fix: name the check that refused a TLS handshake

Platform/MbedTls/Interface/SolidSyslogMbedTlsStreamErrors.h

@@ -34,6 +34,10 @@ SOLIDSYSLOG_EXTERN_C_BEGIN
         SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_NULL_TRANSPORT,
         SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_NULL_SLEEP,
         SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_NULL_RNG,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_UNTRUSTED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_NAME_MISMATCHED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_EXPIRED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_NOT_YET_VALID,
         SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_MAX /**< One past the last code; never emitted. Bounds the range for iteration. */
     };
 

Platform/MbedTls/Source/SolidSyslogMbedTlsStream.c

@@ -7,6 +7,7 @@
 #include <mbedtls/ctr_drbg.h>
 #include <mbedtls/pk.h>
 #include <mbedtls/ssl.h>
+#include <mbedtls/x509.h>
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
@@ -45,6 +46,10 @@ static inline bool MbedTlsStream_BindContextToConfig(struct SolidSyslogMbedTlsSt
 static inline bool MbedTlsStream_ConfigureExpectedHostname(struct SolidSyslogMbedTlsStream* self);
 static inline void MbedTlsStream_InstallTransportCallbacks(struct SolidSyslogMbedTlsStream* self);
 static inline bool MbedTlsStream_PerformHandshake(struct SolidSyslogMbedTlsStream* self);
+static inline enum SolidSyslogMbedTlsStreamErrors MbedTlsStream_RefusalDetail(struct SolidSyslogMbedTlsStream* self);
+static inline bool MbedTlsStream_IsVerifyFailure(uint32_t verdict);
+static inline enum SolidSyslogMbedTlsStreamErrors MbedTlsStream_DetailForVerifyFailure(uint32_t verdict);
+static inline bool MbedTlsStream_HasUnnamedVerifyFailure(uint32_t verdict);
 static inline bool MbedTlsStream_IsRetryableHandshakeRc(int rc);
 static inline bool MbedTlsStream_IsHandshakeBudgetExhausted(uint32_t totalSleptMs, uint32_t budgetMs);
 static inline bool MbedTlsStream_Send(struct SolidSyslogStream* base, const void* buffer, size_t size);
@@ -334,7 +339,7 @@ static inline bool MbedTlsStream_PerformHandshake(struct SolidSyslogMbedTlsStrea
             MbedTlsStream_Report(
                 SOLIDSYSLOG_SEVERITY_ERROR,
                 SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
-                SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_HANDSHAKE_REJECTED
+                MbedTlsStream_RefusalDetail(self)
             );
             done = true;
         }
@@ -356,6 +361,66 @@ static inline bool MbedTlsStream_PerformHandshake(struct SolidSyslogMbedTlsStrea
     return result;
 }
 
+/* The verdict outlives the failed handshake - mbedTLS records every fault it
+ * found on the session being negotiated - so the refusal can name the check that
+ * produced it rather than the handshake that carried it. */
+static inline enum SolidSyslogMbedTlsStreamErrors MbedTlsStream_RefusalDetail(struct SolidSyslogMbedTlsStream* self)
+{
+    enum SolidSyslogMbedTlsStreamErrors detail = SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_HANDSHAKE_REJECTED;
+    uint32_t verdict = mbedtls_ssl_get_verify_result(&self->SslContext);
+    if (MbedTlsStream_IsVerifyFailure(verdict))
+    {
+        detail = MbedTlsStream_DetailForVerifyFailure(verdict);
+    }
+    return detail;
+}
+
+/* Zero is mbedTLS for "nothing wrong" and 0xFFFFFFFF for "no result to give".
+ * Neither is a check the peer's certificate failed, so neither may be read as a
+ * set of flags - every flag reads as set in the second of them. */
+static inline bool MbedTlsStream_IsVerifyFailure(uint32_t verdict)
+{
+    const uint32_t verifyResultUnavailable = 0xFFFFFFFFU;
+    return (verdict != 0U) && (verdict != verifyResultUnavailable);
+}
+
+/* The flags accumulate, so a compound verdict resolves by precedence: an
+ * untrusted chain is reported ahead of anything the certificate says about
+ * itself, because a certificate no anchor vouches for is not made acceptable by
+ * the dates it carries. */
+static inline enum SolidSyslogMbedTlsStreamErrors MbedTlsStream_DetailForVerifyFailure(uint32_t verdict)
+{
+    enum SolidSyslogMbedTlsStreamErrors detail = SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_UNTRUSTED;
+    if (MbedTlsStream_HasUnnamedVerifyFailure(verdict) == false)
+    {
+        if ((verdict & (uint32_t) MBEDTLS_X509_BADCERT_CN_MISMATCH) != 0U)
+        {
+            detail = SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_NAME_MISMATCHED;
+        }
+        else if ((verdict & (uint32_t) MBEDTLS_X509_BADCERT_EXPIRED) != 0U)
+        {
+            detail = SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_EXPIRED;
+        }
+        else
+        {
+            /* A named flag is set and the other two are not, so this is it. */
+            detail = SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_NOT_YET_VALID;
+        }
+    }
+    return detail;
+}
+
+/* Every flag the cascade above does not name individually. A certificate that
+ * fails path validation for one of them is untrusted whichever it is, and the
+ * integrator's next step - replace the certificate, not the network - is the
+ * same. */
+static inline bool MbedTlsStream_HasUnnamedVerifyFailure(uint32_t verdict)
+{
+    const uint32_t named = (uint32_t) MBEDTLS_X509_BADCERT_CN_MISMATCH | (uint32_t) MBEDTLS_X509_BADCERT_EXPIRED |
+                           (uint32_t) MBEDTLS_X509_BADCERT_FUTURE;
+    return (verdict & ~named) != 0U;
+}
+
 static inline bool MbedTlsStream_IsRetryableHandshakeRc(int rc)
 {
     return (rc == MBEDTLS_ERR_SSL_WANT_READ) || (rc == MBEDTLS_ERR_SSL_WANT_WRITE);

