grpc 1.53.0 → 1.54.2

data/third_party/boringssl-with-bazel/src/crypto/x509/x509_trs.c

@@ -71,13 +71,10 @@ static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
 static int trust_compat(X509_TRUST *trust, X509 *x, int flags);
 
 static int obj_trust(int id, X509 *x, int flags);
-static int (*default_trust) (int id, X509 *x, int flags) = obj_trust;
 
-/*
- * WARNING: the following table should be kept in order of trust and without
- * any gaps so we can just subtract the minimum trust value to get an index
- * into the table
- */
+// WARNING: the following table should be kept in order of trust and without
+// any gaps so we can just subtract the minimum trust value to get an index
+// into the table
 
 static X509_TRUST trstandard[] = {
     {X509_TRUST_COMPAT, 0, trust_compat, (char *)"compatible", 0, NULL},
@@ -94,238 +91,220 @@ static X509_TRUST trstandard[] = {
     {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, (char *)"OCSP request",
      NID_ad_OCSP, NULL},
     {X509_TRUST_TSA, 0, trust_1oidany, (char *)"TSA server", NID_time_stamp,
-     NULL}
-};
+     NULL}};
 
-#define X509_TRUST_COUNT        (sizeof(trstandard)/sizeof(X509_TRUST))
+#define X509_TRUST_COUNT (sizeof(trstandard) / sizeof(X509_TRUST))
 
 static STACK_OF(X509_TRUST) *trtable = NULL;
 
-static int tr_cmp(const X509_TRUST **a, const X509_TRUST **b)
-{
-    return (*a)->trust - (*b)->trust;
-}
-
-int (*X509_TRUST_set_default(int (*trust) (int, X509 *, int))) (int, X509 *,
-                                                                int) {
-    int (*oldtrust) (int, X509 *, int);
-    oldtrust = default_trust;
-    default_trust = trust;
-    return oldtrust;
+static int tr_cmp(const X509_TRUST **a, const X509_TRUST **b) {
+  return (*a)->trust - (*b)->trust;
 }
 
-int X509_check_trust(X509 *x, int id, int flags)
-{
-    X509_TRUST *pt;
-    int idx;
-    if (id == -1)
-        return 1;
-    /* We get this as a default value */
-    if (id == 0) {
-        int rv;
-        rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);
-        if (rv != X509_TRUST_UNTRUSTED)
-            return rv;
-        return trust_compat(NULL, x, 0);
+int X509_check_trust(X509 *x, int id, int flags) {
+  X509_TRUST *pt;
+  int idx;
+  if (id == -1) {
+    return 1;
+  }
+  // We get this as a default value
+  if (id == 0) {
+    int rv;
+    rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);
+    if (rv != X509_TRUST_UNTRUSTED) {
+      return rv;
     }
-    idx = X509_TRUST_get_by_id(id);
-    if (idx == -1)
-        return default_trust(id, x, flags);
-    pt = X509_TRUST_get0(idx);
-    return pt->check_trust(pt, x, flags);
+    return trust_compat(NULL, x, 0);
+  }
+  idx = X509_TRUST_get_by_id(id);
+  if (idx == -1) {
+    return obj_trust(id, x, flags);
+  }
+  pt = X509_TRUST_get0(idx);
+  return pt->check_trust(pt, x, flags);
 }
 
-int X509_TRUST_get_count(void)
-{
-    if (!trtable)
-        return X509_TRUST_COUNT;
-    return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
+int X509_TRUST_get_count(void) {
+  if (!trtable) {
+    return X509_TRUST_COUNT;
+  }
+  return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
 }
 
-X509_TRUST *X509_TRUST_get0(int idx)
-{
-    if (idx < 0)
-        return NULL;
-    if (idx < (int)X509_TRUST_COUNT)
-        return trstandard + idx;
-    return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
+X509_TRUST *X509_TRUST_get0(int idx) {
+  if (idx < 0) {
+    return NULL;
+  }
+  if (idx < (int)X509_TRUST_COUNT) {
+    return trstandard + idx;
+  }
+  return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
 }
 
