From cc75064317725f5b4d58b8b364dbf0c9c431ec3e Mon Sep 17 00:00:00 2001
From: Rasmus Dahlberg <rasmus.dahlberg@kau.se>
Date: Sat, 2 Oct 2021 20:23:51 +0200
Subject: added domain_hint enforcement

---
 pkg/dns/dns.go | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 pkg/dns/dns.go

(limited to 'pkg/dns')

diff --git a/pkg/dns/dns.go b/pkg/dns/dns.go
new file mode 100644
index 0000000..7979119
--- /dev/null
+++ b/pkg/dns/dns.go
@@ -0,0 +1,40 @@
+package dns
+
+import (
+	"context"
+	"fmt"
+	"net"
+
+	"encoding/hex"
+
+	"git.sigsum.org/sigsum-log-go/pkg/types"
+)
+
+// Verifier can verify that a domain name is aware of a public key
+type Verifier interface {
+	Verify(ctx context.Context, name string, key *[types.VerificationKeySize]byte) error
+}
+
+// DefaultResolver implements the Verifier interface with Go's default resolver
+type DefaultResolver struct {
+	resolver net.Resolver
+}
+
+func NewDefaultResolver() Verifier {
+	return &DefaultResolver{}
+}
+
+func (dr *DefaultResolver) Verify(ctx context.Context, name string, key *[types.VerificationKeySize]byte) error {
+	rsp, err := dr.resolver.LookupTXT(ctx, name)
+	if err != nil {
+		return fmt.Errorf("domain name look-up failed: %v", err)
+	}
+
+	want := hex.EncodeToString(types.Hash(key[:])[:])
+	for _, got := range rsp {
+		if got == want {
+			return nil
+		}
+	}
+	return fmt.Errorf("%q is not aware of key hash %q", name, want)
+}
-- 
cgit v1.2.3