Remove acl support

OK millert

10 files changed, 12 insertions, 1798 deletions

diff --git a/usr.sbin/bind/lib/dns/Makefile.in b/usr.sbin/bind/lib/dns/Makefile.in
index c85984f0eeb..00e1f81de05 100644
--- a/usr.sbin/bind/lib/dns/Makefile.in
+++ b/usr.sbin/bind/lib/dns/Makefile.in
@@ -56,10 +56,10 @@ DSTOBJS =	@DST_EXTRA_OBJS@ @OPENSSLLINKOBJS@  \
 		hmac_link.@O@ key.@O@
 
 # Alphabetically
-DNSOBJS =	acl.@O@ byaddr.@O@ \
+DNSOBJS =	byaddr.@O@ \
 		callbacks.@O@ compress.@O@ \
 		dnssec.@O@ ds.@O@ \
-		iptable.@O@  keydata.@O@ \
+		keydata.@O@ \
 		lib.@O@ log.@O@ \
 		master.@O@ masterdump.@O@ message.@O@ \
 		name.@O@ ncache.@O@ nsec.@O@ nsec3.@O@ \
@@ -87,10 +87,10 @@ DSTSRCS =	@DST_EXTRA_SRCS@ @OPENSSLLINKSRCS@ \
 		dst_result.c \
 		hmac_link.c key.c
 
-DNSSRCS =	acl.c byaddr.c \
+DNSSRCS =	byaddr.c \
 		callbacks.c compress.c \
 		dnssec.c ds.c \
-		iptable.c keydata.c lib.c log.c \
+		keydata.c lib.c log.c \
 		master.c masterdump.c message.c \
 		name.c ncache.c nsec.c nsec3.c \
 		rbt.c rcode.c rdata.c rdatalist.c \
diff --git a/usr.sbin/bind/lib/dns/acl.c b/usr.sbin/bind/lib/dns/acl.c
deleted file mode 100644
index 6f6a0548ee5..00000000000
--- a/usr.sbin/bind/lib/dns/acl.c
+++ /dev/null
@@ -1,629 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* $Id: acl.c,v 1.5 2020/01/09 18:17:14 florian Exp $ */
-
-/*! \file */
-
-#include <config.h>
-
-#include <isc/mem.h>
-#include <isc/once.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/acl.h>
-#include <dns/iptable.h>
-
-
-/*
- * Create a new ACL, including an IP table and an array with room
- * for 'n' ACL elements.  The elements are uninitialized and the
- * length is 0.
- */
-isc_result_t
-dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target) {
-	isc_result_t result;
-	dns_acl_t *acl;
-
-	/*
-	 * Work around silly limitation of isc_mem_get().
-	 */
-	if (n == 0)
-		n = 1;
-
-	acl = isc_mem_get(mctx, sizeof(*acl));
-	if (acl == NULL)
-		return (ISC_R_NOMEMORY);
-
-	acl->mctx = NULL;
-	isc_mem_attach(mctx, &acl->mctx);
-
-	acl->name = NULL;
-
-	result = isc_refcount_init(&acl->refcount, 1);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, acl, sizeof(*acl));
-		return (result);
-	}
-
-	result = dns_iptable_create(mctx, &acl->iptable);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, acl, sizeof(*acl));
-		return (result);
-	}
-
-	acl->elements = NULL;
-	acl->alloc = 0;
-	acl->length = 0;
-	acl->has_negatives = ISC_FALSE;
-
-	ISC_LINK_INIT(acl, nextincache);
-	/*
-	 * Must set magic early because we use dns_acl_detach() to clean up.
-	 */
-	acl->magic = DNS_ACL_MAGIC;
-
-	acl->elements = isc_mem_get(mctx, n * sizeof(dns_aclelement_t));
-	if (acl->elements == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-	acl->alloc = n;
-	memset(acl->elements, 0, n * sizeof(dns_aclelement_t));
-	*target = acl;
-	return (ISC_R_SUCCESS);
-
- cleanup:
-	dns_acl_detach(&acl);
-	return (result);
-}
-
-/*
- * Create a new ACL and initialize it with the value "any" or "none",
- * depending on the value of the "neg" parameter.
- * "any" is a positive iptable entry with bit length 0.
- * "none" is the same as "!any".
- */
-static isc_result_t
-dns_acl_anyornone(isc_mem_t *mctx, isc_boolean_t neg, dns_acl_t **target) {
-	isc_result_t result;
-	dns_acl_t *acl = NULL;
-
-	result = dns_acl_create(mctx, 0, &acl);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
-	result = dns_iptable_addprefix(acl->iptable, NULL, 0, ISC_TF(!neg));
-	if (result != ISC_R_SUCCESS) {
-		dns_acl_detach(&acl);
-		return (result);
-	}
-
-	*target = acl;
-	return (result);
-}
-
-/*
- * Create a new ACL that matches everything.
- */
-isc_result_t
-dns_acl_any(isc_mem_t *mctx, dns_acl_t **target) {
-	return (dns_acl_anyornone(mctx, ISC_FALSE, target));
-}
-
-/*
- * Create a new ACL that matches nothing.
- */
-isc_result_t
-dns_acl_none(isc_mem_t *mctx, dns_acl_t **target) {
-	return (dns_acl_anyornone(mctx, ISC_TRUE, target));
-}
-
-/*
- * If pos is ISC_TRUE, test whether acl is set to "{ any; }"
- * If pos is ISC_FALSE, test whether acl is set to "{ none; }"
- */
-static isc_boolean_t
-dns_acl_isanyornone(dns_acl_t *acl, isc_boolean_t pos)
-{
-	/* Should never happen but let's be safe */
-	if (acl == NULL ||
-	    acl->iptable == NULL ||
-	    acl->iptable->radix == NULL ||
-	    acl->iptable->radix->head == NULL ||
-	    acl->iptable->radix->head->prefix == NULL)
-		return (ISC_FALSE);
-
-	if (acl->length != 0 || acl->node_count != 1)
-		return (ISC_FALSE);
-
-	if (acl->iptable->radix->head->prefix->bitlen == 0 &&
-	    acl->iptable->radix->head->data[0] != NULL &&
-	    acl->iptable->radix->head->data[0] ==
-		    acl->iptable->radix->head->data[1] &&
-	    *(isc_boolean_t *) (acl->iptable->radix->head->data[0]) == pos)
-		return (ISC_TRUE);
-
-	return (ISC_FALSE); /* All others */
-}
-
-/*
- * Test whether acl is set to "{ any; }"
- */
-isc_boolean_t
-dns_acl_isany(dns_acl_t *acl)
-{
-	return (dns_acl_isanyornone(acl, ISC_TRUE));
-}
-
-/*
- * Test whether acl is set to "{ none; }"
- */
-isc_boolean_t
-dns_acl_isnone(dns_acl_t *acl)
-{
-	return (dns_acl_isanyornone(acl, ISC_FALSE));
-}
-
-/*
- * Determine whether a given address or signer matches a given ACL.
- * For a match with a positive ACL element or iptable radix entry,
- * return with a positive value in match; for a match with a negated ACL
- * element or radix entry, return with a negative value in match.
