1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
|
// Copyright 2014 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/ssl/openssl_ssl_util.h"
#include <errno.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <utility>
#include "base/bind.h"
#include "base/lazy_instance.h"
#include "base/location.h"
#include "base/logging.h"
#include "base/values.h"
#include "crypto/openssl_util.h"
#include "net/base/net_errors.h"
namespace net {
SslSetClearMask::SslSetClearMask()
: set_mask(0),
clear_mask(0) {
}
void SslSetClearMask::ConfigureFlag(long flag, bool state) {
(state ? set_mask : clear_mask) |= flag;
// Make sure we haven't got any intersection in the set & clear options.
DCHECK_EQ(0, set_mask & clear_mask) << flag << ":" << state;
}
namespace {
class OpenSSLNetErrorLibSingleton {
public:
OpenSSLNetErrorLibSingleton() {
crypto::EnsureOpenSSLInit();
// Allocate a new error library value for inserting net errors into
// OpenSSL. This does not register any ERR_STRING_DATA for the errors, so
// stringifying error codes through OpenSSL will return NULL.
net_error_lib_ = ERR_get_next_error_library();
}
int net_error_lib() const { return net_error_lib_; }
private:
int net_error_lib_;
};
base::LazyInstance<OpenSSLNetErrorLibSingleton>::Leaky g_openssl_net_error_lib =
LAZY_INSTANCE_INITIALIZER;
int OpenSSLNetErrorLib() {
return g_openssl_net_error_lib.Get().net_error_lib();
}
int MapOpenSSLErrorSSL(uint32_t error_code) {
DCHECK_EQ(ERR_LIB_SSL, ERR_GET_LIB(error_code));
DVLOG(1) << "OpenSSL SSL error, reason: " << ERR_GET_REASON(error_code)
<< ", name: " << ERR_error_string(error_code, NULL);
switch (ERR_GET_REASON(error_code)) {
case SSL_R_READ_TIMEOUT_EXPIRED:
return ERR_TIMED_OUT;
case SSL_R_UNKNOWN_CERTIFICATE_TYPE:
case SSL_R_UNKNOWN_CIPHER_TYPE:
case SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE:
case SSL_R_UNKNOWN_SSL_VERSION:
return ERR_NOT_IMPLEMENTED;
case SSL_R_NO_CIPHER_MATCH:
case SSL_R_NO_SHARED_CIPHER:
case SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY:
case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION:
case SSL_R_UNSUPPORTED_PROTOCOL:
return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;
case SSL_R_SSLV3_ALERT_BAD_CERTIFICATE:
case SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE:
case SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED:
case SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED:
case SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN:
case SSL_R_TLSV1_ALERT_ACCESS_DENIED:
case SSL_R_TLSV1_ALERT_UNKNOWN_CA:
return ERR_BAD_SSL_CLIENT_AUTH_CERT;
case SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE:
return ERR_SSL_DECOMPRESSION_FAILURE_ALERT;
case SSL_R_SSLV3_ALERT_BAD_RECORD_MAC:
return ERR_SSL_BAD_RECORD_MAC_ALERT;
case SSL_R_TLSV1_ALERT_DECRYPT_ERROR:
return ERR_SSL_DECRYPT_ERROR_ALERT;
case SSL_R_TLSV1_UNRECOGNIZED_NAME:
return ERR_SSL_UNRECOGNIZED_NAME_ALERT;
case SSL_R_BAD_DH_P_LENGTH:
return ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY;
case SSL_R_CERTIFICATE_VERIFY_FAILED:
// The only way that the certificate verify callback can fail is if
// the leaf certificate changed during a renegotiation.
return ERR_SSL_SERVER_CERT_CHANGED;
case SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK:
return ERR_SSL_INAPPROPRIATE_FALLBACK;
// SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE may be returned from the server after
// receiving ClientHello if there's no common supported cipher. Map that
// specific case to ERR_SSL_VERSION_OR_CIPHER_MISMATCH to match the NSS
// implementation. See https://goo.gl/oMtZW and https://crbug.com/446505.
case SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE: {
uint32_t previous = ERR_peek_error();
if (previous != 0 && ERR_GET_LIB(previous) == ERR_LIB_SSL &&
ERR_GET_REASON(previous) == SSL_R_HANDSHAKE_FAILURE_ON_CLIENT_HELLO) {
return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;
}
return ERR_SSL_PROTOCOL_ERROR;
}
default:
return ERR_SSL_PROTOCOL_ERROR;
}
}
scoped_ptr<base::Value> NetLogOpenSSLErrorCallback(
int net_error,
int ssl_error,
const OpenSSLErrorInfo& error_info,
NetLogCaptureMode /* capture_mode */) {
scoped_ptr<base::DictionaryValue> dict(new base::DictionaryValue());
dict->SetInteger("net_error", net_error);
dict->SetInteger("ssl_error", ssl_error);
if (error_info.error_code != 0) {
dict->SetInteger("error_lib", ERR_GET_LIB(error_info.error_code));
dict->SetInteger("error_reason", ERR_GET_REASON(error_info.error_code));
}
if (error_info.file != NULL)
dict->SetString("file", error_info.file);
if (error_info.line != 0)
dict->SetInteger("line", error_info.line);
return std::move(dict);
}
} // namespace
void OpenSSLPutNetError(const tracked_objects::Location& location, int err) {
// Net error codes are negative. Encode them as positive numbers.
err = -err;
if (err < 0 || err > 0xfff) {
// OpenSSL reserves 12 bits for the reason code.
NOTREACHED();
err = ERR_INVALID_ARGUMENT;
}
ERR_put_error(OpenSSLNetErrorLib(), 0 /* unused */, err, location.file_name(),
location.line_number());
}
int MapOpenSSLError(int err, const crypto::OpenSSLErrStackTracer& tracer) {
OpenSSLErrorInfo error_info;
return MapOpenSSLErrorWithDetails(err, tracer, &error_info);
}
int MapOpenSSLErrorWithDetails(int err,
const crypto::OpenSSLErrStackTracer& tracer,
OpenSSLErrorInfo* out_error_info) {
*out_error_info = OpenSSLErrorInfo();
switch (err) {
case SSL_ERROR_WANT_READ:
case SSL_ERROR_WANT_WRITE:
return ERR_IO_PENDING;
case SSL_ERROR_SYSCALL:
LOG(ERROR) << "OpenSSL SYSCALL error, earliest error code in "
"error queue: " << ERR_peek_error() << ", errno: "
<< errno;
return ERR_FAILED;
case SSL_ERROR_SSL:
// Walk down the error stack to find an SSL or net error.
uint32_t error_code;
const char* file;
int line;
do {
error_code = ERR_get_error_line(&file, &line);
if (ERR_GET_LIB(error_code) == ERR_LIB_SSL) {
out_error_info->error_code = error_code;
out_error_info->file = file;
out_error_info->line = line;
return MapOpenSSLErrorSSL(error_code);
} else if (ERR_GET_LIB(error_code) == OpenSSLNetErrorLib()) {
out_error_info->error_code = error_code;
out_error_info->file = file;
out_error_info->line = line;
// Net error codes are negative but encoded in OpenSSL as positive
// numbers.
return -ERR_GET_REASON(error_code);
}
} while (error_code != 0);
return ERR_FAILED;
default:
// TODO(joth): Implement full mapping.
LOG(WARNING) << "Unknown OpenSSL error " << err;
return ERR_SSL_PROTOCOL_ERROR;
}
}
NetLog::ParametersCallback CreateNetLogOpenSSLErrorCallback(
int net_error,
int ssl_error,
const OpenSSLErrorInfo& error_info) {
return base::Bind(&NetLogOpenSSLErrorCallback,
net_error, ssl_error, error_info);
}
} // namespace net
|
