Some error codes unhandled in mbedtls_strerror

[maxgerhardt-phy]

Suggested enhancement

The entire set of MBEDTLS_ERR_PK_ error codes seem to go completely unhandled in mbedtls_strerror(), specifically mbedtls_high_level_strerr().

It is easy to get one though, e.g., through

int ret = mbedtls_x509_crt_parse_file(&srv_cert, config->server_cert_file);
if (ret != 0) {
  char error_buf[128];
  mbedtls_strerror(ret, error_buf, sizeof(error_buf));
  puts(error_buf);
}

Returns MBEDTLS_ERR_PK_FILE_IO_ERROR (-0x3e00) when the file doesn't exist. Feeding that into mbedtls_strerror() returns an "error message" of

UNKNOWN ERROR CODE (3E00)

Not helpful at all.

Justification

Mbed TLS needs this because all MBEDTLS_ERR_ codes that have a numerical value should be meaningfully decoded by mbedtls_strerror(). That's even what #9925 says.

[abtom87]

@minosgalanakis @maxgerhardt-phy Opened #10782 to address this.

[maxgerhardt-phy]

I've just ran into this again where the result for a mbedtls_ssl_context_save() was returned as -135 and it output

ERROR Serializing session (session_save) failed: -0x87 (-135): UNKNOWN ERROR CODE (0080) : HMAC_DRBG - Read/write error in file

While the actual meaning is

https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/c35df962041731b08c6ff6a39a59e239c344e1ee/include/psa/crypto_values.h#L138

Do the error codes overlap for HMAC and PSA_ERROR?

[abtom87]

@maxgerhardt-phy The root cause is that error.c's lookup logic only handles composite codes in the 0x0000-0x0080 (low-level) and 0x0000-0xFF00 (high-level) ranges. 0x0087 falls outside the low-level range, but the masking (& ~0xFF80) doesn't detect that. It just strips the high bits and silently produces 0x0007, which collides with MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR. Some pkcs7.h codes no longer fit that scheme at all:

#define MBEDTLS_ERR_PKCS7_BAD_INPUT_DATA    PSA_ERROR_INVALID_ARGUMENT
#define MBEDTLS_ERR_PKCS7_ALLOC_FAILED      PSA_ERROR_INSUFFICIENT_MEMORY
#define MBEDTLS_ERR_PKCS7_VERIFY_FAIL       PSA_ERROR_INVALID_SIGNATURE

These are aliases of PSA_ERROR_* values rather than hex literals, so generate_errors.pl's regex doesn't match them, and they never make it into error.c. By contrast, the other pkcs7.h codes (MBEDTLS_ERR_PKCS7_INVALID_FORMAT, MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE, MBEDTLS_ERR_PKCS7_INVALID_VERSION, etc.) are still plain hex literals, so they show up fine.
I'd treat this as a separate issue from the MBEDTLS_ERR_PK_* one, since it likely needs a maintainer decision on how PSA-aliased codes should be surfaced through mbedtls_strerror(). I would wait for a maintainer's response, since I am a brand-new contributor. :)

Could you confirm whether my patch resolves the original MBEDTLS_ERR_PK_* issue? I've verified the codes appear in my generated error.c.