-int X509_TRUST_get_by_id(int id)
-{
-    X509_TRUST tmp;
-    size_t idx;
-
-    if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
-        return id - X509_TRUST_MIN;
-    tmp.trust = id;
-    if (!trtable)
-        return -1;
-    sk_X509_TRUST_sort(trtable);
-    if (!sk_X509_TRUST_find(trtable, &idx, &tmp)) {
-        return -1;
-    }
-    return idx + X509_TRUST_COUNT;
+int X509_TRUST_get_by_id(int id) {
+  X509_TRUST tmp;
+  size_t idx;
+
+  if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX)) {
+    return id - X509_TRUST_MIN;
+  }
+  tmp.trust = id;
+  if (!trtable) {
+    return -1;
+  }
+  sk_X509_TRUST_sort(trtable);
+  if (!sk_X509_TRUST_find(trtable, &idx, &tmp)) {
+    return -1;
+  }
+  return idx + X509_TRUST_COUNT;
 }
 
-int X509_TRUST_set(int *t, int trust)
-{
-    if (X509_TRUST_get_by_id(trust) == -1) {
-        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_TRUST);
-        return 0;
-    }
-    *t = trust;
-    return 1;
+int X509_TRUST_set(int *t, int trust) {
+  if (X509_TRUST_get_by_id(trust) == -1) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_TRUST);
+    return 0;
+  }
+  *t = trust;
+  return 1;
 }
 
-int X509_TRUST_add(int id, int flags, int (*ck) (X509_TRUST *, X509 *, int),
-                   char *name, int arg1, void *arg2)
-{
-    int idx;
-    X509_TRUST *trtmp;
-    char *name_dup;
-
-    /*
-     * This is set according to what we change: application can't set it
-     */
-    flags &= ~X509_TRUST_DYNAMIC;
-    /* This will always be set for application modified trust entries */
-    flags |= X509_TRUST_DYNAMIC_NAME;
-    /* Get existing entry if any */
-    idx = X509_TRUST_get_by_id(id);
-    /* Need a new entry */
-    if (idx == -1) {
-        if (!(trtmp = OPENSSL_malloc(sizeof(X509_TRUST)))) {
-            OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
-            return 0;
-        }
-        trtmp->flags = X509_TRUST_DYNAMIC;
-    } else
-        trtmp = X509_TRUST_get0(idx);
-
-    /* Duplicate the supplied name. */
-    name_dup = OPENSSL_strdup(name);
-    if (name_dup == NULL) {
-        OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
-        if (idx == -1)
-            OPENSSL_free(trtmp);
-        return 0;
+int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
+                   char *name, int arg1, void *arg2) {
+  int idx;
+  X509_TRUST *trtmp;
+  char *name_dup;
+
+  // This is set according to what we change: application can't set it
+  flags &= ~X509_TRUST_DYNAMIC;
+  // This will always be set for application modified trust entries
+  flags |= X509_TRUST_DYNAMIC_NAME;
+  // Get existing entry if any
+  idx = X509_TRUST_get_by_id(id);
+  // Need a new entry
+  if (idx == -1) {
+    if (!(trtmp = OPENSSL_malloc(sizeof(X509_TRUST)))) {
+      return 0;
     }
-
-    /* OPENSSL_free existing name if dynamic */
-    if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
-        OPENSSL_free(trtmp->name);
-    trtmp->name = name_dup;
-    /* Keep the dynamic flag of existing entry */
-    trtmp->flags &= X509_TRUST_DYNAMIC;
-    /* Set all other flags */
-    trtmp->flags |= flags;
-
-    trtmp->trust = id;
-    trtmp->check_trust = ck;
-    trtmp->arg1 = arg1;
-    trtmp->arg2 = arg2;
-
-    /* If its a new entry manage the dynamic table */
+    trtmp->flags = X509_TRUST_DYNAMIC;
+  } else {
+    trtmp = X509_TRUST_get0(idx);
+  }
+
+  // Duplicate the supplied name.
+  name_dup = OPENSSL_strdup(name);
+  if (name_dup == NULL) {
     if (idx == -1) {
-        if (!trtable && !(trtable = sk_X509_TRUST_new(tr_cmp))) {
-            OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
-            trtable_free(trtmp);
-            return 0;
-        }
-        if (!sk_X509_TRUST_push(trtable, trtmp)) {
-            OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
-            trtable_free(trtmp);
-            return 0;
-        }
+      OPENSSL_free(trtmp);
     }
-    return 1;
+    return 0;
+  }
+
+  // OPENSSL_free existing name if dynamic
+  if (trtmp->flags & X509_TRUST_DYNAMIC_NAME) {
+    OPENSSL_free(trtmp->name);
+  }
+  trtmp->name = name_dup;
+  // Keep the dynamic flag of existing entry
+  trtmp->flags &= X509_TRUST_DYNAMIC;
+  // Set all other flags
+  trtmp->flags |= flags;
+
+  trtmp->trust = id;
+  trtmp->check_trust = ck;
+  trtmp->arg1 = arg1;
+  trtmp->arg2 = arg2;
+
+  // If its a new entry manage the dynamic table
+  if (idx == -1) {
+    if (!trtable && !(trtable = sk_X509_TRUST_new(tr_cmp))) {
+      trtable_free(trtmp);
+      return 0;
+    }
+    if (!sk_X509_TRUST_push(trtable, trtmp)) {
+      trtable_free(trtmp);
+      return 0;
+    }
+  }
+  return 1;
 }
 
