From 7e7c38755d24a361f6bc7b8db379bac4bdfd3d9c Mon Sep 17 00:00:00 2001 From: Steffen Eiden Date: Fri, 23 Sep 2022 17:02:48 +0000 Subject: [PATCH] libpv: improve error reporting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use `PV_CERT_ERROR` error domain whenever useful. Currently, it's only used internally in libpv and therefore there is no problem in changing it. Signed-off-by: Steffen Eiden Reviewed-by: Marc Hartmayer Signed-off-by: Jan Höppner --- include/libpv/cert.h | 1 + include/libpv/crypto.h | 1 - libpv/cert.c | 12 ++++++------ 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/include/libpv/cert.h b/include/libpv/cert.h index 3d2ccf0c..bceb3c65 100644 --- a/include/libpv/cert.h +++ b/include/libpv/cert.h @@ -68,6 +68,7 @@ typedef enum { PV_CERT_ERROR_MALFORMED_ROOT_CA, PV_CERT_ERROR_NO_CRL, PV_CERT_ERROR_NO_CRLDP, + PV_CERT_ERROR_NO_IBM_Z_SIGNING_KEY, PV_CERT_ERROR_NO_ISSUER_IBM_Z_FOUND, PV_CERT_ERROR_NO_PUBLIC_KEY, PV_CERT_ERROR_READ_CERTIFICATE, diff --git a/include/libpv/crypto.h b/include/libpv/crypto.h index 24c987fa..8535c7ad 100644 --- a/include/libpv/crypto.h +++ b/include/libpv/crypto.h @@ -181,7 +181,6 @@ typedef enum { PV_CRYPTO_ERROR_KEYGENERATION, PV_CRYPTO_ERROR_RANDOMIZATION, PV_CRYPTO_ERROR_READ_FILE, - PV_CRYPTO_ERROR_NO_IBM_Z_SIGNING_KEY, PV_CRYPTO_ERROR_NO_MATCH_TAG, } PvCryptoErrors; diff --git a/libpv/cert.c b/libpv/cert.c index 064cc92d..a7a3bd68 100644 --- a/libpv/cert.c +++ b/libpv/cert.c @@ -790,7 +790,7 @@ int pv_store_set_verify_param(X509_STORE *store, GError **error) return 0; error: - g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL, + g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_INTERNAL, _("X509 store initialization failed")); return -1; } @@ -1375,14 +1375,14 @@ int pv_check_chain_parameters(const STACK_OF_X509 *chain, GError **error) ca_x509_subject = X509_get_subject_name(ca); if (!ca_x509_subject) { - g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL, + g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_INTERNAL, _("subject of the root CA cannot be retrieved")); return -1; } ca_subject = pv_X509_NAME_oneline(ca_x509_subject); if (!ca_subject) { - g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL, + g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_INTERNAL, _("subject name of the root CA cannot be retrieved")); return -1; } @@ -1476,11 +1476,11 @@ static STACK_OF_X509 *get_ibm_signing_certs(STACK_OF_X509 *certs, GError **error ibm_signing_certs = pv_remove_ibm_signing_certs(certs); ibm_signing_certs_count = sk_X509_num(ibm_signing_certs); if (ibm_signing_certs_count < 1) { - g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_NO_IBM_Z_SIGNING_KEY, + g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_NO_IBM_Z_SIGNING_KEY, _("Specify at least one IBM Z signing key")); return NULL; } else if (ibm_signing_certs_count > 1) { - g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_NO_IBM_Z_SIGNING_KEY, + g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_NO_IBM_Z_SIGNING_KEY, _("Specify only one IBM Z signing key")); return NULL; } @@ -1511,7 +1511,7 @@ static gboolean download_crls(X509_STORE *trusted, PvCertWithPathList *host_key_ X509_CRL *crl = sk_X509_CRL_value(downloaded_ibm_signing_crls, i); if (X509_STORE_add_crl(trusted, crl) != 1) { - g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL, + g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_INTERNAL, _("failed to load CRL")); return FALSE; }