1 /* 2 * unbound.h - unbound validating resolver public API 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to resolve DNS queries and 40 * validate the answers. Synchonously and asynchronously. 41 * 42 * Several ways to use this interface from an application wishing 43 * to perform (validated) DNS lookups. 44 * 45 * All start with 46 * ctx = ub_ctx_create(); 47 * err = ub_ctx_add_ta(ctx, "..."); 48 * err = ub_ctx_add_ta(ctx, "..."); 49 * ... some lookups 50 * ... call ub_ctx_delete(ctx); when you want to stop. 51 * 52 * Application not threaded. Blocking. 53 * int err = ub_resolve(ctx, "www.example.com", ... 54 * if(err) fprintf(stderr, "lookup error: %s\n", ub_strerror(err)); 55 * ... use the answer 56 * 57 * Application not threaded. Non-blocking ('asynchronous'). 58 * err = ub_resolve_async(ctx, "www.example.com", ... my_callback); 59 * ... application resumes processing ... 60 * ... and when either ub_poll(ctx) is true 61 * ... or when the file descriptor ub_fd(ctx) is readable, 62 * ... or whenever, the app calls ... 63 * ub_process(ctx); 64 * ... if no result is ready, the app resumes processing above, 65 * ... or process() calls my_callback() with results. 66 * 67 * ... if the application has nothing more to do, wait for answer 68 * ub_wait(ctx); 69 * 70 * Application threaded. Blocking. 71 * Blocking, same as above. The current thread does the work. 72 * Multiple threads can use the *same context*, each does work and uses 73 * shared cache data from the context. 74 * 75 * Application threaded. Non-blocking ('asynchronous'). 76 * ... setup threaded-asynchronous config option 77 * err = ub_ctx_async(ctx, 1); 78 * ... same as async for non-threaded 79 * ... the callbacks are called in the thread that calls process(ctx) 80 * 81 * Openssl needs to have locking in place, and the application must set 82 * it up, because a mere library cannot do this, use the calls 83 * CRYPTO_set_id_callback and CRYPTO_set_locking_callback. 84 * 85 * If no threading is compiled in, the above async example uses fork(2) to 86 * create a process to perform the work. The forked process exits when the 87 * calling process exits, or ctx_delete() is called. 88 * Otherwise, for asynchronous with threading, a worker thread is created. 89 * 90 * The blocking calls use shared ctx-cache when threaded. Thus 91 * ub_resolve() and ub_resolve_async() && ub_wait() are 92 * not the same. The first makes the current thread do the work, setting 93 * up buffers, etc, to perform the work (but using shared cache data). 94 * The second calls another worker thread (or process) to perform the work. 95 * And no buffers need to be set up, but a context-switch happens. 96 */ 97 #ifndef _UB_UNBOUND_H 98 #define _UB_UNBOUND_H 99 100 #ifdef __cplusplus 101 extern "C" { 102 #endif 103 104 /** the version of this header file */ 105 #define UNBOUND_VERSION_MAJOR @UNBOUND_VERSION_MAJOR@ 106 #define UNBOUND_VERSION_MINOR @UNBOUND_VERSION_MINOR@ 107 #define UNBOUND_VERSION_MICRO @UNBOUND_VERSION_MICRO@ 108 109 /** 110 * The validation context is created to hold the resolver status, 111 * validation keys and a small cache (containing messages, rrsets, 112 * roundtrip times, trusted keys, lameness information). 113 * 114 * Its contents are internally defined. 115 */ 116 struct ub_ctx; 117 118 /** 119 * The validation and resolution results. 120 * Allocated by the resolver, and need to be freed by the application 121 * with ub_resolve_free(). 122 */ 123 struct ub_result { 124 /** The original question, name text string. */ 125 char* qname; 126 /** the type asked for */ 127 int qtype; 128 /** the class asked for */ 129 int qclass; 130 131 /** 132 * a list of network order DNS rdata items, terminated with a 133 * NULL pointer, so that data[0] is the first result entry, 134 * data[1] the second, and the last entry is NULL. 135 * If there was no data, data[0] is NULL. 136 */ 137 char** data; 138 139 /** the length in bytes of the data items, len[i] for data[i] */ 140 int* len; 141 142 /** 143 * canonical name for the result (the final cname). 144 * zero terminated string. 145 * May be NULL if no canonical name exists. 146 */ 147 char* canonname; 148 149 /** 150 * DNS RCODE for the result. May contain additional error code if 151 * there was no data due to an error. 0 (NOERROR) if okay. 152 */ 153 int rcode; 154 155 /** 156 * The DNS answer packet. Network formatted. Can contain DNSSEC types. 