cloudflare / boring

BoringSSL bindings for the Rust programming language.
367 stars 114 forks source link

Remove INVALID_CALL from mid-handshake error message #291

Open TheJokr opened 2 weeks ago

TheJokr commented 2 weeks ago

Mid-handshake errors that occur before certificate verification currently look like this:

TLS handshake failed: cert verification failed - Invalid certificate verification context [WRONG_VERSION_NUMBER]

Despite no certificate even being received yet, the error complains about a failed verification. The cause here is that cert verification failed is only omitted if the verification result is OK. The default in BoringSSL before verification runs is INVALID_CALL, however.

INVALID_CALL is set/returned in these places:

It is not used anywhere else as a verification result code. To improve the error message, this commit adds INVALID_CALL as a verification result for which no additional error is dislayed.