60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <config.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <isc/magic.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <isc/mem.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <isc/netaddr.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <isc/result.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <isc/string.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <isc/util.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <dns/dlz.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <dns/fixedname.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <dns/name.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <dns/ssu.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User#include <dst/gssapi.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <dst/dst.h>

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define SSUTABLEMAGIC ISC_MAGIC('S', 'S', 'U', 'T')

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User#define VALID_SSUTABLE(table) ISC_MAGIC_VALID(table, SSUTABLEMAGIC)

a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User

11e9368a226272085c337e9e74b79808c16fbdbaTinderbox User#define SSURULEMAGIC ISC_MAGIC('S', 'S', 'U', 'R')

75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews#define VALID_SSURULE(table) ISC_MAGIC_VALID(table, SSURULEMAGIC)

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinstruct dns_ssurule {

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned int magic;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_boolean_t grant; /*%< is this a grant or a deny? */

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned int matchtype; /*%< which type of pattern match? */

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User dns_name_t *identity; /*%< the identity to match */

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_name_t *name; /*%< the name being updated */

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned int ntypes; /*%< number of data types covered */

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User dns_rdatatype_t *types; /*%< the data types. Can include ANY, */

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User /*%< defaults to all but SIG,SOA,NS if NULL */

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User ISC_LINK(dns_ssurule_t) link;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User};

010a51c427bfb6ab658fc0056955a1a5b69810beTinderbox User

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox Userstruct dns_ssutable {

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User unsigned int magic;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User isc_mem_t *mctx;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User unsigned int references;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User isc_mutex_t lock;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User dns_dlzdb_t *dlzdatabase;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ISC_LIST(dns_ssurule_t) rules;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein};

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox Userdns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **tablep) {

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User isc_result_t result;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User dns_ssutable_t *table;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User REQUIRE(tablep != NULL && *tablep == NULL);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein REQUIRE(mctx != NULL);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein table = isc_mem_get(mctx, sizeof(dns_ssutable_t));

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (table == NULL)

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein return (ISC_R_NOMEMORY);

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User result = isc_mutex_init(&table->lock);

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if (result != ISC_R_SUCCESS) {

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_mem_put(mctx, table, sizeof(dns_ssutable_t));

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User return (result);

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User }

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein table->references = 1;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User table->mctx = mctx;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User ISC_LIST_INIT(table->rules);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein table->magic = SSUTABLEMAGIC;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein *tablep = table;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein return (ISC_R_SUCCESS);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein}

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntstatic inline void

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntdestroy(dns_ssutable_t *table) {

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt isc_mem_t *mctx;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User REQUIRE(VALID_SSUTABLE(table));

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein mctx = table->mctx;

2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User while (!ISC_LIST_EMPTY(table->rules)) {

2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User dns_ssurule_t *rule = ISC_LIST_HEAD(table->rules);

2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User if (rule->identity != NULL) {

2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User dns_name_free(rule->identity, mctx);

2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User isc_mem_put(mctx, rule->identity, sizeof(dns_name_t));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein }

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if (rule->name != NULL) {

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User dns_name_free(rule->name, mctx);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt isc_mem_put(mctx, rule->name, sizeof(dns_name_t));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein }

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if (rule->types != NULL)

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User isc_mem_put(mctx, rule->types,

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->ntypes * sizeof(dns_rdatatype_t));

44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater ISC_LIST_UNLINK(table->rules, rule, link);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt rule->magic = 0;

6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater isc_mem_put(mctx, rule, sizeof(dns_ssurule_t));

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User }

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User DESTROYLOCK(&table->lock);

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User table->magic = 0;

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User isc_mem_put(mctx, table, sizeof(dns_ssutable_t));

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User}

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Userdns_ssutable_attach(dns_ssutable_t *source, dns_ssutable_t **targetp) {

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User REQUIRE(VALID_SSUTABLE(source));

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User REQUIRE(targetp != NULL && *targetp == NULL);

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User LOCK(&source->lock);

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater INSIST(source->references > 0);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt source->references++;

44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater INSIST(source->references != 0);

