varnish-cache/lib/libvcc/vcc_acl.c
0
/*-
1
 * Copyright (c) 2006 Verdens Gang AS
2
 * Copyright (c) 2006-2010 Varnish Software AS
3
 * All rights reserved.
4
 *
5
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6
 *
7
 * SPDX-License-Identifier: BSD-2-Clause
8
 *
9
 * Redistribution and use in source and binary forms, with or without
10
 * modification, are permitted provided that the following conditions
11
 * are met:
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 * 2. Redistributions in binary form must reproduce the above copyright
15
 *    notice, this list of conditions and the following disclaimer in the
16
 *    documentation and/or other materials provided with the distribution.
17
 *
18
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
22
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28
 * SUCH DAMAGE.
29
 */
30
31
#include "config.h"
32
33
#include <sys/socket.h>
34
35
#include <netinet/in.h>
36
37
#include <netdb.h>
38
#include <stdlib.h>
39
#include <string.h>
40
41
#include "vcc_compile.h"
42
#include <vtcp.h>
43
#include <vtree.h>
44
#include <vsa.h>
45
46
#define ACL_MAXADDR     (sizeof(struct in6_addr) + 1)
47
48
VRBT_HEAD(acl_tree, acl_e);
49
50
struct acl {
51
        unsigned                magic;
52
#define VCC_ACL_MAGIC           0xb9fb3cd0
53
54
        int                     flag_log;
55
        int                     flag_fold;
56
        int                     flag_pedantic;
57
        int                     flag_table;
58
59
        struct acl_tree         acl_tree;
60
};
61
62
struct acl_e {
63
        unsigned                magic;
64
#define VCC_ACL_E_MAGIC 0xcac81e23
65
        VRBT_ENTRY(acl_e)       branch;
66
        unsigned char           data[ACL_MAXADDR];
67
        unsigned                mask;
68
        unsigned                not;
69
        unsigned                para;
70
        unsigned                overlapped;
71
        char                    *addr;
72
        const char              *fixed;
73
        struct token            *t_addr;
74
        struct token            *t_mask;
75
};
76
77
enum acl_cmp_e {
78
        ACL_EQ = 0,
79
        ACL_LT = -1,            // a < b
80
        ACL_GT = 1,             // b > a
81
        ACL_CONTAINED = -2,     // b contains a
82
        ACL_CONTAINS = 2,       // a contains b
83
        ACL_LEFT = -3,          // a + 1 == b
84
        ACL_RIGHT = 3           // a == b + 1
85
};
86
87
static void vcc_acl_insert_entry(struct vcc *, struct acl_e **);
88
89
/*
90
 * Compare two acl rules for relation
91
 */
92
93
#define CMP(n, a, b)                                                    \
94
        do {                                                            \
95
                if ((a) < (b))                                          \
96
                        return (enum acl_cmp_e)(-n);                    \
97
                else if ((b) < (a))                                     \
98
                        return (n);                                     \
99
        } while (0)
100
101
#define CMPA(a, b)                                                      \
102
        do {                                                            \
103
                if (((a) | 1) == (b))                                   \
104
                        return (ACL_LEFT);                              \
105
                else if (((b) | 1) == (a))                              \
106
                        return (ACL_RIGHT);                             \
107
        } while (0)
108
109
static void
110 102
vcl_acl_free(struct acl_e **aep)
111
{
112
        struct acl_e *a;
113
114 102
        TAKE_OBJ_NOTNULL(a, aep, VCC_ACL_E_MAGIC);
115 102
        free(a->addr);
116 102
        FREE_OBJ(a);
117 102
}
118
119
static enum acl_cmp_e
120 8415
vcl_acl_cmp(const struct acl_e *ae1, const struct acl_e *ae2)
121
{
122
        const unsigned char *p1, *p2;
123
        unsigned m;
124
        unsigned char a1, a2;
125
126 8415
        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
127 8415
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
128
129 8415
        p1 = ae1->data;
130 8415
        p2 = ae2->data;
131 8415
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
132 43741
        for (; m >= 8; m -= 8) {
133 39967
                if (m == 8 && ae1->mask == ae2->mask)
134 663
                        CMPA(*p1, *p2);
135 75140
                CMP(ACL_GT, *p1, *p2);
136 35326
                p1++;
137 35326
