1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
/* Copyright (C) 2024 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
/*!
* \file
*
* \brief Pure TLS functionality.
*
* \addtogroup quic
* @{
*/
#pragma once
#include <stdbool.h>
#include <stdint.h>
#include <sys/types.h>
struct gnutls_priority_st;
typedef enum {
KNOT_TLS_CONN_HANDSHAKE_DONE = (1 << 0),
KNOT_TLS_CONN_SESSION_TAKEN = (1 << 1), // unused, to be implemeted later
KNOT_TLS_CONN_BLOCKED = (1 << 2),
} knot_tls_conn_flag_t;
typedef struct knot_tls_ctx {
struct knot_creds *creds;
struct gnutls_priority_st *priority;
unsigned handshake_timeout;
unsigned io_timeout;
bool server;
} knot_tls_ctx_t;
typedef struct knot_tls_conn {
struct gnutls_session_int *session;
struct knot_tls_ctx *ctx;
int fd;
unsigned fd_clones_count;
knot_tls_conn_flag_t flags;
} knot_tls_conn_t;
/*!
* \brief Initialize DoT answering context.
*
* \param creds Certificate credentials.
* \param io_timeout Connections' IO-timeout (in milliseconds).
* \param hs_timeout Handshake timeout (in milliseconds).
* \param server Server context (otherwise client).
*
* \return Initialized context or NULL.
*/
knot_tls_ctx_t *knot_tls_ctx_new(struct knot_creds *creds, unsigned io_timeout,
unsigned hs_timeout, bool server);
/*!
* \brief Free DoT answering context.
*/
void knot_tls_ctx_free(knot_tls_ctx_t *ctx);
/*!
* \brief Initialize DoT connection.
*
* \param ctx DoT answering context.
* \param sock_fd Opened TCP connection socket.
*
* \return Connection struct or NULL.
*/
knot_tls_conn_t *knot_tls_conn_new(knot_tls_ctx_t *ctx, int sock_fd);
/*!
* \brief Free DoT connection struct.
*
* \note Doesn't close the TCP connection socket.
*/
void knot_tls_conn_del(knot_tls_conn_t *conn);
/*!
* \brief Perform the TLS handshake (via gnutls_handshake()).
*
* \note This is also done by the recv/send functions.
*
* \param conn DoT connection.
* \param oneshot If set, don't wait untill the handshake is finished.
*
* \retval KNOT_EOK Handshake successfully finished.
* \retval KNOT_EGAIN Handshake not finished, call me again.
* \retval KNOT_NET_EHSHAKE Handshake error.
* \retval KNOT_NET_ECONNECT Socket not connected.
*/
int knot_tls_handshake(knot_tls_conn_t *conn, bool oneshot);
/*!
* \brief Receive a size-word-prefixed DNS message.
*
* \param conn DoT connection.
* \param data Destination buffer.
* \param size Maximum buffer size.
*
* \return Either the DNS message size received or negative error code.
*
* \note The two-byte-size-prefix is stripped upon reception, not stored to the buffer.
*/
ssize_t knot_tls_recv_dns(knot_tls_conn_t *conn, void *data, size_t size);
/*!
* \brief Send a size-word-prefixed DNS message.
*
* \param conn DoT connection.
* \param data DNS payload.
* \param size Payload size.
*
* \return Either exactly 'size' or a negative error code.
*/
ssize_t knot_tls_send_dns(knot_tls_conn_t *conn, void *data, size_t size);
/*!
* \brief Set or unset the conection's BLOCKED flag.
*/
void knot_tls_conn_block(knot_tls_conn_t *conn, bool block);
/*! @} */
|
