Gecko [ naturenectar.co.uk ]

Name	Size	Permission	Date
acl.h	6.33 KB	-rw-r--r--	2021-11-05 09:03
adb.h	21.75 KB	-rw-r--r--	2021-11-05 09:03
badcache.h	3.31 KB	-rw-r--r--	2021-11-05 09:03
bit.h	798 B	-rw-r--r--	2021-11-05 09:03
byaddr.h	3.51 KB	-rw-r--r--	2021-11-05 09:03
cache.h	8.53 KB	-rw-r--r--	2025-07-29 21:41
callbacks.h	2.23 KB	-rw-r--r--	2021-11-05 09:03
catz.h	11.6 KB	-rw-r--r--	2021-11-05 09:03
cert.h	1.43 KB	-rw-r--r--	2021-11-05 09:03
client.h	14.19 KB	-rw-r--r--	2021-11-05 09:03
clientinfo.h	1.97 KB	-rw-r--r--	2021-11-05 09:03
compress.h	6.88 KB	-rw-r--r--	2021-11-05 09:03
db.h	49.26 KB	-rw-r--r--	2025-07-29 21:41
dbiterator.h	7.21 KB	-rw-r--r--	2021-11-05 09:03
dbtable.h	3.09 KB	-rw-r--r--	2021-11-05 09:03
diff.h	6.87 KB	-rw-r--r--	2021-11-05 09:03
dispatch.h	15.17 KB	-rw-r--r--	2021-11-05 09:03
dlz.h	10.62 KB	-rw-r--r--	2021-11-05 09:03
dlz_dlopen.h	4.29 KB	-rw-r--r--	2021-11-05 09:03
dns64.h	5.59 KB	-rw-r--r--	2021-11-05 09:03
dnsrps.h	2.51 KB	-rw-r--r--	2021-11-05 09:03
dnssec.h	12.29 KB	-rw-r--r--	2021-11-05 09:03
dnstap.h	9.95 KB	-rw-r--r--	2021-11-05 09:03
ds.h	1.63 KB	-rw-r--r--	2021-11-05 09:03
dsdigest.h	1.67 KB	-rw-r--r--	2021-11-05 09:03
dyndb.h	4.75 KB	-rw-r--r--	2021-11-05 09:03
ecdb.h	806 B	-rw-r--r--	2021-11-05 09:03
ecs.h	1.22 KB	-rw-r--r--	2021-11-05 09:03
edns.h	783 B	-rw-r--r--	2021-11-05 09:03
enumclass.h	1.19 KB	-rw-r--r--	2025-07-29 21:42
enumtype.h	8.29 KB	-rw-r--r--	2025-07-29 21:42
events.h	4.35 KB	-rw-r--r--	2021-11-05 09:03
fixedname.h	1.61 KB	-rw-r--r--	2021-11-05 09:03
forward.h	2.99 KB	-rw-r--r--	2021-11-05 09:03
geoip.h	2.29 KB	-rw-r--r--	2021-11-05 09:03
ipkeylist.h	2.17 KB	-rw-r--r--	2021-11-05 09:03
iptable.h	1.49 KB	-rw-r--r--	2021-11-05 09:03
journal.h	9.48 KB	-rw-r--r--	2021-11-05 09:03
kasp.h	11.84 KB	-rw-r--r--	2021-11-05 09:03
keydata.h	1.02 KB	-rw-r--r--	2021-11-05 09:03
keyflags.h	1.25 KB	-rw-r--r--	2021-11-05 09:03
keymgr.h	4.01 KB	-rw-r--r--	2021-11-05 09:03
keytable.h	7.69 KB	-rw-r--r--	2021-11-05 09:03
keyvalues.h	3.99 KB	-rw-r--r--	2021-11-05 09:03
lib.h	993 B	-rw-r--r--	2021-11-05 09:03
librpz.h	30.67 KB	-rw-r--r--	2021-11-05 09:03
lmdb.h	779 B	-rw-r--r--	2021-11-05 09:03
log.h	3.93 KB	-rw-r--r--	2021-11-05 09:03
lookup.h	2.85 KB	-rw-r--r--	2021-11-05 09:03
master.h	8.58 KB	-rw-r--r--	2021-11-05 09:03
masterdump.h	9.9 KB	-rw-r--r--	2021-11-05 09:03
