lib-ssl-iostream: ssl_iostream_cert_match_name() - Change to return bool

The return value makes much more sense as a boolean TRUE/FALSE than 0/-1.

diff --git a/src/lib-ssl-iostream/iostream-openssl-common.c b/src/lib-ssl-iostream/iostream-openssl-common.c
index d1732be9c8805309d817964d30d5fd836805029b..ecc7294c40548e70927fd9c00ffdd846adf7b08a 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl-common.c
+++ b/src/lib-ssl-iostream/iostream-openssl-common.c
@@ -154,7 +154,7 @@ static bool openssl_hostname_equals(const char *ssl_name, const char *host)
        return p != NULL && strcmp(ssl_name+2, p+1) == 0;
 }
 
-int openssl_cert_match_name(SSL *ssl, const char *verify_name)
+bool openssl_cert_match_name(SSL *ssl, const char *verify_name)
 {
        X509 *cert;
        STACK_OF(GENERAL_NAME) *gnames;
@@ -163,7 +163,7 @@ int openssl_cert_match_name(SSL *ssl, const char *verify_name)
        const char *dnsname;
        bool dns_names = FALSE;
        unsigned int i, count;
-       int ret;
+       bool ret;
 
        cert = SSL_get_peer_certificate(ssl);
        i_assert(cert != NULL);
@@ -203,11 +203,11 @@ int openssl_cert_match_name(SSL *ssl, const char *verify_name)
        /* verify against CommonName only when there wasn't any DNS
           SubjectAltNames */
        if (dns_names)
-               ret = i < count ? 0 : -1;
+               ret = i < count;
        else if (openssl_hostname_equals(get_cname(cert), verify_name))
-               ret = 0;
+               ret = TRUE;
        else
-               ret = -1;
+               ret = FALSE;
        X509_free(cert);
        return ret;
 }

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index f4a7a51a5e458033af268fe89bd489e2a8ad6795..04156f96998d10e0ba8e2a0de308331d35632489 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -587,12 +587,12 @@ int openssl_iostream_handle_error(struct ssl_iostream *ssl_io, int ret,
        return -1;
 }
 
-static int
+static bool
 openssl_iostream_cert_match_name(struct ssl_iostream *ssl_io,
                                 const char *verify_name)
 {
        if (!ssl_iostream_has_valid_client_cert(ssl_io))
-               return -1;
+               return FALSE;
 
        return openssl_cert_match_name(ssl_io->ssl, verify_name);
 }
@@ -629,7 +629,7 @@ static int openssl_iostream_handshake(struct ssl_iostream *ssl_io)
                        ssl_io->handshake_failed = TRUE;
                }
        } else if (ssl_io->connected_host != NULL && !ssl_io->handshake_failed) {
-               if (ssl_iostream_cert_match_name(ssl_io, ssl_io->connected_host) < 0) {
+               if (!ssl_iostream_cert_match_name(ssl_io, ssl_io->connected_host)) {
                        openssl_iostream_set_error(ssl_io, t_strdup_printf(
                                "SSL certificate doesn't match expected host name %s",
                                ssl_io->connected_host));

diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index 65a70d9bc4d657644ccd98515daaf7074d5ff975..405dff15528bb4eeae8f7ed77d847a774533599c 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -82,7 +82,7 @@ void openssl_iostream_global_deinit(void);
 
 int openssl_iostream_load_key(const struct ssl_iostream_cert *set,
                              EVP_PKEY **pkey_r, const char **error_r);
-int openssl_cert_match_name(SSL *ssl, const char *verify_name);
+bool openssl_cert_match_name(SSL *ssl, const char *verify_name);
 int openssl_get_protocol_options(const char *protocols);
 #define OPENSSL_ALL_PROTOCOL_OPTIONS \
        (SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1)

diff --git a/src/lib-ssl-iostream/iostream-ssl-private.h b/src/lib-ssl-iostream/iostream-ssl-private.h
index 6efb842a3b4e521e2a6183f7aa9b8df0d4236842..2242f63609aab9584841d5527c9801297e1f2957 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl-private.h
+++ b/src/lib-ssl-iostream/iostream-ssl-private.h
@@ -30,7 +30,7 @@ struct iostream_ssl_vfuncs {
        bool (*has_handshake_failed)(const struct ssl_iostream *ssl_io);
        bool (*has_valid_client_cert)(const struct ssl_iostream *ssl_io);
        bool (*has_broken_client_cert)(struct ssl_iostream *ssl_io);
-       int (*cert_match_name)(struct ssl_iostream *ssl_io, const char *name);
+       bool (*cert_match_name)(struct ssl_iostream *ssl_io, const char *name);
        const char *(*get_peer_name)(struct ssl_iostream *ssl_io);
        const char *(*get_server_name)(struct ssl_iostream *ssl_io);
        const char *(*get_compression)(struct ssl_iostream *ssl_io);

diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index 5431b771ea753b9c37e6673bfa7a44c94735b59e..f23819d37f3e16c720967370b071af56e80826b3 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -187,7 +187,7 @@ bool ssl_iostream_has_broken_client_cert(struct ssl_iostream *ssl_io)
        return ssl_vfuncs->has_broken_client_cert(ssl_io);
 }
 
-int ssl_iostream_cert_match_name(struct ssl_iostream *ssl_io, const char *name)
+bool ssl_iostream_cert_match_name(struct ssl_iostream *ssl_io, const char *name)
 {
        return ssl_vfuncs->cert_match_name(ssl_io, name);
 }
@@ -204,7 +204,7 @@ int ssl_iostream_check_cert_validity(struct ssl_iostream *ssl_io,
                                *error_r = "Received invalid SSL certificate";
                }
                return -1;
-       } else if (ssl_iostream_cert_match_name(ssl_io, host) < 0) {
+       } else if (!ssl_iostream_cert_match_name(ssl_io, host)) {
                *error_r = t_strdup_printf(
                        "SSL certificate doesn't match expected host name %s",
                        host);

diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index a385f95043ecf41ab3f776ff92d06710341dbd46..f3e5fef6b9c1f09979a6be1d71eeac8a7ff335e8 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -80,7 +80,8 @@ bool ssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io);
 bool ssl_iostream_has_broken_client_cert(struct ssl_iostream *ssl_io);
 int ssl_iostream_check_cert_validity(struct ssl_iostream *ssl_io,
                                     const char *host, const char **error_r);
-int ssl_iostream_cert_match_name(struct ssl_iostream *ssl_io, const char *name);
+/* Returns TRUE if the given name matches the SSL stream's certificate. */
+bool ssl_iostream_cert_match_name(struct ssl_iostream *ssl_io, const char *name);
 const char *ssl_iostream_get_peer_name(struct ssl_iostream *ssl_io);
 const char *ssl_iostream_get_compression(struct ssl_iostream *ssl_io);
 const char *ssl_iostream_get_server_name(struct ssl_iostream *ssl_io);

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index 017cd8630f0101c1a9d8576ac5c11e1e0f618f02..7485a896f19235ea71f68cb46bb95102e219d0d0 100644 (file)
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -603,7 +603,7 @@ bool ssl_proxy_has_broken_client_cert(struct ssl_proxy *proxy)
 
 int ssl_proxy_cert_match_name(struct ssl_proxy *proxy, const char *verify_name)
 {
-       return openssl_cert_match_name(proxy->ssl, verify_name);
+       return openssl_cert_match_name(proxy->ssl, verify_name) ? 0 : -1;
 }
 
 const char *ssl_proxy_get_peer_name(struct ssl_proxy *proxy)