varnish-cache/lib/libvcc/vcc_acl.c
0
/*-
1
 * Copyright (c) 2006 Verdens Gang AS
2
 * Copyright (c) 2006-2010 Varnish Software AS
3
 * All rights reserved.
4
 *
5
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6
 *
7
 * SPDX-License-Identifier: BSD-2-Clause
8
 *
9
 * Redistribution and use in source and binary forms, with or without
10
 * modification, are permitted provided that the following conditions
11
 * are met:
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 * 2. Redistributions in binary form must reproduce the above copyright
15
 *    notice, this list of conditions and the following disclaimer in the
16
 *    documentation and/or other materials provided with the distribution.
17
 *
18
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
22
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28
 * SUCH DAMAGE.
29
 */
30
31
#include "config.h"
32
33
#include <sys/socket.h>
34
35
#include <netinet/in.h>
36
37
#include <netdb.h>
38
#include <stdlib.h>
39
#include <string.h>
40
41
#include "vcc_compile.h"
42
#include <vtcp.h>
43
#include <vtree.h>
44
#include <vsa.h>
45
46
#define ACL_MAXADDR     (sizeof(struct in6_addr) + 1)
47
48
VRBT_HEAD(acl_tree, acl_e);
49
50
struct acl {
51
        unsigned                magic;
52
#define VCC_ACL_MAGIC           0xb9fb3cd0
53
54
        int                     flag_log;
55
        int                     flag_fold;
56
        int                     flag_pedantic;
57
        int                     flag_table;
58
59
        struct acl_tree         acl_tree;
60
};
61
62
struct acl_e {
63
        unsigned                magic;
64
#define VCC_ACL_E_MAGIC 0xcac81e23
65
        VRBT_ENTRY(acl_e)       branch;
66
        unsigned char           data[ACL_MAXADDR];
67
        unsigned                mask;
68
        unsigned                not;
69
        unsigned                para;
70
        unsigned                overlapped;
71
        char                    *addr;
72
        const char              *fixed;
73
        struct token            *t_addr;
74
        struct token            *t_mask;
75
};
76
77
enum acl_cmp_e {
78
        ACL_EQ = 0,
79
        ACL_LT = -1,            // a < b
80
        ACL_GT = 1,             // b > a
81
        ACL_CONTAINED = -2,     // b contains a
82
        ACL_CONTAINS = 2,       // a contains b
83
        ACL_LEFT = -3,          // a + 1 == b
84
        ACL_RIGHT = 3           // a == b + 1
85
};
86
87
static void vcc_acl_insert_entry(struct vcc *, struct acl_e **);
88
89
/*
90
 * Compare two acl rules for relation
91
 */
92
93
#define CMP(n, a, b)                                                    \
94
        do {                                                            \
95
                if ((a) < (b))                                          \
96
                        return (enum acl_cmp_e)(-n);                    \
97
                else if ((b) < (a))                                     \
98
                        return (n);                                     \
99
        } while (0)
100
101
#define CMPA(a, b)                                                      \
102
        do {                                                            \
103
                if (((a) | 1) == (b))                                   \
104
                        return (ACL_LEFT);                              \
105
                else if (((b) | 1) == (a))                              \
106
                        return (ACL_RIGHT);                             \
107
        } while (0)
108
109
static void
110 72
vcl_acl_free(struct acl_e **aep)
111
{
112
        struct acl_e *a;
113
114 72
        TAKE_OBJ_NOTNULL(a, aep, VCC_ACL_E_MAGIC);
115 72
        free(a->addr);
116 72
        FREE_OBJ(a);
117 72
}
118
119
static enum acl_cmp_e
120 5916
vcl_acl_cmp(const struct acl_e *ae1, const struct acl_e *ae2)
121
{
122
        const unsigned char *p1, *p2;
123
        unsigned m;
124
        unsigned char a1, a2;
125
126 5916
        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
127 5916
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
128
129 5916
        p1 = ae1->data;
130 5916
        p2 = ae2->data;
131 5916
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
132 30852
        for (; m >= 8; m -= 8) {
133 28188
                if (m == 8 && ae1->mask == ae2->mask)
134 468
                        CMPA(*p1, *p2);
135 53016
                CMP(ACL_GT, *p1, *p2);
136 24936
                p1++;
137 24936
