Map new X509 verification errors to alert codes (Tom Wu <tom@arcot.com>).

Submitted by:
Reviewed by:
PR:

diff --git a/CHANGES b/CHANGES
index 13e50ddfceea527280e74b4b12f1447876558960..f90d541a7774894803bc22c9be1c32bd1f8c1437 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,10 @@
          *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
          +) applies to 0.9.7 only
 
+  *) Map new X509 verification errors to alerts. Discovered and submitted by
+     Tom Wu <tom@arcot.com>.
+     [Lutz Jaenicke]
+
   *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
      returning non-zero before the data has been completely received
      when using non-blocking I/O.

diff --git a/ssl/s3_both.c b/ssl/s3_both.c
index c69e8d230830ed35c86da181473b54774211bb0c..89b54b71d3650dd6c0e328092e2739a57b676a12 100644 (file)
--- a/ssl/s3_both.c
+++ b/ssl/s3_both.c
@@ -548,6 +548,8 @@ int ssl_verify_alarm_type(long type)
        case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
        case X509_V_ERR_CERT_NOT_YET_VALID:
        case X509_V_ERR_CRL_NOT_YET_VALID:
+       case X509_V_ERR_CERT_UNTRUSTED:
+       case X509_V_ERR_CERT_REJECTED:
                al=SSL_AD_BAD_CERTIFICATE;
                break;
        case X509_V_ERR_CERT_SIGNATURE_FAILURE:
@@ -569,11 +571,16 @@ int ssl_verify_alarm_type(long type)
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
        case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
        case X509_V_ERR_CERT_CHAIN_TOO_LONG:
+       case X509_V_ERR_PATH_LENGTH_EXCEEDED:
+       case X509_V_ERR_INVALID_CA:
                al=SSL_AD_UNKNOWN_CA;
                break;
        case X509_V_ERR_APPLICATION_VERIFICATION:
                al=SSL_AD_HANDSHAKE_FAILURE;
                break;
+       case X509_V_ERR_INVALID_PURPOSE:
+               al=SSL_AD_UNSUPPORTED_CERTIFICATE;
+               break;
        default:
                al=SSL_AD_CERTIFICATE_UNKNOWN;
                break;