157 */ 158 void* answer_packet; 159 /** length of the answer packet in octets. */ 160 int answer_len; 161 162 /** 163 * If there is any data, this is true. 164 * If false, there was no data (nxdomain may be true, rcode can be set). 165 */ 166 int havedata; 167 168 /** 169 * If there was no data, and the domain did not exist, this is true. 170 * If it is false, and there was no data, then the domain name 171 * is purported to exist, but the requested data type is not available. 172 */ 173 int nxdomain; 174 175 /** 176 * True, if the result is validated securely. 177 * False, if validation failed or domain queried has no security info. 178 * 179 * It is possible to get a result with no data (havedata is false), 180 * and secure is true. This means that the non-existance of the data 181 * was cryptographically proven (with signatures). 182 */ 183 int secure; 184 185 /** 186 * If the result was not secure (secure==0), and this result is due 187 * to a security failure, bogus is true. 188 * This means the data has been actively tampered with, signatures 189 * failed, expected signatures were not present, timestamps on 190 * signatures were out of date and so on. 191 * 192 * If !secure and !bogus, this can happen if the data is not secure 193 * because security is disabled for that domain name. 194 * This means the data is from a domain where data is not signed. 195 */ 196 int bogus; 197 198 /** 199 * If the result is bogus this contains a string (zero terminated) 200 * that describes the failure. There may be other errors as well 201 * as the one described, the description may not be perfectly accurate. 202 * Is NULL if the result is not bogus. 203 */ 204 char* why_bogus; 205 206 /** 207 * TTL for the result, in seconds. If the security is bogus, then 208 * you also cannot trust this value. 209 */ 210 int ttl; 211 }; 212 213 /** 214 * Callback for results of async queries. 215 * The readable function definition looks like: 216 * void my_callback(void* my_arg, int err, struct ub_result* result); 217 * It is called with 218 * void* my_arg: your pointer to a (struct of) data of your choice, 219 * or NULL. 220 * int err: if 0 all is OK, otherwise an error occured and no results 221 * are forthcoming. 222 * struct result: pointer to more detailed result structure. 223 * This structure is allocated on the heap and needs to be 224 * freed with ub_resolve_free(result); 225 */ 226 typedef void (*ub_callback_t)(void*, int, struct ub_result*); 227 228 /** 229 * Create a resolving and validation context. 230 * The information from /etc/resolv.conf and /etc/hosts is not utilised by 231 * default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them. 232 * @return a new context. default initialisation. 233 * returns NULL on error. 234 */ 235 struct ub_ctx* ub_ctx_create(void); 236 237 /** 238 * Destroy a validation context and free all its resources. 239 * Outstanding async queries are killed and callbacks are not called for them. 240 * @param ctx: context to delete. 241 */ 242 void ub_ctx_delete(struct ub_ctx* ctx); 243 244 /** 245 * Set an option for the context. 246 * @param ctx: context. 247 * @param opt: option name from the unbound.conf config file format. 248 * (not all settings applicable). The name includes the trailing ':' 249 * for example ub_ctx_set_option(ctx, "logfile:", "mylog.txt"); 250 * This is a power-users interface that lets you specify all sorts 251 * of options. 252 * For some specific options, such as adding trust anchors, special 253 * routines exist. 254 * @param val: value of the option. 255 * @return: 0 if OK, else error. 256 */ 257 int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val); 258 259 /** 260 * Get an option from the context. 261 * @param ctx: context. 262 * @param opt: option name from the unbound.conf config file format. 263 * (not all settings applicable). The name excludes the trailing ':' 264 * for example ub_ctx_get_option(ctx, "logfile", &result); 265 * This is a power-users interface that lets you specify all sorts 266 * of options. 267 * @param str: the string is malloced and returned here. NULL on error. 268 * The caller must free() the string. In cases with multiple 269 * entries (auto-trust-anchor-file), a newline delimited list is 270 * returned in the string. 271 * @return 0 if OK else an error code (malloc failure, syntax error). 272 */ 273 int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str); 274 275 /** 276 * setup configuration for the given context. 