                p2++;
138 24936
        }
139 2664
        if (m) {
140 2544
                assert (m < 8);
141 2544
                a1 = *p1 >> (8 - m);
142 2544
                a2 = *p2 >> (8 - m);
143 2544
                if (ae1->mask == ae2->mask)
144 816
                        CMPA(a1, a2);
145 3408
                CMP(ACL_GT, a1, a2);
146 1176
        } else if (ae1->mask == ae2->mask) {
147 120
                CMPA(*p1, *p2);
148 60
        }
149
        /* Long mask is less than short mask */
150 1248
        CMP(ACL_CONTAINS, ae2->mask, ae1->mask);
151
152 72
        return (ACL_EQ);
153 5916
}
154
155
static int
156 1380
vcl_acl_disjoint(const struct acl_e *ae1, const struct acl_e *ae2)
157
{
158
        const unsigned char *p1, *p2;
159
        unsigned m;
160
161 1380
        CHECK_OBJ_NOTNULL(ae1, VCC_ACL_E_MAGIC);
162 1380
        CHECK_OBJ_NOTNULL(ae2, VCC_ACL_E_MAGIC);
163
164 1380
        p1 = ae1->data;
165 1380
        p2 = ae2->data;
166 1380
        m = vmin_t(unsigned, ae1->mask, ae2->mask);
167 10584
        for (; m >= 8; m -= 8) {
168 18744
                CMP(ACL_GT, *p1, *p2);
169 9204
                p1++;
170 9204
                p2++;
171 9204
        }
172 1044
        if (m) {
173 960
                m = 0xff00 >> m;
174 960
                m &= 0xff;
175 1812
                CMP(ACL_GT, *p1 & m, *p2 & m);
176 852
        }
177 936
        return (0);
178 1380
}
179
180 4212
VRBT_GENERATE_INSERT_COLOR(acl_tree, acl_e, branch, static)
181 2028
VRBT_GENERATE_INSERT_FINISH(acl_tree, acl_e, branch, static)
182 7344
VRBT_GENERATE_INSERT(acl_tree, acl_e, branch, vcl_acl_cmp, static)
183 348
VRBT_GENERATE_REMOVE_COLOR(acl_tree, acl_e, branch, static)
184 588
VRBT_GENERATE_REMOVE(acl_tree, acl_e, branch, static)
185 1992
VRBT_GENERATE_MINMAX(acl_tree, acl_e, branch, static)
186 5304
VRBT_GENERATE_NEXT(acl_tree, acl_e, branch, static)
187 3300
VRBT_GENERATE_PREV(acl_tree, acl_e, branch, static)
188
189
static char *
190 1992
vcc_acl_chk(struct vcc *tl, const struct acl_e *ae, const int l,
191
    unsigned char *p, int fam)
192
{
193
        const unsigned char *u;
194
        char h[VTCP_ADDRBUFSIZE];
195
        char t[VTCP_ADDRBUFSIZE + 10];
196 1992
        char s[vsa_suckaddr_len];
197 1992
        char *r = NULL;
198
        const struct suckaddr *sa;
199
        unsigned m;
200 1992
        int ll, ret = 0;
201
202 1992
        u = p;
203 1992
        ll = l;
204 1992
        m = ae->mask;
205
206 1992
        p += m / 8;
207 1992
        ll -= m / 8;
208 1992
        assert (ll >= 0);
209 1992
        m %= 8;
210
211 1992
        if (m && ((unsigned)*p << m & 0xff) != 0) {
212 48
                ret = 1;
213 48
                m = 0xff00 >> m;
214 48
                *p &= m;
215 48
        }
216 1992
        if (m) {
217 1140
                p++;
218 1140
                ll--;
219 1140
        }
220
221 3768
        for ( ; ll > 0; p++, ll--) {
222 1776
                if (*p == 0)
223 1716
                        continue;
224 60
                ret = 1;
225 60
                *p = 0;
226 60
        }
227 1992
        if (ret == 0)
228 1884
                return (NULL);
229
230 108
        sa = VSA_BuildFAP(s, fam, u, l, NULL, 0);
231 108
        AN(sa);
232 108
        VTCP_name(sa, h, sizeof h, NULL, 0);
233 108
        bprintf(t, "%s/%d", h, ae->mask);
234 108
        if (tl->acl->flag_pedantic != 0) {
235 24
                VSB_cat(tl->sb, "Non-zero bits in masked part, ");
236 24
                VSB_printf(tl->sb, "(maybe use %s ?)\n", t);
237 24
                vcc_ErrWhere(tl, ae->t_addr);
238 24
        }
239 108
        REPLACE(r, t);
240 108
        return (r);
241 1992
}
242
243
static void
244 528
vcl_acl_fold(struct vcc *tl, struct acl_e **l, struct acl_e **r)
245
{
246
        enum acl_cmp_e cmp;
247
248 528
        AN(l);
249 528
        AN(r);
250 528
        CHECK_OBJ_NOTNULL(*l, VCC_ACL_E_MAGIC);
251 528
        CHECK_OBJ_NOTNULL(*r, VCC_ACL_E_MAGIC);
252
253 528
        if ((*l)->not || (*r)->not)
254 0
                return;
255
256 528
        cmp = vcl_acl_cmp(*l, *r);
257
258 528
        assert(cmp < 0);
259 528
        if (cmp == ACL_LT)
260 348
                return;
261
262 180
        do {
263 192
                switch (cmp) {
264
                case ACL_CONTAINED:
265 84
                        VSB_cat(tl->sb, "ACL entry:\n");
266 84
                        vcc_ErrWhere(tl, (*r)->t_addr);
267 84
                        VSB_cat(tl->sb, "supersedes / removes:\n");
