fix only cache variable long/short

[oweals/gnunet.git] / src / gns / gnunet-gns-proxy.c

diff --git a/src/gns/gnunet-gns-proxy.c b/src/gns/gnunet-gns-proxy.c
index 265081e7d141d6ce9a038cb6a073bac9ff7f8112..e65cd61101c115e4e64fec26498700b9d59a67ef 100644 (file)
--- a/src/gns/gnunet-gns-proxy.c
+++ b/src/gns/gnunet-gns-proxy.c
@@ -813,34 +813,28 @@ mhd_content_cb (void *cls,
 static int
 check_ssl_certificate (struct Socks5Request *s5r)
 {
-  struct curl_tlsinfo tlsinfo;
   unsigned int cert_list_size;
   const gnutls_datum_t *chainp;
-  union {
-    struct curl_tlsinfo *tlsinfo;
-    struct curl_slist   *to_slist;
-  } gptr;
+  const struct curl_tlssessioninfo *tlsinfo;
   char certdn[GNUNET_DNSPARSER_MAX_NAME_LENGTH + 3];
   size_t size;
   gnutls_x509_crt_t x509_cert;
   int rc;
   const char *name;
 
-  memset (&tlsinfo, 0, sizeof (tlsinfo));
-  gptr.tlsinfo = &tlsinfo;
   if (CURLE_OK !=
       curl_easy_getinfo (s5r->curl,
                         CURLINFO_TLS_SESSION,
-                        &gptr))
+                        (struct curl_slist **) &tlsinfo))
     return GNUNET_SYSERR;
-  if (CURLSSLBACKEND_GNUTLS != tlsinfo.ssl_backend)
+  if (CURLSSLBACKEND_GNUTLS != tlsinfo->backend)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _("Unsupported CURL SSL backend %d\n"),
-                tlsinfo.ssl_backend);
+                tlsinfo->backend);
     return GNUNET_SYSERR;
   }
-  chainp = gnutls_certificate_get_peers (tlsinfo.internals, &cert_list_size);
+  chainp = gnutls_certificate_get_peers (tlsinfo->internals, &cert_list_size);
   if ( (! chainp) || (0 == cert_list_size) )
     return GNUNET_SYSERR;
 
@@ -904,7 +898,7 @@ check_ssl_certificate (struct Socks5Request *s5r)
     if (0 != (rc = dane_verify_crt_raw (dane_state,
                                         chainp,
                                         cert_list_size,
-                                        gnutls_certificate_type_get (tlsinfo.internals),
+                                        gnutls_certificate_type_get (tlsinfo->internals),
                                         dane_query,
                                         0, 0,
                                         &verify)))
@@ -1343,7 +1337,7 @@ curl_task_download (void *cls,
       GNUNET_break (CURLE_OK ==
                    curl_easy_getinfo (msg->easy_handle,
                                       CURLINFO_PRIVATE,
-                                      &s5r));
+                                      (char **) &s5r ));
       if (NULL == s5r)
       {
        GNUNET_break (0);
@@ -1760,6 +1754,7 @@ mhd_log_callback (void *cls,
       return s5r;
     }
   }
+  GNUNET_break (0);
   return NULL;
 }
 
@@ -2036,7 +2031,7 @@ generate_gns_certificate (const char *name)
   GNUNET_break (GNUTLS_E_SUCCESS == gnutls_x509_crt_set_key (request, proxy_ca.key));
   pgc = GNUNET_new (struct ProxyGNSCertificate);
   gnutls_x509_crt_set_dn_by_oid (request, GNUTLS_OID_X520_COUNTRY_NAME,
-                                 0, "TNR", 2);
+                                 0, "ZZ", 2);
   gnutls_x509_crt_set_dn_by_oid (request, GNUTLS_OID_X520_ORGANIZATION_NAME,
                                  0, "GNU Name System", 4);
   gnutls_x509_crt_set_dn_by_oid (request, GNUTLS_OID_X520_COMMON_NAME,
@@ -2088,7 +2083,7 @@ mhd_error_log_callback (void *cls,
  * Lookup (or create) an SSL MHD instance for a particular domain.
  *
  * @param domain the domain the SSL daemon has to serve
- * @return NULL on errro
+ * @return NULL on error
  */
 static struct MhdHttpList *
 lookup_ssl_httpd (const char* domain)
@@ -2096,6 +2091,11 @@ lookup_ssl_httpd (const char* domain)
   struct MhdHttpList *hd;
   struct ProxyGNSCertificate *pgc;
 
+  if (NULL == domain)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
   for (hd = mhd_httpd_head; NULL != hd; hd = hd->next)
     if ( (NULL != hd->domain) &&
         (0 == strcmp (hd->domain, domain)) )
@@ -2545,6 +2545,14 @@ do_s5r_read (void *cls,
        struct sockaddr_in *in;
 
        s5r->port = ntohs (*port);
+        if (HTTPS_PORT == s5r->port)
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      _("SSL connection to plain IPv4 address requested\n"));
+          signal_socks_failure (s5r,
+                                SOCKS5_STATUS_CONNECTION_NOT_ALLOWED_BY_RULE);
+          return;
+        }
        alen = sizeof (struct in_addr);
        if (s5r->rbuf_len < sizeof (struct Socks5ClientRequestMessage) +
            alen + sizeof (uint16_t))
@@ -2566,6 +2574,14 @@ do_s5r_read (void *cls,
        struct sockaddr_in6 *in;
 
        s5r->port = ntohs (*port);
+        if (HTTPS_PORT == s5r->port)
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      _("SSL connection to plain IPv4 address requested\n"));
+          signal_socks_failure (s5r,
+                                SOCKS5_STATUS_CONNECTION_NOT_ALLOWED_BY_RULE);
+          return;
+        }
        alen = sizeof (struct in6_addr);
        if (s5r->rbuf_len < sizeof (struct Socks5ClientRequestMessage) +
            alen + sizeof (uint16_t))