code review 9736043: crypto/x509: harmonise error prefixes.

src/pkg/crypto/x509/x509.go

 // Copyright 2009 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 // Package x509 parses X.509-encoded keys and certificates.
 package x509
 
 import (
         "bytes"
         "crypto"
@@ skipping 22 matching lines @@
 
 // ParsePKIXPublicKey parses a DER encoded public key. These values are
 // typically found in PEM blocks with "BEGIN PUBLIC KEY".
 func ParsePKIXPublicKey(derBytes []byte) (pub interface{}, err error) {
         var pki publicKeyInfo
         if _, err = asn1.Unmarshal(derBytes, &pki); err != nil {
                 return
         }
         algo := getPublicKeyAlgorithmFromOID(pki.Algorithm.Algorithm)
         if algo == UnknownPublicKeyAlgorithm {
-                return nil, errors.New("crypto/x509: unknown public key algorithm")
+                return nil, errors.New("x509: unknown public key algorithm")
         }
         return parsePublicKey(algo, &pki)
 }
 
 // MarshalPKIXPublicKey serialises a public key to DER-encoded PKIX format.
 func MarshalPKIXPublicKey(pub interface{}) ([]byte, error) {
         var pubBytes []byte
 
         switch pub := pub.(type) {
         case *rsa.PublicKey:
                 pubBytes, _ = asn1.Marshal(rsaPublicKey{
                         N: pub.N,
                         E: pub.E,
                 })
         default:
-                return nil, errors.New("crypto/x509: unknown public key type")
+                return nil, errors.New("x509: unknown public key type")
         }
 
         pkix := pkixPublicKey{
                 Algo: pkix.AlgorithmIdentifier{
                         Algorithm: []int{1, 2, 840, 113549, 1, 1, 1},
                         // This is a NULL parameters value which is technically
                         // superfluous, but most other code includes it and, by
                         // doing this, we match their public key hashes.
                         Parameters: asn1.RawValue{
                                 Tag: 5,
@@ skipping 400 matching lines @@
 
         // Name constraints
         PermittedDNSDomainsCritical bool // if true then the name constraints are marked critical.
         PermittedDNSDomains         []string
 
         PolicyIdentifiers []asn1.ObjectIdentifier
 }
 
 // ErrUnsupportedAlgorithm results from attempting to perform an operation that
 // involves algorithms that are not currently implemented.
-var ErrUnsupportedAlgorithm = errors.New("crypto/x509: cannot verify signature: algorithm unimplemented")
+var ErrUnsupportedAlgorithm = errors.New("x509: cannot verify signature: algorithm unimplemented")
 
 // ConstraintViolationError results when a requested usage is not permitted by
 // a certificate. For example: checking a signature when the public key isn't a
 // certificate signing key.
 type ConstraintViolationError struct{}
 
 func (ConstraintViolationError) Error() string {
-        return "crypto/x509: invalid signature: parent certificate cannot sign this kind of certificate"
+        return "x509: invalid signature: parent certificate cannot sign this kind of certificate"
 }
 
 func (c *Certificate) Equal(other *Certificate) bool {
         return bytes.Equal(c.Raw, other.Raw)
 }
 
 // Entrust have a broken root certificate (CN=Entrust.net Certification
 // Authority (2048)) which isn't marked as a CA certificate and is thus invalid
 // according to PKIX.
 // We recognise this certificate by its SubjectPublicKeyInfo and exempt it
@@ skipping 98 matching lines @@
 
         switch pub := c.PublicKey.(type) {
         case *rsa.PublicKey:
                 return rsa.VerifyPKCS1v15(pub, hashType, digest, signature)
         case *dsa.PublicKey:
                 dsaSig := new(dsaSignature)
                 if _, err := asn1.Unmarshal(signature, dsaSig); err != nil {
                         return err
                 }
                 if dsaSig.R.Sign() <= 0 || dsaSig.S.Sign() <= 0 {
-                        return errors.New("crypto/x509: DSA signature contained zero or negative values")
+                        return errors.New("x509: DSA signature contained zero or negative values")
                 }
                 if !dsa.Verify(pub, digest, dsaSig.R, dsaSig.S) {
-                        return errors.New("crypto/x509: DSA verification failure")
+                        return errors.New("x509: DSA verification failure")
                 }
                 return
         case *ecdsa.PublicKey:
                 ecdsaSig := new(ecdsaSignature)
                 if _, err := asn1.Unmarshal(signature, ecdsaSig); err != nil {
                         return err
                 }
                 if ecdsaSig.R.Sign() <= 0 || ecdsaSig.S.Sign() <= 0 {
-                        return errors.New("crypto/x509: ECDSA signature contained zero or negative values")
+                        return errors.New("x509: ECDSA signature contained zero or negative values")
                 }
                 if !ecdsa.Verify(pub, digest, ecdsaSig.R, ecdsaSig.S) {
-                        return errors.New("crypto/x509: ECDSA verification failure")
+                        return errors.New("x509: ECDSA verification failure")
                 }
                 return
         }
         return ErrUnsupportedAlgorithm
 }
 
