From 166a2d6a37b727dc4c493a5dc2ef4314c980851d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 29 Oct 2013 18:11:58 +0100 Subject: reindented code --- libdane/dane.c | 995 +++++++++++++++++++++++++++++++-------------------------- 1 file changed, 545 insertions(+), 450 deletions(-) diff --git a/libdane/dane.c b/libdane/dane.c index 284949c919..e4f1ec7604 100644 --- a/libdane/dane.c +++ b/libdane/dane.c @@ -39,34 +39,35 @@ #define MAX_DATA_ENTRIES 4 #ifdef DEBUG -# define gnutls_assert() fprintf(stderr, "ASSERT: %s: %d\n", __FILE__, __LINE__); -# define gnutls_assert_val(x) gnutls_assert_val_int(x, __FILE__, __LINE__) -static int gnutls_assert_val_int (int val, const char *file, int line) +#define gnutls_assert() fprintf(stderr, "ASSERT: %s: %d\n", __FILE__, __LINE__); +#define gnutls_assert_val(x) gnutls_assert_val_int(x, __FILE__, __LINE__) +static int +gnutls_assert_val_int (int val, const char *file, int line) { - fprintf(stderr, "ASSERT: %s: %d\n", file, line); + fprintf (stderr, "ASSERT: %s: %d\n", file, line); return val; } #else -# define gnutls_assert() -# define gnutls_assert_val(x) (x) +#define gnutls_assert() +#define gnutls_assert_val(x) (x) #endif struct dane_state_st { - struct ub_ctx* ctx; - unsigned int flags; + struct ub_ctx *ctx; + unsigned int flags; }; struct dane_query_st { - struct ub_result* result; - unsigned int data_entries; - dane_cert_usage_t usage[MAX_DATA_ENTRIES]; - dane_cert_type_t type[MAX_DATA_ENTRIES]; - dane_match_type_t match[MAX_DATA_ENTRIES]; - gnutls_datum_t data[MAX_DATA_ENTRIES]; - unsigned int flags; - dane_query_status_t status; + struct ub_result *result; + unsigned int data_entries; + dane_cert_usage_t usage[MAX_DATA_ENTRIES]; + dane_cert_type_t type[MAX_DATA_ENTRIES]; + dane_match_type_t match[MAX_DATA_ENTRIES]; + gnutls_datum_t data[MAX_DATA_ENTRIES]; + unsigned int flags; + dane_query_status_t status; }; /** @@ -78,9 +79,10 @@ struct dane_query_st * * Returns: The status type. **/ -dane_query_status_t dane_query_status(dane_query_t q) +dane_query_status_t +dane_query_status (dane_query_t q) { - return q->status; + return q->status; } /** @@ -91,9 +93,10 @@ dane_query_status_t dane_query_status(dane_query_t q) * * Returns: The number of entries. **/ -unsigned int dane_query_entries(dane_query_t q) +unsigned int +dane_query_entries (dane_query_t q) { - return q->data_entries; + return q->data_entries; } /** @@ -111,25 +114,27 @@ unsigned int dane_query_entries(dane_query_t q) * Returns: On success, %DANE_E_SUCCESS (0) is returned, otherwise a * negative error value. **/ -int dane_query_data(dane_query_t q, unsigned int idx, - unsigned int *usage, unsigned int *type, - unsigned int *match, gnutls_datum_t * data) +int +dane_query_data (dane_query_t q, unsigned int idx, + unsigned int *usage, unsigned int *type, + unsigned int *match, gnutls_datum_t * data) { - if (idx >= q->data_entries) - return gnutls_assert_val(DANE_E_REQUESTED_DATA_NOT_AVAILABLE); - - if (usage) - *usage = q->usage[idx]; - if (type) - *type = q->type[idx]; - if (match) - *match = q->match[idx]; - if (data) { - data->data = q->data[idx].data; - data->size = q->data[idx].size; - } - - return DANE_E_SUCCESS; + if (idx >= q->data_entries) + return gnutls_assert_val (DANE_E_REQUESTED_DATA_NOT_AVAILABLE); + + if (usage) + *usage = q->usage[idx]; + if (type) + *type = q->type[idx]; + if (match) + *match = q->match[idx]; + if (data) + { + data->data = q->data[idx].data; + data->size = q->data[idx].size; + } + + return DANE_E_SUCCESS; } /** @@ -142,58 +147,65 @@ int dane_query_data(dane_query_t q, unsigned int idx, * Returns: On success, %DANE_E_SUCCESS (0) is returned, otherwise a * negative error value. **/ -int dane_state_init(dane_state_t* s, unsigned int flags) +int +dane_state_init (dane_state_t * s, unsigned int flags) { - struct ub_ctx* ctx; - int ret; - - *s = calloc(1, sizeof(struct dane_state_st)); - if (*s == NULL) - return gnutls_assert_val(DANE_E_MEMORY_ERROR); - - ctx = ub_ctx_create(); - if(!ctx) { - gnutls_assert(); - ret = DANE_E_INITIALIZATION_ERROR; - goto cleanup; - } - ub_ctx_debugout(ctx, stderr); - - if (!(flags & DANE_F_IGNORE_LOCAL_RESOLVER)) { - if( (ret=ub_ctx_resolvconf(ctx, NULL)) != 0) { - gnutls_assert(); - ret = DANE_E_INITIALIZATION_ERROR; - goto cleanup; - } - - if( (ret=ub_ctx_hosts(ctx, NULL)) != 0) { - gnutls_assert(); - ret = DANE_E_INITIALIZATION_ERROR; - goto cleanup; - } - } - - /* read public keys for DNSSEC verification */ - if (!(flags & DANE_F_IGNORE_DNSSEC)) + struct ub_ctx *ctx; + int ret; + + *s = calloc (1, sizeof (struct dane_state_st)); + if (*s == NULL) + return gnutls_assert_val (DANE_E_MEMORY_ERROR); + + ctx = ub_ctx_create (); + if (!ctx) + { + gnutls_assert (); + ret = DANE_E_INITIALIZATION_ERROR; + goto cleanup; + } + ub_ctx_debugout (ctx, stderr); + + if (!(flags & DANE_F_IGNORE_LOCAL_RESOLVER)) + { + if ((ret = ub_ctx_resolvconf (ctx, NULL)) != 0) + { + gnutls_assert (); + ret = DANE_E_INITIALIZATION_ERROR; + goto cleanup; + } + + if ((ret = ub_ctx_hosts (ctx, NULL)) != 0) { - if( (ret=ub_ctx_add_ta_file(ctx, (char*)UNBOUND_ROOT_KEY_FILE)) != 0) { - gnutls_assert(); - ret = DANE_E_INITIALIZATION_ERROR; - goto cleanup; - } - } + gnutls_assert (); + ret = DANE_E_INITIALIZATION_ERROR; + goto cleanup; + } + } - (*s)->ctx = ctx; - (*s)->flags = flags; + /* read public keys for DNSSEC verification */ + if (!(flags & DANE_F_IGNORE_DNSSEC)) + { + if ((ret = + ub_ctx_add_ta_file (ctx, (char *) UNBOUND_ROOT_KEY_FILE)) != 0) + { + gnutls_assert (); + ret = DANE_E_INITIALIZATION_ERROR; + goto cleanup; + } + } - return DANE_E_SUCCESS; + (*s)->ctx = ctx; + (*s)->flags = flags; + + return DANE_E_SUCCESS; cleanup: - if (ctx) - ub_ctx_delete(ctx); - free(*s); + if (ctx) + ub_ctx_delete (ctx); + free (*s); - return ret; + return ret; } /** @@ -203,10 +215,11 @@ cleanup: * This function will deinitialize a DANE query structure. * **/ -void dane_state_deinit(dane_state_t s) +void +dane_state_deinit (dane_state_t s) { - ub_ctx_delete(s->ctx); - free(s); + ub_ctx_delete (s->ctx); + free (s); } /** @@ -218,13 +231,15 @@ void dane_state_deinit(dane_state_t s) * for DLV (DNSSEC Lookaside Validation). * **/ -int dane_state_set_dlv_file(dane_state_t s, const char* file) +int +dane_state_set_dlv_file (dane_state_t s, const char *file) { -int ret; + int ret; - ret = ub_ctx_set_option(s->ctx, (char*)"dlv-anchor-file:", (void*)file); + ret = + ub_ctx_set_option (s->ctx, (char *) "dlv-anchor-file:", (void *) file); if (ret != 0) - return gnutls_assert_val(DANE_E_FILE_ERROR); + return gnutls_assert_val (DANE_E_FILE_ERROR); return 0; } @@ -236,10 +251,12 @@ int ret; * This function will deinitialize a DANE query result structure. * **/ -void dane_query_deinit(dane_query_t q) +void +dane_query_deinit (dane_query_t q) { - if (q->result) ub_resolve_free(q->result); - free(q); + if (q->result) + ub_resolve_free (q->result); + free (q); } @@ -262,52 +279,60 @@ void dane_query_deinit(dane_query_t q) * Returns: On success, %DANE_E_SUCCESS (0) is returned, otherwise a * negative error value. **/ -int dane_raw_tlsa(dane_state_t s, dane_query_t *r, char *const*dane_data, const int *dane_data_len, int secure, int bogus) +int +dane_raw_tlsa (dane_state_t s, dane_query_t * r, char *const *dane_data, + const int *dane_data_len, int secure, int bogus) { - int ret = DANE_E_SUCCESS; - unsigned int i; - - *r = calloc(1, sizeof(struct dane_query_st)); - if (*r == NULL) - return gnutls_assert_val(DANE_E_MEMORY_ERROR); - - (*r)->data_entries = 0; - - for (i=0;iusage[i] = dane_data[i][0]; - (*r)->type[i] = dane_data[i][1]; - (*r)->match[i] = dane_data[i][2]; - (*r)->data[i].data = (void*)&dane_data[i][3]; - (*r)->data[i].size = dane_data_len[i] - 3; - (*r)->data_entries++; - } - - if (!(s->flags & DANE_F_INSECURE) && !secure) { - if (bogus) - ret = gnutls_assert_val(DANE_E_INVALID_DNSSEC_SIG); - else - ret = gnutls_assert_val(DANE_E_NO_DNSSEC_SIG); - } - - /* show security status */ - if (secure) { - (*r)->status = DANE_QUERY_DNSSEC_VERIFIED; - } else if (bogus) { - gnutls_assert(); - (*r)->status = DANE_QUERY_BOGUS; - } else { - gnutls_assert(); - (*r)->status = DANE_QUERY_NO_DNSSEC; - } + int ret = DANE_E_SUCCESS; + unsigned int i; + + *r = calloc (1, sizeof (struct dane_query_st)); + if (*r == NULL) + return gnutls_assert_val (DANE_E_MEMORY_ERROR); + + (*r)->data_entries = 0; + + for (i = 0; i < MAX_DATA_ENTRIES; i++) + { + if (dane_data[i] == NULL) + break; + + if (dane_data_len[i] <= 3) + return gnutls_assert_val (DANE_E_RECEIVED_CORRUPT_DATA); + + (*r)->usage[i] = dane_data[i][0]; + (*r)->type[i] = dane_data[i][1]; + (*r)->match[i] = dane_data[i][2]; + (*r)->data[i].data = (void *) &dane_data[i][3]; + (*r)->data[i].size = dane_data_len[i] - 3; + (*r)->data_entries++; + } + + if (!(s->flags & DANE_F_INSECURE) && !secure) + { + if (bogus) + ret = gnutls_assert_val (DANE_E_INVALID_DNSSEC_SIG); + else + ret = gnutls_assert_val (DANE_E_NO_DNSSEC_SIG); + } + + /* show security status */ + if (secure) + { + (*r)->status = DANE_QUERY_DNSSEC_VERIFIED; + } + else if (bogus) + { + gnutls_assert (); + (*r)->status = DANE_QUERY_BOGUS; + } + else + { + gnutls_assert (); + (*r)->status = DANE_QUERY_NO_DNSSEC; + } - return ret; + return ret; } @@ -325,256 +350,300 @@ int dane_raw_tlsa(dane_state_t s, dane_query_t *r, char *const*dane_data, const * Returns: On success, %DANE_E_SUCCESS (0) is returned, otherwise a * negative error value. **/ -int dane_query_tlsa(dane_state_t s, dane_query_t *r, const char* host, const char* proto, unsigned int port) +int +dane_query_tlsa (dane_state_t s, dane_query_t * r, const char *host, + const char *proto, unsigned int port) { - char ns[1024]; - int ret; - struct ub_result *result; + char ns[1024]; + int ret; + struct ub_result *result; - snprintf(ns, sizeof(ns), "_%u._%s.%s", port, proto, host); + snprintf (ns, sizeof (ns), "_%u._%s.