Skip to content

Commit 181863b

Browse files
committed
src: move x509 error code and reason to ncrypto
1 parent d8521ce commit 181863b

File tree

5 files changed

+67
-55
lines changed

5 files changed

+67
-55
lines changed

deps/ncrypto/ncrypto.cc

+47
Original file line numberDiff line numberDiff line change
@@ -1071,6 +1071,53 @@ X509Pointer X509Pointer::IssuerFrom(const SSL_CTX* ctx, const X509View& cert) {
10711071
X509Pointer X509Pointer::PeerFrom(const SSLPointer& ssl) {
10721072
return X509Pointer(SSL_get_peer_certificate(ssl.get()));
10731073
}
1074+
1075+
// When adding or removing errors below, please also update the list in the API
1076+
// documentation. See the "OpenSSL Error Codes" section of doc/api/errors.md
1077+
// Also *please* update the respective section in doc/api/tls.md as well
1078+
std::string_view X509Pointer::ErrorCode(int32_t err) { // NOLINT(runtime/int)
1079+
#define CASE(CODE) \
1080+
case X509_V_ERR_##CODE: \
1081+
return #CODE;
1082+
switch (err) {
1083+
CASE(UNABLE_TO_GET_ISSUER_CERT)
1084+
CASE(UNABLE_TO_GET_CRL)
1085+
CASE(UNABLE_TO_DECRYPT_CERT_SIGNATURE)
1086+
CASE(UNABLE_TO_DECRYPT_CRL_SIGNATURE)
1087+
CASE(UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY)
1088+
CASE(CERT_SIGNATURE_FAILURE)
1089+
CASE(CRL_SIGNATURE_FAILURE)
1090+
CASE(CERT_NOT_YET_VALID)
1091+
CASE(CERT_HAS_EXPIRED)
1092+
CASE(CRL_NOT_YET_VALID)
1093+
CASE(CRL_HAS_EXPIRED)
1094+
CASE(ERROR_IN_CERT_NOT_BEFORE_FIELD)
1095+
CASE(ERROR_IN_CERT_NOT_AFTER_FIELD)
1096+
CASE(ERROR_IN_CRL_LAST_UPDATE_FIELD)
1097+
CASE(ERROR_IN_CRL_NEXT_UPDATE_FIELD)
1098+
CASE(OUT_OF_MEM)
1099+
CASE(DEPTH_ZERO_SELF_SIGNED_CERT)
1100+
CASE(SELF_SIGNED_CERT_IN_CHAIN)
1101+
CASE(UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
1102+
CASE(UNABLE_TO_VERIFY_LEAF_SIGNATURE)
1103+
CASE(CERT_CHAIN_TOO_LONG)
1104+
CASE(CERT_REVOKED)
1105+
CASE(INVALID_CA)
1106+
CASE(PATH_LENGTH_EXCEEDED)
1107+
CASE(INVALID_PURPOSE)
1108+
CASE(CERT_UNTRUSTED)
1109+
CASE(CERT_REJECTED)
1110+
CASE(HOSTNAME_MISMATCH)
1111+
}
1112+
#undef CASE
1113+
return "UNSPECIFIED";
1114+
}
1115+
1116+
std::string_view X509Pointer::ErrorReason(int32_t err) {
1117+
if (err == X509_V_OK) return "";
1118+
return X509_verify_cert_error_string(err);
1119+
}
1120+
10741121
// ============================================================================
10751122
// BIOPointer
10761123

deps/ncrypto/ncrypto.h

+3
Original file line numberDiff line numberDiff line change
@@ -637,6 +637,9 @@ class X509Pointer final {
637637
X509View view() const;
638638
operator X509View() const { return view(); }
639639

640+
static std::string_view ErrorCode(int32_t err);
641+
static std::string_view ErrorReason(int32_t err);
642+
640643
private:
641644
DeleteFnPtr<X509, X509_free> cert_;
642645
};

src/crypto/crypto_common.cc

+5-46
Original file line numberDiff line numberDiff line change
@@ -144,58 +144,17 @@ bool SetGroups(SecureContext* sc, const char* groups) {
144144
return SSL_CTX_set1_groups_list(sc->ctx().get(), groups) == 1;
145145
}
146146

