finishing TLSA validation logic

1 files changed, 64 insertions, 18 deletions

diff --git a/src/namestore/plugin_gtk_namestore_tlsa.c b/src/namestore/plugin_gtk_namestore_tlsa.c
index 2228831d..19f88d11 100644
--- a/src/namestore/plugin_gtk_namestore_tlsa.c
+++ b/src/namestore/plugin_gtk_namestore_tlsa.c
@@ -31,6 +31,7 @@
 #include "gnunet_gtk_namestore_plugin.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/x509.h>
+#include <gnutls/abstract.h>
 
 
 /**
@@ -445,19 +446,18 @@ tlsa_validate (void *cls,
   GtkTextIter ti_start;
   GtkTextIter ti_end;
   gnutls_datum_t datum;
-  gnutls_pkcs7_t pkcs7;
+  gnutls_x509_crt_t cert;
+  gnutls_pubkey_t pk;
   int ret;
   unsigned int matching_type;
+  unsigned int selector;
+  int err;
 
-  fprintf (stderr,
-           "Validating...\n");
   cb = GTK_COMBO_BOX (gtk_builder_get_object (builder,
                                               "edit_dialog_protocol_combobox"));
   if (! gtk_combo_box_get_active_iter (cb,
                                        &iter))
   {
-    fprintf (stderr,
-             "No protocol selected...\n");
     return GNUNET_SYSERR;
   }
 
@@ -479,31 +479,74 @@ tlsa_validate (void *cls,
                                      bin))
     {
       /* not hex */
-      fprintf (stderr,
-               "Certificate value is not in hex...\n");
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _("Certificate value is not in hex...\n"));
       return GNUNET_SYSERR;
     }
     matching_type = get_selected_radio_value (builder,
                                               matching_type_buttons);
-
+    selector = get_selected_radio_value (builder,
+                                       selector_buttons);
     switch (matching_type)
     {
     case 0: /* exact match */
       datum.size = sizeof (bin);
       datum.data = bin;
-      gnutls_pkcs7_init (&pkcs7);
-      if (GNUTLS_E_SUCCESS !=
-          gnutls_pkcs7_import (pkcs7,
-                               &datum,
-                               GNUTLS_X509_FMT_DER))
+      switch (selector)
       {
-        fprintf (stderr,
-                 "Certificate value is not PKCS7...\n");
+      case 0: /* full Cert */
+        if (GNUTLS_E_SUCCESS !=
+            (err = gnutls_x509_crt_init (&cert)))
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      _("Failed to initialize CERT: %s\n"),
+                      gnutls_strerror_name (err));
+          ret = GNUNET_SYSERR;
+          break;
+        }
+        if (GNUTLS_E_SUCCESS !=
+            (err = gnutls_x509_crt_import (cert,
+                                           &datum,
+                                           GNUTLS_X509_FMT_DER)))
+          {
+            GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                        _("Failed to parse CERT: %s\n"),
+                        gnutls_strerror_name (err));
+            ret = GNUNET_SYSERR;
+          }
+        else
+          ret = GNUNET_OK;
+        gnutls_x509_crt_deinit (cert);
+        break;
+      case 1: /* subject public key only */
+        if (GNUTLS_E_SUCCESS !=
+            (err = gnutls_pubkey_init (&pk)))
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      _("Failed to initialize PK: %s\n"),
+                      gnutls_strerror_name (err));
+          ret = GNUNET_SYSERR;
+          break;
+        }
+        if (GNUTLS_E_SUCCESS !=
+            (err = gnutls_pubkey_import (pk,
+                                         &datum,
+                                         GNUTLS_X509_FMT_DER)))
+          {
+            GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                        _("Failed to parse PK: %s\n"),
+                        gnutls_strerror_name (err));
+            ret = GNUNET_SYSERR;
+          }
+        else
+          ret = GNUNET_OK;
+        gnutls_pubkey_deinit (pk);
+        break;
+      default:
+        GNUNET_break (0);
         ret = GNUNET_SYSERR;
+        break;
       }
-      else
-        ret = GNUNET_OK;
-      gnutls_pkcs7_deinit (pkcs7);
       break;
     case 1: /* SHA-256 hash */
       ret = (256 / 8 == slen / 2) ? GNUNET_OK : GNUNET_SYSERR;
@@ -513,6 +556,7 @@ tlsa_validate (void *cls,
       break;
     default:
       GNUNET_break (0);
+      ret = GNUNET_SYSERR;
       break;
     }
   }
@@ -593,6 +637,7 @@ libgnunet_plugin_gtk_namestore_tlsa_init (void *cls)
     { NULL, NULL }
   };
 
+  gnutls_global_init ();
   plugin = GNUNET_new (struct GNUNET_GTK_NAMESTORE_PluginFunctions);
   plugin->cls = env;
   plugin->dialog_glade_filename = "gnunet_namestore_edit_tlsa.glade";
@@ -619,6 +664,7 @@ libgnunet_plugin_gtk_namestore_tlsa_done (void *cls)
   struct GNUNET_GTK_NAMESTORE_PluginFunctions *plugin = cls;
 
   GNUNET_free (plugin);
+  gnutls_global_deinit ();
   return NULL;
 }