Commit 3181d0e3 authored by Evan Hunt's avatar Evan Hunt
Browse files

Add support for O(1) ACL processing, based on radix tree code originally

written by kevin brintnall. [RT #16288]
parent c7e266b7
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
#ifndef DNS_IPTABLE_H
#define DNS_IPTABLE_H 1
#include <isc/lang.h>
#include <isc/magic.h>
#include <isc/radix.h>
struct dns_iptable {
unsigned int magic;
isc_mem_t *mctx;
isc_refcount_t refcount;
isc_radix_tree_t *radix;
ISC_LINK(dns_iptable_t) nextincache;
};
#define DNS_IPTABLE_MAGIC ISC_MAGIC('T','a','b','l')
#define DNS_IPTABLE_VALID(a) ISC_MAGIC_VALID(a, DNS_IPTABLE_MAGIC)
/***
*** Functions
***/
ISC_LANG_BEGINDECLS
isc_result_t
dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target);
/*
* Create a new IP table and the underlying radix structure
*/
isc_result_t
dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
isc_uint16_t bitlen, isc_boolean_t pos);
/*
* Add an IP prefix to an existing IP table
*/
void
dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos);
/*
* Merge one IP table into another one.
*/
void
dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target);
void
dns_iptable_detach(dns_iptable_t **tabp);
ISC_LANG_ENDDECLS
#endif /* DNS_IPTABLE_H */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
#include <isc/mem.h>
#include <isc/radix.h>
#include <dns/acl.h>
static void destroy_iptable(dns_iptable_t *dtab);
/*
* Create a new IP table and the underlying radix structure
*/
isc_result_t
dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) {
isc_result_t result;
dns_iptable_t *tab;
tab = isc_mem_get(mctx, sizeof(*tab));
if (tab == NULL)
return (ISC_R_NOMEMORY);
tab->mctx = mctx;
isc_refcount_init(&tab->refcount, 1);
tab->magic = DNS_IPTABLE_MAGIC;
result = isc_radix_create(mctx, &tab->radix, RADIX_MAXBITS);
if (result != ISC_R_SUCCESS)
goto cleanup;
*target = tab;
return (ISC_R_SUCCESS);
cleanup:
dns_iptable_detach(&tab);
return (result);
}
isc_boolean_t dns_iptable_neg = ISC_FALSE;
isc_boolean_t dns_iptable_pos = ISC_TRUE;
/*
* Add an IP prefix to an existing IP table
*/
isc_result_t
dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
isc_uint16_t bitlen, isc_boolean_t pos)
{
isc_result_t result;
isc_prefix_t pfx;
isc_radix_node_t *node;
INSIST(DNS_IPTABLE_VALID(tab));
INSIST(tab->radix);
NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
if (result != ISC_R_SUCCESS)
return(result);
/* If the node already contains data, don't overwrite it */
if (node->data == NULL) {
if (pos)
node->data = &dns_iptable_pos;
else
node->data = &dns_iptable_neg;
}
return (ISC_R_SUCCESS);
}
/*
* Merge one IP table into another one.
*/
void
dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos)
{
isc_radix_node_t *node, *new_node;
int max_node = 0;
RADIX_WALK (source->radix->head, node) {
isc_radix_insert (tab->radix, &new_node, node, NULL);
/*
* If we're negating a nested ACL, then we should
* reverse the sense of every node. However, this
* could lead to a negative node in a nested ACL
* becoming a positive match in the parent, which
* could be a security risk. To prevent this, we
* just leave the negative nodes negative.
* (XXX: does this still need to be documented?)
