GCOV - Varnish Cache


/*-
 * Copyright (c) 2006 Verdens Gang AS
 * Copyright (c) 2006-2010 Varnish Software AS
 * All rights reserved.
 *
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
 *
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/socket.h>

#include <netinet/in.h>

#include <netdb.h>
#include <stdlib.h>
#include <string.h>

#include "vcc_compile.h"
#include <vtcp.h>
#include <vtree.h>
#include <vsa.h>

#define ACL_MAXADDR     (sizeof(struct in6_addr) + 1)

VRBT_HEAD(acl_tree, acl_e);

struct acl {
        unsigned                magic;
#define VCC_ACL_MAGIC           0xb9fb3cd0

        int                     flag_log;
        int                     flag_fold;
        int                     flag_pedantic;
        int                     flag_table;

        struct acl_tree         acl_tree;
};

struct acl_e {
        unsigned                magic;
#define VCC_ACL_E_MAGIC 0xcac81e23
        VRBT_ENTRY(acl_e)       branch;
        unsigned char           data[ACL_MAXADDR];
        unsigned                mask;
        unsigned                not;
        unsigned                para;
        unsigned                overlapped;
        char                    *addr;
        const char              *fixed;
        struct token            *t_addr;
        struct token            *t_mask;
};

enum acl_cmp_e {
        ACL_EQ = 0,
        ACL_LT = -1,            // a < b
        ACL_GT = 1,             // b > a
        ACL_CONTAINED = -2,     // b contains a
        ACL_CONTAINS = 2,       // a contains b
        ACL_LEFT = -3,          // a + 1 == b
        ACL_RIGHT = 3           // a == b + 1
};

static void vcc_acl_insert_entry(struct vcc *, struct acl_e **);

/*
 * Compare two acl rules for relation
 */

#define CMP(n, a, b)                                                    \
        do {                                                            \
                if ((a) < (b))                                          \
                        return (enum acl_cmp_e)(-n);                    \
                else if ((b) < (a))                                     \
                        return (n);                                     \
        } while (0)

#define CMPA(a, b)                                                      \
        do {                                                            \
                if (((a) | 1) == (b))                                   \
                        return (ACL_LEFT);                              \
                else if (((b) | 1) == (a))                              \
                        return (ACL_RIGHT);                             \
        } while (0)

static void
vcl_acl_free(struct acl_e **aep)
{
        struct acl_e *a;

        TAKE_OBJ_NOTNULL(a, aep, VCC_ACL_E_MAGIC);
        free(a->addr);
        FREE_OBJ(a);
}

static enum acl_cmp_e
vcl_acl_cmp(const struct acl_e *ae1, const struct acl_e *ae2)
{
        const unsigned char *p1, *p2;
        unsigned m;
        unsigned char a1, a2;

        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);

        p1 = ae1->data;
        p2 = ae2->data;
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
        for (; m >= 8; m -= 8) {
                if (m == 8 && ae1->mask == ae2->mask)
                        CMPA(*p1, *p2);
                CMP(ACL_GT, *p1, *p2);
                p1++;
                p2++;
        }
        if (m) {
                assert (m < 8);
                a1 = *p1 >> (8 - m);
                a2 = *p2 >> (8 - m);
                if (ae1->mask == ae2->mask)
                        CMPA(a1, a2);
                CMP(ACL_GT, a1, a2);
        } else if (ae1->mask == ae2->mask) {
                CMPA(*p1, *p2);
        }
        /* Long mask is less than short mask */
        CMP(ACL_CONTAINS, ae2->mask, ae1->mask);

        return (ACL_EQ);
}

static int
vcl_acl_disjoint(const struct acl_e *ae1, const struct acl_e *ae2)
{
        const unsigned char *p1, *p2;
        unsigned m;

        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);

        p1 = ae1->data;
        p2 = ae2->data;
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
        for (; m >= 8; m -= 8) {
                CMP(ACL_GT, *p1, *p2);
                p1++;
                p2++;
        }
        if (m) {
                m = 0xff00 >> m;
                m &= 0xff;
                CMP(ACL_GT, *p1 & m, *p2 & m);
        }
        return (0);
}

VRBT_GENERATE_INSERT_COLOR(acl_tree, acl_e, branch, static)
VRBT_GENERATE_INSERT_FINISH(acl_tree, acl_e, branch, static)
VRBT_GENERATE_INSERT(acl_tree, acl_e, branch, vcl_acl_cmp, static)
VRBT_GENERATE_REMOVE_COLOR(acl_tree, acl_e, branch, static)
VRBT_GENERATE_REMOVE(acl_tree, acl_e, branch, static)
VRBT_GENERATE_MINMAX(acl_tree, acl_e, branch, static)
VRBT_GENERATE_NEXT(acl_tree, acl_e, branch, static)
VRBT_GENERATE_PREV(acl_tree, acl_e, branch, static)

static char *
vcc_acl_chk(struct vcc *tl, const struct acl_e *ae, const int l,
    unsigned char *p, int fam)
{
        const unsigned char *u;
        char h[VTCP_ADDRBUFSIZE];
        char t[VTCP_ADDRBUFSIZE + 10];
        char s[vsa_suckaddr_len];
        char *r = NULL;
        const struct suckaddr *sa;
        unsigned m;
        int ll, ret = 0;

        u = p;
        ll = l;
        m = ae->mask;

        p += m / 8;
        ll -= m / 8;
        assert (ll >= 0);
        m %= 8;

        if (m && ((unsigned)*p << m & 0xff) != 0) {
                ret = 1;
                m = 0xff00 >> m;
                *p &= m;
        }
        if (m) {
                p++;
                ll--;
        }

        for ( ; ll > 0; p++, ll--) {
                if (*p == 0)
                        continue;
                ret = 1;
                *p = 0;
        }
        if (ret == 0)
                return (NULL);

        sa = VSA_BuildFAP(s, fam, u, l, NULL, 0);
        AN(sa);
        VTCP_name(sa, h, sizeof h, NULL, 0);
        bprintf(t, "%s/%d", h, ae->mask);
        if (tl->acl->flag_pedantic != 0) {
                VSB_cat(tl->sb, "Non-zero bits in masked part, ");
                VSB_printf(tl->sb, "(maybe use %s ?)\n", t);
                vcc_ErrWhere(tl, ae->t_addr);
        }
        REPLACE(r, t);
        return (r);
}

static void
vcl_acl_fold(struct vcc *tl, struct acl_e **l, struct acl_e **r)
{
        enum acl_cmp_e cmp;