                p2++;
138 35326
        }
139 3774
        if (m) {
140 3604
                assert (m < 8);
141 3604
                a1 = *p1 >> (8 - m);
142 3604
                a2 = *p2 >> (8 - m);
143 3604
                if (ae1->mask == ae2->mask)
144 1156
                        CMPA(a1, a2);
145 4828
                CMP(ACL_GT, a1, a2);
146 1666
        } else if (ae1->mask == ae2->mask) {
147 170
                CMPA(*p1, *p2);
148 85
        }
149
        /* Long mask is less than short mask */
150 1768
        CMP(ACL_CONTAINS, ae2->mask, ae1->mask);
151
152 102
        return (ACL_EQ);
153 8415
}
154
155
static int
156 1989
vcl_acl_disjoint(const struct acl_e *ae1, const struct acl_e *ae2)
157
{
158
        const unsigned char *p1, *p2;
159
        unsigned m;
160
161 1989
        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
162 1989
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
163
164 1989
        p1 = ae1->data;
165 1989
        p2 = ae2->data;
166 1989
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
167 15028
        for (; m >= 8; m -= 8) {
168 26588
                CMP(ACL_GT, *p1, *p2);
169 13039
                p1++;
170 13039
                p2++;
171 13039
        }
172 1479
        if (m) {
173 1360
                m = 0xff00 >> m;
174 1360
                m &= 0xff;
175 2567
                CMP(ACL_GT, *p1 & m, *p2 & m);
176 1207
        }
177 1326
        return (0);
178 1989
}
179
180 6001
VRBT_GENERATE_INSERT_COLOR(acl_tree, acl_e, branch, static)
181 2941
VRBT_GENERATE_INSERT_FINISH(acl_tree, acl_e, branch, static)
182 10506
VRBT_GENERATE_INSERT(acl_tree, acl_e, branch, vcl_acl_cmp, static)
183 493
VRBT_GENERATE_REMOVE_COLOR(acl_tree, acl_e, branch, static)
184 833
VRBT_GENERATE_REMOVE(acl_tree, acl_e, branch, static)
185 2992
VRBT_GENERATE_MINMAX(acl_tree, acl_e, branch, static)
186 7616
VRBT_GENERATE_NEXT(acl_tree, acl_e, branch, static)
187 4743
VRBT_GENERATE_PREV(acl_tree, acl_e, branch, static)
188
189
static char *
190 2890
vcc_acl_chk(struct vcc *tl, const struct acl_e *ae, const int l,
191
    unsigned char *p, int fam)
192
{
193
        const unsigned char *u;
194
        char h[VTCP_ADDRBUFSIZE];
195
        char t[VTCP_ADDRBUFSIZE + 10];
196 2890
        char s[vsa_suckaddr_len];
197 2890
        char *r = NULL;
198
        const struct suckaddr *sa;
199
        unsigned m;
200 2890
        int ll, ret = 0;
201
202 2890
        u = p;
203 2890
        ll = l;
204 2890
        m = ae->mask;
205
206 2890
        p += m / 8;
207 2890
        ll -= m / 8;
208 2890
        assert (ll >= 0);
209 2890
        m %= 8;
210
211 2890
        if (m && ((unsigned)*p << m & 0xff) != 0) {
212 68
                ret = 1;
213 68
                m = 0xff00 >> m;
214 68
                *p &= m;
215 68
        }
216 2890
        if (m) {
217 1615
                p++;
218 1615
                ll--;
219 1615
        }
220
221 5406
        for ( ; ll > 0; p++, ll--) {
222 2516
                if (*p == 0)
223 2431
                        continue;
224 85
                ret = 1;
225 85
                *p = 0;
226 85
        }
227 2890
        if (ret == 0)
228 2737
                return (NULL);
229
230 153
        sa = VSA_BuildFAP(s, fam, u, l, NULL, 0);
231 153
        AN(sa);
232 153
        VTCP_name(sa, h, sizeof h, NULL, 0);
233 153
        bprintf(t, "%s/%d", h, ae->mask);
234 153
        if (tl->acl->flag_pedantic != 0) {
235 34
                VSB_cat(tl->sb, "Non-zero bits in masked part, ");
236 34
                VSB_printf(tl->sb, "(maybe use %s ?)\n", t);
237 34
                vcc_ErrWhere(tl, ae->t_addr);
238 34
        }
239 153
        REPLACE(r, t);
240 153
        return (r);
241 2890
}
242
243
static void
244 748
vcl_acl_fold(struct vcc *tl, struct acl_e **l, struct acl_e **r)
245
{
246
        enum acl_cmp_e cmp;
247
248 748
        AN(l);
249 748
        AN(r);
250 748
        CHECK_OBJ_NOTNULL(*l, VCC_ACL_E_MAGIC);
251 748
        CHECK_OBJ_NOTNULL(*r, VCC_ACL_E_MAGIC);
252
253 748
        if ((*l)->not || (*r)->not)
254 0
                return;
255
256 748
        cmp = vcl_acl_cmp(*l, *r);
257
258 748
        assert(cmp < 0);
259 748
        if (cmp == ACL_LT)
260 493
                return;
261
262 255
        do {
263 272
                switch (cmp) {
264
                case ACL_CONTAINED:
265 119
                        VSB_cat(tl->sb, "ACL entry:\n");
266 119
                        vcc_ErrWhere(tl, (*r)->t_addr);
267 119
