1 /* 2 * unbound.h - unbound validating resolver public API 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to resolve DNS queries and 40 * validate the answers. Synchonously and asynchronously. 41 * 42 * Several ways to use this interface from an application wishing 43 * to perform (validated) DNS lookups. 44 * 45 * All start with 46 * ctx = ub_ctx_create(); 47 * err = ub_ctx_add_ta(ctx, "..."); 48 * err = ub_ctx_add_ta(ctx, "..."); 49 * ... some lookups 50 * ... call ub_ctx_delete(ctx); when you want to stop. 51 * 52 * Application not threaded. Blocking. 53 * int err = ub_resolve(ctx, "www.example.com", ... 54 * if(err) fprintf(stderr, "lookup error: %s\n", ub_strerror(err)); 55 * ... use the answer 56 * 57 * Application not threaded. Non-blocking ('asynchronous'). 58 * err = ub_resolve_async(ctx, "www.example.com", ... my_callback); 59 * ... application resumes processing ... 60 * ... and when either ub_poll(ctx) is true 61 * ... or when the file descriptor ub_fd(ctx) is readable, 62 * ... or whenever, the app calls ... 63 * ub_process(ctx); 64 * ... if no result is ready, the app resumes processing above, 65 * ... or process() calls my_callback() with results. 66 * 67 * ... if the application has nothing more to do, wait for answer 68 * ub_wait(ctx); 69 * 70 * Application threaded. Blocking. 71 * Blocking, same as above. The current thread does the work. 72 * Multiple threads can use the *same context*, each does work and uses 73 * shared cache data from the context. 74 * 75 * Application threaded. Non-blocking ('asynchronous'). 76 * ... setup threaded-asynchronous config option 77 * err = ub_ctx_async(ctx, 1); 78 * ... same as async for non-threaded 79 * ... the callbacks are called in the thread that calls process(ctx) 80 * 81 * Openssl needs to have locking in place, and the application must set 82 * it up, because a mere library cannot do this, use the calls 83 * CRYPTO_set_id_callback and CRYPTO_set_locking_callback. 84 * 85 * If no threading is compiled in, the above async example uses fork(2) to 86 * create a process to perform the work. The forked process exits when the 87 * calling process exits, or ctx_delete() is called. 88 * Otherwise, for asynchronous with threading, a worker thread is created. 89 * 90 * The blocking calls use shared ctx-cache when threaded. Thus 91 * ub_resolve() and ub_resolve_async() && ub_wait() are 92 * not the same. The first makes the current thread do the work, setting 93 * up buffers, etc, to perform the work (but using shared cache data). 94 * The second calls another worker thread (or process) to perform the work. 95 * And no buffers need to be set up, but a context-switch happens. 96 */ 97 #ifndef _UB_UNBOUND_H 98 #define _UB_UNBOUND_H 99 100 #ifdef __cplusplus 101 extern "C" { 102 #endif 103 104 /** the version of this header file */ 105 #define UNBOUND_VERSION_MAJOR @UNBOUND_VERSION_MAJOR@ 106 #define UNBOUND_VERSION_MINOR @UNBOUND_VERSION_MINOR@ 107 #define UNBOUND_VERSION_MICRO @UNBOUND_VERSION_MICRO@ 108 109 /** 110 * The validation context is created to hold the resolver status, 111 * validation keys and a small cache (containing messages, rrsets, 112 * roundtrip times, trusted keys, lameness information). 113 * 114 * Its contents are internally defined. 115 */ 116 struct ub_ctx; 117 118 /** 119 * The validation and resolution results. 120 * Allocated by the resolver, and need to be freed by the application 121 * with ub_resolve_free(). 122 */ 123 struct ub_result { 124 /** The original question, name text string. */ 125 char* qname; 126 /** the type asked for */ 127 int qtype; 128 /** the class asked for */ 129 int qclass; 130 131 /** 132 * a list of network order DNS rdata items, terminated with a 133 * NULL pointer, so that data[0] is the first result entry, 134 * data[1] the second, and the last entry is NULL. 135 * If there was no data, data[0] is NULL. 136 */ 137 char** data; 138 139 /** the length in bytes of the data items, len[i] for data[i] */ 140 int* len; 141 142 /** 143 * canonical name for the result (the final cname). 144 * zero terminated string. 145 * May be NULL if no canonical name exists. 146 */ 147 char* canonname; 148 149 /** 150 * DNS RCODE for the result. May contain additional error code if 151 * there was no data due to an error. 