Provided by: libvbr-dev_2.9.1-1_amd64 bug

NAME

       vbr_init(),  vbr_options(),  vbr_close(),  vbr_geterror(), vbr_getheader(), vbr_setcert(),
       vbr_settype(),   vbr_setdomain(),   vbr_trustedcerts(),   vbr_query(),   vbr_settimeout(),
       vbr_setcallbackint(),              vbr_setcallbackctx(),             vbr_setdnscallback(),
       vbr_dns_set_query_service(),    vbr_dns_set_query_start(),     vbr_dns_set_query_cancel(),
       vbr_dns_set_query_waitreply(),      vbr_dns_set_query_waitreply(),     vbr_dns_set_init(),
       vbr_dns_set_close(),              vbr_dns_set_nslist(),              vbr_dns_set_config(),
       vbr_dns_set_trustanchor(), vbr_dns_init() - Vouch By Reference service facility

SYNOPSIS

       #include <vbr.h>

       VBR * vbr_init (void *(* mallocf )(void *, size_t), void (* freef )(void *, void *p), void
       * closure );

       void vbr_options (VBR * vbr , unsigned int opts );

       unsigned char * vbr_geterror (VBR * vbr );

       VBR_STAT vbr_getheader (VBR * vbr, unsigned char * hdr, size_t len );

       void vbr_setcert (VBR * vbr, unsigned char * cert );

       void vbr_settype (VBR * vbr, unsigned char * cert );

       void vbr_setdomain (VBR * vbr, unsigned char * cert );

       void vbr_trustedcerts (VBR * vbr, unsigned char ** cert );

       VBR_STAT vbr_query (VBR * vbr, unsigned char ** res, unsigned char ** cert );

       VBR_STAT vbr_settimeout (VBR * vbr, unsigned int timeout );

       VBR_STAT vbr_setcallbackint (VBR * vbr, unsigned int cbint );

       VBR_STAT vbr_setcallbackctx (VBR *, vbr, void * ctx );

       VBR_STAT vbr_setdnscallback (VBR *, vbr, void (* func )(const void *));

       void * vbr_dns_set_query_service (VBR * vbr, void * svc );

       void vbr_dns_set_query_cancel (VBR * vbr, int (* func )(void *, void *));

       void vbr_dns_set_query_start (VBR * vbr, int (* func  )(void  *,  int,  unsigned  char  *,
       unsigned char *, size_t, void **));

       void  vbr_dns_set_query_waitreply (VBR * vbr, int (* func )(void *, void *, struct timeval
       *, size_t *, int *, int *));

       void vbr_dns_set_init (VBR * vbr, int (* func )(void **);

       void vbr_dns_set_close (VBR * vbr, int (* func )(void *);

       void vbr_dns_set_config (VBR * vbr, int (* func )(void *, const char *);

       void vbr_dns_set_nslist (VBR * vbr, int (* func )(void *, const char *);

       void vbr_dns_set_trustanchor (VBR * vbr, int (* func )(void *, const char *);

       VBR_STAT vbr_dns_init (VBR * vbr );

       void vbr_close (VBR *);

DESCRIPTION

       These functions are an interface to a facility to conduct Vouch By Reference (VBR) queries
       and return their results.  VBR is defined in RFC5518.

       An  application first initializes the package by calling vbr_init().  The optional mallocf
       parameter is a caller-provided memory allocation function taking a pointer  to  a  caller-
       provided  opaque data structure (the closure parameter) and a number of bytes to allocate.
       If mallocf is not provided, the default system  memory  allocator  function  malloc(3)  is
       used.    The   optional  freef  parameter  specifies  a  matching  caller-provided  memory
       deallocator function, taking a pointer to a caller-provided  opaque  data  structure  (the
       closure  parameter) and a pointer to the memory to be released.  If freef is not provided,
       the default system memory release function free(3) is used.  A handle for  future  use  of
       the  initialized  library  instance is returned, or NULL on error and errno will be set to
       indicate the cause of the failure.

       The caller can use vbr_options() to set query processing options.  See the OPTIONS section
       for details.

       The  vbr_geterror()  function  can  be  used  to poll the library for an error string that
       provides further description for the most recent failed operation.

