/***************************************************************************
 * nbase_addrset.c -- Address set (addrset) management.                          *
 ***********************IMPORTANT NMAP LICENSE TERMS************************
 *                                                                         *
 * The Nmap Security Scanner is (C) 1996-2022 Nmap Software LLC ("The Nmap *
 * Project"). Nmap is also a registered trademark of the Nmap Project.     *
 *                                                                         *
 * This program is distributed under the terms of the Nmap Public Source   *
 * License (NPSL). The exact license text applying to a particular Nmap    *
 * release or source code control revision is contained in the LICENSE     *
 * file distributed with that version of Nmap or source code control       *
 * revision. More Nmap copyright/legal information is available from       *
 * https://nmap.org/book/man-legal.html, and further information on the    *
 * NPSL license itself can be found at https://nmap.org/npsl/ . This       *
 * header summarizes some key points from the Nmap license, but is no      *
 * substitute for the actual license text.                                 *
 *                                                                         *
 * Nmap is generally free for end users to download and use themselves,    *
 * including commercial use. It is available from https://nmap.org.        *
 *                                                                         *
 * The Nmap license generally prohibits companies from using and           *
 * redistributing Nmap in commercial products, but we sell a special Nmap  *
 * OEM Edition with a more permissive license and special features for     *
 * this purpose. See https://nmap.org/oem/                                 *
 *                                                                         *
 * If you have received a written Nmap license agreement or contract       *
 * stating terms other than these (such as an Nmap OEM license), you may   *
 * choose to use and redistribute Nmap under those terms instead.          *
 *                                                                         *
 * The official Nmap Windows builds include the Npcap software             *
 * (https://npcap.com) for packet capture and transmission. It is under    *
 * separate license terms which forbid redistribution without special      *
 * permission. So the official Nmap Windows builds may not be              *
 * redistributed without special permission (such as an Nmap OEM           *
 * license).                                                               *
 *                                                                         *
 * Source is provided to this software because we believe users have a     *
 * right to know exactly what a program is going to do before they run it. *
 * This also allows you to audit the software for security holes.          *
 *                                                                         *
 * Source code also allows you to port Nmap to new platforms, fix bugs,    *
 * and add new features.  You are highly encouraged to submit your         *
 * changes as a Github PR or by email to the dev@nmap.org mailing list     *
 * for possible incorporation into the main distribution. Unless you       *
 * specify otherwise, it is understood that you are offering us very       *
 * broad rights to use your submissions as described in the Nmap Public    *
 * Source License Contributor Agreement. This is important because we      *
 * fund the project by selling licenses with various terms, and also       *
 * because the inability to relicense code has caused devastating          *
 * problems for other Free Software projects (such as KDE and NASM).       *
 *                                                                         *
 * The free version of Nmap is distributed in the hope that it will be     *
 * useful, but WITHOUT ANY WARRANTY; without even the implied warranty of  *
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Warranties,        *
 * indemnification and commercial support are all available through the    *
 * Npcap OEM program--see https://nmap.org/oem/                            *
 *                                                                         *
 ***************************************************************************/

/* $Id$ */

/* The code in this file has tests in the file ncat/tests/test-addrset.sh. Run that
   program after making any big changes. Also, please add tests for any new
   features. */

#include <limits.h> /* CHAR_BIT */
#include <errno.h>
#include <assert.h>

#include "nbase.h"

/* A fancy logging system to allow this file to take advantage of different logging
   systems used by various programs */

static void default_log_user(const char * a, ...){};

static void (*log_user)(const char *, ...) = default_log_user;

static void default_log_debug(const char * a, ...){};

static void (*log_debug)(const char *, ...) = default_log_debug;

void nbase_set_log(void (*log_user_func)(const char *, ...),void (*log_debug_func)(const char *, ...)){
    if (log_user_func == NULL)
        log_user = default_log_user;
    else
        log_user = log_user_func;
    if (log_debug_func == NULL)
        log_debug = default_log_debug;
    else
        log_debug = log_debug_func;
}

