diff options
| author | wtc@chromium.org <wtc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-03-05 22:00:24 +0000 |
|---|---|---|
| committer | wtc@chromium.org <wtc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-03-05 22:00:24 +0000 |
| commit | f6ee0a018e7b1f4ff5e63da7e8c388041acad2c3 (patch) | |
| tree | 53851346eeda1dec85690dc65039a4c9045818a2 /net/socket/ssl_client_socket_nss.cc | |
| parent | 246a7045b9c45620fd725210aac51322e611c83f (diff) | |
| download | chromium_src-f6ee0a018e7b1f4ff5e63da7e8c388041acad2c3.zip chromium_src-f6ee0a018e7b1f4ff5e63da7e8c388041acad2c3.tar.gz chromium_src-f6ee0a018e7b1f4ff5e63da7e8c388041acad2c3.tar.bz2 | |
SSLClientSocketNSS::ClientAuthHandler should return SECWouldBlock
instead of SECFailure when we want to abort the handshake, because
SECWouldBlock causes NSS to suspend the client authentication,
whereas SECFailure causes NSS to continue the handshake with an
empty certificate (in TLS) or no_certificate alert (in SSL 3.0).
R=agl
BUG=16830
TEST=SSL client authentication on Linux should still work.
Review URL: http://codereview.chromium.org/669198
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@40785 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net/socket/ssl_client_socket_nss.cc')
| -rw-r--r-- | net/socket/ssl_client_socket_nss.cc | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc index 52dc09e..994f1f3 100644 --- a/net/socket/ssl_client_socket_nss.cc +++ b/net/socket/ssl_client_socket_nss.cc @@ -1150,7 +1150,9 @@ SECStatus SSLClientSocketNSS::ClientAuthHandler( CERT_FreeNicknames(names); } - return SECFailure; + // Tell NSS to suspend the client authentication. We will then abort the + // handshake by returning ERR_SSL_CLIENT_AUTH_CERT_NEEDED. + return SECWouldBlock; #endif } @@ -1286,7 +1288,7 @@ int SSLClientSocketNSS::DoVerifyCertComplete(int result) { } completed_handshake_ = true; - // TODO(ukai): we may not need this call because it is now harmless to have an + // TODO(ukai): we may not need this call because it is now harmless to have a // session with a bad cert. InvalidateSessionIfBadCertificate(); // Exit DoHandshakeLoop and return the result to the caller to Connect. |