        AN(l);
        AN(r);
        CHECK_OBJ_NOTNULL(*l, VCC_ACL_E_MAGIC);
        CHECK_OBJ_NOTNULL(*r, VCC_ACL_E_MAGIC);

        if ((*l)->not || (*r)->not)
                return;

        cmp = vcl_acl_cmp(*l, *r);

        assert(cmp < 0);
        if (cmp == ACL_LT)
                return;

        do {
                switch (cmp) {
                case ACL_CONTAINED:
                        VSB_cat(tl->sb, "ACL entry:\n");
                        vcc_ErrWhere(tl, (*r)->t_addr);
                        VSB_cat(tl->sb, "supersedes / removes:\n");
                        vcc_ErrWhere(tl, (*l)->t_addr);
                        vcc_Warn(tl);
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
                        FREE_OBJ(*l);
                        *l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, *r);
                        break;
                case ACL_LEFT:
                        (*l)->mask--;
                        (*l)->fixed = "folded";
                        VSB_cat(tl->sb, "ACL entry:\n");
                        vcc_ErrWhere(tl, (*l)->t_addr);
                        VSB_cat(tl->sb, "left of:\n");
                        vcc_ErrWhere(tl, (*r)->t_addr);
                        VSB_printf(tl->sb, "removing the latter and expanding "
                            "mask of the former by one to /%u\n",
                            (*l)->mask - 8);
                        vcc_Warn(tl);
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *r);
                        FREE_OBJ(*r);
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
                        vcc_acl_insert_entry(tl, l);
                        return;
                default:
                        INCOMPL();
                }
                if (*l == NULL || *r == NULL)
                        break;
                cmp = vcl_acl_cmp(*l, *r);
        } while (cmp != ACL_LT);
}

static void
vcc_acl_insert_entry(struct vcc *tl, struct acl_e **aenp)
{
        struct acl_e *ae2, *l, *r;

        CHECK_OBJ_NOTNULL(*aenp, VCC_ACL_E_MAGIC);
        ae2 = VRBT_INSERT(acl_tree, &tl->acl->acl_tree, *aenp);
        if (ae2 != NULL) {
                if (ae2->not != (*aenp)->not) {
                        VSB_cat(tl->sb, "Conflicting ACL entries:\n");
                        vcc_ErrWhere(tl, ae2->t_addr);
                        VSB_cat(tl->sb, "vs:\n");
                        vcc_ErrWhere(tl, (*aenp)->t_addr);
                }
                return;
        }

        r = *aenp;
        *aenp = NULL;

        if (tl->acl->flag_fold == 0)
                return;

        l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, r);
        if (l != NULL) {
                vcl_acl_fold(tl, &l, &r);
        }
        if (r == NULL)
                return;
        l = r;
        r = VRBT_NEXT(acl_tree, &tl->acl->acl_tree, l);
        if (r == NULL)
                return;
        vcl_acl_fold(tl, &l, &r);
}

static void
vcc_acl_add_entry(struct vcc *tl, const struct acl_e *ae, int l,
    unsigned char *u, int fam)
{
        struct acl_e *aen;

        if (fam == PF_INET && ae->mask > 32) {
                VSB_printf(tl->sb,
                    "Too wide mask (/%u) for IPv4 address\n", ae->mask);
                if (ae->t_mask != NULL)
                        vcc_ErrWhere(tl, ae->t_mask);
                else
                        vcc_ErrWhere(tl, ae->t_addr);
                return;
        }
        if (fam == PF_INET6 && ae->mask > 128) {
                VSB_printf(tl->sb,
                    "Too wide mask (/%u) for IPv6 address\n", ae->mask);
                vcc_ErrWhere(tl, ae->t_mask);
                return;
        }

        /* Make a copy from the template */
        ALLOC_OBJ(aen, VCC_ACL_E_MAGIC);
        AN(aen);
        *aen = *ae;
        aen->addr = strdup(ae->addr);
        AN(aen->addr);

        aen->fixed = vcc_acl_chk(tl, ae, l, u, fam);

        /* We treat family as part of address, it saves code */
        assert(fam <= 0xff);
        aen->data[0] = fam & 0xff;
        aen->mask += 8;

        assert(l + 1UL <= sizeof aen->data);
        memcpy(aen->data + 1L, u, l);

        vcc_acl_insert_entry(tl, &aen);
        if (aen != NULL)
                vcl_acl_free(&aen);
}

static void
vcc_acl_try_getaddrinfo(struct vcc *tl, struct acl_e *ae)
{
        struct addrinfo *res0, *res, hint;
        struct sockaddr_in *sin4;
        struct sockaddr_in6 *sin6;
        unsigned char *u, i4, i6;
        int error;

