Skip to content

Commit 0e8af03

Browse files
miyazakhmiyazakh
committed
OpenSSL error code handling in reason_error_string
1 parent d555c1a commit 0e8af03

4 files changed

Lines changed: 81 additions & 62 deletions

File tree

‎src/internal.c‎

Lines changed: 68 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -26595,6 +26595,65 @@ int SendAlert(WOLFSSL* ssl, int severity, int type)
2659526595
#include <wolfssl/debug-untrace-error-codes.h>
2659626596
#endif
2659726597

26598+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
26599+
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
26600+
static const char* wolfSSL_ERR_reason_error_string_OpenSSL(unsigned long e)
26601+
{
26602+
switch (e) {
26603+
/* TODO: -WOLFSSL_X509_V_ERR_CERT_SIGNATURE_FAILURE. Conflicts with
26604+
* -WOLFSSL_ERROR_WANT_CONNECT.
26605+
*/
26606+
case WOLFSSL_X509_V_ERR_CRL_HAS_EXPIRED:
26607+
return "CRL has expired";
26608+
26609+
case WOLFSSL_X509_V_ERR_UNABLE_TO_GET_CRL:
26610+
return "unable to get CRL";
26611+
26612+
case WOLFSSL_X509_V_ERR_CERT_NOT_YET_VALID:
26613+
return "certificate not yet valid";
26614+
26615+
case WOLFSSL_X509_V_ERR_CERT_HAS_EXPIRED:
26616+
return "certificate has expired";
26617+
26618+
case WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
26619+
return "certificate signature failure";
26620+
26621+
case WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
26622+
return "format error in certificate's notAfter field";
26623+
26624+
case WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
26625+
return "self-signed certificate in certificate chain";
26626+
26627+
case WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
26628+
return "unable to get local issuer certificate";
26629+
26630+
case WOLFSSL_X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
26631+
return "unable to verify the first certificate";
26632+
26633+
case WOLFSSL_X509_V_ERR_CERT_CHAIN_TOO_LONG:
26634+
return "certificate chain too long";
26635+
26636+
case WOLFSSL_X509_V_ERR_CERT_REVOKED:
26637+
return "certificate revoked";
26638+
26639+
case WOLFSSL_X509_V_ERR_INVALID_CA:
26640+
return "invalid CA certificate";
26641+
26642+
case WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED:
26643+
return "path length constraint exceeded";
26644+
26645+
case WOLFSSL_X509_V_ERR_CERT_REJECTED:
26646+
return "certificate rejected";
26647+
26648+
case WOLFSSL_X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
26649+
return "subject issuer mismatch";
26650+
26651+
default:
26652+
return NULL;
26653+
}
26654+
}
26655+
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL || HAVE_WEBSERVER || HAVE_MEMCACHED */
26656+
2659826657
const char* wolfSSL_ERR_reason_error_string(unsigned long e)
2659926658
{
2660026659
#ifdef NO_ERROR_STRINGS
@@ -26606,11 +26665,18 @@ const char* wolfSSL_ERR_reason_error_string(unsigned long e)
2660626665

2660726666
int error = (int)e;
2660826667

26609-
/* OpenSSL uses positive error codes */
2661026668
if (error > 0) {
26669+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
26670+
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
26671+
/* try OpenSSL error strings first */
26672+
const char* ossl_err = wolfSSL_ERR_reason_error_string_OpenSSL(e);
26673+
if (ossl_err != NULL) {
26674+
return ossl_err;
26675+
}
26676+
/* try to find error strings from wolfSSL */
26677+
#endif
2661126678
error = -error;
2661226679
}
26613-
2661426680
/* pass to wolfCrypt */
2661526681
if ((error <= WC_SPAN1_FIRST_E && error >= WC_SPAN1_MIN_CODE_E) ||
2661626682
(error <= WC_SPAN2_FIRST_E && error >= WC_SPAN2_MIN_CODE_E))
@@ -27169,55 +27235,6 @@ const char* wolfSSL_ERR_reason_error_string(unsigned long e)
2716927235
return "Private key decode error (EVP)";
2717027236
}
2717127237

