varnish-cache/lib/libvcc/vcc_acl.c
0
/*-
1
 * Copyright (c) 2006 Verdens Gang AS
2
 * Copyright (c) 2006-2010 Varnish Software AS
3
 * All rights reserved.
4
 *
5
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6
 *
7
 * SPDX-License-Identifier: BSD-2-Clause
8
 *
9
 * Redistribution and use in source and binary forms, with or without
10
 * modification, are permitted provided that the following conditions
11
 * are met:
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 * 2. Redistributions in binary form must reproduce the above copyright
15
 *    notice, this list of conditions and the following disclaimer in the
16
 *    documentation and/or other materials provided with the distribution.
17
 *
18
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
22
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28
 * SUCH DAMAGE.
29
 */
30
31
#include "config.h"
32
33
#include <sys/socket.h>
34
35
#include <netinet/in.h>
36
37
#include <netdb.h>
38
#include <stdlib.h>
39
#include <string.h>
40
41
#include "vcc_compile.h"
42
#include <vtcp.h>
43
#include <vtree.h>
44
#include <vsa.h>
45
46
#define ACL_MAXADDR     (sizeof(struct in6_addr) + 1)
47
48
VRBT_HEAD(acl_tree, acl_e);
49
50
struct acl {
51
        unsigned                magic;
52
#define VCC_ACL_MAGIC           0xb9fb3cd0
53
54
        int                     flag_log;
55
        int                     flag_fold;
56
        int                     flag_pedantic;
57
        int                     flag_table;
58
59
        struct acl_tree         acl_tree;
60
};
61
62
struct acl_e {
63
        unsigned                magic;
64
#define VCC_ACL_E_MAGIC 0xcac81e23
65
        VRBT_ENTRY(acl_e)       branch;
66
        unsigned char           data[ACL_MAXADDR];
67
        unsigned                mask;
68
        unsigned                not;
69
        unsigned                para;
70
        unsigned                overlapped;
71
        char                    *addr;
72
        const char              *fixed;
73
        struct token            *t_addr;
74
        struct token            *t_mask;
75
};
76
77
enum acl_cmp_e {
78
        ACL_EQ = 0,
79
        ACL_LT = -1,            // a < b
80
        ACL_GT = 1,             // b > a
81
        ACL_CONTAINED = -2,     // b contains a
82
        ACL_CONTAINS = 2,       // a contains b
83
        ACL_LEFT = -3,          // a + 1 == b
84
        ACL_RIGHT = 3           // a == b + 1
85
};
86
87
static void vcc_acl_insert_entry(struct vcc *, struct acl_e **);
88
89
/*
90
 * Compare two acl rules for relation
91
 */
92
93
#define CMP(n, a, b)                                                    \
94
        do {                                                            \
95
                if ((a) < (b))                                          \
96
                        return (enum acl_cmp_e)(-n);                    \
97
                else if ((b) < (a))                                     \
98
                        return (n);                                     \
99
        } while (0)
100
101
#define CMPA(a, b)                                                      \
102
        do {                                                            \
103
                if (((a) | 1) == (b))                                   \
104
                        return (ACL_LEFT);                              \
105
                else if (((b) | 1) == (a))                              \
106
                        return (ACL_RIGHT);                             \
107
        } while (0)
108
109
static void
110 168
vcl_acl_free(struct acl_e **aep)
111
{
112
        struct acl_e *a;
113
114 168
        TAKE_OBJ_NOTNULL(a, aep, VCC_ACL_E_MAGIC);
115 168
        free(a->addr);
116 168
        FREE_OBJ(a);
117 168
}
118
119
static enum acl_cmp_e
120 15400
vcl_acl_cmp(const struct acl_e *ae1, const struct acl_e *ae2)
121
{
122
        const unsigned char *p1, *p2;
123
        unsigned m;
124
        unsigned char a1, a2;
125
126 15400
        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
127 15400
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
128
129 15400
        p1 = ae1->data;
130 15400
        p2 = ae2->data;
131 15400
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
132 79576
        for (; m >= 8; m -= 8) {
133 72912
                if (m == 8 && ae1->mask == ae2->mask)
134 1596
                        CMPA(*p1, *p2);
135 136724
                CMP(ACL_GT, *p1, *p2);
136 64176
                p1++;
137 64176
                p2++;
