1 // Copyright 2011 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/cert/cert_status_flags.h" 6 7 #include "base/check_op.h" 8 #include "base/notreached.h" 9 #include "net/base/net_errors.h" 10 11 namespace net { 12 MapNetErrorToCertStatus(int error)13CertStatus MapNetErrorToCertStatus(int error) { 14 switch (error) { 15 case ERR_CERT_COMMON_NAME_INVALID: 16 return CERT_STATUS_COMMON_NAME_INVALID; 17 case ERR_CERT_DATE_INVALID: 18 return CERT_STATUS_DATE_INVALID; 19 case ERR_CERT_AUTHORITY_INVALID: 20 return CERT_STATUS_AUTHORITY_INVALID; 21 case ERR_CERT_NO_REVOCATION_MECHANISM: 22 return CERT_STATUS_NO_REVOCATION_MECHANISM; 23 case ERR_CERT_UNABLE_TO_CHECK_REVOCATION: 24 return CERT_STATUS_UNABLE_TO_CHECK_REVOCATION; 25 case ERR_CERTIFICATE_TRANSPARENCY_REQUIRED: 26 return CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED; 27 case ERR_CERT_REVOKED: 28 return CERT_STATUS_REVOKED; 29 // We added the ERR_CERT_CONTAINS_ERRORS error code when we were using 30 // WinInet, but we never figured out how it differs from ERR_CERT_INVALID. 31 // We should not use ERR_CERT_CONTAINS_ERRORS in new code. 32 case ERR_CERT_CONTAINS_ERRORS: 33 NOTREACHED(); 34 [[fallthrough]]; 35 case ERR_CERT_INVALID: 36 return CERT_STATUS_INVALID; 37 case ERR_CERT_WEAK_SIGNATURE_ALGORITHM: 38 return CERT_STATUS_WEAK_SIGNATURE_ALGORITHM; 39 case ERR_CERT_NON_UNIQUE_NAME: 40 return CERT_STATUS_NON_UNIQUE_NAME; 41 case ERR_CERT_WEAK_KEY: 42 return CERT_STATUS_WEAK_KEY; 43 case ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN: 44 return CERT_STATUS_PINNED_KEY_MISSING; 45 case ERR_CERT_NAME_CONSTRAINT_VIOLATION: 46 return CERT_STATUS_NAME_CONSTRAINT_VIOLATION; 47 case ERR_CERT_VALIDITY_TOO_LONG: 48 return CERT_STATUS_VALIDITY_TOO_LONG; 49 case ERR_CERT_SYMANTEC_LEGACY: 50 return CERT_STATUS_SYMANTEC_LEGACY; 51 case ERR_CERT_KNOWN_INTERCEPTION_BLOCKED: 52 return (CERT_STATUS_KNOWN_INTERCEPTION_BLOCKED | CERT_STATUS_REVOKED); 53 default: 54 return 0; 55 } 56 } 57 MapCertStatusToNetError(CertStatus cert_status)58int MapCertStatusToNetError(CertStatus cert_status) { 59 // A certificate may have multiple errors. We report the most 60 // serious error. 61 62 // Unrecoverable errors 63 if (cert_status & CERT_STATUS_INVALID) 64 return ERR_CERT_INVALID; 65 if (cert_status & CERT_STATUS_PINNED_KEY_MISSING) 66 return ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; 67 68 // Potentially recoverable errors 69 if (cert_status & CERT_STATUS_KNOWN_INTERCEPTION_BLOCKED) 70 return ERR_CERT_KNOWN_INTERCEPTION_BLOCKED; 71 if (cert_status & CERT_STATUS_REVOKED) 72 return ERR_CERT_REVOKED; 73 if (cert_status & CERT_STATUS_AUTHORITY_INVALID) 74 return ERR_CERT_AUTHORITY_INVALID; 75 if (cert_status & CERT_STATUS_COMMON_NAME_INVALID) 76 return ERR_CERT_COMMON_NAME_INVALID; 77 if (cert_status & CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED) 78 return ERR_CERTIFICATE_TRANSPARENCY_REQUIRED; 79 if (cert_status & CERT_STATUS_SYMANTEC_LEGACY) 80 return ERR_CERT_SYMANTEC_LEGACY; 81 // CERT_STATUS_NON_UNIQUE_NAME is intentionally not mapped to an error. 82 // It is treated as just a warning and used to degrade the SSL UI. 83 if (cert_status & CERT_STATUS_NAME_CONSTRAINT_VIOLATION) 84 return ERR_CERT_NAME_CONSTRAINT_VIOLATION; 85 if (cert_status & CERT_STATUS_WEAK_SIGNATURE_ALGORITHM) 86 return ERR_CERT_WEAK_SIGNATURE_ALGORITHM; 87 if (cert_status & CERT_STATUS_WEAK_KEY) 88 return ERR_CERT_WEAK_KEY; 89 if (cert_status & CERT_STATUS_DATE_INVALID) 90 return ERR_CERT_DATE_INVALID; 91 if (cert_status & CERT_STATUS_VALIDITY_TOO_LONG) 92 return ERR_CERT_VALIDITY_TOO_LONG; 93 if (cert_status & CERT_STATUS_UNABLE_TO_CHECK_REVOCATION) 94 return ERR_CERT_UNABLE_TO_CHECK_REVOCATION; 95 if (cert_status & CERT_STATUS_NO_REVOCATION_MECHANISM) 96 return ERR_CERT_NO_REVOCATION_MECHANISM; 97 98 // Unknown status. The assumption is 0 (an OK status) won't be used here. 99 NOTREACHED(); 100 return ERR_UNEXPECTED; 101 } 102 103 } // namespace net 104