Disabled by default, used by loader and sbin/veriexec Reviewed by: emaste Sponsored by: Juniper Networks Differential Revision: D16334
345 lines
8.7 KiB
C
345 lines
8.7 KiB
C
/*
|
|
* Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining
|
|
* a copy of this software and associated documentation files (the
|
|
* "Software"), to deal in the Software without restriction, including
|
|
* without limitation the rights to use, copy, modify, merge, publish,
|
|
* distribute, sublicense, and/or sell copies of the Software, and to
|
|
* permit persons to whom the Software is furnished to do so, subject to
|
|
* the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be
|
|
* included in all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <stdint.h>
|
|
#include <errno.h>
|
|
|
|
#include "brssl.h"
|
|
#include "bearssl.h"
|
|
|
|
static struct {
|
|
int err;
|
|
const char *name;
|
|
const char *comment;
|
|
} errors[] = {
|
|
{
|
|
BR_ERR_BAD_PARAM,
|
|
"BR_ERR_BAD_PARAM",
|
|
"Caller-provided parameter is incorrect."
|
|
}, {
|
|
BR_ERR_BAD_STATE,
|
|
"BR_ERR_BAD_STATE",
|
|
"Operation requested by the caller cannot be applied with"
|
|
" the current context state (e.g. reading data while"
|
|
" outgoing data is waiting to be sent)."
|
|
}, {
|
|
BR_ERR_UNSUPPORTED_VERSION,
|
|
"BR_ERR_UNSUPPORTED_VERSION",
|
|
"Incoming protocol or record version is unsupported."
|
|
}, {
|
|
BR_ERR_BAD_VERSION,
|
|
"BR_ERR_BAD_VERSION",
|
|
"Incoming record version does not match the expected version."
|
|
}, {
|
|
BR_ERR_BAD_LENGTH,
|
|
"BR_ERR_BAD_LENGTH",
|
|
"Incoming record length is invalid."
|
|
}, {
|
|
BR_ERR_TOO_LARGE,
|
|
"BR_ERR_TOO_LARGE",
|
|
"Incoming record is too large to be processed, or buffer"
|
|
" is too small for the handshake message to send."
|
|
}, {
|
|
BR_ERR_BAD_MAC,
|
|
"BR_ERR_BAD_MAC",
|
|
"Decryption found an invalid padding, or the record MAC is"
|
|
" not correct."
|
|
}, {
|
|
BR_ERR_NO_RANDOM,
|
|
"BR_ERR_NO_RANDOM",
|
|
"No initial entropy was provided, and none can be obtained"
|
|
" from the OS."
|
|
}, {
|
|
BR_ERR_UNKNOWN_TYPE,
|
|
"BR_ERR_UNKNOWN_TYPE",
|
|
"Incoming record type is unknown."
|
|
}, {
|
|
BR_ERR_UNEXPECTED,
|
|
"BR_ERR_UNEXPECTED",
|
|
"Incoming record or message has wrong type with regards to"
|
|
" the current engine state."
|
|
}, {
|
|
BR_ERR_BAD_CCS,
|
|
"BR_ERR_BAD_CCS",
|
|
"ChangeCipherSpec message from the peer has invalid contents."
|
|
}, {
|
|
BR_ERR_BAD_ALERT,
|
|
"BR_ERR_BAD_ALERT",
|
|
"Alert message from the peer has invalid contents"
|
|
" (odd length)."
|
|
}, {
|
|
BR_ERR_BAD_HANDSHAKE,
|
|
"BR_ERR_BAD_HANDSHAKE",
|
|
"Incoming handshake message decoding failed."
|
|
}, {
|
|
BR_ERR_OVERSIZED_ID,
|
|
"BR_ERR_OVERSIZED_ID",
|
|
"ServerHello contains a session ID which is larger than"
|
|
" 32 bytes."
|
|
}, {
|
|
BR_ERR_BAD_CIPHER_SUITE,
|
|
"BR_ERR_BAD_CIPHER_SUITE",
|
|
"Server wants to use a cipher suite that we did not claim"
|
|
" to support. This is also reported if we tried to advertise"
|
|
" a cipher suite that we do not support."
|
|
}, {
|
|
BR_ERR_BAD_COMPRESSION,
|
|
"BR_ERR_BAD_COMPRESSION",
|
|
"Server wants to use a compression that we did not claim"
|
|
" to support."
|
|
}, {
|
|
BR_ERR_BAD_FRAGLEN,
|
|
"BR_ERR_BAD_FRAGLEN",
|
|
"Server's max fragment length does not match client's."
|
|
}, {
|
|
BR_ERR_BAD_SECRENEG,
|
|
"BR_ERR_BAD_SECRENEG",
|
|
"Secure renegotiation failed."
