1/*
2 * Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
3 *
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
10 * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
11 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
12 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
13 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
14 * PERFORMANCE OF THIS SOFTWARE.
15 */
16
17/* $Id: dns64.h,v 1.3 2010/12/08 23:51:56 tbox Exp $ */
18
19#ifndef DNS_DNS64_H
20#define DNS_DNS64_H 1
21
22#include <isc/lang.h>
23
24#include <dns/types.h>
25
26ISC_LANG_BEGINDECLS
27
28/*
29 * dns_dns64_create() flags.
30 */
31#define DNS_DNS64_RECURSIVE_ONLY	0x01	/* If set then this record
32						 * only applies to recursive
33						 * queries.
34						 */
35#define DNS_DNS64_BREAK_DNSSEC		0x02	/* If set then still perform
36						 * DNSSEC synthesis even
37						 * though the result would
38						 * fail validation.
39						 */
40
41/*
42 * dns_dns64_aaaaok() and dns_dns64_aaaafroma() flags.
43 */
44#define DNS_DNS64_RECURSIVE		0x01	/* Recursive query. */
45#define DNS_DNS64_DNSSEC		0x02	/* DNSSEC sensitive query. */
46
47isc_result_t
48dns_dns64_create(isc_mem_t *mctx, isc_netaddr_t *prefix,
49		 unsigned int prefixlen, isc_netaddr_t *suffix,
50		 dns_acl_t *client, dns_acl_t *mapped, dns_acl_t *excluded,
51		 unsigned int flags, dns_dns64_t **dns64);
52/*
53 * Create a dns64 record which is used to identify the set of clients
54 * it applies to and how to perform the DNS64 synthesis.
55 *
56 * 'prefix' and 'prefixlen' defined the leading bits of the AAAA records
57 * to be synthesised.  'suffix' defines the bits after the A records bits.
58 * If suffix is NULL zeros will be used for these bits.  'client' defines
59 * for which clients this record applies.  If 'client' is NULL then all
60 * clients apply.  'mapped' defines which A records are candidated for
61 * mapping.  If 'mapped' is NULL then all A records will be mapped.
62 * 'excluded' defines which AAAA are to be treated as non-existent for the
63 * purposed of determining whether to perform syntesis.  If 'excluded' is
64 * NULL then no AAAA records prevent synthesis.
65 *
66 * If DNS_DNS64_RECURSIVE_ONLY is set then the record will only match if
67 * DNS_DNS64_RECURSIVE is set when calling  dns_dns64_aaaaok() and
68 * dns_dns64_aaaafroma().
69 *
70 * If DNS_DNS64_BREAK_DNSSEC is set then the record will still apply if
71 * DNS_DNS64_DNSSEC is set when calling  dns_dns64_aaaaok() and
72 * dns_dns64_aaaafroma() otherwise the record will be ignored.
73 *
74 * Requires:
75 *      'mctx'          to be valid.
76 *      'prefix'        to be valid and the address family to AF_INET6.
77 *      'prefixlen'     to be one of 32, 40, 48, 56, 72 and 96.
78 *                      the bits not covered by prefixlen in prefix to
79 *                      be zero.
80 *      'suffix'        to be NULL or the address family be set to AF_INET6
81 *                      and the leading 'prefixlen' + 32 bits of the 'suffix'
82 *                      to be zero.  If 'prefixlen' is 40, 48 or 56 then the
83 *                      the leading 'prefixlen' + 40 bits of 'suffix' must be
84 *                      zero.
85 *	'client'	to be NULL or a valid acl.
86 *	'mapped'	to be NULL or a valid acl.
87 *	'exculded'	to be NULL or a valid acl.
88 *
89 * Returns:
90 *	ISC_R_SUCCESS
91 *	ISC_R_NOMEMORY
92 */
93
94void
95dns_dns64_destroy(dns_dns64_t **dns64p);
96/*
97 * Destroys a dns64 record.
98 *
99 * Requires the record to not be linked.
100 */
101
102isc_result_t
103dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
104		    const dns_name_t *reqsigner, const dns_aclenv_t *env,
105		    unsigned int flags, unsigned char *a, unsigned char *aaaa);
106/*
107 * dns_dns64_aaaafroma() determines whether to perform a DNS64 address
108 * synthesis from 'a' based on 'dns64', 'reqaddr', 'reqsigner', 'env',
109 * 'flags' and 'aaaa'.  If synthesis is performed then the result is
110 * written to '*aaaa'.
111 *
112 * The synthesised address will be of the form:
113 *
114 *	 <prefix bits><a bits><suffix bits>
115 *
116 * If <a bits> straddle bits 64-71 of the AAAA record, then 8 zero bits will
117 * be inserted at bits 64-71.
118 *
119 * Requires:
120 *	'dns64'		to be valid.
121 *	'reqaddr'	to be valid.
122 *	'reqsigner'	to be NULL or valid.
123 *	'env'		to be valid.
124 *	'a'		to point to a IPv4 address in network order.
125 *	'aaaa'		to point to a IPv6 address buffer in network order.
126 *
127 * Returns:
128 *	ISC_R_SUCCESS		if synthesis was performed.
129 *	DNS_R_DISALLOWED	if there is no match.
130 */
131
132dns_dns64_t *
133dns_dns64_next(dns_dns64_t *dns64);
134/*
135 * Return the next dns64 record in the list.
136 */
137
138void
139dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64);
140/*
141 * Append the dns64 record to the list.
142 */
143
144void
145dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64);
146/*
147 * Unlink the dns64 record from the list.
148 */
149
150isc_boolean_t
151dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
152		 const dns_name_t *reqsigner, const dns_aclenv_t *env,
153		 unsigned int flags, dns_rdataset_t *rdataset,
154		 isc_boolean_t *aaaaok, size_t aaaaoklen);
155/*
156 * Determine if there are any non-excluded AAAA records in from the
157 * matching dns64 records in the list starting at 'dns64'.  If there
158 * is a non-exluded address return ISC_TRUE.  If all addresses are
159 * excluded in the matched records return ISC_FALSE.   If no records
160 * match then return ISC_TRUE.
161 *
162 * If aaaaok is defined then dns_dns64_aaaaok() return a array of which
163 * addresses in 'rdataset' were deemed to not be exclude by any matching
164 * record.  If there are no matching records then all entries are set
165 * to ISC_TRUE.
166 *
167 * Requires
168 * 	'rdataset'	to be valid and to be for type AAAA and class IN.
169 *	'aaaaoklen'	must match the number of records in 'rdataset'
170 *			if 'aaaaok' in non NULL.
171 */
172
173ISC_LANG_ENDDECLS
174
175#endif /* DNS_DNS64_H */
176