Merge tag 'upstream/2.4.0'

Upstream version 2.4.0

1 files changed, 334 insertions, 309 deletions

diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c
index 4260823..f01569f 100644
--- a/src/openvpn/ssl_verify_mbedtls.c
+++ b/src/openvpn/ssl_verify_mbedtls.c
@@ -5,8 +5,8 @@
  *             packet encryption, packet authentication, and
  *             packet compression.
  *
- *  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
- *  Copyright (C) 2010 Fox Crypto B.V. <openvpn@fox-it.com>
+ *  Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
+ *  Copyright (C) 2010-2017 Fox Crypto B.V. <openvpn@fox-it.com>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
@@ -48,293 +48,305 @@
 #define MAX_SUBJECT_LENGTH 256
 
 int
-verify_callback (void *session_obj, mbedtls_x509_crt *cert, int cert_depth,
-    uint32_t *flags)
+verify_callback(void *session_obj, mbedtls_x509_crt *cert, int cert_depth,
+                uint32_t *flags)
 {
-  struct tls_session *session = (struct tls_session *) session_obj;
-  struct gc_arena gc = gc_new();
+    struct tls_session *session = (struct tls_session *) session_obj;
+    struct gc_arena gc = gc_new();
 
-  ASSERT (cert);
-  ASSERT (session);
+    ASSERT(cert);
+    ASSERT(session);
 
-  session->verified = false;
+    session->verified = false;
 
-  /* Remember certificate hash */
-  struct buffer cert_fingerprint = x509_get_sha256_fingerprint (cert, &gc);
-  cert_hash_remember (session, cert_depth, &cert_fingerprint);
+    /* Remember certificate hash */
+    struct buffer cert_fingerprint = x509_get_sha256_fingerprint(cert, &gc);
+    cert_hash_remember(session, cert_depth, &cert_fingerprint);
 
-  /* did peer present cert which was signed by our root cert? */
-  if (*flags != 0)
+    /* did peer present cert which was signed by our root cert? */
+    if (*flags != 0)
     {
-      int ret = 0;
-      char errstr[512] = { 0 };
-      char *subject = x509_get_subject(cert, &gc);
-
-      ret = mbedtls_x509_crt_verify_info (errstr, sizeof(errstr)-1, "", *flags);
-      if (ret <= 0 && !openvpn_snprintf(errstr, sizeof(errstr),
-	    "Could not retrieve error string, flags=%"PRIx32, *flags))
-	{
-	  errstr[0] = '\0';
-	}
-      else
-	{
-	  chomp(errstr);
-	}
-
-      if (subject)
-	{
-	  msg (D_TLS_ERRORS, "VERIFY ERROR: depth=%d, subject=%s: %s",
-	      cert_depth, subject, errstr);
-	}
-      else
-	{
-	  msg (D_TLS_ERRORS, "VERIFY ERROR: depth=%d, (could not extract X509 "
-	      "subject string from certificate): %s", cert_depth, errstr);
-	}
-
-      /* Leave flags set to non-zero to indicate that the cert is not ok */
+        int ret = 0;
+        char errstr[512] = { 0 };
+        char *subject = x509_get_subject(cert, &gc);
+
+        ret = mbedtls_x509_crt_verify_info(errstr, sizeof(errstr)-1, "", *flags);
+        if (ret <= 0 && !openvpn_snprintf(errstr, sizeof(errstr),
+                                          "Could not retrieve error string, flags=%" PRIx32, *flags))
+        {
+            errstr[0] = '\0';
+        }
+        else
+        {
+            chomp(errstr);
+        }
+
+        if (subject)
+        {
+            msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, subject=%s: %s",
+                cert_depth, subject, errstr);
+        }
+        else
+        {
+            msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, (could not extract X509 "
+                "subject string from certificate): %s", cert_depth, errstr);
+        }
+
+        /* Leave flags set to non-zero to indicate that the cert is not ok */
     }
-  else if (SUCCESS != verify_cert(session, cert, cert_depth))
+    else if (SUCCESS != verify_cert(session, cert, cert_depth))
     {
-      *flags |= MBEDTLS_X509_BADCERT_OTHER;
+        *flags |= MBEDTLS_X509_BADCERT_OTHER;
     }
 