0 (NOERROR) if okay. 152 */ 153 int rcode; 154 155 /** 156 * The DNS answer packet. Network formatted. Can contain DNSSEC types. 157 */ 158 void* answer_packet; 159 /** length of the answer packet in octets. */ 160 int answer_len; 161 162 /** 163 * If there is any data, this is true. 164 * If false, there was no data (nxdomain may be true, rcode can be set). 165 */ 166 int havedata; 167 168 /** 169 * If there was no data, and the domain did not exist, this is true. 170 * If it is false, and there was no data, then the domain name 171 * is purported to exist, but the requested data type is not available. 172 */ 173 int nxdomain; 174 175 /** 176 * True, if the result is validated securely. 177 * False, if validation failed or domain queried has no security info. 178 * 179 * It is possible to get a result with no data (havedata is false), 180 * and secure is true. This means that the non-existance of the data 181 * was cryptographically proven (with signatures). 182 */ 183 int secure; 184 185 /** 186 * If the result was not secure (secure==0), and this result is due 187 * to a security failure, bogus is true. 188 * This means the data has been actively tampered with, signatures 189 * failed, expected signatures were not present, timestamps on 190 * signatures were out of date and so on. 191 * 192 * If !secure and !bogus, this can happen if the data is not secure 193 * because security is disabled for that domain name. 194 * This means the data is from a domain where data is not signed. 195 */ 196 int bogus; 197 198 /** 199 * If the result is bogus this contains a string (zero terminated) 200 * that describes the failure. There may be other errors as well 201 * as the one described, the description may not be perfectly accurate. 202 * Is NULL if the result is not bogus. 203 */ 204 char* why_bogus; 205 206 /** 207 * TTL for the result, in seconds. If the security is bogus, then 208 * you also cannot trust this value. 209 */ 210 int ttl; 211 }; 212 213 /** 214 * Callback for results of async queries. 215 * The readable function definition looks like: 216 * void my_callback(void* my_arg, int err, struct ub_result* result); 217 * It is called with 218 * void* my_arg: your pointer to a (struct of) data of your choice, 219 * or NULL. 220 * int err: if 0 all is OK, otherwise an error occured and no results 221 * are forthcoming. 222 * struct result: pointer to more detailed result structure. 223 * This structure is allocated on the heap and needs to be 224 * freed with ub_resolve_free(result); 225 */ 226 typedef void (*ub_callback_t)(void*, int, struct ub_result*); 227 228 /** 229 * Create a resolving and validation context. 230 * The information from /etc/resolv.conf and /etc/hosts is not utilised by 231 * default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them. 232 * @return a new context. default initialisation. 233 * returns NULL on error. 234 */ 235 struct ub_ctx* ub_ctx_create(void); 236 237 /** 238 * Destroy a validation context and free all its resources. 239 * Outstanding async queries are killed and callbacks are not called for them. 240 * @param ctx: context to delete. 241 */ 242 void ub_ctx_delete(struct ub_ctx* ctx); 243 244 /** 245 * Set an option for the context. 246 * @param ctx: context. 247 * @param opt: option name from the unbound.conf config file format. 248 * (not all settings applicable). The name includes the trailing ':' 249 * for example ub_ctx_set_option(ctx, "logfile:", "mylog.txt"); 250 * This is a power-users interface that lets you specify all sorts 251 * of options. 252 * For some specific options, such as adding trust anchors, special 253 * routines exist. 254 * @param val: value of the option. 255 * @return: 0 if OK, else error. 256 */ 257 int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val); 258 259 /** 260 * Get an option from the context. 261 * @param ctx: context. 262 * @param opt: option name from the unbound.conf config file format. 263 * (not all settings applicable). The name excludes the trailing ':' 264 * for example ub_ctx_get_option(ctx, "logfile", &result); 265 * This is a power-users interface that lets you specify all sorts 266 * of options. 