                        VSB_cat(tl->sb, "supersedes / removes:\n");
268 119
                        vcc_ErrWhere(tl, (*l)->t_addr);
269 119
                        vcc_Warn(tl);
270 119
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
271 119
                        FREE_OBJ(*l);
272 119
                        *l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, *r);
273 119
                        break;
274
                case ACL_LEFT:
275 153
                        (*l)->mask--;
276 153
                        (*l)->fixed = "folded";
277 153
                        VSB_cat(tl->sb, "ACL entry:\n");
278 153
                        vcc_ErrWhere(tl, (*l)->t_addr);
279 153
                        VSB_cat(tl->sb, "left of:\n");
280 153
                        vcc_ErrWhere(tl, (*r)->t_addr);
281 306
                        VSB_printf(tl->sb, "removing the latter and expanding "
282
                            "mask of the former by one to /%u\n",
283 153
                            (*l)->mask - 8);
284 153
                        vcc_Warn(tl);
285 153
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *r);
286 153
                        FREE_OBJ(*r);
287 153
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
288 153
                        vcc_acl_insert_entry(tl, l);
289 153
                        return;
290
                default:
291 0
                        INCOMPL();
292 0
                }
293 119
                if (*l == NULL || *r == NULL)
294 17
                        break;
295 102
                cmp = vcl_acl_cmp(*l, *r);
296 102
        } while (cmp != ACL_LT);
297 748
}
298
299
static void
300 3043
vcc_acl_insert_entry(struct vcc *tl, struct acl_e **aenp)
301
{
302
        struct acl_e *ae2, *l, *r;
303
304 3043
        CHECK_OBJ_NOTNULL(*aenp, VCC_ACL_E_MAGIC);
305 3043
        ae2 = VRBT_INSERT(acl_tree, &tl->acl->acl_tree, *aenp);
306 3043
        if (ae2 != NULL) {
307 102
                if (ae2->not != (*aenp)->not) {
308 17
                        VSB_cat(tl->sb, "Conflicting ACL entries:\n");
309 17
                        vcc_ErrWhere(tl, ae2->t_addr);
310 17
                        VSB_cat(tl->sb, "vs:\n");
311 17
                        vcc_ErrWhere(tl, (*aenp)->t_addr);
312 17
                }
313 102
                return;
314
        }
315
316 2941
        r = *aenp;
317 2941
        *aenp = NULL;
318
319 2941
        if (tl->acl->flag_fold == 0)
320 2312
                return;
321
322 629
        l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, r);
323 629
        if (l != NULL) {
324 595
                vcl_acl_fold(tl, &l, &r);
325 595
        }
326 629
        if (r == NULL)
327 136
                return;
328 493
        l = r;
329 493
        r = VRBT_NEXT(acl_tree, &tl->acl->acl_tree, l);
330 493
        if (r == NULL)
331 340
                return;
332 153
        vcl_acl_fold(tl, &l, &r);
333 3043
}
334
335
static void
336 2924
vcc_acl_add_entry(struct vcc *tl, const struct acl_e *ae, int l,
337
    unsigned char *u, int fam)
338
{
339
        struct acl_e *aen;
340
341 2924
        if (fam == PF_INET && ae->mask > 32) {
342 34
                VSB_printf(tl->sb,
343 17
                    "Too wide mask (/%u) for IPv4 address\n", ae->mask);
344 17
                if (ae->t_mask != NULL)
345 17
                        vcc_ErrWhere(tl, ae->t_mask);
346
                else
347 0
                        vcc_ErrWhere(tl, ae->t_addr);
348 17
                return;
349
        }
350 2907
        if (fam == PF_INET6 && ae->mask > 128) {
351 34
                VSB_printf(tl->sb,
352 17
                    "Too wide mask (/%u) for IPv6 address\n", ae->mask);
353 17
                vcc_ErrWhere(tl, ae->t_mask);
354 17
                return;
355
        }
356
357
        /* Make a copy from the template */
358 2890
        ALLOC_OBJ(aen, VCC_ACL_E_MAGIC);
359 2890
        AN(aen);
360 2890
        *aen = *ae;
361 2890
        aen->addr = strdup(ae->addr);
362 2890
        AN(aen->addr);
363
364 2890
        aen->fixed = vcc_acl_chk(tl, ae, l, u, fam);
365
366
        /* We treat family as part of address, it saves code */
367 2890
        assert(fam <= 0xff);
368 2890
        aen->data[0] = fam & 0xff;
369 2890
        aen->mask += 8;
370
371 2890
        assert(l + 1UL <= sizeof aen->data);
372 2890
        memcpy(aen->data + 1L, u, l);
373
374 2890
        vcc_acl_insert_entry(tl, &aen);
375 2890
        if (aen != NULL)
376 102
                vcl_acl_free(&aen);
377 2924
}
378
379