-  gc_free(&gc);
+    gc_free(&gc);
 
-  /*
-   * PolarSSL/mbed TLS-1.2.0+ expects 0 on anything except fatal errors.
-   */
-  return 0;
+    /*
+     * PolarSSL/mbed TLS-1.2.0+ expects 0 on anything except fatal errors.
+     */
+    return 0;
 }
 
 #ifdef ENABLE_X509ALTUSERNAME
-# warning "X509 alt user name not yet supported for mbed TLS"
+#warning "X509 alt user name not yet supported for mbed TLS"
 #endif
 
 result_t
-backend_x509_get_username (char *cn, int cn_len,
-    char *x509_username_field, mbedtls_x509_crt *cert)
+backend_x509_get_username(char *cn, int cn_len,
+                          char *x509_username_field, mbedtls_x509_crt *cert)
 {
-  mbedtls_x509_name *name;
+    mbedtls_x509_name *name;
 
-  ASSERT( cn != NULL );
+    ASSERT( cn != NULL );
 
-  name = &cert->subject;
+    name = &cert->subject;
 
-  /* Find common name */
-  while( name != NULL )
-  {
-      if (0 == memcmp (name->oid.p, MBEDTLS_OID_AT_CN,
-	  MBEDTLS_OID_SIZE (MBEDTLS_OID_AT_CN)))
-	break;
+    /* Find common name */
+    while (name != NULL)
+    {
+        if (0 == memcmp(name->oid.p, MBEDTLS_OID_AT_CN,
+                        MBEDTLS_OID_SIZE(MBEDTLS_OID_AT_CN)))
+        {
+            break;
+        }
 
-      name = name->next;
-  }
+        name = name->next;
+    }
 
-  /* Not found, return an error if this is the peer's certificate */
-  if( name == NULL )
-      return FAILURE;
+    /* Not found, return an error if this is the peer's certificate */
+    if (name == NULL)
+    {
+        return FAILURE;
+    }
 
-  /* Found, extract CN */
-  if (cn_len > name->val.len)
+    /* Found, extract CN */
+    if (cn_len > name->val.len)
     {
-      memcpy( cn, name->val.p, name->val.len );
-      cn[name->val.len] = '\0';
+        memcpy( cn, name->val.p, name->val.len );
+        cn[name->val.len] = '\0';
     }
-  else
+    else
     {
-      memcpy( cn, name->val.p, cn_len);
-      cn[cn_len-1] = '\0';
+        memcpy( cn, name->val.p, cn_len);
+        cn[cn_len-1] = '\0';
     }
 
-  return SUCCESS;
+    return SUCCESS;
 }
 
 char *
-backend_x509_get_serial (mbedtls_x509_crt *cert, struct gc_arena *gc)
+backend_x509_get_serial(mbedtls_x509_crt *cert, struct gc_arena *gc)
 {
-  char *buf = NULL;
-  size_t buflen = 0;
-  mbedtls_mpi serial_mpi = { 0 };
-
-  /* Transform asn1 integer serial into mbed TLS MPI */
-  mbedtls_mpi_init(&serial_mpi);
-  if (!mbed_ok(mbedtls_mpi_read_binary(&serial_mpi, cert->serial.p,
-      cert->serial.len)))
+    char *buf = NULL;
+    size_t buflen = 0;
+    mbedtls_mpi serial_mpi = { 0 };
+
+    /* Transform asn1 integer serial into mbed TLS MPI */
+    mbedtls_mpi_init(&serial_mpi);
+    if (!mbed_ok(mbedtls_mpi_read_binary(&serial_mpi, cert->serial.p,
+                                         cert->serial.len)))
     {
-      msg(M_WARN, "Failed to retrieve serial from certificate.");
-      goto end;
+        msg(M_WARN, "Failed to retrieve serial from certificate.");
+        goto end;
     }
 
-  /* Determine decimal representation length, allocate buffer */
-  mbedtls_mpi_write_string(&serial_mpi, 10, NULL, 0, &buflen);
-  buf = gc_malloc(buflen, true, gc);
+    /* Determine decimal representation length, allocate buffer */
+    mbedtls_mpi_write_string(&serial_mpi, 10, NULL, 0, &buflen);
+    buf = gc_malloc(buflen, true, gc);
 
