/usr/src/usr.sbin/nsd/options.c

Bug Summary

File:	src/usr.sbin/nsd/options.c
Warning:	line 2204, column 25 Null pointer passed as 1st argument to string comparison function
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name options.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/nsd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I . -I /usr/src/usr.sbin/nsd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/nsd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/nsd/options.c
1/*
* options.c -- options functions.
*
* Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
*
* See LICENSE for the license.
*
*/
9#include "config.h"
10#include <string.h>
11#include <stdio.h>
12#include <sys/stat.h>
13#include <errno(*__errno()).h>
14#ifdef HAVE_IFADDRS_H1
15#include <ifaddrs.h>
16#endif
17#include "options.h"
18#include "query.h"
19#include "tsig.h"
20#include "ixfr.h"
21#include "difffile.h"
22#include "rrl.h"
23#include "bitset.h"

25#include "configparser.h"
26config_parser_state_type* cfg_parser = 0;
27extern FILE* c_in, *c_out;
28int c_parse(void);
29int c_lex(void);
30int c_wrap(void);
31int c_lex_destroy(void);
32extern char* c_text;

34static int
35rbtree_strcmp(const void* p1, const void* p2)
36{
if(p1 == NULL((void *)0) && p2 == NULL((void *)0)) return 0;
if(p1 == NULL((void *)0)) return -1;
if(p2 == NULL((void *)0)) return 1;
return strcmp((const char*)p1, (const char*)p2);
41}

43struct nsd_options*
44nsd_options_create(region_type* region)
45{
struct nsd_options* opt;
opt = (struct nsd_options*)region_alloc(region, sizeof(
struct nsd_options));
opt->region = region;
opt->zone_options = rbtree_create(region,
(int (*)(const void *, const void *)) dname_compare);
opt->configfile = NULL((void *)0);
opt->zonestatnames = rbtree_create(opt->region, rbtree_strcmp);
opt->patterns = rbtree_create(region, rbtree_strcmp);
opt->keys = rbtree_create(region, rbtree_strcmp);
opt->tls_auths = rbtree_create(region, rbtree_strcmp);
opt->ip_addresses = NULL((void *)0);
opt->ip_transparent = 0;
opt->ip_freebind = 0;
opt->send_buffer_size = 0;
opt->receive_buffer_size = 0;
opt->debug_mode = 0;
opt->verbosity = 0;
opt->hide_version = 0;
opt->hide_identity = 0;
opt->drop_updates = 0;
opt->do_ip4 = 1;
opt->do_ip6 = 1;
opt->identity = 0;
opt->version = 0;
opt->nsid = 0;
opt->logfile = 0;
opt->log_only_syslog = 0;
opt->log_time_ascii = 1;
opt->round_robin = 0; /* also packet.h::round_robin */
opt->minimal_responses = 1; /* also packet.h::minimal_responses */
opt->confine_to_zone = 0;
opt->refuse_any = 1;
opt->server_count = 1;
opt->cpu_affinity = NULL((void *)0);
opt->service_cpu_affinity = NULL((void *)0);
opt->tcp_count = 100;
opt->tcp_reject_overflow = 0;
opt->tcp_query_count = 0;
opt->tcp_timeout = TCP_TIMEOUT120;
opt->tcp_mss = 0;
opt->outgoing_tcp_mss = 0;
opt->ipv4_edns_size = EDNS_MAX_MESSAGE_LEN1232;
opt->ipv6_edns_size = EDNS_MAX_MESSAGE_LEN1232;
opt->pidfile = PIDFILE"";
opt->port = UDP_PORT"53";
92/* deprecated?	opt->port = TCP_PORT; */
opt->reuseport = 0;
opt->xfrd_tcp_max = 128;
opt->xfrd_tcp_pipeline = 128;
opt->statistics = 0;
opt->chroot = 0;
opt->username = USER"_nsd";
opt->zonesdir = ZONESDIR"/var/nsd/zones";
opt->xfrdfile = XFRDFILE"/var/nsd/run/xfrd.state";
opt->xfrdir = XFRDIR"/var/nsd/run/xfr";
opt->zonelistfile = ZONELISTFILE"/var/nsd/db/zone.list";
103#ifdef RATELIMIT
opt->rrl_size = RRL_BUCKETS1000000;
opt->rrl_slip = RRL_SLIP2;
opt->rrl_ipv4_prefix_length = RRL_IPV4_PREFIX_LENGTH24;
opt->rrl_ipv6_prefix_length = RRL_IPV6_PREFIX_LENGTH64;
108#  ifdef RATELIMIT_DEFAULT_OFF
opt->rrl_ratelimit = 0;
opt->rrl_whitelist_ratelimit = 0;
111#  else
opt->rrl_ratelimit = RRL_LIMIT400/2;
opt->rrl_whitelist_ratelimit = RRL_WLIST_LIMIT4000/2;
114#  endif
115#endif
116#ifdef USE_DNSTAP
opt->dnstap_enable = 0;
opt->dnstap_socket_path = DNSTAP_SOCKET_PATH;
opt->dnstap_ip = "";
opt->dnstap_tls = 1;
opt->dnstap_tls_server_name = NULL((void *)0);
opt->dnstap_tls_cert_bundle = NULL((void *)0);
opt->dnstap_tls_client_key_file = NULL((void *)0);
opt->dnstap_tls_client_cert_file = NULL((void *)0);
opt->dnstap_send_identity = 0;
opt->dnstap_send_version = 0;
opt->dnstap_identity = NULL((void *)0);
opt->dnstap_version = NULL((void *)0);
opt->dnstap_log_auth_query_messages = 0;
opt->dnstap_log_auth_response_messages = 0;
131#endif
opt->zonefiles_check = 1;
opt->zonefiles_write = ZONEFILES_WRITE_INTERVAL3600;
opt->xfrd_reload_timeout = 1;
opt->tls_service_key = NULL((void *)0);
opt->tls_service_ocsp = NULL((void *)0);
opt->tls_service_pem = NULL((void *)0);
opt->tls_port = TLS_PORT"853";
opt->tls_cert_bundle = NULL((void *)0);
opt->proxy_protocol_port = NULL((void *)0);
opt->answer_cookie = 1;
opt->cookie_secret = NULL((void *)0);
opt->cookie_secret_file = CONFIGDIR"/var/nsd/etc""/nsd_cookiesecrets.txt";
opt->control_enable = 0;
opt->control_interface = NULL((void *)0);
opt->control_port = NSD_CONTROL_PORT8952;
opt->server_key_file = CONFIGDIR"/var/nsd/etc""/nsd_server.key";
opt->server_cert_file = CONFIGDIR"/var/nsd/etc""/nsd_server.pem";
opt->control_key_file = CONFIGDIR"/var/nsd/etc""/nsd_control.key";
opt->control_cert_file = CONFIGDIR"/var/nsd/etc""/nsd_control.pem";

opt->verify_enable = 0;
opt->verify_ip_addresses = NULL((void *)0);
opt->verify_port = VERIFY_PORT"5347";
opt->verify_zones = 1;
opt->verifier = NULL((void *)0);
opt->verifier_count = 1;
opt->verifier_feed_zone = 1;
opt->verifier_timeout = 0;

return opt;
162}

164int
165nsd_options_insert_zone(struct nsd_options* opt, struct zone_options* zone)
166{
/* create dname for lookup */
const dname_type* dname = dname_parse(opt->region, zone->name);
if(!dname)
return 0;
zone->node.key = dname;
if(!rbtree_insert(opt->zone_options, (rbnode_type*)zone))
return 0;
return 1;
175}

177int
178nsd_options_insert_pattern(struct nsd_options* opt,
struct pattern_options* pat)
180{
if(!pat->pname)
return 0;
pat->node.key = pat->pname;
if(!rbtree_insert(opt->patterns, (rbnode_type*)pat))
return 0;
return 1;
187}

189void
190warn_if_directory(const char* filetype, FILE* f, const char* fname)
191{
if(fileno(f)(!__isthreaded ? ((f)->_file) : (fileno)(f)) != -1) {
struct stat st;
memset(&st, 0, sizeof(st));
if(fstat(fileno(f)(!__isthreaded ? ((f)->_file) : (fileno)(f)), &st) != -1) {
	if(S_ISDIR(st.st_mode)((st.st_mode & 0170000) == 0040000)) {
		log_msg(LOG_WARNING4, "trying to read %s but it is a directory: %s", filetype, fname);
	}
}
}
201}

203int
204parse_options_file(struct nsd_options* opt, const char* file,
void (*err)(void*,const char*), void* err_arg)
206{
FILE *in = 0;
struct pattern_options* pat;
struct acl_options* acl;

if(!cfg_parser) {
cfg_parser = (config_parser_state_type*)region_alloc(
	opt->region, sizeof(config_parser_state_type));
cfg_parser->chroot = 0;
}
cfg_parser->err = err;
cfg_parser->err_arg = err_arg;
cfg_parser->filename = (char*)file;
cfg_parser->line = 1;
cfg_parser->errors = 0;
cfg_parser->opt = opt;
cfg_parser->pattern = NULL((void *)0);
cfg_parser->zone = NULL((void *)0);
cfg_parser->key = NULL((void *)0);
cfg_parser->tls_auth = NULL((void *)0);

in = fopen(cfg_parser->filename, "r");
if(!in) {
if(err) {
	char m[MAXSYSLOGMSGLEN512];
	snprintf(m, sizeof(m), "Could not open %s: %s\n",
		file, strerror(errno(*__errno())));
	err(err_arg, m);
} else {
	fprintf(stderr(&__sF[2]), "Could not open %s: %s\n",
		file, strerror(errno(*__errno())));
}
return 0;
}
warn_if_directory("configfile", in, file);
c_in = in;
c_parse();
fclose(in);

opt->configfile = region_strdup(opt->region, file);

RBTREE_FOR(pat, struct pattern_options*, opt->patterns)for(pat=(struct pattern_options*)rbtree_first(opt->patterns
); (rbnode_type*)pat != &rbtree_null_node; pat = (struct pattern_options
*)rbtree_next((rbnode_type*)pat))
{
/* lookup keys for acls */
for(acl=pat->allow_notify; acl; acl=acl->next)
{
	if(acl->nokey || acl->blocked)
		continue;
	acl->key_options = key_options_find(opt, acl->key_name);
	if(!acl->key_options)
		c_error("key %s in pattern %s could not be found",
			acl->key_name, pat->pname);
}
for(acl=pat->notify; acl; acl=acl->next)
{
	if(acl->nokey || acl->blocked)
		continue;
	acl->key_options = key_options_find(opt, acl->key_name);
	if(!acl->key_options)
		c_error("key %s in pattern %s could not be found",
			acl->key_name, pat->pname);
}
for(acl=pat->request_xfr; acl; acl=acl->next)
{
	/* Find tls_auth */
	if (!acl->tls_auth_name)
		; /* pass */
	else if (!(acl->tls_auth_options =
	                tls_auth_options_find(opt, acl->tls_auth_name)))
		c_error("tls_auth %s in pattern %s could not be found",
				acl->tls_auth_name, pat->pname);
	/* Find key */
	if(acl->nokey || acl->blocked)
		continue;
	acl->key_options = key_options_find(opt, acl->key_name);
	if(!acl->key_options)
		c_error("key %s in pattern %s could not be found",
			acl->key_name, pat->pname);
}
for(acl=pat->provide_xfr; acl; acl=acl->next)
{
	if(acl->nokey || acl->blocked)
		continue;
	acl->key_options = key_options_find(opt, acl->key_name);
	if(!acl->key_options)
		c_error("key %s in pattern %s could not be found",
			acl->key_name, pat->pname);
}
for(acl=pat->allow_query; acl; acl=acl->next)
{
	if(acl->nokey || acl->blocked)
		continue;
	acl->key_options = key_options_find(opt, acl->key_name);
	if(!acl->key_options)
		c_error("key %s in pattern %s could not be found",
			acl->key_name, pat->pname);
}
}

if(cfg_parser->errors > 0)
{
if(err) {
	char m[MAXSYSLOGMSGLEN512];
	snprintf(m, sizeof(m), "read %s failed: %d errors in "
		"configuration file\n", file,
		cfg_parser->errors);
	err(err_arg, m);
} else {
	fprintf(stderr(&__sF[2]), "read %s failed: %d errors in "
		"configuration file\n", file,
		cfg_parser->errors);
}
return 0;
}
return 1;
321}

323void options_zonestatnames_create(struct nsd_options* opt)
324{
struct zone_options* zopt;
/* allocate "" as zonestat 0, for zones without a zonestat */
if(!rbtree_search(opt->zonestatnames, "")) {
struct zonestatname* n;
n = (struct zonestatname*)region_alloc_zero(opt->region,
	sizeof(*n));
n->node.key = region_strdup(opt->region, "");
if(!n->node.key) {
	log_msg(LOG_ERR3, "malloc failed: %s", strerror(errno(*__errno())));
	exit(1);
}
n->id = (unsigned)(opt->zonestatnames->count);
rbtree_insert(opt->zonestatnames, (rbnode_type*)n);
}
RBTREE_FOR(zopt, struct zone_options*, opt->zone_options)for(zopt=(struct zone_options*)rbtree_first(opt->zone_options
); (rbnode_type*)zopt != &rbtree_null_node; zopt = (struct
 zone_options*)rbtree_next((rbnode_type*)zopt)) {
/* insert into tree, so that when read in later id exists */
(void)getzonestatid(opt, zopt);
}
343}

