001/*
002 * Copyright 2015-2024 the original author or authors
003 *
004 * This software is licensed under the Apache License, Version 2.0,
005 * the GNU Lesser General Public License version 2 or later ("LGPL")
006 * and the WTFPL.
007 * You may choose either license to govern your use of this software only
008 * upon the condition that you accept all of the terms of either
009 * the Apache License 2.0, the LGPL 2.1+ or the WTFPL.
010 */
011package org.minidns.dane;
012
013/**
014 * The result of a DANE verification performed by {@link DaneVerifier}.
015 * <p>
016 * Note that a TLSA record set which contains usable records, none of which matches the certificate, does not result
017 * in a {@link DaneVerificationResult}, but in a {@link DaneCertificateException} being thrown.
018 * </p>
019 */
020public enum DaneVerificationResult {
021
022    /**
023     * The TLSA response was not DNSSEC authenticated. DANE does not apply and PKIX validation is required.
024     */
025    notAuthenticated,
026
027    /**
028     * The TLSA response was DNSSEC authenticated, but contained no usable TLSA records, that is, it either contained
029     * no TLSA records at all or only TLSA records with unsupported parameters. DANE does not apply and PKIX validation
030     * is required.
031     */
032    noUsableTlsaRecords,
033
034    /**
035     * A TLSA record with the certificate usage PKIX-EE (1) matched the certificate. The DANE verification was
036     * successful, but PKIX validation is still required.
037     */
038    matchedPkixRequired,
039
040    /**
041     * A TLSA record with the certificate usage DANE-EE (3) matched the certificate. The certificate is verified and no
042     * further validation is required.
043     */
044    verified,
045    ;
046
047    /**
048     * Check if the DANE verification alone is sufficient to verify the certificate.
049     *
050     * @return {@code true} if no further PKIX validation is required.
051     */
052    public boolean isFullyVerified() {
053        return this == verified;
054    }
055
056    /**
057     * Check if a TLSA record matched the certificate.
058     *
059     * @return {@code true} if a TLSA record matched the certificate.
060     */
061    public boolean isDaneMatch() {
062        return this == matchedPkixRequired || this == verified;
063    }
064}