-  /* Write MPI serial as decimal string into buffer */
-  if (!mbed_ok(mbedtls_mpi_write_string(&serial_mpi, 10, buf, buflen, &buflen)))
+    /* Write MPI serial as decimal string into buffer */
+    if (!mbed_ok(mbedtls_mpi_write_string(&serial_mpi, 10, buf, buflen, &buflen)))
     {
-      msg(M_WARN, "Failed to write serial to string.");
-      buf = NULL;
-      goto end;
+        msg(M_WARN, "Failed to write serial to string.");
+        buf = NULL;
+        goto end;
     }
 
 end:
-  mbedtls_mpi_free(&serial_mpi);
-  return buf;
+    mbedtls_mpi_free(&serial_mpi);
+    return buf;
 }
 
 char *
-backend_x509_get_serial_hex (mbedtls_x509_crt *cert, struct gc_arena *gc)
+backend_x509_get_serial_hex(mbedtls_x509_crt *cert, struct gc_arena *gc)
 {
-  char *buf = NULL;
-  size_t len = cert->serial.len * 3 + 1;
+    char *buf = NULL;
+    size_t len = cert->serial.len * 3 + 1;
 
-  buf = gc_malloc(len, true, gc);
+    buf = gc_malloc(len, true, gc);
 
-  if(mbedtls_x509_serial_gets(buf, len-1, &cert->serial) < 0)
-    buf = NULL;
+    if (mbedtls_x509_serial_gets(buf, len-1, &cert->serial) < 0)
+    {
+        buf = NULL;
+    }
 
-  return buf;
+    return buf;
 }
 
 static struct buffer
-x509_get_fingerprint (const mbedtls_md_info_t *md_info, mbedtls_x509_crt *cert,
-    struct gc_arena *gc)
+x509_get_fingerprint(const mbedtls_md_info_t *md_info, mbedtls_x509_crt *cert,
+                     struct gc_arena *gc)
 {
-  const size_t md_size = mbedtls_md_get_size (md_info);
-  struct buffer fingerprint = alloc_buf_gc (md_size, gc);
-  mbedtls_md(md_info, cert->raw.p, cert->tbs.len, BPTR (&fingerprint));
-  ASSERT (buf_inc_len(&fingerprint, md_size));
-  return fingerprint;
+    const size_t md_size = mbedtls_md_get_size(md_info);
+    struct buffer fingerprint = alloc_buf_gc(md_size, gc);
+    mbedtls_md(md_info, cert->raw.p, cert->tbs.len, BPTR(&fingerprint));
+    ASSERT(buf_inc_len(&fingerprint, md_size));
+    return fingerprint;
 }
 
 struct buffer
-x509_get_sha1_fingerprint (mbedtls_x509_crt *cert, struct gc_arena *gc)
+x509_get_sha1_fingerprint(mbedtls_x509_crt *cert, struct gc_arena *gc)
 {
-  return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA1),
-      cert, gc);
+    return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA1),
+                                cert, gc);
 }
 
 struct buffer
-x509_get_sha256_fingerprint (mbedtls_x509_crt *cert, struct gc_arena *gc)
+x509_get_sha256_fingerprint(mbedtls_x509_crt *cert, struct gc_arena *gc)
 {
-  return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
-      cert, gc);
+    return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
+                                cert, gc);
 }
 
 char *
 x509_get_subject(mbedtls_x509_crt *cert, struct gc_arena *gc)
 {
-  char tmp_subject[MAX_SUBJECT_LENGTH] = {0};
-  char *subject = NULL;
+    char tmp_subject[MAX_SUBJECT_LENGTH] = {0};
+    char *subject = NULL;
 
-  int ret = 0;
+    int ret = 0;
 
-  ret = mbedtls_x509_dn_gets( tmp_subject, MAX_SUBJECT_LENGTH-1, &cert->subject );
-  if (ret > 0)
+    ret = mbedtls_x509_dn_gets( tmp_subject, MAX_SUBJECT_LENGTH-1, &cert->subject );
+    if (ret > 0)
     {
-      /* Allocate the required space for the subject */
-      subject = string_alloc(tmp_subject, gc);
+        /* Allocate the required space for the subject */
+        subject = string_alloc(tmp_subject, gc);
     }
 
