OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ | 5 #ifndef NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ |
6 #define NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ | 6 #define NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/string_piece.h" | 12 #include "base/string_piece.h" |
13 #include "net/base/net_api.h" | 13 #include "net/base/net_export.h" |
14 | 14 |
15 namespace net { | 15 namespace net { |
16 | 16 |
17 // DNSSECChainVerifier verifies a chain of DNSSEC records. These records | 17 // DNSSECChainVerifier verifies a chain of DNSSEC records. These records |
18 // eventually prove the validity of a set of resource records for the target | 18 // eventually prove the validity of a set of resource records for the target |
19 // name. For example, if the fingerprint of a certificate was stored in a CERT | 19 // name. For example, if the fingerprint of a certificate was stored in a CERT |
20 // record for a given domain, then a chain could prove the validity of that | 20 // record for a given domain, then a chain could prove the validity of that |
21 // fingerprint. | 21 // fingerprint. |
22 class NET_TEST DNSSECChainVerifier { | 22 class NET_EXPORT_PRIVATE DNSSECChainVerifier { |
23 public: | 23 public: |
24 enum Error { | 24 enum Error { |
25 OK = 0, | 25 OK = 0, |
26 BAD_DATA, // The chain was corrupt in some fashion. | 26 BAD_DATA, // The chain was corrupt in some fashion. |
27 UNKNOWN_ROOT_KEY, // The chain is assuming an unknown DNS root. | 27 UNKNOWN_ROOT_KEY, // The chain is assuming an unknown DNS root. |
28 UNKNOWN_DIGEST, // An omitted DS record used an unknown hash function. | 28 UNKNOWN_DIGEST, // An omitted DS record used an unknown hash function. |
29 UNKNOWN_TERMINAL_RRTYPE, // The chain proved an unknown RRTYPE. | 29 UNKNOWN_TERMINAL_RRTYPE, // The chain proved an unknown RRTYPE. |
30 BAD_SIGNATURE, // One of the signature was incorrect. | 30 BAD_SIGNATURE, // One of the signature was incorrect. |
31 NO_DS_LINK, // a DS set didn't include the next entry key. | 31 NO_DS_LINK, // a DS set didn't include the next entry key. |
32 OFF_COURSE, // the chain is diverging from the target name. | 32 OFF_COURSE, // the chain is diverging from the target name. |
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
96 uint16 rrtype_; | 96 uint16 rrtype_; |
97 std::vector<base::StringPiece> rrdatas_; | 97 std::vector<base::StringPiece> rrdatas_; |
98 // A list of pointers which need to be free()ed on destruction. | 98 // A list of pointers which need to be free()ed on destruction. |
99 std::vector<void*> scratch_pool_; | 99 std::vector<void*> scratch_pool_; |
100 }; | 100 }; |
101 | 101 |
102 // DnsCAARecord encapsulates code and types for dealing with Certificate | 102 // DnsCAARecord encapsulates code and types for dealing with Certificate |
103 // Authority Authorization records. These are DNS records which can express | 103 // Authority Authorization records. These are DNS records which can express |
104 // limitations regarding acceptable certificates for a domain. See | 104 // limitations regarding acceptable certificates for a domain. See |
105 // http://tools.ietf.org/html/draft-hallambaker-donotissue-04 | 105 // http://tools.ietf.org/html/draft-hallambaker-donotissue-04 |
106 class NET_TEST DnsCAARecord { | 106 class NET_EXPORT_PRIVATE DnsCAARecord { |
107 public: | 107 public: |
108 enum ParseResult { | 108 enum ParseResult { |
109 SUCCESS, // parse successful. | 109 SUCCESS, // parse successful. |
110 DISCARD, // no policies applying to this client were found. | 110 DISCARD, // no policies applying to this client were found. |
111 SYNTAX_ERROR, // the record was syntactically invalid. | 111 SYNTAX_ERROR, // the record was syntactically invalid. |
112 UNKNOWN_CRITICAL, // a critical record was not understood. | 112 UNKNOWN_CRITICAL, // a critical record was not understood. |
113 }; | 113 }; |
114 | 114 |
115 // A CAAPolicy is the result of parsing a set of CAA records. It describes a | 115 // A CAAPolicy is the result of parsing a set of CAA records. It describes a |
116 // number of properies of certificates in a chain, any of which is sufficient | 116 // number of properies of certificates in a chain, any of which is sufficient |
117 // to validate the chain. | 117 // to validate the chain. |
118 struct NET_TEST Policy { | 118 struct NET_EXPORT_PRIVATE Policy { |
119 public: | 119 public: |
120 Policy(); | 120 Policy(); |
121 ~Policy(); | 121 ~Policy(); |
122 | 122 |
123 // A HashTarget identifies the object that we are hashing. | 123 // A HashTarget identifies the object that we are hashing. |
124 enum HashTarget { | 124 enum HashTarget { |
125 USER_CERTIFICATE, | 125 USER_CERTIFICATE, |
126 CA_CERTIFICATE, | 126 CA_CERTIFICATE, |
127 SUBJECT_PUBLIC_KEY_INFO, | 127 SUBJECT_PUBLIC_KEY_INFO, |
128 }; | 128 }; |
(...skipping 11 matching lines...) Expand all Loading... |
140 | 140 |
141 // Parse parses a series of DNS resource records and sets |output| to the | 141 // Parse parses a series of DNS resource records and sets |output| to the |
142 // result. | 142 // result. |
143 static ParseResult Parse(const std::vector<base::StringPiece>& rrdatas, | 143 static ParseResult Parse(const std::vector<base::StringPiece>& rrdatas, |
144 Policy* output); | 144 Policy* output); |
145 }; | 145 }; |
146 | 146 |
147 } // namespace net | 147 } // namespace net |
148 | 148 |
149 #endif // NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ | 149 #endif // NET_BASE_DNSSEC_CHAIN_VERIFIER_H_ |
OLD | NEW |