27172-
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
27173-
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
27174-
27175-
switch (error) {
27176-
/* TODO: -WOLFSSL_X509_V_ERR_CERT_SIGNATURE_FAILURE. Conflicts with
27177-
* -WOLFSSL_ERROR_WANT_CONNECT.
27178-
*/
27179-
27180-
case -WOLFSSL_X509_V_ERR_CERT_NOT_YET_VALID:
27181-
return "certificate not yet valid";
27182-
27183-
case -WOLFSSL_X509_V_ERR_CERT_HAS_EXPIRED:
27184-
return "certificate has expired";
27185-
27186-
case -WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
27187-
return "certificate signature failure";
27188-
27189-
case -WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
27190-
return "format error in certificate's notAfter field";
27191-
27192-
case -WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
27193-
return "self-signed certificate in certificate chain";
27194-
27195-
case -WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
27196-
return "unable to get local issuer certificate";
27197-
27198-
case -WOLFSSL_X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
27199-
return "unable to verify the first certificate";
27200-
27201-
case -WOLFSSL_X509_V_ERR_CERT_CHAIN_TOO_LONG:
27202-
return "certificate chain too long";
27203-
27204-
case -WOLFSSL_X509_V_ERR_CERT_REVOKED:
27205-
return "certificate revoked";
27206-
27207-
case -WOLFSSL_X509_V_ERR_INVALID_CA:
27208-
return "invalid CA certificate";
27209-
27210-
case -WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED:
27211-
return "path length constraint exceeded";
27212-
27213-
case -WOLFSSL_X509_V_ERR_CERT_REJECTED:
27214-
return "certificate rejected";
27215-
27216-
case -WOLFSSL_X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
27217-
return "subject issuer mismatch";
27218-
}
27219-
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL || HAVE_WEBSERVER || HAVE_MEMCACHED */
27220-
2722127238
return "unknown error number";
2722227239

2722327240
#endif /* NO_ERROR_STRINGS */

‎tests/api.c‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34750,6 +34750,7 @@ static int error_test(void)
3475034750
if (EXPECT_FAIL())
3475134751
return OPEN_RAN_E;
3475234752
#else
34753+
int start_idx = 0;
3475334754
int i;
3475434755
int j = 0;
3475534756
/* Values that are not or no longer error codes. */
@@ -34763,14 +34764,12 @@ static int error_test(void)
3476334764

3476434765
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
3476534766
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
34766-
{ -11, -12 },
34767-
{ -15, -17 },
34768-
{ -19, -19 },
34769-
{ -26, -27 },
34770-
{ -30, WC_SPAN1_FIRST_E + 1 },
34771-
#else
34772-
{ -9, WC_SPAN1_FIRST_E + 1 },
34767+
{11, 11},
34768+
{17, 15},
34769+
{19, 19},
34770+
{27, 26 },
3477334771
#endif
34772+
{ -9, WC_SPAN1_FIRST_E + 1 },
3477434773
{ -124, -124 },
3477534774
{ -167, -169 },
3477634775
{ -300, -300 },
@@ -34788,7 +34787,10 @@ static int error_test(void)
3478834787
* APIs. Check that the values that are not errors map to the unknown
3478934788
* string.
3479034789
*/
34791-
for (i = 0; i >= MIN_CODE_E; i--) {
34790+
#if defined(OPENSSL_EXTRA)
34791+
start_idx = WC_OSSL_V509_V_ERR_MAX - 1;
34792+
#endif
34793+
for (i = start_idx; i >= MIN_CODE_E; i--) {
3479234794
int this_missing = 0;
3479334795
for (j = 0; j < (int)XELEM_CNT(missing); ++j) {
3479434796
if ((i <= missing[j].first) && (i >= missing[j].last)) {

‎wolfssl/openssl/x509.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,6 @@
6868
#define WOLFSSL_XN_FLAG_MULTILINE 0xFFFF
6969
#define WOLFSSL_XN_FLAG_ONELINE (WOLFSSL_XN_FLAG_SEP_CPLUS_SPC | WOLFSSL_XN_FLAG_SPC_EQ | WOLFSSL_XN_FLAG_FN_SN)
7070

71-
#define WOLFSSL_X509_V_ERR_CRL_HAS_EXPIRED 12
72-
#define WOLFSSL_X509_V_ERR_UNABLE_TO_GET_CRL 3
73-
7471
#ifndef OPENSSL_COEXIST
7572

7673
/* wolfSSL_X509_print_ex flags */

‎wolfssl/ssl.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2612,9 +2612,11 @@ WOLFSSL_API void* wolfSSL_get_app_data( const WOLFSSL *ssl);
26122612
*/
26132613
enum {
26142614
WOLFSSL_X509_V_OK = 0,
2615+
WOLFSSL_X509_V_ERR_UNABLE_TO_GET_CRL = 3,
26152616
WOLFSSL_X509_V_ERR_CERT_SIGNATURE_FAILURE = 7,
26162617
WOLFSSL_X509_V_ERR_CERT_NOT_YET_VALID = 9,
26172618
WOLFSSL_X509_V_ERR_CERT_HAS_EXPIRED = 10,
2619+
WOLFSSL_X509_V_ERR_CRL_HAS_EXPIRED = 12,
26182620
WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD = 13,
26192621
WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD = 14,
26202622
WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT = 18,
@@ -2626,6 +2628,7 @@ enum {
26262628
WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED = 25,
26272629
WOLFSSL_X509_V_ERR_CERT_REJECTED = 28,
26282630
WOLFSSL_X509_V_ERR_SUBJECT_ISSUER_MISMATCH = 29,
2631+
WC_OSSL_V509_V_ERR_MAX = 30,
26292632

26302633
#ifdef HAVE_OCSP
26312634
/* OCSP Flags */

0 commit comments

Comments
 (0)