Repository: envoyproxy/envoy
File: source/common/tls/cert_validator/default_validator.cc (C++)

Code before:

  // If `trusted_ca` exists, it is already verified in the code above. Thus, we just need to make
  // sure the verification for other validation context configurations doesn't fail (i.e. either
  // `NotValidated` or `Validated`). If `trusted_ca` doesn't exist, we will need to make sure
  // other configurations are verified and the verification succeed.
  const bool success = verify_trusted_ca_
                           ? validated != Envoy::Ssl::ClientValidationStatus::Failed
                           : validated == Envoy::Ssl::ClientValidationStatus::Validated;

  return (allow_untrusted_certificate_ || success);
}

Envoy::Ssl::ClientValidationStatus
DefaultCertValidator::verifyCertificate(X509* cert, const std::vector<std::string>& verify_san_list,
                                        const std::vector<SanMatcherPtr>& subject_alt_name_matchers,
                                        OptRef<const StreamInfo::StreamInfo> stream_info,
                                        std::string* error_details, uint8_t* out_alert) {
  Envoy::Ssl::ClientValidationStatus validated = Envoy::Ssl::ClientValidationStatus::NotValidated;
  if (!verify_san_list.empty()) {
    if (!verifySubjectAltName(cert, verify_san_list)) {
      const std::string error_msg =
          fmt::format("verify cert failed: verify SAN list, SAN List is [{}]",
                      fmt::join(verify_san_list, ", "));

      if (error_details != nullptr) {
        *error_details = error_msg.c_str();
      }
      ENVOY_LOG(debug, error_msg.c_str());
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }
    validated = Envoy::Ssl::ClientValidationStatus::Validated;
  }

  if (!subject_alt_name_matchers.empty()) {
    if (!matchSubjectAltName(cert, stream_info, subject_alt_name_matchers)) {
      const char* error = "verify cert failed: SAN matcher";
      if (error_details != nullptr) {
        *error_details = error;
      }
      ENVOY_LOG(debug, error);
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }
    validated = Envoy::Ssl::ClientValidationStatus::Validated;
  }

  if (!verify_certificate_hash_list_.empty() || !verify_certificate_spki_list_.empty()) {
    const bool valid_certificate_hash =
        !verify_certificate_hash_list_.empty() &&
        verifyCertificateHashList(cert, verify_certificate_hash_list_);

Review comment (suggestion):
```suggestion
        *error_details = error_msg;
```

Code after:

  // If `trusted_ca` exists, it is already verified in the code above. Thus, we just need to make
  // sure the verification for other validation context configurations doesn't fail (i.e. either
  // `NotValidated` or `Validated`). If `trusted_ca` doesn't exist, we will need to make sure
  // other configurations are verified and the verification succeed.
  const bool success = verify_trusted_ca_
                           ? validated != Envoy::Ssl::ClientValidationStatus::Failed
                           : validated == Envoy::Ssl::ClientValidationStatus::Validated;

  return (allow_untrusted_certificate_ || success);
}

Envoy::Ssl::ClientValidationStatus
DefaultCertValidator::verifyCertificate(X509* cert, const std::vector<std::string>& verify_san_list,
                                        const std::vector<SanMatcherPtr>& subject_alt_name_matchers,
                                        OptRef<const StreamInfo::StreamInfo> stream_info,
                                        std::string* error_details, uint8_t* out_alert) {
  Envoy::Ssl::ClientValidationStatus validated = Envoy::Ssl::ClientValidationStatus::NotValidated;
  if (!verify_san_list.empty()) {
    if (!verifySubjectAltName(cert, verify_san_list)) {
      const std::string error_msg = fmt::format(
          "verify cert failed: verify SAN list, expected SANs: [{}], certificate SANs: [{}]",
          fmt::join(verify_san_list, ", "),
          fmt::join(Utility::getCertificateSansForLogging(cert), ", "));

      if (error_details != nullptr) {
        *error_details = error_msg;
      }
      ENVOY_LOG(debug, error_msg);
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }
    validated = Envoy::Ssl::ClientValidationStatus::Validated;
  }

  if (!subject_alt_name_matchers.empty()) {
    if (!matchSubjectAltName(cert, stream_info, subject_alt_name_matchers)) {
      const std::string error_msg =
          fmt::format("verify cert failed: SAN matcher, certificate SANs are [{}]",
                      fmt::join(Utility::getCertificateSansForLogging(cert), ", "));
      if (error_details != nullptr) {
        *error_details = error_msg;
      }
      ENVOY_LOG(debug, error_msg);
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }
    validated = Envoy::Ssl::ClientValidationStatus::Validated;
  }

  if (!verify_certificate_hash_list_.empty() || !verify_certificate_spki_list_.empty()) {