103ed08549
Previously, we'd omitted OpenSSL's OCSP APIs because they depend on a complex OCSP mechanism and encourage the the unreliable server behavior that hampers using OCSP stapling to fix revocation today. (OCSP responses should not be fetched on-demand on a callback. They should be managed like other server credentials and refreshed eagerly, so temporary CA outage does not translate to loss of OCSP.) But most of the APIs are byte-oriented anyway, so they're easy to support. Intentionally omit the one that takes a bunch of OCSP_RESPIDs. The callback is benign on the client (an artifact of OpenSSL reading OCSP and verifying certificates in the wrong order). On the server, it encourages unreliability, but pyOpenSSL/cryptography.io depends on this. Dcument that this is only for compatibility with legacy software. Also tweak a few things for compatilibility. cryptography.io expects SSL_CTX_set_read_ahead to return something, SSL_get_server_tmp_key's signature was wrong, and cryptography.io tries to redefine SSL_get_server_tmp_key if SSL_CTRL_GET_SERVER_TMP_KEY is missing. Change-Id: I2f99711783456bfb7324e9ad972510be8a95e845 Reviewed-on: https://boringssl-review.googlesource.com/28404 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
96 lines
3.7 KiB
Go
96 lines
3.7 KiB
Go
// Copyright 2009 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package runner
|
|
|
|
import "strconv"
|
|
|
|
type alert uint8
|
|
|
|
const (
|
|
// alert level
|
|
alertLevelWarning = 1
|
|
alertLevelError = 2
|
|
)
|
|
|
|
const (
|
|
alertCloseNotify alert = 0
|
|
alertEndOfEarlyData alert = 1
|
|
alertUnexpectedMessage alert = 10
|
|
alertBadRecordMAC alert = 20
|
|
alertDecryptionFailed alert = 21
|
|
alertRecordOverflow alert = 22
|
|
alertDecompressionFailure alert = 30
|
|
alertHandshakeFailure alert = 40
|
|
alertNoCertificate alert = 41
|
|
alertBadCertificate alert = 42
|
|
alertUnsupportedCertificate alert = 43
|
|
alertCertificateRevoked alert = 44
|
|
alertCertificateExpired alert = 45
|
|
alertCertificateUnknown alert = 46
|
|
alertIllegalParameter alert = 47
|
|
alertUnknownCA alert = 48
|
|
alertAccessDenied alert = 49
|
|
alertDecodeError alert = 50
|
|
alertDecryptError alert = 51
|
|
alertProtocolVersion alert = 70
|
|
alertInsufficientSecurity alert = 71
|
|
alertInternalError alert = 80
|
|
alertInappropriateFallback alert = 86
|
|
alertUserCanceled alert = 90
|
|
alertNoRenegotiation alert = 100
|
|
alertMissingExtension alert = 109
|
|
alertUnsupportedExtension alert = 110
|
|
alertUnrecognizedName alert = 112
|
|
alertBadCertificateStatusResponse alert = 113
|
|
alertUnknownPSKIdentity alert = 115
|
|
alertCertificateRequired alert = 116
|
|
)
|
|
|
|
var alertText = map[alert]string{
|
|
alertCloseNotify: "close notify",
|
|
alertEndOfEarlyData: "end of early data",
|
|
alertUnexpectedMessage: "unexpected message",
|
|
alertBadRecordMAC: "bad record MAC",
|
|
alertDecryptionFailed: "decryption failed",
|
|
alertRecordOverflow: "record overflow",
|
|
alertDecompressionFailure: "decompression failure",
|
|
alertHandshakeFailure: "handshake failure",
|
|
alertNoCertificate: "no certificate",
|
|
alertBadCertificate: "bad certificate",
|
|
alertUnsupportedCertificate: "unsupported certificate",
|
|
alertCertificateRevoked: "revoked certificate",
|
|
alertCertificateExpired: "expired certificate",
|
|
alertCertificateUnknown: "unknown certificate",
|
|
alertIllegalParameter: "illegal parameter",
|
|
alertUnknownCA: "unknown certificate authority",
|
|
alertAccessDenied: "access denied",
|
|
alertDecodeError: "error decoding message",
|
|
alertDecryptError: "error decrypting message",
|
|
alertProtocolVersion: "protocol version not supported",
|
|
alertInsufficientSecurity: "insufficient security level",
|
|
alertInternalError: "internal error",
|
|
alertInappropriateFallback: "inappropriate fallback",
|
|
alertUserCanceled: "user canceled",
|
|
alertNoRenegotiation: "no renegotiation",
|
|
alertMissingExtension: "missing extension",
|
|
alertUnsupportedExtension: "unsupported extension",
|
|
alertBadCertificateStatusResponse: "bad certificate status response",
|
|
alertUnrecognizedName: "unrecognized name",
|
|
alertUnknownPSKIdentity: "unknown PSK identity",
|
|
alertCertificateRequired: "certificate required",
|
|
}
|
|
|
|
func (e alert) String() string {
|
|
s, ok := alertText[e]
|
|
if ok {
|
|
return s
|
|
}
|
|
return "alert(" + strconv.Itoa(int(e)) + ")"
|
|
}
|
|
|
|
func (e alert) Error() string {
|
|
return e.String()
|
|
}
|