Roll src/third_party/boringssl/src be2ee342d..a58baaf9e

net/ssl/openssl_ssl_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/openssl_ssl_util.h"
 
 #include <errno.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 78 matching lines @@
     case SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE:
       return ERR_SSL_DECOMPRESSION_FAILURE_ALERT;
     case SSL_R_SSLV3_ALERT_BAD_RECORD_MAC:
       return ERR_SSL_BAD_RECORD_MAC_ALERT;
     case SSL_R_TLSV1_ALERT_DECRYPT_ERROR:
       return ERR_SSL_DECRYPT_ERROR_ALERT;
     case SSL_R_TLSV1_UNRECOGNIZED_NAME:
       return ERR_SSL_UNRECOGNIZED_NAME_ALERT;
     case SSL_R_BAD_DH_P_LENGTH:
       return ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY;
+    case SSL_R_SERVER_CERT_CHANGED:
+      return ERR_SSL_SERVER_CERT_CHANGED;
     case SSL_R_CERTIFICATE_VERIFY_FAILED:
       // The only way that the certificate verify callback can fail is if
       // the leaf certificate changed during a renegotiation.
+      //
+      // TODO(davidben): This check has since moved within BoringSSL. Remove the
+      // Chromium-side machinery for it.
       return ERR_SSL_SERVER_CERT_CHANGED;
     // SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE may be returned from the server after
     // receiving ClientHello if there's no common supported cipher. Map that
     // specific case to ERR_SSL_VERSION_OR_CIPHER_MISMATCH to match the NSS
     // implementation. See https://goo.gl/oMtZW and https://crbug.com/446505.
     case SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE: {
       uint32_t previous = ERR_peek_error();
       if (previous != 0 && ERR_GET_LIB(previous) == ERR_LIB_SSL &&
           ERR_GET_REASON(previous) == SSL_R_HANDSHAKE_FAILURE_ON_CLIENT_HELLO) {
         return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;
@@ skipping 129 matching lines @@
   for (size_t i = 0; i < os_handles.size(); i++) {
     bssl::UniquePtr<X509> x509 = OSCertHandleToOpenSSL(os_handles[i]);
     if (!x509)
       return nullptr;
     sk_X509_push(stack.get(), x509.release());
   }
   return stack;
 }
 
 }  // namespace net