Repository: valkey-io/valkey
File: src/tls.c (C)

Code before:
        if (!fp) continue;

        X509 *cert = PEM_read_X509(fp, NULL, NULL, NULL);
        fclose(fp);

        if (cert) {
            if (X509_STORE_add_cert(store, cert) != 1) {
                unsigned long err = ERR_peek_last_error();
                if (ERR_GET_REASON(err) != X509_R_CERT_ALREADY_IN_HASH_TABLE) {
                    serverLog(LL_WARNING, "Failed to add CA certificate from %s to store", full_path);
                    X509_free(cert);
                    closedir(dir);
                    return 0;
                }
                ERR_clear_error();
            }
            X509_free(cert);
        }
    }

    closedir(dir);
    return 1;
}

/* Iterate over all CA certs in the SSL_CTX and fail-fast if any are invalid */
int check_loaded_ca_certs(SSL_CTX *ctx) {
    X509_STORE *store = SSL_CTX_get_cert_store(ctx);
    if (!store) return 0;
    STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);
    if (!objs) return 0;
    for (int i = 0; i < sk_X509_OBJECT_num(objs); i++) {
        X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);
        int type = X509_OBJECT_get_type(obj);
        if (type == X509_LU_X509) {
            X509 *ca_cert = X509_OBJECT_get0_X509(obj);
            if (ca_cert && !is_cert_valid(ca_cert)) {
                return 0;
            }
        }
    }
    return 1;
}

/* Create a *base* SSL_CTX using the SSL configuration provided. The base context
 * includes everything that's common for both client-side and server-side connections.
 */
static SSL_CTX *createSSLContext(serverTLSContextConfig *ctx_config, int protocols, int client) {
    const char *cert_file = client ? ctx_config->client_cert_file : ctx_config->cert_file;
    const char *key_file = client ? ctx_config->client_key_file : ctx_config->key_file;
    const char *key_file_pass = client ? ctx_config->client_key_file_pass : ctx_config->key_file_pass;
    char errbuf[256];

Review comment (suggestion):
Describe the meaning of the return values, or maybe use a bool return type and self-explaining yes/no-question-like name, for example areAllCaCertsValid.

Code after:

        snprintf(full_path, sizeof(full_path), "%s/%s", ca_cert_dir, entry->d_name);
        FILE *fp = fopen(full_path, "r");
        if (!fp) continue;

        X509 *cert = PEM_read_X509(fp, NULL, NULL, NULL);
        fclose(fp);

        if (cert) {
            if (X509_STORE_add_cert(store, cert) != 1) {
                unsigned long err = ERR_peek_last_error();
                if (ERR_GET_REASON(err) != X509_R_CERT_ALREADY_IN_HASH_TABLE) {
                    serverLog(LL_WARNING, "Failed to add CA certificate from %s to store", full_path);
                    X509_free(cert);
                    closedir(dir);
                    return false;
                }
                ERR_clear_error();
            }
            X509_free(cert);
        }
    }

    closedir(dir);
    return true;
}

/* Iterate over all CA certs in the SSL_CTX and fail-fast if any are invalid */
static bool areAllCaCertsValid(SSL_CTX *ctx) {
    X509_STORE *store = SSL_CTX_get_cert_store(ctx);
    if (!store) return false;
    STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);
    if (!objs) return false;
    for (int i = 0; i < sk_X509_OBJECT_num(objs); i++) {
        X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);
        int type = X509_OBJECT_get_type(obj);
        if (type == X509_LU_X509) {
            X509 *ca_cert = X509_OBJECT_get0_X509(obj);
            if (ca_cert && !isCertValid(ca_cert)) {
                return false;
            }
        }
    }
    return true;
}

/* Create a *base* SSL_CTX using the SSL configuration provided. The base context
 * includes everything that's common for both client-side and server-side connections.
 */
static SSL_CTX *createSSLContext(serverTLSContextConfig *ctx_config, int protocols, int client) {
    const char *cert_file = client ? ctx_config->client_cert_file : ctx_config->cert_file;