345#define ZONELIST_HEADER"# NSD zone list\n# name pattern\n" "# NSD zone list\n# name pattern\n"
346static int
347comp_zonebucket(const void* a, const void* b)
348{
/* the line size is much smaller than max-int, and positive,
* so the subtraction works */
return *(const int*)b - *(const int*)a;
352}

354/* insert free entry into zonelist free buckets */
355static void
356zone_list_free_insert(struct nsd_options* opt, int linesize, off_t off)
357{
struct zonelist_free* e;
struct zonelist_bucket* b = (struct zonelist_bucket*)rbtree_search(
opt->zonefree, &linesize);
if(!b) {
b = region_alloc_zero(opt->region, sizeof(*b));
b->linesize = linesize;
b->node = *RBTREE_NULL&rbtree_null_node;
b->node.key = &b->linesize;
rbtree_insert(opt->zonefree, &b->node);
}
e = (struct zonelist_free*)region_alloc_zero(opt->region, sizeof(*e));
e->next = b->list;
b->list = e;
e->off = off;
opt->zonefree_number++;
373}

375struct zone_options*
376zone_list_zone_insert(struct nsd_options* opt, const char* nm,
const char* patnm, int linesize, off_t off)
378{
struct pattern_options* pat = pattern_options_find(opt, patnm);
struct zone_options* zone;
if(!pat) {
log_msg(LOG_ERR3, "pattern does not exist for zone %s "
	"pattern %s", nm, patnm);
return NULL((void *)0);
}
zone = zone_options_create(opt->region);
zone->part_of_config = 0;
zone->name = region_strdup(opt->region, nm);
zone->linesize = linesize;
zone->off = off;
zone->pattern = pat;
if(!nsd_options_insert_zone(opt, zone)) {
log_msg(LOG_ERR3, "bad domain name or duplicate zone '%s' "
	"pattern %s", nm, patnm);
region_recycle(opt->region, (void*)zone->name, strlen(nm)+1);
region_recycle(opt->region, zone, sizeof(*zone));
return NULL((void *)0);
}
return zone;
400}

402int
403parse_zone_list_file(struct nsd_options* opt)
404{
/* zonelist looks like this:
# name pattern
add example.com master
del example.net slave
add foo.bar.nl slave
add rutabaga.uk config
*/
char hdr[64];
char buf[1024];

/* create empty data structures */
opt->zonefree = rbtree_create(opt->region, comp_zonebucket);
opt->zonelist = NULL((void *)0);
opt->zonefree_number = 0;
opt->zonelist_off = 0;

/* try to open the zonelist file, an empty or nonexist file is OK */
opt->zonelist = fopen(opt->zonelistfile, "r+");
if(!opt->zonelist) {
if(errno(*__errno()) == ENOENT2)
	return 1; /* file does not exist, it is created later */
log_msg(LOG_ERR3, "could not open zone list %s: %s", opt->zonelistfile,
	strerror(errno(*__errno())));
return 0;
}
/* read header */
hdr[strlen(ZONELIST_HEADER"# NSD zone list\n# name pattern\n")] = 0;
if(fread(hdr, 1, strlen(ZONELIST_HEADER"# NSD zone list\n# name pattern\n"), opt->zonelist) !=
strlen(ZONELIST_HEADER"# NSD zone list\n# name pattern\n") || strncmp(hdr, ZONELIST_HEADER"# NSD zone list\n# name pattern\n",
strlen(ZONELIST_HEADER"# NSD zone list\n# name pattern\n")) != 0) {
log_msg(LOG_ERR3, "zone list %s contains bad header\n", opt->zonelistfile);
fclose(opt->zonelist);
opt->zonelist = NULL((void *)0);
return 0;
}
buf[sizeof(buf)-1]=0;

/* read entries in file */
while(fgets(buf, sizeof(buf), opt->zonelist)) {
/* skip comments and empty lines */
if(buf[0] == 0 || buf[0] == '\n' || buf[0] == '#')
	continue;
if(strncmp(buf, "add ", 4) == 0) {
	int linesize = strlen(buf);
	/* parse the 'add' line */
	/* pick last space on the line, so that the domain
	 * name can have a space in it (but not the pattern)*/
	char* space = strrchr(buf+4, ' ');
	char* nm, *patnm;
	if(!space) {
		/* parse error */
		log_msg(LOG_ERR3, "parse error in %s: '%s'",
			opt->zonelistfile, buf);
		continue;
	}
	nm = buf+4;
	*space = 0;
	patnm = space+1;
	if(linesize && buf[linesize-1] == '\n')
		buf[linesize-1] = 0;

	/* store offset and line size for zone entry */
	/* and create zone entry in zonetree */
	(void)zone_list_zone_insert(opt, nm, patnm, linesize,
		ftello(opt->zonelist)-linesize);
} else if(strncmp(buf, "del ", 4) == 0) {
	/* store offset and line size for deleted entry */
	int linesize = strlen(buf);
	zone_list_free_insert(opt, linesize,
		ftello(opt->zonelist)-linesize);
} else {
	log_msg(LOG_WARNING4, "bad data in %s, '%s'", opt->zonelistfile,
		buf);
}
}
/* store EOF offset */
opt->zonelist_off = ftello(opt->zonelist);
return 1;
483}

485void
486zone_options_delete(struct nsd_options* opt, struct zone_options* zone)
487{
rbtree_delete(opt->zone_options, zone->node.key);
region_recycle(opt->region, (void*)zone->node.key, dname_total_size(
(dname_type*)zone->node.key));
region_recycle(opt->region, zone, sizeof(*zone));
492}

494/* add a new zone to the zonelist */
495struct zone_options*
496zone_list_add(struct nsd_options* opt, const char* zname, const char* pname)
497{
int r;
struct zonelist_free* e;
struct zonelist_bucket* b;
int linesize = 6 + strlen(zname) + strlen(pname);
/* create zone entry */
struct zone_options* zone = zone_list_zone_insert(opt, zname, pname,
linesize, 0);
if(!zone)
return NULL((void *)0);

/* use free entry or append to file or create new file */
if(!opt->zonelist || opt->zonelist_off == 0) {
/* create new file */
if(opt->zonelist) fclose(opt->zonelist);
opt->zonelist = fopen(opt->zonelistfile, "w+");
if(!opt->zonelist) {
	log_msg(LOG_ERR3, "could not create zone list %s: %s",
		opt->zonelistfile, strerror(errno(*__errno())));
	log_msg(LOG_ERR3, "zone %s could not be added", zname);
	zone_options_delete(opt, zone);
	return NULL((void *)0);
}
r = fprintf(opt->zonelist, ZONELIST_HEADER"# NSD zone list\n# name pattern\n");
if(r != strlen(ZONELIST_HEADER"# NSD zone list\n# name pattern\n")) {
	if(r == -1)
		log_msg(LOG_ERR3, "could not write to %s: %s",
			opt->zonelistfile, strerror(errno(*__errno())));
	else log_msg(LOG_ERR3, "partial write to %s: disk full",
		opt->zonelistfile);
	log_msg(LOG_ERR3, "zone %s could not be added", zname);
	zone_options_delete(opt, zone);
	return NULL((void *)0);
}
zone->off = ftello(opt->zonelist);
if(zone->off == -1)
	log_msg(LOG_ERR3, "ftello(%s): %s", opt->zonelistfile, strerror(errno(*__errno())));
r = fprintf(opt->zonelist, "add %s %s\n", zname, pname);
if(r != zone->linesize) {
	if(r == -1)
		log_msg(LOG_ERR3, "could not write to %s: %s",
			opt->zonelistfile, strerror(errno(*__errno())));
	else log_msg(LOG_ERR3, "partial write to %s: disk full",
		opt->zonelistfile);
	log_msg(LOG_ERR3, "zone %s could not be added", zname);
	zone_options_delete(opt, zone);
	return NULL((void *)0);
}
opt->zonelist_off = ftello(opt->zonelist);
if(opt->zonelist_off == -1)
	log_msg(LOG_ERR3, "ftello(%s): %s", opt->zonelistfile, strerror(errno(*__errno())));
if(fflush(opt->zonelist) != 0) {
	log_msg(LOG_ERR3, "fflush %s: %s", opt->zonelistfile, strerror(errno(*__errno())));
}
return zone;
}
b = (struct zonelist_bucket*)rbtree_search(opt->zonefree,
&zone->linesize);
if(!b || b->list == NULL((void *)0)) {
/* no empty place, append to file */
zone->off = opt->zonelist_off;
if(fseeko(opt->zonelist, zone->off, SEEK_SET0) == -1) {
	log_msg(LOG_ERR3, "fseeko(%s): %s", opt->zonelistfile, strerror(errno(*__errno())));
	log_msg(LOG_ERR3, "zone %s could not be added", zname);
	zone_options_delete(opt, zone);
	return NULL((void *)0);
}
r = fprintf(opt->zonelist, "add %s %s\n", zname, pname);
if(r != zone->linesize) {
	if(r == -1)
		log_msg(LOG_ERR3, "could not write to %s: %s",
			opt->zonelistfile, strerror(errno(*__errno())));
	else log_msg(LOG_ERR3, "partial write to %s: disk full",
		opt->zonelistfile);
	log_msg(LOG_ERR3, "zone %s could not be added", zname);
	zone_options_delete(opt, zone);
	return NULL((void *)0);
}
opt->zonelist_off += linesize;
if(fflush(opt->zonelist) != 0) {
	log_msg(LOG_ERR3, "fflush %s: %s", opt->zonelistfile, strerror(errno(*__errno())));
}
return zone;
}
/* reuse empty spot */
e = b->list;
zone->off = e->off;
if(fseeko(opt->zonelist, zone->off, SEEK_SET0) == -1) {
log_msg(LOG_ERR3, "fseeko(%s): %s", opt->zonelistfile, strerror(errno(*__errno())));
log_msg(LOG_ERR3, "zone %s could not be added", zname);
zone_options_delete(opt, zone);
return NULL((void *)0);
}
r = fprintf(opt->zonelist, "add %s %s\n", zname, pname);
if(r != zone->linesize) {
if(r == -1)
	log_msg(LOG_ERR3, "could not write to %s: %s",
		opt->zonelistfile, strerror(errno(*__errno())));
else log_msg(LOG_ERR3, "partial write to %s: disk full",
	opt->zonelistfile);
log_msg(LOG_ERR3, "zone %s could not be added", zname);
zone_options_delete(opt, zone);
return NULL((void *)0);
}
if(fflush(opt->zonelist) != 0) {
log_msg(LOG_ERR3, "fflush %s: %s", opt->zonelistfile, strerror(errno(*__errno())));
}

/* snip off and recycle element */
b->list = e->next;
region_recycle(opt->region, e, sizeof(*e));
if(b->list == NULL((void *)0)) {
rbtree_delete(opt->zonefree, &b->linesize);
region_recycle(opt->region, b, sizeof(*b));
}
opt->zonefree_number--;
return zone;
614}

616/* remove a zone on the zonelist */
617void
618zone_list_del(struct nsd_options* opt, struct zone_options* zone)
619{
/* put its space onto the free entry */
if(fseeko(opt->zonelist, zone->off, SEEK_SET0) == -1) {
log_msg(LOG_ERR3, "fseeko(%s): %s", opt->zonelistfile, strerror(errno(*__errno())));
return;
}
fprintf(opt->zonelist, "del");
zone_list_free_insert(opt, zone->linesize, zone->off);

/* remove zone_options */
zone_options_delete(opt, zone);

/* see if we need to compact: it is going to halve the zonelist */
if(opt->zonefree_number > opt->zone_options->count) {
zone_list_compact(opt);
} else {
if(fflush(opt->zonelist) != 0) {
	log_msg(LOG_ERR3, "fflush %s: %s", opt->zonelistfile, strerror(errno(*__errno())));
}
}
639}
640/* postorder delete of zonelist free space tree */
641static void
642delbucket(region_type* region, struct zonelist_bucket* b)
643{
struct zonelist_free* e, *f;
if(!b || (rbnode_type*)b==RBTREE_NULL&rbtree_null_node)
return;
delbucket(region, (struct zonelist_bucket*)b->node.left);
delbucket(region, (struct zonelist_bucket*)b->node.right);
e = b->list;
while(e) {
f = e->next;
region_recycle(region, e, sizeof(*e));
e = f;
}
region_recycle(region, b, sizeof(*b));
656}