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User UNLOCK(&source->lock);

bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt *targetp = source;

bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User}

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Userdns_ssutable_detach(dns_ssutable_t **tablep) {

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User dns_ssutable_t *table;

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User isc_boolean_t done = ISC_FALSE;

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User REQUIRE(tablep != NULL);

44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater table = *tablep;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt REQUIRE(VALID_SSUTABLE(table));

44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User LOCK(&table->lock);

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User INSIST(table->references > 0);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (--table->references == 0)

bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User done = ISC_TRUE;

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User UNLOCK(&table->lock);

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User

983df82baf1d7d0b668c98cf45928a19f175c6e7Tinderbox User *tablep = NULL;

260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User

260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User if (done)

260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User destroy(table);

260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User}

260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox Userdns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,

983df82baf1d7d0b668c98cf45928a19f175c6e7Tinderbox User dns_name_t *identity, unsigned int matchtype,

260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User dns_name_t *name, unsigned int ntypes,

260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User dns_rdatatype_t *types)

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein{

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_ssurule_t *rule;

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews isc_mem_t *mctx;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_result_t result;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt REQUIRE(VALID_SSUTABLE(table));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein REQUIRE(dns_name_isabsolute(identity));

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews REQUIRE(dns_name_isabsolute(name));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein REQUIRE(matchtype <= DNS_SSUMATCHTYPE_MAX);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (matchtype == DNS_SSUMATCHTYPE_WILDCARD)

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein REQUIRE(dns_name_iswildcard(name));

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (ntypes > 0)

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User REQUIRE(types != NULL);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt mctx = table->mctx;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rule = isc_mem_get(mctx, sizeof(dns_ssurule_t));

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if (rule == NULL)

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt return (ISC_R_NOMEMORY);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->identity = NULL;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt rule->name = NULL;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rule->types = NULL;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->grant = grant;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->identity = isc_mem_get(mctx, sizeof(dns_name_t));

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if (rule->identity == NULL) {

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User result = ISC_R_NOMEMORY;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User goto failure;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User }

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User dns_name_init(rule->identity, NULL);

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User result = dns_name_dup(identity, mctx, rule->identity);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (result != ISC_R_SUCCESS)

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User goto failure;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rule->name = isc_mem_get(mctx, sizeof(dns_name_t));

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (rule->name == NULL) {

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt result = ISC_R_NOMEMORY;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein goto failure;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt }

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User dns_name_init(rule->name, NULL);

a1ad6695ed6f988406cf155aa26376f84f73bcb9Automatic Updater result = dns_name_dup(name, mctx, rule->name);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (result != ISC_R_SUCCESS)

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User goto failure;

2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->matchtype = matchtype;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rule->ntypes = ntypes;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (ntypes > 0) {

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->types = isc_mem_get(mctx,

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt ntypes * sizeof(dns_rdatatype_t));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (rule->types == NULL) {

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User result = ISC_R_NOMEMORY;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein goto failure;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User }

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memcpy(rule->types, types, ntypes * sizeof(dns_rdatatype_t));

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt } else

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->types = NULL;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User rule->magic = SSURULEMAGIC;

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User ISC_LIST_INITANDAPPEND(table->rules, rule, link);

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt return (ISC_R_SUCCESS);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt failure:

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (rule->identity != NULL) {

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if (dns_name_dynamic(rule->identity))

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt dns_name_free(rule->identity, mctx);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_mem_put(mctx, rule->identity, sizeof(dns_name_t));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein }

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews if (rule->name != NULL) {

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (dns_name_dynamic(rule->name))

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt dns_name_free(rule->name, mctx);

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User isc_mem_put(mctx, rule->name, sizeof(dns_name_t));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein }

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if (rule->types != NULL)

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User isc_mem_put(mctx, rule->types,

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ntypes * sizeof(dns_rdatatype_t));

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt isc_mem_put(mctx, rule, sizeof(dns_ssurule_t));

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein return (result);

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein}

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Userstatic inline isc_boolean_t

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Userisusertype(dns_rdatatype_t type) {

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User return (ISC_TF(type != dns_rdatatype_ns &&

