69fe9aaafdd6a141610e86a777d325db75422070Mark Andrews

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington#include <config.h>

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington#include <isc/magic.h>

99910383666b1942a64a9b76eb5b7c0c04b23162Andreas Gustafsson#include <isc/mem.h>

92f60809e854ccf5f115883c6347e370da048848Mark Andrews#include <isc/netaddr.h>

6e373c502584f9292e964378411d296c8259026bMark Andrews#include <isc/result.h>

92f60809e854ccf5f115883c6347e370da048848Mark Andrews#include <isc/string.h>

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington#include <isc/util.h>

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt#include <dns/dlz.h>

6e373c502584f9292e964378411d296c8259026bMark Andrews#include <dns/fixedname.h>

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington#include <dns/name.h>

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington#include <dns/ssu.h>

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews#include <dst/gssapi.h>

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt#include <dst/dst.h>

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews

92ef1a9b9dbd48ecb507b42ac62c15afefdaf838David Lawrence#define SSUTABLEMAGIC ISC_MAGIC('S', 'S', 'U', 'T')

92ef1a9b9dbd48ecb507b42ac62c15afefdaf838David Lawrence#define VALID_SSUTABLE(table) ISC_MAGIC_VALID(table, SSUTABLEMAGIC)

92ef1a9b9dbd48ecb507b42ac62c15afefdaf838David Lawrence

92ef1a9b9dbd48ecb507b42ac62c15afefdaf838David Lawrence#define SSURULEMAGIC ISC_MAGIC('S', 'S', 'U', 'R')

92ef1a9b9dbd48ecb507b42ac62c15afefdaf838David Lawrence#define VALID_SSURULE(table) ISC_MAGIC_VALID(table, SSURULEMAGIC)

71f5ad0517325eb32ecbee112206277c6277af87Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellingtonstruct dns_ssurule {

28fc90e6c81338c5f34e065fdda49d320e362583Mark Andrews unsigned int magic;

ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein isc_boolean_t grant; /*%< is this a grant or a deny? */

ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein unsigned int matchtype; /*%< which type of pattern match? */

ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein dns_name_t *identity; /*%< the identity to match */

ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein dns_name_t *name; /*%< the name being updated */

ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein unsigned int ntypes; /*%< number of data types covered */

ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein dns_rdatatype_t *types; /*%< the data types. Can include ANY, */

ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein /*%< defaults to all but SIG,SOA,NS if NULL */

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington ISC_LINK(dns_ssurule_t) link;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington};

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellingtonstruct dns_ssutable {

28fc90e6c81338c5f34e065fdda49d320e362583Mark Andrews unsigned int magic;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_t *mctx;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington unsigned int references;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington isc_mutex_t lock;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt dns_dlzdb_t *dlzdatabase;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington ISC_LIST(dns_ssurule_t) rules;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington};

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellingtondns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **tablep) {

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington isc_result_t result;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington dns_ssutable_t *table;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington REQUIRE(tablep != NULL && *tablep == NULL);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington REQUIRE(mctx != NULL);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington table = isc_mem_get(mctx, sizeof(dns_ssutable_t));

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington if (table == NULL)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (ISC_R_NOMEMORY);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington result = isc_mutex_init(&table->lock);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington if (result != ISC_R_SUCCESS) {

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington isc_mem_put(mctx, table, sizeof(dns_ssutable_t));

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington return (result);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington }

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington table->references = 1;

3a0da183bb40bd120698102b20b61ef12665c09bMark Andrews table->mctx = NULL;

3a0da183bb40bd120698102b20b61ef12665c09bMark Andrews isc_mem_attach(mctx, &table->mctx);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington ISC_LIST_INIT(table->rules);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington table->magic = SSUTABLEMAGIC;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington *tablep = table;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (ISC_R_SUCCESS);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington}

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellingtonstatic inline void

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellingtondestroy(dns_ssutable_t *table) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_t *mctx;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington REQUIRE(VALID_SSUTABLE(table));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington mctx = table->mctx;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington while (!ISC_LIST_EMPTY(table->rules)) {

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington dns_ssurule_t *rule = ISC_LIST_HEAD(table->rules);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->identity != NULL) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington dns_name_free(rule->identity, mctx);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule->identity, sizeof(dns_name_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->name != NULL) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington dns_name_free(rule->name, mctx);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule->name, sizeof(dns_name_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->types != NULL)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule->types,