 // CheckCRLSignature checks that the signature in crl is from c.
 func (c *Certificate) CheckCRLSignature(crl *pkix.CertificateList) (err error) {
         algo := getSignatureAlgorithmFromOID(crl.SignatureAlgorithm.Algorithm)
         return c.CheckSignature(algo, crl.TBSCertList.Raw, crl.SignatureValue.RightAlign())
 }
 
 type UnhandledCriticalExtension struct{}
 
 func (h UnhandledCriticalExtension) Error() string {
-        return "crypto/x509: unhandled critical extension"
+        return "x509: unhandled critical extension"
 }
 
 type basicConstraints struct {
         IsCA       bool `asn1:"optional"`
         MaxPathLen int  `asn1:"optional,default:-1"`
 }
 
 // RFC 5280 4.2.1.4
 type policyInformation struct {
         Policy asn1.ObjectIdentifier
@@ skipping 14 matching lines @@
         asn1Data := keyData.PublicKey.RightAlign()
         switch algo {
         case RSA:
                 p := new(rsaPublicKey)
                 _, err := asn1.Unmarshal(asn1Data, p)
                 if err != nil {
                         return nil, err
                 }
 
                 if p.N.Sign() <= 0 {
-                        return nil, errors.New("crypto/x509: RSA modulus is not a positive number")
+                        return nil, errors.New("x509: RSA modulus is not a positive number")
                 }
                 if p.E <= 0 {
-                        return nil, errors.New("crypto/x509: RSA public exponent is not a positive number")
+                        return nil, errors.New("x509: RSA public exponent is not a positive number")
                 }
 
                 pub := &rsa.PublicKey{
                         E: p.E,
                         N: p.N,
                 }
                 return pub, nil
         case DSA:
                 var p *big.Int
                 _, err := asn1.Unmarshal(asn1Data, &p)
                 if err != nil {
                         return nil, err
                 }
                 paramsData := keyData.Algorithm.Parameters.FullBytes
                 params := new(dsaAlgorithmParameters)
                 _, err = asn1.Unmarshal(paramsData, params)
                 if err != nil {
                         return nil, err
                 }
                 if p.Sign() <= 0 || params.P.Sign() <= 0 || params.Q.Sign() <= 0 || params.G.Sign() <= 0 {
-                        return nil, errors.New("crypto/x509: zero or negative DSA parameter")
+                        return nil, errors.New("x509: zero or negative DSA parameter")
                 }
                 pub := &dsa.PublicKey{
                         Parameters: dsa.Parameters{
                                 P: params.P,
                                 Q: params.Q,
                                 G: params.G,
                         },
                         Y: p,
                 }
                 return pub, nil
         case ECDSA:
                 paramsData := keyData.Algorithm.Parameters.FullBytes
                 namedCurveOID := new(asn1.ObjectIdentifier)
                 _, err := asn1.Unmarshal(paramsData, namedCurveOID)
                 if err != nil {
                         return nil, err
                 }
                 namedCurve := namedCurveFromOID(*namedCurveOID)
                 if namedCurve == nil {
-                        return nil, errors.New("crypto/x509: unsupported elliptic curve")
+                        return nil, errors.New("x509: unsupported elliptic curve")
                 }
                 x, y := elliptic.Unmarshal(namedCurve, asn1Data)
                 if x == nil {
-                        return nil, errors.New("crypto/x509: failed to unmarshal elliptic curve point")
+                        return nil, errors.New("x509: failed to unmarshal elliptic curve point")
                 }
                 pub := &ecdsa.PublicKey{
                         Curve: namedCurve,
                         X:     x,
                         Y:     y,
                 }
                 return pub, nil
         default:
                 return nil, nil
         }
@@ skipping 13 matching lines @@
 
         out.PublicKeyAlgorithm =
                 getPublicKeyAlgorithmFromOID(in.TBSCertificate.PublicKey.Algorithm.Algorithm)
         var err error
         out.PublicKey, err = parsePublicKey(out.PublicKeyAlgorithm, &in.TBSCertificate.PublicKey)
         if err != nil {
                 return nil, err
         }
 
         if in.TBSCertificate.SerialNumber.Sign() < 0 {
-                return nil, errors.New("crypto/x509: negative serial number")
+                return nil, errors.New("x509: negative serial number")
         }
 
         out.Version = in.TBSCertificate.Version + 1
         out.SerialNumber = in.TBSCertificate.SerialNumber
 
         var issuer, subject pkix.RDNSequence
         if _, err := asn1.Unmarshal(in.TBSCertificate.Subject.FullBytes, &subject); err != nil {
                 return nil, err
         }
         if _, err := asn1.Unmarshal(in.TBSCertificate.Issuer.FullBytes, &issuer); err != nil {
@@ skipping 75 matching lines @@
                                                 out.EmailAddresses = append(out.EmailAddresses, string(v.Bytes))
                                                 parsedName = true
                                         case 2:
                                                 out.DNSNames = append(out.DNSNames, string(v.Bytes))
                                                 parsedName = true
                                         case 7:
                                                 switch len(v.Bytes) {
                                                 case net.IPv4len, net.IPv6len:
                                                         out.IPAddresses = append(out.IPAddresses, v.Bytes)
                                                 default:
-                                                        return nil, errors.New("crypto/x509: certificate contained IP address of length " + strconv.Itoa(len(v.Bytes)))
+                                                        return nil, errors.New("x509: certificate contained IP address of length " + strconv.Itoa(len(v.Bytes)))
                                                 }
                                         }
                                 }
 