-static void trtable_free(X509_TRUST *p)
-{
-    if (!p)
-        return;
-    if (p->flags & X509_TRUST_DYNAMIC) {
-        if (p->flags & X509_TRUST_DYNAMIC_NAME)
-            OPENSSL_free(p->name);
-        OPENSSL_free(p);
+static void trtable_free(X509_TRUST *p) {
+  if (!p) {
+    return;
+  }
+  if (p->flags & X509_TRUST_DYNAMIC) {
+    if (p->flags & X509_TRUST_DYNAMIC_NAME) {
+      OPENSSL_free(p->name);
     }
+    OPENSSL_free(p);
+  }
 }
 
-void X509_TRUST_cleanup(void)
-{
-    unsigned int i;
-    for (i = 0; i < X509_TRUST_COUNT; i++)
-        trtable_free(trstandard + i);
-    sk_X509_TRUST_pop_free(trtable, trtable_free);
-    trtable = NULL;
+void X509_TRUST_cleanup(void) {
+  unsigned int i;
+  for (i = 0; i < X509_TRUST_COUNT; i++) {
+    trtable_free(trstandard + i);
+  }
+  sk_X509_TRUST_pop_free(trtable, trtable_free);
+  trtable = NULL;
 }
 
-int X509_TRUST_get_flags(const X509_TRUST *xp)
-{
-    return xp->flags;
-}
+int X509_TRUST_get_flags(const X509_TRUST *xp) { return xp->flags; }
 
-char *X509_TRUST_get0_name(const X509_TRUST *xp)
-{
-    return xp->name;
-}
+char *X509_TRUST_get0_name(const X509_TRUST *xp) { return xp->name; }
 
-int X509_TRUST_get_trust(const X509_TRUST *xp)
-{
-    return xp->trust;
-}
+int X509_TRUST_get_trust(const X509_TRUST *xp) { return xp->trust; }
 