-  return subject;
+    return subject;
 }
 
 static void
-do_setenv_x509 (struct env_set *es, const char *name, char *value, int depth)
+do_setenv_x509(struct env_set *es, const char *name, char *value, int depth)
 {
-  char *name_expand;
-  size_t name_expand_size;
-
-  string_mod (value, CC_ANY, CC_CRLF, '?');
-  msg (D_X509_ATTR, "X509 ATTRIBUTE name='%s' value='%s' depth=%d", name, value, depth);
-  name_expand_size = 64 + strlen (name);
-  name_expand = (char *) malloc (name_expand_size);
-  check_malloc_return (name_expand);
-  openvpn_snprintf (name_expand, name_expand_size, "X509_%d_%s", depth, name);
-  setenv_str (es, name_expand, value);
-  free (name_expand);
+    char *name_expand;
+    size_t name_expand_size;
+
+    string_mod(value, CC_ANY, CC_CRLF, '?');
+    msg(D_X509_ATTR, "X509 ATTRIBUTE name='%s' value='%s' depth=%d", name, value, depth);
+    name_expand_size = 64 + strlen(name);
+    name_expand = (char *) malloc(name_expand_size);
+    check_malloc_return(name_expand);
+    openvpn_snprintf(name_expand, name_expand_size, "X509_%d_%s", depth, name);
+    setenv_str(es, name_expand, value);
+    free(name_expand);
 }
 
 static char *
 asn1_buf_to_c_string(const mbedtls_asn1_buf *orig, struct gc_arena *gc)
 {
-  size_t i;
-  char *val;
-
-  for (i = 0; i < orig->len; ++i)
-    if (orig->p[i] == '\0')
-      return "ERROR: embedded null value";
-  val = gc_malloc(orig->len+1, false, gc);
-  memcpy(val, orig->p, orig->len);
-  val[orig->len] = '\0';
-  return val;
+    size_t i;
+    char *val;
+
+    for (i = 0; i < orig->len; ++i)
+        if (orig->p[i] == '\0')
+        {
+            return "ERROR: embedded null value";
+        }
+    val = gc_malloc(orig->len+1, false, gc);
+    memcpy(val, orig->p, orig->len);
+    val[orig->len] = '\0';
+    return val;
 }
 
 static void
 do_setenv_name(struct env_set *es, const struct x509_track *xt,
-	       const mbedtls_x509_crt *cert, int depth, struct gc_arena *gc)
+               const mbedtls_x509_crt *cert, int depth, struct gc_arena *gc)
 {
-  const mbedtls_x509_name *xn;
-  for (xn = &cert->subject; xn != NULL; xn = xn->next)
+    const mbedtls_x509_name *xn;
+    for (xn = &cert->subject; xn != NULL; xn = xn->next)
     {
-      const char *xn_short_name = NULL;
-      if (0 == mbedtls_oid_get_attr_short_name (&xn->oid, &xn_short_name) &&
-	  0 == strcmp (xt->name, xn_short_name))
-	{
-	  char *val_str = asn1_buf_to_c_string (&xn->val, gc);
-	  do_setenv_x509 (es, xt->name, val_str, depth);
-	}
+        const char *xn_short_name = NULL;
+        if (0 == mbedtls_oid_get_attr_short_name(&xn->oid, &xn_short_name)
+            && 0 == strcmp(xt->name, xn_short_name))
+        {
+            char *val_str = asn1_buf_to_c_string(&xn->val, gc);
+            do_setenv_x509(es, xt->name, val_str, depth);
+        }
     }
 }
 
 void
-x509_track_add (const struct x509_track **ll_head, const char *name, int msglevel, struct gc_arena *gc)
+x509_track_add(const struct x509_track **ll_head, const char *name, int msglevel, struct gc_arena *gc)
 {
-  struct x509_track *xt;
-  ALLOC_OBJ_CLEAR_GC (xt, struct x509_track, gc);
-  if (*name == '+')
+    struct x509_track *xt;
+    ALLOC_OBJ_CLEAR_GC(xt, struct x509_track, gc);
+    if (*name == '+')
     {
-      xt->flags |= XT_FULL_CHAIN;
-      ++name;
+        xt->flags |= XT_FULL_CHAIN;
+        ++name;
     }
-  xt->name = name;
-  xt->next = *ll_head;
-  *ll_head = xt;
+    xt->name = name;
+    xt->next = *ll_head;
+    *ll_head = xt;
 }
 
