1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
// Copyright (c) 1999-2004 Brian Wellington (bwelling@xbill.org)
package org.xbill.DNS;
import java.io.*;
import org.xbill.DNS.utils.*;
/**
* Transport Layer Security Authentication
*
* @author Brian Wellington
*/
public class TLSARecord extends Record {
private static final long serialVersionUID = 356494267028580169L;
public static class CertificateUsage {
private CertificateUsage() {}
public static final int CA_CONSTRAINT = 0;
public static final int SERVICE_CERTIFICATE_CONSTRAINT = 1;
public static final int TRUST_ANCHOR_ASSERTION = 2;
public static final int DOMAIN_ISSUED_CERTIFICATE = 3;
}
public static class Selector {
private Selector() {}
/**
* Full certificate; the Certificate binary structure defined in
* [RFC5280]
*/
public static final int FULL_CERTIFICATE = 0;
/**
* SubjectPublicKeyInfo; DER-encoded binary structure defined in
* [RFC5280]
*/
public static final int SUBJECT_PUBLIC_KEY_INFO = 1;
}
public static class MatchingType {
private MatchingType() {}
/** Exact match on selected content */
public static final int EXACT = 0;
/** SHA-256 hash of selected content [RFC6234] */
public static final int SHA256 = 1;
/** SHA-512 hash of selected content [RFC6234] */
public static final int SHA512 = 2;
}
private int certificateUsage;
private int selector;
private int matchingType;
private byte [] certificateAssociationData;
TLSARecord() {}
Record
getObject() {
return new TLSARecord();
}
/**
* Creates an TLSA Record from the given data
* @param certificateUsage The provided association that will be used to
* match the certificate presented in the TLS handshake.
* @param selector The part of the TLS certificate presented by the server
* that will be matched against the association data.
* @param matchingType How the certificate association is presented.
* @param certificateAssociationData The "certificate association data" to be
* matched.
*/
public
TLSARecord(Name name, int dclass, long ttl,
int certificateUsage, int selector, int matchingType,
byte [] certificateAssociationData)
{
super(name, Type.TLSA, dclass, ttl);
this.certificateUsage = checkU8("certificateUsage", certificateUsage);
this.selector = checkU8("selector", selector);
this.matchingType = checkU8("matchingType", matchingType);
this.certificateAssociationData = checkByteArrayLength(
"certificateAssociationData",
certificateAssociationData,
0xFFFF);
}
void
rrFromWire(DNSInput in) throws IOException {
certificateUsage = in.readU8();
selector = in.readU8();
matchingType = in.readU8();
certificateAssociationData = in.readByteArray();
}
void
rdataFromString(Tokenizer st, Name origin) throws IOException {
certificateUsage = st.getUInt8();
selector = st.getUInt8();
matchingType = st.getUInt8();
certificateAssociationData = st.getHex();
}
/** Converts rdata to a String */
String
rrToString() {
StringBuffer sb = new StringBuffer();
sb.append(certificateUsage);
sb.append(" ");
sb.append(selector);
sb.append(" ");
sb.append(matchingType);
sb.append(" ");
sb.append(base16.toString(certificateAssociationData));
return sb.toString();
}
void
rrToWire(DNSOutput out, Compression c, boolean canonical) {
out.writeU8(certificateUsage);
out.writeU8(selector);
out.writeU8(matchingType);
out.writeByteArray(certificateAssociationData);
}
/** Returns the certificate usage of the TLSA record */
public int
getCertificateUsage() {
return certificateUsage;
}
/** Returns the selector of the TLSA record */
public int
getSelector() {
return selector;
}
/** Returns the matching type of the TLSA record */
public int
getMatchingType() {
return matchingType;
}
/** Returns the certificate associate data of this TLSA record */
public final byte []
getCertificateAssociationData() {
return certificateAssociationData;
}
}
|