message.h	38.41 KB	-rw-r--r--	2025-07-29 21:41
name.h	36.9 KB	-rw-r--r--	2025-07-29 21:41
ncache.h	4.84 KB	-rw-r--r--	2021-11-05 09:03
nsec.h	2.99 KB	-rw-r--r--	2021-11-05 09:03
nsec3.h	8.06 KB	-rw-r--r--	2021-11-05 09:03
nta.h	4.73 KB	-rw-r--r--	2021-11-05 09:03
opcode.h	1006 B	-rw-r--r--	2021-11-05 09:03
order.h	1.96 KB	-rw-r--r--	2021-11-05 09:03
peer.h	6.32 KB	-rw-r--r--	2021-11-05 09:03
portlist.h	2.05 KB	-rw-r--r--	2021-11-05 09:03
private.h	1.92 KB	-rw-r--r--	2021-11-05 09:03
rbt.h	36.61 KB	-rw-r--r--	2025-07-29 21:41
rcode.h	2.41 KB	-rw-r--r--	2021-11-05 09:03
rdata.h	22.04 KB	-rw-r--r--	2021-11-05 09:03
rdataclass.h	2.2 KB	-rw-r--r--	2021-11-05 09:03
rdatalist.h	2.5 KB	-rw-r--r--	2021-11-05 09:03
rdataset.h	18.28 KB	-rw-r--r--	2025-07-29 21:41
rdatasetiter.h	3.82 KB	-rw-r--r--	2021-11-05 09:03
rdataslab.h	4.14 KB	-rw-r--r--	2025-07-29 21:41
rdatastruct.h	61.23 KB	-rw-r--r--	2025-07-29 21:42
rdatatype.h	2.24 KB	-rw-r--r--	2021-11-05 09:03
request.h	8.97 KB	-rw-r--r--	2021-11-05 09:03
resolver.h	19.68 KB	-rw-r--r--	2021-11-05 09:03
result.h	8.98 KB	-rw-r--r--	2021-11-05 09:03
rootns.h	891 B	-rw-r--r--	2021-11-05 09:03
rpz.h	11.87 KB	-rw-r--r--	2021-11-05 09:03
rriterator.h	4.12 KB	-rw-r--r--	2021-11-05 09:03
rrl.h	6.8 KB	-rw-r--r--	2021-11-05 09:03
sdb.h	7.18 KB	-rw-r--r--	2021-11-05 09:03
sdlz.h	13.76 KB	-rw-r--r--	2021-11-05 09:03
secalg.h	1.67 KB	-rw-r--r--	2021-11-05 09:03
secproto.h	1.52 KB	-rw-r--r--	2021-11-05 09:03
soa.h	2.13 KB	-rw-r--r--	2021-11-05 09:03
ssu.h	7.01 KB	-rw-r--r--	2021-11-05 09:03
stats.h	24.11 KB	-rw-r--r--	2021-11-05 09:03
tcpmsg.h	3.05 KB	-rw-r--r--	2021-11-05 09:03
time.h	1.65 KB	-rw-r--r--	2021-11-05 09:03
timer.h	1.03 KB	-rw-r--r--	2021-11-05 09:03
tkey.h	7.48 KB	-rw-r--r--	2021-11-05 09:03
tsec.h	2.88 KB	-rw-r--r--	2021-11-05 09:03
tsig.h	8.3 KB	-rw-r--r--	2021-11-05 09:03
ttl.h	1.83 KB	-rw-r--r--	2021-11-05 09:03
types.h	14.19 KB	-rw-r--r--	2021-11-05 09:03
update.h	1.96 KB	-rw-r--r--	2021-11-05 09:03
validator.h	6.52 KB	-rw-r--r--	2025-07-29 21:41
version.h	679 B	-rw-r--r--	2021-11-05 09:03
view.h	34.51 KB	-rw-r--r--	2025-07-29 21:41
xfrin.h	2.26 KB	-rw-r--r--	2021-11-05 09:03
zone.h	64.01 KB	-rw-r--r--	2025-07-29 21:41
zonekey.h	776 B	-rw-r--r--	2021-11-05 09:03
zoneverify.h	1.36 KB	-rw-r--r--	2021-11-05 09:03
zt.h	5.12 KB	-rw-r--r--	2025-07-29 21:41