 void
-x509_setenv_track (const struct x509_track *xt, struct env_set *es,
-    const int depth, mbedtls_x509_crt *cert)
+x509_setenv_track(const struct x509_track *xt, struct env_set *es,
+                  const int depth, mbedtls_x509_crt *cert)
 {
-  struct gc_arena gc = gc_new();
-  while (xt)
+    struct gc_arena gc = gc_new();
+    while (xt)
     {
-      if (depth == 0 || (xt->flags & XT_FULL_CHAIN))
-	{
-	  if (0 == strcmp(xt->name, "SHA1") || 0 == strcmp(xt->name, "SHA256"))
-	    {
-	      /* Fingerprint is not part of X509 structure */
-	      struct buffer cert_hash;
-	      char *fingerprint;
-
-	      if (0 == strcmp(xt->name, "SHA1"))
-		cert_hash = x509_get_sha1_fingerprint(cert, &gc);
-	      else
-		cert_hash = x509_get_sha256_fingerprint(cert, &gc);
-
-	      fingerprint = format_hex_ex(BPTR(&cert_hash),
-		  BLEN(&cert_hash), 0, 1 | FHE_CAPS, ":", &gc);
-	      do_setenv_x509(es, xt->name, fingerprint, depth);
-	    }
-	  else
-	    {
-	      do_setenv_name(es, xt, cert, depth, &gc);
-	    }
-	}
-      xt = xt->next;
+        if (depth == 0 || (xt->flags & XT_FULL_CHAIN))
+        {
+            if (0 == strcmp(xt->name, "SHA1") || 0 == strcmp(xt->name, "SHA256"))
+            {
+                /* Fingerprint is not part of X509 structure */
+                struct buffer cert_hash;
+                char *fingerprint;
+
+                if (0 == strcmp(xt->name, "SHA1"))
+                {
+                    cert_hash = x509_get_sha1_fingerprint(cert, &gc);
+                }
+                else
+                {
+                    cert_hash = x509_get_sha256_fingerprint(cert, &gc);
+                }
+
+                fingerprint = format_hex_ex(BPTR(&cert_hash),
+                                            BLEN(&cert_hash), 0, 1 | FHE_CAPS, ":", &gc);
+                do_setenv_x509(es, xt->name, fingerprint, depth);
+            }
+            else
+            {
+                do_setenv_name(es, xt, cert, depth, &gc);
+            }
+        }
+        xt = xt->next;
     }
-  gc_free(&gc);
+    gc_free(&gc);
 }
 
 /*
@@ -343,146 +355,159 @@ x509_setenv_track (const struct x509_track *xt, struct env_set *es,
  * X509_{cert_depth}_{name}={value}
  */
 void
-x509_setenv (struct env_set *es, int cert_depth, mbedtls_x509_crt *cert)
+x509_setenv(struct env_set *es, int cert_depth, mbedtls_x509_crt *cert)
 {
-  int i;
-  unsigned char c;
-  const mbedtls_x509_name *name;
-  char s[128] = { 0 };
+    int i;
+    unsigned char c;
+    const mbedtls_x509_name *name;
+    char s[128] = { 0 };
 
-  name = &cert->subject;
+    name = &cert->subject;
 