        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
        memset(&hint, 0, sizeof hint);
        hint.ai_family = PF_UNSPEC;
        hint.ai_socktype = SOCK_STREAM;
        error = getaddrinfo(ae->addr, "0", &hint, &res0);
        if (error) {
                if (ae->para) {
                        VSB_printf(tl->sb,
                            "Warning: %s ignored\n  -- %s\n",
                            ae->addr, gai_strerror(error));
                        Fh(tl, 1, "/* Ignored ACL entry: %s%s",
                            ae->para ? "\"(\" " : "", ae->not ? "\"!\" " : "");
                        EncToken(tl->fh, ae->t_addr);
                        if (ae->t_mask)
                                Fh(tl, 0, "/%u", ae->mask);
                        Fh(tl, 0, "%s\n", ae->para ? " \")\"" : "");
                        Fh(tl, 1, " * getaddrinfo:  %s */\n",
                             gai_strerror(error));
                } else {
                        VSB_printf(tl->sb,
                            "DNS lookup(%s): %s\n",
                            ae->addr, gai_strerror(error));
                        vcc_ErrWhere(tl, ae->t_addr);
                }
                return;
        }

        i4 = i6 = 0;
        for (res = res0; res != NULL; res = res->ai_next) {
                switch (res->ai_family) {
                case PF_INET:
                        i4++;
                        break;
                case PF_INET6:
                        i6++;
                        break;
                default:
                        VSB_printf(tl->sb,
                            "Ignoring unknown protocol family (%d) for %.*s\n",
                                res->ai_family, PF(ae->t_addr));
                        continue;
                }
        }

        if (ae->t_mask != NULL && i4 > 0 && i6 > 0) {
                VSB_printf(tl->sb,
                    "Mask (/%u) specified, but string resolves to"
                    " both IPv4 and IPv6 addresses.\n", ae->mask);
                vcc_ErrWhere(tl, ae->t_mask);
                freeaddrinfo(res0);
                return;
        }

        for (res = res0; res != NULL; res = res->ai_next) {
                switch (res->ai_family) {
                case PF_INET:
                        assert(PF_INET < 256);
                        sin4 = (void*)res->ai_addr;
                        assert(sizeof(sin4->sin_addr) == 4);
                        u = (void*)&sin4->sin_addr;
                        if (ae->t_mask == NULL)
                                ae->mask = 32;
                        vcc_acl_add_entry(tl, ae, 4, u, res->ai_family);
                        break;
                case PF_INET6:
                        assert(PF_INET6 < 256);
                        sin6 = (void*)res->ai_addr;
                        assert(sizeof(sin6->sin6_addr) == 16);
                        u = (void*)&sin6->sin6_addr;
                        if (ae->t_mask == NULL)
                                ae->mask = 128;
                        vcc_acl_add_entry(tl, ae, 16, u, res->ai_family);
                        break;
                default:
                        continue;
                }
                if (tl->err)
                        freeaddrinfo(res0);
                ERRCHK(tl);
        }
        freeaddrinfo(res0);

}

/*--------------------------------------------------------------------
 * Ancient stupidity on the part of X/Open and other standards orgs
 * dictate that "192.168" be translated to 192.0.0.168.  Ever since
 * CIDR happened, "192.168/16" notation has been used, but apparently
 * no API supports parsing this, so roll our own.
 */

static int
vcc_acl_try_netnotation(struct vcc *tl, struct acl_e *ae)
{
        unsigned char b[4];
        int i, j, k;
        unsigned u;
        const char *p;

        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
        memset(b, 0, sizeof b);
        p = ae->addr;
        for (i = 0; i < 4; i++) {
                j = sscanf(p, "%u%n", &u, &k);
                if (j != 1)
                        return (0);
                if (u & ~0xff)
                        return (0);
                b[i] = (unsigned char)u;
                if (p[k] == '\0')
                        break;
                if (p[k] != '.')
                        return (0);
                p += k + 1;
        }
        if (ae->t_mask == NULL)
                ae->mask = 8 + 8 * i;
        vcc_acl_add_entry(tl, ae, 4, b, AF_INET);
        return (1);
}

static void
vcc_acl_entry(struct vcc *tl)
{
        struct acl_e ae[1];
        char *sl, *e;

        INIT_OBJ(ae, VCC_ACL_E_MAGIC);

        if (tl->t->tok == '!') {
                ae->not = 1;
                vcc_NextToken(tl);
        }

        if (tl->t->tok == '(') {
                ae->para = 1;
                vcc_NextToken(tl);
        }

        if (!ae->not && tl->t->tok == '!') {
                ae->not = 1;
                vcc_NextToken(tl);
        }

        ExpectErr(tl, CSTR);
        ae->t_addr = tl->t;
        ae->addr = ae->t_addr->dec;
        vcc_NextToken(tl);

        if (strchr(ae->t_addr->dec, '/') != NULL) {
                sl = strchr(ae->addr, '/');
                AN(sl);
                *sl++ = '\0';
                e = NULL;
                ae->mask = strtoul(sl, &e, 10);
                if (*e != '\0') {
                        VSB_cat(tl->sb, ".../mask is not numeric.\n");
                        vcc_ErrWhere(tl, ae->t_addr);
                        return;
                }
                ae->t_mask = ae->t_addr;
                if (tl->t->tok == '/') {
                        VSB_cat(tl->sb, "/mask only allowed once.\n");
                        vcc_ErrWhere(tl, tl->t);
                        return;
                }
        } else if (tl->t->tok == '/') {
                vcc_NextToken(tl);
                ae->t_mask = tl->t;
                ExpectErr(tl, CNUM);
                ae->mask = vcc_UintVal(tl);
        }

        if (ae->para)
                SkipToken(tl, ')');

        if (!vcc_acl_try_netnotation(tl, ae)) {
                ERRCHK(tl);
                vcc_acl_try_getaddrinfo(tl, ae);
        }
        ERRCHK(tl);
}

/*********************************************************************
 * Emit the tokens making up an entry as C-strings
 */

static void
vcc_acl_emit_tokens(const struct vcc *tl, const struct acl_e *ae)
{
        struct token *t;
        const char *sep = "";

