qdns_dane.h File Reference

definitions for DNS DANE information More...

#include <stdint.h>
#include <sys/types.h>

Go to the source code of this file.

Data Structures
struct	daneinfo
	contents of one DNS DANE record More...

Enumerations
enum	tlsa_cu {   TLSA_CU_PKIX_TA = 0, TLSA_CU_PKIX_EE = 1, TLSA_CU_DANE_TA = 2, TLSA_CU_DANE_EE = 3,   TLSA_CU_PrivCert = 255 }
	labels for TLSA certificate usage values More...
enum	tlsa_sel { TLSA_SEL_Cert = 0, TLSA_SEL_SPKI = 1, TLSA_SEL_PrivSel = 255 }
	labels for TLSA selector values More...
enum	tlsa_mt { TLSA_MT_Full = 0, TLSA_MT_SHA2_256 = 1, TLSA_MT_SHA2_512 = 2, TLSA_MT_PrivMatch = 255 }
	labels for TLSA matching type values More...

Functions
int	dnstlsa (const char *host, const unsigned short port, struct daneinfo **out)
	check for TLSA record of the given host More...

Detailed Description

definitions for DNS DANE information

Enumeration Type Documentation

enum tlsa_cu

labels for TLSA certificate usage values

Enumerator
TLSA_CU_PKIX_TA	CA constraint
TLSA_CU_PKIX_EE	Service certificate constraint
TLSA_CU_DANE_TA	Trust anchor assertion
TLSA_CU_DANE_EE	Domain-issued certificate
TLSA_CU_PrivCert	Reserved for Private Use

enum tlsa_mt

labels for TLSA matching type values

Enumerator
TLSA_MT_Full	No hash used
TLSA_MT_SHA2_256	256 bit hash by SHA2
TLSA_MT_SHA2_512	512 bit hash by SHA2
TLSA_MT_PrivMatch	Reserved for Private Use

enum tlsa_sel

labels for TLSA selector values

Enumerator
TLSA_SEL_Cert	Full certificate
TLSA_SEL_SPKI	SubjectPublicKeyInfo
TLSA_SEL_PrivSel	Reserved for Private Use

Function Documentation

int dnstlsa	(	const char *	host,
		const unsigned short	port,
		struct daneinfo **	out
	)

check for TLSA record of the given host

Parameters

host	the host name to check
port	the port of the host to check
out	if not NULL TLSA info will be returned here

Returns

the number of TLSA entries

Return values

<0	error code from dns_errors enum

If out is NULL the return value is the number of structs that would have been returned.

The protocol in the DNS lookup is always _tcp.

The DNS answers are NOT (yet?) checked for DNSSEC signatures.