38 static const char* acl_str =
"acl";
47 acl_parse_range_type(
char* ip,
char** mask)
50 if((p=strchr(ip,
'&'))!=0) {
55 if((p=strchr(ip,
'/'))!=0) {
60 if((p=strchr(ip,
'-'))!=0) {
75 acl_parse_range_subnet(
char* p,
void* addr,
int maxbits)
77 int subnet_bits = atoi(p);
78 uint8_t* addr_bytes = (uint8_t*)addr;
79 if (subnet_bits == 0 && strcmp(p,
"0")!=0) {
82 if (subnet_bits < 0 || subnet_bits > maxbits) {
86 while(subnet_bits >= 8) {
92 {0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff};
93 *addr_bytes = shifts[subnet_bits];
137 ods_log_error(
"[%s] unable to create acl: allocator_alloc() "
147 ods_log_error(
"[%s] unable to create acl: tsig %s not found",
155 acl->
port = atoi((
const char*) port);
161 acl->
range_type = acl_parse_range_type(address, &p);
164 ods_log_error(
"[%s] unable to create acl: allocator_strdup() "
169 if (acl->
family == AF_INET6) {
172 "(%s)", acl_str, acl->
address);
180 " mask (%s)", acl_str, p);
193 }
else if (acl->
family == AF_INET) {
196 "(%s)", acl_str, acl->
address);
204 " mask (%s)", acl_str, p);
229 acl_addr_matches_mask(uint32_t* a, uint32_t* b, uint32_t* mask,
size_t sz)
234 for (i=0; i<sz; ++i) {
235 if (((*a++)&*mask) != ((*b++)&*mask)) {
248 acl_addr_matches_range(uint32_t* minval, uint32_t* x, uint32_t* maxval,
252 uint8_t checkmin = 1;
253 uint8_t checkmax = 1;
257 for (i=0; i<sz; ++i) {
259 if (checkmin && minval[i] > x[i]) {
262 if (checkmax && maxval[i] < x[i]) {
266 if (checkmin && minval[i] != x[i]) {
269 if (checkmax && maxval[i]!=x[i]) {
272 if (!checkmin && !checkmax) {
285 acl_addr_matches(
acl_type* acl,
struct sockaddr_storage* addr)
294 if (acl->
family == AF_INET6) {
295 struct sockaddr_in6* addr6 = (
struct sockaddr_in6*) addr;
296 if (addr->ss_family != AF_INET6) {
299 if (acl->
port != 0 && acl->
port != ntohs(addr6->sin6_port)) {
305 if (!acl_addr_matches_mask((uint32_t*)&acl->
addr.
addr6,
306 (uint32_t*)&addr6->sin6_addr,
308 sizeof(
struct in6_addr))) {
313 if (!acl_addr_matches_range((uint32_t*)&acl->
addr.
addr6,
314 (uint32_t*)&addr6->sin6_addr,
316 sizeof(
struct in6_addr))) {
322 if (memcmp(&addr6->sin6_addr, &acl->
addr.
addr6,
323 sizeof(
struct in6_addr)) != 0) {
330 struct sockaddr_in* addr4 = (
struct sockaddr_in*)addr;
331 if (addr4->sin_family != AF_INET) {
334 if (acl->
port != 0 && acl->
port != ntohs(addr4->sin_port)) {
340 if (!acl_addr_matches_mask((uint32_t*)&acl->
addr.
addr,
341 (uint32_t*)&addr4->sin_addr,
343 sizeof(
struct in_addr))) {
348 if (!acl_addr_matches_range((uint32_t*)&acl->
addr.
addr,
349 (uint32_t*)&addr4->sin_addr,
351 sizeof(
struct in_addr))) {
357 if (memcmp(&addr4->sin_addr, &acl->
addr.
addr,
358 sizeof(
struct in_addr)) != 0) {
385 ods_log_debug(
"[%s] no match: tsig present but no config", acl_str);
407 ods_log_debug(
"[%s] no match: key names not the same", acl_str);
411 ods_log_debug(
"[%s] no match: algorithms not the same", acl_str);
424 addr2ip(
struct sockaddr_storage addr,
char* ip,
size_t len)
426 if (addr.ss_family == AF_INET6) {
427 if (!inet_ntop(AF_INET6, &((
struct sockaddr_in6 *)&addr)->sin6_addr,
432 if (!inet_ntop(AF_INET, &((
struct sockaddr_in *)&addr)->sin_addr,
449 if (acl_addr_matches(find, addr) && acl_tsig_matches(find, trr)) {
466 if (!acl || !allocator) {