dane.h
Go to the documentation of this file.
/*
* dane.h -- defines for the DNS-Based Authentication of Named Entities (DANE)
* Transport Layer Security (TLS) Protocol: TLSA
*
* Copyright (c) 2012, NLnet Labs. All rights reserved.
*
* See LICENSE for the license.
*
*/
#ifndef LDNS_DANE_H
#define LDNS_DANE_H
#include <ldns/common.h>
#include <ldns/rdata.h>
#include <ldns/rr.h>
#if LDNS_BUILD_CONFIG_HAVE_SSL
#include <openssl/ssl.h>
#include <openssl/err.h>
#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
#ifdef __cplusplus
extern "C" {
#endif
enum ldns_enum_tlsa_certificate_usage
{
LDNS_TLSA_USAGE_PKIX_TA = 0,
LDNS_TLSA_USAGE_CA_CONSTRAINT = 0,
LDNS_TLSA_USAGE_PKIX_EE = 1,
LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT = 1,
LDNS_TLSA_USAGE_DANE_TA = 2,
LDNS_TLSA_USAGE_TRUST_ANCHOR_ASSERTION = 2,
LDNS_TLSA_USAGE_DANE_EE = 3,
LDNS_TLSA_USAGE_DOMAIN_ISSUED_CERTIFICATE = 3,
LDNS_TLSA_USAGE_PRIVCERT = 255
};
typedef enum ldns_enum_tlsa_certificate_usage ldns_tlsa_certificate_usage;
enum ldns_enum_tlsa_selector
{
LDNS_TLSA_SELECTOR_CERT = 0,
LDNS_TLSA_SELECTOR_FULL_CERTIFICATE = 0,
LDNS_TLSA_SELECTOR_SPKI = 1,
LDNS_TLSA_SELECTOR_SUBJECTPUBLICKEYINFO = 1,
LDNS_TLSA_SELECTOR_PRIVSEL = 255
};
typedef enum ldns_enum_tlsa_selector ldns_tlsa_selector;
enum ldns_enum_tlsa_matching_type
{
LDNS_TLSA_MATCHING_TYPE_FULL = 0,
LDNS_TLSA_MATCHING_TYPE_NO_HASH_USED = 0,
LDNS_TLSA_MATCHING_TYPE_SHA2_256 = 1,
LDNS_TLSA_MATCHING_TYPE_SHA256 = 1,
LDNS_TLSA_MATCHING_TYPE_SHA2_512 = 2,
LDNS_TLSA_MATCHING_TYPE_SHA512 = 2,
LDNS_TLSA_MATCHING_TYPE_PRIVMATCH = 255
};
typedef enum ldns_enum_tlsa_matching_type ldns_tlsa_matching_type;
enum ldns_enum_dane_transport
{
LDNS_DANE_TRANSPORT_TCP = 0,
LDNS_DANE_TRANSPORT_UDP = 1,
LDNS_DANE_TRANSPORT_SCTP = 2
};
typedef enum ldns_enum_dane_transport ldns_dane_transport;
#if LDNS_BUILD_CONFIG_USE_DANE
ldns_status ldns_dane_create_tlsa_owner(ldns_rdf** tlsa_owner,
const ldns_rdf* name, uint16_t port,
ldns_dane_transport transport);
#if LDNS_BUILD_CONFIG_HAVE_SSL
ldns_status ldns_dane_cert2rdf(ldns_rdf** rdf, X509* cert,
ldns_tlsa_selector selector,
ldns_tlsa_matching_type matching_type);
ldns_status ldns_dane_select_certificate(X509** selected_cert,
X509* cert, STACK_OF(X509)* extra_certs,
X509_STORE* pkix_validation_store,
ldns_tlsa_certificate_usage cert_usage, int index);
ldns_status ldns_dane_create_tlsa_rr(ldns_rr** tlsa,
ldns_tlsa_certificate_usage certificate_usage,
ldns_tlsa_selector selector,
ldns_tlsa_matching_type matching_type,
X509* cert);
ldns_status ldns_dane_verify_rr(const ldns_rr* tlsa_rr,
X509* cert, STACK_OF(X509)* extra_certs,
X509_STORE* pkix_validation_store);
ldns_status ldns_dane_verify(const ldns_rr_list* tlsas,
X509* cert, STACK_OF(X509)* extra_certs,
X509_STORE* pkix_validation_store);
#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
#endif /* LDNS_BUILD_CONFIG_USE_DANE */
#ifdef __cplusplus
}
#endif
#endif /* LDNS_DANE_H */
common.h
Common definitions for LDNS.
ldns_enum_tlsa_selector
ldns_enum_tlsa_selector
The different "Selector" rdata field values for a TLSA RR.