-static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
-{
-    if (x->aux && (x->aux->trust || x->aux->reject))
-        return obj_trust(trust->arg1, x, flags);
-    /*
-     * we don't have any trust settings: for compatibility we return trusted
-     * if it is self signed
-     */
-    return trust_compat(trust, x, flags);
+static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags) {
+  if (x->aux && (x->aux->trust || x->aux->reject)) {
+    return obj_trust(trust->arg1, x, flags);
+  }
+  // we don't have any trust settings: for compatibility we return trusted
+  // if it is self signed
+  return trust_compat(trust, x, flags);
 }
 
-static int trust_1oid(X509_TRUST *trust, X509 *x, int flags)
-{
-    if (x->aux)
-        return obj_trust(trust->arg1, x, flags);
-    return X509_TRUST_UNTRUSTED;
+static int trust_1oid(X509_TRUST *trust, X509 *x, int flags) {
+  if (x->aux) {
+    return obj_trust(trust->arg1, x, flags);
+  }
+  return X509_TRUST_UNTRUSTED;
 }
 
-static int trust_compat(X509_TRUST *trust, X509 *x, int flags)
-{
-    if (!x509v3_cache_extensions(x))
-        return X509_TRUST_UNTRUSTED;
-    if (x->ex_flags & EXFLAG_SS)
-        return X509_TRUST_TRUSTED;
-    else
-        return X509_TRUST_UNTRUSTED;
+static int trust_compat(X509_TRUST *trust, X509 *x, int flags) {
+  if (!x509v3_cache_extensions(x)) {
+    return X509_TRUST_UNTRUSTED;
+  }
+  if (x->ex_flags & EXFLAG_SS) {
+    return X509_TRUST_TRUSTED;
+  } else {
+    return X509_TRUST_UNTRUSTED;
+  }
 }
 
-static int obj_trust(int id, X509 *x, int flags)
-{
-    ASN1_OBJECT *obj;
-    size_t i;
-    X509_CERT_AUX *ax;
-    ax = x->aux;
-    if (!ax)
-        return X509_TRUST_UNTRUSTED;
-    if (ax->reject) {
-        for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
-            obj = sk_ASN1_OBJECT_value(ax->reject, i);
-            if (OBJ_obj2nid(obj) == id)
-                return X509_TRUST_REJECTED;
-        }
+static int obj_trust(int id, X509 *x, int flags) {
+  ASN1_OBJECT *obj;
+  size_t i;
+  X509_CERT_AUX *ax;
+  ax = x->aux;
+  if (!ax) {
+    return X509_TRUST_UNTRUSTED;
+  }
+  if (ax->reject) {
+    for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
+      obj = sk_ASN1_OBJECT_value(ax->reject, i);
+      if (OBJ_obj2nid(obj) == id) {
+        return X509_TRUST_REJECTED;
+      }
     }
-    if (ax->trust) {
-        for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
-            obj = sk_ASN1_OBJECT_value(ax->trust, i);
-            if (OBJ_obj2nid(obj) == id)
-                return X509_TRUST_TRUSTED;
-        }
+  }
+  if (ax->trust) {
+    for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
+      obj = sk_ASN1_OBJECT_value(ax->trust, i);
+      if (OBJ_obj2nid(obj) == id) {
+        return X509_TRUST_TRUSTED;
+      }
     }
-    return X509_TRUST_UNTRUSTED;
+  }
+  return X509_TRUST_UNTRUSTED;
 }

