net: add DANE support for DNSSEC stapled certificates.

net/base/dnssec_chain_verifier.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_DNSSEC_CHAIN_VERIFIER_H_
 #define NET_BASE_DNSSEC_CHAIN_VERIFIER_H_
 
 #include <map>
 #include <string>
 #include <vector>
@@ skipping 60 matching lines @@
   bool ReadAheadKey(base::StringPiece*, uint8 entry_key);
   bool ReadDNSKEYs(std::vector<base::StringPiece>*, bool is_root);
   bool DigestKey(base::StringPiece* digest,
                  const base::StringPiece& name,
                  const base::StringPiece& dnskey,
                  uint8 digest_type,
                  uint16 keyid,
                  uint8 algorithm);
 
   Error EnterRoot();
+  static bool IsValidTerminalRRType(uint16 rrtype);
   Error EnterZone(const base::StringPiece& zone);
   Error LeaveZone(base::StringPiece* next_name);
   Error ReadDSSet(std::vector<base::StringPiece>*,
                   const base::StringPiece& next_name);
   Error ReadGenericRRs(std::vector<base::StringPiece>*);
   Error ReadCNAME(std::vector<base::StringPiece>*);
 
   Zone* current_zone_;
   std::string target_;
   base::StringPiece chain_;
   bool ignore_timestamps_;
   bool valid_;
   // already_entered_zone_ is set to true when we unwind a Zone chain and start
   // off from a point where we have already entered a zone.
   bool already_entered_zone_;
   uint16 rrtype_;
   std::vector<base::StringPiece> rrdatas_;
   // A list of pointers which need to be free()ed on destruction.
   std::vector<void*> scratch_pool_;
 };
 
 // DnsCAARecord encapsulates code and types for dealing with Certificate
 // Authority Authorization records. These are DNS records which can express
 // limitations regarding acceptable certificates for a domain. See
 // http://tools.ietf.org/html/draft-hallambaker-donotissue-04
+// TODO(agl): remove once DANE support has been released.
 class NET_EXPORT_PRIVATE DnsCAARecord {
  public:
   enum ParseResult {
     SUCCESS,  // parse successful.
     DISCARD,  // no policies applying to this client were found.
     SYNTAX_ERROR,  // the record was syntactically invalid.
     UNKNOWN_CRITICAL,  // a critical record was not understood.
   };
 
   // A CAAPolicy is the result of parsing a set of CAA records. It describes a
@@ skipping 21 matching lines @@
 
     std::vector<Hash> authorized_hashes;
   };
 
   // Parse parses a series of DNS resource records and sets |output| to the
   // result.
   static ParseResult Parse(const std::vector<base::StringPiece>& rrdatas,
                            Policy* output);
 };
 
+class NET_EXPORT_PRIVATE DnsTLSARecord {
+ public:
+  // A Match is an authorized certificate or public key from the TLSA records.
+  struct NET_EXPORT_PRIVATE Match {
+    // A HashTarget identifies the object that we are hashing.
+    enum HashTarget {
+      CERTIFICATE,
+      SUBJECT_PUBLIC_KEY_INFO,
+    };
+
+    HashTarget target;  // what do we hash?
+    // algorithm is an NSS HASH_HashType (i.e. HASH_AlgSHA1). But note that
+    // it can also be HASH_AlgNULL to indicate that |data| isn't hashed at
+    // all.
+    int algorithm;
+    std::string data;  // digest, or raw data if |algorithm == HASH_AlgNULL|.
+  };
+
+  // Parse parses a series of TLSA resource records and sets |output| to the
+  // result. Unknown or invalid records are ignored, as are records with a
+  // usage other than "domain-issued certificate". See

[Ryan Sleevi, 2012/10/18 23:21:13]

nit: mention the specific value (usage 3), since the actual reference to
"domain-issued certificate" doesn't appear until you've read all the inner
usages text.

[agl, 2012/10/29 15:41:56]

Done.

+  // https://tools.ietf.org/html/rfc6698#section-2.1.1.
+  static void Parse(const std::vector<base::StringPiece>& rrdatas,

[Ryan Sleevi, 2012/10/18 23:21:13]

DESIGN: Usage types 0 - 2 are used to establish pinning data. While it's not
necessary to support it yet, it will be important to think about how this
structure may need to change to accomodate it, before it's too widely used.

+                    std::vector<Match>* output);
+};
+
 }  // namespace net
 
 #endif  // NET_BASE_DNSSEC_CHAIN_VERIFIER_H_