Move more comments that confuse indent

[openssl.git] / crypto / x509 / x509_vfy.c

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 30fc974a2091f58e67820972b4cd1f6b5896dc7a..31633d74ba0baa6df288844365ddef07026ba59a 100644 (file)
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -119,6 +119,7 @@ static int check_trust(X509_STORE_CTX *ctx);
 static int check_revocation(X509_STORE_CTX *ctx);
 static int check_cert(X509_STORE_CTX *ctx);
 static int check_policy(X509_STORE_CTX *ctx);
+static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
 
 static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
                        unsigned int *preasons,
@@ -519,7 +520,6 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
        ctx->current_cert = x;
        ctx->current_issuer = issuer;
        return ctx->verify_cb(0, ctx);
-       return 0;
 }
 
 /* Alternative lookup method: look from a STACK stored in other_ctx */
@@ -554,14 +554,15 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
        int allow_proxy_certs;
        cb=ctx->verify_cb;
 
-       /* must_be_ca can have 1 of 3 values:
-          -1: we accept both CA and non-CA certificates, to allow direct
-              use of self-signed certificates (which are marked as CA).
-          0:  we only accept non-CA certificates.  This is currently not
-              used, but the possibility is present for future extensions.
-          1:  we only accept CA certificates.  This is currently used for
-              all certificates in the chain except the leaf certificate.
-       */
+       /*-
+        *  must_be_ca can have 1 of 3 values:
+        * -1: we accept both CA and non-CA certificates, to allow direct
+        *     use of self-signed certificates (which are marked as CA).
+        * 0:  we only accept non-CA certificates.  This is currently not
+        *     used, but the possibility is present for future extensions.
+        * 1:  we only accept CA certificates.  This is currently used for
+        *     all certificates in the chain except the leaf certificate.
+        */
        must_be_ca = -1;
 
        /* CRL path validation */
@@ -743,23 +744,38 @@ static int check_id_error(X509_STORE_CTX *ctx, int errcode)
        return ctx->verify_cb(0, ctx);
        }
 
+static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id)
+       {
+       int i;
+       int n = sk_OPENSSL_STRING_num(id->hosts);
+       char *name;
+
+       for (i = 0; i < n; ++i)
+               {
+               name = sk_OPENSSL_STRING_value(id->hosts, i);
+               if (X509_check_host(x, name, 0, id->hostflags,
+                                   &id->peername) > 0)
+                       return 1;
+               }
+       return n == 0;
+       }
+
 static int check_id(X509_STORE_CTX *ctx)
        {
        X509_VERIFY_PARAM *vpm = ctx->param;
        X509_VERIFY_PARAM_ID *id = vpm->id;
        X509 *x = ctx->cert;
-       if (id->host && !X509_check_host(x, id->host, id->hostlen,
-                                        id->hostflags))
+       if (id->hosts && check_hosts(x, id) <= 0)
                {
                if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH))
                        return 0;
                }
-       if (id->email && !X509_check_email(x, id->email, id->emaillen, 0))
+       if (id->email && X509_check_email(x, id->email, id->emaillen, 0) <= 0)
                {
                if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH))
                        return 0;
                }
-       if (id->ip && !X509_check_ip(x, id->ip, id->iplen, 0))
+       if (id->ip && X509_check_ip(x, id->ip, id->iplen, 0) <= 0)
                {
                if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))
                        return 0;
@@ -1320,7 +1336,8 @@ static int check_crl_chain(X509_STORE_CTX *ctx,
        return 0;
        }
 
-/* Check for match between two dist point names: three separate cases.
+/*-
+ * Check for match between two dist point names: three separate cases.
  * 1. Both are relative names and compare X509_NAME types.
  * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES.
  * 3. Both are full names and compare two GENERAL_NAMES.