138 64176
        }
139 6664
        if (m) {
140 6384
                assert (m < 8);
141 6384
                a1 = *p1 >> (8 - m);
142 6384
                a2 = *p2 >> (8 - m);
143 6384
                if (ae1->mask == ae2->mask)
144 1988
                        CMPA(a1, a2);
145 8624
                CMP(ACL_GT, a1, a2);
146 2996
        } else if (ae1->mask == ae2->mask) {
147 280
                CMPA(*p1, *p2);
148 140
        }
149
        /* Long mask is less than short mask */
150 3164
        CMP(ACL_CONTAINS, ae2->mask, ae1->mask);
151
152 168
        return (ACL_EQ);
153 15400
}
154
155
static int
156 2968
vcl_acl_disjoint(const struct acl_e *ae1, const struct acl_e *ae2)
157
{
158
        const unsigned char *p1, *p2;
159
        unsigned m;
160
161 2968
        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
162 2968
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
163
164 2968
        p1 = ae1->data;
165 2968
        p2 = ae2->data;
166 2968
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
167 21448
        for (; m >= 8; m -= 8) {
168 37828
                CMP(ACL_GT, *p1, *p2);
169 18480
                p1++;
170 18480
                p2++;
171 18480
        }
172 2100
        if (m) {
173 2016
                m = 0xff00 >> m;
174 2016
                m &= 0xff;
175 3752
                CMP(ACL_GT, *p1 & m, *p2 & m);
176 1736
        }
177 1820
        return (0);
178 2968
}
179
180 10164
VRBT_GENERATE_INSERT_COLOR(acl_tree, acl_e, branch, static)
181 5124
VRBT_GENERATE_INSERT_FINISH(acl_tree, acl_e, branch, static)
182 17444
VRBT_GENERATE_INSERT(acl_tree, acl_e, branch, vcl_acl_cmp, static)
183 1260
VRBT_GENERATE_REMOVE_COLOR(acl_tree, acl_e, branch, static)
184 2268
VRBT_GENERATE_REMOVE(acl_tree, acl_e, branch, static)
185 4956
VRBT_GENERATE_MINMAX(acl_tree, acl_e, branch, static)
186 16856
VRBT_GENERATE_NEXT(acl_tree, acl_e, branch, static)
187 13020
VRBT_GENERATE_PREV(acl_tree, acl_e, branch, static)
188
189
static char *
190 4928
vcc_acl_chk(struct vcc *tl, const struct acl_e *ae, const int l,
191
    unsigned char *p, int fam)
192
{
193
        const unsigned char *u;
194
        char h[VTCP_ADDRBUFSIZE];
195
        char t[VTCP_ADDRBUFSIZE + 10];
196 4928
        char s[vsa_suckaddr_len];
197 4928
        char *r = NULL;
198
        const struct suckaddr *sa;
199
        unsigned m;
200 4928
        int ll, ret = 0;
201
202 4928
        u = p;
203 4928
        ll = l;
204 4928
        m = ae->mask;
205
206 4928
        p += m / 8;
207 4928
        ll -= m / 8;
208 4928
        assert (ll >= 0);
209 4928
        m %= 8;
210
211 4928
        if (m && ((unsigned)*p << m & 0xff) != 0) {
212 112
                ret = 1;
213 112
                m = 0xff00 >> m;
214 112
                *p &= m;
215 112
        }
216 4928
        if (m) {
217 2772
                p++;
218 2772
                ll--;
219 2772
        }
220
221 9240
        for ( ; ll > 0; p++, ll--) {
222 4312
                if (*p == 0)
223 4172
                        continue;
224 140
                ret = 1;
225 140
                *p = 0;
226 140
        }
227 4928
        if (ret == 0)
228 4676
                return (NULL);
229
230 252
        sa = VSA_BuildFAP(s, fam, u, l, NULL, 0);
231 252
        AN(sa);
232 252
        VTCP_name(sa, h, sizeof h, NULL, 0);
233 252
        bprintf(t, "%s/%d", h, ae->mask);
234 252
        if (tl->acl->flag_pedantic != 0) {
235 56
                VSB_cat(tl->sb, "Non-zero bits in masked part, ");
236 56
                VSB_printf(tl->sb, "(maybe use %s ?)\n", t);
237 56
                vcc_ErrWhere(tl, ae->t_addr);
238 56
        }
239 252
        REPLACE(r, t);
240 252
        return (r);
241 4928
}
242
243
static void
244 5712
vcl_acl_fold(struct vcc *tl, struct acl_e **l, struct acl_e **r)
245
{
246
        enum acl_cmp_e cmp;
247
248 5712
        AN(l);
249 5712
        AN(r);
250 5712
        CHECK_OBJ_NOTNULL(*l, VCC_ACL_E_MAGIC);
251 5712
        CHECK_OBJ_NOTNULL(*r, VCC_ACL_E_MAGIC);
252
253 5712
        if ((*l)->not || (*r)->not)
254 2856
                return;
255
256 2856
        cmp = vcl_acl_cmp(*l, *r);
257
258 2856
        assert(cmp < 0);
259 2856
        if (cmp == ACL_LT)
260 1988
                return;
261
262 868
        do {
263 896
                switch (cmp) {
264
                case ACL_CONTAINED:
265 532
                        VSB_cat(tl->sb, "ACL entry:\n");
266 532
                        vcc_ErrWhere(tl, (*r)->t_addr);
267 532
                        VSB_cat(tl->sb, "supersedes / removes:\n");