static void
380 969
vcc_acl_try_getaddrinfo(struct vcc *tl, struct acl_e *ae)
381
{
382
        struct addrinfo *res0, *res, hint;
383
        struct sockaddr_in *sin4;
384
        struct sockaddr_in6 *sin6;
385
        unsigned char *u, i4, i6;
386
        int error;
387
388 969
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
389 969
        memset(&hint, 0, sizeof hint);
390 969
        hint.ai_family = PF_UNSPEC;
391 969
        hint.ai_socktype = SOCK_STREAM;
392 969
        error = getaddrinfo(ae->addr, "0", &hint, &res0);
393 969
        if (error) {
394 68
                if (ae->para) {
395 68
                        VSB_printf(tl->sb,
396
                            "Warning: %s ignored\n  -- %s\n",
397 34
                            ae->addr, gai_strerror(error));
398 68
                        Fh(tl, 1, "/* Ignored ACL entry: %s%s",
399 34
                            ae->para ? "\"(\" " : "", ae->not ? "\"!\" " : "");
400 34
                        EncToken(tl->fh, ae->t_addr);
401 34
                        if (ae->t_mask)
402 17
                                Fh(tl, 0, "/%u", ae->mask);
403 34
                        Fh(tl, 0, "%s\n", ae->para ? " \")\"" : "");
404 68
                        Fh(tl, 1, " * getaddrinfo:  %s */\n",
405 34
                             gai_strerror(error));
406 34
                } else {
407 68
                        VSB_printf(tl->sb,
408
                            "DNS lookup(%s): %s\n",
409 34
                            ae->addr, gai_strerror(error));
410 34
                        vcc_ErrWhere(tl, ae->t_addr);
411
                }
412 68
                return;
413
        }
414
415 901
        i4 = i6 = 0;
416 1836
        for (res = res0; res != NULL; res = res->ai_next) {
417 935
                switch (res->ai_family) {
418
                case PF_INET:
419 34
                        i4++;
420 34
                        break;
421
                case PF_INET6:
422 901
                        i6++;
423 901
                        break;
424
                default:
425 0
                        VSB_printf(tl->sb,
426
                            "Ignoring unknown protocol family (%d) for %.*s\n",
427 0
                                res->ai_family, PF(ae->t_addr));
428 0
                        continue;
429
                }
430 935
        }
431
432 901
        if (ae->t_mask != NULL && i4 > 0 && i6 > 0) {
433 0
                VSB_printf(tl->sb,
434
                    "Mask (/%u) specified, but string resolves to"
435 0
                    " both IPv4 and IPv6 addresses.\n", ae->mask);
436 0
                vcc_ErrWhere(tl, ae->t_mask);
437 0
                freeaddrinfo(res0);
438 0
                return;
439
        }
440
441 1802
        for (res = res0; res != NULL; res = res->ai_next) {
442 935
                switch (res->ai_family) {
443
                case PF_INET:
444 34
                        assert(PF_INET < 256);
445 34
                        sin4 = (void*)res->ai_addr;
446 34
                        assert(sizeof(sin4->sin_addr) == 4);
447 34
                        u = (void*)&sin4->sin_addr;
448 34
                        if (ae->t_mask == NULL)
449 34
                                ae->mask = 32;
450 34
                        vcc_acl_add_entry(tl, ae, 4, u, res->ai_family);
451 34
                        break;
452
                case PF_INET6:
453 901
                        assert(PF_INET6 < 256);
454 901
                        sin6 = (void*)res->ai_addr;
455 901
                        assert(sizeof(sin6->sin6_addr) == 16);
456 901
                        u = (void*)&sin6->sin6_addr;
457 901
                        if (ae->t_mask == NULL)
458 136
                                ae->mask = 128;
459 901
                        vcc_acl_add_entry(tl, ae, 16, u, res->ai_family);
460 901
                        break;
461
                default:
462 0
                        continue;
463
                }
464 935
                if (tl->err)
465 34
                        freeaddrinfo(res0);
466 935
                ERRCHK(tl);
467 901
        }
468 867
        freeaddrinfo(res0);
469
470 969
}
471
472
/*--------------------------------------------------------------------
473
 * Ancient stupidity on the part of X/Open and other standards orgs
474
 * dictate that "192.168" be translated to 192.0.0.168.  Ever since
475
 * CIDR happened, "192.168/16" notation has been used, but apparently
476
 * no API supports parsing this, so roll our own.