268 84
                        vcc_ErrWhere(tl, (*l)->t_addr);
269 84
                        vcc_Warn(tl);
270 84
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
271 84
                        FREE_OBJ(*l);
272 84
                        *l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, *r);
273 84
                        break;
274
                case ACL_LEFT:
275 108
                        (*l)->mask--;
276 108
                        (*l)->fixed = "folded";
277 108
                        VSB_cat(tl->sb, "ACL entry:\n");
278 108
                        vcc_ErrWhere(tl, (*l)->t_addr);
279 108
                        VSB_cat(tl->sb, "left of:\n");
280 108
                        vcc_ErrWhere(tl, (*r)->t_addr);
281 216
                        VSB_printf(tl->sb, "removing the latter and expanding "
282
                            "mask of the former by one to /%u\n",
283 108
                            (*l)->mask - 8);
284 108
                        vcc_Warn(tl);
285 108
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *r);
286 108
                        FREE_OBJ(*r);
287 108
                        VRBT_REMOVE(acl_tree, &tl->acl->acl_tree, *l);
288 108
                        vcc_acl_insert_entry(tl, l);
289 108
                        return;
290
                default:
291 0
                        INCOMPL();
292 0
                }
293 84
                if (*l == NULL || *r == NULL)
294 12
                        break;
295 72
                cmp = vcl_acl_cmp(*l, *r);
296 72
        } while (cmp != ACL_LT);
297 528
}
298
299
static void
300 2100
vcc_acl_insert_entry(struct vcc *tl, struct acl_e **aenp)
301
{
302
        struct acl_e *ae2, *l, *r;
303
304 2100
        CHECK_OBJ_NOTNULL(*aenp, VCC_ACL_E_MAGIC);
305 2100
        ae2 = VRBT_INSERT(acl_tree, &tl->acl->acl_tree, *aenp);
306 2100
        if (ae2 != NULL) {
307 72
                if (ae2->not != (*aenp)->not) {
308 12
                        VSB_cat(tl->sb, "Conflicting ACL entries:\n");
309 12
                        vcc_ErrWhere(tl, ae2->t_addr);
310 12
                        VSB_cat(tl->sb, "vs:\n");
311 12
                        vcc_ErrWhere(tl, (*aenp)->t_addr);
312 12
                }
313 72
                return;
314
        }
315
316 2028
        r = *aenp;
317 2028
        *aenp = NULL;
318
319 2028
        if (tl->acl->flag_fold == 0)
320 1584
                return;
321
322 444
        l = VRBT_PREV(acl_tree, &tl->acl->acl_tree, r);
323 444
        if (l != NULL) {
324 420
                vcl_acl_fold(tl, &l, &r);
325 420
        }
326 444
        if (r == NULL)
327 96
                return;
328 348
        l = r;
329 348
        r = VRBT_NEXT(acl_tree, &tl->acl->acl_tree, l);
330 348
        if (r == NULL)
331 240
                return;
332 108
        vcl_acl_fold(tl, &l, &r);
333 2100
}
334
335
static void
336 2016
vcc_acl_add_entry(struct vcc *tl, const struct acl_e *ae, int l,
337
    unsigned char *u, int fam)
338
{
339
        struct acl_e *aen;
340
341 2016
        if (fam == PF_INET && ae->mask > 32) {
342 24
                VSB_printf(tl->sb,
343 12
                    "Too wide mask (/%u) for IPv4 address\n", ae->mask);
344 12
                if (ae->t_mask != NULL)
345 12
                        vcc_ErrWhere(tl, ae->t_mask);
346
                else
347 0
                        vcc_ErrWhere(tl, ae->t_addr);
348 12
                return;
349
        }
350 2004
        if (fam == PF_INET6 && ae->mask > 128) {
351 24
                VSB_printf(tl->sb,
352 12
                    "Too wide mask (/%u) for IPv6 address\n", ae->mask);
353 12
                vcc_ErrWhere(tl, ae->t_mask);
354 12
                return;
355
        }
356
357
        /* Make a copy from the template */
358 1992
        ALLOC_OBJ(aen, VCC_ACL_E_MAGIC);
359 1992
        AN(aen);
360 1992
        *aen = *ae;
361 1992
        aen->addr = strdup(ae->addr);
362 1992
        AN(aen->addr);
363
364 1992
        aen->fixed = vcc_acl_chk(tl, ae, l, u, fam);
365
366
        /* We treat family as part of address, it saves code */
367 1992
        assert(fam <= 0xff);
368 1992
        aen->data[0] = fam & 0xff;
369 1992
        aen->mask += 8;
370
371 1992
        assert(l + 1UL <= sizeof aen->data);
372 1992
        memcpy(aen->data + 1L, u, l);
373
374 1992
        vcc_acl_insert_entry(tl, &aen);
375 1992
        if (aen != NULL)
376 72
                vcl_acl_free(&aen);
377 2016
}
378
379
static void