/* Node for a radix tree (trie) used to match certain addresses.
 * Currently, only individual numeric IP and IPv6 addresses are matched using
 * the trie. */
struct trie_node {
  /* The address prefix that this node represents. */
  u32 addr[4];
  /* The prefix mask. Bits in addr that are not within this mask are ignored. */
  u32 mask[4];
  /* Addresses with the next bit after the mask equal to 1 are on this branch. */
  struct trie_node *next_bit_one;
  /* Addresses with the next bit after the mask equal to 0 are on this branch. */
  struct trie_node *next_bit_zero;
};

/* We use bit vectors to represent what values are allowed in an IPv4 octet.
   Each vector is built up of an array of bitvector_t (any convenient integer
   type). */
typedef unsigned long bitvector_t;
/* A 256-element bit vector, representing legal values for one octet. */
typedef bitvector_t octet_bitvector[(256 - 1) / (sizeof(unsigned long) * CHAR_BIT) + 1];

/* A chain of tests for set inclusion. If one test is passed, the address is in
   the set. */
struct addrset_elem {
  struct {
    /* A bit vector for each address octet. */
    octet_bitvector bits[4];
  } ipv4;
  struct addrset_elem *next;
};

/* A set of addresses. Used to match against allow/deny lists. */
struct addrset {
    /* Linked list of struct addset_elem. */
    struct addrset_elem *head;
    /* Radix tree for faster matching of certain cases */
    struct trie_node *trie;
};

/* Special node pointer to represent "all possible addresses"
 * This will be used to represent netmask specifications. */
static struct trie_node g_TRIE_NODE_TRUE = {0};
#define TRIE_NODE_TRUE &g_TRIE_NODE_TRUE

struct addrset *addrset_new()
{
    struct addrset *set = (struct addrset *) safe_zalloc(sizeof(struct addrset));
    set->head = NULL;

    /* Allocate the first node of the IPv4 trie */
    set->trie = (struct trie_node *) safe_zalloc(sizeof(struct trie_node));
    return set;
}

static void trie_free(struct trie_node *curr)
{
  /* Since we descend only down one side, we at most accumulate one tree's-depth, or 128.
   * Add 4 for safety to account for special root node and special empty stack position 0.
   */
  struct trie_node *stack[128+4] = {NULL};
  int i = 1;

  while (i > 0 && curr != NULL && curr != TRIE_NODE_TRUE) {
    /* stash next_bit_one */
    if (curr->next_bit_one != NULL && curr->next_bit_one != TRIE_NODE_TRUE) {
      stack[i++] = curr->next_bit_one;
    }
    /* if next_bit_zero is valid, descend */
    if (curr->next_bit_zero != NULL && curr->next_bit_zero != TRIE_NODE_TRUE) {
      curr = curr->next_bit_zero;
    }
    else {
      /* next_bit_one was stashed, next_bit_zero is invalid. Free it and move back up the stack. */
      free(curr);
      curr = stack[--i];
    }
  }
}

void addrset_free(struct addrset *set)
{
    struct addrset_elem *elem, *next;

    for (elem = set->head; elem != NULL; elem = next) {
        next = elem->next;
        free(elem);
    }

    trie_free(set->trie);
    free(set);
}


/* Public domain log2 function. https://graphics.stanford.edu/~seander/bithacks.html#IntegerLogLookup */
static const char LogTable256[256] = {
#define LT(n) n, n, n, n, n, n, n, n, n, n, n, n, n, n, n, n
  -1, 0, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3,
  LT(4), LT(5), LT(5), LT(6), LT(6), LT(6), LT(6),
  LT(7), LT(7), LT(7), LT(7), LT(7), LT(7), LT(7), LT(7)
};

/* Returns a mask representing the common prefix between 2 values. */
static u32 common_mask(u32 a, u32 b)
{
  u8 r;     // r will be lg(v)
  u32 t, tt; // temporaries
  u32 v = a ^ b;
  if (v == 0) {
    /* values are equal, all bits are the same */
    return 0xffffffff;
  }

  if ((tt = v >> 16))
  {
    r = (t = tt >> 8) ? 24 + LogTable256[t] : 16 + LogTable256[tt];
  }
  else
  {
    r = (t = v >> 8) ? 8 + LogTable256[t] : LogTable256[v];
  }
  if (r + 1 >= 32) {
    /* shifting this many bits would overflow. Just return max mask */
    return 0;
  }
  else {
    return ~((1 << (r + 1)) - 1);
  }
}

