2 * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
18 /* $Id: ssu.h,v 1.13.18.4 2006/02/16 23:51:32 marka Exp $ */
27 #include <dns/types.h>
31 #define DNS_SSUMATCHTYPE_NAME 0
32 #define DNS_SSUMATCHTYPE_SUBDOMAIN 1
33 #define DNS_SSUMATCHTYPE_WILDCARD 2
34 #define DNS_SSUMATCHTYPE_SELF 3
35 #define DNS_SSUMATCHTYPE_SELFSUB 4
36 #define DNS_SSUMATCHTYPE_SELFWILD 5
37 #define DNS_SSUMATCHTYPE_MAX 5 /* maximum defined value */
41 dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **table);
43 * Creates a table that will be used to store simple-secure-update rules.
44 * Note: all locking must be provided by the client.
47 *\li 'mctx' is a valid memory context
48 *\li 'table' is not NULL, and '*table' is NULL
56 dns_ssutable_attach(dns_ssutable_t *source, dns_ssutable_t **targetp);
58 * Attach '*targetp' to 'source'.
61 *\li 'source' is a valid SSU table
62 *\li 'targetp' points to a NULL dns_ssutable_t *.
65 *\li *targetp is attached to source.
69 dns_ssutable_detach(dns_ssutable_t **tablep);
71 * Detach '*tablep' from its simple-secure-update rule table.
74 *\li 'tablep' points to a valid dns_ssutable_t
78 *\li If '*tablep' is the last reference to the SSU table, all
79 * resources used by the table will be freed.
83 dns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,
84 dns_name_t *identity, unsigned int matchtype,
85 dns_name_t *name, unsigned int ntypes,
86 dns_rdatatype_t *types);
88 * Adds a new rule to a simple-secure-update rule table. The rule
89 * either grants or denies update privileges of an identity (or set of
90 * identities) to modify a name (or set of names) or certain types present
94 *\li If 'matchtype' is SELF, this rule only matches if the name
95 * to be updated matches the signing identity.
97 *\li If 'ntypes' is 0, this rule applies to all types except
98 * NS, SOA, RRSIG, and NSEC.
100 *\li If 'types' includes ANY, this rule applies to all types
104 *\li 'table' is a valid SSU table
105 *\li 'identity' is a valid absolute name
106 *\li 'matchtype' must be one of the defined constants.
107 *\li 'name' is a valid absolute name
108 *\li If 'ntypes' > 0, 'types' must not be NULL
116 dns_ssutable_checkrules(dns_ssutable_t *table, dns_name_t *signer,
117 dns_name_t *name, dns_rdatatype_t type);
119 * Checks that the attempted update of (name, type) is allowed according
120 * to the rules specified in the simple-secure-update rule table. If
121 * no rules are matched, access is denied. If signer is NULL, access
125 *\li 'table' is a valid SSU table
126 *\li 'signer' is NULL or a valid absolute name
127 *\li 'name' is a valid absolute name
131 /*% Accessor functions to extract rule components */
132 isc_boolean_t dns_ssurule_isgrant(const dns_ssurule_t *rule);
133 /*% Accessor functions to extract rule components */
134 dns_name_t * dns_ssurule_identity(const dns_ssurule_t *rule);
135 /*% Accessor functions to extract rule components */
136 unsigned int dns_ssurule_matchtype(const dns_ssurule_t *rule);
137 /*% Accessor functions to extract rule components */
138 dns_name_t * dns_ssurule_name(const dns_ssurule_t *rule);
139 /*% Accessor functions to extract rule components */
140 unsigned int dns_ssurule_types(const dns_ssurule_t *rule,
141 dns_rdatatype_t **types);
143 isc_result_t dns_ssutable_firstrule(const dns_ssutable_t *table,
144 dns_ssurule_t **rule);
146 * Initiates a rule iterator. There is no need to maintain any state.
153 isc_result_t dns_ssutable_nextrule(dns_ssurule_t *rule,
154 dns_ssurule_t **nextrule);
156 * Returns the next rule in the table.
165 #endif /* DNS_SSU_H */