ssu.h File Reference

Create an SSU table that contains a dlzdatabase pointer, and a single rule with matchtype DNS_SSUMATCHTYPE_DLZ. This type of SSU table is used by writeable DLZ drivers to offload authorization for updates to the driver.

Definition at line 580 of file ssu.c.

References dns_ssutable::dlzdatabase, DNS_SSUMATCHTYPE_DLZ, dns_ssutable_create(), dns_ssutable_detach(), dns_ssurule::grant, dns_ssurule::identity, ISC_LIST_INITANDAPPEND, isc_mem_get, ISC_R_NOMEMORY, ISC_R_SUCCESS, ISC_TRUE, dns_ssurule::magic, dns_ssurule::matchtype, dns_ssutable::mctx, dns_ssurule::name, dns_ssurule::ntypes, REQUIRE, SSURULEMAGIC, and dns_ssurule::types.

Referenced by dns_dlz_writeablezone().

void dns_ssutable_attach	(	dns_ssutable_t *	source,
		dns_ssutable_t **	targetp
	)

Attach '*targetp' to 'source'.

Requires:

'source' is a valid SSU table
'targetp' points to a NULL dns_ssutable_t *.

Ensures:

*targetp is attached to source.

Definition at line 123 of file ssu.c.

References INSIST, dns_ssutable::lock, LOCK, dns_ssutable::references, REQUIRE, UNLOCK, and VALID_SSUTABLE.

Referenced by dns_zone_getssutable(), and dns_zone_setssutable().

void dns_ssutable_detach ( dns_ssutable_t ** tablep )

Detach '*tablep' from its simple-secure-update rule table.

Requires:

'tablep' points to a valid dns_ssutable_t

Ensures:

*tablep is NULL
If '*tablep' is the last reference to the SSU table, all resources used by the table will be freed.

Definition at line 139 of file ssu.c.

References destroy(), INSIST, ISC_FALSE, ISC_TRUE, dns_ssutable::lock, LOCK, dns_ssutable::references, REQUIRE, UNLOCK, and VALID_SSUTABLE.

Referenced by configure_zone_ssutable(), dns_dlzdestroy(), dns_ssutable_createdlz(), dns_zone_setssutable(), update_action(), and zone_free().

isc_result_t dns_ssutable_addrule	(	dns_ssutable_t *	table,
		isc_boolean_t	grant,
		dns_name_t *	identity,
		unsigned int	matchtype,
		dns_name_t *	name,
		unsigned int	ntypes,
		dns_rdatatype_t *	types
	)

Adds a new rule to a simple-secure-update rule table. The rule either grants or denies update privileges of an identity (or set of identities) to modify a name (or set of names) or certain types present at that name.

Notes:

If 'matchtype' is of SELF type, this rule only matches if the name to be updated matches the signing identity.

If 'ntypes' is 0, this rule applies to all types except NS, SOA, RRSIG, and NSEC.

If 'types' includes ANY, this rule applies to all types except NSEC.

Requires:

'table' is a valid SSU table
'identity' is a valid absolute name
'matchtype' must be one of the defined constants.
'name' is a valid absolute name
If 'ntypes' > 0, 'types' must not be NULL

Returns:

ISC_R_SUCCESS
ISC_R_NOMEMORY

Definition at line 161 of file ssu.c.

References dns_name_dup(), dns_name_dynamic(), dns_name_free(), dns_name_init(), dns_name_isabsolute(), dns_name_iswildcard(), DNS_SSUMATCHTYPE_MAX, DNS_SSUMATCHTYPE_WILDCARD, dns_ssurule::grant, dns_ssurule::identity, ISC_LIST_INITANDAPPEND, isc_mem_get, isc_mem_put, ISC_R_NOMEMORY, ISC_R_SUCCESS, dns_ssurule::magic, dns_ssurule::matchtype, dns_ssutable::mctx, dns_ssurule::name, dns_ssurule::ntypes, REQUIRE, SSURULEMAGIC, dns_ssurule::types, and VALID_SSUTABLE.

Referenced by configure_zone_ssutable().

isc_boolean_t dns_ssutable_checkrules	(	dns_ssutable_t *	table,
		dns_name_t *	signer,
		dns_name_t *	name,
		isc_netaddr_t *	tcpaddr,
		dns_rdatatype_t	type,
		const dst_key_t *	key
	)

Checks that the attempted update of (name, type) is allowed according to the rules specified in the simple-secure-update rule table. If no rules are matched, access is denied.

Notes: 'tcpaddr' should only be set if the request received via TCP. This provides a weak assurance that the request was not spoofed. 'tcpaddr' is to to validate DNS_SSUMATCHTYPE_TCPSELF and DNS_SSUMATCHTYPE_6TO4SELF rules.

For DNS_SSUMATCHTYPE_TCPSELF the addresses are mapped to the standard reverse names under IN-ADDR.ARPA and IP6.ARPA. RFC 1035, Section 3.5, "IN-ADDR.ARPA domain" and RFC 3596, Section 2.5, "IP6.ARPA Domain".

For DNS_SSUMATCHTYPE_6TO4SELF, IPv4 address are converted to a 6to4 prefix (48 bits) per the rules in RFC 3056. Only the top 48 bits of the IPv6 address are mapped to the reverse name. This is independent of whether the most significant 16 bits match 2002::/16, assigned for 6to4 prefixes, or not.

Requires:

'table' is a valid SSU table
'signer' is NULL or a valid absolute name
'tcpaddr' is NULL or a valid network address.
'name' is a valid absolute name

Definition at line 350 of file ssu.c.

References dns_ssutable::dlzdatabase, dns_dlz_ssumatch(), dns_fixedname_init, dns_fixedname_name, dns_name_concatenate(), dns_name_equal(), dns_name_isabsolute(), dns_name_issubdomain(), dns_name_iswildcard(), dns_name_matcheswildcard(), dns_ssu_external_match(), DNS_SSUMATCHTYPE_6TO4SELF, DNS_SSUMATCHTYPE_DLZ, DNS_SSUMATCHTYPE_EXTERNAL, DNS_SSUMATCHTYPE_NAME, DNS_SSUMATCHTYPE_SELF, DNS_SSUMATCHTYPE_SELFKRB5, DNS_SSUMATCHTYPE_SELFMS, DNS_SSUMATCHTYPE_SELFSUB, DNS_SSUMATCHTYPE_SELFWILD, DNS_SSUMATCHTYPE_SUBDOMAIN, DNS_SSUMATCHTYPE_SUBDOMAINKRB5, DNS_SSUMATCHTYPE_SUBDOMAINMS, DNS_SSUMATCHTYPE_TCPSELF, DNS_SSUMATCHTYPE_WILDCARD, dns_wildcardname, dst_gssapi_identitymatchesrealmkrb5(), dst_gssapi_identitymatchesrealmms(), fixed, dns_ssurule::grant, dns_ssurule::identity, ISC_FALSE, ISC_LIST_HEAD, ISC_LIST_NEXT, ISC_R_SUCCESS, isusertype(), dns_ssurule::matchtype, dns_ssutable::mctx, dns_ssurule::name, dns_ssurule::ntypes, REQUIRE, reverse_from_address(), stf_from_address(), dns_ssurule::types, and VALID_SSUTABLE.

Referenced by ssu_checkrule(), and update_action().

isc_boolean_t dns_ssurule_isgrant ( const dns_ssurule_t * rule )