mirror of
https://github.com/miekg/dns.git
synced 2025-09-26 10:31:00 +02:00
46df8c9462
1) Refactoring of tlsa.go
- moved routine to create the certificate rdata to its own go module
as this is shared between TLSA and SMIMEA records
2) Added support for creating an SMIMEA domain name
3) Developed in accordance with draft-ietf-dane-smime-12 RFC
Miek,
Submitting for your review. Happy to make any recommended changes or
address omissions.
Lightly tested against our internal DNS service which hosts DANE
SMIMEA records for our email certificates.
Parse tests are added.
45 lines
1.0 KiB
Go
45 lines
1.0 KiB
Go
package dns
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"crypto/sha512"
|
|
"crypto/x509"
|
|
"encoding/hex"
|
|
"errors"
|
|
"io"
|
|
)
|
|
|
|
// CertificateToDANE converts a certificate to a hex string as used in the TLSA or SMIMEA records.
|
|
func CertificateToDANE(selector, matchingType uint8, cert *x509.Certificate) (string, error) {
|
|
switch matchingType {
|
|
case 0:
|
|
switch selector {
|
|
case 0:
|
|
return hex.EncodeToString(cert.Raw), nil
|
|
case 1:
|
|
return hex.EncodeToString(cert.RawSubjectPublicKeyInfo), nil
|
|
}
|
|
case 1:
|
|
h := sha256.New()
|
|
switch selector {
|
|
case 0:
|
|
io.WriteString(h, string(cert.Raw))
|
|
return hex.EncodeToString(h.Sum(nil)), nil
|
|
case 1:
|
|
io.WriteString(h, string(cert.RawSubjectPublicKeyInfo))
|
|
return hex.EncodeToString(h.Sum(nil)), nil
|
|
}
|
|
case 2:
|
|
h := sha512.New()
|
|
switch selector {
|
|
case 0:
|
|
io.WriteString(h, string(cert.Raw))
|
|
return hex.EncodeToString(h.Sum(nil)), nil
|
|
case 1:
|
|
io.WriteString(h, string(cert.RawSubjectPublicKeyInfo))
|
|
return hex.EncodeToString(h.Sum(nil)), nil
|
|
}
|
|
}
|
|
return "", errors.New("dns: bad MatchingType or Selector")
|
|
}
|