|
|
}, {
|
|
BR_ERR_EXTRA_EXTENSION,
|
|
"BR_ERR_EXTRA_EXTENSION",
|
|
"Server sent an extension type that we did not announce,"
|
|
" or used the same extension type several times in a"
|
|
" single ServerHello."
|
|
}, {
|
|
BR_ERR_BAD_SNI,
|
|
"BR_ERR_BAD_SNI",
|
|
"Invalid Server Name Indication contents (when used by"
|
|
" the server, this extension shall be empty)."
|
|
}, {
|
|
BR_ERR_BAD_HELLO_DONE,
|
|
"BR_ERR_BAD_HELLO_DONE",
|
|
"Invalid ServerHelloDone from the server (length is not 0)."
|
|
}, {
|
|
BR_ERR_LIMIT_EXCEEDED,
|
|
"BR_ERR_LIMIT_EXCEEDED",
|
|
"Internal limit exceeded (e.g. server's public key is too"
|
|
" large)."
|
|
}, {
|
|
BR_ERR_BAD_FINISHED,
|
|
"BR_ERR_BAD_FINISHED",
|
|
"Finished message from peer does not match the expected"
|
|
" value."
|
|
}, {
|
|
BR_ERR_RESUME_MISMATCH,
|
|
"BR_ERR_RESUME_MISMATCH",
|
|
"Session resumption attempt with distinct version or cipher"
|
|
" suite."
|
|
}, {
|
|
BR_ERR_INVALID_ALGORITHM,
|
|
"BR_ERR_INVALID_ALGORITHM",
|
|
"Unsupported or invalid algorithm (ECDHE curve, signature"
|
|
" algorithm, hash function)."
|
|
}, {
|
|
BR_ERR_BAD_SIGNATURE,
|
|
"BR_ERR_BAD_SIGNATURE",
|
|
"Invalid signature in ServerKeyExchange or"
|
|
" CertificateVerify message."
|
|
}, {
|
|
BR_ERR_WRONG_KEY_USAGE,
|
|
"BR_ERR_WRONG_KEY_USAGE",
|
|
"Peer's public key does not have the proper type or is"
|
|
" not allowed for the requested operation."
|
|
}, {
|
|
BR_ERR_NO_CLIENT_AUTH,
|
|
"BR_ERR_NO_CLIENT_AUTH",
|
|
"Client did not send a certificate upon request, or the"
|
|
" client certificate could not be validated."
|
|
}, {
|
|
BR_ERR_IO,
|
|
"BR_ERR_IO",
|
|
"I/O error or premature close on transport stream."
|
|
}, {
|
|
BR_ERR_X509_INVALID_VALUE,
|
|
"BR_ERR_X509_INVALID_VALUE",
|
|
"Invalid value in an ASN.1 structure."
|
|
},
|
|
{
|
|
BR_ERR_X509_TRUNCATED,
|
|
"BR_ERR_X509_TRUNCATED",
|
|
"Truncated certificate or other ASN.1 object."
|
|
},
|
|
{
|
|
BR_ERR_X509_EMPTY_CHAIN,
|
|
"BR_ERR_X509_EMPTY_CHAIN",
|
|
"Empty certificate chain (no certificate at all)."
|
|
},
|
|
{
|
|
BR_ERR_X509_INNER_TRUNC,
|
|
"BR_ERR_X509_INNER_TRUNC",
|
|
"Decoding error: inner element extends beyond outer element"
|
|
" size."
|
|
},
|
|
{
|
|
BR_ERR_X509_BAD_TAG_CLASS,
|
|
"BR_ERR_X509_BAD_TAG_CLASS",
|
|
"Decoding error: unsupported tag class (application or"
|
|
" private)."
|
|
},
|
|
{
|
|
BR_ERR_X509_BAD_TAG_VALUE,
|
|
"BR_ERR_X509_BAD_TAG_VALUE",
|
|
"Decoding error: unsupported tag value."
|
|
},
|
|
{
|
|
BR_ERR_X509_INDEFINITE_LENGTH,
|
|
"BR_ERR_X509_INDEFINITE_LENGTH",
|
|
"Decoding error: indefinite length."
|
|
},
|
|
{
|
|
BR_ERR_X509_EXTRA_ELEMENT,
|
|
"BR_ERR_X509_EXTRA_ELEMENT",
|
|
"Decoding error: extraneous element."
|
|
},
|
|
{
|
|
BR_ERR_X509_UNEXPECTED,
|
|
"BR_ERR_X509_UNEXPECTED",
|
|
"Decoding error: unexpected element."
|
|
},
|
|
{
|
|
BR_ERR_X509_NOT_CONSTRUCTED,
|
|
"BR_ERR_X509_NOT_CONSTRUCTED",
|
|
"Decoding error: expected constructed element, but is"
|
|
" primitive."