/* Given a mask and a value, return the value of the bit immediately following
 * the masked bits. */
static u32 next_bit_is_one(u32 mask, u32 value) {
  if (mask == 0) {
    /* no masked bits, check the first bit. */
    return (0x80000000 & value);
  }
  else if (mask == 0xffffffff) {
    /* Imaginary bit off the end we will say is 0 */
    return 0;
  }
  /* isolate the bit by overlapping the mask with its inverse */
  return ((mask >> 1) & ~mask) & value;
}

/* Given a mask and an address, return true if the first unmasked bit is one */
static u32 addr_next_bit_is_one(const u32 *mask, const u32 *addr) {
  u32 curr_mask;
  u8 i;
  for (i = 0; i < 4; i++) {
    curr_mask = mask[i];
    if (curr_mask < 0xffffffff) {
      /* Only bother checking the first not-completely-masked portion of the address */
      return next_bit_is_one(curr_mask, addr[i]);
    }
  }
  /* Mask must be all ones, meaning that the next bit is off the end, and clearly not 1. */
  return 0;
}

/* Return true if the masked portion of a and b is identical */
static int mask_matches(u32 mask, u32 a, u32 b)
{
  return !(mask & (a ^ b));
}

/* Apply a mask and check if 2 addresses are equal */
static int addr_matches(const u32 *mask, const u32 *sa, const u32 *sb)
{
  u32 curr_mask;
  u8 i;
  for (i = 0; i < 4; i++) {
    curr_mask = mask[i];
    if (curr_mask == 0) {
      /* No more applicable bits */
      break;
    }
    else if (!mask_matches(curr_mask, sa[i], sb[i])) {
      /* Doesn't match. */
      return 0;
    }
  }
  /* All applicable bits match. */
  return 1;
}

/* Helper function to allocate and initialize a new node */
static struct trie_node *new_trie_node(const u32 *addr, const u32 *mask)
{
  u8 i;
  struct trie_node *new_node = (struct trie_node *) safe_zalloc(sizeof(struct trie_node));
  for (i=0; i < 4; i++) {
    new_node->addr[i] = addr[i];
    new_node->mask[i] = mask[i];
  }
  /* New nodes default to matching true. Override if not. */
  new_node->next_bit_one = new_node->next_bit_zero = TRIE_NODE_TRUE;
  return new_node;
}

/* Split a node into 2: one that matches the greatest common prefix with addr
 * and one that does not. */
static void trie_split (struct trie_node *this, const u32 *addr, const u32 *mask)
{
  struct trie_node *new_node;
  u32 new_mask[4] = {0,0,0,0};
  u8 i;
  /* Calculate the mask of the common prefix */
  for (i=0; i < 4; i++) {
    new_mask[i] = common_mask(this->addr[i], addr[i]);
    if (new_mask[i] > this->mask[i]){
      /* Addrs have more bits in common than we care about for this node. */
      new_mask[i] = this->mask[i];
    }
    if (new_mask[i] > mask[i]) {
      /* new addr's mask is broader, so this node is superseded. */
      this->mask[i] = mask[i];
      for (i++; i < 4; i++) {
        this->mask[i] = 0;
      }
      /* The longer mask is superseded. Delete following nodes. */
      trie_free(this->next_bit_one);
      trie_free(this->next_bit_zero);
      /* Anything below here will always match. */
      this->next_bit_one = this->next_bit_zero = TRIE_NODE_TRUE;
      return;
    }
    if (new_mask[i] < 0xffffffff) {
      break;
    }
  }
  if (new_mask[i] >= this->mask[i]) {
    /* This node completely contains the new addr and mask. No need to split or add */
    return;
  }
  /* Make a copy of this node to continue matching what it has been */
  new_node = new_trie_node(this->addr, this->mask);
  new_node->next_bit_one = this->next_bit_one;
  new_node->next_bit_zero = this->next_bit_zero;
  /* Adjust this node to the smaller mask */
  for (i=0; i < 4; i++) {
    this->mask[i] = new_mask[i];
  }
  /* Put the new node on the appropriate branch */
  if (addr_next_bit_is_one(this->mask, this->addr)) {
    this->next_bit_one = new_node;
    this->next_bit_zero = NULL;
  }
  else {
    this->next_bit_zero = new_node;
    this->next_bit_one = NULL;
  }
}