268 532
                        vcc_ErrWhere(tl, (*l)->t_addr);
269 532
                        vcc_Warn(tl);
270 532
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
271 532
                        FREE_OBJ(*l);
272 532
                        *l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, *r);
273 532
                        break;
274
                case ACL_LEFT:
275 364
                        (*l)->mask--;
276 364
                        (*l)->fixed = "folded";
277 364
                        VSB_cat(tl->sb, "ACL entry:\n");
278 364
                        vcc_ErrWhere(tl, (*l)->t_addr);
279 364
                        VSB_cat(tl->sb, "left of:\n");
280 364
                        vcc_ErrWhere(tl, (*r)->t_addr);
281 728
                        VSB_printf(tl->sb, "removing the latter and expanding "
282
                            "mask of the former by one to /%u\n",
283 364
                            (*l)->mask - 8);
284 364
                        vcc_Warn(tl);
285 364
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *r);
286 364
                        FREE_OBJ(*r);
287 364
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
288 364
                        vcc_acl_insert_entry(tl, l);
289 364
                        return;
290
                default:
291 0
                        INCOMPL();
292 0
                }
293 532
                if (*l == NULL || *r == NULL || (*l)->not || (*r)->not)
294 308
                        break;
295 224
                cmp = vcl_acl_cmp(*l, *r);
296 224
        } while (cmp != ACL_LT);
297 5712
}
298
299
static void
300 5292
vcc_acl_insert_entry(struct vcc *tl, struct acl_e **aenp)
301
{
302
        struct acl_e *ae2, *l, *r;
303
304 5292
        CHECK_OBJ_NOTNULL(*aenp, VCC_ACL_E_MAGIC);
305 5292
        ae2 = VRBT_INSERT(acl_tree, &tl->acl->acl_tree, *aenp);
306 5292
        if (ae2 != NULL) {
307 168
                if (ae2->not != (*aenp)->not) {
308 28
                        VSB_cat(tl->sb, "Conflicting ACL entries:\n");
309 28
                        vcc_ErrWhere(tl, ae2->t_addr);
310 28
                        VSB_cat(tl->sb, "vs:\n");
311 28
                        vcc_ErrWhere(tl, (*aenp)->t_addr);
312 28
                }
313 168
                return;
314
        }
315
316 5124
        r = *aenp;
317 5124
        *aenp = NULL;
318
319 5124
        if (tl->acl->flag_fold == 0)
320 392
                return;
321
322 4732
        l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, r);
323 4732
        if (l != NULL) {
324 3472
                vcl_acl_fold(tl, &l, &r);
325 3472
        }
326 4732
        if (r == NULL)
327 224
                return;
328 4508
        l = r;
329 4508
        r = VRBT_NEXT(acl_tree, &tl->acl->acl_tree, l);
330 4508
        if (r == NULL)
331 2268
                return;
332 2240
        vcl_acl_fold(tl, &l, &r);
333 5292
}
334
335
static void
336 4984
vcc_acl_add_entry(struct vcc *tl, const struct acl_e *ae, int l,
337
    unsigned char *u, int fam)
338
{
339
        struct acl_e *aen;
340
341 4984
        if (fam == PF_INET && ae->mask > 32) {
342 56
                VSB_printf(tl->sb,
343 28
                    "Too wide mask (/%u) for IPv4 address\n", ae->mask);
344 28
                if (ae->t_mask != NULL)
345 28
                        vcc_ErrWhere(tl, ae->t_mask);
346
                else
347 0
                        vcc_ErrWhere(tl, ae->t_addr);
348 28
                return;
349
        }
350 4956
        if (fam == PF_INET6 && ae->mask > 128) {
351 56
                VSB_printf(tl->sb,
352 28
                    "Too wide mask (/%u) for IPv6 address\n", ae->mask);
353 28
                vcc_ErrWhere(tl, ae->t_mask);
354 28
                return;
355
        }
356
357
        /* Make a copy from the template */
358 4928
        ALLOC_OBJ(aen, VCC_ACL_E_MAGIC);
359 4928
        AN(aen);
360 4928
        *aen = *ae;
361 4928
        aen->addr = strdup(ae->addr);
362 4928
        AN(aen->addr);
363
364 4928
        aen->fixed = vcc_acl_chk(tl, ae, l, u, fam);
365
366
        /* We treat family as part of address, it saves code */
367 4928
        assert(fam <= 0xff);
368 4928
        aen->data[0] = fam & 0xff;
369 4928
        aen->mask += 8;
370
371 4928
        assert(l + 1UL <= sizeof aen->data);
372 4928
        memcpy(aen->data + 1L, u, l);
373
374 4928
        vcc_acl_insert_entry(tl, &aen);
375 4928
        if (aen != NULL)
376 168
                vcl_acl_free(&aen);
377 4984
}
378
379
static void
