danetool: improvements in information presentation

diff --git a/src/danetool-args.def b/src/danetool-args.def
index f6a4cb7f702e1541b2868e291002d0c4860ad706..80a26f20fca1fd60db04e43e5558b8fd12d897ff 100644 (file)
--- a/src/danetool-args.def
+++ b/src/danetool-args.def
@@ -44,7 +44,7 @@ flag = {
     name      = check;
     arg-type  = string;
     descrip   = "Check a host's DANE TLSA entry";
-    doc = "Obtains the DANE TLSA entry from the given hostname and prints information. Note that the actual certificate of the host has to be provided using --load-certificate.";
+    doc = "Obtains the DANE TLSA entry from the given hostname and prints information. Note that the actual certificate of the host can be provided using --load-certificate, otherwise danetool will connect to the server to obtain it. The exit code on verification success will be zero.";
 };
 
 flag = {
@@ -59,44 +59,6 @@ flag = {
     doc = "Checks the trust anchor's and CA's certificate only. End-entities are not considered.";
 };
 
-flag = {
-    name      = insecure;
-    descrip   = "Do not verify any DNSSEC signature";
-    doc = "Ignores any DNSSEC signature verification results.";
-};
-
-flag = {
-    name      = local-dns;
-    descrip   = "Use the local DNS server for DNSSEC resolving";
-    disabled;
-    disable   = "no";
-    doc       = "This option will use the local DNS server for DNSSEC.
-This is disabled by default due to many servers not allowing DNSSEC.";
-};
-
-flag = {
-    name      = inder;
-    descrip   = "Use DER format for input certificates and private keys";
-    disabled;
-    disable   = "no";
-    doc       = "The input files will be assumed to be in DER or RAW format. 
-Unlike options that in PEM input would allow multiple input data (e.g. multiple 
-certificates), when reading in DER format a single data structure is read.";
-};
-
-flag = {
-    name      = inraw;
-    aliases   = inder;
-};
-
-flag = {
-    name      = print-raw;
-    descrip   = "Print the received DANE data in raw format";
-    disabled;
-    disable   = "no";
-    doc = "This option will print the received DANE data.";
-};
-
 flag = {
     name      = tlsa-rr;
     descrip   = "Print the DANE RR data on a certificate or public key";
@@ -153,6 +115,52 @@ flag = {
     doc      = "DANE distinguishes certificates and public keys offered via the DNSSEC to trusted and local entities. This flag indicates that this is a domain-issued certificate, meaning that there could be no CA involved.";
 };
 
+flag = {
+    name      = local-dns;
+    descrip   = "Use the local DNS server for DNSSEC resolving";
+    disabled;
+    disable   = "no";
+    doc       = "This option will use the local DNS server for DNSSEC.
+This is disabled by default due to many servers not allowing DNSSEC.";
+};
+
+flag = {
+    name      = insecure;
+    descrip   = "Do not verify any DNSSEC signature";
+    doc = "Ignores any DNSSEC signature verification results.";
+};
+
+flag = {
+    name      = inder;
+    descrip   = "Use DER format for input certificates and private keys";
+    disabled;
+    disable   = "no";
+    doc       = "The input files will be assumed to be in DER or RAW format. 
+Unlike options that in PEM input would allow multiple input data (e.g. multiple 
+certificates), when reading in DER format a single data structure is read.";
+};
+
+flag = {
+    name      = inraw;
+    aliases   = inder;
+};
+
+flag = {
+    name      = print-raw;
+    descrip   = "Print the received DANE data in raw format";
+    disabled;
+    disable   = "no";
+    doc = "This option will print the received DANE data.";
+};
+
+flag = {
+    name      = quiet;
+    descrip   = "Suppress several informational messages";
+    doc      = "In that case on the exit code can be used as an indication of verification success";
+};
+
+
+
 doc-section = {
   ds-type = 'SEE ALSO';
   ds-format = 'texi';

diff --git a/src/danetool.c b/src/danetool.c
index dd3cd62dd90b92514087f1db39a67c810e50a185..cce6b3747105d20770bcd086f61b4842dd55cec3 100644 (file)
--- a/src/danetool.c
+++ b/src/danetool.c
@@ -51,7 +51,7 @@
 #include "certtool-common.h"
 #include "socket.h"
 
-static const char* obtain_cert(const char *hostname, const char *proto, unsigned int port);
+static const char* obtain_cert(const char *hostname, const char *proto, unsigned int port, unsigned quiet);
 static void cmd_parser(int argc, char **argv);
 static void dane_info(const char *host, const char *proto,
                      unsigned int port, unsigned int ca,
@@ -183,7 +183,7 @@ static void dane_check(const char *host, const char *proto,
 #ifdef HAVE_DANE
        dane_state_t s;
        dane_query_t q;
-       int ret, retcode = 0;
+       int ret, retcode = 1;
        unsigned entries;
        unsigned int flags = DANE_F_IGNORE_LOCAL_RESOLVER, i;
        unsigned int usage, type, match;
@@ -191,6 +191,7 @@ static void dane_check(const char *host, const char *proto,
        size_t size;
        unsigned del = 0;
        unsigned vflags = DANE_VFLAG_FAIL_IF_NOT_CHECKED;
+       const char *str;
 
        if (ENABLED_OPT(LOCAL_DNS))
                flags = 0;
@@ -285,22 +286,30 @@ static void dane_check(const char *host, const char *proto,
                        exit(1);
                }
 
