OLD | NEW |
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ | 5 #ifndef NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ |
6 #define NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ | 6 #define NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/string_piece.h" | 12 #include "base/string_piece.h" |
13 #include "net/base/dnssec_keyset.h" | |
14 | 13 |
15 namespace net { | 14 namespace net { |
16 | 15 |
17 // DNSSECChainVerifier verifies a chain of DNSSEC records. These records | 16 // DNSSECChainVerifier verifies a chain of DNSSEC records. These records |
18 // eventually prove the validity of a set of resource records for the target | 17 // eventually prove the validity of a set of resource records for the target |
19 // name. For example, if the fingerprint of a certificate was stored in a CERT | 18 // name. For example, if the fingerprint of a certificate was stored in a CERT |
20 // record for a given domain, then a chain could prove the validity of that | 19 // record for a given domain, then a chain could prove the validity of that |
21 // fingerprint. | 20 // fingerprint. |
22 class DNSSECChainVerifier { | 21 class DNSSECChainVerifier { |
23 public: | 22 public: |
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
60 // rrdata: the raw TXT RRDATA from DNS | 59 // rrdata: the raw TXT RRDATA from DNS |
61 // returns: an empty map on failure, or the result of the parse. | 60 // returns: an empty map on failure, or the result of the parse. |
62 static std::map<std::string, std::string> | 61 static std::map<std::string, std::string> |
63 ParseTLSTXTRecord(base::StringPiece rrdata); | 62 ParseTLSTXTRecord(base::StringPiece rrdata); |
64 | 63 |
65 // Exposed for testing only. | 64 // Exposed for testing only. |
66 static unsigned MatchingLabels(base::StringPiece a, | 65 static unsigned MatchingLabels(base::StringPiece a, |
67 base::StringPiece b); | 66 base::StringPiece b); |
68 | 67 |
69 private: | 68 private: |
70 struct Zone { | 69 struct Zone; |
71 base::StringPiece name; | |
72 // The number of consecutive labels which |name| shares with |target_|, | |
73 // counting right-to-left from the root. | |
74 unsigned matching_labels; | |
75 DNSSECKeySet trusted_keys; | |
76 Zone* prev; | |
77 }; | |
78 | 70 |
79 bool U8(uint8*); | 71 bool U8(uint8*); |
80 bool U16(uint16*); | 72 bool U16(uint16*); |
81 bool VariableLength16(base::StringPiece*); | 73 bool VariableLength16(base::StringPiece*); |
82 bool ReadName(base::StringPiece*); | 74 bool ReadName(base::StringPiece*); |
83 | 75 |
84 bool ReadAheadEntryKey(base::StringPiece*); | 76 bool ReadAheadEntryKey(base::StringPiece*); |
85 bool ReadAheadKey(base::StringPiece*, uint8 entry_key); | 77 bool ReadAheadKey(base::StringPiece*, uint8 entry_key); |
86 bool ReadDNSKEYs(std::vector<base::StringPiece>*, bool is_root); | 78 bool ReadDNSKEYs(std::vector<base::StringPiece>*, bool is_root); |
87 bool DigestKey(base::StringPiece* digest, | 79 bool DigestKey(base::StringPiece* digest, |
(...skipping 21 matching lines...) Expand all Loading... |
109 bool already_entered_zone_; | 101 bool already_entered_zone_; |
110 uint16 rrtype_; | 102 uint16 rrtype_; |
111 std::vector<base::StringPiece> rrdatas_; | 103 std::vector<base::StringPiece> rrdatas_; |
112 // A list of pointers which need to be free()ed on destruction. | 104 // A list of pointers which need to be free()ed on destruction. |
113 std::vector<void*> scratch_pool_; | 105 std::vector<void*> scratch_pool_; |
114 }; | 106 }; |
115 | 107 |
116 } // namespace net | 108 } // namespace net |
117 | 109 |
118 #endif // NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ | 110 #endif // NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ |
OLD | NEW |