       Calling vbr_getheader() can be used to generate an RFC-compliant  VBR-Info:  haeder  field
       based  on  data  provided by other accessor functions, namely vbr_setcert(), vbr_settype()
       and vbr_setdomain() (below).  A library instance is provided as the first parameter, and a
       pointer  to  the  destination  buffer and its length are provided in the second and third.
       Note that only the value of the header field is stored into the buffer, not its name;  the
       standard name of the header field is available as the VBR_INFOHEADER macro.

       vbr_setcert()  takes  a  VBR  library instance as its first argument and a colon-separated
       list of claimed vouching domains as its second.  Similarly, vbr_settype() sets the message
       type, and vbr_setdomain() sets the sending domain.  These correspond, respectively, to the
       "mv", "mc" and "md" values from a received message's VBR-Info header field.  These  values
       are  used by the library instance when calling vbr_getheader() to generate VBR information
       header fields to attach to outgoing messages or when calling vbr_query() to  check  for  a
       vouching  reference.   Note  that the library does no validation of the possible values of
       the message type (to allow for new message types that may appear outside of  the  original
       RFC), and has no context to validate the domain.

       vbr_trustedcerts()  takes  a  VBR  library  instance  as  its  first  argument and a NULL-
       terminated array of  pointers  to  certifier  names  as  its  second,  which  is  used  by
       vbr_query()  to  select  vouching  services  the caller trusts.  The intersection of these
       trusted certifiers and those claimed by an arriving message.  The list is initially empty.

       vbr_query() polls trusted certifiers to see if any of them agree with the  assertion  made
       by  the message sender.  The pointer res will be set to point to a result string after the
       query has been resolved.  The result will be "pass" if  any  trusted  certifier  concurred
       with  the  assertion made by the sender.  If cert is not NULL, it will be updated to point
       to the name of the trusted certifier that concurred with the  sender's  assertion  when  a
       "pass"  result  is  returned.   If  any  queries  were  made  but none of them resulted in
       concurrence, a result of "fail" is returned.  If no query was made because  of  errors  or
       because  the  trusted certifier set and the sender's certifier set included no vouchers in
       common, cert will be unchanged.

       The vbr_settimeout() function can be used to change the query timeout.  The default is ten
       seconds.   Note  that  this  timeout  is  applied  for  each  voucher  query, so a call to
       vbr_query() can take longer than this if multiple queries need to be made.

       If it is useful to have the library periodically  call  a  user-provided  function  as  an
       indication  that queries are still in progress, such a function can be registered with the
       vbr_setdnscallback() function.  The function provided should take a void  context  pointer
       as  its  sole  argument.   vbr_setcallbackctx()  is  used to tell the library what context
       pointer should be used,  and  vbr_setcallbackint()  is  used  to  tell  the  library  what
       frequency, in seconds, should be used to call that callback function.  Each of these takes
       the corresponding VBR library handle as its first argument, and the obvious parameter  for
       its second.

       By  default,  the  library  will use the stock system resolver to conduct DNS queries.  If
       alternates should be used, these can be specified using the following functions:

       vbr_dns_set_query_service() sets a context pointer to the query service  to  be  used,  if
       any.   This  will  be  passed  as-is  to the other DNS functions.  It returns its previous
       value.

       vbr_dns_set_query_cancel() sets a pointer to the function that should be called to  cancel
       an  open  query, and should take the following parameters: a void pointer to the DNS query
       service to be used, and a void pointer to a query handle as previously returned by a  call
       to  vbr_dns_set_query_start().   The  function  should  return one of the DNS result codes
       described below.

       vbr_dns_set_query_start() sets a pointer to the function that should be called to initiate
       a  new  query,  and  should take the following parameters: a void pointer to the DNS query
       service to be used, a DNS record type (e.g. T_TXT), a pointer to a string  containing  the
       query  to  be  started,  a pointer to a buffer into which the reply should be written, the
       number of bytes available in that buffer, and a pointer to a void  pointer  that  will  be
       updated  to  contain  a  unique  handle  for that query once started.  The function should
       return one of the DNS result codes described below.