658/* compact zonelist file */
659void
660zone_list_compact(struct nsd_options* opt)
661{
char outname[1024];
FILE* out;
struct zone_options* zone;
off_t off;
int r;
snprintf(outname, sizeof(outname), "%s~", opt->zonelistfile);
/* useful, when : count-of-free > count-of-used */
/* write zonelist to zonelist~ */
out = fopen(outname, "w+");
if(!out) {
log_msg(LOG_ERR3, "could not open %s: %s", outname, strerror(errno(*__errno())));
return;
}
r = fprintf(out, ZONELIST_HEADER"# NSD zone list\n# name pattern\n");
if(r == -1) {
log_msg(LOG_ERR3, "write %s failed: %s", outname,
	strerror(errno(*__errno())));
fclose(out);
return;
} else if(r != strlen(ZONELIST_HEADER"# NSD zone list\n# name pattern\n")) {
log_msg(LOG_ERR3, "write %s was partial: disk full",
	outname);
fclose(out);
return;
}
off = ftello(out);
if(off == -1) {
log_msg(LOG_ERR3, "ftello(%s): %s", outname, strerror(errno(*__errno())));
fclose(out);
return;
}
RBTREE_FOR(zone, struct zone_options*, opt->zone_options)for(zone=(struct zone_options*)rbtree_first(opt->zone_options
); (rbnode_type*)zone != &rbtree_null_node; zone = (struct
 zone_options*)rbtree_next((rbnode_type*)zone)) {
if(zone->part_of_config)
	continue;
r = fprintf(out, "add %s %s\n", zone->name,
	zone->pattern->pname);
if(r < 0) {
	log_msg(LOG_ERR3, "write %s failed: %s", outname,
		strerror(errno(*__errno())));
	fclose(out);
	return;
} else if(r != zone->linesize) {
	log_msg(LOG_ERR3, "write %s was partial: disk full",
		outname);
	fclose(out);
	return;
}
}
if(fflush(out) != 0) {
log_msg(LOG_ERR3, "fflush %s: %s", outname, strerror(errno(*__errno())));
}

/* rename zonelist~ onto zonelist */
if(rename(outname, opt->zonelistfile) == -1) {
log_msg(LOG_ERR3, "rename(%s to %s) failed: %s",
	outname, opt->zonelistfile, strerror(errno(*__errno())));
fclose(out);
return;
}
fclose(opt->zonelist);
/* set offsets */
RBTREE_FOR(zone, struct zone_options*, opt->zone_options)for(zone=(struct zone_options*)rbtree_first(opt->zone_options
); (rbnode_type*)zone != &rbtree_null_node; zone = (struct
 zone_options*)rbtree_next((rbnode_type*)zone)) {
if(zone->part_of_config)
	continue;
zone->off = off;
off += zone->linesize;
}
/* empty the free tree */
delbucket(opt->region, (struct zonelist_bucket*)opt->zonefree->root);
opt->zonefree->root = RBTREE_NULL&rbtree_null_node;
opt->zonefree->count = 0;
opt->zonefree_number = 0;
/* finish */
opt->zonelist = out;
opt->zonelist_off = off;
737}

739/* close zonelist file */
740void
741zone_list_close(struct nsd_options* opt)
742{
if(opt->zonelist) {
fclose(opt->zonelist);
opt->zonelist = NULL((void *)0);
}
747}

749static void
750c_error_va_list_pos(int showpos, const char* fmt, va_list args)
751{
char* at = NULL((void *)0);
cfg_parser->errors++;
if(showpos && c_text && c_text[0]!=0) {
at = c_text;
}
if(cfg_parser->err) {
char m[MAXSYSLOGMSGLEN512];
snprintf(m, sizeof(m), "%s:%d: ", cfg_parser->filename,
	cfg_parser->line);
(*cfg_parser->err)(cfg_parser->err_arg, m);
if(at) {
	snprintf(m, sizeof(m), "at '%s': ", at);
	(*cfg_parser->err)(cfg_parser->err_arg, m);
}
(*cfg_parser->err)(cfg_parser->err_arg, "error: ");
vsnprintf(m, sizeof(m), fmt, args);
(*cfg_parser->err)(cfg_parser->err_arg, m);
(*cfg_parser->err)(cfg_parser->err_arg, "\n");
return;
}
      fprintf(stderr(&__sF[2]), "%s:%d: ", cfg_parser->filename, cfg_parser->line);
if(at) fprintf(stderr(&__sF[2]), "at '%s': ", at);
fprintf(stderr(&__sF[2]), "error: ");
vfprintf(stderr(&__sF[2]), fmt, args);
fprintf(stderr(&__sF[2]), "\n");
777}

779void
780c_error(const char *fmt, ...)
781{
va_list ap;
int showpos = 0;

if (strcmp(fmt, "syntax error") == 0 || strcmp(fmt, "parse error") == 0) {
showpos = 1;
}

va_start(ap, fmt)__builtin_va_start((ap), fmt);
c_error_va_list_pos(showpos, fmt, ap);
va_end(ap)__builtin_va_end((ap));
792}

794int
795c_wrap(void)
796{
return 1;
798}

800struct zone_options*
801zone_options_create(region_type* region)
802{
struct zone_options* zone;
zone = (struct zone_options*)region_alloc(region, sizeof(
struct zone_options));
zone->node = *RBTREE_NULL&rbtree_null_node;
zone->name = 0;
zone->pattern = 0;
zone->part_of_config = 0;
return zone;
811}

813/* true is booleans are the same truth value */
814#define booleq(x,y)( ((x) && (y)) || (!(x) && !(y)) ) ( ((x) && (y)) || (!(x) && !(y)) )

816/* true is min_expire_time_expr has either an equal known value
* or none of these known values but booleanally equal
*/
819#define expire_expr_eq(x,y)( ( (x) == 2 && (y) == 2 ) || ( (x) != 2 && (
y) != 2 && ( (((x)) && ((y))) || (!((x)) &&
 !((y))) ))) (  (  (x) == REFRESHPLUSRETRYPLUS12 \
                             && (y) == REFRESHPLUSRETRYPLUS12 ) \
                          || (  (x) != REFRESHPLUSRETRYPLUS12 \
                             && (y) != REFRESHPLUSRETRYPLUS12 \
                             && booleq((x), (y))( (((x)) && ((y))) || (!((x)) && !((y))) )))


826int
827acl_equal(struct acl_options* p, struct acl_options* q)
828{
if(!booleq(p->use_axfr_only, q->use_axfr_only)( ((p->use_axfr_only) && (q->use_axfr_only)) ||
 (!(p->use_axfr_only) && !(q->use_axfr_only)) )) return 0;
if(!booleq(p->allow_udp, q->allow_udp)( ((p->allow_udp) && (q->allow_udp)) || (!(p->
allow_udp) && !(q->allow_udp)) )) return 0;
if(strcmp(p->ip_address_spec, q->ip_address_spec)!=0) return 0;
/* the ip6, port, addr, mask, type: are derived from the ip_address_spec */
if(!booleq(p->nokey, q->nokey)( ((p->nokey) && (q->nokey)) || (!(p->nokey)
 && !(q->nokey)) )) return 0;
if(!booleq(p->blocked, q->blocked)( ((p->blocked) && (q->blocked)) || (!(p->blocked
) && !(q->blocked)) )) return 0;
if(p->key_name && q->key_name) {
if(strcmp(p->key_name, q->key_name)!=0) return 0;
} else if(p->key_name && !q->key_name) return 0;
else if(!p->key_name && q->key_name) return 0;
/* key_options is derived from key_name */
if(p->tls_auth_name && q->tls_auth_name) {
if(strcmp(p->tls_auth_name, q->tls_auth_name)!=0) return 0;
} else if(p->tls_auth_name && !q->tls_auth_name) return 0;
else if(!p->tls_auth_name && q->tls_auth_name) return 0;
/* tls_auth_options is derived from tls_auth_name */
return 1;
846}

848int
849acl_list_equal(struct acl_options* p, struct acl_options* q)
850{
/* must be same and in same order */
while(p && q) {
if(!acl_equal(p, q))
	return 0;
p = p->next;
q = q->next;
}
if(!p && !q) return 1;
/* different lengths */
return 0;
861}

863struct pattern_options*
864pattern_options_create(region_type* region)
865{
struct pattern_options* p;
p = (struct pattern_options*)region_alloc(region, sizeof(
struct pattern_options));
p->node = *RBTREE_NULL&rbtree_null_node;
p->pname = 0;
p->zonefile = 0;
p->zonestats = 0;
p->allow_notify = 0;
p->request_xfr = 0;
p->size_limit_xfr = 0;
p->notify = 0;
p->provide_xfr = 0;
p->allow_query = 0;
p->outgoing_interface = 0;
p->notify_retry = 5;
p->notify_retry_is_default = 1;
p->allow_axfr_fallback = 1;
p->allow_axfr_fallback_is_default = 1;
p->implicit = 0;
p->xfrd_flags = 0;
p->max_refresh_time = 2419200;	/* 4 weeks */
p->max_refresh_time_is_default = 1;
p->min_refresh_time = 0;
p->min_refresh_time_is_default = 1;
p->max_retry_time = 1209600;	/* 2 weeks */
p->max_retry_time_is_default = 1;
p->min_retry_time = 0;
p->min_retry_time_is_default = 1;
p->min_expire_time = 0;
p->min_expire_time_expr = EXPIRE_TIME_IS_DEFAULT1;
896#ifdef RATELIMIT
p->rrl_whitelist = 0;
898#endif
p->multi_master_check = 0;
p->store_ixfr = 0;
p->store_ixfr_is_default = 1;
p->ixfr_size = IXFR_SIZE_DEFAULT1048576;
p->ixfr_size_is_default = 1;
p->ixfr_number = IXFR_NUMBER_DEFAULT5;
p->ixfr_number_is_default = 1;
p->create_ixfr = 0;
p->create_ixfr_is_default = 1;
p->verify_zone = VERIFY_ZONE_INHERIT(2);
p->verify_zone_is_default = 1;
p->verifier = NULL((void *)0);
p->verifier_feed_zone = VERIFIER_FEED_ZONE_INHERIT(2);
p->verifier_feed_zone_is_default = 1;
p->verifier_timeout = VERIFIER_TIMEOUT_INHERIT(-1);
p->verifier_timeout_is_default = 1;

return p;
917}

919static void
920acl_delete(region_type* region, struct acl_options* acl)
921{
if(acl->ip_address_spec)
region_recycle(region, (void*)acl->ip_address_spec,
	strlen(acl->ip_address_spec)+1);
if(acl->key_name)
region_recycle(region, (void*)acl->key_name,
	strlen(acl->key_name)+1);
if(acl->tls_auth_name)
region_recycle(region, (void*)acl->tls_auth_name,
	strlen(acl->tls_auth_name)+1);
/* key_options is a convenience pointer, not owned by the acl */
region_recycle(region, acl, sizeof(*acl));
933}

935static void
936acl_list_delete(region_type* region, struct acl_options* list)
937{
struct acl_options* n;
while(list) {
n = list->next;
acl_delete(region, list);
list = n;
}
944}

946static void
947verifier_delete(region_type* region, char **v)
948{
if(v != NULL((void *)0)) {
size_t vc = 0;
for(vc = 0; v[vc] != NULL((void *)0); vc++)
	region_recycle(region, v[vc], strlen(v[vc]) + 1);
region_recycle(region, v, (vc + 1) * sizeof(char *));
}
955}

957void
958pattern_options_remove(struct nsd_options* opt, const char* name)
959{
struct pattern_options* p = (struct pattern_options*)rbtree_delete(
opt->patterns, name);
/* delete p and its contents */
if (!p)
return;
if(p->pname)
region_recycle(opt->region, (void*)p->pname,
	strlen(p->pname)+1);
if(p->zonefile)
region_recycle(opt->region, (void*)p->zonefile,
	strlen(p->zonefile)+1);
if(p->zonestats)
region_recycle(opt->region, (void*)p->zonestats,
	strlen(p->zonestats)+1);
acl_list_delete(opt->region, p->allow_notify);
acl_list_delete(opt->region, p->request_xfr);
acl_list_delete(opt->region, p->notify);
acl_list_delete(opt->region, p->provide_xfr);
acl_list_delete(opt->region, p->allow_query);
acl_list_delete(opt->region, p->outgoing_interface);
verifier_delete(opt->region, p->verifier);

region_recycle(opt->region, p, sizeof(struct pattern_options));
983}

985static struct acl_options*
986copy_acl(region_type* region, struct acl_options* a)
987{
struct acl_options* b;
if(!a) return NULL((void *)0);
b = (struct acl_options*)region_alloc(region, sizeof(*b));
/* copy the whole lot */
*b = *a;
/* fix the pointers */
if(a->ip_address_spec)
b->ip_address_spec = region_strdup(region, a->ip_address_spec);
if(a->key_name)
b->key_name = region_strdup(region, a->key_name);
if(a->tls_auth_name)
b->tls_auth_name = region_strdup(region, a->tls_auth_name);
b->next = NULL((void *)0);
b->key_options = NULL((void *)0);
b->tls_auth_options = NULL((void *)0);
return b;
1004}

1006static struct acl_options*
1007copy_acl_list(struct nsd_options* opt, struct acl_options* a)
1008{
struct acl_options* b, *blast = NULL((void *)0), *blist = NULL((void *)0);
while(a) {
b = copy_acl(opt->region, a);
/* fixup key_options */
if(b->key_name)
	b->key_options = key_options_find(opt, b->key_name);
else	b->key_options = NULL((void *)0);
/* fixup tls_auth_options */
if(b->tls_auth_name)
	b->tls_auth_options = tls_auth_options_find(opt, b->tls_auth_name);
else	b->tls_auth_options = NULL((void *)0);

