static int vnc_validate_certificate(struct VncState *vs)

{

    int ret;

    unsigned int status;

    const gnutls_datum_t *certs;

    unsigned int nCerts, i;

    time_t now;



    VNC_DEBUG("Validating client certificate\n");

    if ((ret = gnutls_certificate_verify_peers2 (vs->tls_session, &status)) < 0) {

	VNC_DEBUG("Verify failed %s\n", gnutls_strerror(ret));

	return -1;

    }



    if ((now = time(NULL)) == ((time_t)-1)) {

	return -1;

    }



    if (status != 0) {

	if (status & GNUTLS_CERT_INVALID)

	    VNC_DEBUG("The certificate is not trusted.\n");



	if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)

	    VNC_DEBUG("The certificate hasn't got a known issuer.\n");



	if (status & GNUTLS_CERT_REVOKED)

	    VNC_DEBUG("The certificate has been revoked.\n");



	if (status & GNUTLS_CERT_INSECURE_ALGORITHM)

	    VNC_DEBUG("The certificate uses an insecure algorithm\n");



	return -1;

    } else {

	VNC_DEBUG("Certificate is valid!\n");

    }



    /* Only support x509 for now */

    if (gnutls_certificate_type_get(vs->tls_session) != GNUTLS_CRT_X509)

	return -1;



    if (!(certs = gnutls_certificate_get_peers(vs->tls_session, &nCerts)))

	return -1;



    for (i = 0 ; i < nCerts ; i++) {

	gnutls_x509_crt_t cert;

	VNC_DEBUG ("Checking certificate chain %d\n", i);

	if (gnutls_x509_crt_init (&cert) < 0)

	    return -1;



	if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_expiration_time (cert) < now) {

	    VNC_DEBUG("The certificate has expired\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_activation_time (cert) > now) {

	    VNC_DEBUG("The certificate is not yet activated\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_activation_time (cert) > now) {

	    VNC_DEBUG("The certificate is not yet activated\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	gnutls_x509_crt_deinit (cert);

    }



    return 0;

}

static int vnc_validate_certificate(struct VncState *vs)

{

    int ret;

    unsigned int status;

    const gnutls_datum_t *certs;

    unsigned int nCerts, i;

    time_t now;



    VNC_DEBUG("Validating client certificate\n");

    if ((ret = gnutls_certificate_verify_peers2 (vs->tls_session, &status)) < 0) {

	VNC_DEBUG("Verify failed %s\n", gnutls_strerror(ret));

	return -1;

    }



    if ((now = time(NULL)) == ((time_t)-1)) {

	return -1;

    }



    if (status != 0) {

	if (status & GNUTLS_CERT_INVALID)

	    VNC_DEBUG("The certificate is not trusted.\n");



	if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)

	    VNC_DEBUG("The certificate hasn't got a known issuer.\n");



	if (status & GNUTLS_CERT_REVOKED)

	    VNC_DEBUG("The certificate has been revoked.\n");



	if (status & GNUTLS_CERT_INSECURE_ALGORITHM)

	    VNC_DEBUG("The certificate uses an insecure algorithm\n");



	return -1;

    } else {

	VNC_DEBUG("Certificate is valid!\n");

    }



    

    if (gnutls_certificate_type_get(vs->tls_session) != GNUTLS_CRT_X509)

	return -1;



    if (!(certs = gnutls_certificate_get_peers(vs->tls_session, &nCerts)))

	return -1;



    for (i = 0 ; i < nCerts ; i++) {

	gnutls_x509_crt_t cert;

	VNC_DEBUG ("Checking certificate chain %d\n", i);

	if (gnutls_x509_crt_init (&cert) < 0)

	    return -1;



	if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_expiration_time (cert) < now) {

	    VNC_DEBUG("The certificate has expired\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_activation_time (cert) > now) {

	    VNC_DEBUG("The certificate is not yet activated\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_activation_time (cert) > now) {

	    VNC_DEBUG("The certificate is not yet activated\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	gnutls_x509_crt_deinit (cert);

    }



    return 0;

}

static int FUNC_0(struct VncState *VAR_0)

{

    int VAR_1;

    unsigned int VAR_2;

    const gnutls_datum_t *VAR_3;

    unsigned int VAR_4, VAR_5;

    time_t now;



    VNC_DEBUG("Validating client certificate\n");

    if ((VAR_1 = gnutls_certificate_verify_peers2 (VAR_0->tls_session, &VAR_2)) < 0) {

	VNC_DEBUG("Verify failed %s\n", gnutls_strerror(VAR_1));

	return -1;

