Skip to content

Commit ce69f1c

Browse files
SparkiDevSparkiDev
authored
Merge pull request #9635 from miyazakh/x509errstr_handling
Fix OpenSSL error code handling in ERR_reason_error_string()
2 parents 84ca4a0 + 8571a67 commit ce69f1c

File tree

4 files changed

+82
-62
lines changed

4 files changed

+82
-62
lines changed

‎src/internal.c‎

Lines changed: 69 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -26599,6 +26599,66 @@ int SendAlert(WOLFSSL* ssl, int severity, int type)
2659926599
#include <wolfssl/debug-untrace-error-codes.h>
2660026600
#endif
2660126601

26602+
#if !defined(NO_ERROR_STRINGS) && (defined(OPENSSL_EXTRA) || \
26603+
defined(OPENSSL_EXTRA_X509_SMALL) || \
26604+
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED))
26605+
static const char* wolfSSL_ERR_reason_error_string_OpenSSL(unsigned long e)
26606+
{
26607+
switch (e) {
26608+
/* TODO: -WOLFSSL_X509_V_ERR_CERT_SIGNATURE_FAILURE. Conflicts with
26609+
* -WOLFSSL_ERROR_WANT_CONNECT.
26610+
*/
26611+
case WOLFSSL_X509_V_ERR_CRL_HAS_EXPIRED:
26612+
return "CRL has expired";
26613+
26614+
case WOLFSSL_X509_V_ERR_UNABLE_TO_GET_CRL:
26615+
return "unable to get CRL";
26616+
26617+
case WOLFSSL_X509_V_ERR_CERT_NOT_YET_VALID:
26618+
return "certificate not yet valid";
26619+
26620+
case WOLFSSL_X509_V_ERR_CERT_HAS_EXPIRED:
26621+
return "certificate has expired";
26622+
26623+
case WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
26624+
return "certificate signature failure";
26625+
26626+
case WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
26627+
return "format error in certificate's notAfter field";
26628+
26629+
case WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
26630+
return "self-signed certificate in certificate chain";
26631+
26632+
case WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
26633+
return "unable to get local issuer certificate";
26634+
26635+
case WOLFSSL_X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
26636+
return "unable to verify the first certificate";
26637+
26638+
case WOLFSSL_X509_V_ERR_CERT_CHAIN_TOO_LONG:
26639+
return "certificate chain too long";
26640+
26641+
case WOLFSSL_X509_V_ERR_CERT_REVOKED:
26642+
return "certificate revoked";
26643+
26644+
case WOLFSSL_X509_V_ERR_INVALID_CA:
26645+
return "invalid CA certificate";
26646+
26647+
case WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED:
26648+
return "path length constraint exceeded";
26649+
26650+
case WOLFSSL_X509_V_ERR_CERT_REJECTED:
26651+
return "certificate rejected";
26652+
26653+
case WOLFSSL_X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
26654+
return "subject issuer mismatch";
26655+
26656+
default:
26657+
return NULL;
26658+
}
26659+
}
26660+
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL || HAVE_WEBSERVER || HAVE_MEMCACHED */
26661+
2660226662
const char* wolfSSL_ERR_reason_error_string(unsigned long e)
2660326663
{
2660426664
#ifdef NO_ERROR_STRINGS
@@ -26610,11 +26670,18 @@ const char* wolfSSL_ERR_reason_error_string(unsigned long e)
2661026670

2661126671
int error = (int)e;
2661226672

26613-
/* OpenSSL uses positive error codes */
2661426673
if (error > 0) {
26674+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
26675+
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
26676+
/* Check the OpenSSL error strings first. */
26677+
const char* ossl_err = wolfSSL_ERR_reason_error_string_OpenSSL(e);
26678+
if (ossl_err != NULL) {
26679+
return ossl_err;
26680+
}
26681+
/* try to find error strings from wolfSSL */
26682+
#endif
2661526683
error = -error;
2661626684
}
26617-
2661826685
/* pass to wolfCrypt */
2661926686
if ((error <= WC_SPAN1_FIRST_E && error >= WC_SPAN1_MIN_CODE_E) ||
2662026687
(error <= WC_SPAN2_FIRST_E && error >= WC_SPAN2_MIN_CODE_E))
@@ -27173,55 +27240,6 @@ const char* wolfSSL_ERR_reason_error_string(unsigned long e)
2717327240
return "Private key decode error (EVP)";
2717427241
}
2717527242