380 1596
vcc_acl_try_getaddrinfo(struct vcc *tl, struct acl_e *ae)
381
{
382
        struct addrinfo *res0, *res, hint;
383
        struct sockaddr_in *sin4;
384
        struct sockaddr_in6 *sin6;
385
        unsigned char *u, i4, i6;
386
        int error;
387
388 1596
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
389 1596
        memset(&hint, 0, sizeof hint);
390 1596
        hint.ai_family = PF_UNSPEC;
391 1596
        hint.ai_socktype = SOCK_STREAM;
392 1596
        error = getaddrinfo(ae->addr, "0", &hint, &res0);
393 1596
        if (error) {
394 112
                if (ae->para) {
395 112
                        VSB_printf(tl->sb,
396
                            "Warning: %s ignored\n  -- %s\n",
397 56
                            ae->addr, gai_strerror(error));
398 112
                        Fh(tl, 1, "/* Ignored ACL entry: %s%s",
399 56
                            ae->para ? "\"(\" " : "", ae->not ? "\"!\" " : "");
400 56
                        EncToken(tl->fh, ae->t_addr);
401 56
                        if (ae->t_mask)
402 28
                                Fh(tl, 0, "/%u", ae->mask);
403 56
                        Fh(tl, 0, "%s\n", ae->para ? " \")\"" : "");
404 112
                        Fh(tl, 1, " * getaddrinfo:  %s */\n",
405 56
                             gai_strerror(error));
406 56
                } else {
407 112
                        VSB_printf(tl->sb,
408
                            "DNS lookup(%s): %s\n",
409 56
                            ae->addr, gai_strerror(error));
410 56
                        vcc_ErrWhere(tl, ae->t_addr);
411
                }
412 112
                return;
413
        }
414
415 1484
        i4 = i6 = 0;
416 3024
        for (res = res0; res != NULL; res = res->ai_next) {
417 1540
                switch (res->ai_family) {
418
                case PF_INET:
419 56
                        i4++;
420 56
                        break;
421
                case PF_INET6:
422 1484
                        i6++;
423 1484
                        break;
424
                default:
425 0
                        VSB_printf(tl->sb,
426
                            "Ignoring unknown protocol family (%d) for %.*s\n",
427 0
                                res->ai_family, PF(ae->t_addr));
428 0
                        continue;
429
                }
430 1540
        }
431
432 1484
        if (ae->t_mask != NULL && i4 > 0 && i6 > 0) {
433 0
                VSB_printf(tl->sb,
434
                    "Mask (/%u) specified, but string resolves to"
435 0
                    " both IPv4 and IPv6 addresses.\n", ae->mask);
436 0
                vcc_ErrWhere(tl, ae->t_mask);
437 0
                freeaddrinfo(res0);
438 0
                return;
439
        }
440
441 2968
        for (res = res0; res != NULL; res = res->ai_next) {
442 1540
                switch (res->ai_family) {
443
                case PF_INET:
444 56
                        assert(PF_INET < 256);
445 56
                        sin4 = (void*)res->ai_addr;
446 56
                        assert(sizeof(sin4->sin_addr) == 4);
447 56
                        u = (void*)&sin4->sin_addr;
448 56
                        if (ae->t_mask == NULL)
449 56
                                ae->mask = 32;
450 56
                        vcc_acl_add_entry(tl, ae, 4, u, res->ai_family);
451 56
                        break;
452
                case PF_INET6:
453 1484
                        assert(PF_INET6 < 256);
454 1484
                        sin6 = (void*)res->ai_addr;
455 1484
                        assert(sizeof(sin6->sin6_addr) == 16);
456 1484
                        u = (void*)&sin6->sin6_addr;
457 1484
                        if (ae->t_mask == NULL)
458 224
                                ae->mask = 128;
459 1484
                        vcc_acl_add_entry(tl, ae, 16, u, res->ai_family);
460 1484
                        break;
461
                default:
462 0
                        continue;
463
                }
464 1540
                if (tl->err)
465 56
                        freeaddrinfo(res0);
466 1540
                ERRCHK(tl);
467 1484
        }
468 1428
        freeaddrinfo(res0);
469
470 1596
}
471
472
/*--------------------------------------------------------------------
473
 * Ancient stupidity on the part of X/Open and other standards orgs
474
 * dictate that "192.168" be translated to 192.0.0.168.  Ever since
475
 * CIDR happened, "192.168/16" notation has been used, but apparently
476
 * no API supports parsing this, so roll our own.