-  while( name != NULL )
+    while (name != NULL)
     {
-      char name_expand[64+8];
-      const char *shortname;
-
-      if( 0 == mbedtls_oid_get_attr_short_name(&name->oid, &shortname) )
-	{
-	  openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_%s",
-	      cert_depth, shortname);
-	}
-      else
-	{
-	  openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_\?\?",
-	      cert_depth);
-	}
-
-      for( i = 0; i < name->val.len; i++ )
-	{
-	  if( i >= (int) sizeof( s ) - 1 )
-	      break;
-
-	  c = name->val.p[i];
-	  if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
-	       s[i] = '?';
-	  else s[i] = c;
-	}
-	s[i] = '\0';
-
-	/* Check both strings, set environment variable */
-	string_mod (name_expand, CC_PRINT, CC_CRLF, '_');
-	string_mod ((char*)s, CC_PRINT, CC_CRLF, '_');
-	setenv_str_incr (es, name_expand, (char*)s);
-
-	name = name->next;
+        char name_expand[64+8];
+        const char *shortname;
+
+        if (0 == mbedtls_oid_get_attr_short_name(&name->oid, &shortname) )
+        {
+            openvpn_snprintf(name_expand, sizeof(name_expand), "X509_%d_%s",
+                             cert_depth, shortname);
+        }
+        else
+        {
+            openvpn_snprintf(name_expand, sizeof(name_expand), "X509_%d_\?\?",
+                             cert_depth);
+        }
+
+        for (i = 0; i < name->val.len; i++)
+        {
+            if (i >= (int) sizeof( s ) - 1)
+            {
+                break;
+            }
+
+            c = name->val.p[i];
+            if (c < 32 || c == 127 || ( c > 128 && c < 160 ) )
+            {
+                s[i] = '?';
+            }
+            else
+            {
+                s[i] = c;
+            }
+        }
+        s[i] = '\0';
+
+        /* Check both strings, set environment variable */
+        string_mod(name_expand, CC_PRINT, CC_CRLF, '_');
+        string_mod((char *)s, CC_PRINT, CC_CRLF, '_');
+        setenv_str_incr(es, name_expand, (char *)s);
+
+        name = name->next;
     }
 }
 
 result_t
 x509_verify_ns_cert_type(const mbedtls_x509_crt *cert, const int usage)
 {
-  if (usage == NS_CERT_CHECK_NONE)
-    return SUCCESS;
-  if (usage == NS_CERT_CHECK_CLIENT)
-    return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
-	&& (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT)) ?
-	    SUCCESS : FAILURE;
-  if (usage == NS_CERT_CHECK_SERVER)
-    return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
-	&& (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER)) ?
-	    SUCCESS : FAILURE;
-
-  return FAILURE;
+    if (usage == NS_CERT_CHECK_NONE)
+    {
+        return SUCCESS;
+    }
+    if (usage == NS_CERT_CHECK_CLIENT)
+    {
+        return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
+                && (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT)) ?
+               SUCCESS : FAILURE;
+    }
+    if (usage == NS_CERT_CHECK_SERVER)
+    {
+        return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
+                && (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER)) ?
+               SUCCESS : FAILURE;
+    }
+
+    return FAILURE;
 }
 
 result_t
-x509_verify_cert_ku (mbedtls_x509_crt *cert, const unsigned * const expected_ku,
-    int expected_len)
+x509_verify_cert_ku(mbedtls_x509_crt *cert, const unsigned *const expected_ku,
+                    int expected_len)
 {
-  result_t fFound = FAILURE;
+    result_t fFound = FAILURE;
 
-  if(!(cert->ext_types & MBEDTLS_X509_EXT_KEY_USAGE))
+    if (!(cert->ext_types & MBEDTLS_X509_EXT_KEY_USAGE))
     {
-      msg (D_HANDSHAKE, "Certificate does not have key usage extension");
+        msg(D_HANDSHAKE, "Certificate does not have key usage extension");
     }
-  else
+    else
     {
-      int i;
-      unsigned nku = cert->key_usage;
-
-      msg (D_HANDSHAKE, "Validating certificate key usage");
-      for (i=0; SUCCESS != fFound && i<expected_len; i++)
-	{
-	  if (expected_ku[i] != 0)
-	    {
-	      msg (D_HANDSHAKE, "++ Certificate has key usage  %04x, expects "
-		  "%04x", nku, expected_ku[i]);
-
-	      if (nku == expected_ku[i])
-		{
-		  fFound = SUCCESS;
-		}
-	    }
-	}
+        int i;
+        unsigned nku = cert->key_usage;
+
+        msg(D_HANDSHAKE, "Validating certificate key usage");
+        for (i = 0; SUCCESS != fFound && i<expected_len; i++)
+        {
+            if (expected_ku[i] != 0)
+            {
+                msg(D_HANDSHAKE, "++ Certificate has key usage  %04x, expects "
+                    "%04x", nku, expected_ku[i]);
+
+                if (nku == expected_ku[i])
+                {
+                    fFound = SUCCESS;
+                }
+            }
+        }
     }
-  return fFound;
+    return fFound;
 }
 
 result_t
-x509_verify_cert_eku (mbedtls_x509_crt *cert, const char * const expected_oid)
+x509_verify_cert_eku(mbedtls_x509_crt *cert, const char *const expected_oid)
 {
-  result_t fFound = FAILURE;
+    result_t fFound = FAILURE;
 
