qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,

                                         gnutls_x509_crt_t cert,

                                         const char *certFile,

                                         bool isServer,

                                         Error **errp)

{

    int status;

    size_t i;

    unsigned int purposeCritical;

    unsigned int critical;

    char *buffer = NULL;

    size_t size;

    bool allowClient = false, allowServer = false;



    critical = 0;

    for (i = 0; ; i++) {

        size = 0;

        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,

                                                     &size, NULL);



        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {



            /* If there is no data at all, then we must allow

               client/server to pass */

            if (i == 0) {

                allowServer = allowClient = true;

            }

            break;

        }

        if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {

            error_setg(errp,

                       "Unable to query certificate %s key purpose: %s",

                       certFile, gnutls_strerror(status));

            return -1;

        }



        buffer = g_new0(char, size);



        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,

                                                     &size, &purposeCritical);



        if (status < 0) {

            trace_qcrypto_tls_creds_x509_check_key_purpose(

                creds, certFile, status, "<none>", purposeCritical);

            g_free(buffer);

            error_setg(errp,

                       "Unable to query certificate %s key purpose: %s",

                       certFile, gnutls_strerror(status));

            return -1;

        }

        trace_qcrypto_tls_creds_x509_check_key_purpose(

            creds, certFile, status, buffer, purposeCritical);

        if (purposeCritical) {

            critical = true;

        }



        if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {

            allowServer = true;

        } else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {

            allowClient = true;

        } else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {

            allowServer = allowClient = true;

        }



        g_free(buffer);


    }



    if (isServer) {

        if (!allowServer) {

            if (critical) {

                error_setg(errp,

                           "Certificate %s purpose does not allow "

                           "use with a TLS server", certFile);

                return -1;

            }

        }

    } else {

        if (!allowClient) {

            if (critical) {

                error_setg(errp,

                           "Certificate %s purpose does not allow use "

                           "with a TLS client", certFile);

                return -1;

            }

        }

    }



    return 0;

}
qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,

                                         gnutls_x509_crt_t cert,

                                         const char *certFile,

                                         bool isServer,

                                         Error **errp)

{

    int status;

    size_t i;

    unsigned int purposeCritical;

    unsigned int critical;

    char *buffer = NULL;

    size_t size;

    bool allowClient = false, allowServer = false;



    critical = 0;

    for (i = 0; ; i++) {

        size = 0;

        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,

                                                     &size, NULL);



        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {



            



            if (i == 0) {

                allowServer = allowClient = true;

            }

            break;

        }

        if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {

            error_setg(errp,

                       "Unable to query certificate %s key purpose: %s",

                       certFile, gnutls_strerror(status));

            return -1;

        }



        buffer = g_new0(char, size);



        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,

                                                     &size, &purposeCritical);



        if (status < 0) {

            trace_qcrypto_tls_creds_x509_check_key_purpose(

                creds, certFile, status, "<none>", purposeCritical);

            g_free(buffer);

            error_setg(errp,

                       "Unable to query certificate %s key purpose: %s",

                       certFile, gnutls_strerror(status));

            return -1;

        }

        trace_qcrypto_tls_creds_x509_check_key_purpose(

            creds, certFile, status, buffer, purposeCritical);

        if (purposeCritical) {

            critical = true;

        }



        if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {

            allowServer = true;

        } else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {

            allowClient = true;

        } else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {

            allowServer = allowClient = true;

        }



        g_free(buffer);


    }



    if (isServer) {

        if (!allowServer) {

            if (critical) {

                error_setg(errp,

                           "Certificate %s purpose does not allow "

                           "use with a TLS server", certFile);

                return -1;

            }

        }

    } else {

        if (!allowClient) {

            if (critical) {

                error_setg(errp,

                           "Certificate %s purpose does not allow use "

                           "with a TLS client", certFile);

                return -1;

            }

        }

    }



    return 0;

}
FUNC_0(QCryptoTLSCredsX509 *VAR_0,

                                         gnutls_x509_crt_t VAR_1,

                                         const char *VAR_2,

                                         bool VAR_3,

                                         Error **VAR_4)

{

    int VAR_5;

    size_t i;

    unsigned int VAR_6;

    unsigned int VAR_7;

    char *VAR_8 = NULL;

    size_t size;

    bool allowClient = false, allowServer = false;



    VAR_7 = 0;

    for (i = 0; ; i++) {

        size = 0;

        VAR_5 = gnutls_x509_crt_get_key_purpose_oid(VAR_1, i, VAR_8,

                                                     &size, NULL);



        if (VAR_5 == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {



            



            if (i == 0) {

                allowServer = allowClient = true;