       vbr_dns_set_query_waitreply() sets a pointer to the function that should be called to wait
       for  a reply to an open query, and should take the following parameters: a void pointer to
       the DNS query service to be used, a void pointer referencing  the  query  of  interest  as
       previously  returned  by  a  call  to  vbr_dns_set_query_start(),  a  pointer to a "struct
       timeval" structure indicating how long the function should wait for a reply  (or  NULL  if
       infinite  waiting  is acceptable), a pointer to a "size_t" that will be updated to contain
       the size of the received reply, a pointer to an integer that will contain an error code if
       the  query fails (can be NULL if that information is not interesting to the caller), and a
       pointer to an integer that will contain a DNSSEC status indication (can be  NULL  if  that
       information  is not interesting to the caller).  The function should return one of the DNS
       result codes described below.

       vbr_dns_set_init() sets a pointer to the  function  that  should  be  called  when  it  is
       necessary to initialize a resolver.  The function should store a handle to the initialized
       resolver and return zero, or return non-zero if initialization could not be completed.

       vbr_dns_set_close() sets a pointer to the function  that  should  be  called  when  it  is
       necessary  to  terminate  a  resolver.  The function will receive a handle referencing the
       resolver to be terminated, and should return zero on success or non-zero on failure.

       vbr_dns_set_nslist() sets a pointer to the function that  should  be  called  when  it  is
       necessary  to  change  the  set of nameservers that are to be used to resolve RBL queries.
       The function will receive a handle referencing the active resolver and a string containing
       a  comma-separated  list of nameservers to use.  It should return zero on success and non-
       zero on failure.

       vbr_dns_set_config() sets a pointer to the function that  should  be  called  when  it  is
       necessary  to  provide  arbitrary configuration information to the resolver.  The function
       will receive a handle  referencing  the  active  resolver  and  a  string  containing  the
       configuration.  It should return zero on success and non-zero on failure.

       vbr_dns_set_trustanchor()  sets a pointer to the function that should be called when it is
       necessary to provide trust anchor information (supporting DNSSEC) to  the  resolver.   The
       function will receive a handle referencing the active resolver and a string containing the
       trust anchor data.  It should return zero on success and non-zero on failure.

       Calling vbr_dns_init() forces  (re-)initialization  of  the  resolver.   This  essentially
       causes the library to call any initialization function defined by vbr_dns_set_init().

       When the library handle is no longer needed, it should be passed to vbr_close().

OPTIONS

       Setting  options  is  done  using  the  vbr_options()  function.   The opts parameter is a
       bitwise-OR list of the available options requested  by  the  application.   The  currently
       supported option:

       VBR_FLAG_TRUSTEDONLY
              By  default, a VBR query will be sent to the intersection of the trusted certifiers
              (provided by the vbr_trustedcerts() function) and the list of certifiers claimed on
              a  message (provided by the vbr_sercert() function).  With this option enabled, the
              trusted certifiers will be checked and the provided certifiers will be ignored.

RETURN VALUES

       The following return codes, of type VBR_STAT, can be returned:

       VBR_STAT_OK
              successful completion

       VBR_STAT_INVALID
              operation failed because an invalid parameter was provided

       VBR_STAT_DNSERROR
              operation could not be completed because of errors requesting or  receiving  a  DNS
              reply;  note  that  this  does  not  include a successful reply that contains a "no
              record found" result, which is a successful answer

       VBR_STAT_NORESOURCE
              a caller-provided buffer was too small to complete the requested  operation,  or  a
              memory or file descriptor allocation failed

       VBR_STAT_NOTIMPLEMENT
              an optional library feature was not selected at compilation time

DNS RETURN CODES

       Any registered DNS functions should return one of the following result codes:

       VBR_DNS_ERROR
              An error occurred.  The cause of the error can be retrieved using vbr_geterror().

       VBR_DNS_SUCCESS
              The operation was successful.

       VBR_DNS_REPLY
              A reply is available (returned by the "waitreply" function).

       VBR_DNS_NOREPLY
              No  reply  was  received by the time the query timeout was reached (returned by the
              "waitreply" function).

       VBR_DNS_EXPIRED
              The  query  expired  completely  (returned  by  the  "waitreply"  function).   Some
              resolvers set an overall timeout for the query at start time in addition to one for
              each single wait request; this code indicates the former timeout expired.

COPYRIGHT

       Copyright (c) 2010, 2012, The Trusted Domain Project.  All rights reserved.

SEE ALSO

       intro(2)

                                                                                        libvbr(3)