/* link as last into list */
b->next = NULL((void *)0);
if(!blist) blist = b;
else blast->next = b;
blast = b;

a = a->next;
}
return blist;
1030}

1032static void
1033copy_changed_acl(struct nsd_options* opt, struct acl_options** orig,
struct acl_options* anew)
1035{
if(!acl_list_equal(*orig, anew)) {
acl_list_delete(opt->region, *orig);
*orig = copy_acl_list(opt, anew);
}
1040}

1042static void
1043copy_changed_verifier(struct nsd_options* opt, char ***ov, char **nv)
1044{
size_t ovc, nvc;
assert(ov != NULL)((void)0);
ovc = nvc = 0;
if(nv != NULL((void *)0)) {
for(; nv[nvc] != NULL((void *)0); nvc++) ;
} else {
verifier_delete(opt->region, *ov);
*ov = NULL((void *)0);
return;
}
if(*ov != NULL((void *)0)) {
for(; (*ov)[ovc] != NULL((void *)0); ovc++) {
	if(ovc < nvc && strcmp((*ov)[ovc], nv[ovc]) != 0)
		break;
}
if(ovc == nvc)
	return;
verifier_delete(opt->region, *ov);
*ov = NULL((void *)0);
}
*ov = region_alloc(opt->region, (nvc + 1) * sizeof(*nv));
for(ovc = 0; nv[ovc] != NULL((void *)0); ovc++) {
(*ov)[ovc] = region_strdup(opt->region, nv[ovc]);
}
(*ov)[ovc] = NULL((void *)0);
assert(ovc == nvc)((void)0);
1071}

1073static void
1074copy_pat_fixed(region_type* region, struct pattern_options* orig,
struct pattern_options* p)
1076{
orig->allow_axfr_fallback = p->allow_axfr_fallback;
orig->allow_axfr_fallback_is_default =
p->allow_axfr_fallback_is_default;
orig->notify_retry = p->notify_retry;
orig->notify_retry_is_default = p->notify_retry_is_default;
orig->implicit = p->implicit;
if(p->zonefile)
orig->zonefile = region_strdup(region, p->zonefile);
else orig->zonefile = NULL((void *)0);
if(p->zonestats)
orig->zonestats = region_strdup(region, p->zonestats);
else orig->zonestats = NULL((void *)0);
orig->max_refresh_time = p->max_refresh_time;
orig->max_refresh_time_is_default = p->max_refresh_time_is_default;
orig->min_refresh_time = p->min_refresh_time;
orig->min_refresh_time_is_default = p->min_refresh_time_is_default;
orig->max_retry_time = p->max_retry_time;
orig->max_retry_time_is_default = p->max_retry_time_is_default;
orig->min_retry_time = p->min_retry_time;
orig->min_retry_time_is_default = p->min_retry_time_is_default;
orig->min_expire_time = p->min_expire_time;
orig->min_expire_time_expr = p->min_expire_time_expr;
1099#ifdef RATELIMIT
orig->rrl_whitelist = p->rrl_whitelist;
1101#endif
orig->multi_master_check = p->multi_master_check;
orig->store_ixfr = p->store_ixfr;
orig->store_ixfr_is_default = p->store_ixfr_is_default;
orig->ixfr_size = p->ixfr_size;
orig->ixfr_size_is_default = p->ixfr_size_is_default;
orig->ixfr_number = p->ixfr_number;
orig->ixfr_number_is_default = p->ixfr_number_is_default;
orig->create_ixfr = p->create_ixfr;
orig->create_ixfr_is_default = p->create_ixfr_is_default;
orig->verify_zone = p->verify_zone;
orig->verify_zone_is_default = p->verify_zone_is_default;
orig->verifier_timeout = p->verifier_timeout;
orig->verifier_timeout_is_default = p->verifier_timeout_is_default;
orig->verifier_feed_zone = p->verifier_feed_zone;
orig->verifier_feed_zone_is_default = p->verifier_feed_zone_is_default;
1117}

1119void
1120pattern_options_add_modify(struct nsd_options* opt, struct pattern_options* p)
1121{
struct pattern_options* orig = pattern_options_find(opt, p->pname);
if(!orig) {
/* needs to be copied to opt region */
orig = pattern_options_create(opt->region);
orig->pname = region_strdup(opt->region, p->pname);
copy_pat_fixed(opt->region, orig, p);
orig->allow_notify = copy_acl_list(opt, p->allow_notify);
orig->request_xfr = copy_acl_list(opt, p->request_xfr);
orig->notify = copy_acl_list(opt, p->notify);
orig->provide_xfr = copy_acl_list(opt, p->provide_xfr);
orig->allow_query = copy_acl_list(opt, p->allow_query);
orig->outgoing_interface = copy_acl_list(opt,
	p->outgoing_interface);
copy_changed_verifier(opt, &orig->verifier, p->verifier);
nsd_options_insert_pattern(opt, orig);
} else {
/* modify in place so pointers stay valid (and copy
   into region). Do not touch unchanged acls. */
if(orig->zonefile)
	region_recycle(opt->region, (char*)orig->zonefile,
		strlen(orig->zonefile)+1);
if(orig->zonestats)
	region_recycle(opt->region, (char*)orig->zonestats,
		strlen(orig->zonestats)+1);
copy_pat_fixed(opt->region, orig, p);
copy_changed_acl(opt, &orig->allow_notify, p->allow_notify);
copy_changed_acl(opt, &orig->request_xfr, p->request_xfr);
copy_changed_acl(opt, &orig->notify, p->notify);
copy_changed_acl(opt, &orig->provide_xfr, p->provide_xfr);
copy_changed_acl(opt, &orig->allow_query, p->allow_query);
copy_changed_acl(opt, &orig->outgoing_interface,
	p->outgoing_interface);
copy_changed_verifier(opt, &orig->verifier, p->verifier);
}
1156}

1158struct pattern_options*
1159pattern_options_find(struct nsd_options* opt, const char* name)
1160{
return (struct pattern_options*)rbtree_search(opt->patterns, name);
1162}

1164static int
1165pattern_verifiers_equal(const char **vp, const char **vq)
1166{
size_t vpc, vqc;
if(vp == NULL((void *)0))
return vq == NULL((void *)0);
if(vq == NULL((void *)0))
return 0;
for(vpc = 0; vp[vpc] != NULL((void *)0); vpc++) ;
for(vqc = 0; vq[vqc] != NULL((void *)0); vqc++) ;
if(vpc != vqc)
return 0;
for(vpc = 0; vp[vpc] != NULL((void *)0); vpc++) {
assert(vq[vpc] != NULL)((void)0);
if (strcmp(vp[vpc], vq[vpc]) != 0)
	return 0;
}
return 1;
1182}

1184int
1185pattern_options_equal(struct pattern_options* p, struct pattern_options* q)
1186{
if(strcmp(p->pname, q->pname) != 0) return 0;
if(!p->zonefile && q->zonefile) return 0;
else if(p->zonefile && !q->zonefile) return 0;
else if(p->zonefile && q->zonefile) {
if(strcmp(p->zonefile, q->zonefile) != 0) return 0;
}
if(!p->zonestats && q->zonestats) return 0;
else if(p->zonestats && !q->zonestats) return 0;
else if(p->zonestats && q->zonestats) {
if(strcmp(p->zonestats, q->zonestats) != 0) return 0;
}
if(!booleq(p->allow_axfr_fallback, q->allow_axfr_fallback)( ((p->allow_axfr_fallback) && (q->allow_axfr_fallback
)) || (!(p->allow_axfr_fallback) && !(q->allow_axfr_fallback
)) )) return 0;
if(!booleq(p->allow_axfr_fallback_is_default,( ((p->allow_axfr_fallback_is_default) && (q->allow_axfr_fallback_is_default
)) || (!(p->allow_axfr_fallback_is_default) && !(q
->allow_axfr_fallback_is_default)) )
q->allow_axfr_fallback_is_default)( ((p->allow_axfr_fallback_is_default) && (q->allow_axfr_fallback_is_default
)) || (!(p->allow_axfr_fallback_is_default) && !(q
->allow_axfr_fallback_is_default)) )) return 0;
if(p->notify_retry != q->notify_retry) return 0;
if(!booleq(p->notify_retry_is_default,( ((p->notify_retry_is_default) && (q->notify_retry_is_default
)) || (!(p->notify_retry_is_default) && !(q->notify_retry_is_default
)) )
q->notify_retry_is_default)( ((p->notify_retry_is_default) && (q->notify_retry_is_default
)) || (!(p->notify_retry_is_default) && !(q->notify_retry_is_default
)) )) return 0;
if(!booleq(p->implicit, q->implicit)( ((p->implicit) && (q->implicit)) || (!(p->
implicit) && !(q->implicit)) )) return 0;
if(!acl_list_equal(p->allow_notify, q->allow_notify)) return 0;
if(!acl_list_equal(p->request_xfr, q->request_xfr)) return 0;
if(!acl_list_equal(p->notify, q->notify)) return 0;
if(!acl_list_equal(p->provide_xfr, q->provide_xfr)) return 0;
if(!acl_list_equal(p->allow_query, q->allow_query)) return 0;
if(!acl_list_equal(p->outgoing_interface, q->outgoing_interface))
return 0;
if(p->max_refresh_time != q->max_refresh_time) return 0;
if(!booleq(p->max_refresh_time_is_default,( ((p->max_refresh_time_is_default) && (q->max_refresh_time_is_default
)) || (!(p->max_refresh_time_is_default) && !(q->
max_refresh_time_is_default)) )
q->max_refresh_time_is_default)( ((p->max_refresh_time_is_default) && (q->max_refresh_time_is_default
)) || (!(p->max_refresh_time_is_default) && !(q->
max_refresh_time_is_default)) )) return 0;
if(p->min_refresh_time != q->min_refresh_time) return 0;
if(!booleq(p->min_refresh_time_is_default,( ((p->min_refresh_time_is_default) && (q->min_refresh_time_is_default
)) || (!(p->min_refresh_time_is_default) && !(q->
min_refresh_time_is_default)) )
q->min_refresh_time_is_default)( ((p->min_refresh_time_is_default) && (q->min_refresh_time_is_default
)) || (!(p->min_refresh_time_is_default) && !(q->
min_refresh_time_is_default)) )) return 0;
if(p->max_retry_time != q->max_retry_time) return 0;
if(!booleq(p->max_retry_time_is_default,( ((p->max_retry_time_is_default) && (q->max_retry_time_is_default
)) || (!(p->max_retry_time_is_default) && !(q->
max_retry_time_is_default)) )
q->max_retry_time_is_default)( ((p->max_retry_time_is_default) && (q->max_retry_time_is_default
)) || (!(p->max_retry_time_is_default) && !(q->
max_retry_time_is_default)) )) return 0;
if(p->min_retry_time != q->min_retry_time) return 0;
if(!booleq(p->min_retry_time_is_default,( ((p->min_retry_time_is_default) && (q->min_retry_time_is_default
)) || (!(p->min_retry_time_is_default) && !(q->
min_retry_time_is_default)) )
q->min_retry_time_is_default)( ((p->min_retry_time_is_default) && (q->min_retry_time_is_default
)) || (!(p->min_retry_time_is_default) && !(q->
min_retry_time_is_default)) )) return 0;
if(p->min_expire_time != q->min_expire_time) return 0;
if(!expire_expr_eq(p->min_expire_time_expr,( ( (p->min_expire_time_expr) == 2 && (q->min_expire_time_expr
) == 2 ) || ( (p->min_expire_time_expr) != 2 && (q
->min_expire_time_expr) != 2 && ( (((p->min_expire_time_expr
)) && ((q->min_expire_time_expr))) || (!((p->min_expire_time_expr
)) && !((q->min_expire_time_expr))) )))
q->min_expire_time_expr)( ( (p->min_expire_time_expr) == 2 && (q->min_expire_time_expr
) == 2 ) || ( (p->min_expire_time_expr) != 2 && (q
->min_expire_time_expr) != 2 && ( (((p->min_expire_time_expr
)) && ((q->min_expire_time_expr))) || (!((p->min_expire_time_expr
)) && !((q->min_expire_time_expr))) )))) return 0;
1227#ifdef RATELIMIT
if(p->rrl_whitelist != q->rrl_whitelist) return 0;
1229#endif
if(!booleq(p->multi_master_check,q->multi_master_check)( ((p->multi_master_check) && (q->multi_master_check
)) || (!(p->multi_master_check) && !(q->multi_master_check
)) )) return 0;
if(p->size_limit_xfr != q->size_limit_xfr) return 0;
if(!booleq(p->store_ixfr,q->store_ixfr)( ((p->store_ixfr) && (q->store_ixfr)) || (!(p->
store_ixfr) && !(q->store_ixfr)) )) return 0;
if(!booleq(p->store_ixfr_is_default,q->store_ixfr_is_default)( ((p->store_ixfr_is_default) && (q->store_ixfr_is_default
)) || (!(p->store_ixfr_is_default) && !(q->store_ixfr_is_default
)) )) return 0;
if(p->ixfr_size != q->ixfr_size) return 0;
if(!booleq(p->ixfr_size_is_default,q->ixfr_size_is_default)( ((p->ixfr_size_is_default) && (q->ixfr_size_is_default
)) || (!(p->ixfr_size_is_default) && !(q->ixfr_size_is_default
)) )) return 0;
if(p->ixfr_number != q->ixfr_number) return 0;
if(!booleq(p->ixfr_number_is_default,q->ixfr_number_is_default)( ((p->ixfr_number_is_default) && (q->ixfr_number_is_default
)) || (!(p->ixfr_number_is_default) && !(q->ixfr_number_is_default
)) )) return 0;
if(!booleq(p->create_ixfr,q->create_ixfr)( ((p->create_ixfr) && (q->create_ixfr)) || (!(
p->create_ixfr) && !(q->create_ixfr)) )) return 0;
if(!booleq(p->create_ixfr_is_default,q->create_ixfr_is_default)( ((p->create_ixfr_is_default) && (q->create_ixfr_is_default
)) || (!(p->create_ixfr_is_default) && !(q->create_ixfr_is_default
)) )) return 0;
if(p->verify_zone != q->verify_zone) return 0;
if(!booleq(p->verify_zone_is_default,( ((p->verify_zone_is_default) && (q->verify_zone_is_default
)) || (!(p->verify_zone_is_default) && !(q->verify_zone_is_default
)) )
q->verify_zone_is_default)( ((p->verify_zone_is_default) && (q->verify_zone_is_default
)) || (!(p->verify_zone_is_default) && !(q->verify_zone_is_default
)) )) return 0;
if(!pattern_verifiers_equal((const char **)p->verifier,
(const char **)q->verifier)) return 0;
if(p->verifier_feed_zone != q->verifier_feed_zone) return 0;
if(!booleq(p->verifier_feed_zone_is_default,( ((p->verifier_feed_zone_is_default) && (q->verifier_feed_zone_is_default
)) || (!(p->verifier_feed_zone_is_default) && !(q->
verifier_feed_zone_is_default)) )
q->verifier_feed_zone_is_default)( ((p->verifier_feed_zone_is_default) && (q->verifier_feed_zone_is_default
)) || (!(p->verifier_feed_zone_is_default) && !(q->
verifier_feed_zone_is_default)) )) return 0;
if(p->verifier_timeout != q->verifier_timeout) return 0;
if(!booleq(p->verifier_timeout_is_default,( ((p->verifier_timeout_is_default) && (q->verifier_timeout_is_default
)) || (!(p->verifier_timeout_is_default) && !(q->
verifier_timeout_is_default)) )
q->verifier_timeout_is_default)( ((p->verifier_timeout_is_default) && (q->verifier_timeout_is_default
)) || (!(p->verifier_timeout_is_default) && !(q->
verifier_timeout_is_default)) )) return 0;
return 1;
1252}

