Gecko [ paxlifestyle.com ]

Name	Size	Permission	Date
acl.h	8.74 KB	-rw-r--r--	2025-01-20 13:39
adb.h	21.28 KB	-rw-r--r--	2025-01-20 13:39
badcache.h	3.28 KB	-rw-r--r--	2025-01-20 13:39
bit.h	788 B	-rw-r--r--	2025-01-20 13:39
byaddr.h	3.5 KB	-rw-r--r--	2025-01-20 13:39
cache.h	6.68 KB	-rw-r--r--	2025-01-20 13:39
callbacks.h	2.04 KB	-rw-r--r--	2025-01-20 13:39
catz.h	12.03 KB	-rw-r--r--	2025-01-20 13:39
cert.h	1.42 KB	-rw-r--r--	2025-01-20 13:39
client.h	9.18 KB	-rw-r--r--	2025-01-20 13:39
clientinfo.h	2.58 KB	-rw-r--r--	2025-01-20 13:39
compress.h	6.86 KB	-rw-r--r--	2025-01-20 13:39
db.h	49.1 KB	-rw-r--r--	2025-01-20 13:39
dbiterator.h	7.18 KB	-rw-r--r--	2025-01-20 13:39
diff.h	6.86 KB	-rw-r--r--	2025-01-20 13:39
dispatch.h	10.25 KB	-rw-r--r--	2026-03-27 00:00
dlz.h	10.61 KB	-rw-r--r--	2025-01-20 13:39
dlz_dlopen.h	4.27 KB	-rw-r--r--	2025-01-20 13:39
dns64.h	6.22 KB	-rw-r--r--	2025-01-20 13:39
dnsrps.h	2.49 KB	-rw-r--r--	2025-01-20 13:39
dnssec.h	12.86 KB	-rw-r--r--	2025-01-20 13:39
dnstap.h	9.95 KB	-rw-r--r--	2025-01-20 13:39
ds.h	1.62 KB	-rw-r--r--	2025-01-20 13:39
dsdigest.h	1.65 KB	-rw-r--r--	2025-01-20 13:39
dyndb.h	4.8 KB	-rw-r--r--	2025-01-20 13:39
ecs.h	1.91 KB	-rw-r--r--	2025-01-20 13:39
edns.h	763 B	-rw-r--r--	2025-01-20 13:39
enumclass.h	1.13 KB	-rw-r--r--	2026-03-27 00:00
enumtype.h	8.42 KB	-rw-r--r--	2026-03-27 00:00
events.h	4.33 KB	-rw-r--r--	2025-01-20 13:39
fixedname.h	1.59 KB	-rw-r--r--	2025-01-20 13:39
forward.h	3.13 KB	-rw-r--r--	2025-01-20 13:39
geoip.h	2.27 KB	-rw-r--r--	2025-01-20 13:39
ipkeylist.h	2.13 KB	-rw-r--r--	2025-01-20 13:39
iptable.h	1.46 KB	-rw-r--r--	2025-01-20 13:39
journal.h	9.46 KB	-rw-r--r--	2025-01-20 13:39
kasp.h	12.46 KB	-rw-r--r--	2025-01-20 13:39
keydata.h	1 KB	-rw-r--r--	2025-01-20 13:39
keyflags.h	1.22 KB	-rw-r--r--	2025-01-20 13:39
keymgr.h	3.99 KB	-rw-r--r--	2025-01-20 13:39
keytable.h	7.85 KB	-rw-r--r--	2025-01-20 13:39
keyvalues.h	3.96 KB	-rw-r--r--	2025-01-20 13:39
librpz.h	30.29 KB	-rw-r--r--	2025-01-20 13:39
log.h	3.91 KB	-rw-r--r--	2025-01-20 13:39
lookup.h	2.84 KB	-rw-r--r--	2025-01-20 13:39
master.h	8.52 KB	-rw-r--r--	2025-01-20 13:39
masterdump.h	9.64 KB	-rw-r--r--	2025-01-20 13:39