        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
        t = ae->t_addr;
        do {
                if (t->tok == CSTR) {
                        Fh(tl, 0, "%s\"\\\"\" ", sep);
                        EncToken(tl->fh, t);
                        Fh(tl, 0, " \"\\\"\"");
                } else if (t == ae->t_mask) {
                        Fh(tl, 0, " \"%u\"", ae->mask - 8);
                } else {
                        Fh(tl, 0, "%s\"%.*s\"", sep, PF(t));
                }
                if (t == ae->t_mask)
                        break;
                t = vcc_PeekTokenFrom(tl, t);
                AN(t);
                sep = " ";
        } while (ae->t_mask != NULL);
        if (ae->fixed)
                Fh(tl, 0, "\" fixed: %s\"", ae->fixed);
}

/*********************************************************************
 * Emit ACL on table format
 */

static unsigned
vcc_acl_emit_tables(const struct vcc *tl, unsigned n, const char *name)
{
        struct acl_e *ae;
        unsigned rv = sizeof(ae->data) + 3;
        unsigned nn = 0;
        size_t sz;

        Fh(tl, 0, "\nstatic unsigned char acl_tbl_%s[%u*%u] = {\n",
            name, n, rv);
        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
                if (ae->overlapped)
                        continue;
                Fh(tl, 0, "\t0x%02x,", ae->not ? 0 : 1);
                Fh(tl, 0, "0x%02x,", (ae->mask >> 3) - 1);
                Fh(tl, 0, "0x%02x,", (0xff00 >> (ae->mask & 7)) & 0xff);
                for (sz = 0; sz < sizeof(ae->data); sz++)
                        Fh(tl, 0, "0x%02x,", ae->data[sz]);
                for (; sz < rv - 3; sz++)
                        Fh(tl, 0, "0,");
                Fh(tl, 0, "\n");
                nn++;
        }
        assert(n == nn);
        Fh(tl, 0, "};\n");
        if (tl->acl->flag_log) {
                Fh(tl, 0, "\nstatic const char *acl_str_%s[%d] = {\n",
                    name, n);
                VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
                        if (ae->overlapped)
                                continue;
                        Fh(tl, 0, "\t");
                        Fh(tl, 0, "\"%sMATCH %s \" ",
                            ae->not ? "NEG_" : "", name);
                        vcc_acl_emit_tokens(tl, ae);
                        Fh(tl, 0, ",\n");
                }
                Fh(tl, 0, "};\n");
        }
        return (rv);
}

/*********************************************************************
 * Emit a function to match the ACL we have collected
 */

static void
vcc_acl_emit(struct vcc *tl, const struct symbol *sym)
{
        struct acl_e *ae, *ae2;
        int depth, l, m, i;
        unsigned at[ACL_MAXADDR];
        struct inifin *ifp = NULL;
        struct vsb *func;
        unsigned n, no, nw = 0;

        func = VSB_new_auto();
        AN(func);
        VSB_cat(func, "match_acl_");
        VCC_PrintCName(func, sym->name, NULL);
        AZ(VSB_finish(func));

        depth = -1;
        at[0] = 256;
        ae2 = NULL;
        n = no = 0;
        VRBT_FOREACH_REVERSE(ae, acl_tree, &tl->acl->acl_tree) {
                n++;
                if (ae2 == NULL) {
                        ae2 = ae;
                } else if (vcl_acl_disjoint(ae, ae2)) {
                        ae2 = ae;
                } else {
                        no++;
                        ae->overlapped = 1;
                }
        }

        Fh(tl, 0, "/* acl_n_%s n %u no %u */\n", sym->name, n, no);
        if (n - no < (1<<1))
                no = n;
        else if (!tl->acl->flag_table)
                no = n;

        if (no < n)
                nw = vcc_acl_emit_tables(tl, n - no, sym->name);


        Fh(tl, 0, "\nstatic int v_matchproto_(acl_match_f)\n");
        Fh(tl, 0, "%s(VRT_CTX, const VCL_IP p)\n", VSB_data(func));
        Fh(tl, 0, "{\n");
        Fh(tl, 0, "\tconst unsigned char *a;\n");
        Fh(tl, 0, "\tint fam;\n");
        Fh(tl, 0, "\n");
        Fh(tl, 0, "\tfam = VRT_VSA_GetPtr(ctx, p, &a);\n");
        Fh(tl, 0, "\tif (fam < 0) {\n");
        Fh(tl, 0, "\t\tVRT_fail(ctx,");
        Fh(tl, 0, " \"ACL %s: no protocol family\");\n", sym->name);
        Fh(tl, 0, "\t\treturn(0);\n");
        Fh(tl, 0, "\t}\n\n");
        if (!tl->err_unref) {
                ifp = New_IniFin(tl);
                VSB_printf(ifp->ini,
                        "\t(void)%s;\n", VSB_data(func));
        }

        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {

                if (no < n && !ae->overlapped)
                        continue;

                /* Find how much common prefix we have */
                for (l = 0; l <= depth && l * 8 < (int)ae->mask - 7; l++) {
                        assert(l >= 0);
                        if (ae->data[l] != at[l])
                                break;
                }

                /* Back down, if necessary */
                while (l <= depth) {
                        Fh(tl, 0, "\t%*s}\n", -depth, "");
                        depth--;
                }

                m = (int)ae->mask;
                assert(m >= l*8);
                m -= l * 8;