Platform/OpenSsl/Interface/SolidSyslogOpenSslStreamErrors.h

@@ -31,6 +31,10 @@ SOLIDSYSLOG_EXTERN_C_BEGIN
         SOLIDSYSLOG_OPENSSL_STREAM_ERROR_NULL_CONFIG,
         SOLIDSYSLOG_OPENSSL_STREAM_ERROR_NULL_TRANSPORT,
         SOLIDSYSLOG_OPENSSL_STREAM_ERROR_NULL_SLEEP,
+        SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_CERTIFICATE_UNTRUSTED,
+        SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_NAME_MISMATCHED,
+        SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_CERTIFICATE_EXPIRED,
+        SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_CERTIFICATE_NOT_YET_VALID,
         SOLIDSYSLOG_OPENSSL_STREAM_ERROR_MAX /**< One past the last code; never emitted. Bounds the range for iteration. */
     };
 

Platform/OpenSsl/Source/SolidSyslogOpenSslStream.c

@@ -8,6 +8,7 @@
 #include <openssl/prov_ssl.h>
 #include <openssl/ssl.h>
 #include <openssl/types.h>
+#include <openssl/x509_vfy.h>
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
@@ -62,6 +63,7 @@ static inline void OpenSslStream_LoadClientCredential(
 );
 static inline bool OpenSslStream_Open(struct SolidSyslogStream* base, const struct SolidSyslogAddress* addr);
 static inline bool OpenSslStream_PerformHandshake(struct SolidSyslogOpenSslStream* self);
+static inline enum SolidSyslogOpenSslStreamErrors OpenSslStream_RefusalDetail(struct SolidSyslogOpenSslStream* self);
 static inline SolidSyslogSsize OpenSslStream_Read(struct SolidSyslogStream* base, void* buffer, size_t size);
 static inline void OpenSslStream_ReleaseBioMethod(struct SolidSyslogOpenSslStream* self);
 static inline void OpenSslStream_ReleaseHandshakeState(struct SolidSyslogOpenSslStream* self);
@@ -550,7 +552,7 @@ static inline bool OpenSslStream_PerformHandshake(struct SolidSyslogOpenSslStrea
                 OpenSslStream_Report(
                     SOLIDSYSLOG_SEVERITY_ERROR,
                     SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
-                    SOLIDSYSLOG_OPENSSL_STREAM_ERROR_HANDSHAKE_REJECTED
+                    OpenSslStream_RefusalDetail(self)
                 );
                 done = true;
             }
@@ -573,6 +575,39 @@ static inline bool OpenSslStream_PerformHandshake(struct SolidSyslogOpenSslStrea
     return result;
 }
 