message.h	41.35 KB	-rw-r--r--	2026-03-27 00:00
name.h	36.35 KB	-rw-r--r--	2025-01-20 13:39
ncache.h	4.83 KB	-rw-r--r--	2025-01-20 13:39
nsec.h	3.43 KB	-rw-r--r--	2025-01-20 13:39
nsec3.h	8.05 KB	-rw-r--r--	2025-01-20 13:39
nta.h	4.6 KB	-rw-r--r--	2025-01-20 13:39
opcode.h	987 B	-rw-r--r--	2025-01-20 13:39
order.h	1.95 KB	-rw-r--r--	2025-01-20 13:39
peer.h	4.8 KB	-rw-r--r--	2025-01-20 13:39
private.h	1.89 KB	-rw-r--r--	2025-01-20 13:39
rbt.h	34.66 KB	-rw-r--r--	2025-01-20 13:39
rcode.h	2.4 KB	-rw-r--r--	2025-01-20 13:39
rdata.h	22.21 KB	-rw-r--r--	2025-01-20 13:39
rdataclass.h	2.17 KB	-rw-r--r--	2025-01-20 13:39
rdatalist.h	2.47 KB	-rw-r--r--	2025-01-20 13:39
rdataset.h	18.67 KB	-rw-r--r--	2025-01-20 13:39
rdatasetiter.h	3.81 KB	-rw-r--r--	2025-01-20 13:39
rdataslab.h	4.11 KB	-rw-r--r--	2025-01-20 13:39
rdatastruct.h	60.33 KB	-rw-r--r--	2026-03-27 00:00
rdatatype.h	2.21 KB	-rw-r--r--	2025-01-20 13:39
request.h	8.67 KB	-rw-r--r--	2026-03-27 00:00
resolver.h	18.7 KB	-rw-r--r--	2025-01-20 13:39
result.h	689 B	-rw-r--r--	2025-01-20 13:39
rootns.h	872 B	-rw-r--r--	2025-01-20 13:39
rpz.h	12.22 KB	-rw-r--r--	2025-01-20 13:39
rriterator.h	4.09 KB	-rw-r--r--	2025-01-20 13:39
rrl.h	6.8 KB	-rw-r--r--	2025-01-20 13:39
sdb.h	7.17 KB	-rw-r--r--	2025-01-20 13:39
sdlz.h	13.75 KB	-rw-r--r--	2025-01-20 13:39
secalg.h	1.65 KB	-rw-r--r--	2025-01-20 13:39
secproto.h	1.5 KB	-rw-r--r--	2025-01-20 13:39
soa.h	2.12 KB	-rw-r--r--	2025-01-20 13:39
ssu.h	7.6 KB	-rw-r--r--	2025-01-20 13:39
stats.h	24.15 KB	-rw-r--r--	2025-01-20 13:39
time.h	1.64 KB	-rw-r--r--	2025-01-20 13:39
tkey.h	7.46 KB	-rw-r--r--	2025-01-20 13:39
transport.h	5.93 KB	-rw-r--r--	2026-03-27 00:00
tsec.h	2.86 KB	-rw-r--r--	2025-01-20 13:39
tsig.h	8.18 KB	-rw-r--r--	2025-01-20 13:39
ttl.h	1.82 KB	-rw-r--r--	2025-01-20 13:39
types.h	14.03 KB	-rw-r--r--	2026-03-27 00:00
update.h	1.94 KB	-rw-r--r--	2025-01-20 13:39
validator.h	6.6 KB	-rw-r--r--	2025-01-20 13:39
view.h	36.94 KB	-rw-r--r--	2025-01-20 13:39
xfrin.h	2.26 KB	-rw-r--r--	2025-01-20 13:39
zone.h	63.88 KB	-rw-r--r--	2025-01-20 13:39
zonekey.h	754 B	-rw-r--r--	2025-01-20 13:39
zoneverify.h	1.4 KB	-rw-r--r--	2025-01-20 13:39
zt.h	5.02 KB	-rw-r--r--	2025-01-20 13:39

