
count = 0;
|
|
|
|
for (ce = ISC_LIST_HEAD(caml->elements);
|
|
|
|
ce != NULL;
|
|
|
|
ce = ISC_LIST_NEXT(ce, next))
|
|
|
|
count++;
|
|
|
|
|
2000-01-13 23:38:55 +00:00
|
|
|
result = dns_acl_create(mctx, count, &dacl);
|
|
|
|
if (result != ISC_R_SUCCESS)
|
|
|
|
return (result);
|
1999-12-16 23:11:07 +00:00
|
|
|
|
|
|
|
de = dacl->elements;
|
|
|
|
for (ce = ISC_LIST_HEAD(caml->elements);
|
|
|
|
ce != NULL;
|
|
|
|
ce = ISC_LIST_NEXT(ce, next))
|
|
|
|
{
|
|
|
|
de->negative = dns_c_ipmatchelement_isneg(ce);
|
|
|
|
switch (ce->type) {
|
|
|
|
case dns_c_ipmatch_pattern:
|
|
|
|
de->type = dns_aclelementtype_ipprefix;
|
2000-02-15 19:53:05 +00:00
|
|
|
isc_netaddr_fromsockaddr(&de->u.ip_prefix.address,
|
|
|
|
&ce->u.direct.address);
|
1999-12-16 23:11:07 +00:00
|
|
|
/* XXX "mask" is a misnomer */
|
|
|
|
de->u.ip_prefix.prefixlen = ce->u.direct.mask;
|
|
|
|
break;
|
|
|
|
case dns_c_ipmatch_key:
|
|
|
|
de->type = dns_aclelementtype_keyname;
|
|
|
|
dns_name_init(&de->u.keyname, NULL);
|
2000-05-08 14:38:29 +00:00
|
|
|
result = convert_keyname(ce->u.key, mctx,
|
|
|
|
&de->u.keyname);
|
1999-12-16 23:11:07 +00:00
|
|
|
if (result != ISC_R_SUCCESS)
|
|
|
|
goto cleanup;
|
|
|
|
break;
|
|
|
|
case dns_c_ipmatch_indirect:
|
|
|
|
de->type = dns_aclelementtype_nestedacl;
|
2000-05-08 14:38:29 +00:00
|
|
|
result = dns_acl_fromconfig(ce->u.indirect.list,
|
|
|
|
cctx, ctx, mctx,
|
|
|
|
&de->u.nestedacl);
|
1999-12-16 23:11:07 +00:00
|
|
|
if (result != ISC_R_SUCCESS)
|
|
|
|
goto cleanup;
|
|
|
|
break;
|
|
|
|
case dns_c_ipmatch_localhost:
|
|
|
|
de->type = dns_aclelementtype_localhost;
|
|
|
|
break;
|
2000-02-15 16:58:52 +00:00
|
|
|
|
2000-02-11 18:26:09 +00:00
|
|
|
case dns_c_ipmatch_any:
|
|
|
|
de->type = dns_aclelementtype_any;
|
|
|
|
break;
|
2000-02-15 16:58:52 +00:00
|
|
|
|
1999-12-16 23:11:07 +00:00
|
|
|
case dns_c_ipmatch_localnets:
|
|
|
|
de->type = dns_aclelementtype_localnets;
|
|
|
|
break;
|
|
|
|
case dns_c_ipmatch_acl:
|
|
|
|
de->type = dns_aclelementtype_nestedacl;
|
2000-05-08 14:38:29 +00:00
|
|
|
result = convert_named_acl(ce->u.aclname,
|
|
|
|
cctx, ctx, mctx,
|
|
|
|
&de->u.nestedacl);
|
1999-12-16 23:11:07 +00:00
|
|
|
if (result != ISC_R_SUCCESS)
|
|
|
|
goto cleanup;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
|
|
|
|
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
|
|
|
|
"address match list contains "
|
|
|
|
"unsupported element type");
|
|
|
|
result = ISC_R_FAILURE;
|
|
|
|
goto cleanup;
|
|
|
|
}
|
|
|
|
de++;
|
|
|
|
dacl->length++;
|
|
|
|
}
|
|
|
|
|
|
|
|
*target = dacl;
|
|
|
|
return (ISC_R_SUCCESS);
|
|
|
|
|
|
|
|
cleanup:
|
|
|
|
dns_acl_detach(&dacl);
|
|
|
|
return (result);
|
|
|
|
}
|