*/
if (!pos &&
node->data &&
*(isc_boolean_t *) node->data == ISC_TRUE)
new_node->data = &dns_iptable_neg;
else
new_node->data = node->data;
if (node->node_num > max_node)
max_node = node->node_num;
} RADIX_WALK_END;
tab->radix->num_added_node += max_node;
}
void
dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target) {
REQUIRE(DNS_IPTABLE_VALID(source));
isc_refcount_increment(&source->refcount, NULL);
*target = source;
}
void
dns_iptable_detach(dns_iptable_t **tabp) {
dns_iptable_t *tab = *tabp;
unsigned int refs;
REQUIRE(DNS_IPTABLE_VALID(tab));
isc_refcount_decrement(&tab->refcount, &refs);
if (refs == 0)
destroy_iptable(tab);
*tabp = NULL;
}
static void
destroy_iptable(dns_iptable_t *dtab) {
REQUIRE(DNS_IPTABLE_VALID(dtab));
if (dtab->radix != NULL) {
isc_destroy_radix(dtab->radix, NULL);
dtab->radix = NULL;
}
isc_refcount_destroy(&dtab->refcount);
dtab->magic = 0;
isc_mem_put(dtab->mctx, dtab, sizeof(*dtab));
}
/*
* Copyright (c) 1999-2000
*
* The Regents of the University of Michigan ("The Regents") and
* Merit Network, Inc. All rights reserved. Redistribution and use
* in source and binary forms, with or without modification, are
* permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above
* copyright notice, this list of conditions and the
* following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the
* following disclaimer in the documentation and/or other
* materials provided with the distribution.
*
* 3. All advertising materials mentioning features or use of
* this software must display the following acknowledgement:
*
* This product includes software developed by the University of
* Michigan, Merit Network, Inc., and their contributors.
*
* 4. Neither the name of the University, Merit Network, nor the
* names of their contributors may be used to endorse or
* promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL TH E REGENTS
* OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HO WEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/*
* This source was adapted from MRT's RCS Ids:
* Id: radix.h,v 1.6 1999/08/03 03:32:53 masaki Exp
* Id: mrt.h,v 1.57.2.6 1999/12/28 23:41:27 labovit Exp
* Id: defs.h,v 1.5.2.2 2000/01/15 14:19:16 masaki Exp
*/
#include <isc/magic.h>
#include <isc/types.h>
#include <isc/mutex.h>
#include <isc/net.h>
#include <isc/refcount.h>
#include <string.h>
#ifndef _RADIX_H
#define _RADIX_H
#define NETADDR_TO_PREFIX_T(na,pt,bits) \
do { \
memset(&(pt), 0, sizeof(pt)); \
if((bits) && (na) != NULL) { \
memcpy(&(pt).add.sin, &(na)->type.in, ((bits)+7)/8); \
(pt).bitlen = (bits); \
(pt).family = (na)->family; \
} else \
(pt).family = AF_INET; \
isc_refcount_init(&(pt).refcount, 0); \
} while(0)
typedef struct isc_prefix {
unsigned int family; /* AF_INET | AF_INET6 */
unsigned int bitlen;
isc_refcount_t refcount;
union {
struct in_addr sin;
struct in6_addr sin6;
} add;
} isc_prefix_t;
typedef void (*void_fn_t)();
#define isc_prefix_tochar(prefix) ((char *)&(prefix)->add.sin)
#define isc_prefix_touchar(prefix) ((u_char *)&(prefix)->add.sin)
#define BIT_TEST(f, b) ((f) & (b))
/*
* We need "first match" when we search the radix tree to preserve
* compatibility with the existing ACL implementation. Radix trees
* naturally lend themselves to "best match". In order to get "first
* match" behavior, we remember the entries are added to the tree,
* and when a search is made, we find all matching entries, and return
* the one that was added first.