/* Helper for address insertion */
static void _trie_insert (struct trie_node *this, const u32 *addr, const u32 *mask)
{
  /* On entry, at least the 1st bit must match this node */
  assert(this == TRIE_NODE_TRUE || (this->addr[0] ^ addr[0]) < (1 << 31));

  while (this != NULL && this != TRIE_NODE_TRUE) {
    /* Split the node if necessary to ensure a match */
    trie_split(this, addr, mask);

    /* At this point, this node matches the addr up to this->mask. */
    if (addr_next_bit_is_one(this->mask, addr)) {
      /* next bit is one: insert on the one branch */
      if (this->next_bit_one == NULL) {
        /* Previously unmatching branch, always the case when splitting */
        this->next_bit_one = new_trie_node(addr, mask);
        return;
      }
      else {
        this = this->next_bit_one;
      }
    }
    else {
      /* next bit is zero: insert on the zero branch */
      if (this->next_bit_zero == NULL) {
        /* Previously unmatching branch, always the case when splitting */
        this->next_bit_zero = new_trie_node(addr, mask);
        return;
      }
      else {
        this = this->next_bit_zero;
      }
    }
  }
}

/* Helper function to turn a sockaddr into an array of u32, used internally */
static int sockaddr_to_addr(const struct sockaddr *sa, u32 *addr)
{
  if (sa->sa_family == AF_INET) {
    /* IPv4-mapped IPv6 address */
    addr[0] = addr[1] = 0;
    addr[2] = 0xffff;
    addr[3] = ntohl(((struct sockaddr_in *) sa)->sin_addr.s_addr);
  }
#ifdef HAVE_IPV6
  else if (sa->sa_family == AF_INET6) {
    u8 i;
    unsigned char *addr6 = ((struct sockaddr_in6 *) sa)->sin6_addr.s6_addr;
    for (i=0; i < 4; i++) {
      addr[i] = (addr6[i*4] << 24) + (addr6[i*4+1] << 16) + (addr6[i*4+2] << 8) + addr6[i*4+3];
    }
  }
#endif
  else {
    return 0;
  }
  return 1;
}

static int sockaddr_to_mask (const struct sockaddr *sa, int bits, u32 *mask)
{
  int i, k;
  if (bits >= 0) {
    if (sa->sa_family == AF_INET) {
      bits += 96;
    }
#ifdef HAVE_IPV6
    else if (sa->sa_family == AF_INET6) {
      ; /* do nothing */
    }
#endif
    else {
      return 0;
    }
  }
  else
    bits = 128;
  k = bits / 32;
  for (i=0; i < 4; i++) {
    if (i < k) {
      mask[i] = 0xffffffff;
    }
    else if (i > k) {
      mask[i] = 0;
    }
    else {
      mask[i] = 0xfffffffe << (31 - bits % 32);
    }
  }
  return 1;
}

/* Insert a sockaddr into the trie */
static void trie_insert (struct trie_node *this, const struct sockaddr *sa, int bits)
{
  u32 addr[4] = {0};
  u32 mask[4] = {0};
  if (!sockaddr_to_addr(sa, addr)) {
    log_debug("Unknown address family %u, address not inserted.\n", sa->sa_family);
    return;
  }
  if (!sockaddr_to_mask(sa, bits, mask)) {
    log_debug("Bad netmask length %d for address family %u, address not inserted.\n", bits, sa->sa_family);
    return;
  }
  /* First node doesn't have a mask or address of its own; we have to check the
   * first bit manually. */
  if (0x80000000 & addr[0]) {
    /* First bit is 1, so insert on ones branch */
    if (this->next_bit_one == NULL) {
      /* Empty branch, just add it. */
      this->next_bit_one = new_trie_node(addr, mask);
      return;
    }
    _trie_insert(this->next_bit_one, addr, mask);
  }
  else {
    /* First bit is 0, so insert on zeros branch */
    if (this->next_bit_zero == NULL) {
      /* Empty branch, just add it. */
      this->next_bit_zero = new_trie_node(addr, mask);
      return;
    }
    _trie_insert(this->next_bit_zero, addr, mask);
  }
}

