diff options
| author | wtc@chromium.org <wtc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-02-25 23:27:31 +0000 |
|---|---|---|
| committer | wtc@chromium.org <wtc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-02-25 23:27:31 +0000 |
| commit | 995403c8020b1dc23e57e4ebad8d4f5eb937e40e (patch) | |
| tree | c33dbfb1a6942ca9911f779d13f2a41b432e5296 | |
| parent | 45965de15b7d03722dc2e9cd81edcb7ad7b8d7f2 (diff) | |
| download | chromium_src-995403c8020b1dc23e57e4ebad8d4f5eb937e40e.zip chromium_src-995403c8020b1dc23e57e4ebad8d4f5eb937e40e.tar.gz chromium_src-995403c8020b1dc23e57e4ebad8d4f5eb937e40e.tar.bz2 | |
Handle the TLS no_renegotiation alert message.
R=agl
BUG=36835
TEST=Visit https://ssltls.de:1445/otherciphers/ffs.jpg on
Windows. The error page should display the error code
ERR_SSL_NO_RENEGOTIATION instead of ERR_FAILED.
Review URL: http://codereview.chromium.org/652007
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@40067 0039d316-1c4b-4281-b951-d872f2087c98
| -rw-r--r-- | net/base/net_error_list.h | 3 | ||||
| -rw-r--r-- | net/socket/ssl_client_socket_win.cc | 8 |
2 files changed, 11 insertions, 0 deletions
diff --git a/net/base/net_error_list.h b/net/base/net_error_list.h index db94f69..b79658c 100644 --- a/net/base/net_error_list.h +++ b/net/base/net_error_list.h @@ -137,6 +137,9 @@ NET_ERROR(SOCKS_CONNECTION_HOST_UNREACHABLE, -121) // There is no more data left in the logical stream. NET_ERROR(END_OF_STREAM, -122) +// The peer sent an SSL no_renegotiation alert message. +NET_ERROR(SSL_NO_RENEGOTIATION, -123) + // Certificate error codes // // The values of certificate error codes must be consecutive. diff --git a/net/socket/ssl_client_socket_win.cc b/net/socket/ssl_client_socket_win.cc index 5acfa0f..5d464b5 100644 --- a/net/socket/ssl_client_socket_win.cc +++ b/net/socket/ssl_client_socket_win.cc @@ -58,6 +58,7 @@ static int MapSecurityError(SECURITY_STATUS err) { case SEC_E_ALGORITHM_MISMATCH: return ERR_SSL_VERSION_OR_CIPHER_MISMATCH; case SEC_E_INVALID_HANDLE: + case SEC_E_INVALID_TOKEN: return ERR_UNEXPECTED; case SEC_E_OK: return OK; @@ -882,6 +883,13 @@ int SSLClientSocketWin::DidCallInitializeSecurityContext() { if (isc_status_ == SEC_I_INCOMPLETE_CREDENTIALS) return ERR_SSL_CLIENT_AUTH_CERT_NEEDED; + if (isc_status_ == SEC_I_NO_RENEGOTIATION) { + // Received a no_renegotiation alert message. Although this is just a + // warning, SChannel doesn't seem to allow us to continue after this + // point, so we have to return an error. See http://crbug.com/36835. + return ERR_SSL_NO_RENEGOTIATION; + } + DCHECK(isc_status_ == SEC_I_CONTINUE_NEEDED); if (in_buffers_[1].BufferType == SECBUFFER_EXTRA) { memmove(recv_buffer_.get(), |