Flatten PKI error variants

rustls · Jul 25, 2021 · 432ed5e · 432ed5e
1 parent b84721e
commit 432ed5e
Show file tree

Hide file tree

Showing 8 changed files with 70 additions and 337 deletions.
diff --git a/rustls-mio/tests/badssl.rs b/rustls-mio/tests/badssl.rs
@@ -38,7 +38,9 @@ mod online {
         polite();
         connect("expired.badssl.com")
             .fails()
-            .expect(r"TLS error: WebPkiError\(CertExpired, ValidateServerCert\)")
+            .expect(
+                r#"TLS error: InvalidCertificateData\("invalid peer certificate: CertExpired"\)"#,
+            )
             .go()
             .unwrap();
     }
@@ -48,7 +50,7 @@ mod online {
         polite();
         connect("wrong.host.badssl.com")
             .fails()
-            .expect(r"TLS error: WebPkiError\(CertNotValidForName, ValidateForDnsName\)")
+            .expect(r#"TLS error: InvalidCertificateData\("invalid peer certificate: CertNotValidForName"\)"#)
             .go()
             .unwrap();
     }
@@ -58,7 +60,9 @@ mod online {
         polite();
         connect("self-signed.badssl.com")
             .fails()
-            .expect(r"TLS error: WebPkiError\((UnknownIssuer|CertExpired), ValidateServerCert\)")
+            .expect(
+                r#"TLS error: InvalidCertificateData\("invalid peer certificate: UnknownIssuer"\)"#,
+            )
             .go()
             .unwrap();
     }
@@ -133,7 +137,9 @@ mod online {
         polite();
         connect("sha1-2016.badssl.com")
             .fails()
-            .expect(r"TLS error: WebPkiError\(CertExpired, ValidateServerCert\)")
+            .expect(
+                r#"TLS error: InvalidCertificateData\("invalid peer certificate: CertExpired"\)"#,
+            )
             .go()
             .unwrap();
     }

diff --git a/rustls/examples/internal/bogo_shim.rs b/rustls/examples/internal/bogo_shim.rs
@@ -492,7 +492,7 @@ fn quit_err(why: &str) -> ! {
 
 fn handle_err(err: rustls::Error) -> ! {
     use rustls::internal::msgs::enums::{AlertDescription, ContentType};
-    use rustls::{Error, WebPkiError};
+    use rustls::Error;
     use std::{thread, time};
 
     println!("TLS error: {:?}", err);
@@ -525,13 +525,9 @@ fn handle_err(err: rustls::Error) -> ! {
         Error::AlertReceived(AlertDescription::DecompressionFailure) => {
             quit_err(":SSLV3_ALERT_DECOMPRESSION_FAILURE:")
         }
-        Error::WebPkiError(WebPkiError::BadEncoding, ..) => quit(":CANNOT_PARSE_LEAF_CERT:"),
-        Error::WebPkiError(WebPkiError::InvalidSignatureForPublicKey, ..) => {
-            quit(":BAD_SIGNATURE:")
-        }
-        Error::WebPkiError(WebPkiError::UnsupportedSignatureAlgorithmForPublicKey, ..) => {
-            quit(":WRONG_SIGNATURE_TYPE:")
-        }
+        Error::InvalidCertificateEncoding => quit(":CANNOT_PARSE_LEAF_CERT:"),
+        Error::InvalidCertificateSignature => quit(":BAD_SIGNATURE:"),
+        Error::InvalidCertificateSignatureType => quit(":WRONG_SIGNATURE_TYPE:"),
         Error::PeerSentOversizedRecord => quit(":DATA_LENGTH_TOO_LONG:"),
         _ => {
             println_err!("unhandled error: {:?}", err);

diff --git a/rustls/examples/internal/trytls_shim.rs b/rustls/examples/internal/trytls_shim.rs
@@ -81,7 +81,11 @@ fn communicate(
 
             if let Err(err) = client.process_new_packets() {
                 return match err {
-                    Error::WebPkiError(..) | Error::AlertReceived(_) => Ok(Verdict::Reject(err)),
+                    Error::InvalidCertificateData(_)
+                    | Error::InvalidCertificateSignature
+                    | Error::InvalidCertificateSignatureType
+                    | Error::InvalidCertificateEncoding
+                    | Error::AlertReceived(_) => Ok(Verdict::Reject(err)),
                     _ => Err(From::from(format!("{:?}", err))),
                 };
             }

diff --git a/rustls/src/client/hs.rs b/rustls/src/client/hs.rs
@@ -2,7 +2,7 @@
 use crate::bs_debug;
 use crate::check::check_message;
 use crate::conn::{ConnectionCommon, ConnectionRandoms};
-use crate::error::{Error, WebPkiError};
+use crate::error::Error;
 use crate::hash_hs::HandshakeHashBuffer;
 use crate::key_schedule::KeyScheduleEarly;
 use crate::kx;
@@ -802,7 +802,7 @@ impl State for ExpectServerHelloOrHelloRetryRequest {
 
 pub(super) fn send_cert_error_alert(common: &mut ConnectionCommon, err: Error) -> Error {
     match err {
-        Error::WebPkiError(WebPkiError::BadEncoding, _) => {
+        Error::InvalidCertificateEncoding => {
             common.send_fatal_alert(AlertDescription::DecodeError);
         }
         Error::PeerMisbehavedError(_) => {