Rename

/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

#ifndef DNS_KEYTABLE_H
#define DNS_KEYTABLE_H 1

/*****
***** Module Info
*****/

/*! \file
 * \brief
 * The keytable module provides services for storing and retrieving DNSSEC
 * trusted keys, as well as the ability to find the deepest matching key
 * for a given domain name.
 *
 * MP:
 *\li	The module ensures appropriate synchronization of data structures it
 *	creates and manipulates.
 *
 * Resources:
 *\li	TBS
 *
 * Security:
 *\li	No anticipated impact.
 */

#include <stdbool.h>

#include <isc/lang.h>
#include <isc/magic.h>
#include <isc/refcount.h>
#include <isc/rwlock.h>
#include <isc/stdtime.h>

#include <dns/rdatastruct.h>
#include <dns/types.h>

#include <dst/dst.h>

ISC_LANG_BEGINDECLS

isc_result_t
dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep);
/*%<
 * Create a keytable.
 *
 * Requires:
 *
 *\li	'mctx' is a valid memory context.
 *
 *\li	keytablep != NULL && *keytablep == NULL
 *
 * Ensures:
 *
 *\li	On success, *keytablep is a valid, empty key table.
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *
 *\li	Any other result indicates failure.
 */

void
dns_keytable_attach(dns_keytable_t *source, dns_keytable_t **targetp);
/*%<
 * Attach *targetp to source.
 *
 * Requires:
 *
 *\li	'source' is a valid keytable.
 *
 *\li	'targetp' points to a NULL dns_keytable_t *.
 *
 * Ensures:
 *
 *\li	*targetp is attached to source.
 */

void
dns_keytable_detach(dns_keytable_t **keytablep);
/*%<
 * Detach *keytablep from its keytable.
 *
 * Requires:
 *
 *\li	'keytablep' points to a valid keytable.
 *
 * Ensures:
 *
 *\li	*keytablep is NULL.
 *
 *\li	If '*keytablep' is the last reference to the keytable,
 *		all resources used by the keytable will be freed
 */

isc_result_t
dns_keytable_add(dns_keytable_t *keytable, bool managed, bool initial,
		 dns_name_t *name, dns_rdata_ds_t *ds);
/*%<
 * Add a key to 'keytable'. The keynode associated with 'name'
 * is updated with the DS specified in 'ds'.
 *
 * The value of keynode->managed is set to 'managed', and the
 * value of keynode->initial is set to 'initial'. (Note: 'initial'
 * should only be used when adding managed-keys from configuration.
 * This indicates the key is in "initializing" state, and has not yet
 * been confirmed with a key refresh query.  Once a key refresh query
 * has validated, we update the keynode with initial == false.)
 *
 * Notes:
 *
 *\li   If the key already exists in the table, adding it again
 *      has no effect and ISC_R_SUCCESS is returned.
 *
 * Requires:
 *
 *\li	'keytable' points to a valid keytable.
 *\li	'ds' is not NULL.
 *\li	if 'initial' is true then 'managed' must also be true.
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *\li	ISC_R_EXISTS
 *
 *\li	Any other result indicates failure.
 */

isc_result_t
dns_keytable_marksecure(dns_keytable_t *keytable, const dns_name_t *name);
/*%<
 * Add a null key to 'keytable' for name 'name'.  This marks the
 * name as a secure domain, but doesn't supply any key data to allow the
 * domain to be validated.  (Used when automated trust anchor management
 * has gotten broken by a zone misconfiguration; for example, when the
 * active key has been revoked but the stand-by key was still in its 30-day
 * waiting period for validity.)
 *
 * Notes:
 *
 *\li   If a key already exists in the table, ISC_R_EXISTS is
 *      returned and nothing is done.
 *
 * Requires:
 *
 *\li	'keytable' points to a valid keytable.
 *
 *\li	keyp != NULL && *keyp is a valid dst_key_t *.
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *\li	ISC_R_EXISTS
 *
 *\li	Any other result indicates failure.
 */

isc_result_t
dns_keytable_delete(dns_keytable_t *keytable, const dns_name_t *keyname);
/*%<
 * Delete all trust anchors from 'keytable' matching name 'keyname'
 *
 * Requires:
 *
 *\li	'keytable' points to a valid keytable.
 *
 *\li	'name' is not NULL
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *
 *\li	Any other result indicates failure.
 */