                /* Do whole byte compares */
                for (i = l; m >= 8; m -= 8, i++) {
                        if (i == 0)
                                Fh(tl, 0, "\t%*s%sif (fam == %d) {\n",
                                    -i, "", "", ae->data[i]);
                        else
                                Fh(tl, 0, "\t%*s%sif (a[%d] == %d) {\n",
                                    -i, "", "", i - 1, ae->data[i]);
                        at[i] = ae->data[i];
                        depth = i;
                }

                if (m > 0) {
                        // XXX can remove masking due to fixup
                        /* Do fractional byte compares */
                        Fh(tl, 0, "\t%*s%sif ((a[%d] & 0x%x) == %d) {\n",
                            -i, "", "", i - 1, (0xff00 >> m) & 0xff,
                            ae->data[i] & ((0xff00 >> m) & 0xff));
                        at[i] = 256;
                        depth = i;
                }

                i = ((int)ae->mask + 7) / 8;

                if (tl->acl->flag_log) {
                        Fh(tl, 0, "\t%*sVPI_acl_log(ctx, \"%sMATCH %s \" ",
                            -i, "", ae->not ? "NEG_" : "", sym->name);
                        vcc_acl_emit_tokens(tl, ae);
                        Fh(tl, 0, ");\n");
                }

                Fh(tl, 0, "\t%*sreturn (%d);\n", -i, "", ae->not ? 0 : 1);
        }

        /* Unwind */
        for (; 0 <= depth; depth--)
                Fh(tl, 0, "\t%*.*s}\n", depth, depth, "");

        if (no < n) {
                Fh(tl, 0, "\treturn(\n\t    VPI_acl_table(ctx,\n");
                Fh(tl, 0, "\t\tp,\n");
                Fh(tl, 0, "\t\t%u, %u,\n", n - no, nw);
                Fh(tl, 0, "\t\tacl_tbl_%s,\n", sym->name);
                if (tl->acl->flag_log)
                        Fh(tl, 0, "\t\tacl_str_%s,\n", sym->name);
                else
                        Fh(tl, 0, "\t\tNULL,\n");
                Fh(tl, 0, "\t\t\"NO MATCH %s\"\n\t    )\n\t);\n", sym->name);
        } else {
                /* Deny by default */
                if (tl->acl->flag_log)
                        Fh(tl, 0, "\tVPI_acl_log(ctx, \"NO_MATCH %s\");\n",
                            sym->name);
                Fh(tl, 0, "\treturn(0);\n");
        }
        Fh(tl, 0, "}\n");

        /* Emit the struct that will be referenced */
        Fh(tl, 0, "\nstatic const struct vrt_acl %s[] = {{\n", sym->rname);
        Fh(tl, 0, "\t.magic = VRT_ACL_MAGIC,\n");
        Fh(tl, 0, "\t.match = &%s,\n", VSB_data(func));
        Fh(tl, 0, "\t.name = \"%s\",\n", sym->name);
        Fh(tl, 0, "}};\n\n");
        if (!tl->err_unref) {
                AN(ifp);
                VSB_printf(ifp->ini, "\t(void)%s;", sym->rname);
        }
        VSB_destroy(&func);
}

void
vcc_ParseAcl(struct vcc *tl)
{
        struct symbol *sym;
        int sign;
        struct acl acl[1];

        INIT_OBJ(acl, VCC_ACL_MAGIC);
        tl->acl = acl;
        acl->flag_pedantic = 1;
        vcc_NextToken(tl);
        VRBT_INIT(&acl->acl_tree);

        vcc_ExpectVid(tl, "ACL");
        ERRCHK(tl);
        sym = VCC_HandleSymbol(tl, ACL);
        ERRCHK(tl);
        AN(sym);

        while (1) {
                sign = vcc_IsFlag(tl);
                if (tl->err) {
                        VSB_cat(tl->sb,
                            "Valid ACL flags are `log` and `table`:\n");
                        return;
                }
                if (sign < 0)
                        break;
                if (vcc_IdIs(tl->t, "log")) {
                        acl->flag_log = sign;
                        vcc_NextToken(tl);
                } else if (vcc_IdIs(tl->t, "fold")) {
                        acl->flag_fold = sign;
                        vcc_NextToken(tl);
                } else if (vcc_IdIs(tl->t, "pedantic")) {
                        acl->flag_pedantic = sign;
                        vcc_NextToken(tl);
                } else if (vcc_IdIs(tl->t, "table")) {
                        acl->flag_table = sign;
                        vcc_NextToken(tl);
                } else {
                        VSB_cat(tl->sb, "Unknown ACL flag:\n");
                        vcc_ErrWhere(tl, tl->t);
                        return;
                }
        }

        SkipToken(tl, '{');

        while (tl->t->tok != '}') {
                vcc_acl_entry(tl);
                ERRCHK(tl);
                SkipToken(tl, ';');
        }
        SkipToken(tl, '}');

