static int dane_verify(X509_STORE_CTX *ctx)
{
    X509 *cert = ctx->cert;
    struct dane_st *dane = (struct dane_st *)ctx->dane;
    int matched;
    int done;

    dane_reset(dane);

    matched = dane_match(ctx, ctx->cert, 0);
    done = matched != 0 || (!DANETLS_HAS_TA(dane) && dane->mdpth < 0);

    if (done)
        X509_get_pubkey_parameters(NULL, ctx->chain);

    if (matched > 0) {
        if (!check_leaf_suiteb(ctx, cert))
            return 0;
        ctx->error_depth = 0;
        ctx->current_cert = cert;
        return ctx->verify_cb(1, ctx);
    }

    if (matched < 0) {
        ctx->error_depth = 0;
        ctx->current_cert = cert;
        ctx->error = X509_V_ERR_OUT_OF_MEM;
        return -1;
    }

    if (done) {
        /* Fail early, TA-based success is not possible */
        if (!check_leaf_suiteb(ctx, cert))
            return 0;
        ctx->current_cert = cert;
        ctx->error_depth = 0;
        ctx->error = X509_V_ERR_CERT_UNTRUSTED;
        return ctx->verify_cb(0, ctx);
    }

    /*
     * Chain verification for usages 0/1/2.  TLSA record matching of depth > 0
     * certificates happens in-line with building the rest of the chain.
     */
    return verify_chain(ctx);
}
static int dane_verify(X509_STORE_CTX *ctx)
{
    X509 *cert = ctx->cert;
    struct dane_st *dane = (struct dane_st *)ctx->dane;
    int matched;
    int done;

    dane_reset(dane);

    matched = dane_match(ctx, ctx->cert, 0);
    done = matched != 0 || (!DANETLS_HAS_TA(dane) && dane->mdpth < 0);

    if (done)
        X509_get_pubkey_parameters(NULL, ctx->chain);

    if (matched > 0) {
        if (!check_leaf_suiteb(ctx, cert))
            return 0;
        ctx->error_depth = 0;
        ctx->current_cert = cert;
        return ctx->verify_cb(1, ctx);
    }

    if (matched < 0) {
        ctx->error_depth = 0;
        ctx->current_cert = cert;
        ctx->error = X509_V_ERR_OUT_OF_MEM;
        return -1;
    }

    if (done) {
         
        if (!check_leaf_suiteb(ctx, cert))
            return 0;
        ctx->current_cert = cert;
        ctx->error_depth = 0;
        ctx->error = X509_V_ERR_CERT_UNTRUSTED;
        return ctx->verify_cb(0, ctx);
    }

     
    return verify_chain(ctx);
}