- */
-isc_result_t
-dns_acl_match(const isc_netaddr_t *reqaddr,
-	      const dns_name_t *reqsigner,
-	      const dns_acl_t *acl,
-	      const dns_aclenv_t *env,
-	      int *match,
-	      const dns_aclelement_t **matchelt)
-{
-	uint16_t bitlen, family;
-	isc_prefix_t pfx;
-	isc_radix_node_t *node = NULL;
-	const isc_netaddr_t *addr;
-	isc_netaddr_t v4addr;
-	isc_result_t result;
-	int match_num = -1;
-	unsigned int i;
-
-	REQUIRE(reqaddr != NULL);
-	REQUIRE(matchelt == NULL || *matchelt == NULL);
-
-	if (env == NULL || env->match_mapped == ISC_FALSE ||
-	    reqaddr->family != AF_INET6 ||
-	    !IN6_IS_ADDR_V4MAPPED(&reqaddr->type.in6))
-		addr = reqaddr;
-	else {
-		isc_netaddr_fromv4mapped(&v4addr, reqaddr);
-		addr = &v4addr;
-	}
-
-	/* Always match with host addresses. */
-	family = addr->family;
-	bitlen = family == AF_INET6 ? 128 : 32;
-	NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
-
-	/* Assume no match. */
-	*match = 0;
-
-	/* Search radix. */
-	result = isc_radix_search(acl->iptable->radix, &node, &pfx);
-
-	/* Found a match. */
-	if (result == ISC_R_SUCCESS && node != NULL) {
-		match_num = node->node_num[ISC_IS6(family)];
-		if (*(isc_boolean_t *) node->data[ISC_IS6(family)] == ISC_TRUE)
-			*match = match_num;
-		else
-			*match = -match_num;
-	}
-
-	/* Now search non-radix elements for a match with a lower node_num. */
-	for (i = 0; i < acl->length; i++) {
-		dns_aclelement_t *e = &acl->elements[i];
-
-		/* Already found a better match? */
-		if (match_num != -1 && match_num < e->node_num) {
-			isc_refcount_destroy(&pfx.refcount);
-			return (ISC_R_SUCCESS);
-		}
-
-		if (dns_aclelement_match(reqaddr, reqsigner,
-					 e, env, matchelt)) {
-			if (match_num == -1 || e->node_num < match_num) {
-				if (e->negative == ISC_TRUE)
-					*match = -e->node_num;
-				else
-					*match = e->node_num;
-			}
-			isc_refcount_destroy(&pfx.refcount);
-			return (ISC_R_SUCCESS);
-		}
-	}
-
-	isc_refcount_destroy(&pfx.refcount);
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Merge the contents of one ACL into another.  Call dns_iptable_merge()
- * for the IP tables, then concatenate the element arrays.
- *
- * If pos is set to false, then the nested ACL is to be negated.  This
- * means reverse the sense of each *positive* element or IP table node,
- * but leave negatives alone, so as to prevent a double-negative causing
- * an unexpected positive match in the parent ACL.
- */
-isc_result_t
-dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos)
-{
-	isc_result_t result;
-	unsigned int newalloc, nelem, i;
-	int max_node = 0, nodes;
-
-	/* Resize the element array if needed. */
-	if (dest->length + source->length > dest->alloc) {
-		void *newmem;
-
-		newalloc = dest->alloc + source->alloc;
-		if (newalloc < 4)
-			newalloc = 4;
-
-		newmem = isc_mem_get(dest->mctx,
-				     newalloc * sizeof(dns_aclelement_t));
-		if (newmem == NULL)
-			return (ISC_R_NOMEMORY);
-
-		/* Zero. */
-		memset(newmem, 0, newalloc * sizeof(dns_aclelement_t));
-
-		/* Copy in the original elements */
-		memmove(newmem, dest->elements,
-			dest->length * sizeof(dns_aclelement_t));
-
-		/* Release the memory for the old elements array */
-		isc_mem_put(dest->mctx, dest->elements,
-			    dest->alloc * sizeof(dns_aclelement_t));
-		dest->elements = newmem;
-		dest->alloc = newalloc;
-	}
-
-	/*
-	 * Now copy in the new elements, increasing their node_num
-	 * values so as to keep the new ACL consistent.  If we're
-	 * negating, then negate positive elements, but keep negative
-	 * elements the same for security reasons.
-	 */
-	nelem = dest->length;
-	dest->length += source->length;
-	for (i = 0; i < source->length; i++) {
-		if (source->elements[i].node_num > max_node)
-			max_node = source->elements[i].node_num;
-
-		/* Copy type. */
-		dest->elements[nelem + i].type = source->elements[i].type;
-
-		/* Adjust node numbering. */
-		dest->elements[nelem + i].node_num =
-			source->elements[i].node_num + dest->node_count;
-
-		/* Duplicate nested acl. */
-		if (source->elements[i].type == dns_aclelementtype_nestedacl &&
-		   source->elements[i].nestedacl != NULL)
-			dns_acl_attach(source->elements[i].nestedacl,
-				       &dest->elements[nelem + i].nestedacl);
-
-		/* Duplicate key name. */
-		if (source->elements[i].type == dns_aclelementtype_keyname) {
-			dns_name_init(&dest->elements[nelem+i].keyname, NULL);
-			result = dns_name_dup(&source->elements[i].keyname,
-					      dest->mctx,
-					      &dest->elements[nelem+i].keyname);
-			if (result != ISC_R_SUCCESS)
-				return result;
-		}
-
-		/* reverse sense of positives if this is a negative acl */
-		if (!pos && source->elements[i].negative == ISC_FALSE) {
-			dest->elements[nelem + i].negative = ISC_TRUE;
-		} else {
-			dest->elements[nelem + i].negative =
-				source->elements[i].negative;
-		}
-	}
-
-	/*
-	 * Merge the iptables.  Make sure the destination ACL's
-	 * node_count value is set correctly afterward.
-	 */
-	nodes = max_node + dest->node_count;
-	result = dns_iptable_merge(dest->iptable, source->iptable, pos);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	if (nodes > dest->node_count)
-		dest->node_count = nodes;
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Like dns_acl_match, but matches against the single ACL element 'e'
- * rather than a complete ACL, and returns ISC_TRUE iff it matched.
- *
- * To determine whether the match was positive or negative, the
- * caller should examine e->negative.  Since the element 'e' may be
- * a reference to a named ACL or a nested ACL, a matching element
- * returned through 'matchelt' is not necessarily 'e' itself.
- */
-isc_boolean_t
-dns_aclelement_match(const isc_netaddr_t *reqaddr,
-		     const dns_name_t *reqsigner,
-		     const dns_aclelement_t *e,
-		     const dns_aclenv_t *env,
-		     const dns_aclelement_t **matchelt)
-{
-	dns_acl_t *inner = NULL;
-	int indirectmatch;
-	isc_result_t result;
-
-	switch (e->type) {
-	case dns_aclelementtype_keyname:
-		if (reqsigner != NULL &&
-		    dns_name_equal(reqsigner, &e->keyname)) {
-			if (matchelt != NULL)
-				*matchelt = e;
-			return (ISC_TRUE);
-		} else
-			return (ISC_FALSE);
-
-	case dns_aclelementtype_nestedacl:
-		inner = e->nestedacl;
-		break;
-
-	case dns_aclelementtype_localhost:
-		if (env == NULL || env->localhost == NULL)
-			return (ISC_FALSE);
-		inner = env->localhost;
-		break;
-
-	case dns_aclelementtype_localnets:
-		if (env == NULL || env->localnets == NULL)
-			return (ISC_FALSE);
-		inner = env->localnets;
-		break;
-
-	default:
-		/* Should be impossible. */
-		INSIST(0);
-	}
-
-	result = dns_acl_match(reqaddr, reqsigner, inner, env,
-			       &indirectmatch, matchelt);
-	INSIST(result == ISC_R_SUCCESS);
-
-	/*
-	 * Treat negative matches in indirect ACLs as "no match".
-	 * That way, a negated indirect ACL will never become a
-	 * surprise positive match through double negation.
-	 * XXXDCL this should be documented.
-	 */
-
-	if (indirectmatch > 0) {
-		if (matchelt != NULL)
-			*matchelt = e;
-		return (ISC_TRUE);
-	}
-
-	/*
-	 * A negative indirect match may have set *matchelt, but we don't
-	 * want it set when we return.
