191 static void dane_final(SSL_DANE *dane)  in dane_final()  argument
193     sk_danetls_record_pop_free(dane->trecs, tlsa_free);  in dane_final()
194     dane->trecs = NULL;  in dane_final()
196     sk_X509_pop_free(dane->certs, X509_free);  in dane_final()
197     dane->certs = NULL;  in dane_final()
199     X509_free(dane->mcert);  in dane_final()
200     dane->mcert = NULL;  in dane_final()
201     dane->mtlsa = NULL;  in dane_final()
202     dane->mdpth = -1;  in dane_final()
203     dane->pdpth = -1;  in dane_final()
214     if (!DANETLS_ENABLED(&from->dane))  in ssl_dane_dup()
217     num = sk_danetls_record_num(from->dane.trecs);  in ssl_dane_dup()
218     dane_final(&to->dane);  in ssl_dane_dup()
219     to->dane.flags = from->dane.flags;  in ssl_dane_dup()
220     to->dane.dctx = &to->ctx->dane;  in ssl_dane_dup()
221     to->dane.trecs = sk_danetls_record_new_reserve(NULL, num);  in ssl_dane_dup()
223     if (to->dane.trecs == NULL) {  in ssl_dane_dup()
229         danetls_record *t = sk_danetls_record_value(from->dane.trecs, i);  in ssl_dane_dup()
283 static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype)  in tlsa_md_get()  argument
285     if (mtype > dane->dctx->mdmax)  in tlsa_md_get()
287     return dane->dctx->mdevp[mtype];  in tlsa_md_get()
290 static int dane_tlsa_add(SSL_DANE *dane,  in dane_tlsa_add()  argument
301     if (dane->trecs == NULL) {  in dane_tlsa_add()
322         md = tlsa_md_get(dane, mtype);  in dane_tlsa_add()
387             if ((dane->certs == NULL &&  in dane_tlsa_add()
388                  (dane->certs = sk_X509_new_null()) == NULL) ||  in dane_tlsa_add()
389                 !sk_X509_push(dane->certs, cert)) {  in dane_tlsa_add()
432     num = sk_danetls_record_num(dane->trecs);  in dane_tlsa_add()
434         danetls_record *rec = sk_danetls_record_value(dane->trecs, i);  in dane_tlsa_add()
444         if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])  in dane_tlsa_add()
449     if (!sk_danetls_record_insert(dane->trecs, t, i)) {  in dane_tlsa_add()
454     dane->umask |= DANETLS_USAGE_BIT(usage);  in dane_tlsa_add()
622     s->dane.mdpth = -1;  in SSL_clear()
623     s->dane.pdpth = -1;  in SSL_clear()
624     X509_free(s->dane.mcert);  in SSL_clear()
625     s->dane.mcert = NULL;  in SSL_clear()
626     s->dane.mtlsa = NULL;  in SSL_clear()
706     s->dane.flags = ctx->dane.flags;  in SSL_new()
989     return dane_ctx_enable(&ctx->dane);  in SSL_CTX_dane_enable()
994     unsigned long orig = ctx->dane.flags;  in SSL_CTX_dane_set_flags()
996     ctx->dane.flags |= flags;  in SSL_CTX_dane_set_flags()
1002     unsigned long orig = ctx->dane.flags;  in SSL_CTX_dane_clear_flags()
1004     ctx->dane.flags &= ~flags;  in SSL_CTX_dane_clear_flags()
1010     SSL_DANE *dane = &s->dane;  in SSL_dane_enable()  local
1012     if (s->ctx->dane.mdmax == 0) {  in SSL_dane_enable()
1016     if (dane->trecs != NULL) {  in SSL_dane_enable()
1039     dane->mdpth = -1;  in SSL_dane_enable()
1040     dane->pdpth = -1;  in SSL_dane_enable()
1041     dane->dctx = &s->ctx->dane;  in SSL_dane_enable()
1042     dane->trecs = sk_danetls_record_new_null();  in SSL_dane_enable()
1044     if (dane->trecs == NULL) {  in SSL_dane_enable()
1053     unsigned long orig = ssl->dane.flags;  in SSL_dane_set_flags()
1055     ssl->dane.flags |= flags;  in SSL_dane_set_flags()
1061     unsigned long orig = ssl->dane.flags;  in SSL_dane_clear_flags()
1063     ssl->dane.flags &= ~flags;  in SSL_dane_clear_flags()
1069     SSL_DANE *dane = &s->dane;  in SSL_get0_dane_authority()  local
1071     if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)  in SSL_get0_dane_authority()
1073     if (dane->mtlsa) {  in SSL_get0_dane_authority()
1075             *mcert = dane->mcert;  in SSL_get0_dane_authority()
1077             *mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL;  in SSL_get0_dane_authority()
1079     return dane->mdpth;  in SSL_get0_dane_authority()
1085     SSL_DANE *dane = &s->dane;  in SSL_get0_dane_tlsa()  local
1087     if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)  in SSL_get0_dane_tlsa()
1089     if (dane->mtlsa) {  in SSL_get0_dane_tlsa()
1091             *usage = dane->mtlsa->usage;  in SSL_get0_dane_tlsa()
1093             *selector = dane->mtlsa->selector;  in SSL_get0_dane_tlsa()
1095             *mtype = dane->mtlsa->mtype;  in SSL_get0_dane_tlsa()
1097             *data = dane->mtlsa->data;  in SSL_get0_dane_tlsa()
1099             *dlen = dane->mtlsa->dlen;  in SSL_get0_dane_tlsa()
1101     return dane->mdpth;  in SSL_get0_dane_tlsa()
1106     return &s->dane;  in SSL_get0_dane()
1112     return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen);  in SSL_dane_tlsa_add()
1118     return dane_mtype_set(&ctx->dane, md, mtype, ord);  in SSL_CTX_dane_mtype_set()
1159     dane_final(&s->dane);  in SSL_free()
3231     dane_ctx_final(&a->dane);  in SSL_CTX_free()
4964     SSL_DANE *dane = &s->dane;  in ssl_validate_ct()  local
4988     if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) {  in ssl_validate_ct()
4989         switch (dane->mtlsa->usage) {  in ssl_validate_ct()