1254static void
1255marshal_u8(struct buffer* b, uint8_t v)
1256{
buffer_reserve(b, 1);
buffer_write_u8(b, v);
1259}

1261static uint8_t
1262unmarshal_u8(struct buffer* b)
1263{
return buffer_read_u8(b);
1265}

1267static void
1268marshal_u64(struct buffer* b, uint64_t v)
1269{
buffer_reserve(b, 8);
buffer_write_u64(b, v);
1272}

1274static uint64_t
1275unmarshal_u64(struct buffer* b)
1276{
return buffer_read_u64(b);
1278}

1280#ifdef RATELIMIT
1281static void
1282marshal_u16(struct buffer* b, uint16_t v)
1283{
buffer_reserve(b, 2);
buffer_write_u16(b, v);
1286}
1287#endif

1289#ifdef RATELIMIT
1290static uint16_t
1291unmarshal_u16(struct buffer* b)
1292{
return buffer_read_u16(b);
1294}
1295#endif

1297static void
1298marshal_u32(struct buffer* b, uint32_t v)
1299{
buffer_reserve(b, 4);
buffer_write_u32(b, v);
1302}

1304static uint32_t
1305unmarshal_u32(struct buffer* b)
1306{
return buffer_read_u32(b);
1308}

1310static void
1311marshal_str(struct buffer* b, const char* s)
1312{
if(!s) marshal_u8(b, 0);
else {
size_t len = strlen(s);
marshal_u8(b, 1);
buffer_reserve(b, len+1);
buffer_write(b, s, len+1);
}
1320}

1322static char*
1323unmarshal_str(region_type* r, struct buffer* b)
1324{
uint8_t nonnull = unmarshal_u8(b);
if(nonnull) {
char* result = region_strdup(r, (char*)buffer_current(b));
size_t len = strlen((char*)buffer_current(b));
buffer_skip(b, len+1);
return result;
} else return NULL((void *)0);
1332}

1334static void
1335marshal_acl(struct buffer* b, struct acl_options* acl)
1336{
buffer_reserve(b, sizeof(*acl));
buffer_write(b, acl, sizeof(*acl));
marshal_str(b, acl->ip_address_spec);
marshal_str(b, acl->key_name);
marshal_str(b, acl->tls_auth_name);
1342}

1344static struct acl_options*
1345unmarshal_acl(region_type* r, struct buffer* b)
1346{
struct acl_options* acl = (struct acl_options*)region_alloc(r,
sizeof(*acl));
buffer_read(b, acl, sizeof(*acl));
acl->next = NULL((void *)0);
acl->key_options = NULL((void *)0);
acl->tls_auth_options = NULL((void *)0);
acl->ip_address_spec = unmarshal_str(r, b);
acl->key_name = unmarshal_str(r, b);
acl->tls_auth_name = unmarshal_str(r, b);
return acl;
1357}

1359static void
1360marshal_acl_list(struct buffer* b, struct acl_options* list)
1361{
while(list) {
marshal_u8(b, 1); /* is there a next one marker */
marshal_acl(b, list);
list = list->next;
}
marshal_u8(b, 0); /* end of list marker */
1368}

1370static struct acl_options*
1371unmarshal_acl_list(region_type* r, struct buffer* b)
1372{
struct acl_options* a, *last=NULL((void *)0), *list=NULL((void *)0);
while(unmarshal_u8(b)) {
a = unmarshal_acl(r, b);
/* link in */
a->next = NULL((void *)0);
if(!list) list = a;
else last->next = a;
last = a;
}
return list;
1383}

1385static void
1386marshal_strv(struct buffer* b, char **strv)
1387{
uint32_t i, n;

assert(b != NULL)((void)0);

if (strv == NULL((void *)0)) {
marshal_u32(b, 0);
return;
}
for(n = 0; strv[n]; n++) {
/* do nothing */
}
marshal_u32(b, n);
for(i = 0; strv[i] != NULL((void *)0); i++) {
marshal_str(b, strv[i]);
}
marshal_u8(b, 0);
1404}

1406static char **
1407unmarshal_strv(region_type* r, struct buffer* b)
1408{
uint32_t i, n;
char **strv;

assert(r != NULL)((void)0);
assert(b != NULL)((void)0);

if ((n = unmarshal_u32(b)) == 0) {
return NULL((void *)0);
}
strv = region_alloc_zero(r, (n + 1) * sizeof(char *));
for(i = 0; i <= n; i++) {
strv[i] = unmarshal_str(r, b);
}
assert(i == (n + 1))((void)0);
assert(strv[i - 1] == NULL)((void)0);

return strv;
1426}

1428void
1429pattern_options_marshal(struct buffer* b, struct pattern_options* p)
1430{
marshal_str(b, p->pname);
marshal_str(b, p->zonefile);
marshal_str(b, p->zonestats);
1434#ifdef RATELIMIT
marshal_u16(b, p->rrl_whitelist);
1436#endif
marshal_u8(b, p->allow_axfr_fallback);
marshal_u8(b, p->allow_axfr_fallback_is_default);
marshal_u8(b, p->notify_retry);
marshal_u8(b, p->notify_retry_is_default);
marshal_u8(b, p->implicit);
marshal_u64(b, p->size_limit_xfr);
marshal_acl_list(b, p->allow_notify);
marshal_acl_list(b, p->request_xfr);
marshal_acl_list(b, p->notify);
marshal_acl_list(b, p->provide_xfr);
marshal_acl_list(b, p->allow_query);
marshal_acl_list(b, p->outgoing_interface);
marshal_u32(b, p->max_refresh_time);
marshal_u8(b, p->max_refresh_time_is_default);
marshal_u32(b, p->min_refresh_time);
marshal_u8(b, p->min_refresh_time_is_default);
marshal_u32(b, p->max_retry_time);
marshal_u8(b, p->max_retry_time_is_default);
marshal_u32(b, p->min_retry_time);
marshal_u8(b, p->min_retry_time_is_default);
marshal_u32(b, p->min_expire_time);
marshal_u8(b, p->min_expire_time_expr);
marshal_u8(b, p->multi_master_check);
marshal_u8(b, p->store_ixfr);
marshal_u8(b, p->store_ixfr_is_default);
marshal_u64(b, p->ixfr_size);
marshal_u8(b, p->ixfr_size_is_default);
marshal_u32(b, p->ixfr_number);
marshal_u8(b, p->ixfr_number_is_default);
marshal_u8(b, p->create_ixfr);
marshal_u8(b, p->create_ixfr_is_default);
marshal_u8(b, p->verify_zone);
marshal_u8(b, p->verify_zone_is_default);
marshal_strv(b, p->verifier);
marshal_u8(b, p->verifier_feed_zone);
marshal_u8(b, p->verifier_feed_zone_is_default);
marshal_u32(b, p->verifier_timeout);
marshal_u8(b, p->verifier_timeout_is_default);
1475}

1477struct pattern_options*
1478pattern_options_unmarshal(region_type* r, struct buffer* b)
1479{
struct pattern_options* p = pattern_options_create(r);
p->pname = unmarshal_str(r, b);
p->zonefile = unmarshal_str(r, b);
p->zonestats = unmarshal_str(r, b);
1484#ifdef RATELIMIT
p->rrl_whitelist = unmarshal_u16(b);
1486#endif
p->allow_axfr_fallback = unmarshal_u8(b);
p->allow_axfr_fallback_is_default = unmarshal_u8(b);
p->notify_retry = unmarshal_u8(b);
p->notify_retry_is_default = unmarshal_u8(b);
p->implicit = unmarshal_u8(b);
p->size_limit_xfr = unmarshal_u64(b);
p->allow_notify = unmarshal_acl_list(r, b);
p->request_xfr = unmarshal_acl_list(r, b);
p->notify = unmarshal_acl_list(r, b);
p->provide_xfr = unmarshal_acl_list(r, b);
p->allow_query = unmarshal_acl_list(r, b);
p->outgoing_interface = unmarshal_acl_list(r, b);
p->max_refresh_time = unmarshal_u32(b);
p->max_refresh_time_is_default = unmarshal_u8(b);
p->min_refresh_time = unmarshal_u32(b);
p->min_refresh_time_is_default = unmarshal_u8(b);
p->max_retry_time = unmarshal_u32(b);
p->max_retry_time_is_default = unmarshal_u8(b);
p->min_retry_time = unmarshal_u32(b);
p->min_retry_time_is_default = unmarshal_u8(b);
p->min_expire_time = unmarshal_u32(b);
p->min_expire_time_expr = unmarshal_u8(b);
p->multi_master_check = unmarshal_u8(b);
p->store_ixfr = unmarshal_u8(b);
p->store_ixfr_is_default = unmarshal_u8(b);
p->ixfr_size = unmarshal_u64(b);
p->ixfr_size_is_default = unmarshal_u8(b);
p->ixfr_number = unmarshal_u32(b);
p->ixfr_number_is_default = unmarshal_u8(b);
p->create_ixfr = unmarshal_u8(b);
p->create_ixfr_is_default = unmarshal_u8(b);
p->verify_zone = unmarshal_u8(b);
p->verify_zone_is_default = unmarshal_u8(b);
p->verifier = unmarshal_strv(r, b);
p->verifier_feed_zone = unmarshal_u8(b);
p->verifier_feed_zone_is_default = unmarshal_u8(b);
p->verifier_timeout = unmarshal_u32(b);
p->verifier_timeout_is_default = unmarshal_u8(b);
return p;
1526}

1528struct key_options*
1529key_options_create(region_type* region)
1530{
struct key_options* key;
key = (struct key_options*)region_alloc_zero(region,
sizeof(struct key_options));
return key;
1535}

1537struct tls_auth_options*
1538tls_auth_options_create(region_type* region)
1539{
struct tls_auth_options* tls_auth_options;
tls_auth_options = (struct tls_auth_options*)region_alloc_zero(region, sizeof(struct tls_auth_options));
return tls_auth_options;
1543}

1545void
1546key_options_insert(struct nsd_options* opt, struct key_options* key)
1547{
if(!key->name) return;
key->node.key = key->name;
(void)rbtree_insert(opt->keys, &key->node);
1551}

1553struct key_options*
1554key_options_find(struct nsd_options* opt, const char* name)
1555{
return (struct key_options*)rbtree_search(opt->keys, name);
1557}

1559void
1560tls_auth_options_insert(struct nsd_options* opt, struct tls_auth_options* auth)
1561{
if(!auth->name) return;
auth->node.key = auth->name;
(void)rbtree_insert(opt->tls_auths, &auth->node);
1565}

1567struct tls_auth_options*
1568tls_auth_options_find(struct nsd_options* opt, const char* name)
1569{
return (struct tls_auth_options*)rbtree_search(opt->tls_auths, name);
1571}