477
 */
478
479
static int
480 2958
vcc_acl_try_netnotation(struct vcc *tl, struct acl_e *ae)
481
{
482
        unsigned char b[4];
483
        int i, j, k;
484
        unsigned u;
485
        const char *p;
486
487 2958
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
488 2958
        memset(b, 0, sizeof b);
489 2958
        p = ae->addr;
490 8602
        for (i = 0; i < 4; i++) {
491 8602
                j = sscanf(p, "%u%n", &u, &k);
492 8602
                if (j != 1)
493 884
                        return (0);
494 7718
                if (u & ~0xff)
495 34
                        return (0);
496 7684
                b[i] = (unsigned char)u;
497 7684
                if (p[k] == '\0')
498 1989
                        break;
499 5695
                if (p[k] != '.')
500 51
                        return (0);
501 5644
                p += k + 1;
502 5644
        }
503 1989
        if (ae->t_mask == NULL)
504 476
                ae->mask = 8 + 8 * i;
505 1989
        vcc_acl_add_entry(tl, ae, 4, b, AF_INET);
506 1989
        return (1);
507 2958
}
508
509
static void
510 3026
vcc_acl_entry(struct vcc *tl)
511
{
512
        struct acl_e ae[1];
513
        char *sl, *e;
514
515 3026
        INIT_OBJ(ae, VCC_ACL_E_MAGIC);
516
517 3026
        if (tl->t->tok == '!') {
518 680
                ae->not = 1;
519 680
                vcc_NextToken(tl);
520 680
        }
521
522 3026
        if (tl->t->tok == '(') {
523 51
                ae->para = 1;
524 51
                vcc_NextToken(tl);
525 51
        }
526
527 3026
        if (!ae->not && tl->t->tok == '!') {
528 17
                ae->not = 1;
529 17
                vcc_NextToken(tl);
530 17
        }
531
532 3026
        ExpectErr(tl, CSTR);
533 3026
        ae->t_addr = tl->t;
534 3026
        ae->addr = ae->t_addr->dec;
535 3026
        vcc_NextToken(tl);
536
537 3026
        if (strchr(ae->t_addr->dec, '/') != NULL) {
538 51
                sl = strchr(ae->addr, '/');
539 51
                AN(sl);
540 51
                *sl++ = '\0';
541 51
                e = NULL;
542 51
                ae->mask = strtoul(sl, &e, 10);
543 51
                if (*e != '\0') {
544 34
                        VSB_cat(tl->sb, ".../mask is not numeric.\n");
545 34
                        vcc_ErrWhere(tl, ae->t_addr);
546 34
                        return;
547
                }
548 17
                ae->t_mask = ae->t_addr;
549 17
                if (tl->t->tok == '/') {
550 17
                        VSB_cat(tl->sb, "/mask only allowed once.\n");
551 17
                        vcc_ErrWhere(tl, tl->t);
552 17
                        return;
553
                }
554 2975
        } else if (tl->t->tok == '/') {
555 2295
                vcc_NextToken(tl);
556 2295
                ae->t_mask = tl->t;
557 2295
                ExpectErr(tl, CNUM);
558 2295
                ae->mask = vcc_UintVal(tl);
559 2295
        }
560
561 2975
        if (ae->para)
562 51
                SkipToken(tl, ')');
563
564 2958
        if (!vcc_acl_try_netnotation(tl, ae)) {
565 969
                ERRCHK(tl);
566 969
                vcc_acl_try_getaddrinfo(tl, ae);
567 969
        }
568 2958
        ERRCHK(tl);
569 3026
}
570
571
/*********************************************************************
572
 * Emit the tokens making up an entry as C-strings
573
 */
574
575
static void
576 867
vcc_acl_emit_tokens(const struct vcc *tl, const struct acl_e *ae)
577
{
578
        struct token *t;
579 867
        const char *sep = "";
580
581 867
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
582 867
        t = ae->t_addr;
583 867
        do {
584 2533
                if (t->tok == CSTR) {
585 867
                        Fh(tl, 0, "%s\"\\\"\" ", sep);
586 867
                        EncToken(tl->fh, t);