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->ntypes * sizeof(dns_rdatatype_t));

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington ISC_LIST_UNLINK(table->rules, rule, link);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington rule->magic = 0;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule, sizeof(dns_ssurule_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

5e387b9ce6bafdfadedb5b34e4c33a4404e5d589Brian Wellington DESTROYLOCK(&table->lock);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington table->magic = 0;

3a0da183bb40bd120698102b20b61ef12665c09bMark Andrews isc_mem_putanddetach(&table->mctx, table, sizeof(dns_ssutable_t));

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington}

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellingtondns_ssutable_attach(dns_ssutable_t *source, dns_ssutable_t **targetp) {

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington REQUIRE(VALID_SSUTABLE(source));

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington REQUIRE(targetp != NULL && *targetp == NULL);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington LOCK(&source->lock);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington INSIST(source->references > 0);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington source->references++;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington INSIST(source->references != 0);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington UNLOCK(&source->lock);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington *targetp = source;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington}

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellingtondns_ssutable_detach(dns_ssutable_t **tablep) {

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington dns_ssutable_t *table;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington isc_boolean_t done = ISC_FALSE;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington REQUIRE(tablep != NULL);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington table = *tablep;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington REQUIRE(VALID_SSUTABLE(table));

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington LOCK(&table->lock);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington INSIST(table->references > 0);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington if (--table->references == 0)

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington done = ISC_TRUE;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington UNLOCK(&table->lock);

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington *tablep = NULL;

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington if (done)

6fcfd0c35d3fd6aea3d36ad002b68e59ac62fdc7Brian Wellington destroy(table);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington}

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellingtondns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington dns_name_t *identity, unsigned int matchtype,

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington dns_name_t *name, unsigned int ntypes,

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington dns_rdatatype_t *types)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington{

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington dns_ssurule_t *rule;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_t *mctx;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_result_t result;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington REQUIRE(VALID_SSUTABLE(table));

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington REQUIRE(dns_name_isabsolute(identity));

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington REQUIRE(dns_name_isabsolute(name));

6e373c502584f9292e964378411d296c8259026bMark Andrews REQUIRE(matchtype <= DNS_SSUMATCHTYPE_MAX);

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (matchtype == DNS_SSUMATCHTYPE_WILDCARD)

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington REQUIRE(dns_name_iswildcard(name));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (ntypes > 0)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington REQUIRE(types != NULL);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington mctx = table->mctx;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule = isc_mem_get(mctx, sizeof(dns_ssurule_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule == NULL)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (ISC_R_NOMEMORY);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->identity = NULL;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->name = NULL;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->types = NULL;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->grant = grant;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington rule->identity = isc_mem_get(mctx, sizeof(dns_name_t));

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (rule->identity == NULL) {

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington result = ISC_R_NOMEMORY;

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington goto failure;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington dns_name_init(rule->identity, NULL);

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington result = dns_name_dup(identity, mctx, rule->identity);

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (result != ISC_R_SUCCESS)

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington goto failure;

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington rule->name = isc_mem_get(mctx, sizeof(dns_name_t));

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (rule->name == NULL) {

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington result = ISC_R_NOMEMORY;

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington goto failure;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington dns_name_init(rule->name, NULL);

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington result = dns_name_dup(name, mctx, rule->name);

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (result != ISC_R_SUCCESS)

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington goto failure;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington rule->matchtype = matchtype;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->ntypes = ntypes;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (ntypes > 0) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->types = isc_mem_get(mctx,

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington ntypes * sizeof(dns_rdatatype_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->types == NULL) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington result = ISC_R_NOMEMORY;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington goto failure;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

e851ea826066ac5a5b01c2c23218faa0273a12e8Evan Hunt memmove(rule->types, types, ntypes * sizeof(dns_rdatatype_t));

6e373c502584f9292e964378411d296c8259026bMark Andrews } else

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->types = NULL;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington rule->magic = SSURULEMAGIC;

6fda1577669dca9e0d8e4832e407bac34cc12de6Mark Andrews ISC_LIST_INITANDAPPEND(table->rules, rule, link);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (ISC_R_SUCCESS);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington failure:

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->identity != NULL) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (dns_name_dynamic(rule->identity))

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington dns_name_free(rule->identity, mctx);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule->identity, sizeof(dns_name_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->name != NULL) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (dns_name_dynamic(rule->name))

