Merge pull request #7903 from Habbie/dnsdist-doc-nits

[thirdparty/pdns.git] / pdns / dnscrypt.hh

diff --git a/pdns/dnscrypt.hh b/pdns/dnscrypt.hh
index fea11f0c7f8abfa70154fcc653d2eb39d0804770..86ddcd20159fdad28b485fd3b97bafa7dab323bc 100644 (file)
--- a/pdns/dnscrypt.hh
+++ b/pdns/dnscrypt.hh
@@ -22,7 +22,26 @@
 #pragma once
 #include "config.h"
 
-#ifdef HAVE_DNSCRYPT
+#ifndef HAVE_DNSCRYPT
+
+/* let's just define a few types and values so that the rest of
+   the code can ignore whether DNSCrypt support is available */
+#define DNSCRYPT_MAX_RESPONSE_PADDING_AND_MAC_SIZE (0)
+
+class DNSCryptContext
+{
+};
+
+class DNSCryptQuery
+{
+  DNSCryptQuery(const std::shared_ptr<DNSCryptContext>& ctx): d_ctx(ctx)
+  {
+  }
+private:
+  std::shared_ptr<DNSCryptContext> d_ctx{nullptr};
+};
+
+#else /* HAVE_DNSCRYPT */
 
 #include <memory>
 #include <string>
@@ -98,7 +117,7 @@ public:
   }
   bool isValid(time_t now) const
   {
-    return ntohl(getTSStart()) <= now && now <= ntohl(getTSEnd());
+    return ntohl(getTSStart()) <= static_cast<uint32_t>(now) && static_cast<uint32_t>(now) <= ntohl(getTSEnd());
   }
   unsigned char magic[DNSCRYPT_CERT_MAGIC_SIZE];
   unsigned char esVersion[2];
@@ -152,7 +171,7 @@ struct DNSCryptCertificatePair
 class DNSCryptQuery
 {
 public:
-  DNSCryptQuery(std::shared_ptr<DNSCryptContext> ctx): d_ctx(ctx)
+  DNSCryptQuery(const std::shared_ptr<DNSCryptContext>& ctx): d_ctx(ctx)
   {
   }
   ~DNSCryptQuery();
@@ -182,7 +201,7 @@ public:
     return d_encrypted;
   }
 
-  void setCertificatePair(std::shared_ptr<DNSCryptCertificatePair> pair)
+  void setCertificatePair(const std::shared_ptr<DNSCryptCertificatePair>& pair)
   {
     d_pair = pair;
   }
@@ -213,7 +232,7 @@ private:
   std::shared_ptr<DNSCryptCertificatePair> d_pair{nullptr};
   uint16_t d_id{0};
   uint16_t d_len{0};
-  uint16_t d_paddedLen;
+  uint16_t d_paddedLen{0};
   bool d_encrypted{false};
   bool d_valid{false};
 
@@ -238,15 +257,16 @@ public:
   DNSCryptContext(const std::string& pName, const std::string& certFile, const std::string& keyFile);
   DNSCryptContext(const std::string& pName, const DNSCryptCert& certificate, const DNSCryptPrivateKey& pKey);
 
-  void loadNewCertificate(const std::string& certFile, const std::string& keyFile, bool active=true);
-  void addNewCertificate(const DNSCryptCert& newCert, const DNSCryptPrivateKey& newKey, bool active=true);
+  void reloadCertificate();
+  void loadNewCertificate(const std::string& certFile, const std::string& keyFile, bool active=true, bool reload=false);
+  void addNewCertificate(const DNSCryptCert& newCert, const DNSCryptPrivateKey& newKey, bool active=true, bool reload=false);
   void markActive(uint32_t serial);
   void markInactive(uint32_t serial);
   void removeInactiveCertificate(uint32_t serial);
   std::vector<std::shared_ptr<DNSCryptCertificatePair>> getCertificates() { return certs; };
   const DNSName& getProviderName() const { return providerName; }
 
-  int encryptQuery(char* query, uint16_t queryLen, uint16_t querySize, const unsigned char clientPublicKey[DNSCRYPT_PUBLIC_KEY_SIZE], const DNSCryptPrivateKey& clientPrivateKey, const unsigned char clientNonce[DNSCRYPT_NONCE_SIZE / 2], bool tcp, uint16_t* encryptedResponseLen, const std::shared_ptr<DNSCryptCert> cert) const;
+  int encryptQuery(char* query, uint16_t queryLen, uint16_t querySize, const unsigned char clientPublicKey[DNSCRYPT_PUBLIC_KEY_SIZE], const DNSCryptPrivateKey& clientPrivateKey, const unsigned char clientNonce[DNSCRYPT_NONCE_SIZE / 2], bool tcp, uint16_t* encryptedResponseLen, const std::shared_ptr<DNSCryptCert>& cert) const;
   bool magicMatchesAPublicKey(DNSCryptQuery& query, time_t now);
   void getCertificateResponse(time_t now, const DNSName& qname, uint16_t qid, std::vector<uint8_t>& response);
 
@@ -257,6 +277,8 @@ private:
   pthread_rwlock_t d_lock;
   std::vector<std::shared_ptr<DNSCryptCertificatePair>> certs;
   DNSName providerName;
+  std::string certificatePath;
+  std::string keyPath;
 };
 
 bool generateDNSCryptCertificate(const std::string& providerPrivateKeyFile, uint32_t serial, time_t begin, time_t end, DNSCryptExchangeVersion version, DNSCryptCert& certOut, DNSCryptPrivateKey& keyOut);