587 867
                        Fh(tl, 0, " \"\\\"\"");
588 2533
                } else if (t == ae->t_mask) {
589 833
                        Fh(tl, 0, " \"%u\"", ae->mask - 8);
590 833
                } else {
591 833
                        Fh(tl, 0, "%s\"%.*s\"", sep, PF(t));
592
                }
593 2533
                if (t == ae->t_mask)
594 833
                        break;
595 1700
                t = vcc_PeekTokenFrom(tl, t);
596 1700
                AN(t);
597 1700
                sep = " ";
598 1700
        } while (ae->t_mask != NULL);
599 867
        if (ae->fixed)
600 170
                Fh(tl, 0, "\" fixed: %s\"", ae->fixed);
601 867
}
602
603
/*********************************************************************
604
 * Emit ACL on table format
605
 */
606
607
static unsigned
608 34
vcc_acl_emit_tables(const struct vcc *tl, unsigned n, const char *name)
609
{
610
        struct acl_e *ae;
611 34
        unsigned rv = sizeof(ae->data) + 3;
612 34
        unsigned nn = 0;
613
        size_t sz;
614
615 68
        Fh(tl, 0, "\nstatic unsigned char acl_tbl_%s[%u*%u] = {\n",
616 34
            name, n, rv);
617 850
        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
618 816
                if (ae->overlapped)
619 680
                        continue;
620 136
                Fh(tl, 0, "\t0x%02x,", ae->not ? 0 : 1);
621 136
                Fh(tl, 0, "0x%02x,", (ae->mask >> 3) - 1);
622 136
                Fh(tl, 0, "0x%02x,", (0xff00 >> (ae->mask & 7)) & 0xff);
623 2448
                for (sz = 0; sz < sizeof(ae->data); sz++)
624 2312
                        Fh(tl, 0, "0x%02x,", ae->data[sz]);
625 136
                for (; sz < rv - 3; sz++)
626 0
                        Fh(tl, 0, "0,");
627 136
                Fh(tl, 0, "\n");
628 136
                nn++;
629 136
        }
630 34
        assert(n == nn);
631 34
        Fh(tl, 0, "};\n");
632 34
        if (tl->acl->flag_log) {
633 34
                Fh(tl, 0, "\nstatic const char *acl_str_%s[%d] = {\n",
634 17
                    name, n);
635 425
                VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
636 408
                        if (ae->overlapped)
637 340
                                continue;
638 68
                        Fh(tl, 0, "\t");
639 136
                        Fh(tl, 0, "\"%sMATCH %s \" ",
640 68
                            ae->not ? "NEG_" : "", name);
641 68
                        vcc_acl_emit_tokens(tl, ae);
642 68
                        Fh(tl, 0, ",\n");
643 68
                }
644 17
                Fh(tl, 0, "};\n");
645 17
        }
646 34
        return (rv);
647
}
648
649
/*********************************************************************
650
 * Emit a function to match the ACL we have collected
651
 */
652
653
static void
654 476
vcc_acl_emit(struct vcc *tl, const struct symbol *sym)
655
{
656
        struct acl_e *ae, *ae2;
657
        int depth, l, m, i;
658
        unsigned at[ACL_MAXADDR];
659 476
        struct inifin *ifp = NULL;
660
        struct vsb *func;
661 476
        unsigned n, no, nw = 0;
662
663 476
        func = VSB_new_auto();
664 476
        AN(func);
665 476
        VSB_cat(func, "match_acl_");
666 476
        VCC_PrintCName(func, sym->name, NULL);
667 476
        AZ(VSB_finish(func));
668
669 476
        depth = -1;
670 476
        at[0] = 256;
671 476
        ae2 = NULL;
672 476
        n = no = 0;
673 2924
        VRBT_FOREACH_REVERSE(ae, acl_tree, &tl->acl->acl_tree) {
674 2448
                n++;
675 2448
                if (ae2 == NULL) {
676 459
                        ae2 = ae;
677 2448
                } else if (vcl_acl_disjoint(ae, ae2)) {
678 663
                        ae2 = ae;
679 663
                } else {
680 1326
                        no++;
681 1326
