/* * Copyright (C) Internet Systems Consortium, Inc. ("ISC") * * This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, you can obtain one at https://mozilla.org/MPL/2.0/. * * See the COPYRIGHT file distributed with this work for additional * information regarding copyright ownership. */ #ifndef DNS_DNS64_H #define DNS_DNS64_H 1 #include <stdbool.h> #include <isc/lang.h> #include <dns/types.h> ISC_LANG_BEGINDECLS /* * dns_dns64_create() flags. */ #define DNS_DNS64_RECURSIVE_ONLY \ 0x01 /* If set then this record \ * only applies to recursive \ * queries. \ */ #define DNS_DNS64_BREAK_DNSSEC \ 0x02 /* If set then still perform \ * DNSSEC synthesis even \ * though the result would \ * fail validation. \ */ /* * dns_dns64_aaaaok() and dns_dns64_aaaafroma() flags. */ #define DNS_DNS64_RECURSIVE 0x01 /* Recursive query. */ #define DNS_DNS64_DNSSEC 0x02 /* DNSSEC sensitive query. */ isc_result_t dns_dns64_create(isc_mem_t *mctx, const isc_netaddr_t *prefix, unsigned int prefixlen, const isc_netaddr_t *suffix, dns_acl_t *client, dns_acl_t *mapped, dns_acl_t *excluded, unsigned int flags, dns_dns64_t **dns64); /* * Create a dns64 record which is used to identify the set of clients * it applies to and how to perform the DNS64 synthesis. * * 'prefix' and 'prefixlen' defined the leading bits of the AAAA records * to be synthesised. 'suffix' defines the bits after the A records bits. * If suffix is NULL zeros will be used for these bits. 'client' defines * for which clients this record applies. If 'client' is NULL then all * clients apply. 'mapped' defines which A records are candidated for * mapping. If 'mapped' is NULL then all A records will be mapped. * 'excluded' defines which AAAA are to be treated as non-existent for the * purposed of determining whether to perform synthesis. If 'excluded' is * NULL then no AAAA records prevent synthesis. * * If DNS_DNS64_RECURSIVE_ONLY is set then the record will only match if * DNS_DNS64_RECURSIVE is set when calling dns_dns64_aaaaok() and * dns_dns64_aaaafroma(). * * If DNS_DNS64_BREAK_DNSSEC is set then the record will still apply if * DNS_DNS64_DNSSEC is set when calling dns_dns64_aaaaok() and * dns_dns64_aaaafroma() otherwise the record will be ignored. * * Requires: * 'mctx' to be valid. * 'prefix' to be valid and the address family to AF_INET6. * 'prefixlen' to be one of 32, 40, 48, 56, 72 and 96. * the bits not covered by prefixlen in prefix to * be zero. * 'suffix' to be NULL or the address family be set to AF_INET6 * and the leading 'prefixlen' + 32 bits of the 'suffix' * to be zero. If 'prefixlen' is 40, 48 or 56 then the * the leading 'prefixlen' + 40 bits of 'suffix' must be * zero. * 'client' to be NULL or a valid acl. * 'mapped' to be NULL or a valid acl. * 'excluded' to be NULL or a valid acl. * * Returns: * ISC_R_SUCCESS * ISC_R_NOMEMORY */ void dns_dns64_destroy(dns_dns64_t **dns64p); /* * Destroys a dns64 record. * * Requires the record to not be linked. */ isc_result_t dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner, const dns_aclenv_t *env, unsigned int flags, unsigned char *a, unsigned char *aaaa); /* * dns_dns64_aaaafroma() determines whether to perform a DNS64 address * synthesis from 'a' based on 'dns64', 'reqaddr', 'reqsigner', 'env', * 'flags' and 'aaaa'. If synthesis is performed then the result is * written to '*aaaa'. * * The synthesised address will be of the form: * * <prefix bits><a bits><suffix bits> * * If <a bits> straddle bits 64-71 of the AAAA record, then 8 zero bits will * be inserted at bits 64-71. * * Requires: * 'dns64' to be valid. * 'reqaddr' to be valid. * 'reqsigner' to be NULL or valid. * 'env' to be valid. * 'a' to point to a IPv4 address in network order. * 'aaaa' to point to a IPv6 address buffer in network order. * * Returns: * ISC_R_SUCCESS if synthesis was performed. * DNS_R_DISALLOWED if there is no match. */ dns_dns64_t * dns_dns64_next(dns_dns64_t *dns64); /* * Return the next dns64 record in the list. */ void dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64); /* * Append the dns64 record to the list. */ void dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64); /* * Unlink the dns64 record from the list. */ bool dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner, const dns_aclenv_t *env, unsigned int flags, dns_rdataset_t *rdataset, bool *aaaaok, size_t aaaaoklen); /* * Determine if there are any non-excluded AAAA records in from the * matching dns64 records in the list starting at 'dns64'. If there * is a non-excluded address return true. If all addresses are * excluded in the matched records return false. If no records * match then return true. * * If aaaaok is defined then dns_dns64_aaaaok() return a array of which * addresses in 'rdataset' were deemed to not be exclude by any matching * record. If there are no matching records then all entries are set * to true. * * Requires * 'rdataset' to be valid and to be for type AAAA and class IN. * 'aaaaoklen' must match the number of records in 'rdataset' * if 'aaaaok' in non NULL. */ ISC_LANG_ENDDECLS #endif /* DNS_DNS64_H */