ssl/dnssec.c

   1 #include <openssl/opensslconf.h>
   2
   3 #include <string.h>
   4 #include <netdb.h>
   5 #include <openssl/bio.h>
   6 #include <openssl/dso.h>
   7
   8 #ifndef OPENSSL_NO_LIBUNBOUND
   9 #include <unbound.h>
  10
  11 static struct ub_ctx *ctx = NULL;
  12 static DSO *unbound_dso = NULL;
  13
  14 static union {
  15         void *p; struct ub_ctx *(*f)(); }
  16         p_ub_ctx_create = {NULL};
  17
  18 static union {
  19         void *p; int (*f)(struct ub_ctx *,const char *); }
  20         p_ub_ctx_resolvconf = {NULL};
  21
  22 static union {
  23         void *p; int (*f)(struct ub_ctx *,const char *); }
  24         p_ub_ctx_add_ta_file = {NULL};
  25
  26 static union {
  27         void *p; void (*f)(struct ub_ctx *); }
  28         p_ub_ctx_delete = {NULL};
  29
  30 static union {
  31         void *p; int (*f)(struct ub_ctx *,const char *,int,int,struct ub_result**); }
  32         p_ub_resolve = {NULL};
  33
  34 static union {
  35         void *p; void (*f)(struct ub_result*); }
  36         p_ub_resolve_free = {NULL};
  37
  38 #if defined(__GNUC__) && __GNUC__>=2
  39  static void unbound_init(void) __attribute__((constructor));
  40  static void unbound_fini(void) __attribute__((destructor));
  41 #endif
  42
  43 static void unbound_init(void)
  44 {
  45         DSO *dso;
  46
  47         if ((dso = DSO_load(NULL, "unbound", NULL, 0)) == NULL) return;
  48
  49         if ((p_ub_ctx_create.p = DSO_bind_func(dso,"ub_ctx_create")) == NULL ||
  50             (p_ub_ctx_resolvconf.p = DSO_bind_func(dso,"ub_ctx_resolvconf")) == NULL ||
  51             (p_ub_ctx_add_ta_file.p = DSO_bind_func(dso,"ub_ctx_add_ta_file")) == NULL ||
  52             (p_ub_ctx_delete.p = DSO_bind_func(dso,"ub_ctx_delete")) == NULL ||
  53             (p_ub_resolve.p = DSO_bind_func(dso,"ub_resolve")) == NULL ||
  54             (p_ub_resolve_free.p = DSO_bind_func(dso,"ub_resolve_free")) == NULL ||
  55             (ctx = p_ub_ctx_create.f()) == NULL) {
  56                 DSO_free(dso);
  57                 return;
  58         }
  59
  60         unbound_dso = dso;
  61
  62         /* FIXME: parameterize these through CONF */
  63         p_ub_ctx_resolvconf.f(ctx,"/etc/resolv.conf");
  64         p_ub_ctx_add_ta_file.f(ctx,"/var/lib/unbound/root.key");
  65 }
  66
  67 static void unbound_fini(void)
  68 {
  69         if (ctx != NULL) p_ub_ctx_delete.f(ctx);
  70         if (unbound_dso != NULL) DSO_free(unbound_dso);
  71 }
  72 #endif
  73
  74 /*
  75  * Output is array packed as [len][data][len][data][0]
  76  */
  77 unsigned char *SSL_get_tlsa_record_byname (const char *name,int port,int type)
  78 {
  79         unsigned char *ret=NULL;
  80         char *query=NULL;
  81         size_t qlen;
  82
  83         if (ctx == NULL) return NULL;
  84
  85         qlen = 7+5+strlen(name)+1;
  86         if ((query = OPENSSL_malloc(qlen)) == NULL)
  87                 return NULL;
  88
  89         BIO_snprintf(query,qlen,"_%u._%s.%s",port&0xffff,type==SOCK_STREAM?"tcp":"udp",name);
  90
  91 #ifndef OPENSSL_NO_LIBUNBOUND
  92         {
  93         struct ub_result *tlsa=NULL;
  94
  95         if (p_ub_resolve.f(ctx,query,52,1,&tlsa)==0 &&
  96             tlsa->havedata && tlsa->data[0]!=NULL) {
  97                 ret=(void*)-1;  /* -1 means insecure */
  98                 if (tlsa->secure) do {
