cert_status_flags.cc 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/cert_status_flags.h"
  5. #include "base/check_op.h"
  6. #include "base/notreached.h"
  7. #include "net/base/net_errors.h"
  8. namespace net {
  9. CertStatus MapNetErrorToCertStatus(int error) {
  10. switch (error) {
  11. case ERR_CERT_COMMON_NAME_INVALID:
  12. return CERT_STATUS_COMMON_NAME_INVALID;
  13. case ERR_CERT_DATE_INVALID:
  14. return CERT_STATUS_DATE_INVALID;
  15. case ERR_CERT_AUTHORITY_INVALID:
  16. return CERT_STATUS_AUTHORITY_INVALID;
  17. case ERR_CERT_NO_REVOCATION_MECHANISM:
  18. return CERT_STATUS_NO_REVOCATION_MECHANISM;
  19. case ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
  20. return CERT_STATUS_UNABLE_TO_CHECK_REVOCATION;
  21. case ERR_CERTIFICATE_TRANSPARENCY_REQUIRED:
  22. return CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED;
  23. case ERR_CERT_REVOKED:
  24. return CERT_STATUS_REVOKED;
  25. // We added the ERR_CERT_CONTAINS_ERRORS error code when we were using
  26. // WinInet, but we never figured out how it differs from ERR_CERT_INVALID.
  27. // We should not use ERR_CERT_CONTAINS_ERRORS in new code.
  28. case ERR_CERT_CONTAINS_ERRORS:
  29. NOTREACHED();
  30. [[fallthrough]];
  31. case ERR_CERT_INVALID:
  32. return CERT_STATUS_INVALID;
  33. case ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
  34. return CERT_STATUS_WEAK_SIGNATURE_ALGORITHM;
  35. case ERR_CERT_NON_UNIQUE_NAME:
  36. return CERT_STATUS_NON_UNIQUE_NAME;
  37. case ERR_CERT_WEAK_KEY:
  38. return CERT_STATUS_WEAK_KEY;
  39. case ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN:
  40. return CERT_STATUS_PINNED_KEY_MISSING;
  41. case ERR_CERT_NAME_CONSTRAINT_VIOLATION:
  42. return CERT_STATUS_NAME_CONSTRAINT_VIOLATION;
  43. case ERR_CERT_VALIDITY_TOO_LONG:
  44. return CERT_STATUS_VALIDITY_TOO_LONG;
  45. case ERR_CERT_SYMANTEC_LEGACY:
  46. return CERT_STATUS_SYMANTEC_LEGACY;
  47. case ERR_CERT_KNOWN_INTERCEPTION_BLOCKED:
  48. return (CERT_STATUS_KNOWN_INTERCEPTION_BLOCKED | CERT_STATUS_REVOKED);
  49. default:
  50. return 0;
  51. }
  52. }
  53. int MapCertStatusToNetError(CertStatus cert_status) {
  54. // A certificate may have multiple errors. We report the most
  55. // serious error.
  56. // Unrecoverable errors
  57. if (cert_status & CERT_STATUS_INVALID)
  58. return ERR_CERT_INVALID;
  59. if (cert_status & CERT_STATUS_PINNED_KEY_MISSING)
  60. return ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
  61. // Potentially recoverable errors
  62. if (cert_status & CERT_STATUS_KNOWN_INTERCEPTION_BLOCKED)
  63. return ERR_CERT_KNOWN_INTERCEPTION_BLOCKED;
  64. if (cert_status & CERT_STATUS_REVOKED)
  65. return ERR_CERT_REVOKED;
  66. if (cert_status & CERT_STATUS_AUTHORITY_INVALID)
  67. return ERR_CERT_AUTHORITY_INVALID;
  68. if (cert_status & CERT_STATUS_COMMON_NAME_INVALID)
  69. return ERR_CERT_COMMON_NAME_INVALID;
  70. if (cert_status & CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED)
  71. return ERR_CERTIFICATE_TRANSPARENCY_REQUIRED;
  72. if (cert_status & CERT_STATUS_SYMANTEC_LEGACY)
  73. return ERR_CERT_SYMANTEC_LEGACY;
  74. // CERT_STATUS_NON_UNIQUE_NAME is intentionally not mapped to an error.
  75. // It is treated as just a warning and used to degrade the SSL UI.
  76. if (cert_status & CERT_STATUS_NAME_CONSTRAINT_VIOLATION)
  77. return ERR_CERT_NAME_CONSTRAINT_VIOLATION;
  78. if (cert_status & CERT_STATUS_WEAK_SIGNATURE_ALGORITHM)
  79. return ERR_CERT_WEAK_SIGNATURE_ALGORITHM;
  80. if (cert_status & CERT_STATUS_WEAK_KEY)
  81. return ERR_CERT_WEAK_KEY;
  82. if (cert_status & CERT_STATUS_DATE_INVALID)
  83. return ERR_CERT_DATE_INVALID;
  84. if (cert_status & CERT_STATUS_VALIDITY_TOO_LONG)
  85. return ERR_CERT_VALIDITY_TOO_LONG;
  86. if (cert_status & CERT_STATUS_UNABLE_TO_CHECK_REVOCATION)
  87. return ERR_CERT_UNABLE_TO_CHECK_REVOCATION;
  88. if (cert_status & CERT_STATUS_NO_REVOCATION_MECHANISM)
  89. return ERR_CERT_NO_REVOCATION_MECHANISM;
  90. // Unknown status. The assumption is 0 (an OK status) won't be used here.
  91. NOTREACHED();
  92. return ERR_UNEXPECTED;
  93. }
  94. } // namespace net