Definition dane.h:64
LDNS_TLSA_SELECTOR_PRIVSEL
@ LDNS_TLSA_SELECTOR_PRIVSEL
Reserved for Private Use.
Definition dane.h:80
LDNS_TLSA_SELECTOR_SPKI
@ LDNS_TLSA_SELECTOR_SPKI
SubjectPublicKeyInfo: DER-encoded binary structure as defined in [RFC5280].
Definition dane.h:76
LDNS_TLSA_SELECTOR_SUBJECTPUBLICKEYINFO
@ LDNS_TLSA_SELECTOR_SUBJECTPUBLICKEYINFO
Definition dane.h:77
LDNS_TLSA_SELECTOR_FULL_CERTIFICATE
@ LDNS_TLSA_SELECTOR_FULL_CERTIFICATE
Definition dane.h:70
LDNS_TLSA_SELECTOR_CERT
@ LDNS_TLSA_SELECTOR_CERT
Full certificate: the Certificate binary structure as defined in [RFC5280].
Definition dane.h:69
ldns_dane_cert2rdf
ldns_status ldns_dane_cert2rdf(ldns_rdf **rdf, X509 *cert, ldns_tlsa_selector selector, ldns_tlsa_matching_type matching_type)
Creates a LDNS_RDF_TYPE_HEX type rdf based on the binary data chosen by the selector and encoded usin...
Definition dane.c:134
ldns_dane_create_tlsa_rr
ldns_status ldns_dane_create_tlsa_rr(ldns_rr **tlsa, ldns_tlsa_certificate_usage certificate_usage, ldns_tlsa_selector selector, ldns_tlsa_matching_type matching_type, X509 *cert)
Creates a TLSA resource record from the certificate.
Definition dane.c:511
ldns_tlsa_selector
enum ldns_enum_tlsa_selector ldns_tlsa_selector
Definition dane.h:82
ldns_dane_transport
enum ldns_enum_dane_transport ldns_dane_transport
Definition dane.h:115
ldns_enum_tlsa_certificate_usage
ldns_enum_tlsa_certificate_usage
The different "Certificate usage" rdata field values for a TLSA RR.
Definition dane.h:42
LDNS_TLSA_USAGE_PRIVCERT
@ LDNS_TLSA_USAGE_PRIVCERT
Reserved for Private Use.
Definition dane.h:56
LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT
@ LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT
Definition dane.h:48
LDNS_TLSA_USAGE_DOMAIN_ISSUED_CERTIFICATE
@ LDNS_TLSA_USAGE_DOMAIN_ISSUED_CERTIFICATE
Definition dane.h:54
LDNS_TLSA_USAGE_TRUST_ANCHOR_ASSERTION
@ LDNS_TLSA_USAGE_TRUST_ANCHOR_ASSERTION
Definition dane.h:51
LDNS_TLSA_USAGE_DANE_EE
@ LDNS_TLSA_USAGE_DANE_EE
Domain issued certificate.
Definition dane.h:53
LDNS_TLSA_USAGE_CA_CONSTRAINT
@ LDNS_TLSA_USAGE_CA_CONSTRAINT
Definition dane.h:45
LDNS_TLSA_USAGE_PKIX_EE
@ LDNS_TLSA_USAGE_PKIX_EE
Service certificate constraint.
Definition dane.h:47
LDNS_TLSA_USAGE_PKIX_TA
@ LDNS_TLSA_USAGE_PKIX_TA
CA constraint.
Definition dane.h:44
LDNS_TLSA_USAGE_DANE_TA
@ LDNS_TLSA_USAGE_DANE_TA
Trust anchor assertion.