267 * @param str: the string is malloced and returned here. NULL on error. 268 * The caller must free() the string. In cases with multiple 269 * entries (auto-trust-anchor-file), a newline delimited list is 270 * returned in the string. 271 * @return 0 if OK else an error code (malloc failure, syntax error). 272 */ 273 int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str); 274 275 /** 276 * setup configuration for the given context. 277 * @param ctx: context. 278 * @param fname: unbound config file (not all settings applicable). 279 * This is a power-users interface that lets you specify all sorts 280 * of options. 281 * For some specific options, such as adding trust anchors, special 282 * routines exist. 283 * @return: 0 if OK, else error. 284 */ 285 int ub_ctx_config(struct ub_ctx* ctx, const char* fname); 286 287 /** 288 * Set machine to forward DNS queries to, the caching resolver to use. 289 * IP4 or IP6 address. Forwards all DNS requests to that machine, which 290 * is expected to run a recursive resolver. If the proxy is not 291 * DNSSEC-capable, validation may fail. Can be called several times, in 292 * that case the addresses are used as backup servers. 293 * 294 * To read the list of nameservers from /etc/resolv.conf (from DHCP or so), 295 * use the call ub_ctx_resolvconf. 296 * 297 * @param ctx: context. 298 * At this time it is only possible to set configuration before the 299 * first resolve is done. 300 * @param addr: address, IP4 or IP6 in string format. 301 * If the addr is NULL, forwarding is disabled. 302 * @return 0 if OK, else error. 303 */ 304 int ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr); 305 306 /** 307 * Read list of nameservers to use from the filename given. 308 * Usually "/etc/resolv.conf". Uses those nameservers as caching proxies. 309 * If they do not support DNSSEC, validation may fail. 310 * 311 * Only nameservers are picked up, the searchdomain, ndots and other 312 * settings from resolv.conf(5) are ignored. 313 * 314 * @param ctx: context. 315 * At this time it is only possible to set configuration before the 316 * first resolve is done. 317 * @param fname: file name string. If NULL "/etc/resolv.conf" is used. 318 * @return 0 if OK, else error. 319 */ 320 int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname); 321 322 /** 323 * Read list of hosts from the filename given. 324 * Usually "/etc/hosts". 325 * These addresses are not flagged as DNSSEC secure when queried for. 326 * 327 * @param ctx: context. 328 * At this time it is only possible to set configuration before the 329 * first resolve is done. 330 * @param fname: file name string. If NULL "/etc/hosts" is used. 331 * @return 0 if OK, else error. 332 */ 333 int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname); 334 335 /** 336 * Add a trust anchor to the given context. 337 * The trust anchor is a string, on one line, that holds a valid DNSKEY or 338 * DS RR. 339 * @param ctx: context. 340 * At this time it is only possible to add trusted keys before the 341 * first resolve is done. 342 * @param ta: string, with zone-format RR on one line. 343 * [domainname] [TTL optional] [type] [class optional] [rdata contents] 344 * @return 0 if OK, else error. 345 */ 346 int ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta); 347 348 /** 349 * Add trust anchors to the given context. 350 * Pass name of a file with DS and DNSKEY records (like from dig or drill). 351 * @param ctx: context. 352 * At this time it is only possible to add trusted keys before the 353 * first resolve is done. 354 * @param fname: filename of file with keyfile with trust anchors. 355 * @return 0 if OK, else error. 356 */ 357 int ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname); 358 359 /** 360 * Add trust anchor to the given context that is tracked with RFC5011 361 * automated trust anchor maintenance. The file is written to when the 362 * trust anchor is changed. 363 * Pass the name of a file that was output from eg. unbound-anchor, 364 * or you can start it by providing a trusted DNSKEY or DS record on one 365 * line in the file. 366 * @param ctx: context. 367 * At this time it is only possible to add trusted keys before the 368 * first resolve is done. 369 * @param fname: filename of file with trust anchor. 