1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_BASE_DNSSEC_KEYSET_H_ 6 #define NET_BASE_DNSSEC_KEYSET_H_ 7 8 #include <string> 9 #include <vector> 10 11 #include "base/string_piece.h" 12 13 namespace net { 14 15 // DNSSECKeySet function wraps crypto/signature_verifier.h to accept 16 // DNSSEC encodings. (See RFC 4043) 17 class DNSSECKeySet { 18 public: 19 DNSSECKeySet(); 20 ~DNSSECKeySet(); 21 22 // AddKey adds a key to the trusted set. 23 // dnskey: the RRDATA of a DNSKEY. 24 bool AddKey(const base::StringPiece& dnskey); 25 26 // CheckSignature checks the DNSSEC signature on set of resource records. 27 // name: the domain that the records are from 28 // zone: the signing zone 29 // signature: the RRSIG signature, not include the signing zone. 30 // rrtype: the type of the resource records 31 // rrdatas: the RRDATA of the signed resource records, in canonical order. 32 bool CheckSignature(const base::StringPiece& name, 33 const base::StringPiece& zone, 34 const base::StringPiece& signature, 35 uint16 rrtype, 36 const std::vector<base::StringPiece>& rrdatas); 37 38 // DNSKEYToKeyID converts the RRDATA of a DNSKEY to its key id. See RFC 4043, 39 // app B. 40 static uint16 DNSKEYToKeyID(const base::StringPiece& dnskey); 41 42 // Used for testing: the timestamps on signatures will be ignored to allow 43 // golden data to remain valid. 44 void IgnoreTimestamps(); 45 46 private: 47 bool VerifySignature( 48 base::StringPiece signature_algorithm, 49 base::StringPiece signature, 50 base::StringPiece public_key, 51 base::StringPiece signed_data); 52 53 std::string ASN1WrapDNSKEY(const base::StringPiece& dnskey); 54 55 bool ignore_timestamps_; 56 std::vector<uint16> keyids_; 57 std::vector<std::string> public_keys_; 58 }; 59 60 } // namespace net 61 62 #endif // NET_BASE_DNSSEC_KEYSET_H_ 63