  99                         unsigned char *data;
 100                         unsigned int dlen, i;
 101
 102                         for (dlen=0, i=0; tlsa->data[i]; i++)
 103                                 dlen += sizeof(int)+(unsigned int)tlsa->len[i];
 104                         dlen +=sizeof(int);
 105
 106                         if ((ret = OPENSSL_malloc(dlen)) == NULL) break;
 107
 108                         for (data=ret, i=0; tlsa->data[i]; i++) {
 109                                 *(unsigned int *)data = dlen = (unsigned int)tlsa->len[i];
 110                                 data += sizeof(unsigned int);
 111                                 memcpy(data,tlsa->data[i],dlen);
 112                                 data += dlen;
 113                         }
 114                         *(unsigned int *)data = 0;      /* trailing zero */
 115                 } while (0);
 116                 p_ub_resolve_free.f(tlsa);
 117         }
 118         }
 119 #elif defined(RRSET_VALIDATED)
 120         do {
 121         static union {
 122                 void *p; int (*f)(const char*,unsigned int,unsigned int,unsigned int,struct rrsetinfo **); }
 123                 p_getrrsetbyname = {NULL};
 124         static union {
 125                 void *p; void (*f)(struct rrsetinfo *); }
 126                 p_freerrset = {NULL};
 127
 128         struct rrsetinfo *rrset=NULL;
 129
 130         if (p_getrrsetbyname.p==NULL) {
 131                 if ((p_getrrsetbyname.p = DSO_global_lookup("getrrsetbyname")) == NULL ||
 132                     (p_freerrset.p = DSO_global_lookup("freerrset")) == NULL)
 133                         p_getrrsetbyname.p = (void*)-1;
 134         }
 135
 136         if (p_getrrsetbyname.p == (void *)-1) break;
 137
 138         if (p_getrrsetbyname.f(query,1,52,RRSET_VALIDATED,&rrset) == 0 && rrset->rri_nrdatas) {
 139                 ret=(void*)-1;  /* -1 means insecure */
 140                 if ((rrset->rri_flags&RRSET_VALIDATED)) do {
 141                         unsigned char *data;
 142                         unsigned int dlen, i;
 143
 144                         for (dlen=0, i=0; i<rrset->rri_nrdatas; i++)
 145                                 dlen += sizeof(int)+rrset->rri_rdatas[i].rdi_length;
 146                         dlen +=sizeof(int);
 147
 148                         if ((ret = OPENSSL_malloc(sizeof(int)+dlen)) == NULL) break;
 149
 150                         for (data=ret, i=0; i<rrset->rri_rdatas[i].rdi_length; i++) {
 151                                 *(unsigned int *)data = dlen = rrset->rri_rdatas[i].rdi_length;
 152                                 data += sizeof(unsigned int);
 153                                 memcpy(data,rrset->rri_rdatas[i].rdi_data,dlen);
 154                                 data += dlen;
 155                         }
 156                         *(unsigned int *)data = 0;      /* trailing zero */
 157                 } while (0);
 158                 p_freerrset.f(rrset);
 159         }
 160         } while (0);
 161 #elif defined(_WIN32_NOT_YET)
 162         {
 163         PDNS_RECORD rrset;
 164
 165         DnsQuery_A(query,52,DNS_QUERY_STANDARD,NULL,&rrset,NULL);
 166         DnsRecordListFree(rrset,DnsFreeRecordList);
 167         }
 168 #endif
 169         CRYPTO_free(query);
 170
 171         return ret;
 172 }