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein type != dns_rdatatype_soa &&

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User type != dns_rdatatype_rrsig));

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt}

a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntstatic void

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntreverse_from_address(dns_name_t *tcpself, isc_netaddr_t *tcpaddr) {

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt char buf[16 * 4 + sizeof("IP6.ARPA.")];

a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User isc_result_t result;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt unsigned char *ap;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt isc_buffer_t b;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt unsigned long l;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt switch (tcpaddr->family) {

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt case AF_INET:

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt l = ntohl(tcpaddr->type.in.s_addr);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt result = isc_string_printf(buf, sizeof(buf),

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt "%lu.%lu.%lu.%lu.IN-ADDR.ARPA.",

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User (l >> 0) & 0xff, (l >> 8) & 0xff,

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User (l >> 16) & 0xff, (l >> 24) & 0xff);

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User RUNTIME_CHECK(result == ISC_R_SUCCESS);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt break;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt case AF_INET6:

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ap = tcpaddr->type.in6.s6_addr;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt result = isc_string_printf(buf, sizeof(buf),

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt "%x.%x.%x.%x.%x.%x.%x.%x."

af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User "%x.%x.%x.%x.%x.%x.%x.%x."

44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater "%x.%x.%x.%x.%x.%x.%x.%x."

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User "%x.%x.%x.%x.%x.%x.%x.%x."

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User "IP6.ARPA.",

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User ap[15] & 0x0f, (ap[15] >> 4) & 0x0f,

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt ap[14] & 0x0f, (ap[14] >> 4) & 0x0f,

44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater ap[13] & 0x0f, (ap[13] >> 4) & 0x0f,

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User ap[12] & 0x0f, (ap[12] >> 4) & 0x0f,

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User ap[11] & 0x0f, (ap[11] >> 4) & 0x0f,

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User ap[10] & 0x0f, (ap[10] >> 4) & 0x0f,

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User ap[9] & 0x0f, (ap[9] >> 4) & 0x0f,

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User ap[8] & 0x0f, (ap[8] >> 4) & 0x0f,

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User ap[7] & 0x0f, (ap[7] >> 4) & 0x0f,

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User ap[6] & 0x0f, (ap[6] >> 4) & 0x0f,

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ap[5] & 0x0f, (ap[5] >> 4) & 0x0f,

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ap[4] & 0x0f, (ap[4] >> 4) & 0x0f,

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User ap[3] & 0x0f, (ap[3] >> 4) & 0x0f,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews ap[2] & 0x0f, (ap[2] >> 4) & 0x0f,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews ap[1] & 0x0f, (ap[1] >> 4) & 0x0f,

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews ap[0] & 0x0f, (ap[0] >> 4) & 0x0f);

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews break;

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews default:

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews INSIST(0);

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews }

e108f2ec640e1acb54999c0ade58af606149956dTinderbox User isc_buffer_init(&b, buf, strlen(buf));

6d382c9fcec316a84a237779fb64bb471b6f9d43Tinderbox User isc_buffer_add(&b, strlen(buf));

6d382c9fcec316a84a237779fb64bb471b6f9d43Tinderbox User result = dns_name_fromtext(tcpself, &b, dns_rootname, 0, NULL);

dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User RUNTIME_CHECK(result == ISC_R_SUCCESS);

f9aef05653eeb454c489d5bd2bde6daab774ad4aTinderbox User}

f9aef05653eeb454c489d5bd2bde6daab774ad4aTinderbox User

f9aef05653eeb454c489d5bd2bde6daab774ad4aTinderbox Userstatic void

f9aef05653eeb454c489d5bd2bde6daab774ad4aTinderbox Userstf_from_address(dns_name_t *stfself, isc_netaddr_t *tcpaddr) {

f9aef05653eeb454c489d5bd2bde6daab774ad4aTinderbox User char buf[sizeof("X.X.X.X.Y.Y.Y.Y.2.0.0.2.IP6.ARPA.")];

922312472e2e05ebc64993d465999c5351b83036Automatic Updater isc_result_t result;

