utils: unify coding style of the OCSP code

diff --git a/src/utils/common/tls.c b/src/utils/common/tls.c
index 913eae6e7fd902d6d3e6919f1599ca22bc6d2414..3c5befacaa0b263ffd3d3fecbaa6e36f78e0c235 100644 (file)
--- a/src/utils/common/tls.c
+++ b/src/utils/common/tls.c
@@ -18,8 +18,8 @@
 #include <stdbool.h>
 #include <string.h>
 #include <gnutls/gnutls.h>
-#include <gnutls/x509.h>
 #include <gnutls/ocsp.h>
+#include <gnutls/x509.h>
 #include <poll.h>
 
 #include "utils/common/tls.h"
@@ -82,7 +82,7 @@ int tls_params_copy(tls_params_t *dst, const tls_params_t *src)
                }
        }
 
-    dst->require_stapled = src->require_stapled;
+       dst->require_stapled = src->require_stapled;
 
        ptrnode_t *n;
        WALK_LIST(n, src->ca_files) {
@@ -150,124 +150,124 @@ static bool check_pin(const uint8_t *cert_pin, size_t cert_pin_len, const list_t
 }
 
 // trust stapled OCSP data for 7 days.
-#define OCSP_VALID_PERIOD (7 * 24 * 60 * 60) 
+#define OCSP_VALID_PERIOD (7 * 24 * 60 * 60)
 static bool verify_ocsp(gnutls_session_t *session)
 {
-    bool ret = false;
-    gnutls_datum_t ocsp_resp_raw;
-    gnutls_ocsp_resp_t ocsp_resp;
-    gnutls_x509_crt_t issuer_cert, server_cert;
-    const gnutls_datum_t *cert_list;
-    unsigned int cert_list_size = 0;
-    bool deinit_issuer = false, deinit_server = false;
-    bool deinit_ocsp = false, deinit_creds = false;
-    gnutls_certificate_credentials_t xcred;
-    unsigned int status;
-    time_t rtime, vtime, ntime, now = time(0);
-
-    if (gnutls_ocsp_status_request_get(*session, &ocsp_resp_raw) != 0) {
-        WARN("TLS, unable to retrieve stapled OCSP data\n");
-        goto cleanup;
-    }
-    if (gnutls_ocsp_resp_init(&ocsp_resp) < 0) {
-        WARN("TLS, unable to init OCSP data\n");
-        goto cleanup;
-    }
-    deinit_ocsp = true;
-    if (gnutls_ocsp_resp_import(ocsp_resp, &ocsp_resp_raw) < 0) {
-        WARN("TLS, unable to import OCSP response\n");
-        goto cleanup;
-    }
-
-    cert_list = gnutls_certificate_get_peers(*session, &cert_list_size);
-    if (cert_list_size == 0) {
-        WARN("TLS, unable to retrieve peer certs when verifying OCSP\n");
-        goto cleanup;
-    }
-    if (gnutls_x509_crt_init(&server_cert) < 0) {
-        WARN("TLS, unable to init server cert when verifying OCSP\n");
-        goto cleanup;
-    }
-    deinit_server = true;
-
-    if (gnutls_x509_crt_import(server_cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0) {
-        WARN("TLS, unable to import server cert when verifying OCSP\n");
-        goto cleanup;
-    }
-
-    if (gnutls_certificate_allocate_credentials(&xcred) != GNUTLS_E_SUCCESS) {
-        WARN("TLS, unable to allocate credentials when verifying OCSP\n");
-        goto cleanup;
-    }
-    deinit_creds = true;
-
-    if (gnutls_certificate_get_issuer(xcred, server_cert, &issuer_cert, 0) < 0) {
-        if (cert_list_size < 2) {
-            WARN("TLS, unable to get issuer (CA) cert when verifying OCSP\n");
-            goto cleanup;
-        }
-        if (gnutls_x509_crt_init(&issuer_cert) < 0) {
-            WARN("TLS, unable to init issuer cert structure when verifying OCSP\n");
-            goto cleanup;
-        }
-        deinit_issuer = true;
-        if (gnutls_x509_crt_import(issuer_cert, &cert_list[1], GNUTLS_X509_FMT_DER) < 0) {
-            WARN("TLS, unable to import issuer cert when verifying OCSP\n");
-            goto cleanup;
-        }
-    }
-    deinit_issuer = true;
-
-    if (gnutls_ocsp_resp_check_crt(ocsp_resp, 0, server_cert) < 0) {
-        WARN("TLS, OCSP response either empty or not for provided server certificate\n");
-        goto cleanup;
-    }
-    if (gnutls_ocsp_resp_verify_direct(ocsp_resp, issuer_cert, &status, 0) < 0) {
-        WARN("TLS, unable to verify OCSP response against issuer cert\n");
-        goto cleanup;
-    }
-    if (status != 0) {
-        WARN("TLS, got a non-zero status when verifying OCSP response against issuer cert\n");
-        goto cleanup;
-    }
-    if (gnutls_ocsp_resp_get_single(
-        ocsp_resp, 0, NULL, NULL, NULL, NULL, &status, &vtime, &ntime, &rtime, NULL) < 0) {
-        WARN("TLS, error reading OCSP response\n");
-        goto cleanup;
-    }
-    if (status == GNUTLS_OCSP_CERT_REVOKED) {
-        WARN("TLS, OCSP data shows that cert was revoked\n");
-        goto cleanup;
-    }
-    if (ntime == -1) {
-        if (now - vtime > OCSP_VALID_PERIOD) {
-            WARN("TLS, OCSP response is out of date.\n");