380 660
vcc_acl_try_getaddrinfo(struct vcc *tl, struct acl_e *ae)
381
{
382
        struct addrinfo *res0, *res, hint;
383
        struct sockaddr_in *sin4;
384
        struct sockaddr_in6 *sin6;
385
        unsigned char *u, i4, i6;
386
        int error;
387
388 660
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
389 660
        memset(&hint, 0, sizeof hint);
390 660
        hint.ai_family = PF_UNSPEC;
391 660
        hint.ai_socktype = SOCK_STREAM;
392 660
        error = getaddrinfo(ae->addr, "0", &hint, &res0);
393 660
        if (error) {
394 48
                if (ae->para) {
395 48
                        VSB_printf(tl->sb,
396
                            "Warning: %s ignored\n  -- %s\n",
397 24
                            ae->addr, gai_strerror(error));
398 48
                        Fh(tl, 1, "/* Ignored ACL entry: %s%s",
399 24
                            ae->para ? "\"(\" " : "", ae->not ? "\"!\" " : "");
400 24
                        EncToken(tl->fh, ae->t_addr);
401 24
                        if (ae->t_mask)
402 12
                                Fh(tl, 0, "/%u", ae->mask);
403 24
                        Fh(tl, 0, "%s\n", ae->para ? " \")\"" : "");
404 48
                        Fh(tl, 1, " * getaddrinfo:  %s */\n",
405 24
                             gai_strerror(error));
406 24
                } else {
407 48
                        VSB_printf(tl->sb,
408
                            "DNS lookup(%s): %s\n",
409 24
                            ae->addr, gai_strerror(error));
410 24
                        vcc_ErrWhere(tl, ae->t_addr);
411
                }
412 48
                return;
413
        }
414
415 612
        i4 = i6 = 0;
416 1248
        for (res = res0; res != NULL; res = res->ai_next) {
417 636
                switch (res->ai_family) {
418
                case PF_INET:
419 24
                        i4++;
420 24
                        break;
421
                case PF_INET6:
422 612
                        i6++;
423 612
                        break;
424
                default:
425 0
                        VSB_printf(tl->sb,
426
                            "Ignoring unknown protocol family (%d) for %.*s\n",
427 0
                                res->ai_family, PF(ae->t_addr));
428 0
                        continue;
429
                }
430 636
        }
431
432 612
        if (ae->t_mask != NULL && i4 > 0 && i6 > 0) {
433 0
                VSB_printf(tl->sb,
434
                    "Mask (/%u) specified, but string resolves to"
435 0
                    " both IPv4 and IPv6 addresses.\n", ae->mask);
436 0
                vcc_ErrWhere(tl, ae->t_mask);
437 0
                freeaddrinfo(res0);
438 0
                return;
439
        }
440
441 1224
        for (res = res0; res != NULL; res = res->ai_next) {
442 636
                switch (res->ai_family) {
443
                case PF_INET:
444 24
                        assert(PF_INET < 256);
445 24
                        sin4 = (void*)res->ai_addr;
446 24
                        assert(sizeof(sin4->sin_addr) == 4);
447 24
                        u = (void*)&sin4->sin_addr;
448 24
                        if (ae->t_mask == NULL)
449 24
                                ae->mask = 32;
450 24
                        vcc_acl_add_entry(tl, ae, 4, u, res->ai_family);
451 24
                        break;
452
                case PF_INET6:
453 612
                        assert(PF_INET6 < 256);
454 612
                        sin6 = (void*)res->ai_addr;
455 612
                        assert(sizeof(sin6->sin6_addr) == 16);
456 612
                        u = (void*)&sin6->sin6_addr;
457 612
                        if (ae->t_mask == NULL)
458 72
                                ae->mask = 128;
459 612
                        vcc_acl_add_entry(tl, ae, 16, u, res->ai_family);
460 612
                        break;
461
                default:
462 0
                        continue;
463
                }
464 636
                if (tl->err)
465 24
                        freeaddrinfo(res0);
466 636
                ERRCHK(tl);
467 612
        }
468 588
        freeaddrinfo(res0);
469
470 660
}
471
472
/*--------------------------------------------------------------------
473
 * Ancient stupidity on the part of X/Open and other standards orgs
474
 * dictate that "192.168" be translated to 192.0.0.168.  Ever since
475
 * CIDR happened, "192.168/16" notation has been used, but apparently
476
 * no API supports parsing this, so roll our own.
