libsecureboot: be more verbose about validation failures

freebsd · Dec 4, 2023 · 5415237 · 5415237
1 parent 99b8c0c
commit 5415237
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 3 deletions.
diff --git a/lib/libbearssl/Makefile.inc b/lib/libbearssl/Makefile.inc
@@ -1,6 +1,7 @@
 
 BEARSSL?= ${SRCTOP}/contrib/bearssl
 BEARSSL_SRC= ${BEARSSL}/src
+BEARSSL_TOOLS= ${BEARSSL}/tools
 
 CFLAGS+= -I${BEARSSL}/inc
 CFLAGS+= ${NO_WDEPRECATED_NON_PROTOTYPE}
diff --git a/lib/libbearssl/Makefile.libsa.inc b/lib/libbearssl/Makefile.libsa.inc
@@ -83,3 +83,6 @@ SRCS+= \
 	x509/x509_decoder.c \
 	x509/x509_minimal.c \
 
+# We want find_error_name().
+SRCS+= \
+	${BEARSSL_TOOLS}/errors.c \
diff --git a/lib/libsecureboot/vets.c b/lib/libsecureboot/vets.c
@@ -568,9 +568,15 @@ verify_signer_xcs(br_x509_certificate *xcs,
 			ve_error_set("Validation failed, certificate not valid as of %s",
 			    gdate(date, sizeof(date), ve_utc));
 			break;
-		default:
-			ve_error_set("Validation failed, err = %d", err);
-			break;
+		default: {
+			const char *err_desc = NULL;
+			const char *err_name = find_error_name(err, &err_desc);
+
+			if (err_name == NULL)
+				ve_error_set("Validation failed, err = %d", err);
+			else
+				ve_error_set("Validation failed, %s (%s)", err_desc, err_name);
+			break; }
 		}
 	} else {
 		tpk = mc.vtable->get_pkey(&mc.vtable, &usages);