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington dns_name_free(rule->name, mctx);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule->name, sizeof(dns_name_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->types != NULL)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule->types,

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington ntypes * sizeof(dns_rdatatype_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington isc_mem_put(mctx, rule, sizeof(dns_ssurule_t));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (result);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington}

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellingtonstatic inline isc_boolean_t

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellingtonisusertype(dns_rdatatype_t type) {

affa3155be811559c5c59c19cd8f16c91bc0a55fDavid Lawrence return (ISC_TF(type != dns_rdatatype_ns &&

affa3155be811559c5c59c19cd8f16c91bc0a55fDavid Lawrence type != dns_rdatatype_soa &&

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews type != dns_rdatatype_rrsig));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington}

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

92f60809e854ccf5f115883c6347e370da048848Mark Andrewsstatic void

92f60809e854ccf5f115883c6347e370da048848Mark Andrewsreverse_from_address(dns_name_t *tcpself, isc_netaddr_t *tcpaddr) {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews char buf[16 * 4 + sizeof("IP6.ARPA.")];

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_result_t result;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews unsigned char *ap;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_buffer_t b;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews unsigned long l;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews

92f60809e854ccf5f115883c6347e370da048848Mark Andrews switch (tcpaddr->family) {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case AF_INET:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews l = ntohl(tcpaddr->type.in.s_addr);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews result = isc_string_printf(buf, sizeof(buf),

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%lu.%lu.%lu.%lu.IN-ADDR.ARPA.",

92f60809e854ccf5f115883c6347e370da048848Mark Andrews (l >> 0) & 0xff, (l >> 8) & 0xff,

2f012d936b5ccdf6520c96a4de23721dc58a2221Automatic Updater (l >> 16) & 0xff, (l >> 24) & 0xff);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case AF_INET6:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap = tcpaddr->type.in6.s6_addr;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews result = isc_string_printf(buf, sizeof(buf),

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%x.%x.%x.%x.%x.%x.%x.%x."

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%x.%x.%x.%x.%x.%x.%x.%x."

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%x.%x.%x.%x.%x.%x.%x.%x."

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%x.%x.%x.%x.%x.%x.%x.%x."

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "IP6.ARPA.",

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[15] & 0x0f, (ap[15] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[14] & 0x0f, (ap[14] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[13] & 0x0f, (ap[13] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[12] & 0x0f, (ap[12] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[11] & 0x0f, (ap[11] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[10] & 0x0f, (ap[10] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[9] & 0x0f, (ap[9] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[8] & 0x0f, (ap[8] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[7] & 0x0f, (ap[7] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[6] & 0x0f, (ap[6] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[5] & 0x0f, (ap[5] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[4] & 0x0f, (ap[4] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[3] & 0x0f, (ap[3] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[2] & 0x0f, (ap[2] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[1] & 0x0f, (ap[1] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[0] & 0x0f, (ap[0] >> 4) & 0x0f);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews default:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews INSIST(0);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews }

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_buffer_init(&b, buf, strlen(buf));

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_buffer_add(&b, strlen(buf));

92f60809e854ccf5f115883c6347e370da048848Mark Andrews result = dns_name_fromtext(tcpself, &b, dns_rootname, 0, NULL);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews}

92f60809e854ccf5f115883c6347e370da048848Mark Andrews

92f60809e854ccf5f115883c6347e370da048848Mark Andrewsstatic void

92f60809e854ccf5f115883c6347e370da048848Mark Andrewsstf_from_address(dns_name_t *stfself, isc_netaddr_t *tcpaddr) {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews char buf[sizeof("X.X.X.X.Y.Y.Y.Y.2.0.0.2.IP6.ARPA.")];

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_result_t result;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews unsigned char *ap;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_buffer_t b;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews unsigned long l;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews

92f60809e854ccf5f115883c6347e370da048848Mark Andrews switch(tcpaddr->family) {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case AF_INET:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews l = ntohl(tcpaddr->type.in.s_addr);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews result = isc_string_printf(buf, sizeof(buf),

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%lx.%lx.%lx.%lx.%lx.%lx.%lx.%lx"

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "2.0.0.2.IP6.ARPA.",

92f60809e854ccf5f115883c6347e370da048848Mark Andrews l & 0xf, (l >> 4) & 0xf,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews (l >> 8) & 0xf, (l >> 12) & 0xf,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews (l >> 16) & 0xf, (l >> 20) & 0xf,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews (l >> 24) & 0xf, (l >> 28) & 0xf);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case AF_INET6:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap = tcpaddr->type.in6.s6_addr;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews result = isc_string_printf(buf, sizeof(buf),

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%x.%x.%x.%x.%x.%x.%x.%x."