data/third_party/boringssl-with-bazel/src/crypto/x509/x509_txt.c

@@ -56,149 +56,134 @@
 
 #include <openssl/x509.h>
 
-const char *X509_verify_cert_error_string(long err)
-{
-    switch (err) {
+const char *X509_verify_cert_error_string(long err) {
+  switch (err) {
     case X509_V_OK:
-        return "ok";
+      return "ok";
     case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
-        return "unable to get issuer certificate";
+      return "unable to get issuer certificate";
     case X509_V_ERR_UNABLE_TO_GET_CRL:
-        return "unable to get certificate CRL";
+      return "unable to get certificate CRL";
     case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
-        return "unable to decrypt certificate's signature";
+      return "unable to decrypt certificate's signature";
     case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
-        return "unable to decrypt CRL's signature";
+      return "unable to decrypt CRL's signature";
     case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
-        return "unable to decode issuer public key";
+      return "unable to decode issuer public key";
     case X509_V_ERR_CERT_SIGNATURE_FAILURE:
-        return "certificate signature failure";
+      return "certificate signature failure";
     case X509_V_ERR_CRL_SIGNATURE_FAILURE:
-        return "CRL signature failure";
+      return "CRL signature failure";
     case X509_V_ERR_CERT_NOT_YET_VALID:
-        return "certificate is not yet valid";
+      return "certificate is not yet valid";
     case X509_V_ERR_CRL_NOT_YET_VALID:
-        return "CRL is not yet valid";
+      return "CRL is not yet valid";
     case X509_V_ERR_CERT_HAS_EXPIRED:
-        return "certificate has expired";
+      return "certificate has expired";
     case X509_V_ERR_CRL_HAS_EXPIRED:
-        return "CRL has expired";
+      return "CRL has expired";
     case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
-        return "format error in certificate's notBefore field";
+      return "format error in certificate's notBefore field";
     case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
-        return "format error in certificate's notAfter field";
+      return "format error in certificate's notAfter field";
     case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
-        return "format error in CRL's lastUpdate field";
+      return "format error in CRL's lastUpdate field";
     case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
-        return "format error in CRL's nextUpdate field";
+      return "format error in CRL's nextUpdate field";
     case X509_V_ERR_OUT_OF_MEM:
-        return "out of memory";
+      return "out of memory";
     case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
-        return "self signed certificate";
+      return "self signed certificate";
     case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
-        return "self signed certificate in certificate chain";
+      return "self signed certificate in certificate chain";
     case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
-        return "unable to get local issuer certificate";
+      return "unable to get local issuer certificate";
     case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
-        return "unable to verify the first certificate";
+      return "unable to verify the first certificate";
     case X509_V_ERR_CERT_CHAIN_TOO_LONG:
-        return "certificate chain too long";
+      return "certificate chain too long";
     case X509_V_ERR_CERT_REVOKED:
-        return "certificate revoked";
+      return "certificate revoked";
     case X509_V_ERR_INVALID_CA:
-        return "invalid CA certificate";
+      return "invalid CA certificate";
     case X509_V_ERR_INVALID_NON_CA:
-        return "invalid non-CA certificate (has CA markings)";
+      return "invalid non-CA certificate (has CA markings)";
     case X509_V_ERR_PATH_LENGTH_EXCEEDED:
-        return "path length constraint exceeded";
+      return "path length constraint exceeded";
     case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED:
-        return "proxy path length constraint exceeded";
+      return "proxy path length constraint exceeded";
     case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED:
-        return
-            "proxy certificates not allowed, please set the appropriate flag";
+      return "proxy certificates not allowed, please set the appropriate flag";
     case X509_V_ERR_INVALID_PURPOSE:
-        return "unsupported certificate purpose";
+      return "unsupported certificate purpose";
     case X509_V_ERR_CERT_UNTRUSTED:
-        return "certificate not trusted";
+      return "certificate not trusted";
     case X509_V_ERR_CERT_REJECTED:
-        return "certificate rejected";
+      return "certificate rejected";
     case X509_V_ERR_APPLICATION_VERIFICATION:
-        return "application verification failure";
+      return "application verification failure";
     case X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
-        return "subject issuer mismatch";
+      return "subject issuer mismatch";
     case X509_V_ERR_AKID_SKID_MISMATCH:
-        return "authority and subject key identifier mismatch";
+      return "authority and subject key identifier mismatch";
     case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
-        return "authority and issuer serial number mismatch";
+      return "authority and issuer serial number mismatch";
     case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
-        return "key usage does not include certificate signing";
+      return "key usage does not include certificate signing";
     case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
-        return "unable to get CRL issuer certificate";
+      return "unable to get CRL issuer certificate";
     case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
-        return "unhandled critical extension";
+      return "unhandled critical extension";
     case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
-        return "key usage does not include CRL signing";
+      return "key usage does not include CRL signing";
     case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
-        return "key usage does not include digital signature";
+      return "key usage does not include digital signature";
     case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
-        return "unhandled critical CRL extension";
+      return "unhandled critical CRL extension";
     case X509_V_ERR_INVALID_EXTENSION:
-        return "invalid or inconsistent certificate extension";
+      return "invalid or inconsistent certificate extension";
     case X509_V_ERR_INVALID_POLICY_EXTENSION:
-        return "invalid or inconsistent certificate policy extension";
+      return "invalid or inconsistent certificate policy extension";
     case X509_V_ERR_NO_EXPLICIT_POLICY:
-        return "no explicit policy";
+      return "no explicit policy";
     case X509_V_ERR_DIFFERENT_CRL_SCOPE:
-        return "Different CRL scope";
+      return "Different CRL scope";
     case X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE:
-        return "Unsupported extension feature";
+      return "Unsupported extension feature";
     case X509_V_ERR_UNNESTED_RESOURCE:
-        return "RFC 3779 resource not subset of parent's resources";
+      return "RFC 3779 resource not subset of parent's resources";
 