27176-
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
27177-
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
27178-
27179-
switch (error) {
27180-
/* TODO: -WOLFSSL_X509_V_ERR_CERT_SIGNATURE_FAILURE. Conflicts with
27181-
* -WOLFSSL_ERROR_WANT_CONNECT.
27182-
*/
27183-
27184-
case -WOLFSSL_X509_V_ERR_CERT_NOT_YET_VALID:
27185-
return "certificate not yet valid";
27186-
27187-
case -WOLFSSL_X509_V_ERR_CERT_HAS_EXPIRED:
27188-
return "certificate has expired";
27189-
27190-
case -WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
27191-
return "certificate signature failure";
27192-
27193-
case -WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
27194-
return "format error in certificate's notAfter field";
27195-
27196-
case -WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
27197-
return "self-signed certificate in certificate chain";
27198-
27199-
case -WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
27200-
return "unable to get local issuer certificate";
27201-
27202-
case -WOLFSSL_X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
27203-
return "unable to verify the first certificate";
27204-
27205-
case -WOLFSSL_X509_V_ERR_CERT_CHAIN_TOO_LONG:
27206-
return "certificate chain too long";
27207-
27208-
case -WOLFSSL_X509_V_ERR_CERT_REVOKED:
27209-
return "certificate revoked";
27210-
27211-
case -WOLFSSL_X509_V_ERR_INVALID_CA:
27212-
return "invalid CA certificate";
27213-
27214-
case -WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED:
27215-
return "path length constraint exceeded";
27216-
27217-
case -WOLFSSL_X509_V_ERR_CERT_REJECTED:
27218-
return "certificate rejected";
27219-
27220-
case -WOLFSSL_X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
27221-
return "subject issuer mismatch";
27222-
}
27223-
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL || HAVE_WEBSERVER || HAVE_MEMCACHED */
27224-
2722527243
return "unknown error number";
2722627244

2722727245
#endif /* NO_ERROR_STRINGS */

‎tests/api.c‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34802,6 +34802,7 @@ static int error_test(void)
3480234802
if (EXPECT_FAIL())
3480334803
return OPEN_RAN_E;
3480434804
#else
34805+
int start_idx = 0;
3480534806
int i;
3480634807
int j = 0;
3480734808
/* Values that are not or no longer error codes. */
@@ -34815,14 +34816,12 @@ static int error_test(void)
3481534816

3481634817
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
3481734818
defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
34818-
{ -11, -12 },
34819-
{ -15, -17 },
34820-
{ -19, -19 },
34821-
{ -26, -27 },
34822-
{ -30, WC_SPAN1_FIRST_E + 1 },
34823-
#else
34824-
{ -9, WC_SPAN1_FIRST_E + 1 },
34819+
{11, 11},
34820+
{17, 15},
34821+
{19, 19},
34822+
{27, 26 },
3482534823
#endif
34824+
{ -9, WC_SPAN1_FIRST_E + 1 },
3482634825
{ -124, -124 },
3482734826
{ -167, -169 },
3482834827
{ -300, -300 },
@@ -34840,7 +34839,10 @@ static int error_test(void)
3484034839
* APIs. Check that the values that are not errors map to the unknown
3484134840
* string.
3484234841
*/
34843-
for (i = 0; i >= MIN_CODE_E; i--) {
34842+
#if defined(OPENSSL_EXTRA)
34843+
start_idx = WC_OSSL_V509_V_ERR_MAX - 1;
34844+
#endif
34845+
for (i = start_idx; i >= MIN_CODE_E; i--) {
3484434846
int this_missing = 0;
3484534847
for (j = 0; j < (int)XELEM_CNT(missing); ++j) {
3484634848
if ((i <= missing[j].first) && (i >= missing[j].last)) {

‎wolfssl/openssl/x509.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,6 @@
6868
#define WOLFSSL_XN_FLAG_MULTILINE 0xFFFF
6969
#define WOLFSSL_XN_FLAG_ONELINE (WOLFSSL_XN_FLAG_SEP_CPLUS_SPC | WOLFSSL_XN_FLAG_SPC_EQ | WOLFSSL_XN_FLAG_FN_SN)
7070

71-
#define WOLFSSL_X509_V_ERR_CRL_HAS_EXPIRED 12
72-
#define WOLFSSL_X509_V_ERR_UNABLE_TO_GET_CRL 3
73-
7471
#ifndef OPENSSL_COEXIST
7572

7673
/* wolfSSL_X509_print_ex flags */

‎wolfssl/ssl.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2612,9 +2612,11 @@ WOLFSSL_API void* wolfSSL_get_app_data( const WOLFSSL *ssl);
26122612
*/
26132613
enum {
26142614
WOLFSSL_X509_V_OK = 0,
2615+
WOLFSSL_X509_V_ERR_UNABLE_TO_GET_CRL = 3,
26152616
WOLFSSL_X509_V_ERR_CERT_SIGNATURE_FAILURE = 7,
26162617
WOLFSSL_X509_V_ERR_CERT_NOT_YET_VALID = 9,
26172618
WOLFSSL_X509_V_ERR_CERT_HAS_EXPIRED = 10,
2619+
WOLFSSL_X509_V_ERR_CRL_HAS_EXPIRED = 12,
26182620
WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD = 13,
26192621
WOLFSSL_X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD = 14,
26202622
WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT = 18,
@@ -2626,6 +2628,7 @@ enum {
26262628
WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED = 25,
26272629
WOLFSSL_X509_V_ERR_CERT_REJECTED = 28,
26282630
WOLFSSL_X509_V_ERR_SUBJECT_ISSUER_MISMATCH = 29,
2631+
WC_OSSL_V509_V_ERR_MAX = 30,
26292632

26302633
#ifdef HAVE_OCSP
26312634
/* OCSP Flags */

0 commit comments

Comments
 (0)