-               if (entries > 1)
-                       printf("\nEntry %d:\n", i + 1);
+               if (entries > 1 && !HAVE_OPT(QUIET))
+                       fprintf(outfile, "\n==== Entry %d ====\n", i + 1);
 
                fprintf(outfile,
                        "_%u._%s.%s. IN TLSA ( %.2x %.2x %.2x %s )\n",
                        port, proto, host, usage, type, match, lbuffer);
-               printf("Certificate usage: %s (%.2x)\n",
-                      dane_cert_usage_name(usage), usage);
-               printf("Certificate type:  %s (%.2x)\n",
-                      dane_cert_type_name(type), type);
-               printf("Contents:          %s (%.2x)\n",
-                      dane_match_type_name(match), match);
-               printf("Data:              %s\n\n", lbuffer);
+               
+               if (!HAVE_OPT(QUIET)) {
+                       str = dane_cert_usage_name(usage);
+                       if (str == NULL) str= "Unknown";
+                       fprintf(outfile, "Certificate usage: %s (%.2x)\n", str, usage);
+
+                       str = dane_cert_type_name(type);
+                       if (str == NULL) str= "Unknown";
+                       fprintf(outfile, "Certificate type:  %s (%.2x)\n", str, type);
+
+                       str = dane_match_type_name(match);
+                       if (str == NULL) str= "Unknown";
+                       fprintf(outfile, "Contents:          %s (%.2x)\n", str, match);
+                       fprintf(outfile, "Data:              %s\n\n", lbuffer);
+               }
 
                if (!cinfo->cert) {
-                       cinfo->cert = obtain_cert(host, proto, port);
+                       cinfo->cert = obtain_cert(host, proto, port, HAVE_OPT(QUIET));
                        del = 1;
                }
 
@@ -373,11 +382,13 @@ static void dane_check(const char *host, const char *proto,
                                        exit(1);
                                }
 
-                               printf("\nVerification: %s\n", out.data);
+                               if (!HAVE_OPT(QUIET))
+                                       fprintf(outfile, "\nVerification: %s\n", out.data);
                                gnutls_free(out.data);
 
-                               if (status != 0)
-                                       retcode = 1;
+                               /* if there is at least one correct accept */
+                               if (status == 0)
+                                       retcode = 0;
 
                                for (i = 0; i < clist_size; i++) {
                                        gnutls_free(certs[i].data);
@@ -388,6 +399,7 @@ static void dane_check(const char *host, const char *proto,
 
                        if (del != 0) {
                                remove(cinfo->cert);
+                               cinfo->cert = NULL;
                        }
                } else {
                        fprintf(stderr,
@@ -621,20 +633,30 @@ static int get_cert(socket_st *hd, const char *hostname, unsigned udp, int fd)
        return 0;
 }
 
-static const char *obtain_cert(const char *hostname, const char *proto, unsigned int port)
+static const char *obtain_cert(const char *hostname, const char *proto, unsigned port, unsigned quiet)
 {
        socket_st hd;
        char txt_port[16];
        unsigned udp = 0;
-       static char tmpfile[32] = "danetool-certXXXXXX";
+       static char tmpfile[32];
        int fd, ret;
+       const char *str = "Obtaining certificate from";
 
        if (strcmp(proto, "udp") == 0)
                udp = 1;
+       else if (strcmp(proto, "tcp") != 0) {
+               /* we cannot handle this protocol */
+               return NULL;
+       }
+
+       strcpy(tmpfile, "danetool-certXXXXXX");
 
        sockets_init();
        snprintf(txt_port, sizeof(txt_port), "%u", port);
-       socket_open(&hd, hostname, port_to_service(txt_port, proto), udp, "Obtaining certificate from");
+
+       if (quiet)
+               str = NULL;
+       socket_open(&hd, hostname, port_to_service(txt_port, proto), udp, str);
 
        fd = mkstemp(tmpfile);
        if (fd == -1) {

diff --git a/src/socket.c b/src/socket.c
index 1b2d851becd9e99c6c4aaa17ffaaa67bef8e9744..ca38027f51d7c8c983556705d138432125ec3a93 100644 (file)
--- a/src/socket.c
+++ b/src/socket.c
@@ -150,7 +150,9 @@ socket_open(socket_st * hd, const char *hostname, const char *service,
        char buffer[MAX_BUF + 1];
        char portname[16] = { 0 };
 
-       printf("Resolving '%s'...\n", hostname);
+       if (msg != NULL)
+               printf("Resolving '%s'...\n", hostname);
+
        /* get server name */
        memset(&hints, 0, sizeof(hints));
        hints.ai_socktype = udp ? SOCK_DGRAM : SOCK_STREAM;