/* Helper for matching addresses */
static int _trie_match (const struct trie_node *this, const u32 *addr)
{
  while (this != TRIE_NODE_TRUE && this != NULL
    && addr_matches(this->mask, this->addr, addr)) {
    if (1 & this->mask[3]) {
      /* We've matched all possible bits! Yay! */
      return 1;
    }
    else if (addr_next_bit_is_one(this->mask, addr)) {
      this = this->next_bit_one;
    }
    else {
      this = this->next_bit_zero;
    }
  }
  if (this == TRIE_NODE_TRUE) {
    return 1;
  }
  return 0;
}

static int trie_match (const struct trie_node *this, const struct sockaddr *sa)
{
  u32 addr[4] = {0};
  if (!sockaddr_to_addr(sa, addr)) {
    log_debug("Unknown address family %u, cannot match.\n", sa->sa_family);
    return 0;
  }
  /* Manually check first bit to decide which branch to match against */
  if (0x80000000 & addr[0]) {
    return _trie_match(this->next_bit_one, addr);
  }
  else {
    return _trie_match(this->next_bit_zero, addr);
  }
  return 0;
}

/* A debugging function to print out the contents of an addrset_elem. For IPv4
   this is the four bit vectors. For IPv6 it is the address and netmask. */
static void addrset_elem_print(FILE *fp, const struct addrset_elem *elem)
{
    const size_t num_bitvector = sizeof(octet_bitvector) / sizeof(bitvector_t);
    int i;
    size_t j;

    for (i = 0; i < 4; i++) {
      for (j = 0; j < num_bitvector; j++)
        fprintf(fp, "%0*lX ", (int) (sizeof(bitvector_t) * 2), elem->ipv4.bits[i][num_bitvector - 1 - j]);
      fprintf(fp, "\n");
    }
}

void addrset_print(FILE *fp, const struct addrset *set)
{
  const struct addrset_elem *elem;
  for (elem = set->head; elem != NULL; elem = elem->next) {
    fprintf(fp, "addrset_elem: %p\n", elem);
    addrset_elem_print(fp, elem);
  }
}

/* This is a wrapper around getaddrinfo that automatically handles hints for
   IPv4/IPv6, TCP/UDP, and whether name resolution is allowed. */
static int resolve_name(const char *name, struct addrinfo **result, int af, int use_dns)
{
    struct addrinfo hints = { 0 };
    int rc;

    hints.ai_protocol = IPPROTO_TCP;

    /* First do a non-DNS lookup for any address family (just checks for a valid
       numeric address). We recognize numeric addresses no matter the setting of
       af. This is also the last step if use_dns is false. */
    hints.ai_flags |= AI_NUMERICHOST;
    hints.ai_family = AF_UNSPEC;
    *result = NULL;
    rc = getaddrinfo(name, NULL, &hints, result);
    if (rc == 0 || !use_dns)
        return rc;

    /* Do a DNS lookup now. When we look up a name we only want addresses
       corresponding to the value of af. */
    hints.ai_flags &= ~AI_NUMERICHOST;
    hints.ai_family = af;
    *result = NULL;
    rc = getaddrinfo(name, NULL, &hints, result);

    return rc;
}

/* This is an address family-agnostic version of inet_ntop. */
static char *address_to_string(const struct sockaddr *sa, size_t sa_len,
                               char *buf, size_t len)
{
    getnameinfo(sa, sa_len, buf, len, NULL, 0, NI_NUMERICHOST);

    return buf;
}

/* Break an IPv4 address into an array of octets. octets[0] contains the most
   significant octet and octets[3] the least significant. */
static void in_addr_to_octets(const struct in_addr *ia, uint8_t octets[4])
{
    u32 hbo = ntohl(ia->s_addr);

    octets[0] = (uint8_t) ((hbo & (0xFFU << 24)) >> 24);
    octets[1] = (uint8_t) ((hbo & (0xFFU << 16)) >> 16);
    octets[2] = (uint8_t) ((hbo & (0xFFU << 8)) >> 8);
    octets[3] = (uint8_t) (hbo & 0xFFU);
}