477
 */
478
479
static int
480 2040
vcc_acl_try_netnotation(struct vcc *tl, struct acl_e *ae)
481
{
482
        unsigned char b[4];
483
        int i, j, k;
484
        unsigned u;
485
        const char *p;
486
487 2040
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
488 2040
        memset(b, 0, sizeof b);
489 2040
        p = ae->addr;
490 5952
        for (i = 0; i < 4; i++) {
491 5952
                j = sscanf(p, "%u%n", &u, &k);
492 5952
                if (j != 1)
493 624
                        return (0);
494 5328
                if (u & ~0xff)
495 12
                        return (0);
496 5316
                b[i] = (unsigned char)u;
497 5316
                if (p[k] == '\0')
498 1380
                        break;
499 3936
                if (p[k] != '.')
500 24
                        return (0);
501 3912
                p += k + 1;
502 3912
        }
503 1380
        if (ae->t_mask == NULL)
504 312
                ae->mask = 8 + 8 * i;
505 1380
        vcc_acl_add_entry(tl, ae, 4, b, AF_INET);
506 1380
        return (1);
507 2040
}
508
509
static void
510 2088
vcc_acl_entry(struct vcc *tl)
511
{
512
        struct acl_e ae[1];
513
        char *sl, *e;
514
515 2088
        INIT_OBJ(ae, VCC_ACL_E_MAGIC);
516
517 2088
        if (tl->t->tok == '!') {
518 480
                ae->not = 1;
519 480
                vcc_NextToken(tl);
520 480
        }
521
522 2088
        if (tl->t->tok == '(') {
523 36
                ae->para = 1;
524 36
                vcc_NextToken(tl);
525 36
        }
526
527 2088
        if (!ae->not && tl->t->tok == '!') {
528 12
                ae->not = 1;
529 12
                vcc_NextToken(tl);
530 12
        }
531
532 2088
        ExpectErr(tl, CSTR);
533 2088
        ae->t_addr = tl->t;
534 2088
        ae->addr = ae->t_addr->dec;
535 2088
        vcc_NextToken(tl);
536
537 2088
        if (strchr(ae->t_addr->dec, '/') != NULL) {
538 36
                sl = strchr(ae->addr, '/');
539 36
                AN(sl);
540 36
                *sl++ = '\0';
541 36
                e = NULL;
542 36
                ae->mask = strtoul(sl, &e, 10);
543 36
                if (*e != '\0') {
544 24
                        VSB_cat(tl->sb, ".../mask is not numeric.\n");
545 24
                        vcc_ErrWhere(tl, ae->t_addr);
546 24
                        return;
547
                }
548 12
                ae->t_mask = ae->t_addr;
549 12
                if (tl->t->tok == '/') {
550 12
                        VSB_cat(tl->sb, "/mask only allowed once.\n");
551 12
                        vcc_ErrWhere(tl, tl->t);
552 12
                        return;
553
                }
554 2052
        } else if (tl->t->tok == '/') {
555 1620
                vcc_NextToken(tl);
556 1620
                ae->t_mask = tl->t;
557 1620
                ExpectErr(tl, CNUM);
558 1620
                ae->mask = vcc_UintVal(tl);
559 1620
        }
560
561 2052
        if (ae->para)
562 36
                SkipToken(tl, ')');
563
564 2040
        if (!vcc_acl_try_netnotation(tl, ae)) {
565 660
                ERRCHK(tl);
566 660
                vcc_acl_try_getaddrinfo(tl, ae);
567 660
        }
568 2040
        ERRCHK(tl);
569 2088
}
570
571
/*********************************************************************
572
 * Emit the tokens making up an entry as C-strings
573
 */
574
575
static void
576 612
vcc_acl_emit_tokens(const struct vcc *tl, const struct acl_e *ae)
577
{
578
        struct token *t;
579 612
        const char *sep = "";
580
581 612
        CHECK_OBJ_NOTNULL(ae, VCC_ACL_E_MAGIC);
582 612
        t = ae->t_addr;
583 612
        do {
584 1788
                if (t->tok == CSTR) {
585 612
                        Fh(tl, 0, "%s\"\\\"\" ", sep);
586 612
                        EncToken(tl->fh, t);
