Fix the naming of alert error codes. Reason codes 1000+N correspond to receiving an alert N from the peer, rather than observing the corresponding error condition locally. This has generally been a source of confusion for folks. They were originally named like SSL_R_TLSV1_ALERT_DECRYPTION_FAILED, but OpenSSL introduced a few without the "ALERT" token in 739a543ea863682f157e9aa0ee382367eb3d187c. We then inadvertently carried the mistake over in SSL_R_TLSV1_UNKNOWN_PSK_IDENTITY and SSL_R_TLSV1_CERTIFICATE_REQUIRED. Fix all these to include the "ALERT" for consistency and make it slightly less confusing. (Although perhaps it should have been RECEIVED_ALERT or so.) Add compatibility #defines for the original OpenSSL ones and SSL_R_TLSV1_CERTIFICATE_REQUIRED. The latter can be removed when downstream code is fixed. The OpenSSL ones we'll probably just leave around. Update-Note: The renamed alerts will log slightly different strings, but the constants used by external code are still there. Bug: 366 Change-Id: I30c299c4ad4b2bed695bd71d0831fbe6755975a7 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42384 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
diff --git a/crypto/err/ssl.errordata b/crypto/err/ssl.errordata index 46fae66..44f2ef2 100644 --- a/crypto/err/ssl.errordata +++ b/crypto/err/ssl.errordata
@@ -174,6 +174,10 @@ SSL,276,TICKET_ENCRYPTION_FAILED SSL,297,TLS13_DOWNGRADE SSL,1049,TLSV1_ALERT_ACCESS_DENIED +SSL,1114,TLSV1_ALERT_BAD_CERTIFICATE_HASH_VALUE +SSL,1113,TLSV1_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE +SSL,1116,TLSV1_ALERT_CERTIFICATE_REQUIRED +SSL,1111,TLSV1_ALERT_CERTIFICATE_UNOBTAINABLE SSL,1050,TLSV1_ALERT_DECODE_ERROR SSL,1021,TLSV1_ALERT_DECRYPTION_FAILED SSL,1051,TLSV1_ALERT_DECRYPT_ERROR @@ -185,14 +189,10 @@ SSL,1070,TLSV1_ALERT_PROTOCOL_VERSION SSL,1022,TLSV1_ALERT_RECORD_OVERFLOW SSL,1048,TLSV1_ALERT_UNKNOWN_CA +SSL,1115,TLSV1_ALERT_UNKNOWN_PSK_IDENTITY +SSL,1112,TLSV1_ALERT_UNRECOGNIZED_NAME +SSL,1110,TLSV1_ALERT_UNSUPPORTED_EXTENSION SSL,1090,TLSV1_ALERT_USER_CANCELLED -SSL,1114,TLSV1_BAD_CERTIFICATE_HASH_VALUE -SSL,1113,TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE -SSL,1116,TLSV1_CERTIFICATE_REQUIRED -SSL,1111,TLSV1_CERTIFICATE_UNOBTAINABLE -SSL,1115,TLSV1_UNKNOWN_PSK_IDENTITY -SSL,1112,TLSV1_UNRECOGNIZED_NAME -SSL,1110,TLSV1_UNSUPPORTED_EXTENSION SSL,217,TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST SSL,218,TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG SSL,219,TOO_MANY_EMPTY_FRAGMENTS
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 46ed112..f15c006 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h
@@ -4688,6 +4688,23 @@ // |SSL_CTX_set_tlsext_status_cb|'s callback and returns one. OPENSSL_EXPORT int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg); +// The following symbols are compatibility aliases for reason codes used when +// receiving an alert from the peer. Use the other names instead, which fit the +// naming convention. +// +// TODO(davidben): Fix references to |SSL_R_TLSV1_CERTIFICATE_REQUIRED| and +// remove the compatibility value. The others come from OpenSSL. +#define SSL_R_TLSV1_UNSUPPORTED_EXTENSION \ + SSL_R_TLSV1_ALERT_UNSUPPORTED_EXTENSION +#define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE \ + SSL_R_TLSV1_ALERT_CERTIFICATE_UNOBTAINABLE +#define SSL_R_TLSV1_UNRECOGNIZED_NAME SSL_R_TLSV1_ALERT_UNRECOGNIZED_NAME +#define SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE \ + SSL_R_TLSV1_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE +#define SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE \ + SSL_R_TLSV1_ALERT_BAD_CERTIFICATE_HASH_VALUE +#define SSL_R_TLSV1_CERTIFICATE_REQUIRED SSL_R_TLSV1_ALERT_CERTIFICATE_REQUIRED + // Nodejs compatibility section (hidden). // @@ -5205,12 +5222,12 @@ #define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086 #define SSL_R_TLSV1_ALERT_USER_CANCELLED 1090 #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 -#define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110 -#define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE 1111 -#define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112 -#define SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE 1113 -#define SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE 1114 -#define SSL_R_TLSV1_UNKNOWN_PSK_IDENTITY 1115 -#define SSL_R_TLSV1_CERTIFICATE_REQUIRED 1116 +#define SSL_R_TLSV1_ALERT_UNSUPPORTED_EXTENSION 1110 +#define SSL_R_TLSV1_ALERT_CERTIFICATE_UNOBTAINABLE 1111 +#define SSL_R_TLSV1_ALERT_UNRECOGNIZED_NAME 1112 +#define SSL_R_TLSV1_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE 1113 +#define SSL_R_TLSV1_ALERT_BAD_CERTIFICATE_HASH_VALUE 1114 +#define SSL_R_TLSV1_ALERT_UNKNOWN_PSK_IDENTITY 1115 +#define SSL_R_TLSV1_ALERT_CERTIFICATE_REQUIRED 1116 #endif // OPENSSL_HEADER_SSL_H