                        ae->overlapped = 1;
682
                }
683 2448
        }
684
685 476
        Fh(tl, 0, "/* acl_n_%s n %u no %u */\n", sym->name, n, no);
686 476
        if (n - no < (1<<1))
687 255
                no = n;
688 221
        else if (!tl->acl->flag_table)
689 187
                no = n;
690
691 476
        if (no < n)
692 34
                nw = vcc_acl_emit_tables(tl, n - no, sym->name);
693
694
695 476
        Fh(tl, 0, "\nstatic int v_matchproto_(acl_match_f)\n");
696 476
        Fh(tl, 0, "%s(VRT_CTX, const VCL_IP p)\n", VSB_data(func));
697 476
        Fh(tl, 0, "{\n");
698 476
        Fh(tl, 0, "\tconst unsigned char *a;\n");
699 476
        Fh(tl, 0, "\tint fam;\n");
700 476
        Fh(tl, 0, "\n");
701 476
        Fh(tl, 0, "\tfam = VRT_VSA_GetPtr(ctx, p, &a);\n");
702 476
        Fh(tl, 0, "\tif (fam < 0) {\n");
703 476
        Fh(tl, 0, "\t\tVRT_fail(ctx,");
704 476
        Fh(tl, 0, " \"ACL %s: no protocol family\");\n", sym->name);
705 476
        Fh(tl, 0, "\t\treturn(0);\n");
706 476
        Fh(tl, 0, "\t}\n\n");
707 476
        if (!tl->err_unref) {
708 34
                ifp = New_IniFin(tl);
709 68
                VSB_printf(ifp->ini,
710 34
                        "\t(void)%s;\n", VSB_data(func));
711 34
        }
712
713 2924
        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
714
715 2448
                if (no < n && !ae->overlapped)
716 136
                        continue;
717
718
                /* Find how much common prefix we have */
719 14076
                for (l = 0; l <= depth && l * 8 < (int)ae->mask - 7; l++) {
720 12580
                        assert(l >= 0);
721 12580
                        if (ae->data[l] != at[l])
722 816
                                break;
723 11764
                }
724
725
                /* Back down, if necessary */
726 5338
                while (l <= depth) {
727 3026
                        Fh(tl, 0, "\t%*s}\n", -depth, "");
728 3026
                        depth--;
729
                }
730
731 2312
                m = (int)ae->mask;
732 2312
                assert(m >= l*8);
733 2312
                m -= l * 8;
734
735
                /* Do whole byte compares */
736 8194
                for (i = l; m >= 8; m -= 8, i++) {
737 5882
                        if (i == 0)
738 1326
                                Fh(tl, 0, "\t%*s%sif (fam == %d) {\n",
739 663
                                    -i, "", "", ae->data[i]);
740
                        else
741 10438
                                Fh(tl, 0, "\t%*s%sif (a[%d] == %d) {\n",
742 5219
                                    -i, "", "", i - 1, ae->data[i]);
743 5882
                        at[i] = ae->data[i];
744 5882
                        depth = i;
745 5882
                }
746
747 2312
                if (m > 0) {
748
                        // XXX can remove masking due to fixup
749
                        /* Do fractional byte compares */
750 2584
                        Fh(tl, 0, "\t%*s%sif ((a[%d] & 0x%x) == %d) {\n",
751 1292
                            -i, "", "", i - 1, (0xff00 >> m) & 0xff,
752 1292
                            ae->data[i] & ((0xff00 >> m) & 0xff));
753 1292
                        at[i] = 256;
754 1292
                        depth = i;
755 1292
                }
756
757 2312
                i = ((int)ae->mask + 7) / 8;
758
759 2312
                if (tl->acl->flag_log) {
760 1598
                        Fh(tl, 0, "\t%*sVPI_acl_log(ctx, \"%sMATCH %s \" ",
761 799
                            -i, "", ae->not ? "NEG_" : "", sym->name);
762 799
                        vcc_acl_emit_tokens(tl, ae);
763 799
                        Fh(tl, 0, ");\n");
764 799
                }
765
766 2312
                Fh(tl, 0, "\t%*sreturn (%d);\n", -i, "", ae->not ? 0 : 1);