-	 */
-
-	if (matchelt != NULL)
-		*matchelt = NULL;
-
-	return (ISC_FALSE);
-}
-
-void
-dns_acl_attach(dns_acl_t *source, dns_acl_t **target) {
-	REQUIRE(DNS_ACL_VALID(source));
-
-	isc_refcount_increment(&source->refcount, NULL);
-	*target = source;
-}
-
-static void
-destroy(dns_acl_t *dacl) {
-	unsigned int i;
-
-	INSIST(!ISC_LINK_LINKED(dacl, nextincache));
-
-	for (i = 0; i < dacl->length; i++) {
-		dns_aclelement_t *de = &dacl->elements[i];
-		if (de->type == dns_aclelementtype_keyname) {
-			dns_name_free(&de->keyname, dacl->mctx);
-		} else if (de->type == dns_aclelementtype_nestedacl) {
-			dns_acl_detach(&de->nestedacl);
-		}
-	}
-	if (dacl->elements != NULL)
-		isc_mem_put(dacl->mctx, dacl->elements,
-			    dacl->alloc * sizeof(dns_aclelement_t));
-	if (dacl->name != NULL)
-		isc_mem_free(dacl->mctx, dacl->name);
-	if (dacl->iptable != NULL)
-		dns_iptable_detach(&dacl->iptable);
-	isc_refcount_destroy(&dacl->refcount);
-	dacl->magic = 0;
-	isc_mem_putanddetach(&dacl->mctx, dacl, sizeof(*dacl));
-}
-
-void
-dns_acl_detach(dns_acl_t **aclp) {
-	dns_acl_t *acl = *aclp;
-	unsigned int refs;
-
-	REQUIRE(DNS_ACL_VALID(acl));
-
-	isc_refcount_decrement(&acl->refcount, &refs);
-	if (refs == 0)
-		destroy(acl);
-	*aclp = NULL;
-}
-
-
-static isc_once_t	insecure_prefix_once = ISC_ONCE_INIT;
-static isc_mutex_t	insecure_prefix_lock;
-static isc_boolean_t	insecure_prefix_found;
-
-static void
-initialize_action(void) {
-	RUNTIME_CHECK(isc_mutex_init(&insecure_prefix_lock) == ISC_R_SUCCESS);
-}
-
-/*
- * Called via isc_radix_walk() to find IP table nodes that are
- * insecure.
- */
-static void
-is_insecure(isc_prefix_t *prefix, void **data) {
-	/*
-	 * If all nonexistent or negative then this node is secure.
-	 */
-	if ((data[0] == NULL || !* (isc_boolean_t *) data[0]) &&
-	    (data[1] == NULL || !* (isc_boolean_t *) data[1]))
-		return;
-
-	/*
-	 * If a loopback address found and the other family
-	 * doesn't exist or is negative, return.
-	 */
-	if (prefix->bitlen == 32 &&
-	    htonl(prefix->add.sin.s_addr) == INADDR_LOOPBACK &&
-	    (data[1] == NULL || !* (isc_boolean_t *) data[1]))
-		return;
-
-	if (prefix->bitlen == 128 &&
-	    IN6_IS_ADDR_LOOPBACK(&prefix->add.sin6) &&
-	    (data[0] == NULL || !* (isc_boolean_t *) data[0]))
-		return;
-
-	/* Non-negated, non-loopback */
-	insecure_prefix_found = ISC_TRUE;	/* LOCKED */
-	return;
-}
-
-/*
- * Return ISC_TRUE iff the acl 'a' is considered insecure, that is,
- * if it contains IP addresses other than those of the local host.
- * This is intended for applications such as printing warning
- * messages for suspect ACLs; it is not intended for making access
- * control decisions.  We make no guarantee that an ACL for which
- * this function returns ISC_FALSE is safe.
- */
-isc_boolean_t
-dns_acl_isinsecure(const dns_acl_t *a) {
-	unsigned int i;
-	isc_boolean_t insecure;
-
-	RUNTIME_CHECK(isc_once_do(&insecure_prefix_once,
-				  initialize_action) == ISC_R_SUCCESS);
-
-	/*
-	 * Walk radix tree to find out if there are any non-negated,
-	 * non-loopback prefixes.
-	 */
-	LOCK(&insecure_prefix_lock);
-	insecure_prefix_found = ISC_FALSE;
-	isc_radix_process(a->iptable->radix, is_insecure);
-	insecure = insecure_prefix_found;
-	UNLOCK(&insecure_prefix_lock);
-	if (insecure)
-		return (ISC_TRUE);
-
-	/* Now check non-radix elements */
-	for (i = 0; i < a->length; i++) {
-		dns_aclelement_t *e = &a->elements[i];
-
-		/* A negated match can never be insecure. */
-		if (e->negative)
-			continue;
-
-		switch (e->type) {
-		case dns_aclelementtype_keyname:
-		case dns_aclelementtype_localhost:
-			continue;
-
-		case dns_aclelementtype_nestedacl:
-			if (dns_acl_isinsecure(e->nestedacl))
-				return (ISC_TRUE);
-			continue;
-
-		case dns_aclelementtype_localnets:
-			return (ISC_TRUE);
-
-		default:
-			INSIST(0);
-			return (ISC_TRUE);
-		}
-	}
-
-	/* No insecure elements were found. */
-	return (ISC_FALSE);
-}
-
-/*
- * Initialize ACL environment, setting up localhost and localnets ACLs
- */
-isc_result_t
-dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env) {
-	isc_result_t result;
-
-	env->localhost = NULL;
-	env->localnets = NULL;
-	result = dns_acl_create(mctx, 0, &env->localhost);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup_nothing;
-	result = dns_acl_create(mctx, 0, &env->localnets);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup_localhost;
-	env->match_mapped = ISC_FALSE;
-	return (ISC_R_SUCCESS);
-
- cleanup_localhost:
-	dns_acl_detach(&env->localhost);
- cleanup_nothing:
-	return (result);
-}
-
-void
-dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
-	dns_acl_detach(&t->localhost);
-	dns_acl_attach(s->localhost, &t->localhost);
-	dns_acl_detach(&t->localnets);
-	dns_acl_attach(s->localnets, &t->localnets);
-	t->match_mapped = s->match_mapped;
-}
-
-void
-dns_aclenv_destroy(dns_aclenv_t *env) {
-	dns_acl_detach(&env->localhost);
-	dns_acl_detach(&env->localnets);
-}
diff --git a/usr.sbin/bind/lib/dns/include/dns/Makefile.in b/usr.sbin/bind/lib/dns/include/dns/Makefile.in
index 674c408711f..7a0cec386fe 100644
--- a/usr.sbin/bind/lib/dns/include/dns/Makefile.in
+++ b/usr.sbin/bind/lib/dns/include/dns/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6 2020/01/18 16:55:01 florian Exp $
+# $Id: Makefile.in,v 1.7 2020/01/20 18:39:24 florian Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -20,10 +20,10 @@ top_srcdir =	@top_srcdir@
 
 VERSION=@BIND9_VERSION@
 
-HEADERS =	acl.h bit.h byaddr.h callbacks.h cert.h \
+HEADERS =	bit.h byaddr.h callbacks.h cert.h \
 		compress.h \
 		dnssec.h ds.h dsdigest.h \
-		events.h fixedname.h iptable.h \
+		events.h fixedname.h \
 		keydata.h keyflags.h keyvalues.h \
 		lib.h log.h master.h masterdump.h message.h \
 		name.h ncache.h nsec.h nsec3.h opcode.h \
diff --git a/usr.sbin/bind/lib/dns/include/dns/acl.h b/usr.sbin/bind/lib/dns/include/dns/acl.h
deleted file mode 100644
index 4f9a306af9d..00000000000
--- a/usr.sbin/bind/lib/dns/include/dns/acl.h
+++ /dev/null
@@ -1,242 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* $Id: acl.h,v 1.4 2020/01/07 19:06:07 florian Exp $ */
-
-#ifndef DNS_ACL_H
-#define DNS_ACL_H 1
-
-/*****
- ***** Module Info
- *****/
-
-/*! \file dns/acl.h
- * \brief
- * Address match list handling.