#define BITVECTOR_BITS (sizeof(bitvector_t) * CHAR_BIT)
#define BIT_SET(v, n) ((v)[(n) / BITVECTOR_BITS] |= 1UL << ((n) % BITVECTOR_BITS))
#define BIT_IS_SET(v, n) (((v)[(n) / BITVECTOR_BITS] & 1UL << ((n) % BITVECTOR_BITS)) != 0)

static int parse_ipv4_ranges(struct addrset_elem *elem, const char *spec);
static void apply_ipv4_netmask_bits(struct addrset_elem *elem, int bits);

/* Add a host specification into the address set. Returns 1 on success, 0 on
   error. */
int addrset_add_spec(struct addrset *set, const char *spec, int af, int dns)
{
    char *local_spec;
    char *netmask_s;
    const char *tail;
    long netmask_bits;
    struct addrinfo *addrs, *addr;
    struct addrset_elem *elem;
    int rc;

    /* Make a copy of the spec to mess with. */
    local_spec = strdup(spec);
    if (local_spec == NULL)
        return 0;

    /* Read the CIDR netmask bits, if present. */
    netmask_s = strchr(local_spec, '/');
    if (netmask_s == NULL) {
        /* A negative value means unspecified; default depends on the address
           family. */
        netmask_bits = -1;
    } else {
        *netmask_s = '\0';
        netmask_s++;
        errno = 0;
        netmask_bits = parse_long(netmask_s, &tail);
        if (errno != 0 || *tail != '\0' || tail == netmask_s) {
            log_user("Error parsing netmask in \"%s\".\n", spec);
            free(local_spec);
            return 0;
        }
    }

    /* See if it's a plain IP address */
    rc = resolve_name(local_spec, &addrs, af, 0);
    if (rc == 0 && addrs != NULL) {
      /* Add all addresses to the trie */
      for (addr = addrs; addr != NULL; addr = addr->ai_next) {
        char addr_string[128];
        if ((addr->ai_family == AF_INET && netmask_bits > 32)
#ifdef HAVE_IPV6
          || (addr->ai_family == AF_INET6 && netmask_bits > 128)
#endif
          ) {
          log_user("Illegal netmask in \"%s\". Must be smaller than address bit length.\n", spec);
          free(local_spec);
          freeaddrinfo(addrs);
          return 0;
        }
        address_to_string(addr->ai_addr, addr->ai_addrlen, addr_string, sizeof(addr_string));
        trie_insert(set->trie, addr->ai_addr, netmask_bits);
        log_debug("Add IP %s/%d to addrset (trie).\n", addr_string, netmask_bits);
      }
      free(local_spec);
      freeaddrinfo(addrs);
      return 1;
    }

    elem = (struct addrset_elem *) safe_malloc(sizeof(*elem));
    memset(elem->ipv4.bits, 0, sizeof(elem->ipv4.bits));

    /* Check if this is an IPv4 address, with optional ranges and wildcards. */
    if (parse_ipv4_ranges(elem, local_spec)) {
        if (netmask_bits > 32) {
            log_user("Illegal netmask in \"%s\". Must be between 0 and 32.\n", spec);
            free(local_spec);
            free(elem);
            return 0;
        }
        apply_ipv4_netmask_bits(elem, netmask_bits);
        log_debug("Add IPv4 range %s/%ld to addrset.\n", local_spec, netmask_bits > 0 ? netmask_bits : 32);
        elem->next = set->head;
        set->head = elem;
        free(local_spec);
        return 1;
    } else {
        free(elem);
    }

    /* When all else fails, resolve the name. */
    rc = resolve_name(local_spec, &addrs, af, dns);
    if (rc != 0) {
        log_user("Error resolving name \"%s\": %s\n", local_spec, gai_strerror(rc));
        free(local_spec);
        return 0;
    }
    if (addrs == NULL)
        log_user("Warning: no addresses found for %s.\n", local_spec);
    free(local_spec);