-            goto cleanup;
-        }
-    } else {
-        if (ntime < now) {
-            WARN("TLS, a newer OCSP response is available but was not sent\n");
-            goto cleanup;
-        }
-    }
-
-    ret = true; // only if we get here is the ocsp result completely valid
+       bool ret = false;
+       gnutls_datum_t ocsp_resp_raw;
+       gnutls_ocsp_resp_t ocsp_resp;
+       gnutls_x509_crt_t issuer_cert, server_cert;
+       const gnutls_datum_t *cert_list;
+       unsigned int cert_list_size = 0;
+       bool deinit_issuer = false, deinit_server = false;
+       bool deinit_ocsp = false, deinit_creds = false;
+       gnutls_certificate_credentials_t xcred;
+       unsigned int status;
+       time_t rtime, vtime, ntime, now = time(0);
+
+       if (gnutls_ocsp_status_request_get(*session, &ocsp_resp_raw) != 0) {
+               WARN("TLS, unable to retrieve stapled OCSP data\n");
+               goto cleanup;
+       }
+       if (gnutls_ocsp_resp_init(&ocsp_resp) < 0) {
+               WARN("TLS, unable to init OCSP data\n");
+               goto cleanup;
+       }
+       deinit_ocsp = true;
+       if (gnutls_ocsp_resp_import(ocsp_resp, &ocsp_resp_raw) < 0) {
+               WARN("TLS, unable to import OCSP response\n");
+               goto cleanup;
+       }
+
+       cert_list = gnutls_certificate_get_peers(*session, &cert_list_size);
+       if (cert_list_size == 0) {
+               WARN("TLS, unable to retrieve peer certs when verifying OCSP\n");
+               goto cleanup;
+       }
+       if (gnutls_x509_crt_init(&server_cert) < 0) {
+               WARN("TLS, unable to init server cert when verifying OCSP\n");
+               goto cleanup;
+       }
+       deinit_server = true;
+
+       if (gnutls_x509_crt_import(server_cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0) {
+               WARN("TLS, unable to import server cert when verifying OCSP\n");
+               goto cleanup;
+       }
+
+       if (gnutls_certificate_allocate_credentials(&xcred) != GNUTLS_E_SUCCESS) {
+               WARN("TLS, unable to allocate credentials when verifying OCSP\n");
+               goto cleanup;
+       }
+       deinit_creds = true;
+
+       if (gnutls_certificate_get_issuer(xcred, server_cert, &issuer_cert, 0) < 0) {
+               if (cert_list_size < 2) {
+                       WARN("TLS, unable to get issuer (CA) cert when verifying OCSP\n");
+                       goto cleanup;
+               }
+               if (gnutls_x509_crt_init(&issuer_cert) < 0) {
+                       WARN("TLS, unable to init issuer cert structure when verifying OCSP\n");
+                       goto cleanup;
+               }
+               deinit_issuer = true;
+               if (gnutls_x509_crt_import(issuer_cert, &cert_list[1], GNUTLS_X509_FMT_DER) < 0) {
+                       WARN("TLS, unable to import issuer cert when verifying OCSP\n");
+                       goto cleanup;
+               }
+       }
+       deinit_issuer = true;
+
+       if (gnutls_ocsp_resp_check_crt(ocsp_resp, 0, server_cert) < 0) {
+               WARN("TLS, OCSP response either empty or not for provided server certificate\n");
+               goto cleanup;
+       }
+       if (gnutls_ocsp_resp_verify_direct(ocsp_resp, issuer_cert, &status, 0) < 0) {
+               WARN("TLS, unable to verify OCSP response against issuer cert\n");
+               goto cleanup;
+       }
+       if (status != 0) {
+               WARN("TLS, got a non-zero status when verifying OCSP response against issuer cert\n");
+               goto cleanup;
+       }
+       if (gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL, &status,
+                                       &vtime, &ntime, &rtime, NULL) < 0) {
+               WARN("TLS, error reading OCSP response\n");
+               goto cleanup;
+       }
+       if (status == GNUTLS_OCSP_CERT_REVOKED) {
+               WARN("TLS, OCSP data shows that cert was revoked\n");
+               goto cleanup;
+       }
+       if (ntime == -1) {
+               if (now - vtime > OCSP_VALID_PERIOD) {
+                       WARN("TLS, OCSP response is out of date.\n");
+                       goto cleanup;
+               }
+       } else {
+               if (ntime < now) {
+                       WARN("TLS, a newer OCSP response is available but was not sent\n");
+                       goto cleanup;
+               }
+       }
+
+       ret = true; // only if we get here is the ocsp result completely valid
 