Definition dane.h:50
ldns_dane_verify_rr
ldns_status ldns_dane_verify_rr(const ldns_rr *tlsa_rr, X509 *cert, STACK_OF(X509) *extra_certs, X509_STORE *pkix_validation_store)
BEWARE!
Definition dane.c:658
ldns_dane_verify
ldns_status ldns_dane_verify(const ldns_rr_list *tlsas, X509 *cert, STACK_OF(X509) *extra_certs, X509_STORE *pkix_validation_store)
BEWARE!
Definition dane.c:841
ldns_tlsa_certificate_usage
enum ldns_enum_tlsa_certificate_usage ldns_tlsa_certificate_usage
Definition dane.h:58
ldns_tlsa_matching_type
enum ldns_enum_tlsa_matching_type ldns_tlsa_matching_type
Definition dane.h:101
ldns_enum_dane_transport
ldns_enum_dane_transport
Known transports to use with TLSA owner names.
Definition dane.h:107
LDNS_DANE_TRANSPORT_UDP
@ LDNS_DANE_TRANSPORT_UDP
UDP.
Definition dane.h:111
LDNS_DANE_TRANSPORT_TCP
@ LDNS_DANE_TRANSPORT_TCP
TCP.
Definition dane.h:109
LDNS_DANE_TRANSPORT_SCTP
@ LDNS_DANE_TRANSPORT_SCTP
SCTP.
Definition dane.h:113
ldns_dane_create_tlsa_owner
ldns_status ldns_dane_create_tlsa_owner(ldns_rdf **tlsa_owner, const ldns_rdf *name, uint16_t port, ldns_dane_transport transport)
Creates a dname consisting of the given name, prefixed by the service port and type of transport: _po...
Definition dane.c:90
ldns_enum_tlsa_matching_type
ldns_enum_tlsa_matching_type
The different "Matching type" rdata field values for a TLSA RR.
Definition dane.h:88
LDNS_TLSA_MATCHING_TYPE_FULL
@ LDNS_TLSA_MATCHING_TYPE_FULL
Exact match on selected content.
Definition dane.h:90
LDNS_TLSA_MATCHING_TYPE_SHA256
@ LDNS_TLSA_MATCHING_TYPE_SHA256
Definition dane.h:94
LDNS_TLSA_MATCHING_TYPE_SHA2_512
@ LDNS_TLSA_MATCHING_TYPE_SHA2_512
SHA-512 hash of selected content [RFC6234].
Definition dane.h:96
LDNS_TLSA_MATCHING_TYPE_NO_HASH_USED
@ LDNS_TLSA_MATCHING_TYPE_NO_HASH_USED
Definition dane.h:91
LDNS_TLSA_MATCHING_TYPE_SHA2_256
@ LDNS_TLSA_MATCHING_TYPE_SHA2_256
SHA-256 hash of selected content [RFC6234].
Definition dane.h:93
LDNS_TLSA_MATCHING_TYPE_SHA512
@ LDNS_TLSA_MATCHING_TYPE_SHA512
Definition dane.h:97
LDNS_TLSA_MATCHING_TYPE_PRIVMATCH
@ LDNS_TLSA_MATCHING_TYPE_PRIVMATCH
Reserved for Private Use.
Definition dane.h:99
ldns_dane_select_certificate
ldns_status ldns_dane_select_certificate(X509 **selected_cert, X509 *cert, STACK_OF(X509) *extra_certs, X509_STORE *pkix_validation_store, ldns_tlsa_certificate_usage cert_usage, int index)
Selects the certificate from cert, extra_certs or the pkix_validation_store based on the value of cer...
Definition dane.c:405
ldns_status
enum ldns_enum_status ldns_status
Definition error.h:152
rdata.h
Defines ldns_rdf and functions to manipulate those.
ldns_rdf
struct ldns_struct_rdf ldns_rdf
Definition rdata.h:211
rr.h
Contains the definition of ldns_rr and functions to manipulate those.
ldns_rr
struct ldns_struct_rr ldns_rr
Definition rr.h:346
ldns_rr_list
struct ldns_struct_rr_list ldns_rr_list
Definition rr.h:360