If the server's CertificateRequest message contains an empty...

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 95 matching lines @@
  public:
   NSSSSLInitSingleton() {
     base::EnsureNSSInit();
 
     NSS_SetDomesticPolicy();
 
 #if defined(USE_SYSTEM_SSL)
     // Use late binding to avoid scary but benign warning
     // "Symbol `SSL_ImplementedCiphers' has different size in shared object,
     //  consider re-linking"
+    // TODO(wtc): Use the new SSL_GetImplementedCiphers and
+    // SSL_GetNumImplementedCiphers functions when we require NSS 3.12.6.
+    // See https://bugzilla.mozilla.org/show_bug.cgi?id=496993.
     const PRUint16* pSSL_ImplementedCiphers = static_cast<const PRUint16*>(
         dlsym(RTLD_DEFAULT, "SSL_ImplementedCiphers"));
     if (pSSL_ImplementedCiphers == NULL) {
       NOTREACHED() << "Can't get list of supported ciphers";
       return;
     }
 #else
 #define pSSL_ImplementedCiphers SSL_ImplementedCiphers
 #endif
 
@@ skipping 44 matching lines @@
     case PR_CONNECT_ABORTED_ERROR:
       return ERR_CONNECTION_ABORTED;
     case PR_CONNECT_REFUSED_ERROR:
       return ERR_CONNECTION_REFUSED;
     case PR_HOST_UNREACHABLE_ERROR:
     case PR_NETWORK_UNREACHABLE_ERROR:
       return ERR_ADDRESS_UNREACHABLE;
     case PR_ADDRESS_NOT_AVAILABLE_ERROR:
       return ERR_ADDRESS_INVALID;
 
+    case SSL_ERROR_SSL_DISABLED:
+      return ERR_NO_SSL_VERSIONS_ENABLED;
     case SSL_ERROR_NO_CYPHER_OVERLAP:
     case SSL_ERROR_UNSUPPORTED_VERSION:
       return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;
     case SSL_ERROR_HANDSHAKE_FAILURE_ALERT:
+    case SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT:
+    case SSL_ERROR_ILLEGAL_PARAMETER_ALERT:
       return ERR_SSL_PROTOCOL_ERROR;
 
     default: {
       if (IS_SSL_ERROR(err)) {
         LOG(WARNING) << "Unknown SSL error " << err <<
             " mapped to net::ERR_SSL_PROTOCOL_ERROR";
         return ERR_SSL_PROTOCOL_ERROR;
       }
       LOG(WARNING) << "Unknown error " << err <<
           " mapped to net::ERR_FAILED";
@@ skipping 693 matching lines @@
     case ERR_CONNECTION_RESET:
       return PR_CONNECT_RESET_ERROR;
     case ERR_CONNECTION_ABORTED:
       return PR_CONNECT_ABORTED_ERROR;
     case ERR_CONNECTION_REFUSED:
       return PR_CONNECT_REFUSED_ERROR;
     case ERR_ADDRESS_UNREACHABLE:
       return PR_HOST_UNREACHABLE_ERROR;  // Also PR_NETWORK_UNREACHABLE_ERROR.
     case ERR_ADDRESS_INVALID:
       return PR_ADDRESS_NOT_AVAILABLE_ERROR;
+    case ERR_NAME_NOT_RESOLVED:
+      return PR_DIRECTORY_LOOKUP_ERROR;
     default:
       LOG(WARNING) << "MapErrorToNSS " << result
                    << " mapped to PR_UNKNOWN_ERROR";
       return PR_UNKNOWN_ERROR;
   }
 }
 
 // Do network I/O between the given buffer and the given socket.
 // Return true if some I/O performed, false otherwise (error or ERR_IO_PENDING)
 bool SSLClientSocketNSS::DoTransportIO() {
@@ skipping 309 matching lines @@
       CERT_GetDefaultCertDB(), SEC_CERT_NICKNAMES_USER, wincx);
   if (names) {
     for (int i = 0; i < names->numnicknames; ++i) {
       cert = CERT_FindUserCertByUsage(
           CERT_GetDefaultCertDB(), names->nicknames[i],
           certUsageSSLClient, PR_FALSE, wincx);
       if (!cert)
         continue;
       // Only check unexpired certs.
       if (CERT_CheckCertValidTimes(cert, PR_Now(), PR_TRUE) ==
-          secCertTimeValid &&
-          NSS_CmpCertChainWCANames(cert, ca_names) == SECSuccess) {
+          secCertTimeValid && (!ca_names->nnames ||
+          NSS_CmpCertChainWCANames(cert, ca_names) == SECSuccess)) {
         privkey = PK11_FindKeyByAnyCert(cert, wincx);
         if (privkey) {
           X509Certificate* x509_cert = X509Certificate::CreateFromHandle(
               cert, X509Certificate::SOURCE_LONE_CERT_IMPORT,
               net::X509Certificate::OSCertHandles());
           that->client_certs_.push_back(x509_cert);
           SECKEY_DestroyPrivateKey(privkey);
           continue;
         }
       }
@@ skipping 177 matching lines @@
   EnterFunction(user_write_buf_len_);
   DCHECK(user_write_buf_);
   int rv = PR_Write(nss_fd_, user_write_buf_->data(), user_write_buf_len_);
   if (rv >= 0) {
     LogData(user_write_buf_->data(), rv);
     LeaveFunction("");
     return rv;
   }
   PRErrorCode prerr = PR_GetError();
   if (prerr == PR_WOULD_BLOCK_ERROR) {
+    LeaveFunction("");
     return ERR_IO_PENDING;
   }
   LeaveFunction("");
   return MapNSPRError(prerr);
 }
 
 }  // namespace net