java.lang.Object
org.minidns.record.Data
org.minidns.record.TLSA
public class TLSAextends Data
DNS TLSA record payload for TLS certificate association.
Associates TLS certificates with domain names for DANE-based authentication of TLS services.

  • Field Details

    • CERT_USAGE_LUT

      private static final Map<Byte, TLSA.CertUsage> CERT_USAGE_LUT
      Certificate usages by their number on the wire.

    • SELECTOR_LUT

      private static final Map<Byte, TLSA.Selector> SELECTOR_LUT
      Certificate selectors by their number on the wire.

    • MATCHING_TYPE_LUT

      private static final Map<Byte, TLSA.MatchingType> MATCHING_TYPE_LUT
      Data matching types by their number on the wire.

    • certUsageByte

      public final byte certUsageByte
      The provided association that will be used to match the certificate presented in the TLS handshake.

    • certUsage

      public final TLSA.CertUsage certUsage
      The certificate usage this field names.

    • selectorByte

      public final byte selectorByte
      Which part of the TLS certificate presented by the server will be matched against the association data.

    • selector

      public final TLSA.Selector selector
      The certificate selector this field names.

    • matchingTypeByte

      public final byte matchingTypeByte
      How the certificate association is presented.

    • matchingType

      public final TLSA.MatchingType matchingType
      The matching type this field names.

    • certificateAssociation

      private final byte[] certificateAssociation
      The "certificate association data" to be matched.

  • Constructor Details

    • TLSA

      TLSA(byte certUsageByte, byte selectorByte, byte matchingTypeByte, byte[] certificateAssociation)
      Create TLSA
      Parameters:
      certUsageByte - the raw certificate usage field, looked up in the LUT
      selectorByte - the raw selector field, looked up in the LUT
      matchingTypeByte - the raw matching type field, looked up in the LUT
      certificateAssociation - the certificate association data to match

  • Method Details

    • parse

      public static TLSA parse(DataInputStream dis, int length) throws IOException
      Reads the TLSA record body from the stream.
      Parameters:
      dis - the stream positioned at the start of the record body
      length - the number of bytes the whole record occupies, of which the first three are the usage, selector and matching type
      Returns:
      the TLSA record read from the stream
      Throws:
      IOException - if the stream ends before the record does

    • getType

      public Record.TYPE getType()
      Returns the DNS record type of this record.
      Specified by:
      getType in class Data
      Returns:
      The DNS record type of this payload.

    • serialize

      public void serialize(DataOutputStream dos) throws IOException
      Writes the three header bytes followed by the association data.
      Specified by:
      serialize in class Data
      Parameters:
      dos - the output stream to serialize to.
      Throws:
      IOException - if an I/O error occurs.

    • toString

      public String toString()
      Renders the fields and the association data in hexadecimal.
      Overrides:
      toString in class Object

    • getCertificateAssociation

      public byte[] getCertificateAssociation()
      The certificate association data held by this record, defensively copied so the caller cannot modify the record's own bytes.
      Returns:
      copy of the certificate association data

    • certificateAssociationEquals

      public boolean certificateAssociationEquals(byte[] otherCertificateAssociation)
      Compares the certificate association data this record carries against a candidate, byte for byte, for DANE verification.
      Parameters:
      otherCertificateAssociation - the association data to compare against
      Returns:
      true if the given data matches the certificate association