isc_result_t
dns_keytable_deletekey(dns_keytable_t *keytable, const dns_name_t *keyname,
		       dns_rdata_dnskey_t *dnskey);
/*%<
 * Remove the trust anchor matching the name 'keyname' and the DNSKEY
 * rdata struct 'dnskey' from 'keytable'.
 *
 * Requires:
 *
 *\li	'keytable' points to a valid keytable.
 *\li	'dnskey' is not NULL
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *
 *\li	Any other result indicates failure.
 */

isc_result_t
dns_keytable_find(dns_keytable_t *keytable, const dns_name_t *keyname,
		  dns_keynode_t **keynodep);
/*%<
 * Search for the first instance of a trust anchor named 'name' in
 * 'keytable', without regard to keyid and algorithm.
 *
 * Requires:
 *
 *\li	'keytable' is a valid keytable.
 *
 *\li	'name' is a valid absolute name.
 *
 *\li	keynodep != NULL && *keynodep == NULL
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *\li	ISC_R_NOTFOUND
 *
 *\li	Any other result indicates an error.
 */

isc_result_t
dns_keytable_finddeepestmatch(dns_keytable_t *keytable, const dns_name_t *name,
			      dns_name_t *foundname);
/*%<
 * Search for the deepest match of 'name' in 'keytable'.
 *
 * Requires:
 *
 *\li	'keytable' is a valid keytable.
 *
 *\li	'name' is a valid absolute name.
 *
 *\li	'foundname' is a name with a dedicated buffer.
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *\li	ISC_R_NOTFOUND
 *
 *\li	Any other result indicates an error.
 */

void
dns_keytable_detachkeynode(dns_keytable_t *keytable, dns_keynode_t **keynodep);
/*%<
 * Detach a keynode found via dns_keytable_find().
 *
 * Requires:
 *
 *\li	*keynodep is a valid keynode returned by a call to dns_keytable_find().
 *
 * Ensures:
 *
 *\li	*keynodep == NULL
 */

isc_result_t
dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
			    dns_name_t *foundname, bool *wantdnssecp);
/*%<
 * Is 'name' at or beneath a trusted key?
 *
 * Requires:
 *
 *\li	'keytable' is a valid keytable.
 *
 *\li	'name' is a valid absolute name.
 *
 *\li	'foundanme' is NULL or is a pointer to an initialized dns_name_t
 *
 *\li	'*wantsdnssecp' is a valid bool.
 *
 * Ensures:
 *
 *\li	On success, *wantsdnssecp will be true if and only if 'name'
 *	is at or beneath a trusted key.  If 'foundname' is not NULL, then
 *	it will be updated to contain the name of the closest enclosing
 *	trust anchor.
 *
 * Returns:
 *
 *\li	ISC_R_SUCCESS
 *
 *\li	Any other result is an error.
 */

isc_result_t
dns_keytable_dump(dns_keytable_t *keytable, FILE *fp);
/*%<
 * Dump the keytable on fp.
 */

isc_result_t
dns_keytable_totext(dns_keytable_t *keytable, isc_buffer_t **buf);
/*%<
 * Dump the keytable to buffer at 'buf'
 */

bool
dns_keynode_dsset(dns_keynode_t *keynode, dns_rdataset_t *rdataset);
/*%<
 * Clone the DS RRset associated with 'keynode' into 'rdataset' if
 * it exists.  'dns_rdataset_disassociate(rdataset)' needs to be
 * called when done.
 *
 * Returns:
 *\li	true if there is a DS RRset.
 *\li	false if there isn't DS RRset.
 *
 * Requires:
 *\li	'keynode' is valid.
 *\li	'rdataset' is valid or NULL.
 */

bool
dns_keynode_managed(dns_keynode_t *keynode);
/*%<
 * Is this flagged as a managed key?
 */

bool
dns_keynode_initial(dns_keynode_t *keynode);
/*%<
 * Is this flagged as an initializing key?
 */

void
dns_keynode_trust(dns_keynode_t *keynode);
/*%<
 * Sets keynode->initial to false in order to mark the key as
 * trusted: no longer an initializing key.
 */

isc_result_t
dns_keytable_forall(dns_keytable_t *keytable,
		    void (*func)(dns_keytable_t *, dns_keynode_t *,
				 dns_name_t *, void *),
		    void *arg);
ISC_LANG_ENDDECLS

#endif /* DNS_KEYTABLE_H */