147-
// When adding or removing errors below, please also update the list in the API
148-
// documentation. See the "OpenSSL Error Codes" section of doc/api/errors.md
149-
const char* X509ErrorCode(long err) { // NOLINT(runtime/int)
150-
const char* code = "UNSPECIFIED";
151-
#define CASE_X509_ERR(CODE) case X509_V_ERR_##CODE: code = #CODE; break;
152-
switch (err) {
153-
// if you modify anything in here, *please* update the respective section in
154-
// doc/api/tls.md as well
155-
CASE_X509_ERR(UNABLE_TO_GET_ISSUER_CERT)
156-
CASE_X509_ERR(UNABLE_TO_GET_CRL)
157-
CASE_X509_ERR(UNABLE_TO_DECRYPT_CERT_SIGNATURE)
158-
CASE_X509_ERR(UNABLE_TO_DECRYPT_CRL_SIGNATURE)
159-
CASE_X509_ERR(UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY)
160-
CASE_X509_ERR(CERT_SIGNATURE_FAILURE)
161-
CASE_X509_ERR(CRL_SIGNATURE_FAILURE)
162-
CASE_X509_ERR(CERT_NOT_YET_VALID)
163-
CASE_X509_ERR(CERT_HAS_EXPIRED)
164-
CASE_X509_ERR(CRL_NOT_YET_VALID)
165-
CASE_X509_ERR(CRL_HAS_EXPIRED)
166-
CASE_X509_ERR(ERROR_IN_CERT_NOT_BEFORE_FIELD)
167-
CASE_X509_ERR(ERROR_IN_CERT_NOT_AFTER_FIELD)
168-
CASE_X509_ERR(ERROR_IN_CRL_LAST_UPDATE_FIELD)
169-
CASE_X509_ERR(ERROR_IN_CRL_NEXT_UPDATE_FIELD)
170-
CASE_X509_ERR(OUT_OF_MEM)
171-
CASE_X509_ERR(DEPTH_ZERO_SELF_SIGNED_CERT)
172-
CASE_X509_ERR(SELF_SIGNED_CERT_IN_CHAIN)
173-
CASE_X509_ERR(UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
174-
CASE_X509_ERR(UNABLE_TO_VERIFY_LEAF_SIGNATURE)
175-
CASE_X509_ERR(CERT_CHAIN_TOO_LONG)
176-
CASE_X509_ERR(CERT_REVOKED)
177-
CASE_X509_ERR(INVALID_CA)
178-
CASE_X509_ERR(PATH_LENGTH_EXCEEDED)
179-
CASE_X509_ERR(INVALID_PURPOSE)
180-
CASE_X509_ERR(CERT_UNTRUSTED)
181-
CASE_X509_ERR(CERT_REJECTED)
182-
CASE_X509_ERR(HOSTNAME_MISMATCH)
183-
}
184-
#undef CASE_X509_ERR
185-
return code;
186-
}
187-
188147
MaybeLocal<Value> GetValidationErrorReason(Environment* env, int err) {
189-
if (err == 0)
190-
return Undefined(env->isolate());
191-
const char* reason = X509_verify_cert_error_string(err);
192-
return OneByteString(env->isolate(), reason);
148+
auto reason = X509Pointer::ErrorReason(err);
149+
if (reason == "") return Undefined(env->isolate());
150+
return OneByteString(env->isolate(), reason.data(), reason.length());
193151
}
194152

195153
MaybeLocal<Value> GetValidationErrorCode(Environment* env, int err) {
196154
if (err == 0)
197155
return Undefined(env->isolate());
198-
return OneByteString(env->isolate(), X509ErrorCode(err));
156+
auto error = X509Pointer::ErrorCode(err);
157+
return OneByteString(env->isolate(), error.data(), error.length());
199158
}
200159

201160
MaybeLocal<Value> GetCert(Environment* env, const SSLPointer& ssl) {

src/crypto/crypto_common.h

-2
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,6 @@ v8::MaybeLocal<v8::Array> GetClientHelloCiphers(
4646

4747
bool SetGroups(SecureContext* sc, const char* groups);
4848

49-
const char* X509ErrorCode(long err); // NOLINT(runtime/int)
50-
5149
v8::MaybeLocal<v8::Value> GetValidationErrorReason(Environment* env, int err);
5250

5351
v8::MaybeLocal<v8::Value> GetValidationErrorCode(Environment* env, int err);

src/crypto/crypto_tls.cc

+12-7
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,7 @@ std::string GetBIOError() {
386386
static_cast<void*>(&ret));
387387
return ret;
388388
}
389+
389390
} // namespace
390391

391392
TLSWrap::TLSWrap(Environment* env,
@@ -1844,15 +1845,19 @@ void TLSWrap::VerifyError(const FunctionCallbackInfo<Value>& args) {
18441845
if (x509_verify_error == X509_V_OK)
18451846
return args.GetReturnValue().SetNull();
18461847

1847-
const char* reason = X509_verify_cert_error_string(x509_verify_error);
1848-
const char* code = X509ErrorCode(x509_verify_error);
1848+
Local<Value> reason;
1849+
if (!GetValidationErrorReason(env, x509_verify_error).ToLocal(&reason)) {
1850+
return;
1851+
}
1852+
if (reason->IsUndefined()) [[unlikely]]
1853+
return;
18491854

1850-
Local<Object> error =
1851-
Exception::Error(OneByteString(env->isolate(), reason))
1852-
->ToObject(env->isolate()->GetCurrentContext())
1853-
.FromMaybe(Local<Object>());
1855+
Local<Object> error = Exception::Error(reason.As<v8::String>())
1856+
->ToObject(env->isolate()->GetCurrentContext())
1857+
.FromMaybe(Local<Object>());
18541858

1855-
if (Set(env, error, env->code_string(), code))
1859+
auto code = X509Pointer::ErrorCode(x509_verify_error);
1860+
if (Set(env, error, env->code_string(), code.data()))
18561861
args.GetReturnValue().Set(error);
18571862
}
18581863

0 commit comments

Comments
 (0)