Rename

/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

#pragma once

/*! \file dns/ssu.h */

#include <stdbool.h>

#include <isc/lang.h>

#include <dns/acl.h>
#include <dns/types.h>

#include <dst/dst.h>

ISC_LANG_BEGINDECLS

typedef enum {
	dns_ssumatchtype_name = 0,
	dns_ssumatchtype_subdomain = 1,
	dns_ssumatchtype_wildcard = 2,
	dns_ssumatchtype_self = 3,
	dns_ssumatchtype_selfsub = 4,
	dns_ssumatchtype_selfwild = 5,
	dns_ssumatchtype_selfkrb5 = 6,
	dns_ssumatchtype_selfms = 7,
	dns_ssumatchtype_subdomainms = 8,
	dns_ssumatchtype_subdomainkrb5 = 9,
	dns_ssumatchtype_tcpself = 10,
	dns_ssumatchtype_6to4self = 11,
	dns_ssumatchtype_external = 12,
	dns_ssumatchtype_local = 13,
	dns_ssumatchtype_selfsubms = 14,
	dns_ssumatchtype_selfsubkrb5 = 15,
	dns_ssumatchtype_subdomainselfkrb5rhs = 16,
	dns_ssumatchtype_subdomainselfmsrhs = 17,
	dns_ssumatchtype_max = 17, /* max value */

dns_ssumatchtype_dlz = 18 /* intentionally higher than _max */
} dns_ssumatchtype_t;

typedef struct dns_ssuruletype {
	dns_rdatatype_t type; /* type allowed */
	unsigned int	max;  /* maximum number of records allowed. */
} dns_ssuruletype_t;

void
dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **table);
/*%<
 *	Creates a table that will be used to store simple-secure-update rules.
 *	Note: all locking must be provided by the client.
 *
 *	Requires:
 *\li		'mctx' is a valid memory context
 *\li		'table' is not NULL, and '*table' is NULL
 *
 *	Returns:
 *\li		ISC_R_SUCCESS
 *\li		ISC_R_NOMEMORY
 */

void
dns_ssutable_createdlz(isc_mem_t *mctx, dns_ssutable_t **tablep,
		       dns_dlzdb_t *dlzdatabase);
/*%<
 * Create an SSU table that contains a dlzdatabase pointer, and a
 * single rule with matchtype dns_ssumatchtype_dlz. This type of SSU
 * table is used by writeable DLZ drivers to offload authorization for
 * updates to the driver.
 */

void
dns_ssutable_attach(dns_ssutable_t *source, dns_ssutable_t **targetp);
/*%<
 *	Attach '*targetp' to 'source'.
 *
 *	Requires:
 *\li		'source' is a valid SSU table
 *\li		'targetp' points to a NULL dns_ssutable_t *.
 *
 *	Ensures:
 *\li		*targetp is attached to source.
 */

void
dns_ssutable_detach(dns_ssutable_t **tablep);
/*%<
 *	Detach '*tablep' from its simple-secure-update rule table.
 *
 *	Requires:
 *\li		'tablep' points to a valid dns_ssutable_t
 *
 *	Ensures:
 *\li		*tablep is NULL
 *\li		If '*tablep' is the last reference to the SSU table, all
 *			resources used by the table will be freed.
 */

void
dns_ssutable_addrule(dns_ssutable_t *table, bool grant,
		     const dns_name_t *identity, dns_ssumatchtype_t matchtype,
		     const dns_name_t *name, unsigned int ntypes,
		     dns_ssuruletype_t *types);
/*%<
 *	Adds a new rule to a simple-secure-update rule table.  The rule
 *	either grants or denies update privileges of an identity (or set of
 *	identities) to modify a name (or set of names) or certain types present
 *	at that name.
 *
 *	Notes:
 *\li		If 'matchtype' is of SELF type, this rule only matches if the
 *              name to be updated matches the signing identity.
 *
 *\li		If 'ntypes' is 0, this rule applies to all types except
 *		NS, SOA, RRSIG, and NSEC.
 *
 *\li		If 'types' includes ANY, this rule applies to all types
 *		except NSEC.
 *
 *	Requires:
 *\li		'table' is a valid SSU table
 *\li		'identity' is a valid absolute name
 *\li		'matchtype' must be one of the defined constants.
 *\li		'name' is a valid absolute name
 *\li		If 'ntypes' > 0, 'types' must not be NULL
 *
 *	Returns:
 *\li		ISC_R_SUCCESS
 *\li		ISC_R_NOMEMORY
 */

