From 7ccc1ebb9deb7a52feeff56814ae9a35e79c3849 Mon Sep 17 00:00:00 2001
From: Robert Story <rstory@localhost>
Date: Tue, 22 Jan 2013 12:37:22 -0500
Subject: [PATCH 14/25] NSS DANE patch addendum from Suresh; 130117

---
 security/nss/lib/ssl/SSLerrs.h | 10 ++++++++++
 security/nss/lib/ssl/ssldane.c | 40 +++++++++++++---------------------------
 security/nss/lib/ssl/sslerr.h  |  6 +++---
 3 files changed, 26 insertions(+), 30 deletions(-)

diff --git a/security/nss/lib/ssl/SSLerrs.h b/security/nss/lib/ssl/SSLerrs.h
index 12dceaa..bd9b2d9 100644
--- a/security/nss/lib/ssl/SSLerrs.h
+++ b/security/nss/lib/ssl/SSLerrs.h
@@ -400,3 +400,13 @@ ER3(SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST, (SSL_ERROR_BASE + 123),
 
 ER3(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_VERSION, (SSL_ERROR_BASE + 124),
 "SSL feature not supported for the protocol version.")
+
+ER3(SSL_ERROR_DANE_QUERY_FAILED, (SSL_ERROR_BASE + 125),
+"Could not fetch a DANE record or prove its absence.")
+
+ER3(SSL_ERROR_DANE_UNAUTHORIZED, (SSL_ERROR_BASE + 126),
+"DANE certificate mismatch.")
+
+ER3(SSL_ERROR_DANE_INIT_FAILED, (SSL_ERROR_BASE + 127),
+"SSL DANE Support could not be initialized.")
+
diff --git a/security/nss/lib/ssl/ssldane.c b/security/nss/lib/ssl/ssldane.c
index 8555e8b..01ae5fc 100644
--- a/security/nss/lib/ssl/ssldane.c
+++ b/security/nss/lib/ssl/ssldane.c
@@ -54,27 +54,22 @@ SECStatus SSL_DANECheck(void * pinarg, const char *hostname, int32_t port, CERTC
     struct val_danestatus *danestatus = NULL;
     struct val_danestatus *dane_cur = NULL;
     int dane_retval;
-    int have_dane = 0;
     CERTCertDBHandle *certdb;
-	SECStatus rv = SECSuccess; /* don't ask */
 
     fprintf(stderr, "DANE: checking if disabled\n");
 	if (disabled) {
-        rv = SECSuccess;
-        goto done;
+        goto success;
 	}
 
     fprintf(stderr, "DANE: checking if initialized\n");
 	if (!initSuccess) {
 		PORT_SetError(SSL_ERROR_DANE_INIT_FAILED);
-        rv = SECFailure;
-        goto done;
+        return SECFailure;
 	}
 
 	if (!hostname) {
 		PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
-        rv = SECFailure;
-        goto done;
+        return SECFailure;
 	}
 
     daneparams.port = port;
@@ -98,7 +93,6 @@ SECStatus SSL_DANECheck(void * pinarg, const char *hostname, int32_t port, CERTC
 
     dane_cur = danestatus;
     while(dane_cur)  {
-        have_dane = 1;
         *do_pathval = 1;
     
         fprintf(stderr, "DANE check s,t,u=%d,%d,%d\n",
@@ -127,8 +121,7 @@ SECStatus SSL_DANECheck(void * pinarg, const char *hostname, int32_t port, CERTC
                                 (const unsigned char *)node->cert->derCert.data,
                                 node->cert->derCert.len) == VAL_DANE_NOERROR) {
                         fprintf(stderr, "DANE: val_dane_match() success\n");
-                        rv = SECSuccess;
-                        goto done;
+                        goto success;
                     }
                 }
                 fprintf(stderr, "DANE: val_dane_match() failed\n");
@@ -144,8 +137,7 @@ SECStatus SSL_DANECheck(void * pinarg, const char *hostname, int32_t port, CERTC
                                   (const unsigned char *)cert->derCert.data,
                                   cert->derCert.len) == VAL_DANE_NOERROR) {
                     fprintf(stderr, "DANE: val_dane_match() success\n");
-                    rv = SECSuccess;
-                    goto done;
+                    goto success;
                 }
                 fprintf(stderr, "DANE: val_dane_match() failed\n");
                 break;
@@ -165,8 +157,7 @@ SECStatus SSL_DANECheck(void * pinarg, const char *hostname, int32_t port, CERTC
                         CERT_VerifyCertNow(certdb,
                             cert, PR_TRUE, certUsageSSLServer, pinarg)) {
                     fprintf(stderr, "DANE: val_dane_match() success\n");
-                    rv = SECSuccess;
-                    goto done;
+                    goto success;
                 }
                 fprintf(stderr, "DANE: val_dane_match() failed\n");
                 break;
@@ -179,19 +170,14 @@ SECStatus SSL_DANECheck(void * pinarg, const char *hostname, int32_t port, CERTC
         dane_cur = dane_cur->next;
 	}
 
-    rv = SECFailure; 
-
-done:
     val_free_dane(danestatus);
-    if (have_dane) {
-        if (rv == SECSuccess)
-            fprintf(stderr, "DANE: Passed validation\n");
-        else {
-            fprintf(stderr, "DANE: validation failed\n");
-	        PORT_SetError(SSL_ERROR_DANE_UNAUTHORIZED);
-        }
-    }
+    fprintf(stderr, "DANE: validation failed\n");
+	PORT_SetError(SSL_ERROR_DANE_UNAUTHORIZED);
+    return SECFailure;
 
-	return rv;
+success:
+    val_free_dane(danestatus);
+    fprintf(stderr, "DANE: Passed validation\n");
+	return SECSuccess;
 }
 
diff --git a/security/nss/lib/ssl/sslerr.h b/security/nss/lib/ssl/sslerr.h
index 1f44861..34db0f9 100644
--- a/security/nss/lib/ssl/sslerr.h
+++ b/security/nss/lib/ssl/sslerr.h
@@ -188,9 +188,9 @@ SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST = (SSL_ERROR_BASE + 123),
 
 SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_VERSION = (SSL_ERROR_BASE + 124),
 
-SSL_ERROR_DANE_INIT_FAILED  = (SSL_ERROR_BASE + 125),
-SSL_ERROR_DANE_QUERY_FAILED = (SSL_ERROR_BASE + 126),
-SSL_ERROR_DANE_UNAUTHORIZED = (SSL_ERROR_BASE + 127),
+SSL_ERROR_DANE_QUERY_FAILED = (SSL_ERROR_BASE + 125),
+SSL_ERROR_DANE_UNAUTHORIZED = (SSL_ERROR_BASE + 126),
+SSL_ERROR_DANE_INIT_FAILED  = (SSL_ERROR_BASE + 127),
 
 SSL_ERROR_END_OF_LIST	/* let the c compiler determine the value of this. */
 } SSLErrorCodes;
-- 
1.7.11.7