        vcc_acl_emit(tl, sym);
}

		varnish-cache/lib/libvcc/vcc_acl.c
0		/*-
1		* Copyright (c) 2006 Verdens Gang AS
2		* Copyright (c) 2006-2010 Varnish Software AS
3		* All rights reserved.
4		*
5		* Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6		*
7		* SPDX-License-Identifier: BSD-2-Clause
8		*
9		* Redistribution and use in source and binary forms, with or without
10		* modification, are permitted provided that the following conditions
11		* are met:
12		* 1. Redistributions of source code must retain the above copyright
13		* notice, this list of conditions and the following disclaimer.
14		* 2. Redistributions in binary form must reproduce the above copyright
15		* notice, this list of conditions and the following disclaimer in the
16		* documentation and/or other materials provided with the distribution.
17		*
18		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19		* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21		* ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
22		* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23		* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24		* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26		* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27		* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28		* SUCH DAMAGE.
29		*/
30
31		#include "config.h"
32
33		#include <sys/socket.h>
34
35		#include <netinet/in.h>
36
37		#include <netdb.h>
38		#include <stdlib.h>
39		#include <string.h>
40
41		#include "vcc_compile.h"
42		#include <vtcp.h>
43		#include <vtree.h>
44		#include <vsa.h>
45
46		#define ACL_MAXADDR (sizeof(struct in6_addr) + 1)
47
48		VRBT_HEAD(acl_tree, acl_e);
49
50		struct acl {
51		unsigned magic;
52		#define VCC_ACL_MAGIC 0xb9fb3cd0
53
54		int flag_log;
55		int flag_fold;
56		int flag_pedantic;
57		int flag_table;
58
59		struct acl_tree acl_tree;
60		};
61
62		struct acl_e {
63		unsigned magic;
64		#define VCC_ACL_E_MAGIC 0xcac81e23
65		VRBT_ENTRY(acl_e) branch;
66		unsigned char data[ACL_MAXADDR];
67		unsigned mask;
68		unsigned not;
69		unsigned para;
70		unsigned overlapped;
71		char *addr;
72		const char *fixed;
73		struct token *t_addr;
74		struct token *t_mask;
75		};
76
77		enum acl_cmp_e {
78		ACL_EQ = 0,
79		ACL_LT = -1, // a < b
80		ACL_GT = 1, // b > a
81		ACL_CONTAINED = -2, // b contains a
82		ACL_CONTAINS = 2, // a contains b
83		ACL_LEFT = -3, // a + 1 == b
84		ACL_RIGHT = 3 // a == b + 1
85		};
86
87		static void vcc_acl_insert_entry(struct vcc , struct acl_e *);
88
89		/*
90		* Compare two acl rules for relation
91		*/
92
93		#define CMP(n, a, b) \
94		do { \
95		if ((a) < (b)) \
96		return (enum acl_cmp_e)(-n); \
97		else if ((b) < (a)) \
98		return (n); \
99		} while (0)
100
101		#define CMPA(a, b) \
102		do { \
103		if (((a) \| 1) == (b)) \
104		return (ACL_LEFT); \
105		else if (((b) \| 1) == (a)) \
106		return (ACL_RIGHT); \
107		} while (0)
108
109		static void
110	150	vcl_acl_free(struct acl_e **aep)
111		{
112		struct acl_e *a;
113
114	150	TAKE_OBJ_NOTNULL(a, aep, VCC_ACL_E_MAGIC);
115	150	free(a->addr);
116	150	FREE_OBJ(a);
117	150	}
118
119		static enum acl_cmp_e
120	12325	vcl_acl_cmp(const struct acl_e ae1, const struct acl_e ae2)
121		{
122		const unsigned char p1, p2;
123		unsigned m;
124		unsigned char a1, a2;
125
126	12325	CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
127	12325	CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
128
129	12325	p1 = ae1->data;
130	12325	p2 = ae2->data;
131	12325	m = vmin_t(unsigned, ae1->mask, ae2->mask);
132	64275	for (; m >= 8; m -= 8) {
133	58725	if (m == 8 && ae1->mask == ae2->mask)
134	975	CMPA(p1, p2);
135	110450	CMP(ACL_GT, p1, p2);
136	51950	p1++;
137	51950	p2++;
138	51950	}
139	5550	if (m) {
140	5300	assert (m < 8);
141	5300	a1 = *p1 >> (8 - m);
142	5300	a2 = *p2 >> (8 - m);
143	5300	if (ae1->mask == ae2->mask)
144	1700	CMPA(a1, a2);
145	7100	CMP(ACL_GT, a1, a2);
146	2450	} else if (ae1->mask == ae2->mask) {
147	250	CMPA(p1, p2);
148	125	}
149		/* Long mask is less than short mask */
150	2600	CMP(ACL_CONTAINS, ae2->mask, ae1->mask);
151
152	150	return (ACL_EQ);
153	12325	}
154
155		static int
156	2875	vcl_acl_disjoint(const struct acl_e ae1, const struct acl_e ae2)
157		{
158		const unsigned char p1, p2;
159		unsigned m;
160
161	2875	CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
162	2875	CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
163
164	2875	p1 = ae1->data;
165	2875	p2 = ae2->data;
166	2875	m = vmin_t(unsigned, ae1->mask, ae2->mask);
167	22050	for (; m >= 8; m -= 8) {
168	39050	CMP(ACL_GT, p1, p2);
169	19175	p1++;
170	19175	p2++;
171	19175	}
172	2175	if (m) {