587 612
                        Fh(tl, 0, " \"\\\"\"");
588 1788
                } else if (t == ae->t_mask) {
589 588
                        Fh(tl, 0, " \"%u\"", ae->mask - 8);
590 588
                } else {
591 588
                        Fh(tl, 0, "%s\"%.*s\"", sep, PF(t));
592
                }
593 1788
                if (t == ae->t_mask)
594 588
                        break;
595 1200
                t = vcc_PeekTokenFrom(tl, t);
596 1200
                AN(t);
597 1200
                sep = " ";
598 1200
        } while (ae->t_mask != NULL);
599 612
        if (ae->fixed)
600 120
                Fh(tl, 0, "\" fixed: %s\"", ae->fixed);
601 612
}
602
603
/*********************************************************************
604
 * Emit ACL on table format
605
 */
606
607
static unsigned
608 24
vcc_acl_emit_tables(const struct vcc *tl, unsigned n, const char *name)
609
{
610
        struct acl_e *ae;
611 24
        unsigned rv = sizeof(ae->data) + 3;
612 24
        unsigned nn = 0;
613
        size_t sz;
614
615 48
        Fh(tl, 0, "\nstatic unsigned char acl_tbl_%s[%u*%u] = {\n",
616 24
            name, n, rv);
617 600
        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
618 576
                if (ae->overlapped)
619 480
                        continue;
620 96
                Fh(tl, 0, "\t0x%02x,", ae->not ? 0 : 1);
621 96
                Fh(tl, 0, "0x%02x,", (ae->mask >> 3) - 1);
622 96
                Fh(tl, 0, "0x%02x,", (0xff00 >> (ae->mask & 7)) & 0xff);
623 1728
                for (sz = 0; sz < sizeof(ae->data); sz++)
624 1632
                        Fh(tl, 0, "0x%02x,", ae->data[sz]);
625 96
                for (; sz < rv - 3; sz++)
626 0
                        Fh(tl, 0, "0,");
627 96
                Fh(tl, 0, "\n");
628 96
                nn++;
629 96
        }
630 24
        assert(n == nn);
631 24
        Fh(tl, 0, "};\n");
632 24
        if (tl->acl->flag_log) {
633 24
                Fh(tl, 0, "\nstatic const char *acl_str_%s[%d] = {\n",
634 12
                    name, n);
635 300
                VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
636 288
                        if (ae->overlapped)
637 240
                                continue;
638 48
                        Fh(tl, 0, "\t");
639 96
                        Fh(tl, 0, "\"%sMATCH %s \" ",
640 48
                            ae->not ? "NEG_" : "", name);
641 48
                        vcc_acl_emit_tokens(tl, ae);
642 48
                        Fh(tl, 0, ",\n");
643 48
                }
644 12
                Fh(tl, 0, "};\n");
645 12
        }
646 24
        return (rv);
647
}
648
649
/*********************************************************************
650
 * Emit a function to match the ACL we have collected
651
 */
652
653
static void
654 312
vcc_acl_emit(struct vcc *tl, const struct symbol *sym)
655
{
656
        struct acl_e *ae, *ae2;
657
        int depth, l, m, i;
658
        unsigned at[ACL_MAXADDR];
659 312
        struct inifin *ifp = NULL;
660
        struct vsb *func;
661 312
        unsigned n, no, nw = 0;
662
663 312
        func = VSB_new_auto();
664 312
        AN(func);
665 312
        VSB_cat(func, "match_acl_");
666 312
        VCC_PrintCName(func, sym->name, NULL);
667 312
        AZ(VSB_finish(func));
668
669 312
        depth = -1;
670 312
        at[0] = 256;
671 312
        ae2 = NULL;
672 312
        n = no = 0;
673 1992
        VRBT_FOREACH_REVERSE(ae, acl_tree, &tl->acl->acl_tree) {
674 1680
                n++;
675 1680
                if (ae2 == NULL) {
676 300
                        ae2 = ae;
677 1680
                } else if (vcl_acl_disjoint(ae, ae2)) {
678 444
                        ae2 = ae;
679 444
                } else {
680 936
                        no++;
