40 static const char* acl_str =
"acl";
49 acl_parse_range_type(
char* ip,
char** mask)
52 if((p=strchr(ip,
'&'))!=0) {
57 if((p=strchr(ip,
'/'))!=0) {
62 if((p=strchr(ip,
'-'))!=0) {
77 acl_parse_range_subnet(
char* p,
void* addr,
int maxbits)
79 int subnet_bits = atoi(p);
80 uint8_t* addr_bytes = (uint8_t*)addr;
81 if (subnet_bits == 0 && strcmp(p,
"0")!=0) {
84 if (subnet_bits < 0 || subnet_bits > maxbits) {
88 while(subnet_bits >= 8) {
94 {0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff};
95 *addr_bytes = shifts[subnet_bits];
139 ods_log_error(
"[%s] unable to create acl: allocator_alloc() "
149 ods_log_error(
"[%s] unable to create acl: tsig %s not found",
157 acl->
port = atoi((
const char*) port);
163 acl->
range_type = acl_parse_range_type(address, &p);
166 ods_log_error(
"[%s] unable to create acl: allocator_strdup() "
171 if (acl->
family == AF_INET6) {
174 "(%s)", acl_str, acl->
address);
182 " mask (%s)", acl_str, p);
195 }
else if (acl->
family == AF_INET) {
198 "(%s)", acl_str, acl->
address);
206 " mask (%s)", acl_str, p);
231 acl_addr_matches_mask(uint32_t* a, uint32_t* b, uint32_t* mask,
size_t sz)
236 for (i=0; i<sz; ++i) {
237 if (((*a++)&*mask) != ((*b++)&*mask)) {
250 acl_addr_matches_range(uint32_t* minval, uint32_t* x, uint32_t* maxval,
254 uint8_t checkmin = 1;
255 uint8_t checkmax = 1;
259 for (i=0; i<sz; ++i) {
261 if (checkmin && minval[i] > x[i]) {
264 if (checkmax && maxval[i] < x[i]) {
268 if (checkmin && minval[i] != x[i]) {
271 if (checkmax && maxval[i]!=x[i]) {
274 if (!checkmin && !checkmax) {
287 acl_addr_matches(
acl_type* acl,
struct sockaddr_storage* addr)
296 if (acl->
family == AF_INET6) {
297 struct sockaddr_in6* addr6 = (
struct sockaddr_in6*) addr;
298 if (addr->ss_family != AF_INET6) {
301 if (acl->
port != 0 && acl->
port != ntohs(addr6->sin6_port)) {
307 if (!acl_addr_matches_mask((uint32_t*)&acl->
addr.
addr6,
308 (uint32_t*)&addr6->sin6_addr,
310 sizeof(
struct in6_addr))) {
315 if (!acl_addr_matches_range((uint32_t*)&acl->
addr.
addr6,
316 (uint32_t*)&addr6->sin6_addr,
318 sizeof(
struct in6_addr))) {
324 if (memcmp(&addr6->sin6_addr, &acl->
addr.
addr6,
325 sizeof(
struct in6_addr)) != 0) {
332 struct sockaddr_in* addr4 = (
struct sockaddr_in*)addr;
333 if (addr4->sin_family != AF_INET) {
336 if (acl->
port != 0 && acl->
port != ntohs(addr4->sin_port)) {
342 if (!acl_addr_matches_mask((uint32_t*)&acl->
addr.
addr,
343 (uint32_t*)&addr4->sin_addr,
345 sizeof(
struct in_addr))) {
350 if (!acl_addr_matches_range((uint32_t*)&acl->
addr.
addr,
351 (uint32_t*)&addr4->sin_addr,
353 sizeof(
struct in_addr))) {
359 if (memcmp(&addr4->sin_addr, &acl->
addr.
addr,
360 sizeof(
struct in_addr)) != 0) {
387 ods_log_debug(
"[%s] no match: tsig present but no config", acl_str);
409 ods_log_debug(
"[%s] no match: key names not the same", acl_str);
413 ods_log_debug(
"[%s] no match: algorithms not the same", acl_str);
426 addr2ip(
struct sockaddr_storage addr,
char* ip,
size_t len)
428 if (addr.ss_family == AF_INET6) {
429 if (!inet_ntop(AF_INET6, &((
struct sockaddr_in6 *)&addr)->sin6_addr,
434 if (!inet_ntop(AF_INET, &((
struct sockaddr_in *)&addr)->sin_addr,
451 if (acl_addr_matches(find, addr) && acl_tsig_matches(find, trr)) {
468 if (!acl || !allocator) {