    }



    if ((now = time(NULL)) == ((time_t)-1)) {

	return -1;

    }



    if (VAR_2 != 0) {

	if (VAR_2 & GNUTLS_CERT_INVALID)

	    VNC_DEBUG("The certificate is not trusted.\n");



	if (VAR_2 & GNUTLS_CERT_SIGNER_NOT_FOUND)

	    VNC_DEBUG("The certificate hasn't got a known issuer.\n");



	if (VAR_2 & GNUTLS_CERT_REVOKED)

	    VNC_DEBUG("The certificate has been revoked.\n");



	if (VAR_2 & GNUTLS_CERT_INSECURE_ALGORITHM)

	    VNC_DEBUG("The certificate uses an insecure algorithm\n");



	return -1;

    } else {

	VNC_DEBUG("Certificate is valid!\n");

    }



    

    if (gnutls_certificate_type_get(VAR_0->tls_session) != GNUTLS_CRT_X509)

	return -1;



    if (!(VAR_3 = gnutls_certificate_get_peers(VAR_0->tls_session, &VAR_4)))

	return -1;



    for (VAR_5 = 0 ; VAR_5 < VAR_4 ; VAR_5++) {

	gnutls_x509_crt_t cert;

	VNC_DEBUG ("Checking certificate chain %d\n", VAR_5);

	if (gnutls_x509_crt_init (&cert) < 0)

	    return -1;



	if (gnutls_x509_crt_import(cert, &VAR_3[VAR_5], GNUTLS_X509_FMT_DER) < 0) {

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_expiration_time (cert) < now) {

	    VNC_DEBUG("The certificate has expired\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_activation_time (cert) > now) {

	    VNC_DEBUG("The certificate is not yet activated\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	if (gnutls_x509_crt_get_activation_time (cert) > now) {

	    VNC_DEBUG("The certificate is not yet activated\n");

	    gnutls_x509_crt_deinit (cert);

	    return -1;

	}



	gnutls_x509_crt_deinit (cert);

    }



    return 0;

}

static int FUNC_0(struct VncState *VAR_0)
{ int VAR_1; unsigned int VAR_2; const gnutls_datum_t *VAR_3; unsigned int VAR_4, VAR_5; time_t now; VNC_DEBUG("Validating client certificate\n"); if ((VAR_1 = gnutls_certificate_verify_peers2 (VAR_0->tls_session, &VAR_2)) < 0) { VNC_DEBUG("Verify failed %s\n", gnutls_strerror(VAR_1)); return -1; } if ((now = time(NULL)) == ((time_t)-1)) { return -1; } if (VAR_2 != 0) { if (VAR_2 & GNUTLS_CERT_INVALID)
VNC_DEBUG("The certificate is not trusted.\n"); if (VAR_2 & GNUTLS_CERT_SIGNER_NOT_FOUND)
VNC_DEBUG("The certificate hasn't got a known issuer.\n"); if (VAR_2 & GNUTLS_CERT_REVOKED)
VNC_DEBUG("The certificate has been revoked.\n"); if (VAR_2 & GNUTLS_CERT_INSECURE_ALGORITHM)
VNC_DEBUG("The certificate uses an insecure algorithm\n"); return -1; } else { VNC_DEBUG("Certificate is valid!\n"); } if (gnutls_certificate_type_get(VAR_0->tls_session) != GNUTLS_CRT_X509)
return -1; if (!(VAR_3 = gnutls_certificate_get_peers(VAR_0->tls_session, &VAR_4)))
return -1; for (VAR_5 = 0 ; VAR_5 < VAR_4 ; VAR_5++) { gnutls_x509_crt_t cert; VNC_DEBUG ("Checking certificate chain %d\n", VAR_5); if (gnutls_x509_crt_init (&cert) < 0)
return -1; if (gnutls_x509_crt_import(cert, &VAR_3[VAR_5], GNUTLS_X509_FMT_DER) < 0) { gnutls_x509_crt_deinit (cert); return -1; } if (gnutls_x509_crt_get_expiration_time (cert) < now) { VNC_DEBUG("The certificate has expired\n"); gnutls_x509_crt_deinit (cert); return -1; } if (gnutls_x509_crt_get_activation_time (cert) > now) { VNC_DEBUG("The certificate is not yet activated\n"); gnutls_x509_crt_deinit (cert); return -1; } if (gnutls_x509_crt_get_activation_time (cert) > now) { VNC_DEBUG("The certificate is not yet activated\n"); gnutls_x509_crt_deinit (cert); return -1; } gnutls_x509_crt_deinit (cert); } return 0; }