net: add DANE support for DNSSEC stapled certificates.

net/base/dnssec_chain_verifier.h

Index: net/base/dnssec_chain_verifier.h
diff --git a/net/base/dnssec_chain_verifier.h b/net/base/dnssec_chain_verifier.h
index 9fa80b8761ee7f63a954c04637aae0253b979fee..48d40bf64121701660a33a534689db792c6c83bd 100644
--- a/net/base/dnssec_chain_verifier.h
+++ b/net/base/dnssec_chain_verifier.h
@@ -78,6 +78,7 @@ class NET_EXPORT_PRIVATE DNSSECChainVerifier {
                  uint8 algorithm);
 
   Error EnterRoot();
+  static bool IsValidTerminalRRType(uint16 rrtype);
   Error EnterZone(const base::StringPiece& zone);
   Error LeaveZone(base::StringPiece* next_name);
   Error ReadDSSet(std::vector<base::StringPiece>*,
@@ -103,6 +104,7 @@ class NET_EXPORT_PRIVATE DNSSECChainVerifier {
 // Authority Authorization records. These are DNS records which can express
 // limitations regarding acceptable certificates for a domain. See
 // http://tools.ietf.org/html/draft-hallambaker-donotissue-04
+// TODO(agl): remove once DANE support has been released.
 class NET_EXPORT_PRIVATE DnsCAARecord {
  public:
   enum ParseResult {
@@ -144,6 +146,32 @@ class NET_EXPORT_PRIVATE DnsCAARecord {
                            Policy* output);
 };
 
+class NET_EXPORT_PRIVATE DnsTLSARecord {
+ public:
+  // A Match is an authorized certificate or public key from the TLSA records.
+  struct NET_EXPORT_PRIVATE Match {
+    // A HashTarget identifies the object that we are hashing.
+    enum HashTarget {
+      CERTIFICATE,
+      SUBJECT_PUBLIC_KEY_INFO,
+    };
+
+    HashTarget target;  // what do we hash?
+    // algorithm is an NSS HASH_HashType (i.e. HASH_AlgSHA1). But note that
+    // it can also be HASH_AlgNULL to indicate that |data| isn't hashed at
+    // all.
+    int algorithm;
+    std::string data;  // digest, or raw data if |algorithm == HASH_AlgNULL|.
+  };
+
+  // Parse parses a series of TLSA resource records and sets |output| to the
+  // result. Unknown or invalid records are ignored, as are records with a
+  // usage other than "domain-issued certificate". See

[Ryan Sleevi, 2012/10/18 23:21:13]

nit: mention the specific value (usage 3), since the actual reference to
"domain-issued certificate" doesn't appear until you've read all the inner
usages text.

[agl, 2012/10/29 15:41:56]

Done.

+  // https://tools.ietf.org/html/rfc6698#section-2.1.1.
+  static void Parse(const std::vector<base::StringPiece>& rrdatas,

[Ryan Sleevi, 2012/10/18 23:21:13]

DESIGN: Usage types 0 - 2 are used to establish pinning data. While it's not
necessary to support it yet, it will be important to think about how this
structure may need to change to accomodate it, before it's too widely used.

+                    std::vector<Match>* output);
+};
+
 }  // namespace net
 
 #endif  // NET_BASE_DNSSEC_CHAIN_VERIFIER_H_