- */
-
-/***
- *** Imports
- ***/
-
-#include <isc/lang.h>
-#include <isc/magic.h>
-#include <isc/netaddr.h>
-#include <isc/refcount.h>
-
-#include <dns/name.h>
-#include <dns/types.h>
-#include <dns/iptable.h>
-
-/***
- *** Types
- ***/
-
-typedef enum {
-	dns_aclelementtype_ipprefix,
-	dns_aclelementtype_keyname,
-	dns_aclelementtype_nestedacl,
-	dns_aclelementtype_localhost,
-	dns_aclelementtype_localnets,
-	dns_aclelementtype_any
-} dns_aclelementtype_t;
-
-typedef struct dns_aclipprefix dns_aclipprefix_t;
-
-struct dns_aclipprefix {
-	isc_netaddr_t address; /* IP4/IP6 */
-	unsigned int prefixlen;
-};
-
-struct dns_aclelement {
-	dns_aclelementtype_t	type;
-	isc_boolean_t		negative;
-	dns_name_t		keyname;
-	dns_acl_t		*nestedacl;
-	int			node_num;
-};
-
-struct dns_acl {
-	unsigned int		magic;
-	isc_mem_t		*mctx;
-	isc_refcount_t		refcount;
-	dns_iptable_t		*iptable;
-#define node_count		iptable->radix->num_added_node
-	dns_aclelement_t	*elements;
-	isc_boolean_t 		has_negatives;
-	unsigned int 		alloc;		/*%< Elements allocated */
-	unsigned int 		length;		/*%< Elements initialized */
-	char 			*name;		/*%< Temporary use only */
-	ISC_LINK(dns_acl_t) 	nextincache;	/*%< Ditto */
-};
-
-struct dns_aclenv {
-	dns_acl_t *localhost;
-	dns_acl_t *localnets;
-	isc_boolean_t match_mapped;
-};
-
-#define DNS_ACL_MAGIC		ISC_MAGIC('D','a','c','l')
-#define DNS_ACL_VALID(a)	ISC_MAGIC_VALID(a, DNS_ACL_MAGIC)
-
-/***
- *** Functions
- ***/
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target);
-/*%<
- * Create a new ACL, including an IP table and an array with room
- * for 'n' ACL elements.  The elements are uninitialized and the
- * length is 0.
- */
-
-isc_result_t
-dns_acl_any(isc_mem_t *mctx, dns_acl_t **target);
-/*%<
- * Create a new ACL that matches everything.
- */
-
-isc_result_t
-dns_acl_none(isc_mem_t *mctx, dns_acl_t **target);
-/*%<
- * Create a new ACL that matches nothing.
- */
-
-isc_boolean_t
-dns_acl_isany(dns_acl_t *acl);
-/*%<
- * Test whether ACL is set to "{ any; }"
- */
-
-isc_boolean_t
-dns_acl_isnone(dns_acl_t *acl);
-/*%<
- * Test whether ACL is set to "{ none; }"
- */
-
-isc_result_t
-dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos);
-/*%<
- * Merge the contents of one ACL into another.  Call dns_iptable_merge()
- * for the IP tables, then concatenate the element arrays.
- *
- * If pos is set to false, then the nested ACL is to be negated.  This
- * means reverse the sense of each *positive* element or IP table node,
- * but leave negatives alone, so as to prevent a double-negative causing
- * an unexpected positive match in the parent ACL.
- */
-
-void
-dns_acl_attach(dns_acl_t *source, dns_acl_t **target);
-/*%<
- * Attach to acl 'source'.
- *
- * Requires:
- *\li	'source' to be a valid acl.
- *\li	'target' to be non NULL and '*target' to be NULL.
- */
-
-void
-dns_acl_detach(dns_acl_t **aclp);
-/*%<
- * Detach the acl. On final detach the acl must not be linked on any
- * list.
- *
- * Requires:
- *\li	'*aclp' to be a valid acl.
- *
- * Insists:
- *\li	'*aclp' is not linked on final detach.
- */
-
-isc_boolean_t
-dns_acl_isinsecure(const dns_acl_t *a);
-/*%<
- * Return #ISC_TRUE iff the acl 'a' is considered insecure, that is,
- * if it contains IP addresses other than those of the local host.
- * This is intended for applications such as printing warning
- * messages for suspect ACLs; it is not intended for making access
- * control decisions.  We make no guarantee that an ACL for which
- * this function returns #ISC_FALSE is safe.
- */
-
-isc_result_t
-dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env);
-/*%<
- * Initialize ACL environment, setting up localhost and localnets ACLs
- */
-
-void
-dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s);
-
-void
-dns_aclenv_destroy(dns_aclenv_t *env);
-
-isc_result_t
-dns_acl_match(const isc_netaddr_t *reqaddr,
-	      const dns_name_t *reqsigner,
-	      const dns_acl_t *acl,
-	      const dns_aclenv_t *env,
-	      int *match,
-	      const dns_aclelement_t **matchelt);
-/*%<
- * General, low-level ACL matching.  This is expected to
- * be useful even for weird stuff like the topology and sortlist statements.
- *
- * Match the address 'reqaddr', and optionally the key name 'reqsigner',
- * against 'acl'.  'reqsigner' may be NULL.
- *
- * If there is a match, '*match' will be set to an integer whose absolute
- * value corresponds to the order in which the matching value was inserted
- * into the ACL.  For a positive match, this value will be positive; for a
- * negative match, it will be negative.
- *
- * If there is no match, *match will be set to zero.
- *
- * If there is a match in the element list (either positive or negative)
- * and 'matchelt' is non-NULL, *matchelt will be pointed to the matching
- * element.
- *
- * 'env' points to the current ACL environment, including the
- * current values of localhost and localnets and (if applicable)
- * the GeoIP context.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		Always succeeds.
- */
-
-isc_boolean_t
-dns_aclelement_match(const isc_netaddr_t *reqaddr,
-		     const dns_name_t *reqsigner,
-		     const dns_aclelement_t *e,
-		     const dns_aclenv_t *env,
-		     const dns_aclelement_t **matchelt);
-/*%<
- * Like dns_acl_match, but matches against the single ACL element 'e'
- * rather than a complete ACL, and returns ISC_TRUE iff it matched.
- *
- * To determine whether the match was positive or negative, the
- * caller should examine e->negative.  Since the element 'e' may be
- * a reference to a named ACL or a nested ACL, a matching element
- * returned through 'matchelt' is not necessarily 'e' itself.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_ACL_H */
diff --git a/usr.sbin/bind/lib/dns/include/dns/iptable.h b/usr.sbin/bind/lib/dns/include/dns/iptable.h
deleted file mode 100644
index 11520aa53d7..00000000000
--- a/usr.sbin/bind/lib/dns/include/dns/iptable.h
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* $Id: iptable.h,v 1.3 2020/01/09 18:17:16 florian Exp $ */
-
-#ifndef DNS_IPTABLE_H
-#define DNS_IPTABLE_H 1
-
-#include <isc/lang.h>
-#include <isc/magic.h>
-#include <isc/radix.h>
-
-#include <dns/types.h>
-
-struct dns_iptable {
-	unsigned int		magic;
-	isc_mem_t		*mctx;
-	isc_refcount_t		refcount;
-	isc_radix_tree_t	*radix;
-	ISC_LINK(dns_iptable_t)	nextincache;
-};
-
-#define DNS_IPTABLE_MAGIC	ISC_MAGIC('T','a','b','l')
-#define DNS_IPTABLE_VALID(a)	ISC_MAGIC_VALID(a, DNS_IPTABLE_MAGIC)
-
-/***
- *** Functions
- ***/
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target);
-/*
- * Create a new IP table and the underlying radix structure
- */
-
-isc_result_t
-dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
-		      uint16_t bitlen, isc_boolean_t pos);
-/*
- * Add an IP prefix to an existing IP table
- */
-
-isc_result_t
-dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos);
-/*
- * Merge one IP table into another one.