 cleanup:
-    if (deinit_server) { 
-        gnutls_x509_crt_deinit(server_cert);
-    }
-    if (deinit_issuer) {
-        gnutls_x509_crt_deinit(issuer_cert);
-    }
-    if (deinit_ocsp) {
-        gnutls_ocsp_resp_deinit(ocsp_resp);
-    }
-    if (deinit_creds) {
-        gnutls_certificate_free_credentials(xcred);
-    }
-
-    return ret;
+       if (deinit_server) {
+               gnutls_x509_crt_deinit(server_cert);
+       }
+       if (deinit_issuer) {
+               gnutls_x509_crt_deinit(issuer_cert);
+       }
+       if (deinit_ocsp) {
+               gnutls_ocsp_resp_deinit(ocsp_resp);
+       }
+       if (deinit_creds) {
+               gnutls_certificate_free_credentials(xcred);
+       }
+
+       return ret;
 }
 
 static int check_certificates(gnutls_session_t session, const list_t *pins)
@@ -394,12 +394,14 @@ static int verify_certificate(gnutls_session_t session)
        }
        gnutls_free(msg.data);
 
-    if (status != 0) { return GNUTLS_E_CERTIFICATE_ERROR; }
+       if (status != 0) {
+               return GNUTLS_E_CERTIFICATE_ERROR;
+       }
 
-    if (ctx->params->require_stapled && !verify_ocsp(&session)) {
-        WARN("TLS, failed to validate required OCSP data\n");
-        return GNUTLS_E_CERTIFICATE_ERROR;
-    }
+       if (ctx->params->require_stapled && !verify_ocsp(&session)) {
+               WARN("TLS, failed to validate required OCSP data\n");
+               return GNUTLS_E_CERTIFICATE_ERROR;
+       }
 
        return GNUTLS_E_SUCCESS;
 }

diff --git a/src/utils/kdig/kdig_params.c b/src/utils/kdig/kdig_params.c
index bcadcadde2bed2ebec3fb0cd5898796dddb51641..53752c19dd63c77232b4c2704db5b35a7fa0a686 100644 (file)
--- a/src/utils/kdig/kdig_params.c
+++ b/src/utils/kdig/kdig_params.c
@@ -779,20 +779,20 @@ static int opt_notls_certfile(const char *arg, void *query)
 
 static int opt_require_stapled(const char *arg, void *query)
 {
-    query_t *q = query;
+       query_t *q = query;
 
-    q->tls.require_stapled = true;
+       q->tls.require_stapled = true;
 
-    return KNOT_EOK;
+       return KNOT_EOK;
 }
 
 static int opt_norequire_stapled(const char *arg, void *query)
 {
-    query_t *q = query;
+       query_t *q = query;
 
-    q->tls.require_stapled = false;
+       q->tls.require_stapled = false;
 
-    return KNOT_EOK;
+       return KNOT_EOK;
 }
 
 static int opt_nsid(const char *arg, void *query)