92f60809e854ccf5f115883c6347e370da048848Mark Andrews "%x.%x.%x.%x.IP6.ARPA.",

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[5] & 0x0f, (ap[5] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[4] & 0x0f, (ap[4] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[3] & 0x0f, (ap[3] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[2] & 0x0f, (ap[2] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[1] & 0x0f, (ap[1] >> 4) & 0x0f,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews ap[0] & 0x0f, (ap[0] >> 4) & 0x0f);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews default:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews INSIST(0);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews }

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_buffer_init(&b, buf, strlen(buf));

92f60809e854ccf5f115883c6347e370da048848Mark Andrews isc_buffer_add(&b, strlen(buf));

92f60809e854ccf5f115883c6347e370da048848Mark Andrews result = dns_name_fromtext(stfself, &b, dns_rootname, 0, NULL);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews}

92f60809e854ccf5f115883c6347e370da048848Mark Andrews

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellingtondns_ssutable_checkrules(dns_ssutable_t *table, dns_name_t *signer,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt dns_name_t *name, isc_netaddr_t *addr,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt dns_rdatatype_t type, const dst_key_t *key)

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt{

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt return (dns_ssutable_checkrules2

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt (table, signer, name, addr,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt addr == NULL ? ISC_FALSE : ISC_TRUE,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt NULL, type, key));

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt}

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt

f592d2f76cac7115038124c510d2ba3050334b4dEvan Huntdns_ssutable_checkrules2(dns_ssutable_t *table, dns_name_t *signer,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt dns_name_t *name, isc_netaddr_t *addr,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt isc_boolean_t tcp, const dns_aclenv_t *env,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt dns_rdatatype_t type, const dst_key_t *key)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington{

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington dns_ssurule_t *rule;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington unsigned int i;

6e373c502584f9292e964378411d296c8259026bMark Andrews dns_fixedname_t fixed;

6e373c502584f9292e964378411d296c8259026bMark Andrews dns_name_t *wildcard;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews dns_name_t *tcpself;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews dns_name_t *stfself;

6e373c502584f9292e964378411d296c8259026bMark Andrews isc_result_t result;

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt int match;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington REQUIRE(VALID_SSUTABLE(table));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington REQUIRE(signer == NULL || dns_name_isabsolute(signer));

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington REQUIRE(dns_name_isabsolute(name));

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt REQUIRE(addr == NULL || env != NULL);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt if (signer == NULL && addr == NULL)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (ISC_FALSE);

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington for (rule = ISC_LIST_HEAD(table->rules);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule != NULL;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule = ISC_LIST_NEXT(rule, link))

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington {

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews switch (rule->matchtype) {

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_NAME:

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt case DNS_SSUMATCHTYPE_LOCAL:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SUBDOMAIN:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_WILDCARD:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELF:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELFSUB:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELFWILD:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (signer == NULL)

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (dns_name_iswildcard(rule->identity)) {

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dns_name_matcheswildcard(signer,

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews rule->identity))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews } else {

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dns_name_equal(signer, rule->identity))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews }

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_SELFKRB5:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_SELFMS:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_SUBDOMAINKRB5:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_SUBDOMAINMS:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (signer == NULL)

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_TCPSELF:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_6TO4SELF:

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt if (!tcp || addr == NULL)

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews }

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews switch (rule->matchtype) {

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_NAME:

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (!dns_name_equal(name, rule->name))

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SUBDOMAIN:

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (!dns_name_issubdomain(name, rule->name))

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt case DNS_SSUMATCHTYPE_LOCAL:

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt if (addr == NULL) {

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt continue;

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt }

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt if (!dns_name_issubdomain(name, rule->name)) {

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt continue;

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt }

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt dns_acl_match(addr, NULL, env->localhost,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt NULL, &match, NULL);

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt if (match == 0) {

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt if (signer != NULL) {

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt isc_log_write(dns_lctx,

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt DNS_LOGCATEGORY_GENERAL,

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt DNS_LOGMODULE_SSU,

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt ISC_LOG_WARNING,

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt "update-policy local: "

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt "match on session "