681 936
                        ae->overlapped = 1;
682
                }
683 1680
        }
684
685 312
        Fh(tl, 0, "/* acl_n_%s n %u no %u */\n", sym->name, n, no);
686 312
        if (n - no < (1<<1))
687 180
                no = n;
688 132
        else if (!tl->acl->flag_table)
689 108
                no = n;
690
691 312
        if (no < n)
692 24
                nw = vcc_acl_emit_tables(tl, n - no, sym->name);
693
694
695 312
        Fh(tl, 0, "\nstatic int v_matchproto_(acl_match_f)\n");
696 312
        Fh(tl, 0, "%s(VRT_CTX, const VCL_IP p)\n", VSB_data(func));
697 312
        Fh(tl, 0, "{\n");
698 312
        Fh(tl, 0, "\tconst unsigned char *a;\n");
699 312
        Fh(tl, 0, "\tint fam;\n");
700 312
        Fh(tl, 0, "\n");
701 312
        Fh(tl, 0, "\tfam = VRT_VSA_GetPtr(ctx, p, &a);\n");
702 312
        Fh(tl, 0, "\tif (fam < 0) {\n");
703 312
        Fh(tl, 0, "\t\tVRT_fail(ctx,");
704 312
        Fh(tl, 0, " \"ACL %s: no protocol family\");\n", sym->name);
705 312
        Fh(tl, 0, "\t\treturn(0);\n");
706 312
        Fh(tl, 0, "\t}\n\n");
707 312
        if (!tl->err_unref) {
708 24
                ifp = New_IniFin(tl);
709 48
                VSB_printf(ifp->ini,
710 24
                        "\t(void)%s;\n", VSB_data(func));
711 24
        }
712
713 1992
        VRBT_FOREACH(ae, acl_tree, &tl->acl->acl_tree) {
714
715 1680
                if (no < n && !ae->overlapped)
716 96
                        continue;
717
718
                /* Find how much common prefix we have */
719 9888
                for (l = 0; l <= depth && l * 8 < (int)ae->mask - 7; l++) {
720 8856
                        assert(l >= 0);
721 8856
                        if (ae->data[l] != at[l])
722 552
                                break;
723 8304
                }
724
725
                /* Back down, if necessary */
726 3600
                while (l <= depth) {
727 2016
                        Fh(tl, 0, "\t%*s}\n", -depth, "");
728 2016
                        depth--;
729
                }
730
731 1584
                m = (int)ae->mask;
732 1584
                assert(m >= l*8);
733 1584
                m -= l * 8;
734
735
                /* Do whole byte compares */
736 5208
                for (i = l; m >= 8; m -= 8, i++) {
737 3624
                        if (i == 0)
738 840
                                Fh(tl, 0, "\t%*s%sif (fam == %d) {\n",
739 420
                                    -i, "", "", ae->data[i]);
740
                        else
741 6408
                                Fh(tl, 0, "\t%*s%sif (a[%d] == %d) {\n",
742 3204
                                    -i, "", "", i - 1, ae->data[i]);
743 3624
                        at[i] = ae->data[i];
744 3624
                        depth = i;
745 3624
                }
746
747 1584
                if (m > 0) {
748
                        // XXX can remove masking due to fixup
749
                        /* Do fractional byte compares */
750 1824
                        Fh(tl, 0, "\t%*s%sif ((a[%d] & 0x%x) == %d) {\n",
751 912
                            -i, "", "", i - 1, (0xff00 >> m) & 0xff,
752 912
                            ae->data[i] & ((0xff00 >> m) & 0xff));
753 912
                        at[i] = 256;
754 912
                        depth = i;
755 912
                }
756
757 1584
                i = ((int)ae->mask + 7) / 8;
758
759 1584
                if (tl->acl->flag_log) {
760 1128
                        Fh(tl, 0, "\t%*sVPI_acl_log(ctx, \"%sMATCH %s \" ",
761 564
                            -i, "", ae->not ? "NEG_" : "", sym->name);
762 564
                        vcc_acl_emit_tokens(tl, ae);
763 564
                        Fh(tl, 0, ");\n");
764 564
                }
765
766 1584
                Fh(tl, 0, "\t%*sreturn (%d);\n", -i, "", ae->not ? 0 : 1);