- */
-
-void
-dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target);
-
-void
-dns_iptable_detach(dns_iptable_t **tabp);
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_IPTABLE_H */
diff --git a/usr.sbin/bind/lib/dns/iptable.c b/usr.sbin/bind/lib/dns/iptable.c
deleted file mode 100644
index 3868695bf18..00000000000
--- a/usr.sbin/bind/lib/dns/iptable.c
+++ /dev/null
@@ -1,190 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* $Id: iptable.c,v 1.3 2020/01/09 18:17:15 florian Exp $ */
-
-#include <config.h>
-
-#include <isc/mem.h>
-#include <isc/radix.h>
-#include <isc/util.h>
-
-#include <dns/acl.h>
-
-static void destroy_iptable(dns_iptable_t *dtab);
-
-/*
- * Create a new IP table and the underlying radix structure
- */
-isc_result_t
-dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) {
-	isc_result_t result;
-	dns_iptable_t *tab;
-
-	tab = isc_mem_get(mctx, sizeof(*tab));
-	if (tab == NULL)
-		return (ISC_R_NOMEMORY);
-	tab->mctx = NULL;
-	isc_mem_attach(mctx, &tab->mctx);
-	isc_refcount_init(&tab->refcount, 1);
-	tab->radix = NULL;
-	tab->magic = DNS_IPTABLE_MAGIC;
-
-	result = isc_radix_create(mctx, &tab->radix, RADIX_MAXBITS);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup;
-
-	*target = tab;
-	return (ISC_R_SUCCESS);
-
- cleanup:
-	dns_iptable_detach(&tab);
-	return (result);
-}
-
-static isc_boolean_t dns_iptable_neg = ISC_FALSE;
-static isc_boolean_t dns_iptable_pos = ISC_TRUE;
-
-/*
- * Add an IP prefix to an existing IP table
- */
-isc_result_t
-dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
-		      uint16_t bitlen, isc_boolean_t pos)
-{
-	isc_result_t result;
-	isc_prefix_t pfx;
-	isc_radix_node_t *node = NULL;
-	int family;
-
-	INSIST(DNS_IPTABLE_VALID(tab));
-	INSIST(tab->radix);
-
-	NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
-
-	result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
-	if (result != ISC_R_SUCCESS) {
-		isc_refcount_destroy(&pfx.refcount);
-		return(result);
-	}
-
-	/* If a node already contains data, don't overwrite it */
-	family = pfx.family;
-	if (family == AF_UNSPEC) {
-		/* "any" or "none" */
-		INSIST(pfx.bitlen == 0);
-		if (pos) {
-			if (node->data[0] == NULL)
-				node->data[0] = &dns_iptable_pos;
-			if (node->data[1] == NULL)
-				node->data[1] = &dns_iptable_pos;
-		} else {
-			if (node->data[0] == NULL)
-				node->data[0] = &dns_iptable_neg;
-			if (node->data[1] == NULL)
-				node->data[1] = &dns_iptable_neg;
-		}
-	} else {
-		/* any other prefix */
-		if (node->data[ISC_IS6(family)] == NULL) {
-			if (pos)
-				node->data[ISC_IS6(family)] = &dns_iptable_pos;
-			else
-				node->data[ISC_IS6(family)] = &dns_iptable_neg;
-		}
-	}
-
-	isc_refcount_destroy(&pfx.refcount);
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Merge one IP table into another one.
- */
-isc_result_t
-dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos)
-{
-	isc_result_t result;
-	isc_radix_node_t *node, *new_node;
-	int max_node = 0;
-
-	RADIX_WALK (source->radix->head, node) {
-		new_node = NULL;
-		result = isc_radix_insert (tab->radix, &new_node, node, NULL);
-
-		if (result != ISC_R_SUCCESS)
-			return(result);
-
-		/*
-		 * If we're negating a nested ACL, then we should
-		 * reverse the sense of every node.  However, this
-		 * could lead to a negative node in a nested ACL
-		 * becoming a positive match in the parent, which
-		 * could be a security risk.  To prevent this, we
-		 * just leave the negative nodes negative.
-		 */
-		if (!pos) {
-			if (node->data[0] &&
-			    *(isc_boolean_t *) node->data[0] == ISC_TRUE)
-				new_node->data[0] = &dns_iptable_neg;
-
-			if (node->data[1] &&
-			    *(isc_boolean_t *) node->data[1] == ISC_TRUE)
-				new_node->data[1] = &dns_iptable_neg;
-		}
-
-		if (node->node_num[0] > max_node)
-			max_node = node->node_num[0];
-		if (node->node_num[1] > max_node)
-			max_node = node->node_num[1];
-	} RADIX_WALK_END;
-
-	tab->radix->num_added_node += max_node;
-	return (ISC_R_SUCCESS);
-}
-
-void
-dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target) {
-	REQUIRE(DNS_IPTABLE_VALID(source));
-	isc_refcount_increment(&source->refcount, NULL);
-	*target = source;
-}
-
-void
-dns_iptable_detach(dns_iptable_t **tabp) {
-	dns_iptable_t *tab = *tabp;
-	unsigned int refs;
-	REQUIRE(DNS_IPTABLE_VALID(tab));
-	isc_refcount_decrement(&tab->refcount, &refs);
-	if (refs == 0)
-		destroy_iptable(tab);
-	*tabp = NULL;
-}
-
-static void
-destroy_iptable(dns_iptable_t *dtab) {
-
-	REQUIRE(DNS_IPTABLE_VALID(dtab));
-
-	if (dtab->radix != NULL) {
-		isc_radix_destroy(dtab->radix, NULL);
-		dtab->radix = NULL;
-	}
-
-	isc_refcount_destroy(&dtab->refcount);
-	dtab->magic = 0;
-	isc_mem_putanddetach(&dtab->mctx, dtab, sizeof(*dtab));
-}
diff --git a/usr.sbin/bind/lib/isccfg/Makefile.in b/usr.sbin/bind/lib/isccfg/Makefile.in
index 538e0398be1..21aa88d4c52 100644
--- a/usr.sbin/bind/lib/isccfg/Makefile.in
+++ b/usr.sbin/bind/lib/isccfg/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6 2019/12/17 01:46:38 sthen Exp $
+# $Id: Makefile.in,v 1.7 2020/01/20 18:39:24 florian Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -41,11 +41,11 @@ LIBS =		@LIBS@
 SUBDIRS =	include
 
 # Alphabetically
-OBJS =		aclconf.@O@ dnsconf.@O@ log.@O@ namedconf.@O@ \
+OBJS =		dnsconf.@O@ log.@O@ namedconf.@O@ \
 		parser.@O@ version.@O@
 
 # Alphabetically
-SRCS =		aclconf.c dnsconf.c log.c namedconf.c \
+SRCS =		dnsconf.c log.c namedconf.c \
 		parser.c version.c
 
 TARGETS = 	timestamp
diff --git a/usr.sbin/bind/lib/isccfg/aclconf.c b/usr.sbin/bind/lib/isccfg/aclconf.c