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt "key not from "

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt "localhost");

7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt }

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt continue;

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt }

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_WILDCARD:

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (!dns_name_matcheswildcard(name, rule->name))

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELF:

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington if (!dns_name_equal(signer, name))

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELFSUB:

6e373c502584f9292e964378411d296c8259026bMark Andrews if (!dns_name_issubdomain(name, signer))

6e373c502584f9292e964378411d296c8259026bMark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELFWILD:

6e373c502584f9292e964378411d296c8259026bMark Andrews dns_fixedname_init(&fixed);

6e373c502584f9292e964378411d296c8259026bMark Andrews wildcard = dns_fixedname_name(&fixed);

6e373c502584f9292e964378411d296c8259026bMark Andrews result = dns_name_concatenate(dns_wildcardname, signer,

6e373c502584f9292e964378411d296c8259026bMark Andrews wildcard, NULL);

6e373c502584f9292e964378411d296c8259026bMark Andrews if (result != ISC_R_SUCCESS)

6e373c502584f9292e964378411d296c8259026bMark Andrews continue;

6e373c502584f9292e964378411d296c8259026bMark Andrews if (!dns_name_matcheswildcard(name, wildcard))

6e373c502584f9292e964378411d296c8259026bMark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELFKRB5:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dst_gssapi_identitymatchesrealmkrb5(signer, name,

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews rule->identity))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SELFMS:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dst_gssapi_identitymatchesrealmms(signer, name,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews rule->identity))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SUBDOMAINKRB5:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dns_name_issubdomain(name, rule->name))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dst_gssapi_identitymatchesrealmkrb5(signer, NULL,

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews rule->identity))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews case DNS_SSUMATCHTYPE_SUBDOMAINMS:

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dns_name_issubdomain(name, rule->name))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews if (!dst_gssapi_identitymatchesrealmms(signer, NULL,

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews rule->identity))

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews continue;

289ae548d52bc8f982d9823af64cafda7bd92232Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_TCPSELF:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews dns_fixedname_init(&fixed);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews tcpself = dns_fixedname_name(&fixed);

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt reverse_from_address(tcpself, addr);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (dns_name_iswildcard(rule->identity)) {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (!dns_name_matcheswildcard(tcpself,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews rule->identity))

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews } else {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (!dns_name_equal(tcpself, rule->identity))

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews }

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (!dns_name_equal(tcpself, name))

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews case DNS_SSUMATCHTYPE_6TO4SELF:

92f60809e854ccf5f115883c6347e370da048848Mark Andrews dns_fixedname_init(&fixed);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews stfself = dns_fixedname_name(&fixed);

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt stf_from_address(stfself, addr);

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (dns_name_iswildcard(rule->identity)) {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (!dns_name_matcheswildcard(stfself,

92f60809e854ccf5f115883c6347e370da048848Mark Andrews rule->identity))

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews } else {

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (!dns_name_equal(stfself, rule->identity))

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews }

92f60809e854ccf5f115883c6347e370da048848Mark Andrews if (!dns_name_equal(stfself, name))

92f60809e854ccf5f115883c6347e370da048848Mark Andrews continue;

92f60809e854ccf5f115883c6347e370da048848Mark Andrews break;

3916872f379457fe344afb02398a009701c5016aEvan Hunt case DNS_SSUMATCHTYPE_EXTERNAL:

3916872f379457fe344afb02398a009701c5016aEvan Hunt if (!dns_ssu_external_match(rule->identity, signer,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt name, addr, type, key,

3916872f379457fe344afb02398a009701c5016aEvan Hunt table->mctx))

3916872f379457fe344afb02398a009701c5016aEvan Hunt continue;

3916872f379457fe344afb02398a009701c5016aEvan Hunt break;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt case DNS_SSUMATCHTYPE_DLZ:

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt if (!dns_dlz_ssumatch(table->dlzdatabase, signer,

f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt name, addr, type, key))

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt continue;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt break;

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington }

7dc1fe241043e47a6721fd841e2c52d3691379ebBrian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->ntypes == 0) {

ca103999e64da0b16bb8b30589408f1556264dceAutomatic Updater /*

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt if (rule->matchtype != DNS_SSUMATCHTYPE_DLZ &&

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt !isusertype(type))

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington continue;

6e373c502584f9292e964378411d296c8259026bMark Andrews } else {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington for (i = 0; i < rule->ntypes; i++) {