370 * @return 0 if OK, else error. 371 */ 372 int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname); 373 374 /** 375 * Add trust anchors to the given context. 376 * Pass the name of a bind-style config file with trusted-keys{}. 377 * @param ctx: context. 378 * At this time it is only possible to add trusted keys before the 379 * first resolve is done. 380 * @param fname: filename of file with bind-style config entries with trust 381 * anchors. 382 * @return 0 if OK, else error. 383 */ 384 int ub_ctx_trustedkeys(struct ub_ctx* ctx, const char* fname); 385 386 /** 387 * Set debug output (and error output) to the specified stream. 388 * Pass NULL to disable. Default is stderr. 389 * @param ctx: context. 390 * @param out: FILE* out file stream to log to. 391 * Type void* to avoid stdio dependency of this header file. 392 * @return 0 if OK, else error. 393 */ 394 int ub_ctx_debugout(struct ub_ctx* ctx, void* out); 395 396 /** 397 * Set debug verbosity for the context 398 * Output is directed to stderr. 399 * @param ctx: context. 400 * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, 401 * and 3 is lots. 402 * @return 0 if OK, else error. 403 */ 404 int ub_ctx_debuglevel(struct ub_ctx* ctx, int d); 405 406 /** 407 * Set a context behaviour for asynchronous action. 408 * @param ctx: context. 409 * @param dothread: if true, enables threading and a call to resolve_async() 410 * creates a thread to handle work in the background. 411 * If false, a process is forked to handle work in the background. 412 * Changes to this setting after async() calls have been made have 413 * no effect (delete and re-create the context to change). 414 * @return 0 if OK, else error. 415 */ 416 int ub_ctx_async(struct ub_ctx* ctx, int dothread); 417 418 /** 419 * Poll a context to see if it has any new results 420 * Do not poll in a loop, instead extract the fd below to poll for readiness, 421 * and then check, or wait using the wait routine. 422 * @param ctx: context. 423 * @return: 0 if nothing to read, or nonzero if a result is available. 424 * If nonzero, call ctx_process() to do callbacks. 425 */ 426 int ub_poll(struct ub_ctx* ctx); 427 428 /** 429 * Wait for a context to finish with results. Calls ub_process() after 430 * the wait for you. After the wait, there are no more outstanding 431 * asynchronous queries. 432 * @param ctx: context. 433 * @return: 0 if OK, else error. 434 */ 435 int ub_wait(struct ub_ctx* ctx); 436 437 /** 438 * Get file descriptor. Wait for it to become readable, at this point 439 * answers are returned from the asynchronous validating resolver. 440 * Then call the ub_process to continue processing. 441 * This routine works immediately after context creation, the fd 442 * does not change. 443 * @param ctx: context. 444 * @return: -1 on error, or file descriptor to use select(2) with. 445 */ 446 int ub_fd(struct ub_ctx* ctx); 447 448 /** 449 * Call this routine to continue processing results from the validating 450 * resolver (when the fd becomes readable). 451 * Will perform necessary callbacks. 452 * @param ctx: context 453 * @return: 0 if OK, else error. 454 */ 455 int ub_process(struct ub_ctx* ctx); 456 457 /** 458 * Perform resolution and validation of the target name. 459 * @param ctx: context. 460 * The context is finalized, and can no longer accept config changes. 461 * @param name: domain name in text format (a zero terminated text string). 462 * @param rrtype: type of RR in host order, 1 is A (address). 463 * @param rrclass: class of RR in host order, 1 is IN (for internet). 464 * @param result: the result data is returned in a newly allocated result 465 * structure. May be NULL on return, return value is set to an error 466 * in that case (out of memory). 467 * @return 0 if OK, else error. 468 */ 469 int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, 470 int rrclass, struct ub_result** result); 471 472 /** 473 * Perform resolution and validation of the target name. 474 * Asynchronous, after a while, the callback will be called with your 475 * data and the result. 476 * @param ctx: context. 477 * If no thread or process has been created yet to perform the 478 * work in the background, it is created now. 479 * The context is finalized, and can no longer accept config changes. 