%s", port, proto, host); - /* query for webserver */ - ret = ub_resolve(s->ctx, ns, 52, 1, &result); - if(ret != 0) { - return gnutls_assert_val(DANE_E_RESOLVING_ERROR); - } + /* query for webserver */ + ret = ub_resolve (s->ctx, ns, 52, 1, &result); + if (ret != 0) + { + return gnutls_assert_val (DANE_E_RESOLVING_ERROR); + } /* show first result */ - if(!result->havedata) { - ub_resolve_free (result); - return gnutls_assert_val(DANE_E_NO_DANE_DATA); - } - - ret = dane_raw_tlsa (s, r, result->data, result->len, result->secure, result->bogus); - if (*r == NULL) { - ub_resolve_free (result); - return ret; - } - (*r)->result = result; - return ret; + if (!result->havedata) + { + ub_resolve_free (result); + return gnutls_assert_val (DANE_E_NO_DANE_DATA); + } + + ret = + dane_raw_tlsa (s, r, result->data, result->len, result->secure, + result->bogus); + if (*r == NULL) + { + ub_resolve_free (result); + return ret; + } + (*r)->result = result; + return ret; } -static unsigned int matches(const gnutls_datum_t *raw1, const gnutls_datum_t *raw2, - dane_match_type_t match) +static unsigned int +matches (const gnutls_datum_t * raw1, const gnutls_datum_t * raw2, + dane_match_type_t match) { -uint8_t digest[64]; -int ret; + uint8_t digest[64]; + int ret; - if (match == DANE_MATCH_EXACT) { - if (raw1->size != raw2->size) - return gnutls_assert_val(0); + if (match == DANE_MATCH_EXACT) + { + if (raw1->size != raw2->size) + return gnutls_assert_val (0); - if (memcmp(raw1->data, raw2->data, raw1->size) != 0) - return gnutls_assert_val(0); + if (memcmp (raw1->data, raw2->data, raw1->size) != 0) + return gnutls_assert_val (0); - return 1; - } else if (match == DANE_MATCH_SHA2_256) { + return 1; + } + else if (match == DANE_MATCH_SHA2_256) + { - if (raw2->size != 32) - return gnutls_assert_val(0); + if (raw2->size != 32) + return gnutls_assert_val (0); - ret = gnutls_hash_fast(GNUTLS_DIG_SHA256, raw1->data, raw1->size, digest); - if (ret < 0) - return gnutls_assert_val(0); + ret = + gnutls_hash_fast (GNUTLS_DIG_SHA256, raw1->data, raw1->size, digest); + if (ret < 0) + return gnutls_assert_val (0); - if (memcmp(digest, raw2->data, 32) != 0) - return gnutls_assert_val(0); + if (memcmp (digest, raw2->data, 32) != 0) + return gnutls_assert_val (0); - return 1; - } else if (match == DANE_MATCH_SHA2_512) { - if (raw2->size != 64) - return gnutls_assert_val(0); + return 1; + } + else if (match == DANE_MATCH_SHA2_512) + { + if (raw2->size != 64) + return gnutls_assert_val (0); - ret = gnutls_hash_fast(GNUTLS_DIG_SHA512, raw1->data, raw1->size, digest); - if (ret < 0) - return gnutls_assert_val(0); + ret = + gnutls_hash_fast (GNUTLS_DIG_SHA512, raw1->data, raw1->size, digest); + if (ret < 0) + return gnutls_assert_val (0); - if (memcmp(digest, raw2->data, 64) != 0) - return gnutls_assert_val(0); + if (memcmp (digest, raw2->data, 64) != 0) + return gnutls_assert_val (0); - return 1; - } + return 1; + } - return gnutls_assert_val(0); + return gnutls_assert_val (0); } -static int crt_to_pubkey(const gnutls_datum_t *raw_crt, gnutls_datum_t * out) +static int +crt_to_pubkey (const gnutls_datum_t * raw_crt, gnutls_datum_t * out) { -gnutls_pubkey_t pub = NULL; -gnutls_x509_crt_t crt = NULL; -int ret; - - out->data = NULL; - - ret = gnutls_x509_crt_init(&crt); - if (ret < 0) - return gnutls_assert_val(DANE_E_PUBKEY_ERROR); - - ret = gnutls_pubkey_init( &pub); - if (ret < 0) { - gnutls_assert(); - ret = DANE_E_PUBKEY_ERROR; - goto cleanup; - } - - ret = gnutls_x509_crt_import(crt, raw_crt, GNUTLS_X509_FMT_DER); - if (ret < 0) { - gnutls_assert(); - ret = DANE_E_PUBKEY_ERROR; - goto cleanup; - } - - ret = gnutls_pubkey_import_x509(pub, crt, 0); - if (ret < 0) { - gnutls_assert(); - ret = DANE_E_PUBKEY_ERROR; - goto cleanup; - } - - ret = gnutls_pubkey_export2(pub, GNUTLS_X509_FMT_DER, out); - if (ret < 0) { - gnutls_assert(); - ret = DANE_E_PUBKEY_ERROR; - goto cleanup; - } - - ret = 0; - goto clean_certs; + gnutls_pubkey_t pub = NULL; + gnutls_x509_crt_t crt = NULL; + int ret; + + out->data = NULL; + + ret = gnutls_x509_crt_init (&crt); + if (ret < 0) + return gnutls_assert_val (DANE_E_PUBKEY_ERROR); + + ret = gnutls_pubkey_init (&pub); + if (ret < 0) + { + gnutls_assert (); + ret = DANE_E_PUBKEY_ERROR; + goto cleanup; + } + + ret = gnutls_x509_crt_import (crt, raw_crt, GNUTLS_X509_FMT_DER); + if (ret < 0) + { + gnutls_assert (); + ret = DANE_E_PUBKEY_ERROR; + goto cleanup; + } + + ret = gnutls_pubkey_import_x509 (pub, crt, 0); + if (ret < 0) + { + gnutls_assert (); + ret = DANE_E_PUBKEY_ERROR; + goto cleanup; + } + + ret = gnutls_pubkey_export2 (pub, GNUTLS_X509_FMT_DER, out); + if (ret < 0) + { + gnutls_assert (); + ret = DANE_E_PUBKEY_ERROR; + goto cleanup; + } + + ret = 0; + goto clean_certs; cleanup: - free(out->data); - out->data = NULL; + free (out->data); + out->data = NULL; clean_certs: - if (pub) - gnutls_pubkey_deinit(pub); - if (crt) - gnutls_x509_crt_deinit(crt); + if (pub) + gnutls_pubkey_deinit (pub); + if (crt) + gnutls_x509_crt_deinit (crt); - return ret; + return ret; } -static int verify_ca(const gnutls_datum_t *raw_crt, unsigned raw_crt_size, - gnutls_certificate_type_t crt_type, - dane_cert_type_t ctype, - dane_match_type_t match, gnutls_datum_t * data, - unsigned int *verify) +static int +verify_ca (const gnutls_datum_t * raw_crt, unsigned raw_crt_size, + gnutls_certificate_type_t crt_type, + dane_cert_type_t ctype, + dane_match_type_t match, gnutls_datum_t * data, + unsigned int *verify) { -gnutls_datum_t pubkey = {NULL, 0}; -int ret; -unsigned int vstatus; -gnutls_x509_crt_t crt = NULL, ca = NULL; - - if (raw_crt_size < 2) - return gnutls_assert_val(DANE_E_INVALID_REQUEST); - - if (ctype == DANE_CERT_X509 && crt_type == GNUTLS_CRT_X509) { - - if (!matches(&raw_crt[1], data, match)) { - gnutls_assert(); - *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; - } - - } else if (ctype == DANE_CERT_PK && crt_type == GNUTLS_CRT_X509) { - ret = crt_to_pubkey(&raw_crt[1], &pubkey); - if (ret < 0) { - gnutls_assert(); - goto cleanup; - } - - if (!matches(&pubkey, data, match)) { - gnutls_assert(); - *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; - } - } else { - ret = gnutls_assert_val(DANE_E_UNKNOWN_DANE_DATA); - goto cleanup; - } - - /* check if the certificate chain is actually a chain */ - ret = gnutls_x509_crt_init(&crt); - if (ret < 0) { - ret = gnutls_assert_val(DANE_E_CERT_ERROR); - goto cleanup; - } - - ret = gnutls_x509_crt_init(&ca); - if (ret < 0) { - ret = gnutls_assert_val(DANE_E_CERT_ERROR); - goto cleanup; - } - - ret = gnutls_x509_crt_import(crt, &raw_crt[0], GNUTLS_X509_FMT_DER); - if (ret < 0) { - ret = gnutls_assert_val(DANE_E_CERT_ERROR); - goto cleanup; - } - - ret = gnutls_x509_crt_import(ca, &raw_crt[1], GNUTLS_X509_FMT_DER); - if (ret < 0) { - ret = gnutls_assert_val(DANE_E_CERT_ERROR); - goto cleanup; - } - - ret = gnutls_x509_crt_check_issuer(crt, ca); - if (ret == 0) { - gnutls_assert(); - *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; - } - - ret = gnutls_x509_crt_verify(crt, &ca, 1, 0, &vstatus); - if (ret < 0) { - ret = gnutls_assert_val(DANE_E_CERT_ERROR); - goto cleanup; - } - if (vstatus != 