1573/** remove tsig_key contents */
1574void
1575key_options_desetup(region_type* region, struct key_options* key)
1576{
/* keep tsig_key pointer so that existing references keep valid */
if(!key->tsig_key)
return;
/* name stays the same */
if(key->tsig_key->data) {
/* wipe secret! */
memset(key->tsig_key->data, 0xdd, key->tsig_key->size);
region_recycle(region, key->tsig_key->data,
	key->tsig_key->size);
key->tsig_key->data = NULL((void *)0);
key->tsig_key->size = 0;
}
1589}

1591/** add tsig_key contents */
1592void
1593key_options_setup(region_type* region, struct key_options* key)
1594{
uint8_t data[16384]; /* 16KB */
int size;
if(!key->tsig_key) {
/* create it */
key->tsig_key = (tsig_key_type *) region_alloc(region,
	sizeof(tsig_key_type));
/* create name */
key->tsig_key->name = dname_parse(region, key->name);
if(!key->tsig_key->name) {
	log_msg(LOG_ERR3, "Failed to parse tsig key name %s",
		key->name);
	/* key and base64 were checked during syntax parse */
	exit(1);
}
key->tsig_key->size = 0;
key->tsig_key->data = NULL((void *)0);
}
size = __b64_pton(key->secret, data, sizeof(data));
if(size == -1) {
log_msg(LOG_ERR3, "Failed to parse tsig key data %s",
	key->name);
/* key and base64 were checked during syntax parse */
exit(1);
}
key->tsig_key->size = size;
key->tsig_key->data = (uint8_t *)region_alloc_init(region, data, size);
1621}

1623void
1624key_options_remove(struct nsd_options* opt, const char* name)
1625{
struct key_options* k = key_options_find(opt, name);
if(!k) return;
(void)rbtree_delete(opt->keys, name);
if(k->name)
region_recycle(opt->region, k->name, strlen(k->name)+1);
if(k->algorithm)
region_recycle(opt->region, k->algorithm, strlen(k->algorithm)+1);
if(k->secret) {
memset(k->secret, 0xdd, strlen(k->secret)); /* wipe secret! */
region_recycle(opt->region, k->secret, strlen(k->secret)+1);
}
if(k->tsig_key) {
tsig_del_key(k->tsig_key);
if(k->tsig_key->name)
	region_recycle(opt->region, (void*)k->tsig_key->name,
		dname_total_size(k->tsig_key->name));
key_options_desetup(opt->region, k);
region_recycle(opt->region, k->tsig_key, sizeof(tsig_key_type));
}
region_recycle(opt->region, k, sizeof(struct key_options));
1646}

1648int
1649key_options_equal(struct key_options* p, struct key_options* q)
1650{
return strcmp(p->name, q->name)==0 && strcmp(p->algorithm,
q->algorithm)==0 && strcmp(p->secret, q->secret)==0;
1653}

1655void
1656key_options_add_modify(struct nsd_options* opt, struct key_options* key)
1657{
struct key_options* orig = key_options_find(opt, key->name);
if(!orig) {
/* needs to be copied to opt region */
orig = key_options_create(opt->region);
orig->name = region_strdup(opt->region, key->name);
orig->algorithm = region_strdup(opt->region, key->algorithm);
orig->secret = region_strdup(opt->region, key->secret);
key_options_setup(opt->region, orig);
tsig_add_key(orig->tsig_key);
key_options_insert(opt, orig);
} else {
/* modify entries in existing key, and copy to opt region */
key_options_desetup(opt->region, orig);
region_recycle(opt->region, orig->algorithm,
	strlen(orig->algorithm)+1);
orig->algorithm = region_strdup(opt->region, key->algorithm);
region_recycle(opt->region, orig->secret,
	strlen(orig->secret)+1);
orig->secret = region_strdup(opt->region, key->secret);
key_options_setup(opt->region, orig);
}
1679}

1681int
1682acl_check_incoming_block_proxy(struct acl_options* acl, struct query* q,
struct acl_options** reason)
1684{
/* check each acl element.
* if it is blocked, return -1.
* return false if no matches for blocked elements. */
if(reason)
*reason = NULL((void *)0);

while(acl)
{
DEBUG(DEBUG_XFRD,2, (LOG_INFO, "proxy testing acl %s %s",
	acl->ip_address_spec, acl->nokey?"NOKEY":
	(acl->blocked?"BLOCKED":acl->key_name)));
if(acl_addr_matches_proxy(acl, q) && acl->blocked) {
	if(reason)
		*reason = acl;
	return -1;
}
acl = acl->next;
}

return 0;
1705}

1707int
1708acl_check_incoming(struct acl_options* acl, struct query* q,
struct acl_options** reason)
1710{
/* check each acl element.
  if 1 blocked element matches - return -1.
  if any element matches - return number.
  else return -1. */
int found_match = -1;
int number = 0;
struct acl_options* match = 0;

if(reason)
*reason = NULL((void *)0);

while(acl)
{
DEBUG(DEBUG_XFRD,2, (LOG_INFO, "testing acl %s %s",
	acl->ip_address_spec, acl->nokey?"NOKEY":
	(acl->blocked?"BLOCKED":acl->key_name)));
if(acl_addr_matches(acl, q) && acl_key_matches(acl, q)) {
	if(!match)
	{
		match = acl; /* remember first match */
		found_match=number;
	}
	if(acl->blocked) {
		if(reason)
			*reason = acl;
		return -1;
	}
}
number++;
acl = acl->next;
}

if(reason)
*reason = match;
return found_match;
1746}

1748#ifdef INET6
1749int
1750acl_addr_matches_ipv6host(struct acl_options* acl, struct sockaddr_storage* addr_storage, unsigned int port)
1751{
struct sockaddr_in6* addr = (struct sockaddr_in6*)addr_storage;
if(acl->port != 0 && acl->port != port)
return 0;
switch(acl->rangetype) {
case acl_range_mask:
case acl_range_subnet:
if(!acl_addr_match_mask((uint32_t*)&acl->addr.addr6, (uint32_t*)&addr->sin6_addr,
	(uint32_t*)&acl->range_mask.addr6, sizeof(struct in6_addr)))
	return 0;
break;
case acl_range_minmax:
if(!acl_addr_match_range_v6((uint32_t*)&acl->addr.addr6, (uint32_t*)&addr->sin6_addr,
	(uint32_t*)&acl->range_mask.addr6, sizeof(struct in6_addr)))
	return 0;
break;
case acl_range_single:
default:
if(memcmp(&addr->sin6_addr, &acl->addr.addr6,
	sizeof(struct in6_addr)) != 0)
	return 0;
break;
}
return 1;
1775}
1776#endif

1778int
1779acl_addr_matches_ipv4host(struct acl_options* acl, struct sockaddr_in* addr, unsigned int port)
1780{
if(acl->port != 0 && acl->port != port)
return 0;
switch(acl->rangetype) {
case acl_range_mask:
case acl_range_subnet:
if(!acl_addr_match_mask((uint32_t*)&acl->addr.addr, (uint32_t*)&addr->sin_addr,
	(uint32_t*)&acl->range_mask.addr, sizeof(struct in_addr)))
	return 0;
break;
case acl_range_minmax:
if(!acl_addr_match_range_v4((uint32_t*)&acl->addr.addr, (uint32_t*)&addr->sin_addr,
	(uint32_t*)&acl->range_mask.addr, sizeof(struct in_addr)))
	return 0;
break;
case acl_range_single:
default:
if(memcmp(&addr->sin_addr, &acl->addr.addr,
	sizeof(struct in_addr)) != 0)
	return 0;
break;
}
return 1;
1803}

1805int
1806acl_addr_matches_host(struct acl_options* acl, struct acl_options* host)
1807{
if(acl->is_ipv6)
{
1810#ifdef INET6
struct sockaddr_storage* addr = (struct sockaddr_storage*)&host->addr;
if(!host->is_ipv6) return 0;
return acl_addr_matches_ipv6host(acl, addr, host->port);
1814#else
return 0; /* no inet6, no match */
1816#endif
}
else
{
struct sockaddr_in* addr = (struct sockaddr_in*)&host->addr;
if(host->is_ipv6) return 0;
return acl_addr_matches_ipv4host(acl, addr, host->port);
}
/* ENOTREACH */
return 0;
1826}

1828int
1829acl_addr_matches(struct acl_options* acl, struct query* q)
1830{
if(acl->is_ipv6)
{
1833#ifdef INET6
struct sockaddr_storage* addr = (struct sockaddr_storage*)&q->client_addr;
if(addr->ss_family != AF_INET624)
	return 0;
return acl_addr_matches_ipv6host(acl, addr, ntohs(((struct sockaddr_in6*)addr)->sin6_port)(__uint16_t)(__builtin_constant_p(((struct sockaddr_in6*)addr
)->sin6_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in6
*)addr)->sin6_port) & 0xffU) << 8 | ((__uint16_t
)(((struct sockaddr_in6*)addr)->sin6_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in6*)addr)->sin6_port)));
1838#else
return 0; /* no inet6, no match */
1840#endif
}
else
{
struct sockaddr_in* addr = (struct sockaddr_in*)&q->client_addr;
if(addr->sin_family != AF_INET2)
	return 0;
return acl_addr_matches_ipv4host(acl, addr, ntohs(addr->sin_port)(__uint16_t)(__builtin_constant_p(addr->sin_port) ? (__uint16_t
)(((__uint16_t)(addr->sin_port) & 0xffU) << 8 | (
(__uint16_t)(addr->sin_port) & 0xff00U) >> 8) : __swap16md
(addr->sin_port)));
}
/* ENOTREACH */
return 0;
1851}

1853int
1854acl_addr_matches_proxy(struct acl_options* acl, struct query* q)
1855{
if(acl->is_ipv6)
{
1858#ifdef INET6
struct sockaddr_storage* addr = (struct sockaddr_storage*)&q->remote_addr;
if(addr->ss_family != AF_INET624)
	return 0;
return acl_addr_matches_ipv6host(acl, addr, ntohs(((struct sockaddr_in6*)addr)->sin6_port)(__uint16_t)(__builtin_constant_p(((struct sockaddr_in6*)addr
)->sin6_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in6
*)addr)->sin6_port) & 0xffU) << 8 | ((__uint16_t
)(((struct sockaddr_in6*)addr)->sin6_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in6*)addr)->sin6_port)));
1863#else
return 0; /* no inet6, no match */
1865#endif
}
else
{
struct sockaddr_in* addr = (struct sockaddr_in*)&q->remote_addr;
if(addr->sin_family != AF_INET2)
	return 0;
return acl_addr_matches_ipv4host(acl, addr, ntohs(addr->sin_port)(__uint16_t)(__builtin_constant_p(addr->sin_port) ? (__uint16_t
)(((__uint16_t)(addr->sin_port) & 0xffU) << 8 | (
(__uint16_t)(addr->sin_port) & 0xff00U) >> 8) : __swap16md
(addr->sin_port)));
}
/* ENOTREACH */
return 0;
1876}

1878int
1879acl_addr_match_mask(uint32_t* a, uint32_t* b, uint32_t* mask, size_t sz)
1880{
size_t i;
1882#ifndef NDEBUG
assert(sz % 4 == 0)((void)0);
1884#endif
sz /= 4;
for(i=0; i<sz; ++i)
{
if(((*a++)&*mask) != ((*b++)&*mask))
	return 0;
++mask;
}
return 1;
1893}

1895int
1896acl_addr_match_range_v4(uint32_t* minval, uint32_t* x, uint32_t* maxval, size_t sz)
1897{
assert(sz == 4)((void)0); (void)sz;
/* check treats x as one huge number */

/* if outside bounds, we are done */
if(*minval > *x)
return 0;
if(*maxval < *x)
return 0;

return 1;
1908}

1910#ifdef INET6
1911int
1912acl_addr_match_range_v6(uint32_t* minval, uint32_t* x, uint32_t* maxval, size_t sz)
1913{
size_t i;
uint8_t checkmin = 1, checkmax = 1;
1916#ifndef NDEBUG
assert(sz % 4 == 0)((void)0);
1918#endif
/* check treats x as one huge number */
sz /= 4;
for(i=0; i<sz; ++i)
{
/* if outside bounds, we are done */
if(checkmin)
	if(minval[i] > x[i])
		return 0;
if(checkmax)
	if(maxval[i] < x[i])
		return 0;
/* if x is equal to a bound, that bound needs further checks */
if(checkmin && minval[i]!=x[i])
	checkmin = 0;
if(checkmax && maxval[i]!=x[i])
	checkmax = 0;
if(!checkmin && !checkmax)
	return 1; /* will always match */
}
return 1;
1939}
1940#endif /* INET6 */

