dane.c File Reference

Go to the source code of this file.

Functions

ldns_status ldns_dane_create_tlsa_owner (ldns_rdf **tlsa_owner, const ldns_rdf *name, uint16_t port, ldns_dane_transport transport)
 Creates a dname consisting of the given name, prefixed by the service port and type of transport: _port._transport.
ldns_status ldns_dane_cert2rdf (ldns_rdf **rdf, X509 *cert, ldns_tlsa_selector selector, ldns_tlsa_matching_type matching_type)
 Creates a LDNS_RDF_TYPE_HEX type rdf based on the binary data choosen by the selector and encoded using matching_type.
ldns_status ldns_dane_select_certificate (X509 **selected_cert, X509 *cert, STACK_OF(X509)*extra_certs, X509_STORE *pkix_validation_store, ldns_tlsa_certificate_usage cert_usage, int offset)
 Selects the certificate from cert, extra_certs or the pkix_validation_store based on the value of cert_usage and index.
ldns_status ldns_dane_create_tlsa_rr (ldns_rr **tlsa, ldns_tlsa_certificate_usage certificate_usage, ldns_tlsa_selector selector, ldns_tlsa_matching_type matching_type, X509 *cert)
 Creates a TLSA resource record from the certificate.
ldns_status ldns_dane_verify_rr (const ldns_rr *tlsa_rr, X509 *cert, STACK_OF(X509)*extra_certs, X509_STORE *pkix_validation_store)
 Verify if the given TLSA resource record matches the given certificate.
ldns_status ldns_dane_verify (ldns_rr_list *tlsas, X509 *cert, STACK_OF(X509)*extra_certs, X509_STORE *pkix_validation_store)
 Verify if any of the given TLSA resource records matches the given certificate.

Function Documentation

ldns_status ldns_dane_create_tlsa_owner ( ldns_rdf **  tlsa_owner,
const ldns_rdf name,
uint16_t  port,
ldns_dane_transport  transport 
)

Creates a dname consisting of the given name, prefixed by the service port and type of transport: _port._transport.

name.

Parameters:
[out] tlsa_owner The created dname.
[in] name The dname that should be prefixed.
[in] port The service port number for wich the name should be created.
[in] transport The transport for wich the name should be created.
Returns:
LDNS_STATUS_OK on success or an error code otherwise.

Definition at line 28 of file dane.c.

References LDNS_DANE_TRANSPORT_SCTP, LDNS_DANE_TRANSPORT_TCP, LDNS_DANE_TRANSPORT_UDP, LDNS_MAX_DOMAINLEN, ldns_rdf_data(), ldns_rdf_get_type(), ldns_rdf_new_frm_data(), ldns_rdf_size(), LDNS_RDF_TYPE_DNAME, LDNS_STATUS_DANE_UNKNOWN_TRANSPORT, LDNS_STATUS_DOMAINNAME_OVERFLOW, LDNS_STATUS_MEM_ERR, and LDNS_STATUS_OK.

ldns_status ldns_dane_cert2rdf ( ldns_rdf **  rdf,
X509 *  cert,
ldns_tlsa_selector  selector,
ldns_tlsa_matching_type  matching_type 
)

Creates a LDNS_RDF_TYPE_HEX type rdf based on the binary data choosen by the selector and encoded using matching_type.

Parameters:
[out] rdf The created created rdf of type LDNS_RDF_TYPE_HEX.
[in] cert The certificate from which the data is selected
[in] selector The full certificate or the public key
[in] matching_type The full data or the SHA256 or SHA512 hash of the selected data
Returns:
LDNS_STATUS_OK on success or an error code otherwise.

Definition at line 72 of file dane.c.

References LDNS_FREE, ldns_rdf_new(), LDNS_RDF_TYPE_HEX, ldns_sha256(), ldns_sha512(), LDNS_STATUS_DANE_UNKNOWN_MATCHING_TYPE, LDNS_STATUS_DANE_UNKNOWN_SELECTOR, LDNS_STATUS_MEM_ERR, LDNS_STATUS_OK, LDNS_STATUS_SSL_ERR, LDNS_TLSA_MATCHING_TYPE_NO_HASH_USED, LDNS_TLSA_MATCHING_TYPE_SHA256, LDNS_TLSA_MATCHING_TYPE_SHA512, LDNS_TLSA_SELECTOR_FULL_CERTIFICATE, LDNS_TLSA_SELECTOR_SUBJECTPUBLICKEYINFO, and LDNS_XMALLOC.

ldns_status ldns_dane_select_certificate ( X509 **  selected_cert,
X509 *  cert,
STACK_OF(X509)*  extra_certs,
X509_STORE *  pkix_validation_store,
ldns_tlsa_certificate_usage  cert_usage,
int  index 
)

Selects the certificate from cert, extra_certs or the pkix_validation_store based on the value of cert_usage and index.