0) - *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; - - ret = 0; + gnutls_datum_t pubkey = { NULL, 0 }; + int ret; + unsigned int vstatus; + gnutls_x509_crt_t crt = NULL, ca = NULL; + + if (raw_crt_size < 2) + return gnutls_assert_val (DANE_E_INVALID_REQUEST); + + if (ctype == DANE_CERT_X509 && crt_type == GNUTLS_CRT_X509) + { + + if (!matches (&raw_crt[1], data, match)) + { + gnutls_assert (); + *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; + } + + } + else if (ctype == DANE_CERT_PK && crt_type == GNUTLS_CRT_X509) + { + ret = crt_to_pubkey (&raw_crt[1], &pubkey); + if (ret < 0) + { + gnutls_assert (); + goto cleanup; + } + + if (!matches (&pubkey, data, match)) + { + gnutls_assert (); + *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; + } + } + else + { + ret = gnutls_assert_val (DANE_E_UNKNOWN_DANE_DATA); + goto cleanup; + } + + /* check if the certificate chain is actually a chain */ + ret = gnutls_x509_crt_init (&crt); + if (ret < 0) + { + ret = gnutls_assert_val (DANE_E_CERT_ERROR); + goto cleanup; + } + + ret = gnutls_x509_crt_init (&ca); + if (ret < 0) + { + ret = gnutls_assert_val (DANE_E_CERT_ERROR); + goto cleanup; + } + + ret = gnutls_x509_crt_import (crt, &raw_crt[0], GNUTLS_X509_FMT_DER); + if (ret < 0) + { + ret = gnutls_assert_val (DANE_E_CERT_ERROR); + goto cleanup; + } + + ret = gnutls_x509_crt_import (ca, &raw_crt[1], GNUTLS_X509_FMT_DER); + if (ret < 0) + { + ret = gnutls_assert_val (DANE_E_CERT_ERROR); + goto cleanup; + } + + ret = gnutls_x509_crt_check_issuer (crt, ca); + if (ret == 0) + { + gnutls_assert (); + *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; + } + + ret = gnutls_x509_crt_verify (crt, &ca, 1, 0, &vstatus); + if (ret < 0) + { + ret = gnutls_assert_val (DANE_E_CERT_ERROR); + goto cleanup; + } + if (vstatus != 0) + *verify |= DANE_VERIFY_CA_CONSTRAINTS_VIOLATED; + + ret = 0; cleanup: - free(pubkey.data); - if (crt != NULL) - gnutls_x509_crt_deinit(crt); - if (ca != NULL) - gnutls_x509_crt_deinit(ca); - return ret; + free (pubkey.data); + if (crt != NULL) + gnutls_x509_crt_deinit (crt); + if (ca != NULL) + gnutls_x509_crt_deinit (ca); + return ret; } -static int verify_ee(const gnutls_datum_t *raw_crt, gnutls_certificate_type_t crt_type, - dane_cert_type_t ctype, dane_match_type_t match, gnutls_datum_t * data, - unsigned int *verify) +static int +verify_ee (const gnutls_datum_t * raw_crt, gnutls_certificate_type_t crt_type, + dane_cert_type_t ctype, dane_match_type_t match, + gnutls_datum_t * data, unsigned int *verify) { -gnutls_datum_t pubkey = {NULL, 0}; -int ret; - - if (ctype == DANE_CERT_X509 && crt_type == GNUTLS_CRT_X509) { - - if (!matches(raw_crt, data, match)) { - gnutls_assert(); - *verify |= DANE_VERIFY_CERT_DIFFERS; - } - - } else if (ctype == DANE_CERT_PK && crt_type == GNUTLS_CRT_X509) { - - ret = crt_to_pubkey(raw_crt, &pubkey); - if (ret < 0) { - gnutls_assert(); - goto cleanup; - } - - if (!matches(&pubkey, data, match)) { - gnutls_assert(); - *verify |= DANE_VERIFY_CERT_DIFFERS; - } - } else { - ret = gnutls_assert_val(DANE_E_UNKNOWN_DANE_DATA); - goto cleanup; - } - - ret = 0; + gnutls_datum_t pubkey = { NULL, 0 }; + int ret; + + if (ctype == DANE_CERT_X509 && crt_type == GNUTLS_CRT_X509) + { + + if (!matches (raw_crt, data, match)) + { + gnutls_assert (); + *verify |= DANE_VERIFY_CERT_DIFFERS; + } + + } + else if (ctype == DANE_CERT_PK && crt_type == GNUTLS_CRT_X509) + { + + ret = crt_to_pubkey (raw_crt, &pubkey); + if (ret < 0) + { + gnutls_assert (); + goto cleanup; + } + + if (!matches (&pubkey, data, match)) + { + gnutls_assert (); + *verify |= DANE_VERIFY_CERT_DIFFERS; + } + } + else + { + ret = gnutls_assert_val (DANE_E_UNKNOWN_DANE_DATA); + goto cleanup; + } + + ret = 0; cleanup: - free(pubkey.data); - return ret; + free (pubkey.data); + return ret; } /** @@ -608,59 +677,75 @@ cleanup: * negative error value. * **/ -int dane_verify_crt_raw (dane_state_t s, - const gnutls_datum_t *chain, unsigned chain_size, - gnutls_certificate_type_t chain_type, - dane_query_t r, - unsigned int sflags, unsigned int vflags, - unsigned int *verify) +int +dane_verify_crt_raw (dane_state_t s, + const gnutls_datum_t * chain, unsigned chain_size, + gnutls_certificate_type_t chain_type, + dane_query_t r, + unsigned int sflags, unsigned int vflags, + unsigned int *verify) { -dane_state_t _s = NULL; -int ret; -unsigned checked = 0; -unsigned int usage, type, match, idx; -gnutls_datum_t data; - - if (chain_type != GNUTLS_CRT_X509) - return gnutls_assert_val(DANE_E_INVALID_REQUEST); - - *verify = 0; - idx = 0; - do { - ret = dane_query_data(r, idx++, &usage, &type, &match, &data); - if (ret == DANE_E_REQUESTED_DATA_NOT_AVAILABLE) - break; - - if (ret < 0) { - gnutls_assert(); - goto cleanup; - } - - if (!(vflags & DANE_VFLAG_ONLY_CHECK_EE_USAGE) && (usage == DANE_CERT_USAGE_LOCAL_CA || usage == DANE_CERT_USAGE_CA)) { - ret = verify_ca(chain, chain_size, chain_type, type, match, &data, verify); - if (ret < 0) { - gnutls_assert(); - goto cleanup; - } - checked = 1; - } else if (!(vflags & DANE_VFLAG_ONLY_CHECK_CA_USAGE) && (usage == DANE_CERT_USAGE_LOCAL_EE || usage == DANE_CERT_USAGE_EE)) { - ret = verify_ee(&chain[0], chain_type, type, match, &data, verify); - if (ret < 0) { - gnutls_assert(); - goto cleanup; - } - checked = 1; - } - } while(1); - - if ((vflags & DANE_VFLAG_FAIL_IF_NOT_CHECKED) && checked == 0) - ret = gnutls_assert_val(DANE_E_REQUESTED_DATA_NOT_AVAILABLE); - else - ret = 0; + dane_state_t _s = NULL; + int ret; + unsigned checked = 0; + unsigned int usage, type, match, idx; + gnutls_datum_t data; + + if (chain_type != GNUTLS_CRT_X509) + return gnutls_assert_val (DANE_E_INVALID_REQUEST); + + *verify = 0; + idx = 0; + do + { + ret = dane_query_data (r, idx++, &usage, &type, &match, &data); + if (ret == DANE_E_REQUESTED_DATA_NOT_AVAILABLE) + break; + + if (ret < 0) + { + gnutls_assert (); + goto cleanup; + } + + if (!(vflags & DANE_VFLAG_ONLY_CHECK_EE_USAGE) + && (usage == DANE_CERT_USAGE_LOCAL_CA + || usage == DANE_CERT_USAGE_CA)) + { + ret = + verify_ca (chain, chain_size, chain_type, type, match, &data, + verify); + if (ret < 0) + { + gnutls_assert (); + goto cleanup; + } + checked = 1; + } + else if (!(vflags & DANE_VFLAG_ONLY_CHECK_CA_USAGE) + && (usage == DANE_CERT_USAGE_LOCAL_EE + || usage == DANE_CERT_USAGE_EE)) + { + ret = verify_ee (&chain[0], chain_type, type, match, &data, verify); + if (ret < 0) + { + gnutls_assert (); + goto cleanup; + } + checked = 1; + } + } + while (1); + + if ((vflags & DANE_VFLAG_FAIL_IF_NOT_CHECKED) && checked == 0) + ret = gnutls_assert_val (DANE_E_REQUESTED_DATA_NOT_AVAILABLE); + else + ret = 0; cleanup: - if (s == NULL) dane_state_deinit(_s); - return ret; + if (s == NULL) + dane_state_deinit (_s); + return ret; } @@ -697,38 +782,45 @@ cleanup: * negative error value. * **/ -int dane_verify_crt (dane_state_t