deleted file mode 100644
index 05c14000d69..00000000000
--- a/usr.sbin/bind/lib/isccfg/aclconf.c
+++ /dev/null
@@ -1,563 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <config.h>
-
-#include <isc/mem.h>
-
-#include <isc/string.h>		/* Required for HP/UX (and others?) */
-#include <isc/util.h>
-
-#include <isccfg/namedconf.h>
-#include <isccfg/aclconf.h>
-
-#include <dns/acl.h>
-#include <dns/iptable.h>
-#include <dns/fixedname.h>
-#include <dns/log.h>
-
-#define LOOP_MAGIC ISC_MAGIC('L','O','O','P')
-
-isc_result_t
-cfg_aclconfctx_create(isc_mem_t *mctx, cfg_aclconfctx_t **ret) {
-	isc_result_t result;
-	cfg_aclconfctx_t *actx;
-
-	REQUIRE(mctx != NULL);
-	REQUIRE(ret != NULL && *ret == NULL);
-
-	actx = isc_mem_get(mctx, sizeof(*actx));
-	if (actx == NULL)
-		return (ISC_R_NOMEMORY);
-
-	result = isc_refcount_init(&actx->references, 1);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup;
-
-	actx->mctx = NULL;
-	isc_mem_attach(mctx, &actx->mctx);
-	ISC_LIST_INIT(actx->named_acl_cache);
-
-	*ret = actx;
-	return (ISC_R_SUCCESS);
-
- cleanup:
-	isc_mem_put(mctx, actx, sizeof(*actx));
-	return (result);
-}
-
-void
-cfg_aclconfctx_attach(cfg_aclconfctx_t *src, cfg_aclconfctx_t **dest) {
-	REQUIRE(src != NULL);
-	REQUIRE(dest != NULL && *dest == NULL);
-
-	isc_refcount_increment(&src->references, NULL);
-	*dest = src;
-}
-
-void
-cfg_aclconfctx_detach(cfg_aclconfctx_t **actxp) {
-	cfg_aclconfctx_t *actx;
-	dns_acl_t *dacl, *next;
-	unsigned int refs;
-
-	REQUIRE(actxp != NULL && *actxp != NULL);
-
-	actx = *actxp;
-
-	isc_refcount_decrement(&actx->references, &refs);
-	if (refs == 0) {
-		for (dacl = ISC_LIST_HEAD(actx->named_acl_cache);
-		     dacl != NULL;
-		     dacl = next)
-		{
-			next = ISC_LIST_NEXT(dacl, nextincache);
-			ISC_LIST_UNLINK(actx->named_acl_cache, dacl,
-					nextincache);
-			dns_acl_detach(&dacl);
-		}
-		isc_mem_putanddetach(&actx->mctx, actx, sizeof(*actx));
-	}
-
-	*actxp = NULL;
-}
-
-/*
- * Find the definition of the named acl whose name is "name".
- */
-static isc_result_t
-get_acl_def(const cfg_obj_t *cctx, const char *name, const cfg_obj_t **ret) {
-	isc_result_t result;
-	const cfg_obj_t *acls = NULL;
-	const cfg_listelt_t *elt;
-
-	result = cfg_map_get(cctx, "acl", &acls);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	for (elt = cfg_list_first(acls);
-	     elt != NULL;
-	     elt = cfg_list_next(elt)) {
-		const cfg_obj_t *acl = cfg_listelt_value(elt);
-		const char *aclname = cfg_obj_asstring(cfg_tuple_get(acl, "name"));
-		if (strcasecmp(aclname, name) == 0) {
-			if (ret != NULL) {
-				*ret = cfg_tuple_get(acl, "value");
-			}
-			return (ISC_R_SUCCESS);
-		}
-	}
-	return (ISC_R_NOTFOUND);
-}
-
-static isc_result_t
-convert_named_acl(const cfg_obj_t *nameobj, const cfg_obj_t *cctx,
-		  isc_log_t *lctx, cfg_aclconfctx_t *ctx,
-		  isc_mem_t *mctx, unsigned int nest_level,
-		  dns_acl_t **target)
-{
-	isc_result_t result;
-	const cfg_obj_t *cacl = NULL;
-	dns_acl_t *dacl;
-	dns_acl_t loop;
-	const char *aclname = cfg_obj_asstring(nameobj);
-
-	/* Look for an already-converted version. */
-	for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
-	     dacl != NULL;
-	     dacl = ISC_LIST_NEXT(dacl, nextincache))
-	{
-		if (strcasecmp(aclname, dacl->name) == 0) {
-			if (ISC_MAGIC_VALID(dacl, LOOP_MAGIC)) {
-				cfg_obj_log(nameobj, lctx, ISC_LOG_ERROR,
-					    "acl loop detected: %s", aclname);
-				return (ISC_R_FAILURE);
-			}
-			dns_acl_attach(dacl, target);
-			return (ISC_R_SUCCESS);
-		}
-	}
-	/* Not yet converted.  Convert now. */
-	result = get_acl_def(cctx, aclname, &cacl);
-	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(nameobj, lctx, ISC_LOG_WARNING,
-			    "undefined ACL '%s'", aclname);
-		return (result);
-	}
-	/*
-	 * Add a loop detection element.
-	 */
-	memset(&loop, 0, sizeof(loop));
-	ISC_LINK_INIT(&loop, nextincache);
-	DE_CONST(aclname, loop.name);
-	loop.magic = LOOP_MAGIC;
-	ISC_LIST_APPEND(ctx->named_acl_cache, &loop, nextincache);
-	result = cfg_acl_fromconfig(cacl, cctx, lctx, ctx, mctx,
-				    nest_level, &dacl);
-	ISC_LIST_UNLINK(ctx->named_acl_cache, &loop, nextincache);
-	loop.magic = 0;
-	loop.name = NULL;
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	dacl->name = isc_mem_strdup(dacl->mctx, aclname);
-	if (dacl->name == NULL)
-		return (ISC_R_NOMEMORY);
-	ISC_LIST_APPEND(ctx->named_acl_cache, dacl, nextincache);
-	dns_acl_attach(dacl, target);
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-convert_keyname(const cfg_obj_t *keyobj, isc_log_t *lctx, isc_mem_t *mctx,
-		dns_name_t *dnsname)
-{
-	isc_result_t result;
-	isc_buffer_t buf;
-	dns_fixedname_t fixname;
-	unsigned int keylen;
-	const char *txtname = cfg_obj_asstring(keyobj);
-
-	keylen = strlen(txtname);
-	isc_buffer_constinit(&buf, txtname, keylen);
-	isc_buffer_add(&buf, keylen);
-	dns_fixedname_init(&fixname);
-	result = dns_name_fromtext(dns_fixedname_name(&fixname), &buf,
-				   dns_rootname, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(keyobj, lctx, ISC_LOG_WARNING,
-			    "key name '%s' is not a valid domain name",
-			    txtname);
-		return (result);
-	}
-	return (dns_name_dup(dns_fixedname_name(&fixname), mctx, dnsname));
-}
-
-/*
- * Recursively pre-parse an ACL definition to find the total number
- * of non-IP-prefix elements (localhost, localnets, key) in all nested
- * ACLs, so that the parent will have enough space allocated for the
- * elements table after all the nested ACLs have been merged in to the
- * parent.