480 * @param name: domain name in text format (a string). 481 * @param rrtype: type of RR in host order, 1 is A. 482 * @param rrclass: class of RR in host order, 1 is IN (for internet). 483 * @param mydata: this data is your own data (you can pass NULL), 484 * and is passed on to the callback function. 485 * @param callback: this is called on completion of the resolution. 486 * It is called as: 487 * void callback(void* mydata, int err, struct ub_result* result) 488 * with mydata: the same as passed here, you may pass NULL, 489 * with err: is 0 when a result has been found. 490 * with result: a newly allocated result structure. 491 * The result may be NULL, in that case err is set. 492 * 493 * If an error happens during processing, your callback will be called 494 * with error set to a nonzero value (and result==NULL). 495 * @param async_id: if you pass a non-NULL value, an identifier number is 496 * returned for the query as it is in progress. It can be used to 497 * cancel the query. 498 * @return 0 if OK, else error. 499 */ 500 int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 501 int rrclass, void* mydata, ub_callback_t callback, int* async_id); 502 503 /** 504 * Cancel an async query in progress. 505 * Its callback will not be called. 506 * 507 * @param ctx: context. 508 * @param async_id: which query to cancel. 509 * @return 0 if OK, else error. 510 * This routine can return an error if the async_id passed does not exist 511 * or has already been delivered. If another thread is processing results 512 * at the same time, the result may be delivered at the same time and the 513 * cancel fails with an error. Also the cancel can fail due to a system 514 * error, no memory or socket failures. 515 */ 516 int ub_cancel(struct ub_ctx* ctx, int async_id); 517 518 /** 519 * Free storage associated with a result structure. 520 * @param result: to free 521 */ 522 void ub_resolve_free(struct ub_result* result); 523 524 /** 525 * Convert error value to a human readable string. 526 * @param err: error code from one of the libunbound functions. 527 * @return pointer to constant text string, zero terminated. 528 */ 529 const char* ub_strerror(int err); 530 531 /** 532 * Debug routine. Print the local zone information to debug output. 533 * @param ctx: context. Is finalized by the routine. 534 * @return 0 if OK, else error. 535 */ 536 int ub_ctx_print_local_zones(struct ub_ctx* ctx); 537 538 /** 539 * Add a new zone with the zonetype to the local authority info of the 540 * library. 541 * @param ctx: context. Is finalized by the routine. 542 * @param zone_name: name of the zone in text, "example.com" 543 * If it already exists, the type is updated. 544 * @param zone_type: type of the zone (like for unbound.conf) in text. 545 * @return 0 if OK, else error. 546 */ 547 int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, 548 const char *zone_type); 549 550 /** 551 * Remove zone from local authority info of the library. 552 * @param ctx: context. Is finalized by the routine. 553 * @param zone_name: name of the zone in text, "example.com" 554 * If it does not exist, nothing happens. 555 * @return 0 if OK, else error. 556 */ 557 int ub_ctx_zone_remove(struct ub_ctx* ctx, const char *zone_name); 558 559 /** 560 * Add localdata to the library local authority info. 561 * Similar to local-data config statement. 562 * @param ctx: context. Is finalized by the routine. 563 * @param data: the resource record in text format, for example 564 * "www.example.com IN A 127.0.0.1" 565 * @return 0 if OK, else error. 566 */ 567 int ub_ctx_data_add(struct ub_ctx* ctx, const char *data); 568 569 /** 570 * Remove localdata from the library local authority info. 571 * @param ctx: context. Is finalized by the routine. 572 * @param data: the name to delete all data from, like "www.example.com". 573 * @return 0 if OK, else error. 574 */ 575 int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data); 576 577 /** 578 * Get a version string from the libunbound implementation. 579 * @return a static constant string with the version number. 580 */ 581 const char* ub_version(void); 582 583 #ifdef __cplusplus 584 } 585 #endif 586 587 #endif /* _UB_UNBOUND_H */ 588