1942int
1943acl_key_matches(struct acl_options* acl, struct query* q)
1944{
if(acl->blocked)
return 1;
if(acl->nokey) {
if(q->tsig.status == TSIG_NOT_PRESENT)
	return 1;
return 0;
}
/* check name of tsig key */
if(q->tsig.status != TSIG_OK) {
DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail query has no TSIG"));
return 0; /* query has no TSIG */
}
if(q->tsig.error_code != TSIG_ERROR_NOERROR0) {
DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail, tsig has error"));
return 0; /* some tsig error */
}
if(!acl->key_options->tsig_key) {
DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail no config"));
return 0; /* key not properly configured */
}
if(dname_compare(q->tsig.key_name,
acl->key_options->tsig_key->name) != 0) {
DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail wrong key name"));
return 0; /* wrong key name */
}
if(tsig_strlowercmp(q->tsig.algorithm->short_name,
acl->key_options->algorithm) != 0 && (
strncmp("hmac-", q->tsig.algorithm->short_name, 5) != 0 ||
tsig_strlowercmp(q->tsig.algorithm->short_name+5,
acl->key_options->algorithm) != 0) ) {
DEBUG(DEBUG_XFRD,2, (LOG_ERR, "query tsig wrong algorithm"));
return 0; /* no such algo */
}
return 1;
1979}

1981int
1982acl_same_host(struct acl_options* a, struct acl_options* b)
1983{
if(a->is_ipv6 && !b->is_ipv6)
return 0;
if(!a->is_ipv6 && b->is_ipv6)
return 0;
if(a->port != b->port)
return 0;
if(a->rangetype != b->rangetype)
return 0;
if(!a->is_ipv6) {
if(memcmp(&a->addr.addr, &b->addr.addr,
   sizeof(struct in_addr)) != 0)
	return 0;
if(a->rangetype != acl_range_single &&
   memcmp(&a->range_mask.addr, &b->range_mask.addr,
   sizeof(struct in_addr)) != 0)
	return 0;
} else {
2001#ifdef INET6
if(memcmp(&a->addr.addr6, &b->addr.addr6,
   sizeof(struct in6_addr)) != 0)
	return 0;
if(a->rangetype != acl_range_single &&
   memcmp(&a->range_mask.addr6, &b->range_mask.addr6,
   sizeof(struct in6_addr)) != 0)
	return 0;
2009#else
return 0;
2011#endif
}
return 1;
2014}

2016#if defined(HAVE_SSL)
2017void
2018key_options_tsig_add(struct nsd_options* opt)
2019{
struct key_options* optkey;
RBTREE_FOR(optkey, struct key_options*, opt->keys)for(optkey=(struct key_options*)rbtree_first(opt->keys); (
rbnode_type*)optkey != &rbtree_null_node; optkey = (struct
 key_options*)rbtree_next((rbnode_type*)optkey)) {
key_options_setup(opt->region, optkey);
tsig_add_key(optkey->tsig_key);
}
2025}
2026#endif

2028int
2029zone_is_slave(struct zone_options* opt)
2030{
return opt && opt->pattern && opt->pattern->request_xfr != 0;
2032}

2034/* get a character in string (or replacement char if not long enough) */
2035static const char*
2036get_char(const char* str, size_t i)
2037{
static char res[2];
if(i >= strlen(str))
return ".";
res[0] = str[i];
res[1] = 0;
return res;
2044}
2045/* get end label of the zone name (or .) */
2046static const char*
2047get_end_label(struct zone_options* zone, int i)
2048{
const dname_type* d = (const dname_type*)zone->node.key;
if(i >= d->label_count) {
return ".";
}
return wirelabel2str(dname_label(d, i));
2054}
2055/* replace occurrences of one with two */
2056void
2057replace_str(char* str, size_t len, const char* one, const char* two)
2058{
char* pos;
char* at = str;
while( (pos=strstr(at, one)) ) {
if(strlen(str)+strlen(two)-strlen(one) >= len)
	return; /* no more space to replace */
/* stuff before pos is fine */
/* move the stuff after pos to make space for two, add
 * one to length of remainder to also copy the 0 byte end */
memmove(pos+strlen(two), pos+strlen(one),
	strlen(pos+strlen(one))+1);
/* copy in two */
memmove(pos, two, strlen(two));
/* at is end of the newly inserted two (avoids recursion if
 * two contains one) */
at = pos+strlen(two);
}
2075}

2077const char*
2078config_cook_string(struct zone_options* zone, const char* input)
2079{
static char f[1024];
/* if not a template, return as-is */
if(!strchr(input, '%')) {
return input;
}
strlcpy(f, input, sizeof(f));
if(strstr(f, "%1"))
replace_str(f, sizeof(f), "%1", get_char(zone->name, 0));
if(strstr(f, "%2"))
replace_str(f, sizeof(f), "%2", get_char(zone->name, 1));
if(strstr(f, "%3"))
replace_str(f, sizeof(f), "%3", get_char(zone->name, 2));
if(strstr(f, "%z"))
replace_str(f, sizeof(f), "%z", get_end_label(zone, 1));
if(strstr(f, "%y"))
replace_str(f, sizeof(f), "%y", get_end_label(zone, 2));
if(strstr(f, "%x"))
replace_str(f, sizeof(f), "%x", get_end_label(zone, 3));
if(strstr(f, "%s"))
replace_str(f, sizeof(f), "%s", zone->name);
return f;
2101}

2103const char*
2104config_make_zonefile(struct zone_options* zone, struct nsd* nsd)
2105{
static char f[1024];
/* if not a template, return as-is */
if(!strchr(zone->pattern->zonefile, '%')) {
if (nsd->chrootdir && nsd->chrootdir[0] &&
	zone->pattern->zonefile &&
	zone->pattern->zonefile[0] == '/' &&
	strncmp(zone->pattern->zonefile, nsd->chrootdir,
	strlen(nsd->chrootdir)) == 0)
	/* -1 because chrootdir ends in trailing slash */
	return zone->pattern->zonefile + strlen(nsd->chrootdir) - 1;
return zone->pattern->zonefile;
}
strlcpy(f, zone->pattern->zonefile, sizeof(f));
if(strstr(f, "%1"))
replace_str(f, sizeof(f), "%1", get_char(zone->name, 0));
if(strstr(f, "%2"))
replace_str(f, sizeof(f), "%2", get_char(zone->name, 1));
if(strstr(f, "%3"))
replace_str(f, sizeof(f), "%3", get_char(zone->name, 2));
if(strstr(f, "%z"))
replace_str(f, sizeof(f), "%z", get_end_label(zone, 1));
if(strstr(f, "%y"))
replace_str(f, sizeof(f), "%y", get_end_label(zone, 2));
if(strstr(f, "%x"))
replace_str(f, sizeof(f), "%x", get_end_label(zone, 3));
if(strstr(f, "%s"))
replace_str(f, sizeof(f), "%s", zone->name);
if (nsd->chrootdir && nsd->chrootdir[0] && f[0] == '/' &&
strncmp(f, nsd->chrootdir, strlen(nsd->chrootdir)) == 0)
/* -1 because chrootdir ends in trailing slash */
return f + strlen(nsd->chrootdir) - 1;
return f;
2138}

2140struct zone_options*
2141zone_options_find(struct nsd_options* opt, const struct dname* apex)
2142{
return (struct zone_options*) rbtree_search(opt->zone_options, apex);
2144}

2146struct acl_options*
2147acl_find_num(struct acl_options* acl, int num)
2148{
int count = num;
if(num < 0)
return 0;
while(acl && count > 0) {
acl = acl->next;
count--;
}
if(count == 0)
return acl;
return 0;
2159}

2161/* true if ipv6 address, false if ipv4 */
2162int
2163parse_acl_is_ipv6(const char* p)
2164{
/* see if addr is ipv6 or ipv4 -- by : and . */
while(*p) {
if(*p == '.') return 0;
if(*p == ':') return 1;
++p;
}
return 0;
2172}

2174/* returns range type. mask is the 2nd part of the range */
2175int
2176parse_acl_range_type(char* ip, char** mask)
2177{
char *p;
if((p=strchr(ip, '&'))!=0) {
4
←
Assuming the condition is false→
5
←
Taking false branch→
*p = 0;
*mask = p+1;
return acl_range_mask;
}
if((p=strchr(ip, '/'))!=0) {
6
←
Assuming the condition is false→
7
←
Taking false branch→
*p = 0;
*mask = p+1;
return acl_range_subnet;
}
if((p=strchr(ip, '-'))!=0) {
8
←
Assuming the condition is false→
9
←
Taking false branch→
*p = 0;
*mask = p+1;
return acl_range_minmax;
}
*mask = 0;
10
←
Null pointer value stored to 'p'→
return acl_range_single;
2196}

2198/* parses subnet mask, fills 0 mask as well */
2199void
2200parse_acl_range_subnet(char* p, void* addr, int maxbits)
2201{
int subnet_bits = atoi(p);
uint8_t* addr_bytes = (uint8_t*)addr;
if(subnet_bits == 0 && strcmp(p, "0")!=0) {
23
←
Assuming 'subnet_bits' is equal to 0→
24
←
Null pointer passed as 1st argument to string comparison function
c_error("bad subnet range '%s'", p);
return;
}
if(subnet_bits < 0 || subnet_bits > maxbits) {
c_error("subnet of %d bits out of range [0..%d]", subnet_bits, maxbits);
return;
}
/* fill addr with n bits of 1s (struct has been zeroed) */
while(subnet_bits >= 8) {
*addr_bytes++ = 0xff;
subnet_bits -= 8;
}
if(subnet_bits > 0) {
uint8_t shifts[] = {0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff};
*addr_bytes = shifts[subnet_bits];
}
2221}

2223struct acl_options*
2224parse_acl_info(region_type* region, char* ip, const char* key)
2225{
char* p;
struct acl_options* acl = (struct acl_options*)region_alloc(region,
sizeof(struct acl_options));
acl->next = 0;
/* ip */
acl->ip_address_spec = region_strdup(region, ip);
acl->use_axfr_only = 0;
acl->allow_udp = 0;
acl->ixfr_disabled = 0;
acl->bad_xfr_count = 0;
acl->key_options = 0;
acl->tls_auth_options = 0;
acl->tls_auth_name = 0;
acl->is_ipv6 = 0;
acl->port = 0;
memset(&acl->addr, 0, sizeof(union acl_addr_storage));
memset(&acl->range_mask, 0, sizeof(union acl_addr_storage));
if((p=strrchr(ip, '@'))!=0) {
1
Assuming the condition is false→
2
←
Taking false branch→
if(atoi(p+1) == 0) c_error("expected port number after '@'");
else acl->port = atoi(p+1);
*p=0;
}
acl->rangetype = parse_acl_range_type(ip, &p);
3
←
Calling 'parse_acl_range_type'→
11
←
Returning from 'parse_acl_range_type'→
if(parse_acl_is_ipv6(ip)) {
12
←
Assuming the condition is false→
13
←
Taking false branch→
acl->is_ipv6 = 1;
2251#ifdef INET6
if(inet_pton(AF_INET624, ip, &acl->addr.addr6) != 1)
	c_error("Bad ip6 address '%s'", ip);
if(acl->rangetype==acl_range_mask || acl->rangetype==acl_range_minmax) {
	assert(p)((void)0);
	if(inet_pton(AF_INET624, p, &acl->range_mask.addr6) != 1)
		c_error("Bad ip6 address mask '%s'", p);
}
if(acl->rangetype==acl_range_subnet) {
	assert(p)((void)0);
	parse_acl_range_subnet(p, &acl->range_mask.addr6, 128);
}
2263#else
c_error("encountered IPv6 address '%s'.", ip);
2265#endif /* INET6 */
} else {
acl->is_ipv6 = 0;
if(inet_pton(AF_INET2, ip, &acl->addr.addr) != 1)
14
←
Assuming the condition is true→
15
←
Taking true branch→
	c_error("Bad ip4 address '%s'", ip);
if(acl->rangetype==acl_range_mask || acl->rangetype==acl_range_minmax) {
16
←
Assuming field 'rangetype' is not equal to acl_range_mask→
17
←
Assuming field 'rangetype' is not equal to acl_range_minmax→
18
←
Taking false branch→
	assert(p)((void)0);
	if(inet_pton(AF_INET2, p, &acl->range_mask.addr) != 1)
		c_error("Bad ip4 address mask '%s'", p);
}
if(acl->rangetype==acl_range_subnet) {
19
←
Assuming field 'rangetype' is equal to acl_range_subnet→
20
←
Taking true branch→
	assert(p)((void)0);
	parse_acl_range_subnet(p, &acl->range_mask.addr, 32);
21
←
Passing null pointer value via 1st parameter 'p'→
22
←
Calling 'parse_acl_range_subnet'→
}
}

/* key */
if(strcmp(key, "NOKEY")==0) {
acl->nokey = 1;
acl->blocked = 0;
acl->key_name = 0;
} else if(strcmp(key, "BLOCKED")==0) {
acl->nokey = 0;
acl->blocked = 1;
acl->key_name = 0;
} else {
acl->nokey = 0;
acl->blocked = 0;
acl->key_name = region_strdup(region, key);
}
return acl;
2296}

2298/* copy acl list at end of parser start, update current */
2299static
2300void copy_and_append_acls(struct acl_options** start, struct acl_options* list)
2301{
struct acl_options *tail = NULL((void *)0);

assert(start != NULL)((void)0);

tail = *start;
if(tail) {
while(tail->next) {
	tail = tail->next;
}
}

while(list) {
struct acl_options* acl = copy_acl(cfg_parser->opt->region,
	list);
acl->next = NULL((void *)0);
if(tail) {
	tail->next = acl;
} else {
	*start = acl;
}
tail = acl;
list = list->next;
}
2325}

