bind acl 实现
BIND配置中一大堆一大堆的acl,allow-query, allow-recursion, allow-update还有view的match-clients等 acl中的主要存储的就是IP,可以把acl当做是一个IP池,在需要验证的时候就从这个IP池中查找该IP是否存在。那么BIND中如何实现这个非常常用的IP池的呢?
数据结构
acl数据结构
struct dns_acl {
unsigned int magic;
isc_mem_t *mctx;
isc_refcount_t refcount;
dns_iptable_t *iptable;
#define node_count iptable->radix->num_added_node
dns_aclelement_t *elements;
isc_boolean_t has_negatives;
unsigned int alloc; /*%< Elements allocated */
unsigned int length; /*%< Elements initialized */
char *name; /*%< Temporary use only */
ISC_LINK(dns_acl_t) nextincache; /*%< Ditto */
};
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
其中的iptable本质上就是一个radix tree(中文名叫基数树)。
Linux基数树(radix tree)是将指针与long整数键值相关联的机制,它存储有效率,并且可快速查询,用于指针与整数值的映射(如:IDR机制)、内存管理等。
主要函数
acl 环境初始化。
/*%<
* Initialize ACL environment, setting up localhost and localnets ACLs
*/
- 1
- 2
- 3
调用acl初始化的函数
/*
* Create a new ACL, including an IP table and an array with room
* for 'n' ACL elements. The elements are uninitialized and the
* length is 0.
*/
- 1
- 2
- 3
- 4
- 5
dns_acl_create 创建acl,主要是创建一个radix tree
主要API
/*
* Determine whether a given address or signer matches a given ACL.
* For a match with a positive ACL element or iptable radix entry,
* return with a positive value in match; for a match with a negated ACL
* element or radix entry, return with a negative value in match.
*/
- 1
- 2
- 3
- 4
- 5
- 6
typedef struct isc_radix_tree {
unsigned int magic;
isc_mem_t *mctx;
isc_radix_node_t *head;
isc_uint32_t maxbits; /* for IP, 32 bit addresses */
int num_active_node; /* for debugging purposes */
int num_added_node; /* total number of nodes */
} isc_radix_tree_t;
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
typedef struct isc_radix_node {
isc_uint32_t bit; /* bit length of the prefix */
isc_prefix_t *prefix; /* who we are in radix tree */
struct isc_radix_node *l, *r; /* left and right children */
struct isc_radix_node *parent; /* may be used */
void *data[2]; /* pointers to IPv4 and IPV6 data */
int node_num[2]; /* which node this was in the tree,
or -1 for glue nodes */
} isc_radix_node_t;
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
isc_result_t
isc_radix_create(isc_mem_t *mctx, isc_radix_tree_t **target, int maxbits) {
isc_radix_tree_t *radix;
REQUIRE(target != NULL);
radix = isc_mem_get(mctx, sizeof(isc_radix_tree_t));
if (radix == NULL)
return (ISC_R_NOMEMORY);
radix->mctx = mctx;
radix->maxbits = maxbits;
radix->head = NULL;
radix->num_active_node = 0;
radix->num_added_node = 0;
RUNTIME_CHECK(maxbits <= RADIX_MAXBITS); /* XXX */
radix->magic = RADIX_TREE_MAGIC;
*target = radix;
return (ISC_R_SUCCESS);
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
版权声明:本文为博主原创文章,未经博主允许不得转载。 //blog.csdn.net/divlee130/article/details/46407755