    /* Walk the list of addresses and add them all to the set with netmasks. */
    for (addr = addrs; addr != NULL; addr = addr->ai_next) {
        char addr_string[128];

        address_to_string(addr->ai_addr, addr->ai_addrlen, addr_string, sizeof(addr_string));

        /* Note: it is possible that in this loop we are dealing with addresses
           of more than one family (e.g., IPv4 and IPv6). But we have at most
           one netmask value for all of them. Whatever netmask we have is
           applied blindly to whatever addresses there are, which may not be
           what you want if a /24 is applied to IPv6 and will cause an error if
           a /120 is applied to IPv4. */
        if (addr->ai_family == AF_INET) {

            if (netmask_bits > 32) {
                log_user("Illegal netmask in \"%s\". Must be between 0 and 32.\n", spec);
                freeaddrinfo(addrs);
                return 0;
            }
            log_debug("Add IPv4 %s/%ld to addrset (trie).\n", addr_string, netmask_bits > 0 ? netmask_bits : 32);

#ifdef HAVE_IPV6
        } else if (addr->ai_family == AF_INET6) {
            if (netmask_bits > 128) {
                log_user("Illegal netmask in \"%s\". Must be between 0 and 128.\n", spec);
                freeaddrinfo(addrs);
                return 0;
            }
            log_debug("Add IPv6 %s/%ld to addrset (trie).\n", addr_string, netmask_bits > 0 ? netmask_bits : 128);
#endif
        } else {
            log_debug("ignoring address %s for %s. Family %d socktype %d protocol %d.\n", addr_string, spec, addr->ai_family, addr->ai_socktype, addr->ai_protocol);
            continue;
        }

        trie_insert(set->trie, addr->ai_addr, netmask_bits);
    }

    if (addrs != NULL)
        freeaddrinfo(addrs);

    return 1;
}

/* Add whitespace-separated host specifications from fd into the address set.
   Returns 1 on success, 0 on error. */
int addrset_add_file(struct addrset *set, FILE *fd, int af, int dns)
{
    char buf[1024];
    int c, i;

    for (;;) {
        /* Skip whitespace. */
        while ((c = getc(fd)) != EOF) {
            if (!isspace(c))
                break;
        }
        if (c == EOF)
            break;
        ungetc(c, fd);

        i = 0;
        while ((c = getc(fd)) != EOF) {
            if (isspace(c))
                break;
            if (i + 1 > sizeof(buf) - 1) {
                /* Truncate the specification to give a little context. */
                buf[11] = '\0';
                log_user("Host specification starting with \"%s\" is too long.\n", buf);
                return 0;
            }
            buf[i++] = c;
        }
        buf[i] = '\0';

        if (!addrset_add_spec(set, buf, af, dns))
            return 0;
    }

    return 1;
}

/* Parse an IPv4 address with optional ranges and wildcards into bit vectors.
   Each octet must match the regular expression '(\*|#?(-#?)?(,#?(-#?)?)*)',
   where '#' stands for an integer between 0 and 255. Return 1 on success, 0 on
   error. */
static int parse_ipv4_ranges(struct addrset_elem *elem, const char *spec)
{
    const char *p;
    int octet_index, i;

    p = spec;
    octet_index = 0;
    while (*p != '\0' && octet_index < 4) {
        if (*p == '*') {
            for (i = 0; i < 256; i++)
                BIT_SET(elem->ipv4.bits[octet_index], i);
            p++;
        } else {
            for (;;) {
                long start, end;
                const char *tail;

                errno = 0;
                start = parse_long(p, &tail);
                /* Is this a range open on the left? */
                if (tail == p) {
                    if (*p == '-')
                        start = 0;
                    else
                        return 0;
                }
                if (errno != 0 || start < 0 || start > 255)
                    return 0;
                p = tail;

                /* Look for a range. */
                if (*p == '-') {
                    p++;
                    errno = 0;
                    end = parse_long(p, &tail);
                    /* Is this range open on the right? */
                    if (tail == p)
                        end = 255;
                    if (errno != 0 || end < 0 || end > 255 || end < start)
                        return 0;
                    p = tail;
                } else {
                    end = start;
                }