767 1584
        }
768
769
        /* Unwind */
770 2832
        for (; 0 <= depth; depth--)
771 2520
                Fh(tl, 0, "\t%*.*s}\n", depth, depth, "");
772
773 312
        if (no < n) {
774 24
                Fh(tl, 0, "\treturn(\n\t    VPI_acl_table(ctx,\n");
775 24
                Fh(tl, 0, "\t\tp,\n");
776 24
                Fh(tl, 0, "\t\t%u, %u,\n", n - no, nw);
777 24
                Fh(tl, 0, "\t\tacl_tbl_%s,\n", sym->name);
778 24
                if (tl->acl->flag_log)
779 12
                        Fh(tl, 0, "\t\tacl_str_%s,\n", sym->name);
780
                else
781 12
                        Fh(tl, 0, "\t\tNULL,\n");
782 24
                Fh(tl, 0, "\t\t\"NO MATCH %s\"\n\t    )\n\t);\n", sym->name);
783 24
        } else {
784
                /* Deny by default */
785 288
                if (tl->acl->flag_log)
786 72
                        Fh(tl, 0, "\tVPI_acl_log(ctx, \"NO_MATCH %s\");\n",
787 36
                            sym->name);
788 288
                Fh(tl, 0, "\treturn(0);\n");
789
        }
790 312
        Fh(tl, 0, "}\n");
791
792
        /* Emit the struct that will be referenced */
793 312
        Fh(tl, 0, "\nstatic const struct vrt_acl %s[] = {{\n", sym->rname);
794 312
        Fh(tl, 0, "\t.magic = VRT_ACL_MAGIC,\n");
795 312
        Fh(tl, 0, "\t.match = &%s,\n", VSB_data(func));
796 312
        Fh(tl, 0, "\t.name = \"%s\",\n", sym->name);
797 312
        Fh(tl, 0, "}};\n\n");
798 312
        if (!tl->err_unref) {
799 24
                AN(ifp);
800 24
                VSB_printf(ifp->ini, "\t(void)%s;", sym->rname);
801 24
        }
802 312
        VSB_destroy(&func);
803 312
}
804
805
void
806 492
vcc_ParseAcl(struct vcc *tl)
807
{
808
        struct symbol *sym;
809
        int sign;
810
        struct acl acl[1];
811
812 492
        INIT_OBJ(acl, VCC_ACL_MAGIC);
813 492
        tl->acl = acl;
814 492
        acl->flag_pedantic = 1;
815 492
        vcc_NextToken(tl);
816 492
        VRBT_INIT(&acl->acl_tree);
817
818 492
        vcc_ExpectVid(tl, "ACL");
819 492
        ERRCHK(tl);
820 480
        sym = VCC_HandleSymbol(tl, ACL);
821 480
        ERRCHK(tl);
822 480
        AN(sym);
823
824 660
        while (1) {
825 660
                sign = vcc_IsFlag(tl);
826 660
                if (tl->err) {
827 12
                        VSB_cat(tl->sb,
828
                            "Valid ACL flags are `log` and `table`:\n");
829 12
                        return;
830
                }
831 648
                if (sign < 0)
832 456
                        break;
833 192
                if (vcc_IdIs(tl->t, "log")) {
834 48
                        acl->flag_log = sign;
835 48
                        vcc_NextToken(tl);
836 192
                } else if (vcc_IdIs(tl->t, "fold")) {
837 12
                        acl->flag_fold = sign;
838 12
                        vcc_NextToken(tl);
839 144
                } else if (vcc_IdIs(tl->t, "pedantic")) {
840 96
                        acl->flag_pedantic = sign;
841 96
                        vcc_NextToken(tl);
842 132
                } else if (vcc_IdIs(tl->t, "table")) {
843 24
                        acl->flag_table = sign;
844 24
                        vcc_NextToken(tl);
845 24
                } else {
846 12
                        VSB_cat(tl->sb, "Unknown ACL flag:\n");
847 12
                        vcc_ErrWhere(tl, tl->t);
848 12
                        return;
849
                }
850
        }
851
852 456
        SkipToken(tl, '{');
853
854 2400
        while (tl->t->tok != '}') {
855 2088
                vcc_acl_entry(tl);
856 2088
                ERRCHK(tl);
857 1956
                SkipToken(tl, ';');
858
        }
859 312
        SkipToken(tl, '}');
860
861 312
        vcc_acl_emit(tl, sym);
862 492
}