477
 */
478
479
static int
480 5040
vcc_acl_try_netnotation(struct vcc *tl, struct acl_e *ae)
481
{
482
        unsigned char b[4];
483
        int i, j, k;
484
        unsigned u;
485
        const char *p;
486
487 5040
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
488 5040
        memset(b, 0, sizeof b);
489 5040
        p = ae->addr;
490 14840
        for (i = 0; i < 4; i++) {
491 14840
                j = sscanf(p, "%u%n", &u, &k);
492 14840
                if (j != 1)
493 1456
                        return (0);
494 13384
                if (u & ~0xff)
495 56
                        return (0);
496 13328
                b[i] = (unsigned char)u;
497 13328
                if (p[k] == '\0')
498 3444
                        break;
499 9884
                if (p[k] != '.')
500 84
                        return (0);
501 9800
                p += k + 1;
502 9800
        }
503 3444
        if (ae->t_mask == NULL)
504 784
                ae->mask = 8 + 8 * i;
505 3444
        vcc_acl_add_entry(tl, ae, 4, b, AF_INET);
506 3444
        return (1);
507 5040
}
508
509
static void
510 5152
vcc_acl_entry(struct vcc *tl)
511
{
512
        struct acl_e ae[1];
513
        char *sl, *e;
514
515 5152
        INIT_OBJ(ae, VCC_ACL_E_MAGIC);
516
517 5152
        if (tl->t->tok == '!') {
518 1176
                ae->not = 1;
519 1176
                vcc_NextToken(tl);
520 1176
        }
521
522 5152
        if (tl->t->tok == '(') {
523 84
                ae->para = 1;
524 84
                vcc_NextToken(tl);
525 84
        }
526
527 5152
        if (!ae->not && tl->t->tok == '!') {
528 28
                ae->not = 1;
529 28
                vcc_NextToken(tl);
530 28
        }
531
532 5152
        ExpectErr(tl, CSTR);
533 5152
        ae->t_addr = tl->t;
534 5152
        ae->addr = ae->t_addr->dec;
535 5152
        vcc_NextToken(tl);
536
537 5152
        if (strchr(ae->t_addr->dec, '/') != NULL) {
538 84
                sl = strchr(ae->addr, '/');
539 84
                AN(sl);
540 84
                *sl++ = '\0';
541 84
                e = NULL;
542 84
                ae->mask = strtoul(sl, &e, 10);
543 84
                if (*e != '\0') {
544 56
                        VSB_cat(tl->sb, ".../mask is not numeric.\n");
545 56
                        vcc_ErrWhere(tl, ae->t_addr);
546 56
                        return;
547
                }
548 28
                ae->t_mask = ae->t_addr;
549 28
                if (tl->t->tok == '/') {
550 28
                        VSB_cat(tl->sb, "/mask only allowed once.\n");
551 28
                        vcc_ErrWhere(tl, tl->t);
552 28
                        return;
553
                }
554 5068
        } else if (tl->t->tok == '/') {
555 3948
                vcc_NextToken(tl);
556 3948
                ae->t_mask = tl->t;
557 3948
                ExpectErr(tl, CNUM);
558 3948
                ae->mask = vcc_UintVal(tl);
559 3948
        }
560
561 5068
        if (ae->para)
562 84
                SkipToken(tl, ')');
563
564 5040
        if (!vcc_acl_try_netnotation(tl, ae)) {
565 1596
                ERRCHK(tl);
566 1596
                vcc_acl_try_getaddrinfo(tl, ae);
567 1596
        }
568 5040
        ERRCHK(tl);
569 5152
}
570
571
/*********************************************************************
572
 * Emit the tokens making up an entry as C-strings
573
 */
574
575
static void
576 1484
vcc_acl_emit_tokens(const struct vcc *tl, const struct acl_e *ae)
577
{
578
        struct token *t;
579 1484
        const char *sep = "";
580
581 1484
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
582 1484
        t = ae->t_addr;
583 1484
        do {
584 4340
                if (t->tok == CSTR) {
585 1484
                        Fh(tl, 0, "%s\"\\\"\" ", sep);
586 1484
                        EncToken(tl->fh, t);
587 1484
