Viewing file:  ssu.h (6.61 KB) -rw-r--r--
Select action/file-type:
 (+) |  (+) |  (+) | Code (+) | Session (+) |  (+) | SDB (+) |  (+) |  (+) |  (+) |  (+) |  (+) |
/*
* Copyright (C) 2004-2008, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: ssu.h,v 1.28 2011-01-06 23:47:00 tbox Exp $ */
#ifndef DNS_SSU_H
#define DNS_SSU_H 1
/*! \file dns/ssu.h */
#include <isc/lang.h>
#include <dns/types.h>
#include <dst/dst.h>
ISC_LANG_BEGINDECLS
#define DNS_SSUMATCHTYPE_NAME 0
#define DNS_SSUMATCHTYPE_SUBDOMAIN 1
#define DNS_SSUMATCHTYPE_WILDCARD 2
#define DNS_SSUMATCHTYPE_SELF 3
#define DNS_SSUMATCHTYPE_SELFSUB 4
#define DNS_SSUMATCHTYPE_SELFWILD 5
#define DNS_SSUMATCHTYPE_SELFKRB5 6
#define DNS_SSUMATCHTYPE_SELFMS 7
#define DNS_SSUMATCHTYPE_SUBDOMAINMS 8
#define DNS_SSUMATCHTYPE_SUBDOMAINKRB5 9
#define DNS_SSUMATCHTYPE_TCPSELF 10
#define DNS_SSUMATCHTYPE_6TO4SELF 11
#define DNS_SSUMATCHTYPE_EXTERNAL 12
#define DNS_SSUMATCHTYPE_DLZ 13
#define DNS_SSUMATCHTYPE_MAX 12 /* max value */
isc_result_t
dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **table);
/*%<
* Creates a table that will be used to store simple-secure-update rules.
* Note: all locking must be provided by the client.
*
* Requires:
*\li 'mctx' is a valid memory context
*\li 'table' is not NULL, and '*table' is NULL
*
* Returns:
*\li ISC_R_SUCCESS
*\li ISC_R_NOMEMORY
*/
isc_result_t
dns_ssutable_createdlz(isc_mem_t *mctx, dns_ssutable_t **tablep,
dns_dlzdb_t *dlzdatabase);
/*%<
* Create an SSU table that contains a dlzdatabase pointer, and a
* single rule with matchtype DNS_SSUMATCHTYPE_DLZ. This type of SSU
* table is used by writeable DLZ drivers to offload authorization for
* updates to the driver.
*/
void
dns_ssutable_attach(dns_ssutable_t *source, dns_ssutable_t **targetp);
/*%<
* Attach '*targetp' to 'source'.
*
* Requires:
*\li 'source' is a valid SSU table
*\li 'targetp' points to a NULL dns_ssutable_t *.
*
* Ensures:
*\li *targetp is attached to source.
*/
void
dns_ssutable_detach(dns_ssutable_t **tablep);
/*%<
* Detach '*tablep' from its simple-secure-update rule table.
*
* Requires:
*\li 'tablep' points to a valid dns_ssutable_t
*
* Ensures:
*\li *tablep is NULL
*\li If '*tablep' is the last reference to the SSU table, all
* resources used by the table will be freed.
*/
isc_result_t
dns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,
dns_name_t *identity, unsigned int matchtype,
dns_name_t *name, unsigned int ntypes,
dns_rdatatype_t *types);
/*%<
* Adds a new rule to a simple-secure-update rule table. The rule
* either grants or denies update privileges of an identity (or set of
* identities) to modify a name (or set of names) or certain types present
* at that name.
*
* Notes:
*\li If 'matchtype' is of SELF type, this rule only matches if the
* name to be updated matches the signing identity.
*
*\li If 'ntypes' is 0, this rule applies to all types except
* NS, SOA, RRSIG, and NSEC.
*
*\li If 'types' includes ANY, this rule applies to all types
* except NSEC.
*
* Requires:
*\li 'table' is a valid SSU table
*\li 'identity' is a valid absolute name
*\li 'matchtype' must be one of the defined constants.
*\li 'name' is a valid absolute name
*\li If 'ntypes' > 0, 'types' must not be NULL
*
* Returns:
*\li ISC_R_SUCCESS
*\li ISC_R_NOMEMORY
*/
isc_boolean_t
dns_ssutable_checkrules(dns_ssutable_t *table, dns_name_t *signer,
dns_name_t *name, isc_netaddr_t *tcpaddr,
dns_rdatatype_t type, const dst_key_t *key);
/*%<
* Checks that the attempted update of (name, type) is allowed according
* to the rules specified in the simple-secure-update rule table. If
* no rules are matched, access is denied.
*
* Notes:
* 'tcpaddr' should only be set if the request received
* via TCP. This provides a weak assurance that the
* request was not spoofed. 'tcpaddr' is to to validate
* DNS_SSUMATCHTYPE_TCPSELF and DNS_SSUMATCHTYPE_6TO4SELF
* rules.
*
* For DNS_SSUMATCHTYPE_TCPSELF the addresses are mapped to
* the standard reverse names under IN-ADDR.ARPA and IP6.ARPA.
* RFC 1035, Section 3.5, "IN-ADDR.ARPA domain" and RFC 3596,
* Section 2.5, "IP6.ARPA Domain".
*
* For DNS_SSUMATCHTYPE_6TO4SELF, IPv4 address are converted
* to a 6to4 prefix (48 bits) per the rules in RFC 3056. Only
* the top 48 bits of the IPv6 address are mapped to the reverse
* name. This is independent of whether the most significant 16
* bits match 2002::/16, assigned for 6to4 prefixes, or not.
*
* Requires:
*\li 'table' is a valid SSU table
*\li 'signer' is NULL or a valid absolute name
*\li 'tcpaddr' is NULL or a valid network address.
*\li 'name' is a valid absolute name
*/
/*% Accessor functions to extract rule components */
isc_boolean_t dns_ssurule_isgrant(const dns_ssurule_t *rule);
/*% Accessor functions to extract rule components */
dns_name_t * dns_ssurule_identity(const dns_ssurule_t *rule);
/*% Accessor functions to extract rule components */
unsigned int dns_ssurule_matchtype(const dns_ssurule_t *rule);
/*% Accessor functions to extract rule components */
dns_name_t * dns_ssurule_name(const dns_ssurule_t *rule);
/*% Accessor functions to extract rule components */
unsigned int dns_ssurule_types(const dns_ssurule_t *rule,
dns_rdatatype_t **types);
isc_result_t dns_ssutable_firstrule(const dns_ssutable_t *table,
dns_ssurule_t **rule);
/*%<
* Initiates a rule iterator. There is no need to maintain any state.
*
* Returns:
*\li #ISC_R_SUCCESS
*\li #ISC_R_NOMORE
*/
isc_result_t dns_ssutable_nextrule(dns_ssurule_t *rule,
dns_ssurule_t **nextrule);
/*%<
* Returns the next rule in the table.
*
* Returns:
*\li #ISC_R_SUCCESS
*\li #ISC_R_NOMORE
*/
/*%<
* Check a policy rule via an external application
*/
isc_boolean_t
dns_ssu_external_match(dns_name_t *identity, dns_name_t *signer,
dns_name_t *name, isc_netaddr_t *tcpaddr,
dns_rdatatype_t type, const dst_key_t *key,
isc_mem_t *mctx);
ISC_LANG_ENDDECLS
#endif /* DNS_SSU_H */
|