*/
typedef struct isc_radix_node {
isc_uint32_t bit; /* bit length of the prefix */
isc_prefix_t *prefix; /* who we are in radix tree */
struct isc_radix_node *l, *r; /* left and right children */
struct isc_radix_node *parent; /* may be used */
void *data; /* pointer to data */
int node_num; /* which node this was in the tree,
or -1 for glue nodes */
} isc_radix_node_t;
#define RADIX_TREE_MAGIC ISC_MAGIC('R','d','x','T');
#define RADIX_TREE_VALID(a) ISC_MAGIC_VALID(a, RADIX_TREE_MAGIC);
typedef struct isc_radix_tree {
unsigned int magic;
isc_mem_t *mctx;
isc_radix_node_t *head;
isc_uint32_t maxbits; /* for IP, 32 bit addresses */
int num_active_node; /* for debugging purposes */
int num_added_node; /* total number of nodes */
} isc_radix_tree_t;
isc_result_t
isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target, isc_prefix_t *prefix);
isc_result_t
isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target, isc_radix_node_t *source, isc_prefix_t *prefix);
void
isc_radix_remove(isc_radix_tree_t *radix, isc_radix_node_t *node);
isc_result_t
isc_radix_create(isc_mem_t *mctx, isc_radix_tree_t **target, int maxbits);
void
isc_destroy_radix(isc_radix_tree_t *radix, void_fn_t func);
void
isc_radix_process(isc_radix_tree_t *radix, void_fn_t func);
#define RADIX_MAXBITS 128
#define RADIX_NBIT(x) (0x80 >> ((x) & 0x7f))
#define RADIX_NBYTE(x) ((x) >> 3)
#define RADIX_DATA_GET(node, type) (type *)((node)->data)
#define RADIX_DATA_SET(node, value) ((node)->data = (void *)(value))
#define RADIX_WALK(Xhead, Xnode) \
do { \
isc_radix_node_t *Xstack[RADIX_MAXBITS+1]; \
isc_radix_node_t **Xsp = Xstack; \
isc_radix_node_t *Xrn = (Xhead); \
while ((Xnode = Xrn)) { \
if (Xnode->prefix)
#define RADIX_WALK_ALL(Xhead, Xnode) \
do { \
isc_radix_node_t *Xstack[RADIX_MAXBITS+1]; \
isc_radix_node_t **Xsp = Xstack; \
isc_radix_node_t *Xrn = (Xhead); \
while ((Xnode = Xrn)) { \
if (1)
#define RADIX_WALK_BREAK { \
if (Xsp != Xstack) { \
Xrn = *(--Xsp); \
} else { \
Xrn = (radix_node_t *) 0; \
} \
continue; }
#define RADIX_WALK_END \
if (Xrn->l) { \
if (Xrn->r) { \
*Xsp++ = Xrn->r; \
} \
Xrn = Xrn->l; \
} else if (Xrn->r) { \
Xrn = Xrn->r; \
} else if (Xsp != Xstack) { \
Xrn = *(--Xsp); \
} else { \
Xrn = (isc_radix_node_t *) 0; \
} \
} \
} while (0)
#endif /* _RADIX_H */
/*
* Copyright (c) 1999-2000
*
* The Regents of the University of Michigan ("The Regents") and
* Merit Network, Inc. All rights reserved. Redistribution and use
* in source and binary forms, with or without modification, are
* permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above
* copyright notice, this list of conditions and the
* following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the
* following disclaimer in the documentation and/or other
* materials provided with the distribution.
*
* 3. All advertising materials mentioning features or use of
* this software must display the following acknowledgement:
*
* This product includes software developed by the University of
* Michigan, Merit Network, Inc., and their contributors.