                        Fh(tl, 0, " \"\\\"\"");
588 4340
                } else if (t == ae->t_mask) {
589 1428
                        Fh(tl, 0, " \"%u\"", ae->mask - 8);
590 1428
                } else {
591 1428
                        Fh(tl, 0, "%s\"%.*s\"", sep, PF(t));
592
                }
593 4340
                if (t == ae->t_mask)
594 1428
                        break;
595 2912
                t = vcc_PeekTokenFrom(tl, t);
596 2912
                AN(t);
597 2912
                sep = " ";
598 2912
        } while (ae->t_mask != NULL);
599 1484
        if (ae->fixed)
600 280
                Fh(tl, 0, "\" fixed: %s\"", ae->fixed);
601 1484
}
602
603
/*********************************************************************
604
 * Emit ACL on table format
605
 */
606
607
static unsigned
608 56
vcc_acl_emit_tables(const struct vcc *tl, unsigned n, const char *name)
609
{
610
        struct acl_e *ae;
611 56
        unsigned rv = sizeof(ae->data) + 3;
612 56
        unsigned nn = 0;
613
        size_t sz;
614
615 112
        Fh(tl, 0, "\nstatic unsigned char acl_tbl_%s[%u*%u] = {\n",
616 56
            name, n, rv);
617 1288
        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
618 1232
                if (ae->overlapped)
619 1008
                        continue;
620 224
                Fh(tl, 0, "\t0x%02x,", ae->not ? 0 : 1);
621 224
                Fh(tl, 0, "0x%02x,", (ae->mask >> 3) - 1);
622 224
                Fh(tl, 0, "0x%02x,", (0xff00 >> (ae->mask & 7)) & 0xff);
623 4032
                for (sz = 0; sz < sizeof(ae->data); sz++)
624 3808
                        Fh(tl, 0, "0x%02x,", ae->data[sz]);
625 224
                for (; sz < rv - 3; sz++)
626 0
                        Fh(tl, 0, "0,");
627 224
                Fh(tl, 0, "\n");
628 224
                nn++;
629 224
        }
630 56
        assert(n == nn);
631 56
        Fh(tl, 0, "};\n");
632 56
        if (tl->acl->flag_log) {
633 56
                Fh(tl, 0, "\nstatic const char *acl_str_%s[%d] = {\n",
634 28
                    name, n);
635 644
                VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
636 616
                        if (ae->overlapped)
637 504
                                continue;
638 112
                        Fh(tl, 0, "\t");
639 224
                        Fh(tl, 0, "\"%sMATCH %s \" ",
640 112
                            ae->not ? "NEG_" : "", name);
641 112
                        vcc_acl_emit_tokens(tl, ae);
642 112
                        Fh(tl, 0, ",\n");
643 112
                }
644 28
                Fh(tl, 0, "};\n");
645 28
        }
646 56
        return (rv);
647
}
648
649
/*********************************************************************
650
 * Emit a function to match the ACL we have collected
651
 */
652
653
static void
654 812
vcc_acl_emit(struct vcc *tl, const struct symbol *sym)
655
{
656
        struct acl_e *ae, *ae2;
657
        int depth, l, m, i;
658
        unsigned at[ACL_MAXADDR];
659 812
        struct inifin *ifp = NULL;
660
        struct vsb *func;
661 812
        unsigned n, no, nw = 0;
662
663 812
        func = VSB_new_auto();
664 812
        AN(func);
665 812
        VSB_cat(func, "match_acl_");
666 812
        VCC_PrintCName(func, sym->name, NULL);
667 812
        AZ(VSB_finish(func));
668
669 812
        depth = -1;
670 812
        at[0] = 256;
671 812
        ae2 = NULL;
672 812
        n = no = 0;
673 4564
        VRBT_FOREACH_REVERSE(ae, acl_tree, &tl->acl->acl_tree) {
674 3752
                n++;
675 3752
                if (ae2 == NULL) {
676 784
                        ae2 = ae;
677 3752
                } else if (vcl_acl_disjoint(ae, ae2)) {
678 1148
                        ae2 = ae;
679 1148
                } else {
680 1820
                        no++;
681 1820
                        ae->overlapped = 1;