bool
dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
			const dns_name_t *name, const isc_netaddr_t *addr,
			bool tcp, dns_aclenv_t *env, dns_rdatatype_t type,
			const dns_name_t *target, const dst_key_t *key,
			const dns_ssurule_t **rulep);
/*%<
 *	Checks that the attempted update of (name, type) is allowed according
 *	to the rules specified in the simple-secure-update rule table.  If
 *	no rules are matched, access is denied.
 *
 *	Notes:
 *		In dns_ssutable_checkrules(), 'addr' should only be
 *		set if the request received via TCP.  This provides a
 *		weak assurance that the request was not spoofed.
 *		'addr' is to to validate dns_ssumatchtype_tcpself
 *		and dns_ssumatchtype_6to4self rules.
 *
 *		In dns_ssutable_checkrules2(), 'addr' can also be passed for
 *		UDP requests and TCP is specified via the 'tcp' parameter.
 *		In addition to dns_ssumatchtype_tcpself and
 *		tcp_ssumatchtype_6to4self  rules, the address
 *		also be used to check dns_ssumatchtype_local rules.
 *		If 'addr' is set then 'env' must also be set so that
 *		requests from non-localhost addresses can be rejected.
 *
 *		For dns_ssumatchtype_tcpself the addresses are mapped to
 *		the standard reverse names under IN-ADDR.ARPA and IP6.ARPA.
 *		RFC 1035, Section 3.5, "IN-ADDR.ARPA domain" and RFC 3596,
 *		Section 2.5, "IP6.ARPA Domain".
 *
 *		For dns_ssumatchtype_6to4self, IPv4 address are converted
 *		to a 6to4 prefix (48 bits) per the rules in RFC 3056.  Only
 *		the top	48 bits of the IPv6 address are mapped to the reverse
 *		name. This is independent of whether the most significant 16
 *		bits match 2002::/16, assigned for 6to4 prefixes, or not.
 *
 *	Requires:
 *\li		'table' is a valid SSU table
 *\li		'signer' is NULL or a valid absolute name
 *\li		'addr' is NULL or a valid network address.
 *\li		'aclenv' is NULL or a valid ACL environment.
 *\li		'name' is a valid absolute name
 *\li		if 'addr' is not NULL, 'env' is not NULL.
 */

/*% Accessor functions to extract rule components */
bool
dns_ssurule_isgrant(const dns_ssurule_t *rule);

/*% Accessor functions to extract rule components */
dns_name_t *
dns_ssurule_identity(const dns_ssurule_t *rule);

/*% Accessor functions to extract rule components */
unsigned int
dns_ssurule_matchtype(const dns_ssurule_t *rule);

/*% Accessor functions to extract rule components */
dns_name_t *
dns_ssurule_name(const dns_ssurule_t *rule);

/*% Accessor functions to extract rule components */
unsigned int
dns_ssurule_types(const dns_ssurule_t *rule, dns_ssuruletype_t **types);

unsigned int
dns_ssurule_max(const dns_ssurule_t *rule, dns_rdatatype_t type);
/*%<
 * Returns the maximum number of records configured for type `type`.
 * If no maximum has been configured for `type` but one has been
 * configured for ANY, return that value instead. Otherwise, return
 * zero, which implies "unlimited".
 */

isc_result_t
dns_ssutable_firstrule(const dns_ssutable_t *table, dns_ssurule_t **rule);
/*%<
 * Initiates a rule iterator.  There is no need to maintain any state.
 *
 * Returns:
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOMORE
 */

isc_result_t
dns_ssutable_nextrule(dns_ssurule_t *rule, dns_ssurule_t **nextrule);
/*%<
 * Returns the next rule in the table.
 *
 * Returns:
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOMORE
 */

bool
dns_ssu_external_match(const dns_name_t *identity, const dns_name_t *signer,
		       const dns_name_t *name, const isc_netaddr_t *tcpaddr,
		       dns_rdatatype_t type, const dst_key_t *key,
		       isc_mem_t *mctx);
/*%<
 * Check a policy rule via an external application
 */

isc_result_t
dns_ssu_mtypefromstring(const char *str, dns_ssumatchtype_t *mtype);
/*%<
 * Set 'mtype' from 'str'
 *
 * Requires:
 *\li		'str' is not NULL.
 *\li		'mtype' is not NULL,
 *
 * Returns:
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOTFOUND
 */

ISC_LANG_ENDDECLS