767 2312
        }
768
769
        /* Unwind */
770 4624
        for (; 0 <= depth; depth--)
771 4148
                Fh(tl, 0, "\t%*.*s}\n", depth, depth, "");
772
773 476
        if (no < n) {
774 34
                Fh(tl, 0, "\treturn(\n\t    VPI_acl_table(ctx,\n");
775 34
                Fh(tl, 0, "\t\tp,\n");
776 34
                Fh(tl, 0, "\t\t%u, %u,\n", n - no, nw);
777 34
                Fh(tl, 0, "\t\tacl_tbl_%s,\n", sym->name);
778 34
                if (tl->acl->flag_log)
779 17
                        Fh(tl, 0, "\t\tacl_str_%s,\n", sym->name);
780
                else
781 17
                        Fh(tl, 0, "\t\tNULL,\n");
782 34
                Fh(tl, 0, "\t\t\"NO MATCH %s\"\n\t    )\n\t);\n", sym->name);
783 34
        } else {
784
                /* Deny by default */
785 442
                if (tl->acl->flag_log)
786 102
                        Fh(tl, 0, "\tVPI_acl_log(ctx, \"NO_MATCH %s\");\n",
787 51
                            sym->name);
788 442
                Fh(tl, 0, "\treturn(0);\n");
789
        }
790 476
        Fh(tl, 0, "}\n");
791
792
        /* Emit the struct that will be referenced */
793 476
        Fh(tl, 0, "\nstatic const struct vrt_acl %s[] = {{\n", sym->rname);
794 476
        Fh(tl, 0, "\t.magic = VRT_ACL_MAGIC,\n");
795 476
        Fh(tl, 0, "\t.match = &%s,\n", VSB_data(func));
796 476
        Fh(tl, 0, "\t.name = \"%s\",\n", sym->name);
797 476
        Fh(tl, 0, "}};\n\n");
798 476
        if (!tl->err_unref) {
799 34
                AN(ifp);
800 34
                VSB_printf(ifp->ini, "\t(void)%s;", sym->rname);
801 34
        }
802 476
        VSB_destroy(&func);
803 476
}
804
805
void
806 731
vcc_ParseAcl(struct vcc *tl)
807
{
808
        struct symbol *sym;
809
        int sign;
810
        struct acl acl[1];
811
812 731
        INIT_OBJ(acl, VCC_ACL_MAGIC);
813 731
        tl->acl = acl;
814 731
        acl->flag_pedantic = 1;
815 731
        vcc_NextToken(tl);
816 731
        VRBT_INIT(&acl->acl_tree);
817
818 731
        vcc_ExpectVid(tl, "ACL");
819 731
        ERRCHK(tl);
820 714
        sym = VCC_HandleSymbol(tl, ACL);
821 714
        ERRCHK(tl);
822 714
        AN(sym);
823
824 969
        while (1) {
825 969
                sign = vcc_IsFlag(tl);
826 969
                if (tl->err) {
827 17
                        VSB_cat(tl->sb,
828
                            "Valid ACL flags are `log` and `table`:\n");
829 17
                        return;
830
                }
831 952
                if (sign < 0)
832 680
                        break;
833 272
                if (vcc_IdIs(tl->t, "log")) {
834 68
                        acl->flag_log = sign;
835 68
                        vcc_NextToken(tl);
836 272
                } else if (vcc_IdIs(tl->t, "fold")) {
837 17
                        acl->flag_fold = sign;
838 17
                        vcc_NextToken(tl);
839 204
                } else if (vcc_IdIs(tl->t, "pedantic")) {
840 136
                        acl->flag_pedantic = sign;
841 136
                        vcc_NextToken(tl);
842 187
                } else if (vcc_IdIs(tl->t, "table")) {
843 34
                        acl->flag_table = sign;
844 34
                        vcc_NextToken(tl);
845 34
                } else {
846 17
                        VSB_cat(tl->sb, "Unknown ACL flag:\n");
847 17
                        vcc_ErrWhere(tl, tl->t);
848 17
                        return;
849
                }
850
        }
851
852 680
        SkipToken(tl, '{');
853
854 3502
        while (tl->t->tok != '}') {
855 3026
                vcc_acl_entry(tl);
856 3026
                ERRCHK(tl);
857 2839
                SkipToken(tl, ';');
858
        }
859 476
        SkipToken(tl, '}');
860
861 476
        vcc_acl_emit(tl, sym);
862 731
}