kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Map NOT_YET_VALID errors to |certificate_expired|.

Browse Source 
The language of RFC 5246 is "A certificate has expired or is not
currently valid", which sounds to me like |certificate_expired| should
pertain to any case where the current time is outside the
certificate's validity period.

Along the way, group the |unknown_ca| errors together.

Change-Id: I92c1fe3fc898283d0c7207625de36662cd0f784e
Reviewed-on: https://boringssl-review.googlesource.com/24624
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
Matthew Braithwaite 2018-01-05 09:05:33 -08:00 committed by CQ bot account: commit-bot@chromium.org
parent 92e332501a
commit 9770532afa
1 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
ssl/ssl_x509.cc
View File

@ -1240,9 +1240,16 @@ int SSL_set1_verify_cert_store(SSL *ssl, X509_STORE *store) {
int SSL_alert_from_verify_result(long result) {
switch (result) {
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
case X509_V_ERR_CERT_CHAIN_TOO_LONG:
case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
case X509_V_ERR_INVALID_CA:
case X509_V_ERR_PATH_LENGTH_EXCEEDED:
case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
case X509_V_ERR_UNABLE_TO_GET_CRL:
case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
return SSL_AD_UNKNOWN_CA;
case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
@ -1252,8 +1259,6 @@ int SSL_alert_from_verify_result(long result) {
case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
case X509_V_ERR_CERT_NOT_YET_VALID:
case X509_V_ERR_CRL_NOT_YET_VALID:
case X509_V_ERR_CERT_UNTRUSTED:
case X509_V_ERR_CERT_REJECTED:
case X509_V_ERR_HOSTNAME_MISMATCH:
@ -1266,7 +1271,9 @@ int SSL_alert_from_verify_result(long result) {
return SSL_AD_DECRYPT_ERROR;
case X509_V_ERR_CERT_HAS_EXPIRED:
case X509_V_ERR_CERT_NOT_YET_VALID:
case X509_V_ERR_CRL_HAS_EXPIRED:
case X509_V_ERR_CRL_NOT_YET_VALID:
return SSL_AD_CERTIFICATE_EXPIRED;
case X509_V_ERR_CERT_REVOKED:
@ -1278,15 +1285,6 @@ int SSL_alert_from_verify_result(long result) {
case X509_V_ERR_STORE_LOOKUP:
return SSL_AD_INTERNAL_ERROR;
case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
case X509_V_ERR_CERT_CHAIN_TOO_LONG:
case X509_V_ERR_PATH_LENGTH_EXCEEDED:
case X509_V_ERR_INVALID_CA:
return SSL_AD_UNKNOWN_CA;
case X509_V_ERR_APPLICATION_VERIFICATION:
return SSL_AD_HANDSHAKE_FAILURE;