ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

add krb5-selfsub and ms-selfsub

Browse Source
This commit is contained in:
Mark Andrews
2018-08-30 18:31:17 +10:00
parent 5fb75a3d75
commit fbeefd4990
7 changed files with 132 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
lib/dns/ssu.c
View File

@@ -388,6 +388,8 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
break;
case dns_ssumatchtype_selfkrb5:
case dns_ssumatchtype_selfms:
case dns_ssumatchtype_selfsubkrb5:
case dns_ssumatchtype_selfsubms:
case dns_ssumatchtype_subdomainkrb5:
case dns_ssumatchtype_subdomainms:
if (signer == NULL)
@@ -457,29 +459,55 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
continue;
break;
case dns_ssumatchtype_selfkrb5:
if (!dst_gssapi_identitymatchesrealmkrb5(signer, name,
rule->identity))
continue;
break;
if (dst_gssapi_identitymatchesrealmkrb5(signer, name,
rule->identity,
false))
{
break;
}
continue;
case dns_ssumatchtype_selfms:
if (!dst_gssapi_identitymatchesrealmms(signer, name,
rule->identity))
continue;
break;
if (dst_gssapi_identitymatchesrealmms(signer, name,
rule->identity,
false))
{
break;
}
continue;
case dns_ssumatchtype_selfsubkrb5:
if (dst_gssapi_identitymatchesrealmkrb5(signer, name,
rule->identity,
true))
{
break;
}
continue;
case dns_ssumatchtype_selfsubms:
if (dst_gssapi_identitymatchesrealmms(signer, name,
rule->identity,
true))
break;
continue;
case dns_ssumatchtype_subdomainkrb5:
if (!dns_name_issubdomain(name, rule->name))
continue;
if (!dst_gssapi_identitymatchesrealmkrb5(signer, NULL,
rule->identity))
continue;
break;
if (dst_gssapi_identitymatchesrealmkrb5(signer, NULL,
rule->identity,
false))
{
break;
}
continue;
case dns_ssumatchtype_subdomainms:
if (!dns_name_issubdomain(name, rule->name))
continue;
if (!dst_gssapi_identitymatchesrealmms(signer, NULL,
rule->identity))
continue;
break;
if (dst_gssapi_identitymatchesrealmms(signer, NULL,
rule->identity,
false))
{
break;
}
continue;
case dns_ssumatchtype_tcpself:
tcpself = dns_fixedname_initname(&fixed);
reverse_from_address(tcpself, addr);
@@ -652,8 +680,12 @@ dns_ssu_mtypefromstring(const char *str, dns_ssumatchtype_t *mtype) {
*mtype = dns_ssumatchtype_selfwild;
} else if (strcasecmp(str, "ms-self") == 0) {
*mtype = dns_ssumatchtype_selfms;
} else if (strcasecmp(str, "ms-selfsub") == 0) {
*mtype = dns_ssumatchtype_selfsubms;
} else if (strcasecmp(str, "krb5-self") == 0) {
*mtype = dns_ssumatchtype_selfkrb5;
} else if (strcasecmp(str, "krb5-selfsub") == 0) {
*mtype = dns_ssumatchtype_selfsubkrb5;
} else if (strcasecmp(str, "ms-subdomain") == 0) {
*mtype = dns_ssumatchtype_subdomainms;
} else if (strcasecmp(str, "krb5-subdomain") == 0) {