173	2000	m = 0xff00 >> m;
174	2000	m &= 0xff;
175	3775	CMP(ACL_GT, p1 & m, p2 & m);
176	1775	}
177	1950	return (0);
178	2875	}
179
180	8775	VRBT_GENERATE_INSERT_COLOR(acl_tree, acl_e, branch, static)
181	4225	VRBT_GENERATE_INSERT_FINISH(acl_tree, acl_e, branch, static)
182	15300	VRBT_GENERATE_INSERT(acl_tree, acl_e, branch, vcl_acl_cmp, static)
183	725	VRBT_GENERATE_REMOVE_COLOR(acl_tree, acl_e, branch, static)
184	1225	VRBT_GENERATE_REMOVE(acl_tree, acl_e, branch, static)
185	4150	VRBT_GENERATE_MINMAX(acl_tree, acl_e, branch, static)
186	11050	VRBT_GENERATE_NEXT(acl_tree, acl_e, branch, static)
187	6875	VRBT_GENERATE_PREV(acl_tree, acl_e, branch, static)
188
189		static char *
190	4150	vcc_acl_chk(struct vcc tl, const struct acl_e ae, const int l,
191		unsigned char *p, int fam)
192		{
193		const unsigned char *u;
194		char h[VTCP_ADDRBUFSIZE];
195		char t[VTCP_ADDRBUFSIZE + 10];
196	4150	char s[vsa_suckaddr_len];
197	4150	char *r = NULL;
198		const struct suckaddr *sa;
199		unsigned m;
200	4150	int ll, ret = 0;
201
202	4150	u = p;
203	4150	ll = l;
204	4150	m = ae->mask;
205
206	4150	p += m / 8;
207	4150	ll -= m / 8;
208	4150	assert (ll >= 0);
209	4150	m %= 8;
210
211	4150	if (m && ((unsigned)*p << m & 0xff) != 0) {
212	100	ret = 1;
213	100	m = 0xff00 >> m;
214	100	*p &= m;
215	100	}
216	4150	if (m) {
217	2375	p++;
218	2375	ll--;
219	2375	}
220
221	7850	for ( ; ll > 0; p++, ll--) {
222	3700	if (*p == 0)
223	3575	continue;
224	125	ret = 1;
225	125	*p = 0;
226	125	}
227	4150	if (ret == 0)
228	3925	return (NULL);
229
230	225	sa = VSA_BuildFAP(s, fam, u, l, NULL, 0);
231	225	AN(sa);
232	225	VTCP_name(sa, h, sizeof h, NULL, 0);
233	225	bprintf(t, "%s/%d", h, ae->mask);
234	225	if (tl->acl->flag_pedantic != 0) {
235	50	VSB_cat(tl->sb, "Non-zero bits in masked part, ");
236	50	VSB_printf(tl->sb, "(maybe use %s ?)\n", t);
237	50	vcc_ErrWhere(tl, ae->t_addr);
238	50	}
239	225	REPLACE(r, t);
240	225	return (r);
241	4150	}
242
243		static void
244	1100	vcl_acl_fold(struct vcc tl, struct acl_e l, struct acl_e *r)
245		{
246		enum acl_cmp_e cmp;
247
248	1100	AN(l);
249	1100	AN(r);
250	1100	CHECK_OBJ_NOTNULL(*l, VCC_ACL_E_MAGIC);
251	1100	CHECK_OBJ_NOTNULL(*r, VCC_ACL_E_MAGIC);
252
253	1100	if ((l)->not \|\| (r)->not)
254	0	return;
255
256	1100	cmp = vcl_acl_cmp(l, r);
257
258	1100	assert(cmp < 0);
259	1100	if (cmp == ACL_LT)
260	725	return;
261
262	375	do {
263	400	switch (cmp) {
264		case ACL_CONTAINED:
265	175	VSB_cat(tl->sb, "ACL entry:\n");
266	175	vcc_ErrWhere(tl, (*r)->t_addr);
267	175	VSB_cat(tl->sb, "supersedes / removes:\n");
268	175	vcc_ErrWhere(tl, (*l)->t_addr);
269	175	vcc_Warn(tl);
270	175	VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
271	175	FREE_OBJ(*l);
272	175	l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, r);
273	175	break;
274		case ACL_LEFT:
275	225	(*l)->mask--;
276	225	(*l)->fixed = "folded";
277	225	VSB_cat(tl->sb, "ACL entry:\n");
278	225	vcc_ErrWhere(tl, (*l)->t_addr);
279	225	VSB_cat(tl->sb, "left of:\n");
280	225	vcc_ErrWhere(tl, (*r)->t_addr);
281	450	VSB_printf(tl->sb, "removing the latter and expanding "
282		"mask of the former by one to /%u\n",
283	225	(*l)->mask - 8);
284	225	vcc_Warn(tl);
285	225	VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *r);
286	225	FREE_OBJ(*r);
287	225	VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
288	225	vcc_acl_insert_entry(tl, l);
289	225	return;
290		default:
291	0	INCOMPL();
292	0	}
293	175	if (l == NULL \|\| r == NULL)
294	25	break;
295	150	cmp = vcl_acl_cmp(l, r);
296	150	} while (cmp != ACL_LT);
297	1100	}
298
299		static void
300	4375	vcc_acl_insert_entry(struct vcc tl, struct acl_e *aenp)
301		{
302		struct acl_e ae2, l, *r;
303
304	4375	CHECK_OBJ_NOTNULL(*aenp, VCC_ACL_E_MAGIC);
305	4375	ae2 = VRBT_INSERT(acl_tree, &tl->acl->acl_tree, *aenp);
306	4375	if (ae2 != NULL) {
307	150	if (ae2->not != (*aenp)->not) {
308	25	VSB_cat(tl->sb, "Conflicting ACL entries:\n");
309	25	vcc_ErrWhere(tl, ae2->t_addr);
310	25	VSB_cat(tl->sb, "vs:\n");
311	25	vcc_ErrWhere(tl, (*aenp)->t_addr);
312	25	}
313	150	return;
314		}
315
316	4225	r = *aenp;
317	4225	*aenp = NULL;
318
319	4225	if (tl->acl->flag_fold == 0)
320	3300	return;
321
322	925	l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, r);
323	925	if (l != NULL) {
324	875	vcl_acl_fold(tl, &l, &r);
325	875	}
326	925	if (r == NULL)
327	200	return;
328	725	l = r;
329	725	r = VRBT_NEXT(acl_tree, &tl->acl->acl_tree, l);
330	725	if (r == NULL)
331	500	return;
332	225	vcl_acl_fold(tl, &l, &r);
333	4375	}
334
335		static void
336	4200	vcc_acl_add_entry(struct vcc tl, const struct acl_e ae, int l,
337		unsigned char *u, int fam)
338		{
339		struct acl_e *aen;