Parameters:
[out] selected_cert The selected cert.
[in] cert The certificate to validate (or not)
[in] extra_certs Intermediate certificates that might be necessary during validation. May be NULL, except when the certificate usage is "Trust Anchor Assertion" because the trust anchor has to be provided.(otherwise choose a "Domain issued certificate!"
[in] pkix_validation_store Used when the certificate usage is "CA constraint" or "Service Certificate Constraint" to validate the certificate and, in case of "CA constraint", select the CA. When pkix_validation_store is NULL, validation is explicitely turned off and the behaviour is then the same as for "Trust anchor assertion" and "Domain issued certificate" respectively.
[in] cert_usage Which certificate to use and how to validate.
[in] index Used to select the trust anchor when certificate usage is "Trust Anchor Assertion". 0 is the last certificate in the validation chain. 1 the one but last, etc. When index is -1, the last certificate is used that MUST be self-signed. This can help to make sure that the intended (self signed) trust anchor is actually present in extra_certs (which is a DANE requirement).
Returns:
LDNS_STATUS_OK on success or an error code otherwise.

Definition at line 343 of file dane.c.

References LDNS_STATUS_DANE_UNKNOWN_CERTIFICATE_USAGE, LDNS_STATUS_OK, LDNS_TLSA_USAGE_CA_CONSTRAINT, LDNS_TLSA_USAGE_DOMAIN_ISSUED_CERTIFICATE, LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT, and LDNS_TLSA_USAGE_TRUST_ANCHOR_ASSERTION.

ldns_status ldns_dane_create_tlsa_rr ( ldns_rr **  tlsa,
ldns_tlsa_certificate_usage  certificate_usage,
ldns_tlsa_selector  selector,
ldns_tlsa_matching_type  matching_type,
X509 *  cert 
)

Creates a TLSA resource record from the certificate.

No PKIX validation is performed! The given certificate is used as data regardless the value of certificate_usage.

Parameters:
[out] tlsa The created TLSA resource record.
[in] certificate_usage The value for the Certificate Usage field
[in] selector The value for the Selector field
[in] matching_type The value for the Matching Type field
[in] cert The certificate which data will be represented
Returns:
LDNS_STATUS_OK on success or an error code otherwise.

Definition at line 449 of file dane.c.

References ldns_dane_cert2rdf(), ldns_native2rdf_int8(), LDNS_RDF_TYPE_INT8, ldns_rr_free(), ldns_rr_new_frm_type(), ldns_rr_set_rdf(), LDNS_RR_TYPE_TLSA, LDNS_STATUS_MEM_ERR, and LDNS_STATUS_OK.

ldns_status ldns_dane_verify_rr ( const ldns_rr tlsa_rr,
X509 *  cert,
STACK_OF(X509)*  extra_certs,
X509_STORE *  pkix_validation_store 
)

Verify if the given TLSA resource record matches the given certificate.

Reporting on a TLSA rr mismatch (LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH) is preferred over PKIX failure (LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE). So when PKIX validation is required by the TLSA Certificate usage, but the TLSA data does not match, LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH is returned whether the PKIX validated or not.

Parameters:
[in] tlsa_rr The resource record that specifies what and how to match the certificate. With tlsa_rr == NULL, regular PKIX validation is performed.
[in] cert The certificate to match (and validate)
[in] extra_certs Intermediate certificates that might be necessary creating the validation chain.
[in] pkix_validation_store Used when the certificate usage is "CA constraint" or "Service Certificate Constraint" to validate the certificate.
Returns:
LDNS_STATUS_OK on success, LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH on TLSA data mismatch, LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE when TLSA matched, but the PKIX validation failed, or other ldns_status errors.

Definition at line 592 of file dane.c.

References ldns_rdf2native_int8(), ldns_rr_rdf(), LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE, LDNS_STATUS_DANE_UNKNOWN_CERTIFICATE_USAGE, LDNS_STATUS_OK, LDNS_TLSA_USAGE_CA_CONSTRAINT, LDNS_TLSA_USAGE_DOMAIN_ISSUED_CERTIFICATE, LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT, and LDNS_TLSA_USAGE_TRUST_ANCHOR_ASSERTION.

ldns_status ldns_dane_verify ( ldns_rr_list tlsas,
X509 *  cert,
STACK_OF(X509)*  extra_certs,
X509_STORE *  pkix_validation_store 
)

Verify if any of the given TLSA resource records matches the given certificate.

Parameters:
[in] tlsas The resource records that specify what and how to match the certificate. One must match for this function to succeed. With tlsas == NULL or the number of TLSA records in tlsas == 0, regular PKIX validation is performed.
[in] cert The certificate to match (and validate)
[in] extra_certs Intermediate certificates that might be necessary creating the validation chain.
[in] pkix_validation_store Used when the certificate usage is "CA constraint" or "Service Certificate Constraint" to validate the certificate.
Returns:
LDNS_STATUS_OK on success, LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE when one of the TLSA's matched but the PKIX validation failed, LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH when none of the TLSA's matched, or other ldns_status errors.

Definition at line 697 of file dane.c.

References ldns_dane_verify_rr(), ldns_rr_list_free(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE, LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH, LDNS_STATUS_MEM_ERR, and LDNS_STATUS_OK.


Generated on 17 Feb 2016 for ldns by  doxygen 1.6.1