s, - const gnutls_datum_t *chain, unsigned chain_size, - gnutls_certificate_type_t chain_type, - const char * hostname, const char* proto, unsigned int port, - unsigned int sflags, unsigned int vflags, - unsigned int *verify) +int +dane_verify_crt (dane_state_t s, + const gnutls_datum_t * chain, unsigned chain_size, + gnutls_certificate_type_t chain_type, + const char *hostname, const char *proto, unsigned int port, + unsigned int sflags, unsigned int vflags, + unsigned int *verify) { -dane_state_t _s = NULL; -dane_query_t r = NULL; -int ret; - - *verify = 0; - if (s == NULL) { - ret = dane_state_init(&_s, sflags); - if (ret < 0) { - gnutls_assert(); - return ret; - } - } else - _s = s; - - ret = dane_query_tlsa(_s, &r, hostname, proto, port); - if (ret < 0) { - gnutls_assert(); - goto cleanup; - } - ret = dane_verify_crt_raw (s, chain, chain_size, chain_type, - r, sflags, vflags, verify); + dane_state_t _s = NULL; + dane_query_t r = NULL; + int ret; + + *verify = 0; + if (s == NULL) + { + ret = dane_state_init (&_s, sflags); + if (ret < 0) + { + gnutls_assert (); + return ret; + } + } + else + _s = s; + + ret = dane_query_tlsa (_s, &r, hostname, proto, port); + if (ret < 0) + { + gnutls_assert (); + goto cleanup; + } + ret = dane_verify_crt_raw (s, chain, chain_size, chain_type, + r, sflags, vflags, verify); cleanup: - if (s == NULL) dane_state_deinit(_s); - if (r != NULL) dane_query_deinit(r); - return ret; + if (s == NULL) + dane_state_deinit (_s); + if (r != NULL) + dane_query_deinit (r); + return ret; } /** @@ -750,25 +842,27 @@ cleanup: * negative error value. * **/ -int dane_verify_session_crt ( - dane_state_t s, - gnutls_session_t session, - const char * hostname, const char* proto, unsigned int port, - unsigned int sflags, unsigned int vflags, - unsigned int *verify) +int +dane_verify_session_crt (dane_state_t s, + gnutls_session_t session, + const char *hostname, const char *proto, + unsigned int port, unsigned int sflags, + unsigned int vflags, unsigned int *verify) { -const gnutls_datum_t *cert_list; -unsigned int cert_list_size = 0; -unsigned int type; + const gnutls_datum_t *cert_list; + unsigned int cert_list_size = 0; + unsigned int type; - cert_list = gnutls_certificate_get_peers(session, &cert_list_size); - if (cert_list_size == 0) { - return gnutls_assert_val(DANE_E_NO_CERT); - } + cert_list = gnutls_certificate_get_peers (session, &cert_list_size); + if (cert_list_size == 0) + { + return gnutls_assert_val (DANE_E_NO_CERT); + } - type = gnutls_certificate_type_get(session); + type = gnutls_certificate_type_get (session); - return dane_verify_crt(s, cert_list, cert_list_size, type, hostname, proto, port, sflags, vflags, verify); + return dane_verify_crt (s, cert_list, cert_list_size, type, hostname, proto, + port, sflags, vflags, verify); } /** @@ -788,7 +882,7 @@ unsigned int type; **/ int dane_verification_status_print (unsigned int status, - gnutls_datum_t * out, unsigned int flags) + gnutls_datum_t * out, unsigned int flags) { gnutls_buffer_st str; int ret; @@ -809,8 +903,9 @@ dane_verification_status_print (unsigned int status, if (status & DANE_VERIFY_NO_DANE_INFO) _gnutls_buffer_append_str (&str, _("There were no DANE information. ")); - ret = _gnutls_buffer_to_datum( &str, out); - if (out->size > 0) out->size--; + ret = _gnutls_buffer_to_datum (&str, out); + if (out->size > 0) + out->size--; return ret; } -- cgit v1.2.1