     case X509_V_ERR_PERMITTED_VIOLATION:
-        return "permitted subtree violation";
+      return "permitted subtree violation";
     case X509_V_ERR_EXCLUDED_VIOLATION:
-        return "excluded subtree violation";
+      return "excluded subtree violation";
     case X509_V_ERR_SUBTREE_MINMAX:
-        return "name constraints minimum and maximum not supported";
+      return "name constraints minimum and maximum not supported";
     case X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE:
-        return "unsupported name constraint type";
+      return "unsupported name constraint type";
     case X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX:
-        return "unsupported or invalid name constraint syntax";
+      return "unsupported or invalid name constraint syntax";
     case X509_V_ERR_UNSUPPORTED_NAME_SYNTAX:
-        return "unsupported or invalid name syntax";
+      return "unsupported or invalid name syntax";
     case X509_V_ERR_CRL_PATH_VALIDATION_ERROR:
-        return "CRL path validation error";
-
-    case X509_V_ERR_SUITE_B_INVALID_VERSION:
-        return "Suite B: certificate version invalid";
-    case X509_V_ERR_SUITE_B_INVALID_ALGORITHM:
-        return "Suite B: invalid public key algorithm";
-    case X509_V_ERR_SUITE_B_INVALID_CURVE:
-        return "Suite B: invalid ECC curve";
-    case X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM:
-        return "Suite B: invalid signature algorithm";
-    case X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED:
-        return "Suite B: curve not allowed for this LOS";
-    case X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256:
-        return "Suite B: cannot sign P-384 with P-256";
+      return "CRL path validation error";
 
     case X509_V_ERR_HOSTNAME_MISMATCH:
-        return "Hostname mismatch";
+      return "Hostname mismatch";
     case X509_V_ERR_EMAIL_MISMATCH:
-        return "Email address mismatch";
+      return "Email address mismatch";
     case X509_V_ERR_IP_ADDRESS_MISMATCH:
-        return "IP address mismatch";
+      return "IP address mismatch";
 
     case X509_V_ERR_INVALID_CALL:
-        return "Invalid certificate verification context";
+      return "Invalid certificate verification context";
     case X509_V_ERR_STORE_LOOKUP:
-        return "Issuer certificate lookup error";
+      return "Issuer certificate lookup error";
 
     case X509_V_ERR_NAME_CONSTRAINTS_WITHOUT_SANS:
-        return "Issuer has name constraints but leaf has no SANs";
+      return "Issuer has name constraints but leaf has no SANs";
 
     default:
-        return "unknown certificate verification error";
-    }
+      return "unknown certificate verification error";
+  }
 }