922312472e2e05ebc64993d465999c5351b83036Automatic Updater unsigned char *ap;

922312472e2e05ebc64993d465999c5351b83036Automatic Updater isc_buffer_t b;

dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User unsigned long l;

50066670817cdf9e86c832066d73715232b29680Tinderbox User

50066670817cdf9e86c832066d73715232b29680Tinderbox User switch(tcpaddr->family) {

28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater case AF_INET:

28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater l = ntohl(tcpaddr->type.in.s_addr);

28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater result = isc_string_printf(buf, sizeof(buf),

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews "%lx.%lx.%lx.%lx.%lx.%lx.%lx.%lx"

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews "2.0.0.2.IP6.ARPA.",

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews l & 0xf, (l >> 4) & 0xf,

dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User (l >> 8) & 0xf, (l >> 12) & 0xf,

2cbb4ab75757fbb656997a82c14ca07db37d481aAutomatic Updater (l >> 16) & 0xf, (l >> 20) & 0xf,

2cbb4ab75757fbb656997a82c14ca07db37d481aAutomatic Updater (l >> 24) & 0xf, (l >> 28) & 0xf);

dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User RUNTIME_CHECK(result == ISC_R_SUCCESS);

0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater break;

0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater case AF_INET6:

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews ap = tcpaddr->type.in6.s6_addr;

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews result = isc_string_printf(buf, sizeof(buf),

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews "%x.%x.%x.%x.%x.%x.%x.%x."

c3dc968140ab7f04795acc7835e4e89ccb0c0a27Tinderbox User "%x.%x.%x.%x.IP6.ARPA.",

c3dc968140ab7f04795acc7835e4e89ccb0c0a27Tinderbox User ap[5] & 0x0f, (ap[5] >> 4) & 0x0f,

c3dc968140ab7f04795acc7835e4e89ccb0c0a27Tinderbox User ap[4] & 0x0f, (ap[4] >> 4) & 0x0f,

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt ap[3] & 0x0f, (ap[3] >> 4) & 0x0f,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews ap[2] & 0x0f, (ap[2] >> 4) & 0x0f,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews ap[1] & 0x0f, (ap[1] >> 4) & 0x0f,

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt ap[0] & 0x0f, (ap[0] >> 4) & 0x0f);

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews break;

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt default:

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews INSIST(0);

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews }

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt isc_buffer_init(&b, buf, strlen(buf));

ad8f23aed6c75f94f238c1f23f4e17515d28eb55Tinderbox User isc_buffer_add(&b, strlen(buf));

ad8f23aed6c75f94f238c1f23f4e17515d28eb55Tinderbox User result = dns_name_fromtext(stfself, &b, dns_rootname, 0, NULL);

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt RUNTIME_CHECK(result == ISC_R_SUCCESS);

ad8f23aed6c75f94f238c1f23f4e17515d28eb55Tinderbox User}

ad8f23aed6c75f94f238c1f23f4e17515d28eb55Tinderbox User

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updaterdns_ssutable_checkrules(dns_ssutable_t *table, dns_name_t *signer,

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater dns_name_t *name, isc_netaddr_t *tcpaddr,

dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User dns_rdatatype_t type,

b6b8f8a0362da8c749021c4b6376cfb96047912bTinderbox User const dst_key_t *key)

b6b8f8a0362da8c749021c4b6376cfb96047912bTinderbox User{

0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater dns_ssurule_t *rule;

0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater unsigned int i;

0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater dns_fixedname_t fixed;

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews dns_name_t *wildcard;

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dns_name_t *tcpself;

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dns_name_t *stfself;

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews isc_result_t result;

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater REQUIRE(VALID_SSUTABLE(table));

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater REQUIRE(signer == NULL || dns_name_isabsolute(signer));

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater REQUIRE(dns_name_isabsolute(name));

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater if (signer == NULL && tcpaddr == NULL)

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater return (ISC_FALSE);

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater for (rule = ISC_LIST_HEAD(table->rules);

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater rule != NULL;

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater rule = ISC_LIST_NEXT(rule, link))

