X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=src%2Fverify.c;fp=src%2Fverify.c;h=96c49a51b7f23ff0502dbfeeec3d1163052943ed;hb=c5059d4c1e7f0de5a466d471e7ee26b6ccce8396;hp=6ea5f1b23d07f45be840f813035410129765d466;hpb=edca9c6695ee99d9344e924acf60ecfd0a163203;p=tlsproxy%2Ftlsproxy.git

diff --git a/src/verify.c b/src/verify.c
index 6ea5f1b..96c49a5 100644
--- a/src/verify.c
+++ b/src/verify.c
@@ -47,7 +47,7 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     result = gnutls_certificate_verify_peers2(session, &status);
     /* Verification failed (!= invalid certificate but worse), no need for any
      * more checks. */
-    if (0 > result) {
+    if (result < 0) {
         LOG(LOG_WARNING,
             "verify_tls_connection(): gnutls_certificate_verify_peers2() failed: %s",
             gnutls_strerror(result));
@@ -66,7 +66,7 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     /* We only handle X509 certificates for now. Let validation fail to
      * prevent an attacker from changing the certificate type to prevent
      * detection. */
-    if (GNUTLS_CRT_X509 != gnutls_certificate_type_get(session)) {
+    if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509) {
         LOG(LOG_WARNING,
             "verify_tls_connection(): no X509 server certificate");
         return -1;
@@ -74,7 +74,8 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
 
     /* Get server certificate. */
 
-    if (0 > (result = gnutls_x509_crt_init(&cert))) {
+    result = gnutls_x509_crt_init(&cert);
+    if (result < 0) {
         LOG(LOG_WARNING,
             "verify_tls_connection(): gnutls_x509_crt_init() failed: %s",
             gnutls_strerror(result));
@@ -82,15 +83,15 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     }
 
     cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
-    if (NULL == cert_list) {
+    if (cert_list == NULL) {
         LOG(LOG_WARNING,
             "verify_tls_connection(): gnutls_certificate_get_peers() failed");
         gnutls_x509_crt_deinit(cert);
         return -1;
     }
 
-    if (0 > (result = gnutls_x509_crt_import(cert, &cert_list[0],
-                                             GNUTLS_X509_FMT_DER))) {
+    result = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
+    if (result < 0) {
         LOG(LOG_WARNING,
             "verify_tls_connection(): gnutls_x509_crt_import() failed: %s",
             gnutls_strerror(result));
@@ -103,7 +104,7 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     size = sizeof(server_cert);
     result = gnutls_x509_crt_export(cert, GNUTLS_X509_FMT_PEM,
                                     server_cert, &size);
-    if (GNUTLS_E_SUCCESS != result) {
+    if (result != GNUTLS_E_SUCCESS) {
         LOG(LOG_WARNING,
             "verify_tls_connection(): gnutls_x509_crt_export() failed: %s",
             gnutls_strerror(result));
@@ -114,7 +115,7 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     gnutls_x509_crt_deinit(cert);
 
     /* Open stored server certificate file. */
-    if (0 != server_certificate_file(&file, hostname, path, sizeof(path))) {
+    if (server_certificate_file(&file, hostname, path, sizeof(path)) != 0) {
         LOG(LOG_DEBUG, "server certificate:\n%s", server_cert);
         return -1;
     }
@@ -122,10 +123,10 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     size = 1; /* '\0' */
     stored_cert[0] = '\0'; /* for strcat() */
 
-    while (NULL != fgets(buffer, sizeof(buffer), file)) {
+    while (fgets(buffer, sizeof(buffer), file) != NULL) {
         size += strlen(buffer);
         /* Make sure the buffer is big enough. */
-        if (sizeof(stored_cert) <= size) {
+        if (size >= sizeof(stored_cert)) {
             LOG(LOG_WARNING, "verify_tls_connection(): '%s' too big", path);
             fclose(file);
 
@@ -147,7 +148,7 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     fclose(file);
 
     /* Check if the server certificate matches our stored certificate. */
-    if (0 != strcmp(stored_cert, server_cert)) {
+    if (strcmp(stored_cert, server_cert) != 0) {
         LOG(LOG_ERROR,
             "verify_tls_connection(): server certificate changed!",
             path, strerror(errno));
@@ -159,11 +160,11 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) {
     /* Check that the proxy certificate file exists and is readable for this
      * domain. This ensures we send an "invalid" certificate even if the proxy
      * certificate doesn't exist. */
-    if (0 != proxy_certificate_path(hostname, path, sizeof(path))) {
+    if (proxy_certificate_path(hostname, path, sizeof(path)) != 0) {
         return -1;
     }
     file = fopen(path, "r");
-    if (NULL == file) {
+    if (file == NULL) {
         LOG(LOG_WARNING,
             "verify_tls_connection(): proxy certificate doesn't exist: '%s'",
             path);
@@ -187,7 +188,7 @@ static int get_certificate_path(const char *format,
         return -1;
     }
     /* Try to prevent path traversals in hostnames. */
-    if (NULL != strstr(hostname, "..")) {
+    if (strstr(hostname, "..") != NULL) {
         LOG(LOG_WARNING,
             "get_certificate_path(): possible path traversal: '%s'",
             hostname);
@@ -213,8 +214,8 @@ int proxy_certificate_path(const char *hostname, char *path, size_t size) {
 
 int server_certificate_file(FILE **file, const char *hostname,
                             char *path, size_t size) {
-    if (0 != get_certificate_path(STORED_SERVER_CERT_FORMAT,
-                                  hostname, path, size)) {
+    if (get_certificate_path(STORED_SERVER_CERT_FORMAT,
+                             hostname, path, size) != 0) {
         LOG_PERROR(LOG_ERROR,
                    "server_certificate_file(): failed to get path");
         return -1;
@@ -222,7 +223,7 @@ int server_certificate_file(FILE **file, const char *hostname,
 
     /* Open the stored certificate file. */
     *file = fopen(path, "rb");
-    if (NULL == *file) {
+    if (*file == NULL) {
         if (global_passthrough_unknown) {
             LOG(LOG_DEBUG,
                 "server_certificate_file(): failed to open '%s': %s",