+/* The verdict outlives the failed handshake - OpenSSL records it on the
+ * connection as path validation runs - so the refusal can name the check that
+ * produced it rather than the handshake that carried it. A verification failure
+ * this does not name individually reads as untrusted: the certificate did not
+ * validate, which is what the integrator has to act on. */
+static inline enum SolidSyslogOpenSslStreamErrors OpenSslStream_RefusalDetail(struct SolidSyslogOpenSslStream* self)
+{
+    enum SolidSyslogOpenSslStreamErrors detail = SOLIDSYSLOG_OPENSSL_STREAM_ERROR_HANDSHAKE_REJECTED;
+    long verdict = SSL_get_verify_result(self->Ssl);
+    if (verdict == X509_V_ERR_HOSTNAME_MISMATCH)
+    {
+        detail = SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_NAME_MISMATCHED;
+    }
+    else if (verdict == X509_V_ERR_CERT_HAS_EXPIRED)
+    {
+        detail = SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_CERTIFICATE_EXPIRED;
+    }
+    else if (verdict == X509_V_ERR_CERT_NOT_YET_VALID)
+    {
+        detail = SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_CERTIFICATE_NOT_YET_VALID;
+    }
+    else if (verdict != X509_V_OK)
+    {
+        detail = SOLIDSYSLOG_OPENSSL_STREAM_ERROR_PEER_CERTIFICATE_UNTRUSTED;
+    }
+    else
+    {
+        /* Verification passed or never ran, so the refusal is a protocol or
+         * transport fault rather than one the peer's certificate explains. */
+    }
+    return detail;
+}
+
 static inline bool OpenSslStream_Send(struct SolidSyslogStream* base, const void* buffer, size_t size)
 {
     struct SolidSyslogOpenSslStream* self = OpenSslStream_SelfFromBase(base);

Tests/MbedTls/SolidSyslogMbedTlsStreamTest.cpp

@@ -164,6 +164,17 @@ TEST_GROUP(SolidSyslogMbedTlsStream)
         int seq[] = {errorCode};
         MbedTlsFake_SetSslHandshakeReturnSequence(seq, 1);
     }
+
+    /* Arrange a peer whose certificate mbedTLS refused for `flags`. ServerName is
+     * set so the refusal is the only error source - a NULL one would also emit
+     * the unverified-peer WARNING. */
+    void ArrangeCertificateVerificationFailure(uint32_t flags)
+    {
+        config.ServerName = "syslog.example.com";
+        ReCreateHandleWithUpdatedConfig();
+        ArrangePersistentHandshakeError(MBEDTLS_ERR_X509_CERT_VERIFY_FAILED);
+        MbedTlsFake_SetSslVerifyResult(flags);
+    }
 };
 
 // clang-format on
@@ -385,6 +396,107 @@ TEST(SolidSyslogMbedTlsStream, OpenClosesTransportAndFreesSslStateWhenHandshakeF
     );
 }
 