682
                }
683 3752
        }
684
685 812
        Fh(tl, 0, "/* acl_n_%s n %u no %u */\n", sym->name, n, no);
686 812
        if (n - no < (1<<1))
687 420
                no = n;
688 392
        else if (!tl->acl->flag_table)
689 336
                no = n;
690
691 812
        if (no < n)
692 56
                nw = vcc_acl_emit_tables(tl, n - no, sym->name);
693
694
695 812
        Fh(tl, 0, "\nstatic int v_matchproto_(acl_match_f)\n");
696 812
        Fh(tl, 0, "%s(VRT_CTX, const VCL_IP p)\n", VSB_data(func));
697 812
        Fh(tl, 0, "{\n");
698 812
        Fh(tl, 0, "\tconst unsigned char *a;\n");
699 812
        Fh(tl, 0, "\tint fam;\n");
700 812
        Fh(tl, 0, "\n");
701 812
        Fh(tl, 0, "\tfam = VRT_VSA_GetPtr(ctx, p, &a);\n");
702 812
        Fh(tl, 0, "\tif (fam < 0) {\n");
703 812
        Fh(tl, 0, "\t\tVRT_fail(ctx,");
704 812
        Fh(tl, 0, " \"ACL %s: no protocol family\");\n", sym->name);
705 812
        Fh(tl, 0, "\t\treturn(0);\n");
706 812
        Fh(tl, 0, "\t}\n\n");
707 812
        if (!tl->err_unref) {
708 56
                ifp = New_IniFin(tl);
709 112
                VSB_printf(ifp->ini,
710 56
                        "\t(void)%s;\n", VSB_data(func));
711 56
        }
712
713 4564
        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
714
715 3752
                if (no < n && !ae->overlapped)
716 224
                        continue;
717
718
                /* Find how much common prefix we have */
719 19908
                for (l = 0; l <= depth && l * 8 < (int)ae->mask - 7; l++) {
720 17752
                        assert(l >= 0);
721 17752
                        if (ae->data[l] != at[l])
722 1372
                                break;
723 16380
                }
724
725
                /* Back down, if necessary */
726 8288
                while (l <= depth) {
727 4760
                        Fh(tl, 0, "\t%*s}\n", -depth, "");
728 4760
                        depth--;
729
                }
730
731 3528
                m = (int)ae->mask;
732 3528
                assert(m >= l*8);
733 3528
                m -= l * 8;
734
735
                /* Do whole byte compares */
736 13104
                for (i = l; m >= 8; m -= 8, i++) {
737 9576
                        if (i == 0)
738 2240
                                Fh(tl, 0, "\t%*s%sif (fam == %d) {\n",
739 1120
                                    -i, "", "", ae->data[i]);
740
                        else
741 16912
                                Fh(tl, 0, "\t%*s%sif (a[%d] == %d) {\n",
742 8456
                                    -i, "", "", i - 1, ae->data[i]);
743 9576
                        at[i] = ae->data[i];
744 9576
                        depth = i;
745 9576
                }
746
747 3528
                if (m > 0) {
748
                        // XXX can remove masking due to fixup
749
                        /* Do fractional byte compares */
750 4256
                        Fh(tl, 0, "\t%*s%sif ((a[%d] & 0x%x) == %d) {\n",
751 2128
                            -i, "", "", i - 1, (0xff00 >> m) & 0xff,
752 2128
                            ae->data[i] & ((0xff00 >> m) & 0xff));
753 2128
                        at[i] = 256;
754 2128
                        depth = i;
755 2128
                }
756
757 3528
                i = ((int)ae->mask + 7) / 8;
758
759 3528
                if (tl->acl->flag_log) {
760 2744
                        Fh(tl, 0, "\t%*sVPI_acl_log(ctx, \"%sMATCH %s \" ",
761 1372
                            -i, "", ae->not ? "NEG_" : "", sym->name);
762 1372
                        vcc_acl_emit_tokens(tl, ae);
763 1372
                        Fh(tl, 0, ");\n");
764 1372
                }
765
766 3528
                Fh(tl, 0, "\t%*sreturn (%d);\n", -i, "", ae->not ? 0 : 1);
767 3528
        }
768
769
        /* Unwind */
770 7756
