1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
@deftypefun {int} {dane_verify_crt_raw} (dane_state_t @var{s}, const gnutls_datum_t * @var{chain}, unsigned @var{chain_size}, gnutls_certificate_type_t @var{chain_type}, dane_query_t @var{r}, unsigned int @var{sflags}, unsigned int @var{vflags}, unsigned int * @var{verify})
@var{s}: A DANE state structure (may be NULL)
@var{chain}: A certificate chain
@var{chain_size}: The size of the chain
@var{chain_type}: The type of the certificate chain
@var{r}: DANE data to check against
@var{sflags}: Flags for the the initialization of @code{s} (if NULL)
@var{vflags}: Verification flags; an OR'ed list of @code{dane_verify_flags_t} .
@var{verify}: An OR'ed list of @code{dane_verify_status_t} .
This function will verify the given certificate chain against the
CA constrains and/or the certificate available via DANE.
If no information via DANE can be obtained the flag @code{DANE_VERIFY_NO_DANE_INFO}
is set. If a DNSSEC signature is not available for the DANE
record then the verify flag @code{DANE_VERIFY_NO_DNSSEC_DATA} is set.
Note that the CA constraint only applies for the directly certifying CA
and does not account for long CA chains.
Due to the many possible options of DANE, there is no single threat
model countered. When notifying the user about DANE verification results
it may be better to mention: DANE verification did not reject the certificate,
rather than mentioning a successful DANE verication.
If the @code{q} parameter is provided it will be used for caching entries.
@strong{Returns:} On success, @code{DANE_E_SUCCESS} (0) is returned, otherwise a
negative error value.
@end deftypefun
|