2327void
2328config_apply_pattern(struct pattern_options *dest, const char* name)
2329{
/* find the pattern */
struct pattern_options* pat = pattern_options_find(cfg_parser->opt,
name);
if(!pat) {
c_error("could not find pattern %s", name);
return;
}

/* apply settings */
if(pat->zonefile)
dest->zonefile = region_strdup(cfg_parser->opt->region,
	pat->zonefile);
if(pat->zonestats)
dest->zonestats = region_strdup(cfg_parser->opt->region,
	pat->zonestats);
if(!pat->allow_axfr_fallback_is_default) {
dest->allow_axfr_fallback = pat->allow_axfr_fallback;
dest->allow_axfr_fallback_is_default = 0;
}
if(!pat->notify_retry_is_default) {
dest->notify_retry = pat->notify_retry;
dest->notify_retry_is_default = 0;
}
if(!pat->max_refresh_time_is_default) {
dest->max_refresh_time = pat->max_refresh_time;
dest->max_refresh_time_is_default = 0;
}
if(!pat->min_refresh_time_is_default) {
dest->min_refresh_time = pat->min_refresh_time;
dest->min_refresh_time_is_default = 0;
}
if(!pat->max_retry_time_is_default) {
dest->max_retry_time = pat->max_retry_time;
dest->max_retry_time_is_default = 0;
}
if(!pat->min_retry_time_is_default) {
dest->min_retry_time = pat->min_retry_time;
dest->min_retry_time_is_default = 0;
}
if(!expire_time_is_default(pat->min_expire_time_expr)(!( (pat->min_expire_time_expr) == 2 || (pat->min_expire_time_expr
) == 0 ))) {
dest->min_expire_time = pat->min_expire_time;
dest->min_expire_time_expr = pat->min_expire_time_expr;
}
if(!pat->store_ixfr_is_default) {
dest->store_ixfr = pat->store_ixfr;
dest->store_ixfr_is_default = 0;
}
if(!pat->ixfr_size_is_default) {
dest->ixfr_size = pat->ixfr_size;
dest->ixfr_size_is_default = 0;
}
if(!pat->ixfr_number_is_default) {
dest->ixfr_number = pat->ixfr_number;
dest->ixfr_number_is_default = 0;
}
if(!pat->create_ixfr_is_default) {
dest->create_ixfr = pat->create_ixfr;
dest->create_ixfr_is_default = 0;
}
dest->size_limit_xfr = pat->size_limit_xfr;
2390#ifdef RATELIMIT
dest->rrl_whitelist |= pat->rrl_whitelist;
2392#endif
/* append acl items */
copy_and_append_acls(&dest->allow_notify, pat->allow_notify);
copy_and_append_acls(&dest->request_xfr, pat->request_xfr);
copy_and_append_acls(&dest->notify, pat->notify);
copy_and_append_acls(&dest->provide_xfr, pat->provide_xfr);
copy_and_append_acls(&dest->allow_query, pat->allow_query);
copy_and_append_acls(&dest->outgoing_interface, pat->outgoing_interface);
if(pat->multi_master_check)
dest->multi_master_check = pat->multi_master_check;

if(!pat->verify_zone_is_default) {
dest->verify_zone = pat->verify_zone;
dest->verify_zone_is_default = 0;
}
if(!pat->verifier_timeout_is_default) {
dest->verifier_timeout = pat->verifier_timeout;
dest->verifier_timeout_is_default = 0;
}
if(!pat->verifier_feed_zone_is_default) {
dest->verifier_feed_zone = pat->verifier_feed_zone;
dest->verifier_feed_zone_is_default = 0;
}
if(pat->verifier != NULL((void *)0)) {
size_t cnt;
char **vec;
region_type *region = cfg_parser->opt->region;

for(cnt = 0; pat->verifier[cnt] != NULL((void *)0); cnt++) ;
vec = region_alloc(region, (cnt + 1) * sizeof(char *));
for(cnt = 0; pat->verifier[cnt] != NULL((void *)0); cnt++) {
	vec[cnt] = region_strdup(region, pat->verifier[cnt]);
}
vec[cnt] = NULL((void *)0);
if(dest->verifier != NULL((void *)0)) {
	size_t size;
	for(cnt = 0; dest->verifier[cnt] != NULL((void *)0); cnt++) {
		size = strlen(dest->verifier[cnt]) + 1;
		region_recycle(
			region, dest->verifier[cnt], size);
	}
	size = (cnt + 1) * sizeof(char *);
	region_recycle(region, dest->verifier, size);
}
dest->verifier = vec;
}
2438}

2440void
2441nsd_options_destroy(struct nsd_options* opt)
2442{
region_destroy(opt->region);
2444#ifdef MEMCLEAN /* OS collects memory pages */
c_lex_destroy();
2446#endif
2447}

2449unsigned getzonestatid(struct nsd_options* opt, struct zone_options* zopt)
2450{
2451#ifdef USE_ZONE_STATS
const char* statname;
struct zonestatname* n;
rbnode_type* res;
/* try to find the instantiated zonestat name */
if(!zopt->pattern->zonestats || zopt->pattern->zonestats[0]==0)
return 0; /* no zone stats */
statname = config_cook_string(zopt, zopt->pattern->zonestats);
res = rbtree_search(opt->zonestatnames, statname);
if(res)
return ((struct zonestatname*)res)->id;
/* create it */
n = (struct zonestatname*)region_alloc_zero(opt->region, sizeof(*n));
n->node.key = region_strdup(opt->region, statname);
if(!n->node.key) {
log_msg(LOG_ERR3, "malloc failed: %s", strerror(errno(*__errno())));
exit(1);
}
n->id = (unsigned)(opt->zonestatnames->count);
rbtree_insert(opt->zonestatnames, (rbnode_type*)n);
return n->id;
2472#else /* USE_ZONE_STATS */
(void)opt; (void)zopt;
return 0;
2475#endif /* USE_ZONE_STATS */
2476}

2478/** check if config turns on IP-address interface with certificates or a
* named pipe without certificates. */
2480int
2481options_remote_is_address(struct nsd_options* cfg)
2482{
if(!cfg->control_enable) return 0;
if(!cfg->control_interface) return 1;
if(!cfg->control_interface->address) return 1;
if(cfg->control_interface->address[0] == 0) return 1;
return (cfg->control_interface->address[0] != '/');
2488}

2490#ifdef HAVE_GETIFADDRS1
2491static void
2492resolve_ifa_name(struct ifaddrs *ifas, const char *search_ifa, char ***ip_addresses, size_t *ip_addresses_size)
2493{
struct ifaddrs *ifa;
size_t last_ip_addresses_size = *ip_addresses_size;

for(ifa = ifas; ifa != NULL((void *)0); ifa = ifa->ifa_next) {
sa_family_t family;
const char* atsign;
2500#ifdef INET6      /* |   address ip    | % |  ifa name  | @ |  port  | nul */
char addr_buf[INET6_ADDRSTRLEN46 + 1 + IF_NAMESIZE16 + 1 + 16 + 1];
2502#else
char addr_buf[INET_ADDRSTRLEN16 + 1 + 16 + 1];
2504#endif

if((atsign=strrchr(search_ifa, '@')) != NULL((void *)0)) {
	if(strlen(ifa->ifa_name) != (size_t)(atsign-search_ifa)
	   || strncmp(ifa->ifa_name, search_ifa,
	   atsign-search_ifa) != 0)
		continue;
} else {
	if(strcmp(ifa->ifa_name, search_ifa) != 0)
		continue;
	atsign = "";
}

if(ifa->ifa_addr == NULL((void *)0))
	continue;

family = ifa->ifa_addr->sa_family;
if(family == AF_INET2) {
	char a4[INET_ADDRSTRLEN16 + 1];
	struct sockaddr_in *in4 = (struct sockaddr_in *)
		ifa->ifa_addr;
	if(!inet_ntop(family, &in4->sin_addr, a4, sizeof(a4)))
		error("inet_ntop");
	snprintf(addr_buf, sizeof(addr_buf), "%s%s",
		a4, atsign);
}
2530#ifdef INET6
else if(family == AF_INET624) {
	struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)
		ifa->ifa_addr;
	char a6[INET6_ADDRSTRLEN46 + 1];
	char if_index_name[IF_NAMESIZE16 + 1];
	if_index_name[0] = 0;
	if(!inet_ntop(family, &in6->sin6_addr, a6, sizeof(a6)))
		error("inet_ntop");
	if_indextoname(in6->sin6_scope_id,
		(char *)if_index_name);
	if (strlen(if_index_name) != 0) {
		snprintf(addr_buf, sizeof(addr_buf),
			"%s%%%s%s", a6, if_index_name, atsign);
	} else {
		snprintf(addr_buf, sizeof(addr_buf), "%s%s",
			a6, atsign);
	}
}
2549#endif
else {
	continue;
}
VERBOSITY(4, (LOG_INFO, "interface %s has address %s",do { if ((4) <= verbosity) { log_msg (6, "interface %s has address %s"
, search_ifa, addr_buf) ; } } while (0)
	search_ifa, addr_buf))do { if ((4) <= verbosity) { log_msg (6, "interface %s has address %s"
, search_ifa, addr_buf) ; } } while (0);

*ip_addresses = xrealloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1));
(*ip_addresses)[*ip_addresses_size] = xstrdup(addr_buf);
(*ip_addresses_size)++;
}

if (*ip_addresses_size == last_ip_addresses_size) {
*ip_addresses = xrealloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1));
(*ip_addresses)[*ip_addresses_size] = xstrdup(search_ifa);
(*ip_addresses_size)++;
}
2566}

2568static void
2569resolve_interface_names_for_ref(struct ip_address_option** ip_addresses_ref,
struct ifaddrs *addrs, region_type* region)
2571{
struct ip_address_option *ip_addr;
struct ip_address_option *last = NULL((void *)0);
struct ip_address_option *first = NULL((void *)0);

/* replace the list of ip_adresses with a new list where the
* interface names are replaced with their ip-address strings
* from getifaddrs.  An interface can have several addresses. */
for(ip_addr = *ip_addresses_ref; ip_addr; ip_addr = ip_addr->next) {
char **ip_addresses = NULL((void *)0);
size_t ip_addresses_size = 0, i;
resolve_ifa_name(addrs, ip_addr->address, &ip_addresses,
	&ip_addresses_size);

for (i = 0; i < ip_addresses_size; i++) {
	struct ip_address_option *current;
	/* this copies the range_option, dev, and fib from
	 * the original ip_address option to the new ones
	 * with the addresses spelled out by resolve_ifa_name*/
	current = region_alloc_init(region, ip_addr,
		sizeof(*ip_addr));
	current->address = region_strdup(region,
		ip_addresses[i]);
	current->next = NULL((void *)0);
	free(ip_addresses[i]);

	if(first == NULL((void *)0)) {
		first = current;
	} else {
		last->next = current;
	}
	last = current;
}
free(ip_addresses);
}
*ip_addresses_ref = first;

2608}
2609#endif /* HAVE_GETIFADDRS */

2611void
2612resolve_interface_names(struct nsd_options* options)
2613{
2614#ifdef HAVE_GETIFADDRS1
struct ifaddrs *addrs;

if(getifaddrs(&addrs) == -1)
  error("failed to list interfaces");

resolve_interface_names_for_ref(&options->ip_addresses, 
	addrs, options->region);
resolve_interface_names_for_ref(&options->control_interface, 
	addrs, options->region);

freeifaddrs(addrs);
2626#else
(void)options;
2628#endif /* HAVE_GETIFADDRS */
2629}

2631int
2632sockaddr_uses_proxy_protocol_port(struct nsd_options* options,
struct sockaddr* addr)
2634{
struct proxy_protocol_port_list* p;
int port;
2637#ifdef INET6
struct sockaddr_storage* ss = (struct sockaddr_storage*)addr;
if(ss->ss_family == AF_INET624) {
struct sockaddr_in6* a6 = (struct sockaddr_in6*)addr;
port = ntohs(a6->sin6_port)(__uint16_t)(__builtin_constant_p(a6->sin6_port) ? (__uint16_t
)(((__uint16_t)(a6->sin6_port) & 0xffU) << 8 | (
(__uint16_t)(a6->sin6_port) & 0xff00U) >> 8) : __swap16md
(a6->sin6_port));
} else if(ss->ss_family == AF_INET2) {
2643#endif
struct sockaddr_in* a = (struct sockaddr_in*)addr;
2645#ifndef INET6
if(a->sin_family != AF_INET2)
	return 0; /* unknown family */
2648#endif
port = ntohs(a->sin_port)(__uint16_t)(__builtin_constant_p(a->sin_port) ? (__uint16_t
)(((__uint16_t)(a->sin_port) & 0xffU) << 8 | ((__uint16_t
)(a->sin_port) & 0xff00U) >> 8) : __swap16md(a->
sin_port));
2650#ifdef INET6
} else {
return 0; /* unknown family */
}
2654#endif
p = options->proxy_protocol_port;
while(p) {
if(p->port == port)
	return 1;
p = p->next;
}
return 0;
2662}