        for (; 0 <= depth; depth--)
771 6944
                Fh(tl, 0, "\t%*.*s}\n", depth, depth, "");
772
773 812
        if (no < n) {
774 56
                Fh(tl, 0, "\treturn(\n\t    VPI_acl_table(ctx,\n");
775 56
                Fh(tl, 0, "\t\tp,\n");
776 56
                Fh(tl, 0, "\t\t%u, %u,\n", n - no, nw);
777 56
                Fh(tl, 0, "\t\tacl_tbl_%s,\n", sym->name);
778 56
                if (tl->acl->flag_log)
779 28
                        Fh(tl, 0, "\t\tacl_str_%s,\n", sym->name);
780
                else
781 28
                        Fh(tl, 0, "\t\tNULL,\n");
782 56
                Fh(tl, 0, "\t\t\"NO MATCH %s\"\n\t    )\n\t);\n", sym->name);
783 56
        } else {
784
                /* Deny by default */
785 756
                if (tl->acl->flag_log)
786 224
                        Fh(tl, 0, "\tVPI_acl_log(ctx, \"NO_MATCH %s\");\n",
787 112
                            sym->name);
788 756
                Fh(tl, 0, "\treturn(0);\n");
789
        }
790 812
        Fh(tl, 0, "}\n");
791
792
        /* Emit the struct that will be referenced */
793 812
        Fh(tl, 0, "\nstatic const struct vrt_acl %s[] = {{\n", sym->rname);
794 812
        Fh(tl, 0, "\t.magic = VRT_ACL_MAGIC,\n");
795 812
        Fh(tl, 0, "\t.match = &%s,\n", VSB_data(func));
796 812
        Fh(tl, 0, "\t.name = \"%s\",\n", sym->name);
797 812
        Fh(tl, 0, "}};\n\n");
798 812
        if (!tl->err_unref) {
799 56
                AN(ifp);
800 56
                VSB_printf(ifp->ini, "\t(void)%s;", sym->rname);
801 56
        }
802 812
        VSB_destroy(&func);
803 812
}
804
805
void
806 1232
vcc_ParseAcl(struct vcc *tl)
807
{
808
        struct symbol *sym;
809
        int sign;
810
        struct acl acl[1];
811
812 1232
        INIT_OBJ(acl, VCC_ACL_MAGIC);
813 1232
        tl->acl = acl;
814 1232
        acl->flag_pedantic = 1;
815 1232
        acl->flag_fold = 1;
816 1232
        vcc_NextToken(tl);
817 1232
        VRBT_INIT(&acl->acl_tree);
818
819 1232
        vcc_ExpectVid(tl, "ACL");
820 1232
        ERRCHK(tl);
821 1204
        sym = VCC_HandleSymbol(tl, ACL);
822 1204
        ERRCHK(tl);
823 1204
        AN(sym);
824
825
#define FLAGS_MSG "Valid ACL flags are `log`, `fold`, `pedantic` and `table`:\n"
826
827 1680
        while (1) {
828 1680
                sign = vcc_IsFlag(tl);
829 1680
                if (tl->err) {
830 28
                        VSB_cat(tl->sb, FLAGS_MSG);
831 28
                        return;
832
                }
833 1652
                if (sign < 0)
834 1148
                        break;
835 504
                if (vcc_IdIs(tl->t, "log")) {
836 140
                        acl->flag_log = sign;
837 140
                        vcc_NextToken(tl);
838 504
                } else if (vcc_IdIs(tl->t, "fold")) {
839 56
                        acl->flag_fold = sign;
840 56
                        vcc_NextToken(tl);
841 364
                } else if (vcc_IdIs(tl->t, "pedantic")) {
842 224
                        acl->flag_pedantic = sign;
843 224
                        vcc_NextToken(tl);
844 308
                } else if (vcc_IdIs(tl->t, "table")) {
845 56
                        acl->flag_table = sign;
846 56
                        vcc_NextToken(tl);
847 56
                } else {
848 28
                        VSB_cat(tl->sb, "Unknown ACL flag. " FLAGS_MSG);
849 28
                        vcc_ErrWhere(tl, tl->t);
850 28
                        return;
851
                }
852
        }
853
854
#undef FLAGS_MSG
855
856 1148
        SkipToken(tl, '{');
857
858 5964
        while (tl->t->tok != '}') {
859 5152
                vcc_acl_entry(tl);
860 5152
                ERRCHK(tl);
861 4844
                SkipToken(tl, ';');
862
        }
863 812
        SkipToken(tl, '}');
864
865 812
        vcc_acl_emit(tl, sym);
866 1232
}