10b865e9187fc77cae02f106ddcc9e03eecdfe06Tinderbox User {

10b865e9187fc77cae02f106ddcc9e03eecdfe06Tinderbox User switch (rule->matchtype) {

10b865e9187fc77cae02f106ddcc9e03eecdfe06Tinderbox User case DNS_SSUMATCHTYPE_NAME:

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater case DNS_SSUMATCHTYPE_SUBDOMAIN:

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater case DNS_SSUMATCHTYPE_WILDCARD:

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater case DNS_SSUMATCHTYPE_SELF:

fdd80e9a55c70b36a3bf3e409b86897301c44ff8Automatic Updater case DNS_SSUMATCHTYPE_SELFSUB:

fdd80e9a55c70b36a3bf3e409b86897301c44ff8Automatic Updater case DNS_SSUMATCHTYPE_SELFWILD:

fdd80e9a55c70b36a3bf3e409b86897301c44ff8Automatic Updater if (signer == NULL)

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater continue;

e2e4d321999340802f77adaacd19c797d04b4b95Automatic Updater if (dns_name_iswildcard(rule->identity)) {

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews if (!dns_name_matcheswildcard(signer,

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rule->identity))

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein continue;

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User } else {

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (!dns_name_equal(signer, rule->identity))

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein continue;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein }

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein break;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein case DNS_SSUMATCHTYPE_SELFKRB5:

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein case DNS_SSUMATCHTYPE_SELFMS:

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein case DNS_SSUMATCHTYPE_SUBDOMAINKRB5:

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein case DNS_SSUMATCHTYPE_SUBDOMAINMS:

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (signer == NULL)

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein continue;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein break;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein case DNS_SSUMATCHTYPE_TCPSELF:

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein case DNS_SSUMATCHTYPE_6TO4SELF:

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (tcpaddr == NULL)

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein continue;

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein break;

a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User }

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein

60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein switch (rule->matchtype) {

case DNS_SSUMATCHTYPE_NAME:

if (!dns_name_equal(name, rule->name))

continue;

break;

case DNS_SSUMATCHTYPE_SUBDOMAIN:

if (!dns_name_issubdomain(name, rule->name))

continue;

break;

case DNS_SSUMATCHTYPE_WILDCARD:

if (!dns_name_matcheswildcard(name, rule->name))

continue;

break;

case DNS_SSUMATCHTYPE_SELF:

if (!dns_name_equal(signer, name))

continue;

break;

case DNS_SSUMATCHTYPE_SELFSUB:

if (!dns_name_issubdomain(name, signer))

continue;

break;

case DNS_SSUMATCHTYPE_SELFWILD:

dns_fixedname_init(&fixed);

wildcard = dns_fixedname_name(&fixed);

result = dns_name_concatenate(dns_wildcardname, signer,

wildcard, NULL);

if (result != ISC_R_SUCCESS)

continue;

if (!dns_name_matcheswildcard(name, wildcard))

continue;

break;

case DNS_SSUMATCHTYPE_SELFKRB5:

if (!dst_gssapi_identitymatchesrealmkrb5(signer, name,

rule->identity))

continue;

break;

case DNS_SSUMATCHTYPE_SELFMS:

if (!dst_gssapi_identitymatchesrealmms(signer, name,

rule->identity))

continue;

break;

case DNS_SSUMATCHTYPE_SUBDOMAINKRB5:

if (!dns_name_issubdomain(name, rule->name))

continue;

if (!dst_gssapi_identitymatchesrealmkrb5(signer, NULL,

rule->identity))

continue;

break;

case DNS_SSUMATCHTYPE_SUBDOMAINMS:

if (!dns_name_issubdomain(name, rule->name))

continue;

if (!dst_gssapi_identitymatchesrealmms(signer, NULL,

rule->identity))

continue;

break;

case DNS_SSUMATCHTYPE_TCPSELF:

dns_fixedname_init(&fixed);

tcpself = dns_fixedname_name(&fixed);

reverse_from_address(tcpself, tcpaddr);

if (dns_name_iswildcard(rule->identity)) {

if (!dns_name_matcheswildcard(tcpself,

rule->identity))

continue;