277 * @param ctx: context. 278 * @param fname: unbound config file (not all settings applicable). 279 * This is a power-users interface that lets you specify all sorts 280 * of options. 281 * For some specific options, such as adding trust anchors, special 282 * routines exist. 283 * @return: 0 if OK, else error. 284 */ 285 int ub_ctx_config(struct ub_ctx* ctx, const char* fname); 286 287 /** 288 * Set machine to forward DNS queries to, the caching resolver to use. 289 * IP4 or IP6 address. Forwards all DNS requests to that machine, which 290 * is expected to run a recursive resolver. If the proxy is not 291 * DNSSEC-capable, validation may fail. Can be called several times, in 292 * that case the addresses are used as backup servers. 293 * 294 * To read the list of nameservers from /etc/resolv.conf (from DHCP or so), 295 * use the call ub_ctx_resolvconf. 296 * 297 * @param ctx: context. 298 * At this time it is only possible to set configuration before the 299 * first resolve is done. 300 * @param addr: address, IP4 or IP6 in string format. 301 * If the addr is NULL, forwarding is disabled. 302 * @return 0 if OK, else error. 303 */ 304 int ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr); 305 306 /** 307 * Add a stub zone, with given address to send to. This is for custom 308 * root hints or pointing to a local authoritative dns server. 309 * For dns resolvers and the 'DHCP DNS' ip address, use ub_ctx_set_fwd. 310 * This is similar to a stub-zone entry in unbound.conf. 311 * 312 * @param ctx: context. 313 * It is only possible to set configuration before the 314 * first resolve is done. 315 * @param zone: name of the zone, string. 316 * @param addr: address, IP4 or IP6 in string format. 317 * The addr is added to the list of stub-addresses if the entry exists. 318 * If the addr is NULL the stub entry is removed. 319 * @param isprime: set to true to set stub-prime to yes for the stub. 320 * For local authoritative servers, people usually set it to false, 321 * For root hints it should be set to true. 322 * @return 0 if OK, else error. 323 */ 324 int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr, 325 int isprime); 326 327 /** 328 * Read list of nameservers to use from the filename given. 329 * Usually "/etc/resolv.conf". Uses those nameservers as caching proxies. 330 * If they do not support DNSSEC, validation may fail. 331 * 332 * Only nameservers are picked up, the searchdomain, ndots and other 333 * settings from resolv.conf(5) are ignored. 334 * 335 * @param ctx: context. 336 * At this time it is only possible to set configuration before the 337 * first resolve is done. 338 * @param fname: file name string. If NULL "/etc/resolv.conf" is used. 339 * @return 0 if OK, else error. 340 */ 341 int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname); 342 343 /** 344 * Read list of hosts from the filename given. 345 * Usually "/etc/hosts". 346 * These addresses are not flagged as DNSSEC secure when queried for. 347 * 348 * @param ctx: context. 349 * At this time it is only possible to set configuration before the 350 * first resolve is done. 351 * @param fname: file name string. If NULL "/etc/hosts" is used. 352 * @return 0 if OK, else error. 353 */ 354 int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname); 355 356 /** 357 * Add a trust anchor to the given context. 358 * The trust anchor is a string, on one line, that holds a valid DNSKEY or 359 * DS RR. 360 * @param ctx: context. 361 * At this time it is only possible to add trusted keys before the 362 * first resolve is done. 363 * @param ta: string, with zone-format RR on one line. 364 * [domainname] [TTL optional] [type] [class optional] [rdata contents] 365 * @return 0 if OK, else error. 366 */ 367 int ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta); 368 369 /** 370 * Add trust anchors to the given context. 371 * Pass name of a file with DS and DNSKEY records (like from dig or drill). 372 * @param ctx: context. 373 * At this time it is only possible to add trusted keys before the 374 * first resolve is done. 375 * @param fname: filename of file with keyfile with trust anchors. 376 * @return 0 if OK, else error. 377 */ 378 int ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname); 379 380 /** 381 * Add trust anchor to the given context that is tracked with RFC5011 382 * automated trust anchor maintenance. The file is written to when the 383 * trust anchor is changed. 