            }

            break;

        }

        if (VAR_5 != GNUTLS_E_SHORT_MEMORY_BUFFER) {

            error_setg(VAR_4,

                       "Unable to query certificate %s key purpose: %s",

                       VAR_2, gnutls_strerror(VAR_5));

            return -1;

        }



        VAR_8 = g_new0(char, size);



        VAR_5 = gnutls_x509_crt_get_key_purpose_oid(VAR_1, i, VAR_8,

                                                     &size, &VAR_6);



        if (VAR_5 < 0) {

            trace_qcrypto_tls_creds_x509_check_key_purpose(

                VAR_0, VAR_2, VAR_5, "<none>", VAR_6);

            g_free(VAR_8);

            error_setg(VAR_4,

                       "Unable to query certificate %s key purpose: %s",

                       VAR_2, gnutls_strerror(VAR_5));

            return -1;

        }

        trace_qcrypto_tls_creds_x509_check_key_purpose(

            VAR_0, VAR_2, VAR_5, VAR_8, VAR_6);

        if (VAR_6) {

            VAR_7 = true;

        }



        if (g_str_equal(VAR_8, GNUTLS_KP_TLS_WWW_SERVER)) {

            allowServer = true;

        } else if (g_str_equal(VAR_8, GNUTLS_KP_TLS_WWW_CLIENT)) {

            allowClient = true;

        } else if (g_str_equal(VAR_8, GNUTLS_KP_ANY)) {

            allowServer = allowClient = true;

        }



        g_free(VAR_8);


    }



    if (VAR_3) {

        if (!allowServer) {

            if (VAR_7) {

                error_setg(VAR_4,

                           "Certificate %s purpose does not allow "

                           "use with a TLS server", VAR_2);

                return -1;

            }

        }

    } else {

        if (!allowClient) {

            if (VAR_7) {

                error_setg(VAR_4,

                           "Certificate %s purpose does not allow use "

                           "with a TLS client", VAR_2);

                return -1;

            }

        }

    }



    return 0;

}
FUNC_0(QCryptoTLSCredsX509 *VAR_0,
gnutls_x509_crt_t VAR_1,
const char *VAR_2,
bool VAR_3,
Error **VAR_4)
{ int VAR_5; size_t i; unsigned int VAR_6; unsigned int VAR_7; char *VAR_8 = NULL; size_t size; bool allowClient = false, allowServer = false; VAR_7 = 0; for (i = 0; ; i++) { size = 0; VAR_5 = gnutls_x509_crt_get_key_purpose_oid(VAR_1, i, VAR_8,
&size, NULL); if (VAR_5 == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { if (i == 0) { allowServer = allowClient = true; } break; } if (VAR_5 != GNUTLS_E_SHORT_MEMORY_BUFFER) { error_setg(VAR_4,
"Unable to query certificate %s key purpose: %s",
VAR_2, gnutls_strerror(VAR_5)); return -1; } VAR_8 = g_new0(char, size); VAR_5 = gnutls_x509_crt_get_key_purpose_oid(VAR_1, i, VAR_8,
&size, &VAR_6); if (VAR_5 < 0) { trace_qcrypto_tls_creds_x509_check_key_purpose(
VAR_0, VAR_2, VAR_5, "<none>", VAR_6); g_free(VAR_8); error_setg(VAR_4,
"Unable to query certificate %s key purpose: %s",
VAR_2, gnutls_strerror(VAR_5)); return -1; } trace_qcrypto_tls_creds_x509_check_key_purpose(
VAR_0, VAR_2, VAR_5, VAR_8, VAR_6); if (VAR_6) { VAR_7 = true; } if (g_str_equal(VAR_8, GNUTLS_KP_TLS_WWW_SERVER)) { allowServer = true; } else if (g_str_equal(VAR_8, GNUTLS_KP_TLS_WWW_CLIENT)) { allowClient = true; } else if (g_str_equal(VAR_8, GNUTLS_KP_ANY)) { allowServer = allowClient = true; } g_free(VAR_8); } if (VAR_3) { if (!allowServer) { if (VAR_7) { error_setg(VAR_4,
"Certificate %s purpose does not allow "
"use with a TLS server", VAR_2); return -1; } } } else { if (!allowClient) { if (VAR_7) { error_setg(VAR_4,
"Certificate %s purpose does not allow use "
"with a TLS client", VAR_2); return -1; } } } return 0; }