Commit 11c26ecf authored by Lutz Jänicke's avatar Lutz Jänicke
Browse files

Map new X509 verification errors to alert codes (Tom Wu <tom@arcot.com>).

parent 99d5b230

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -41,6 +41,10 @@ 
         *) applies to 0.9.6a ... 0.9.6d and 0.9.7

         +) applies to 0.9.7 only



  *) Map new X509 verification errors to alerts. Discovered and submitted by

     Tom Wu <tom@arcot.com>.

     [Lutz Jaenicke]



  *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from

     returning non-zero before the data has been completely received

     when using non-blocking I/O.

ssl/s3_both.c

+7 −0
Original line number Diff line number Diff line
@@ -548,6 +548,8 @@ int ssl_verify_alarm_type(long type) 
	case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:

	case X509_V_ERR_CERT_NOT_YET_VALID:

	case X509_V_ERR_CRL_NOT_YET_VALID:

	case X509_V_ERR_CERT_UNTRUSTED:

	case X509_V_ERR_CERT_REJECTED:

		al=SSL_AD_BAD_CERTIFICATE;

		break;

	case X509_V_ERR_CERT_SIGNATURE_FAILURE:
@@ -569,11 +571,16 @@ int ssl_verify_alarm_type(long type) 
	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:

	case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:

	case X509_V_ERR_CERT_CHAIN_TOO_LONG:

	case X509_V_ERR_PATH_LENGTH_EXCEEDED:

	case X509_V_ERR_INVALID_CA:

		al=SSL_AD_UNKNOWN_CA;

		break;

	case X509_V_ERR_APPLICATION_VERIFICATION:

		al=SSL_AD_HANDSHAKE_FAILURE;

		break;

	case X509_V_ERR_INVALID_PURPOSE:

		al=SSL_AD_UNSUPPORTED_CERTIFICATE;

		break;

	default:

		al=SSL_AD_CERTIFICATE_UNKNOWN;

		break;