|
|
},
|
|
{
|
|
BR_ERR_X509_NOT_PRIMITIVE,
|
|
"BR_ERR_X509_NOT_PRIMITIVE",
|
|
"Decoding error: expected primitive element, but is"
|
|
" constructed."
|
|
},
|
|
{
|
|
BR_ERR_X509_PARTIAL_BYTE,
|
|
"BR_ERR_X509_PARTIAL_BYTE",
|
|
"Decoding error: BIT STRING length is not multiple of 8."
|
|
},
|
|
{
|
|
BR_ERR_X509_BAD_BOOLEAN,
|
|
"BR_ERR_X509_BAD_BOOLEAN",
|
|
"Decoding error: BOOLEAN value has invalid length."
|
|
},
|
|
{
|
|
BR_ERR_X509_OVERFLOW,
|
|
"BR_ERR_X509_OVERFLOW",
|
|
"Decoding error: value is off-limits."
|
|
},
|
|
{
|
|
BR_ERR_X509_BAD_DN,
|
|
"BR_ERR_X509_BAD_DN",
|
|
"Invalid distinguished name."
|
|
},
|
|
{
|
|
BR_ERR_X509_BAD_TIME,
|
|
"BR_ERR_X509_BAD_TIME",
|
|
"Invalid date/time representation."
|
|
},
|
|
{
|
|
BR_ERR_X509_UNSUPPORTED,
|
|
"BR_ERR_X509_UNSUPPORTED",
|
|
"Certificate contains unsupported features that cannot be"
|
|
" ignored."
|
|
},
|
|
{
|
|
BR_ERR_X509_LIMIT_EXCEEDED,
|
|
"BR_ERR_X509_LIMIT_EXCEEDED",
|
|
"Key or signature size exceeds internal limits."
|
|
},
|
|
{
|
|
BR_ERR_X509_WRONG_KEY_TYPE,
|
|
"BR_ERR_X509_WRONG_KEY_TYPE",
|
|
"Key type does not match that which was expected."
|
|
},
|
|
{
|
|
BR_ERR_X509_BAD_SIGNATURE,
|
|
"BR_ERR_X509_BAD_SIGNATURE",
|
|
"Signature is invalid."
|
|
},
|
|
{
|
|
BR_ERR_X509_TIME_UNKNOWN,
|
|
"BR_ERR_X509_TIME_UNKNOWN",
|
|
"Validation time is unknown."
|
|
},
|
|
{
|
|
BR_ERR_X509_EXPIRED,
|
|
"BR_ERR_X509_EXPIRED",
|
|
"Certificate is expired or not yet valid."
|
|
},
|
|
{
|
|
BR_ERR_X509_DN_MISMATCH,
|
|
"BR_ERR_X509_DN_MISMATCH",
|
|
"Issuer/Subject DN mismatch in the chain."
|
|
},
|
|
{
|
|
BR_ERR_X509_BAD_SERVER_NAME,
|
|
"BR_ERR_X509_BAD_SERVER_NAME",
|
|
"Expected server name was not found in the chain."
|
|
},
|
|
{
|
|
BR_ERR_X509_CRITICAL_EXTENSION,
|
|
"BR_ERR_X509_CRITICAL_EXTENSION",
|
|
"Unknown critical extension in certificate."
|
|
},
|
|
{
|
|
BR_ERR_X509_NOT_CA,
|
|
"BR_ERR_X509_NOT_CA",
|
|
"Not a CA, or path length constraint violation."
|
|
},
|
|
{
|
|
BR_ERR_X509_FORBIDDEN_KEY_USAGE,
|
|
"BR_ERR_X509_FORBIDDEN_KEY_USAGE",
|
|
"Key Usage extension prohibits intended usage."
|
|
},
|
|
{
|
|
BR_ERR_X509_WEAK_PUBLIC_KEY,
|
|
"BR_ERR_X509_WEAK_PUBLIC_KEY",
|
|
"Public key found in certificate is too small."
|
|
},
|
|
{
|
|
BR_ERR_X509_NOT_TRUSTED,
|
|
"BR_ERR_X509_NOT_TRUSTED",
|
|
"Chain could not be linked to a trust anchor."
|
|
},
|
|
{ 0, 0, 0 }
|
|
};
|
|
|
|
/* see brssl.h */
|
|
const char *
|
|
find_error_name(int err, const char **comment)
|
|
{
|
|
size_t u;
|
|
|
|
for (u = 0; errors[u].name; u ++) {
|
|
if (errors[u].err == err) {
|
|
if (comment != NULL) {
|
|
*comment = errors[u].comment;
|
|
}
|
|
return errors[u].name;
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|