384 * Pass the name of a file that was output from eg. unbound-anchor, 385 * or you can start it by providing a trusted DNSKEY or DS record on one 386 * line in the file. 387 * @param ctx: context. 388 * At this time it is only possible to add trusted keys before the 389 * first resolve is done. 390 * @param fname: filename of file with trust anchor. 391 * @return 0 if OK, else error. 392 */ 393 int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname); 394 395 /** 396 * Add trust anchors to the given context. 397 * Pass the name of a bind-style config file with trusted-keys{}. 398 * @param ctx: context. 399 * At this time it is only possible to add trusted keys before the 400 * first resolve is done. 401 * @param fname: filename of file with bind-style config entries with trust 402 * anchors. 403 * @return 0 if OK, else error. 404 */ 405 int ub_ctx_trustedkeys(struct ub_ctx* ctx, const char* fname); 406 407 /** 408 * Set debug output (and error output) to the specified stream. 409 * Pass NULL to disable. Default is stderr. 410 * @param ctx: context. 411 * @param out: FILE* out file stream to log to. 412 * Type void* to avoid stdio dependency of this header file. 413 * @return 0 if OK, else error. 414 */ 415 int ub_ctx_debugout(struct ub_ctx* ctx, void* out); 416 417 /** 418 * Set debug verbosity for the context 419 * Output is directed to stderr. 420 * @param ctx: context. 421 * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, 422 * and 3 is lots. 423 * @return 0 if OK, else error. 424 */ 425 int ub_ctx_debuglevel(struct ub_ctx* ctx, int d); 426 427 /** 428 * Set a context behaviour for asynchronous action. 429 * @param ctx: context. 430 * @param dothread: if true, enables threading and a call to resolve_async() 431 * creates a thread to handle work in the background. 432 * If false, a process is forked to handle work in the background. 433 * Changes to this setting after async() calls have been made have 434 * no effect (delete and re-create the context to change). 435 * @return 0 if OK, else error. 436 */ 437 int ub_ctx_async(struct ub_ctx* ctx, int dothread); 438 439 /** 440 * Poll a context to see if it has any new results 441 * Do not poll in a loop, instead extract the fd below to poll for readiness, 442 * and then check, or wait using the wait routine. 443 * @param ctx: context. 444 * @return: 0 if nothing to read, or nonzero if a result is available. 445 * If nonzero, call ctx_process() to do callbacks. 446 */ 447 int ub_poll(struct ub_ctx* ctx); 448 449 /** 450 * Wait for a context to finish with results. Calls ub_process() after 451 * the wait for you. After the wait, there are no more outstanding 452 * asynchronous queries. 453 * @param ctx: context. 454 * @return: 0 if OK, else error. 455 */ 456 int ub_wait(struct ub_ctx* ctx); 457 458 /** 459 * Get file descriptor. Wait for it to become readable, at this point 460 * answers are returned from the asynchronous validating resolver. 461 * Then call the ub_process to continue processing. 462 * This routine works immediately after context creation, the fd 463 * does not change. 464 * @param ctx: context. 465 * @return: -1 on error, or file descriptor to use select(2) with. 466 */ 467 int ub_fd(struct ub_ctx* ctx); 468 469 /** 470 * Call this routine to continue processing results from the validating 471 * resolver (when the fd becomes readable). 472 * Will perform necessary callbacks. 473 * @param ctx: context 474 * @return: 0 if OK, else error. 475 */ 476 int ub_process(struct ub_ctx* ctx); 477 478 /** 479 * Perform resolution and validation of the target name. 480 * @param ctx: context. 481 * The context is finalized, and can no longer accept config changes. 482 * @param name: domain name in text format (a zero terminated text string). 483 * @param rrtype: type of RR in host order, 1 is A (address). 484 * @param rrclass: class of RR in host order, 1 is IN (for internet). 485 * @param result: the result data is returned in a newly allocated result 486 * structure. May be NULL on return, return value is set to an error 487 * in that case (out of memory). 488 * @return 0 if OK, else error. 489 */ 490 int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, 491 int rrclass, struct ub_result** result); 492 493 /** 494 * Perform resolution and validation of the target name. 495 * Asynchronous, after a while, the callback will be called with your 496 * data and the result. 