OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/base/dnssec_chain_verifier.h" | 5 #include "net/base/dnssec_chain_verifier.h" |
6 | 6 |
7 #include "base/logging.h" | 7 #include "base/logging.h" |
8 #include "base/memory/scoped_ptr.h" | 8 #include "base/memory/scoped_ptr.h" |
9 #include "base/sha1.h" | 9 #include "base/sha1.h" |
10 #include "base/sha2.h" | |
11 #include "base/string_util.h" | 10 #include "base/string_util.h" |
| 11 #include "crypto/sha2.h" |
12 #include "net/base/dns_util.h" | 12 #include "net/base/dns_util.h" |
13 #include "net/base/dnssec_keyset.h" | 13 #include "net/base/dnssec_keyset.h" |
14 | 14 |
15 // We don't have a location for the spec yet, so we'll include it here until it | 15 // We don't have a location for the spec yet, so we'll include it here until it |
16 // finds a better home. | 16 // finds a better home. |
17 | 17 |
18 /* | 18 /* |
19 When connecting to a host www.example.com, www.example.com may present a certifi
cate which includes a DNSSEC chain embedded in it. The aim of the embedded chain
is to prove that the fingerprint of the public key is valid DNSSEC data. This i
s achieved by proving a CERT record for the target domain. | 19 When connecting to a host www.example.com, www.example.com may present a certifi
cate which includes a DNSSEC chain embedded in it. The aim of the embedded chain
is to prove that the fingerprint of the public key is valid DNSSEC data. This i
s achieved by proving a CERT record for the target domain. |
20 | 20 |
21 Initially, the target domain is constructed by prepending _ssl. For example, the
initial target domain for www.example.com is _ssl.www.example.com. | 21 Initially, the target domain is constructed by prepending _ssl. For example, the
initial target domain for www.example.com is _ssl.www.example.com. |
(...skipping 487 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
509 // digest_type: see http://tools.ietf.org/html/rfc4034#appendix-A.2 | 509 // digest_type: see http://tools.ietf.org/html/rfc4034#appendix-A.2 |
510 // keyid: the key's id | 510 // keyid: the key's id |
511 // algorithm: see http://tools.ietf.org/html/rfc4034#appendix-A.1 | 511 // algorithm: see http://tools.ietf.org/html/rfc4034#appendix-A.1 |
512 bool DNSSECChainVerifier::DigestKey(base::StringPiece* out, | 512 bool DNSSECChainVerifier::DigestKey(base::StringPiece* out, |
513 const base::StringPiece& name, | 513 const base::StringPiece& name, |
514 const base::StringPiece& dnskey, | 514 const base::StringPiece& dnskey, |
515 uint8 digest_type, | 515 uint8 digest_type, |
516 uint16 keyid, | 516 uint16 keyid, |
517 uint8 algorithm) { | 517 uint8 algorithm) { |
518 std::string temp; | 518 std::string temp; |
519 uint8 temp2[base::SHA256_LENGTH]; | 519 uint8 temp2[crypto::SHA256_LENGTH]; |
520 const uint8* digest; | 520 const uint8* digest; |
521 unsigned digest_len; | 521 unsigned digest_len; |
522 | 522 |
523 std::string input = name.as_string() + dnskey.as_string(); | 523 std::string input = name.as_string() + dnskey.as_string(); |
524 | 524 |
525 if (digest_type == kDNSSEC_SHA1) { | 525 if (digest_type == kDNSSEC_SHA1) { |
526 temp = base::SHA1HashString(input); | 526 temp = base::SHA1HashString(input); |
527 digest = reinterpret_cast<const uint8*>(temp.data()); | 527 digest = reinterpret_cast<const uint8*>(temp.data()); |
528 digest_len = base::SHA1_LENGTH; | 528 digest_len = base::SHA1_LENGTH; |
529 } else if (digest_type == kDNSSEC_SHA256) { | 529 } else if (digest_type == kDNSSEC_SHA256) { |
530 base::SHA256HashString(input, temp2, sizeof(temp2)); | 530 crypto::SHA256HashString(input, temp2, sizeof(temp2)); |
531 digest = temp2; | 531 digest = temp2; |
532 digest_len = sizeof(temp2); | 532 digest_len = sizeof(temp2); |
533 } else { | 533 } else { |
534 return false; | 534 return false; |
535 } | 535 } |
536 | 536 |
537 uint8* output = static_cast<uint8*>(malloc(4 + digest_len)); | 537 uint8* output = static_cast<uint8*>(malloc(4 + digest_len)); |
538 scratch_pool_.push_back(output); | 538 scratch_pool_.push_back(output); |
539 output[0] = static_cast<uint8>(keyid >> 8); | 539 output[0] = static_cast<uint8>(keyid >> 8); |
540 output[1] = static_cast<uint8>(keyid); | 540 output[1] = static_cast<uint8>(keyid); |
(...skipping 260 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
801 base::StringPiece name; | 801 base::StringPiece name; |
802 if (!ReadName(&name)) | 802 if (!ReadName(&name)) |
803 return BAD_DATA; | 803 return BAD_DATA; |
804 | 804 |
805 rrdatas->resize(1); | 805 rrdatas->resize(1); |
806 (*rrdatas)[0] = name; | 806 (*rrdatas)[0] = name; |
807 return OK; | 807 return OK; |
808 } | 808 } |
809 | 809 |
810 } // namespace net | 810 } // namespace net |
OLD | NEW |