- */
-static isc_result_t
-count_acl_elements(const cfg_obj_t *caml, const cfg_obj_t *cctx,
-		   isc_log_t *lctx, cfg_aclconfctx_t *ctx, isc_mem_t *mctx,
-		   uint32_t *count, isc_boolean_t *has_negative)
-{
-	const cfg_listelt_t *elt;
-	isc_result_t result;
-	uint32_t n = 0;
-
-	REQUIRE(count != NULL);
-
-	if (has_negative != NULL)
-		*has_negative = ISC_FALSE;
-
-	for (elt = cfg_list_first(caml);
-	     elt != NULL;
-	     elt = cfg_list_next(elt)) {
-		const cfg_obj_t *ce = cfg_listelt_value(elt);
-
-		/* might be a negated element, in which case get the value. */
-		if (cfg_obj_istuple(ce)) {
-			const cfg_obj_t *negated =
-				cfg_tuple_get(ce, "negated");
-			if (! cfg_obj_isvoid(negated)) {
-				ce = negated;
-				if (has_negative != NULL)
-					*has_negative = ISC_TRUE;
-			}
-		}
-
-		if (cfg_obj_istype(ce, &cfg_type_keyref)) {
-			n++;
-		} else if (cfg_obj_islist(ce)) {
-			isc_boolean_t negative;
-			uint32_t sub;
-			result = count_acl_elements(ce, cctx, lctx, ctx, mctx,
-						    &sub, &negative);
-			if (result != ISC_R_SUCCESS)
-				return (result);
-			n += sub;
-			if (negative)
-				n++;
-		} else if (cfg_obj_isstring(ce)) {
-			const char *name = cfg_obj_asstring(ce);
-			if (strcasecmp(name, "localhost") == 0 ||
-			    strcasecmp(name, "localnets") == 0 ||
-			    strcasecmp(name, "none") == 0)
-			{
-				n++;
-			} else if (strcasecmp(name, "any") != 0) {
-				dns_acl_t *inneracl = NULL;
-				/*
-				 * Convert any named acls we reference now if
-				 * they have not already been converted.
-				 */
-				result = convert_named_acl(ce, cctx, lctx, ctx,
-							   mctx, 0, &inneracl);
-				if (result == ISC_R_SUCCESS) {
-					if (inneracl->has_negatives)
-						n++;
-					else
-						n += inneracl->length;
-					dns_acl_detach(&inneracl);
-				} else
-					return (result);
-			}
-		}
-	}
-
-	*count = n;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-cfg_acl_fromconfig(const cfg_obj_t *caml, const cfg_obj_t *cctx,
-		   isc_log_t *lctx, cfg_aclconfctx_t *ctx,
-		   isc_mem_t *mctx, unsigned int nest_level,
-		   dns_acl_t **target)
-{
-	return (cfg_acl_fromconfig2(caml, cctx, lctx, ctx, mctx,
-				    nest_level, 0, target));
-}
-
-isc_result_t
-cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
-		   isc_log_t *lctx, cfg_aclconfctx_t *ctx,
-		   isc_mem_t *mctx, unsigned int nest_level,
-		   uint16_t family, dns_acl_t **target)
-{
-	isc_result_t result;
-	dns_acl_t *dacl = NULL, *inneracl = NULL;
-	dns_aclelement_t *de;
-	const cfg_listelt_t *elt;
-	dns_iptable_t *iptab;
-	int new_nest_level = 0;
-
-	if (nest_level != 0)
-		new_nest_level = nest_level - 1;
-
-	REQUIRE(target != NULL);
-	REQUIRE(*target == NULL || DNS_ACL_VALID(*target));
-
-	if (*target != NULL) {
-		/*
-		 * If target already points to an ACL, then we're being
-		 * called recursively to configure a nested ACL.  The
-		 * nested ACL's contents should just be absorbed into its
-		 * parent ACL.
-		 */
-		dns_acl_attach(*target, &dacl);
-		dns_acl_detach(target);
-	} else {
-		/*
-		 * Need to allocate a new ACL structure.  Count the items
-		 * in the ACL definition that will require space in the
-		 * elements table.  (Note that if nest_level is nonzero,
-		 * *everything* goes in the elements table.)
-		 */
-		uint32_t nelem;
-
-		if (nest_level == 0) {
-			result = count_acl_elements(caml, cctx, lctx, ctx,
-						    mctx, &nelem, NULL);
-			if (result != ISC_R_SUCCESS)
-				return (result);
-		} else
-			nelem = cfg_list_length(caml, ISC_FALSE);
-
-		result = dns_acl_create(mctx, nelem, &dacl);
-		if (result != ISC_R_SUCCESS)
-			return (result);
-	}
-
-	de = dacl->elements;
-	for (elt = cfg_list_first(caml);
-	     elt != NULL;
-	     elt = cfg_list_next(elt)) {
-		const cfg_obj_t *ce = cfg_listelt_value(elt);
-		isc_boolean_t neg = ISC_FALSE;
-
-		INSIST(dacl->length <= dacl->alloc);
-
-		if (cfg_obj_istuple(ce)) {
-			/* Might be a negated element */
-			const cfg_obj_t *negated =
-				cfg_tuple_get(ce, "negated");
-			if (! cfg_obj_isvoid(negated)) {
-				neg = ISC_TRUE;
-				dacl->has_negatives = ISC_TRUE;
-				ce = negated;
-			}
-		}
-
-		/*
-		 * If nest_level is nonzero, then every element is
-		 * to be stored as a separate, nested ACL rather than
-		 * merged into the main iptable.
-		 */
-		iptab = dacl->iptable;
-
-		if (nest_level != 0) {
-			result = dns_acl_create(mctx,
-						cfg_list_length(ce, ISC_FALSE),
-						&de->nestedacl);
-			if (result != ISC_R_SUCCESS)
-				goto cleanup;
-			iptab = de->nestedacl->iptable;
-		}
-
-		if (cfg_obj_isnetprefix(ce)) {
-			/* Network prefix */
-			isc_netaddr_t	addr;
-			unsigned int	bitlen;
-
-			cfg_obj_asnetprefix(ce, &addr, &bitlen);
-			if (family != 0 && family != addr.family) {
-				char buf[ISC_NETADDR_FORMATSIZE + 1];
-				isc_netaddr_format(&addr, buf, sizeof(buf));
-				cfg_obj_log(ce, lctx, ISC_LOG_WARNING,
-					    "'%s': incorrect address family; "
-					    "ignoring", buf);
-				if (nest_level != 0)
-					dns_acl_detach(&de->nestedacl);
-				continue;
-			}
-			result = isc_netaddr_prefixok(&addr, bitlen);
-			if (result != ISC_R_SUCCESS) {
-				char buf[ISC_NETADDR_FORMATSIZE + 1];
-				isc_netaddr_format(&addr, buf, sizeof(buf));
-				cfg_obj_log(ce, lctx, ISC_LOG_WARNING,
-					    "'%s/%u': address/prefix length "
-					    "mismatch", buf, bitlen);
-			}
-
-			/*
-			 * If nesting ACLs (nest_level != 0), we negate
-			 * the nestedacl element, not the iptable entry.
-			 */
-			result = dns_iptable_addprefix(iptab, &addr, bitlen,
-					      ISC_TF(nest_level != 0 || !neg));
-			if (result != ISC_R_SUCCESS)
-				goto cleanup;
-
-			if (nest_level > 0) {
-				INSIST(dacl->length < dacl->alloc);
-				de->type = dns_aclelementtype_nestedacl;
-				de->negative = neg;
-			} else
-				continue;
-		} else if (cfg_obj_islist(ce)) {
-			/*
-			 * If we're nesting ACLs, put the nested
-			 * ACL onto the elements list; otherwise
-			 * merge it into *this* ACL.  We nest ACLs
-			 * in two cases: 1) sortlist, 2) if the
-			 * nested ACL contains negated members.
