170 static void dane_final(SSL_DANE *dane)  in dane_final()  argument
172     sk_danetls_record_pop_free(dane->trecs, tlsa_free);  in dane_final()
173     dane->trecs = NULL;  in dane_final()
175     sk_X509_pop_free(dane->certs, X509_free);  in dane_final()
176     dane->certs = NULL;  in dane_final()
178     X509_free(dane->mcert);  in dane_final()
179     dane->mcert = NULL;  in dane_final()
180     dane->mtlsa = NULL;  in dane_final()
181     dane->mdpth = -1;  in dane_final()
182     dane->pdpth = -1;  in dane_final()
193     if (!DANETLS_ENABLED(&from->dane))  in ssl_dane_dup()
196     num = sk_danetls_record_num(from->dane.trecs);  in ssl_dane_dup()
197     dane_final(&to->dane);  in ssl_dane_dup()
198     to->dane.flags = from->dane.flags;  in ssl_dane_dup()
199     to->dane.dctx = &to->ctx->dane;  in ssl_dane_dup()
200     to->dane.trecs = sk_danetls_record_new_reserve(NULL, num);  in ssl_dane_dup()
202     if (to->dane.trecs == NULL) {  in ssl_dane_dup()
208         danetls_record *t = sk_danetls_record_value(from->dane.trecs, i);  in ssl_dane_dup()
262 static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype)  in tlsa_md_get()  argument
264     if (mtype > dane->dctx->mdmax)  in tlsa_md_get()
266     return dane->dctx->mdevp[mtype];  in tlsa_md_get()
269 static int dane_tlsa_add(SSL_DANE *dane,  in dane_tlsa_add()  argument
280     if (dane->trecs == NULL) {  in dane_tlsa_add()
301         md = tlsa_md_get(dane, mtype);  in dane_tlsa_add()
380             if ((dane->certs == NULL &&  in dane_tlsa_add()
381                  (dane->certs = sk_X509_new_null()) == NULL) ||  in dane_tlsa_add()
382                 !sk_X509_push(dane->certs, cert)) {  in dane_tlsa_add()
426     num = sk_danetls_record_num(dane->trecs);  in dane_tlsa_add()
428         danetls_record *rec = sk_danetls_record_value(dane->trecs, i);  in dane_tlsa_add()
438         if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])  in dane_tlsa_add()
443     if (!sk_danetls_record_insert(dane->trecs, t, i)) {  in dane_tlsa_add()
448     dane->umask |= DANETLS_USAGE_BIT(usage);  in dane_tlsa_add()
629     s->dane.mdpth = -1;  in SSL_clear()
630     s->dane.pdpth = -1;  in SSL_clear()
631     X509_free(s->dane.mcert);  in SSL_clear()
632     s->dane.mcert = NULL;  in SSL_clear()
633     s->dane.mtlsa = NULL;  in SSL_clear()
715     s->dane.flags = ctx->dane.flags;  in SSL_new()
1030     return dane_ctx_enable(&ctx->dane);  in SSL_CTX_dane_enable()
1035     unsigned long orig = ctx->dane.flags;  in SSL_CTX_dane_set_flags()
1037     ctx->dane.flags |= flags;  in SSL_CTX_dane_set_flags()
1043     unsigned long orig = ctx->dane.flags;  in SSL_CTX_dane_clear_flags()
1045     ctx->dane.flags &= ~flags;  in SSL_CTX_dane_clear_flags()
1051     SSL_DANE *dane = &s->dane;  in SSL_dane_enable()  local
1053     if (s->ctx->dane.mdmax == 0) {  in SSL_dane_enable()
1057     if (dane->trecs != NULL) {  in SSL_dane_enable()
1080     dane->mdpth = -1;  in SSL_dane_enable()
1081     dane->pdpth = -1;  in SSL_dane_enable()
1082     dane->dctx = &s->ctx->dane;  in SSL_dane_enable()
1083     dane->trecs = sk_danetls_record_new_null();  in SSL_dane_enable()
1085     if (dane->trecs == NULL) {  in SSL_dane_enable()
1094     unsigned long orig = ssl->dane.flags;  in SSL_dane_set_flags()
1096     ssl->dane.flags |= flags;  in SSL_dane_set_flags()
1102     unsigned long orig = ssl->dane.flags;  in SSL_dane_clear_flags()
1104     ssl->dane.flags &= ~flags;  in SSL_dane_clear_flags()
1110     SSL_DANE *dane = &s->dane;  in SSL_get0_dane_authority()  local
1112     if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)  in SSL_get0_dane_authority()
1114     if (dane->mtlsa) {  in SSL_get0_dane_authority()
1116             *mcert = dane->mcert;  in SSL_get0_dane_authority()
1118             *mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL;  in SSL_get0_dane_authority()
1120     return dane->mdpth;  in SSL_get0_dane_authority()
1126     SSL_DANE *dane = &s->dane;  in SSL_get0_dane_tlsa()  local
1128     if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)  in SSL_get0_dane_tlsa()
1130     if (dane->mtlsa) {  in SSL_get0_dane_tlsa()
1132             *usage = dane->mtlsa->usage;  in SSL_get0_dane_tlsa()
1134             *selector = dane->mtlsa->selector;  in SSL_get0_dane_tlsa()
1136             *mtype = dane->mtlsa->mtype;  in SSL_get0_dane_tlsa()
1138             *data = dane->mtlsa->data;  in SSL_get0_dane_tlsa()
1140             *dlen = dane->mtlsa->dlen;  in SSL_get0_dane_tlsa()
1142     return dane->mdpth;  in SSL_get0_dane_tlsa()
1147     return &s->dane;  in SSL_get0_dane()
1153     return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen);  in SSL_dane_tlsa_add()
1159     return dane_mtype_set(&ctx->dane, md, mtype, ord);  in SSL_CTX_dane_mtype_set()
1200     dane_final(&s->dane);  in SSL_free()
3480     dane_ctx_final(&a->dane);  in SSL_CTX_free()
5246     SSL_DANE *dane = &s->dane;  in ssl_validate_ct()  local
5270     if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) {  in ssl_validate_ct()
5271         switch (dane->mtlsa->usage) {  in ssl_validate_ct()