497 * @param ctx: context. 498 * If no thread or process has been created yet to perform the 499 * work in the background, it is created now. 500 * The context is finalized, and can no longer accept config changes. 501 * @param name: domain name in text format (a string). 502 * @param rrtype: type of RR in host order, 1 is A. 503 * @param rrclass: class of RR in host order, 1 is IN (for internet). 504 * @param mydata: this data is your own data (you can pass NULL), 505 * and is passed on to the callback function. 506 * @param callback: this is called on completion of the resolution. 507 * It is called as: 508 * void callback(void* mydata, int err, struct ub_result* result) 509 * with mydata: the same as passed here, you may pass NULL, 510 * with err: is 0 when a result has been found. 511 * with result: a newly allocated result structure. 512 * The result may be NULL, in that case err is set. 513 * 514 * If an error happens during processing, your callback will be called 515 * with error set to a nonzero value (and result==NULL). 516 * @param async_id: if you pass a non-NULL value, an identifier number is 517 * returned for the query as it is in progress. It can be used to 518 * cancel the query. 519 * @return 0 if OK, else error. 520 */ 521 int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 522 int rrclass, void* mydata, ub_callback_t callback, int* async_id); 523 524 /** 525 * Cancel an async query in progress. 526 * Its callback will not be called. 527 * 528 * @param ctx: context. 529 * @param async_id: which query to cancel. 530 * @return 0 if OK, else error. 531 * This routine can return an error if the async_id passed does not exist 532 * or has already been delivered. If another thread is processing results 533 * at the same time, the result may be delivered at the same time and the 534 * cancel fails with an error. Also the cancel can fail due to a system 535 * error, no memory or socket failures. 536 */ 537 int ub_cancel(struct ub_ctx* ctx, int async_id); 538 539 /** 540 * Free storage associated with a result structure. 541 * @param result: to free 542 */ 543 void ub_resolve_free(struct ub_result* result); 544 545 /** 546 * Convert error value to a human readable string. 547 * @param err: error code from one of the libunbound functions. 548 * @return pointer to constant text string, zero terminated. 549 */ 550 const char* ub_strerror(int err); 551 552 /** 553 * Debug routine. Print the local zone information to debug output. 554 * @param ctx: context. Is finalized by the routine. 555 * @return 0 if OK, else error. 556 */ 557 int ub_ctx_print_local_zones(struct ub_ctx* ctx); 558 559 /** 560 * Add a new zone with the zonetype to the local authority info of the 561 * library. 562 * @param ctx: context. Is finalized by the routine. 563 * @param zone_name: name of the zone in text, "example.com" 564 * If it already exists, the type is updated. 565 * @param zone_type: type of the zone (like for unbound.conf) in text. 566 * @return 0 if OK, else error. 567 */ 568 int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, 569 const char *zone_type); 570 571 /** 572 * Remove zone from local authority info of the library. 573 * @param ctx: context. Is finalized by the routine. 574 * @param zone_name: name of the zone in text, "example.com" 575 * If it does not exist, nothing happens. 576 * @return 0 if OK, else error. 577 */ 578 int ub_ctx_zone_remove(struct ub_ctx* ctx, const char *zone_name); 579 580 /** 581 * Add localdata to the library local authority info. 582 * Similar to local-data config statement. 583 * @param ctx: context. Is finalized by the routine. 584 * @param data: the resource record in text format, for example 585 * "www.example.com IN A 127.0.0.1" 586 * @return 0 if OK, else error. 587 */ 588 int ub_ctx_data_add(struct ub_ctx* ctx, const char *data); 589 590 /** 591 * Remove localdata from the library local authority info. 592 * @param ctx: context. Is finalized by the routine. 593 * @param data: the name to delete all data from, like "www.example.com". 594 * @return 0 if OK, else error. 595 */ 596 int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data); 597 598 /** 599 * Get a version string from the libunbound implementation. 600 * @return a static constant string with the version number. 601 */ 602 const char* ub_version(void); 603 604 #ifdef __cplusplus 605 } 606 #endif 607 608 #endif /* _UB_UNBOUND_H */ 609