+TEST(SolidSyslogMbedTlsStream, OpenReportsThatThePeerCertificateHasExpired)
+{
+    ArrangeCertificateVerificationFailure(MBEDTLS_X509_BADCERT_EXPIRED);
+
+    CHECK_FALSE(SolidSyslogStream_Open(handle, addr));
+    CHECK_OPEN_UNWOUND_WITH_ERROR(
+        transport,
+        SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_EXPIRED
+    );
+}
+
+TEST(SolidSyslogMbedTlsStream, OpenReportsThatThePeerCertificateIsNotYetValid)
+{
+    ArrangeCertificateVerificationFailure(MBEDTLS_X509_BADCERT_FUTURE);
+
+    CHECK_FALSE(SolidSyslogStream_Open(handle, addr));
+    CHECK_OPEN_UNWOUND_WITH_ERROR(
+        transport,
+        SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_NOT_YET_VALID
+    );
+}
+
+TEST(SolidSyslogMbedTlsStream, OpenReportsThatThePeerNameDidNotMatch)
+{
+    ArrangeCertificateVerificationFailure(MBEDTLS_X509_BADCERT_CN_MISMATCH);
+
+    CHECK_FALSE(SolidSyslogStream_Open(handle, addr));
+    CHECK_OPEN_UNWOUND_WITH_ERROR(
+        transport,
+        SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_NAME_MISMATCHED
+    );
+}
+
+TEST(SolidSyslogMbedTlsStream, OpenReportsThatThePeerCertificateIsNotTrusted)
+{
+    ArrangeCertificateVerificationFailure(MBEDTLS_X509_BADCERT_NOT_TRUSTED);
+
+    CHECK_FALSE(SolidSyslogStream_Open(handle, addr));
+    CHECK_OPEN_UNWOUND_WITH_ERROR(
+        transport,
+        SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_UNTRUSTED
+    );
+}
+
+/* mbedTLS accumulates every fault it found into one bitmask, so a compound
+ * verdict has to resolve to a single reason. An untrusted chain wins, which is
+ * the reason a library that stops at the first failure reaches first - path
+ * building runs before any date is examined - so both TLS adapters agree on a
+ * compound fault as well as on a single one. */
+TEST(SolidSyslogMbedTlsStream, OpenReportsAnUntrustedChainAheadOfTheDatesOnIt)
+{
+    ArrangeCertificateVerificationFailure(MBEDTLS_X509_BADCERT_NOT_TRUSTED | MBEDTLS_X509_BADCERT_EXPIRED);
+
+    CHECK_FALSE(SolidSyslogStream_Open(handle, addr));
+    CHECK_OPEN_UNWOUND_WITH_ERROR(
+        transport,
+        SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_UNTRUSTED
+    );
+}
+
+/* A verification failure with no name of its own - here a key too weak for the
+ * profile - still tells the integrator the certificate is the fault rather than
+ * the network, which is the whole point of naming the check. */
+TEST(SolidSyslogMbedTlsStream, OpenReportsAVerificationFailureItCannotNameAsUntrusted)
+{
+    ArrangeCertificateVerificationFailure(MBEDTLS_X509_BADCERT_BAD_KEY);
+
+    CHECK_FALSE(SolidSyslogStream_Open(handle, addr));
+    CHECK_OPEN_UNWOUND_WITH_ERROR(
+        transport,
+        SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_PEER_CERTIFICATE_UNTRUSTED
+    );
+}
+
+/* mbedTLS answers 0xFFFFFFFF when it has no verdict to give. Every flag reads as
+ * set, so it must be recognised rather than mapped, or a refusal with no
+ * certificate behind it would be reported as an untrusted one. */
+TEST(SolidSyslogMbedTlsStream, OpenReportsAPlainRejectionWhenNoVerdictIsAvailable)
+{
+    /* Arranged by hand rather than through ArrangeCertificateVerificationFailure:
+     * a verdict is unavailable when certificate verification never ran, which
+     * pairs with a handshake that failed for some other reason. */
+    config.ServerName = "syslog.example.com";
+    ReCreateHandleWithUpdatedConfig();
+    ArrangePersistentHandshakeError(MBEDTLS_ERR_SSL_BAD_INPUT_DATA);
+    MbedTlsFake_SetSslVerifyResult(0xFFFFFFFFU);
+
+    CHECK_FALSE(SolidSyslogStream_Open(handle, addr));
+    CHECK_OPEN_UNWOUND_WITH_ERROR(
+        transport,
+        SOLIDSYSLOG_CAT_TLS_STREAM_HANDSHAKE_FAILED,
+        SOLIDSYSLOG_MBEDTLS_STREAM_ERROR_HANDSHAKE_REJECTED
+    );
+}
+
 /* -------------------------------------------------------------------------
  * Open failure unwind + error reporting (S26.02). Every failure path after
  * the first allocating operation must close the inner transport, free both

Tests/MbedTlsIntegration/MbedTlsTestCert.c

@@ -101,7 +101,9 @@ static void WriteCertToDer(
     const unsigned char serial[] = {0x01};
     mbedtls_x509write_crt_set_serial_raw(&crt, (unsigned char*) serial, sizeof(serial));
 
-    mbedtls_x509write_crt_set_validity(&crt, TEST_CERT_VALIDITY_FROM, TEST_CERT_VALIDITY_TO);
+    const char* validityFrom = (config->ValidityFrom != NULL) ? config->ValidityFrom : TEST_CERT_VALIDITY_FROM;
+    const char* validityTo = (config->ValidityTo != NULL) ? config->ValidityTo : TEST_CERT_VALIDITY_TO;
+    mbedtls_x509write_crt_set_validity(&crt, validityFrom, validityTo);
 
     mbedtls_x509write_crt_set_basic_constraints(&crt, config->IsCa, -1);
 

Tests/MbedTlsIntegration/MbedTlsTestCert.h

@@ -22,6 +22,11 @@ SOLIDSYSLOG_EXTERN_C_BEGIN
         const char* SubjectAltDns; /* SAN dnsName; NULL = no SAN */
         int IsCa; /* 1 = mark BasicConstraints CA:TRUE */
         const struct MbedTlsTestCert* Issuer; /* NULL = self-signed */
+        /* "YYYYMMDDHHMMSS", as mbedtls_x509write_crt_set_validity takes them.
+         * NULL on either leaves the default window, which is open now and
+         * stays open past any plausible run of these tests. */
+        const char* ValidityFrom;
+        const char* ValidityTo;
     };
 
     /* Build a fresh RSA-2048 key + cert pair. The cert is parsed back into