                                 if parsedName {
                                         continue
                                 }
                                 // If we didn't parse any of the names then we
                                 // fall through to the critical check below.
 
@@ skipping 320 matching lines @@
         switch pub := pub.(type) {
         case *rsa.PublicKey:
                 publicKeyBytes, err = asn1.Marshal(rsaPublicKey{
                         N: pub.N,
                         E: pub.E,
                 })
                 publicKeyAlgorithm.Algorithm = oidPublicKeyRSA
         case *ecdsa.PublicKey:
                 oid, ok := oidFromNamedCurve(pub.Curve)
                 if !ok {
-                        return nil, errors.New("crypto/x509: unknown elliptic curve")
+                        return nil, errors.New("x509: unknown elliptic curve")
                 }
                 publicKeyAlgorithm.Algorithm = oidPublicKeyECDSA
                 var paramBytes []byte
                 paramBytes, err = asn1.Marshal(oid)
                 if err != nil {
                         return
                 }
                 publicKeyAlgorithm.Parameters.FullBytes = paramBytes
                 publicKeyBytes = elliptic.Marshal(pub.Curve, pub.X, pub.Y)
         default:
-                return nil, errors.New("crypto/x509: only RSA and ECDSA public keys supported")
+                return nil, errors.New("x509: only RSA and ECDSA public keys supported")
         }
 
         var signatureAlgorithm pkix.AlgorithmIdentifier
         var hashFunc crypto.Hash
 
         switch priv := priv.(type) {
         case *rsa.PrivateKey:
                 signatureAlgorithm.Algorithm = oidSignatureSHA1WithRSA
                 hashFunc = crypto.SHA1
         case *ecdsa.PrivateKey:
                 switch priv.Curve {
                 case elliptic.P224(), elliptic.P256():
                         hashFunc = crypto.SHA256
                         signatureAlgorithm.Algorithm = oidSignatureECDSAWithSHA256
                 case elliptic.P384():
                         hashFunc = crypto.SHA384
                         signatureAlgorithm.Algorithm = oidSignatureECDSAWithSHA384
                 case elliptic.P521():
                         hashFunc = crypto.SHA512
                         signatureAlgorithm.Algorithm = oidSignatureECDSAWithSHA512
                 default:
-                        return nil, errors.New("crypto/x509: unknown elliptic curve")
+                        return nil, errors.New("x509: unknown elliptic curve")
                 }
         default:
-                return nil, errors.New("crypto/x509: only RSA and ECDSA private keys supported")
+                return nil, errors.New("x509: only RSA and ECDSA private keys supported")
         }
 
         if err != nil {
                 return
         }
 
         if len(parent.SubjectKeyId) > 0 {
                 template.AuthorityKeyId = parent.SubjectKeyId
         }
 
@@ skipping 93 matching lines @@
         return
 }
 
 // CreateCRL returns a DER encoded CRL, signed by this Certificate, that
 // contains the given list of revoked certificates.
 //
 // The only supported key type is RSA (*rsa.PrivateKey for priv).
 func (c *Certificate) CreateCRL(rand io.Reader, priv interface{}, revokedCerts []pkix.RevokedCertificate, now, expiry time.Time) (crlBytes []byte, err error) {
         rsaPriv, ok := priv.(*rsa.PrivateKey)
         if !ok {
-                return nil, errors.New("crypto/x509: non-RSA private keys not supported")
+                return nil, errors.New("x509: non-RSA private keys not supported")
         }
         tbsCertList := pkix.TBSCertificateList{
                 Version: 2,
                 Signature: pkix.AlgorithmIdentifier{
                         Algorithm: oidSignatureSHA1WithRSA,
                 },
                 Issuer:              c.Subject.ToRDNSequence(),
                 ThisUpdate:          now.UTC(),
                 NextUpdate:          expiry.UTC(),
                 RevokedCertificates: revokedCerts,
@@ skipping 14 matching lines @@
         }
 
         return asn1.Marshal(pkix.CertificateList{
                 TBSCertList: tbsCertList,
                 SignatureAlgorithm: pkix.AlgorithmIdentifier{
                         Algorithm: oidSignatureSHA1WithRSA,
                 },
                 SignatureValue: asn1.BitString{Bytes: signature, BitLength: len(signature) * 8},
         })
 }