                /* Fill in the range in the bit vector. */
                for (i = start; i <= end; i++)
                    BIT_SET(elem->ipv4.bits[octet_index], i);

                if (*p != ',')
                    break;
                p++;
            }
        }
        octet_index++;
        if (octet_index < 4) {
            if (*p != '.')
                return 0;
            p++;
        }
    }
    if (*p != '\0' || octet_index < 4)
        return 0;

    return 1;
}

/* Expand a single-octet bit vector to include any additional addresses that
   result when mask is applied. */
static void apply_ipv4_netmask_octet(octet_bitvector bits, uint8_t mask)
{
    unsigned int i, j;
    uint32_t chunk_size;

    /* Process the bit vector in chunks, first of size 1, then of size 2, up to
       size 128. Check the next bit of the mask. If it is 1, do nothing.
       Otherwise, pair up the chunks (first with the second, third with the
       fourth, etc.). For each pair of chunks, set a bit in one chunk if it is
       set in the other. chunk_size also serves as an index into the mask. */
    for (chunk_size = 1; chunk_size < 256; chunk_size <<= 1) {
        if ((mask & chunk_size) != 0)
            continue;
        for (i = 0; i < 256; i += chunk_size * 2) {
            for (j = 0; j < chunk_size; j++) {
                if (BIT_IS_SET(bits, i + j))
                    BIT_SET(bits, i + j + chunk_size);
                else if (BIT_IS_SET(bits, i + j + chunk_size))
                    BIT_SET(bits, i + j);
            }
        }
    }
}

/* Expand an addrset_elem's IPv4 bit vectors to include any additional addresses
   that result when the given netmask is applied. The mask is in network byte
   order. */
static void apply_ipv4_netmask(struct addrset_elem *elem, uint32_t mask)
{
    mask = ntohl(mask);
    /* Apply the mask one octet at a time. It's done this way because ranges
       span exactly one octet. */
    apply_ipv4_netmask_octet(elem->ipv4.bits[0], (mask & 0xFF000000) >> 24);
    apply_ipv4_netmask_octet(elem->ipv4.bits[1], (mask & 0x00FF0000) >> 16);
    apply_ipv4_netmask_octet(elem->ipv4.bits[2], (mask & 0x0000FF00) >> 8);
    apply_ipv4_netmask_octet(elem->ipv4.bits[3], (mask & 0x000000FF));
}

/* Expand an addrset_elem's IPv4 bit vectors to include any additional addresses
   that result from the application of a CIDR-style netmask with the given
   number of bits. If bits is negative it is taken to be 32. */
static void apply_ipv4_netmask_bits(struct addrset_elem *elem, int bits)
{
    uint32_t mask;

    if (bits > 32)
        return;
    if (bits < 0)
        bits = 32;

    if (bits == 0)
        mask = htonl(0x00000000);
    else
        mask = htonl(0xFFFFFFFF << (32 - bits));
    apply_ipv4_netmask(elem, mask);
}

static int match_ipv4_bits(const octet_bitvector bits[4], const struct sockaddr *sa)
{
    uint8_t octets[4];

    if (sa->sa_family != AF_INET)
        return 0;

    in_addr_to_octets(&((const struct sockaddr_in *) sa)->sin_addr, octets);

    return BIT_IS_SET(bits[0], octets[0])
        && BIT_IS_SET(bits[1], octets[1])
        && BIT_IS_SET(bits[2], octets[2])
        && BIT_IS_SET(bits[3], octets[3]);
}

static int addrset_elem_match(const struct addrset_elem *elem, const struct sockaddr *sa)
{
  return match_ipv4_bits(elem->ipv4.bits, sa);
}

int addrset_contains(const struct addrset *set, const struct sockaddr *sa)
{
    struct addrset_elem *elem;

    /* First check the trie. */
    if (trie_match(set->trie, sa))
      return 1;

    /* If that didn't match, check the rest of the addrset_elem in order */
    if (sa->sa_family == AF_INET) {
      for (elem = set->head; elem != NULL; elem = elem->next) {
        if (addrset_elem_match(elem, sa))
          return 1;
      }
    }

    return 0;
}