*
* 4. Neither the name of the University, Merit Network, nor the
* names of their contributors may be used to endorse or
* promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL TH E REGENTS
* OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HO WEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/*
* This source was adapted from MRT's RCS Ids:
* Id: radix.c,v 1.10.2.1 1999/11/29 05:16:24 masaki Exp
* Id: prefix.c,v 1.37.2.9 2000/03/10 02:53:19 labovit Exp
*/
#include <isc/mem.h>
#include <isc/types.h>
#include <isc/util.h>
#include <isc/radix.h>
static isc_result_t
_new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family,
void *dest, int bitlen);
static void
_deref_prefix(isc_mem_t *mctx, isc_prefix_t *prefix);
static isc_result_t
_ref_prefix(isc_mem_t *mctx, isc_prefix_t **target, isc_prefix_t *prefix);
static int
_comp_with_mask(void *addr, void *dest, u_int mask);
static void
_clear_radix(isc_radix_tree_t *radix, void_fn_t func);
static isc_result_t
_new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family, void *dest,
int bitlen)
{
isc_prefix_t *prefix;
if (family != AF_INET6 && family != AF_INET)
return (ISC_R_NOTIMPLEMENTED);
prefix = isc_mem_get(mctx, sizeof(isc_prefix_t));
if (prefix == NULL)
return (ISC_R_NOMEMORY);
if (family == AF_INET6) {
prefix->bitlen = (bitlen >= 0) ? bitlen : 128;
memcpy(&prefix->add.sin6, dest, 16);
} else {
prefix->bitlen = (bitlen >= 0) ? bitlen : 32;
memcpy(&prefix->add.sin, dest, 4);
}
prefix->family = family;
isc_refcount_init(&prefix->refcount, 1);
*target = prefix;
return (ISC_R_SUCCESS);
}
static void
_deref_prefix(isc_mem_t *mctx, isc_prefix_t *prefix) {
size_t size;
int refs;
if (prefix == NULL)
return;
isc_refcount_decrement(&prefix->refcount, &refs);
if (refs <= 0) {
isc_refcount_destroy(&prefix->refcount);
if (prefix->family == AF_INET6)
size = sizeof(isc_prefix_t);
else
size = sizeof(isc_prefix_t);
isc_mem_put(mctx, prefix, size);
}
}
static isc_result_t
_ref_prefix(isc_mem_t *mctx, isc_prefix_t **target, isc_prefix_t *prefix) {
INSIST((prefix->family == AF_INET && prefix->bitlen <= 32) ||
(prefix->family == AF_INET6 && prefix->bitlen <= 128));
if (prefix != NULL) {
if (isc_refcount_current(&prefix->refcount) == 0) {
/* Make a copy in case of a static prefix. */
return (_new_prefix(mctx, target, prefix->family,
&prefix->add, prefix->bitlen));
}
isc_refcount_increment(&prefix->refcount, NULL);
}
*target = prefix;
return (ISC_R_SUCCESS);
}
static int
_comp_with_mask(void *addr, void *dest, u_int mask) {
if (memcmp(addr, dest, mask / 8) == 0) {
int n = mask / 8;
int m = ((~0) << (8 - (mask % 8)));
if ((mask % 8) == 0 ||
(((u_char *)addr)[n] & m) == (((u_char *)dest)[n] & m))
return (1);
}
return (0);
}
isc_result_t
isc_radix_create(isc_mem_t *mctx, isc_radix_tree_t **target, int maxbits) {
isc_radix_tree_t *radix;
radix = isc_mem_get(mctx, sizeof(isc_radix_tree_t));
if (radix == NULL)
return (ISC_R_NOMEMORY);
radix->mctx = mctx;
radix->maxbits = maxbits;
radix->head = NULL;
radix->num_active_node = 0;
radix->num_added_node = 0;
RUNTIME_CHECK(maxbits <= RADIX_MAXBITS); /* XXX */
radix->magic = RADIX_TREE_MAGIC;
*target = radix;
return (ISC_R_SUCCESS);
}
/*
* if func is supplied, it will be called as func(node->data)
* before deleting the node
*/
static void
_clear_radix(isc_radix_tree_t *radix, void_fn_t func) {
REQUIRE(radix);
if (radix->head) {
isc_radix_node_t *Xstack[RADIX_MAXBITS+1];
isc_radix_node_t **Xsp = Xstack;
isc_radix_node_t *Xrn = radix->head;
while (Xrn != NULL) {
isc_radix_node_t *l = Xrn->l;
isc_radix_node_t *r = Xrn->r;
if (Xrn->prefix) {
_deref_prefix(radix->mctx, Xrn->prefix);
if (Xrn->data && func)
func(Xrn->data);
} else {
INSIST(Xrn->data == NULL);
}
isc_mem_put(radix->mctx, Xrn, sizeof(*Xrn));
radix->num_active_node--;
if (l != NULL) {
if (r != NULL) {
*Xsp++ = r;
}
Xrn = l;
} else if (r != NULL) {
Xrn = r;
} else if (Xsp != Xstack) {
Xrn = *(--Xsp);
} else {
Xrn = NULL;
}
}
}
RUNTIME_CHECK(radix->num_active_node == 0);