340
341	4200	if (fam == PF_INET && ae->mask > 32) {
342	50	VSB_printf(tl->sb,
343	25	"Too wide mask (/%u) for IPv4 address\n", ae->mask);
344	25	if (ae->t_mask != NULL)
345	25	vcc_ErrWhere(tl, ae->t_mask);
346		else
347	0	vcc_ErrWhere(tl, ae->t_addr);
348	25	return;
349		}
350	4175	if (fam == PF_INET6 && ae->mask > 128) {
351	50	VSB_printf(tl->sb,
352	25	"Too wide mask (/%u) for IPv6 address\n", ae->mask);
353	25	vcc_ErrWhere(tl, ae->t_mask);
354	25	return;
355		}
356
357		/* Make a copy from the template */
358	4150	ALLOC_OBJ(aen, VCC_ACL_E_MAGIC);
359	4150	AN(aen);
360	4150	aen = ae;
361	4150	aen->addr = strdup(ae->addr);
362	4150	AN(aen->addr);
363
364	4150	aen->fixed = vcc_acl_chk(tl, ae, l, u, fam);
365
366		/* We treat family as part of address, it saves code */
367	4150	assert(fam <= 0xff);
368	4150	aen->data[0] = fam & 0xff;
369	4150	aen->mask += 8;
370
371	4150	assert(l + 1UL <= sizeof aen->data);
372	4150	memcpy(aen->data + 1L, u, l);
373
374	4150	vcc_acl_insert_entry(tl, &aen);
375	4150	if (aen != NULL)
376	150	vcl_acl_free(&aen);
377	4200	}
378
379		static void
380	1375	vcc_acl_try_getaddrinfo(struct vcc tl, struct acl_e ae)
381		{
382		struct addrinfo res0, res, hint;
383		struct sockaddr_in *sin4;
384		struct sockaddr_in6 *sin6;
385		unsigned char *u, i4, i6;
386		int error;
387
388	1375	CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
389	1375	memset(&hint, 0, sizeof hint);
390	1375	hint.ai_family = PF_UNSPEC;
391	1375	hint.ai_socktype = SOCK_STREAM;
392	1375	error = getaddrinfo(ae->addr, "0", &hint, &res0);
393	1375	if (error) {
394	100	if (ae->para) {
395	100	VSB_printf(tl->sb,
396		"Warning: %s ignored\n -- %s\n",
397	50	ae->addr, gai_strerror(error));
398	100	Fh(tl, 1, "/* Ignored ACL entry: %s%s",
399	50	ae->para ? "\"(\" " : "", ae->not ? "\"!\" " : "");
400	50	EncToken(tl->fh, ae->t_addr);
401	50	if (ae->t_mask)
402	25	Fh(tl, 0, "/%u", ae->mask);
403	50	Fh(tl, 0, "%s\n", ae->para ? " \")\"" : "");
404	100	Fh(tl, 1, " * getaddrinfo: %s */\n",
405	50	gai_strerror(error));
406	50	} else {
407	100	VSB_printf(tl->sb,
408		"DNS lookup(%s): %s\n",
409	50	ae->addr, gai_strerror(error));
410	50	vcc_ErrWhere(tl, ae->t_addr);
411		}
412	100	return;
413		}
414
415	1275	i4 = i6 = 0;
416	2600	for (res = res0; res != NULL; res = res->ai_next) {
417	1325	switch (res->ai_family) {
418		case PF_INET:
419	50	i4++;
420	50	break;
421		case PF_INET6:
422	1275	i6++;
423	1275	break;
424		default:
425	0	VSB_printf(tl->sb,
426		"Ignoring unknown protocol family (%d) for %.*s\n",
427	0	res->ai_family, PF(ae->t_addr));
428	0	continue;
429		}
430	1325	}
431
432	1275	if (ae->t_mask != NULL && i4 > 0 && i6 > 0) {
433	0	VSB_printf(tl->sb,
434		"Mask (/%u) specified, but string resolves to"
435	0	" both IPv4 and IPv6 addresses.\n", ae->mask);
436	0	vcc_ErrWhere(tl, ae->t_mask);
437	0	freeaddrinfo(res0);
438	0	return;
439		}
440
441	2550	for (res = res0; res != NULL; res = res->ai_next) {
442	1325	switch (res->ai_family) {
443		case PF_INET:
444	50	assert(PF_INET < 256);
445	50	sin4 = (void*)res->ai_addr;
446	50	assert(sizeof(sin4->sin_addr) == 4);
447	50	u = (void*)&sin4->sin_addr;
448	50	if (ae->t_mask == NULL)
449	50	ae->mask = 32;
450	50	vcc_acl_add_entry(tl, ae, 4, u, res->ai_family);
451	50	break;
452		case PF_INET6:
453	1275	assert(PF_INET6 < 256);
454	1275	sin6 = (void*)res->ai_addr;
455	1275	assert(sizeof(sin6->sin6_addr) == 16);
456	1275	u = (void*)&sin6->sin6_addr;
457	1275	if (ae->t_mask == NULL)
458	150	ae->mask = 128;
459	1275	vcc_acl_add_entry(tl, ae, 16, u, res->ai_family);
460	1275	break;
461		default:
462	0	continue;
463		}
464	1325	if (tl->err)
465	50	freeaddrinfo(res0);
466	1325	ERRCHK(tl);
467	1275	}
468	1225	freeaddrinfo(res0);
469
470	1375	}
471
472		/*--------------------------------------------------------------------
473		* Ancient stupidity on the part of X/Open and other standards orgs
474		* dictate that "192.168" be translated to 192.0.0.168. Ever since
475		* CIDR happened, "192.168/16" notation has been used, but apparently
476		* no API supports parsing this, so roll our own.
477		*/
478
479		static int
480	4250	vcc_acl_try_netnotation(struct vcc tl, struct acl_e ae)
481		{
482		unsigned char b[4];
483		int i, j, k;
484		unsigned u;
485		const char *p;
486
487	4250	CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
488	4250	memset(b, 0, sizeof b);
489	4250	p = ae->addr;
490	12400	for (i = 0; i < 4; i++) {
491	12400	j = sscanf(p, "%u%n", &u, &k);
492	12400	if (j != 1)
493	1300	return (0);
494	11100	if (u & ~0xff)
495	25	return (0);
496	11075	b[i] = (unsigned char)u;
497	11075	if (p[k] == '\0')
498	2875	break;
499	8200	if (p[k] != '.')