} else {

if (!dns_name_equal(tcpself, rule->identity))

continue;

}

if (!dns_name_equal(tcpself, name))

continue;

break;

case DNS_SSUMATCHTYPE_6TO4SELF:

dns_fixedname_init(&fixed);

stfself = dns_fixedname_name(&fixed);

stf_from_address(stfself, tcpaddr);

if (dns_name_iswildcard(rule->identity)) {

if (!dns_name_matcheswildcard(stfself,

rule->identity))

continue;

} else {

if (!dns_name_equal(stfself, rule->identity))

continue;

}

if (!dns_name_equal(stfself, name))

continue;

break;

case DNS_SSUMATCHTYPE_DLZ:

if (!dns_dlz_ssumatch(table->dlzdatabase, signer,

name, tcpaddr, type, key))

continue;

break;

}

if (rule->ntypes == 0) {

/*

if (rule->matchtype != DNS_SSUMATCHTYPE_DLZ &&

!isusertype(type))

continue;

} else {

for (i = 0; i < rule->ntypes; i++) {

if (rule->types[i] == dns_rdatatype_any ||

rule->types[i] == type)

break;

}

if (i == rule->ntypes)

continue;

}

return (rule->grant);

}

return (ISC_FALSE);

}

dns_ssurule_isgrant(const dns_ssurule_t *rule) {

REQUIRE(VALID_SSURULE(rule));

return (rule->grant);

}

dns_name_t *

dns_ssurule_identity(const dns_ssurule_t *rule) {

REQUIRE(VALID_SSURULE(rule));

return (rule->identity);

}

unsigned int

dns_ssurule_matchtype(const dns_ssurule_t *rule) {

REQUIRE(VALID_SSURULE(rule));

return (rule->matchtype);

}

dns_name_t *

dns_ssurule_name(const dns_ssurule_t *rule) {

REQUIRE(VALID_SSURULE(rule));

return (rule->name);

}

unsigned int

dns_ssurule_types(const dns_ssurule_t *rule, dns_rdatatype_t **types) {

REQUIRE(VALID_SSURULE(rule));

REQUIRE(types != NULL && *types != NULL);

*types = rule->types;

return (rule->ntypes);

}

dns_ssutable_firstrule(const dns_ssutable_t *table, dns_ssurule_t **rule) {

REQUIRE(VALID_SSUTABLE(table));

REQUIRE(rule != NULL && *rule == NULL);

*rule = ISC_LIST_HEAD(table->rules);

return (*rule != NULL ? ISC_R_SUCCESS : ISC_R_NOMORE);

}

dns_ssutable_nextrule(dns_ssurule_t *rule, dns_ssurule_t **nextrule) {

REQUIRE(VALID_SSURULE(rule));

REQUIRE(nextrule != NULL && *nextrule == NULL);

*nextrule = ISC_LIST_NEXT(rule, link);

return (*nextrule != NULL ? ISC_R_SUCCESS : ISC_R_NOMORE);

}

dns_ssutable_createdlz(isc_mem_t *mctx, dns_ssutable_t **tablep,

dns_dlzdb_t *dlzdatabase)

{

isc_result_t result;

dns_ssurule_t *rule;

dns_ssutable_t *table = NULL;

REQUIRE(tablep != NULL && *tablep == NULL);

result = dns_ssutable_create(mctx, &table);

if (result != ISC_R_SUCCESS)

return (result);

table->dlzdatabase = dlzdatabase;

rule = isc_mem_get(table->mctx, sizeof(dns_ssurule_t));

if (rule == NULL) {

dns_ssutable_detach(&table);

return (ISC_R_NOMEMORY);

}

rule->identity = NULL;

rule->name = NULL;

rule->types = NULL;

rule->grant = ISC_TRUE;

rule->matchtype = DNS_SSUMATCHTYPE_DLZ;

rule->ntypes = 0;

rule->types = NULL;

rule->magic = SSURULEMAGIC;

ISC_LIST_INITANDAPPEND(table->rules, rule, link);

*tablep = table;

return (ISC_R_SUCCESS);

}