Enabled DANE only when at least one TLSA RR was added
It is up to the caller of SSL_dane_tlsa_add() to take appropriate
action when no records are added successfully or adding some records
triggers an internal error (negative return value).
With this change the caller can continue with PKIX if desired when
none of the TLSA records are usable, or take some appropriate action
if DANE is required.
Also fixed the internal ssl_dane_dup() function to properly initialize
the TLSA RR stack in the target SSL handle. Errors in ssl_dane_dup()
are no longer ignored.
Reviewed-by: Rich Salz <rsalz@openssl.org>
diff --git a/include/internal/dane.h b/include/internal/dane.h
index 1672849..557534a 100644
--- a/include/internal/dane.h
+++ b/include/internal/dane.h
@@ -121,7 +121,8 @@
int pdpth; /* Depth of PKIX trust */
};
-#define DANETLS_ENABLED(dane) ((dane) != NULL && ((dane)->trecs != NULL))
+#define DANETLS_ENABLED(dane) \
+ ((dane) != NULL && sk_danetls_record_num((dane)->trecs) > 0)
#define DANETLS_USAGE_BIT(u) (((uint32_t)1) << u)
