1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
package org.bouncycastle.cert.dane;
import java.io.IOException;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.util.Arrays;
/**
* Carrier class for a DANE entry.
*/
public class DANEEntry
{
static final int CERT_USAGE = 0;
static final int SELECTOR = 1;
static final int MATCHING_TYPE = 2;
private final String domainName;
private final byte[] flags;
private final X509CertificateHolder certHolder;
DANEEntry(String domainName, byte[] flags, X509CertificateHolder certHolder)
{
this.flags = flags;
this.domainName = domainName;
this.certHolder = certHolder;
}
public DANEEntry(String domainName, byte[] data)
throws IOException
{
this(domainName, Arrays.copyOfRange(data, 0, 3), new X509CertificateHolder(Arrays.copyOfRange(data, 3, data.length)));
}
public byte[] getFlags()
{
return Arrays.clone(flags);
}
/**
* Return the certificate associated with this entry.
*
* @return the entry's certificate.
*/
public X509CertificateHolder getCertificate()
{
return certHolder;
}
public String getDomainName()
{
return domainName;
}
/**
* Return the full data string as it would appear in the DNS record - flags + encoding
*
* @return byte array representing the full data string.
* @throws IOException if there is an issue encoding the certificate inside this entry.
*/
public byte[] getRDATA()
throws IOException
{
byte[] certEnc = certHolder.getEncoded();
byte[] data = new byte[flags.length + certEnc.length];
System.arraycopy(flags, 0, data, 0, flags.length);
System.arraycopy(certEnc, 0, data, flags.length, certEnc.length);
return data;
}
/**
* Return true if the byte string has the correct flag bytes to indicate a certificate entry.
*
* @param data the byte string of interest.
* @return true if flags indicate a valid certificate, false otherwise.
*/
public static boolean isValidCertificate(byte[] data)
{
// TODO: perhaps validate ASN.1 data as well...
return (data[CERT_USAGE] == 3 && data[SELECTOR] == 0 && data[MATCHING_TYPE] == 0);
}
}
|