-  if (!(cert->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE))
+    if (!(cert->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE))
     {
-      msg (D_HANDSHAKE, "Certificate does not have extended key usage extension");
+        msg(D_HANDSHAKE, "Certificate does not have extended key usage extension");
     }
-  else
+    else
     {
-      mbedtls_x509_sequence *oid_seq = &(cert->ext_key_usage);
-
-      msg (D_HANDSHAKE, "Validating certificate extended key usage");
-      while (oid_seq != NULL)
-	{
-	  mbedtls_x509_buf *oid = &oid_seq->buf;
-	  char oid_num_str[1024];
-	  const char *oid_str;
-
-	  if (0 == mbedtls_oid_get_extended_key_usage( oid, &oid_str ))
-	    {
-	      msg (D_HANDSHAKE, "++ Certificate has EKU (str) %s, expects %s",
-		  oid_str, expected_oid);
-	      if (!strcmp (expected_oid, oid_str))
-		{
-		  fFound = SUCCESS;
-		  break;
-		}
-	    }
-
-	  if (0 < mbedtls_oid_get_numeric_string( oid_num_str,
-	      sizeof (oid_num_str), oid))
-	    {
-	      msg (D_HANDSHAKE, "++ Certificate has EKU (oid) %s, expects %s",
-		  oid_num_str, expected_oid);
-	      if (!strcmp (expected_oid, oid_num_str))
-		{
-		  fFound = SUCCESS;
-		  break;
-		}
-	    }
-	  oid_seq = oid_seq->next;
-	}
+        mbedtls_x509_sequence *oid_seq = &(cert->ext_key_usage);
+
+        msg(D_HANDSHAKE, "Validating certificate extended key usage");
+        while (oid_seq != NULL)
+        {
+            mbedtls_x509_buf *oid = &oid_seq->buf;
+            char oid_num_str[1024];
+            const char *oid_str;
+
+            if (0 == mbedtls_oid_get_extended_key_usage( oid, &oid_str ))
+            {
+                msg(D_HANDSHAKE, "++ Certificate has EKU (str) %s, expects %s",
+                    oid_str, expected_oid);
+                if (!strcmp(expected_oid, oid_str))
+                {
+                    fFound = SUCCESS;
+                    break;
+                }
+            }
+
+            if (0 < mbedtls_oid_get_numeric_string( oid_num_str,
+                                                    sizeof(oid_num_str), oid))
+            {
+                msg(D_HANDSHAKE, "++ Certificate has EKU (oid) %s, expects %s",
+                    oid_num_str, expected_oid);
+                if (!strcmp(expected_oid, oid_num_str))
+                {
+                    fFound = SUCCESS;
+                    break;
+                }
+            }
+            oid_seq = oid_seq->next;
+        }
     }
 
     return fFound;
@@ -491,19 +516,19 @@ x509_verify_cert_eku (mbedtls_x509_crt *cert, const char * const expected_oid)
 result_t
 x509_write_pem(FILE *peercert_file, mbedtls_x509_crt *peercert)
 {
-    msg (M_WARN, "mbed TLS does not support writing peer certificate in PEM format");
+    msg(M_WARN, "mbed TLS does not support writing peer certificate in PEM format");
     return FAILURE;
 }
 
 bool
 tls_verify_crl_missing(const struct tls_options *opt)
 {
-  if (opt->crl_file && !(opt->ssl_flags & SSLF_CRL_VERIFY_DIR)
-      && (opt->ssl_ctx.crl == NULL || opt->ssl_ctx.crl->version == 0))
+    if (opt->crl_file && !(opt->ssl_flags & SSLF_CRL_VERIFY_DIR)
+        && (opt->ssl_ctx.crl == NULL || opt->ssl_ctx.crl->version == 0))
     {
-      return true;
+        return true;
     }
-  return false;
+    return false;
 }
 
 #endif /* #if defined(ENABLE_CRYPTO) && defined(ENABLE_CRYPTO_MBEDTLS) */