Unverified Commit 78ff4e0d authored by Han Han's avatar Han Han Committed by Daniel Stenberg
Browse files

ssl: replace all internal uses of CURLE_SSL_CACERT 

Closes #3291
parent 89d2e95f

lib/vtls/darwinssl.c

+12 −12
Original line number Diff line number Diff line
@@ -950,7 +950,7 @@ static CURLcode CopyCertSubject(struct Curl_easy *data, 


  if(!c) {

    failf(data, "SSL: invalid CA certificate subject");

    return CURLE_SSL_CACERT;

    return CURLE_PEER_FAILED_VERIFICATION;

  }



  /* If the subject is already available as UTF-8 encoded (ie 'direct') then
@@ -970,7 +970,7 @@ static CURLcode CopyCertSubject(struct Curl_easy *data, 
      if(!CFStringGetCString(c, cbuf, cbuf_size,

                             kCFStringEncodingUTF8)) {

        failf(data, "SSL: invalid CA certificate subject");

        result = CURLE_SSL_CACERT;

        result = CURLE_PEER_FAILED_VERIFICATION;

      }

      else

        /* pass back the buffer */
@@ -1649,7 +1649,7 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, 
        }



        CFRelease(cert);

        if(result == CURLE_SSL_CACERT)

        if(result == CURLE_PEER_FAILED_VERIFICATION)

          return CURLE_SSL_CERTPROBLEM;

        if(result)

          return result;
@@ -2429,37 +2429,37 @@ darwinssl_connect_step2(struct connectdata *conn, int sockindex) 
      /* These are all certificate problems with the server: */

      case errSSLXCertChainInvalid:

        failf(data, "SSL certificate problem: Invalid certificate chain");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLUnknownRootCert:

        failf(data, "SSL certificate problem: Untrusted root certificate");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLNoRootCert:

        failf(data, "SSL certificate problem: No root certificate");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLCertNotYetValid:

        failf(data, "SSL certificate problem: The certificate chain had a "

                    "certificate that is not yet valid");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLCertExpired:

      case errSSLPeerCertExpired:

        failf(data, "SSL certificate problem: Certificate chain had an "

              "expired certificate");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLBadCert:

      case errSSLPeerBadCert:

        failf(data, "SSL certificate problem: Couldn't understand the server "

              "certificate format");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLPeerUnsupportedCert:

        failf(data, "SSL certificate problem: An unsupported certificate "

                    "format was encountered");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLPeerCertRevoked:

        failf(data, "SSL certificate problem: The certificate was revoked");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      case errSSLPeerCertUnknown:

        failf(data, "SSL certificate problem: The certificate is unknown");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;



      /* These are all certificate problems with the client: */

      case errSecAuthFailed:

lib/vtls/gtls.c

+1 −1
Original line number Diff line number Diff line
@@ -1110,7 +1110,7 @@ gtls_connect_step3(struct connectdata *conn, 
              "CRLfile: %s", SSL_CONN_CONFIG(CAfile) ? SSL_CONN_CONFIG(CAfile):

              "none",

              SSL_SET_OPTION(CRLfile)?SSL_SET_OPTION(CRLfile):"none");

        return CURLE_SSL_CACERT;

        return CURLE_PEER_FAILED_VERIFICATION;

      }

      else

        infof(data, "\t server certificate verification FAILED\n");

lib/vtls/mbedtls.c

+1 −1
Original line number Diff line number Diff line
@@ -580,7 +580,7 @@ mbed_connect_step2(struct connectdata *conn, 


    if(ret & MBEDTLS_X509_BADCERT_REVOKED) {

      failf(data, "Cert verify failed: BADCERT_REVOKED");

      return CURLE_SSL_CACERT;

      return CURLE_PEER_FAILED_VERIFICATION;

    }



    if(ret & MBEDTLS_X509_BADCERT_CN_MISMATCH)

lib/vtls/nss.c

+1 −1
Original line number Diff line number Diff line
@@ -2081,7 +2081,7 @@ static CURLcode nss_do_connect(struct connectdata *conn, int sockindex) 
    else if(*certverifyresult == SSL_ERROR_BAD_CERT_DOMAIN)

      result = CURLE_PEER_FAILED_VERIFICATION;

    else if(*certverifyresult != 0)

      result = CURLE_SSL_CACERT;

      result = CURLE_PEER_FAILED_VERIFICATION;

    goto error;

  }

lib/vtls/openssl.c

+1 −1
Original line number Diff line number Diff line
@@ -2719,7 +2719,7 @@ static CURLcode ossl_connect_step2(struct connectdata *conn, int sockindex) 


      if((lib == ERR_LIB_SSL) &&

         (reason == SSL_R_CERTIFICATE_VERIFY_FAILED)) {

        result = CURLE_SSL_CACERT;

        result = CURLE_PEER_FAILED_VERIFICATION;



        lerr = SSL_get_verify_result(BACKEND->handle);

        if(lerr != X509_V_OK) {