-			 */
-			if (inneracl != NULL)
-				dns_acl_detach(&inneracl);
-			result = cfg_acl_fromconfig(ce, cctx, lctx,
-						    ctx, mctx, new_nest_level,
-						    &inneracl);
-			if (result != ISC_R_SUCCESS)
-				goto cleanup;
-nested_acl:
-			if (nest_level > 0 || inneracl->has_negatives) {
-				INSIST(dacl->length < dacl->alloc);
-				de->type = dns_aclelementtype_nestedacl;
-				de->negative = neg;
-				if (de->nestedacl != NULL)
-					dns_acl_detach(&de->nestedacl);
-				dns_acl_attach(inneracl,
-					       &de->nestedacl);
-				dns_acl_detach(&inneracl);
-				/* Fall through. */
-			} else {
-				INSIST(dacl->length + inneracl->length
-				       <= dacl->alloc);
-				dns_acl_merge(dacl, inneracl,
-					      ISC_TF(!neg));
-				de += inneracl->length;  /* elements added */
-				dns_acl_detach(&inneracl);
-				INSIST(dacl->length <= dacl->alloc);
-				continue;
-			}
-		} else if (cfg_obj_istype(ce, &cfg_type_keyref)) {
-			/* Key name. */
-			INSIST(dacl->length < dacl->alloc);
-			de->type = dns_aclelementtype_keyname;
-			de->negative = neg;
-			dns_name_init(&de->keyname, NULL);
-			result = convert_keyname(ce, lctx, mctx,
-						 &de->keyname);
-			if (result != ISC_R_SUCCESS)
-				goto cleanup;
-		} else if (cfg_obj_isstring(ce)) {
-			/* ACL name. */
-			const char *name = cfg_obj_asstring(ce);
-			if (strcasecmp(name, "any") == 0) {
-				/* Iptable entry with zero bit length. */
-				result = dns_iptable_addprefix(iptab, NULL, 0,
-					      ISC_TF(nest_level != 0 || !neg));
-				if (result != ISC_R_SUCCESS)
-					goto cleanup;
-
-				if (nest_level != 0) {
-					INSIST(dacl->length < dacl->alloc);
-					de->type = dns_aclelementtype_nestedacl;
-					de->negative = neg;
-				} else
-					continue;
-			} else if (strcasecmp(name, "none") == 0) {
-				/* none == !any */
-				/*
-				 * We don't unconditional set
-				 * dacl->has_negatives and
-				 * de->negative to true so we can handle
-				 * "!none;".
-				 */
-				result = dns_iptable_addprefix(iptab, NULL, 0,
-					      ISC_TF(nest_level != 0 || neg));
-				if (result != ISC_R_SUCCESS)
-					goto cleanup;
-
-				if (!neg)
-					dacl->has_negatives = !neg;
-
-				if (nest_level != 0) {
-					INSIST(dacl->length < dacl->alloc);
-					de->type = dns_aclelementtype_nestedacl;
-					de->negative = !neg;
-				} else
-					continue;
-			} else if (strcasecmp(name, "localhost") == 0) {
-				INSIST(dacl->length < dacl->alloc);
-				de->type = dns_aclelementtype_localhost;
-				de->negative = neg;
-			} else if (strcasecmp(name, "localnets") == 0) {
-				INSIST(dacl->length < dacl->alloc);
-				de->type = dns_aclelementtype_localnets;
-				de->negative = neg;
-			} else {
-				if (inneracl != NULL)
-					dns_acl_detach(&inneracl);
-				/*
-				 * This call should just find the cached
-				 * of the named acl.
-				 */
-				result = convert_named_acl(ce, cctx, lctx, ctx,
-							   mctx, new_nest_level,
-							   &inneracl);
-				if (result != ISC_R_SUCCESS)
-					goto cleanup;
-
-				goto nested_acl;
-			}
-		} else {
-			cfg_obj_log(ce, lctx, ISC_LOG_WARNING,
-				    "address match list contains "
-				    "unsupported element type");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-
-		/*
-		 * This should only be reached for localhost, localnets
-		 * and keyname elements, and nested ACLs if nest_level is
-		 * nonzero (i.e., in sortlists).
-		 */
-		if (de->nestedacl != NULL &&
-		    de->type != dns_aclelementtype_nestedacl)
-			dns_acl_detach(&de->nestedacl);
-
-		dacl->node_count++;
-		de->node_num = dacl->node_count;
-
-		dacl->length++;
-		de++;
-		INSIST(dacl->length <= dacl->alloc);
-	}
-
-	dns_acl_attach(dacl, target);
-	result = ISC_R_SUCCESS;
-
- cleanup:
-	if (inneracl != NULL)
-		dns_acl_detach(&inneracl);
-	dns_acl_detach(&dacl);
-	return (result);
-}
diff --git a/usr.sbin/bind/lib/isccfg/include/isccfg/Makefile.in b/usr.sbin/bind/lib/isccfg/include/isccfg/Makefile.in
index 071333c735f..4e1f29f8f4d 100644
--- a/usr.sbin/bind/lib/isccfg/include/isccfg/Makefile.in
+++ b/usr.sbin/bind/lib/isccfg/include/isccfg/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.3 2019/12/17 01:46:38 sthen Exp $
+# $Id: Makefile.in,v 1.4 2020/01/20 18:39:24 florian Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -25,7 +25,7 @@ VERSION=@BIND9_VERSION@
 # machine generated.  The latter are handled specially in the
 # install target below.
 #
-HEADERS =	aclconf.h cfg.h dnsconf.h grammar.h log.h namedconf.h \
+HEADERS =	cfg.h dnsconf.h grammar.h log.h namedconf.h \
 		version.h
 
 SUBDIRS =
diff --git a/usr.sbin/bind/lib/isccfg/include/isccfg/aclconf.h b/usr.sbin/bind/lib/isccfg/include/isccfg/aclconf.h
deleted file mode 100644
index 08eac043224..00000000000
--- a/usr.sbin/bind/lib/isccfg/include/isccfg/aclconf.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* $Id: aclconf.h,v 1.5 2020/01/09 18:17:20 florian Exp $ */
-
-#ifndef ISCCFG_ACLCONF_H
-#define ISCCFG_ACLCONF_H 1
-
-#include <isc/lang.h>
-
-#include <isccfg/cfg.h>
-
-#include <dns/types.h>
-
-typedef struct cfg_aclconfctx {
-	ISC_LIST(dns_acl_t) named_acl_cache;
-	isc_mem_t *mctx;
-	isc_refcount_t references;
-} cfg_aclconfctx_t;
-
-/***
- *** Functions
- ***/
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-cfg_aclconfctx_create(isc_mem_t *mctx, cfg_aclconfctx_t **ret);
-/*
- * Creates and initializes an ACL configuration context.
- */
-
-void
-cfg_aclconfctx_detach(cfg_aclconfctx_t **actxp);
-/*
- * Removes a reference to an ACL configuration context; when references
- * reaches zero, clears the contents and deallocate the structure.
- */
-
-void
-cfg_aclconfctx_attach(cfg_aclconfctx_t *src, cfg_aclconfctx_t **dest);
-/*
- * Attaches a pointer to an existing ACL configuration context.
- */
-
-isc_result_t
-cfg_acl_fromconfig(const cfg_obj_t *caml, const cfg_obj_t *cctx,
-		   isc_log_t *lctx, cfg_aclconfctx_t *ctx,
-		   isc_mem_t *mctx, unsigned int nest_level,
-		   dns_acl_t **target);
-
-isc_result_t
-cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
-		   isc_log_t *lctx, cfg_aclconfctx_t *ctx,
-		   isc_mem_t *mctx, unsigned int nest_level,
-		   uint16_t family, dns_acl_t **target);
-/*
- * Construct a new dns_acl_t from configuration data in 'caml' and
- * 'cctx'.  Memory is allocated through 'mctx'.
- *
- * Any named ACLs referred to within 'caml' will be be converted
- * into nested dns_acl_t objects.  Multiple references to the same
- * named ACLs will be converted into shared references to a single
- * nested dns_acl_t object when the referring objects were created
- * passing the same ACL configuration context 'ctx'.
- *
- * cfg_acl_fromconfig() is a backward-compatible version of
- * cfg_acl_fromconfig2(), which allows an address family to be
- * specified.  If 'family' is not zero, then only addresses/prefixes
- * of a matching family (AF_INET or AF_INET6) may be configured.
- *
- * On success, attach '*target' to the new dns_acl_t object.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISCCFG_ACLCONF_H */