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (rule->types[i] == dns_rdatatype_any ||

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington rule->types[i] == type)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington break;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington if (i == rule->ntypes)

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington continue;

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (rule->grant);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington }

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington return (ISC_FALSE);

01d202be8fb07c010388eada31635e40ae3bffe5Brian Wellington}

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_ssurule_isgrant(const dns_ssurule_t *rule) {

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(VALID_SSURULE(rule));

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington return (rule->grant);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington}

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_name_t *

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_ssurule_identity(const dns_ssurule_t *rule) {

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(VALID_SSURULE(rule));

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington return (rule->identity);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington}

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtonunsigned int

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_ssurule_matchtype(const dns_ssurule_t *rule) {

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(VALID_SSURULE(rule));

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington return (rule->matchtype);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington}

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_name_t *

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_ssurule_name(const dns_ssurule_t *rule) {

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(VALID_SSURULE(rule));

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington return (rule->name);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington}

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtonunsigned int

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_ssurule_types(const dns_ssurule_t *rule, dns_rdatatype_t **types) {

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(VALID_SSURULE(rule));

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(types != NULL && *types != NULL);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington *types = rule->types;

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington return (rule->ntypes);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington}

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_ssutable_firstrule(const dns_ssutable_t *table, dns_ssurule_t **rule) {

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(VALID_SSUTABLE(table));

dc1961d96f9d116f77e0ac5e4a0b2bb5bb40328eJames Brister REQUIRE(rule != NULL && *rule == NULL);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington *rule = ISC_LIST_HEAD(table->rules);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington return (*rule != NULL ? ISC_R_SUCCESS : ISC_R_NOMORE);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington}

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellingtondns_ssutable_nextrule(dns_ssurule_t *rule, dns_ssurule_t **nextrule) {

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington REQUIRE(VALID_SSURULE(rule));

dc1961d96f9d116f77e0ac5e4a0b2bb5bb40328eJames Brister REQUIRE(nextrule != NULL && *nextrule == NULL);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington *nextrule = ISC_LIST_NEXT(rule, link);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington return (*nextrule != NULL ? ISC_R_SUCCESS : ISC_R_NOMORE);

2fabf91e5bfc718f274e19c5fa8844fdae90ae41Brian Wellington}

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Huntdns_ssutable_createdlz(isc_mem_t *mctx, dns_ssutable_t **tablep,

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt dns_dlzdb_t *dlzdatabase)

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt{

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt isc_result_t result;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt dns_ssurule_t *rule;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt dns_ssutable_t *table = NULL;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt REQUIRE(tablep != NULL && *tablep == NULL);

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt result = dns_ssutable_create(mctx, &table);

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt if (result != ISC_R_SUCCESS)

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt return (result);

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt table->dlzdatabase = dlzdatabase;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule = isc_mem_get(table->mctx, sizeof(dns_ssurule_t));

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt if (rule == NULL) {

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt dns_ssutable_detach(&table);

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt return (ISC_R_NOMEMORY);

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt }

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->identity = NULL;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->name = NULL;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->types = NULL;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->grant = ISC_TRUE;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->matchtype = DNS_SSUMATCHTYPE_DLZ;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->ntypes = 0;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->types = NULL;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt rule->magic = SSURULEMAGIC;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt ISC_LIST_INITANDAPPEND(table->rules, rule, link);

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt *tablep = table;

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt return (ISC_R_SUCCESS);

71bd858d8ed62672e7c23999dc7c02fd16a55089Evan Hunt}

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrewsdns_ssu_mtypefromstring(const char *str, dns_ssumatchtype_t *mtype) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews REQUIRE(str != NULL);

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews REQUIRE(mtype != NULL);

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews if (strcasecmp(str, "name") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_name;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "subdomain") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_subdomain;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "wildcard") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_wildcard;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "self") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_self;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "selfsub") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_selfsub;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "selfwild") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_selfwild;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "ms-self") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_selfms;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "krb5-self") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_selfkrb5;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "ms-subdomain") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_subdomainms;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "krb5-subdomain") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_subdomainkrb5;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "tcp-self") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_tcpself;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "6to4-self") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_6to4self;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "zonesub") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_subdomain;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else if (strcasecmp(str, "external") == 0) {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews *mtype = dns_ssumatchtype_external;

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews } else {

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews return (ISC_R_NOTFOUND);

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews }

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews return (ISC_R_SUCCESS);

8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews}