net/socket/openssl_util.cc - Issue 274783002: Implement SSL server socket over OpenSSL.

Side by Side Diff: net/socket/openssl_util.cc

Issue 274783002: Implement SSL server socket over OpenSSL. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Created 6 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 // Copyright (c) 2014 The Chromium Authors. All rights reserved.

	2 // Use of this source code is governed by a BSD-style license that can be

	3 // found in the LICENSE file.

	4

	5 #include "net/socket/openssl_util.h"

	6

	7 #include <openssl/err.h>

	8 #include <openssl/ssl.h>

	9

	10 #include "base/logging.h"

	11 #include "crypto/openssl_util.h"

	12 #include "net/base/net_errors.h"

	13

	14 namespace net {

	15

	16 namespace {

	17

	18 int MapOpenSSLErrorSSL() {

	19 // Walk down the error stack to find the SSLerr generated reason.

	20 unsigned long error_code;

	21 do {

	22 error_code = ERR_get_error();

	23 if (error_code == 0)

	24 return ERR_SSL_PROTOCOL_ERROR;

	25 } while (ERR_GET_LIB(error_code) != ERR_LIB_SSL);

	26

	27 DVLOG(1) << "OpenSSL SSL error, reason: " << ERR_GET_REASON(error_code)

	28 << ", name: " << ERR_error_string(error_code, NULL);

	29 switch (ERR_GET_REASON(error_code)) {

	30 case SSL_R_READ_TIMEOUT_EXPIRED:

	31 return ERR_TIMED_OUT;

	32 case SSL_R_BAD_RESPONSE_ARGUMENT:

	33 return ERR_INVALID_ARGUMENT;

	34 case SSL_R_UNKNOWN_CERTIFICATE_TYPE:

	35 case SSL_R_UNKNOWN_CIPHER_TYPE:

	36 case SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE:

	37 case SSL_R_UNKNOWN_PKEY_TYPE:

	38 case SSL_R_UNKNOWN_REMOTE_ERROR_TYPE:

	39 case SSL_R_UNKNOWN_SSL_VERSION:

	40 return ERR_NOT_IMPLEMENTED;

	41 case SSL_R_UNSUPPORTED_SSL_VERSION:

	42 case SSL_R_NO_CIPHER_MATCH:

	43 case SSL_R_NO_SHARED_CIPHER:

	44 case SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY:

	45 case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION:

	46 case SSL_R_UNSUPPORTED_PROTOCOL:

	47 return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;

	48 case SSL_R_SSLV3_ALERT_BAD_CERTIFICATE:

	49 case SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE:

	50 case SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED:

	51 case SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED:

	52 case SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN:

	53 case SSL_R_TLSV1_ALERT_ACCESS_DENIED:

	54 case SSL_R_TLSV1_ALERT_UNKNOWN_CA:

	55 return ERR_BAD_SSL_CLIENT_AUTH_CERT;

	56 case SSL_R_BAD_DECOMPRESSION:

	57 case SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE:

	58 return ERR_SSL_DECOMPRESSION_FAILURE_ALERT;

	59 case SSL_R_SSLV3_ALERT_BAD_RECORD_MAC:

	60 return ERR_SSL_BAD_RECORD_MAC_ALERT;

	61 case SSL_R_TLSV1_ALERT_DECRYPT_ERROR:

	62 return ERR_SSL_DECRYPT_ERROR_ALERT;

	63 case SSL_R_TLSV1_UNRECOGNIZED_NAME:

	64 return ERR_SSL_UNRECOGNIZED_NAME_ALERT;

	65 case SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED:

	66 return ERR_SSL_UNSAFE_NEGOTIATION;

	67 case SSL_R_WRONG_NUMBER_OF_KEY_BITS:

	68 return ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY;

	69 // SSL_R_UNKNOWN_PROTOCOL is reported if premature application data is

	70 // received (see http://crbug.com/42538), and also if all the protocol

	71 // versions supported by the server were disabled in this socket instance.

	72 // Mapped to ERR_SSL_PROTOCOL_ERROR for compatibility with other SSL sockets

	73 // in the former scenario.

	74 case SSL_R_UNKNOWN_PROTOCOL:

	75 case SSL_R_SSL_HANDSHAKE_FAILURE:

	76 case SSL_R_DECRYPTION_FAILED:

	77 case SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC:

	78 case SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG:

	79 case SSL_R_DIGEST_CHECK_FAILED:

	80 case SSL_R_DUPLICATE_COMPRESSION_ID:

	81 case SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER:

	82 case SSL_R_ENCRYPTED_LENGTH_TOO_LONG:

	83 case SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST:

	84 case SSL_R_EXCESSIVE_MESSAGE_SIZE:

	85 case SSL_R_EXTRA_DATA_IN_MESSAGE:

	86 case SSL_R_GOT_A_FIN_BEFORE_A_CCS:

	87 case SSL_R_ILLEGAL_PADDING:

	88 case SSL_R_INVALID_CHALLENGE_LENGTH:

	89 case SSL_R_INVALID_COMMAND:

	90 case SSL_R_INVALID_PURPOSE:

	91 case SSL_R_INVALID_STATUS_RESPONSE:

	92 case SSL_R_INVALID_TICKET_KEYS_LENGTH:

	93 case SSL_R_KEY_ARG_TOO_LONG:

	94 case SSL_R_READ_WRONG_PACKET_TYPE:

	95 // SSL_do_handshake reports this error when the server responds to a

	96 // ClientHello with a fatal close_notify alert.

	97 case SSL_AD_REASON_OFFSET + SSL_AD_CLOSE_NOTIFY:

	98 case SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE:

	99 // TODO(joth): SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE may be returned from the

	100 // server after receiving ClientHello if there's no common supported cipher.

	101 // Ideally we'd map that specific case to ERR_SSL_VERSION_OR_CIPHER_MISMATCH

	102 // to match the NSS implementation. See also http://goo.gl/oMtZW

	103 case SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE:

	104 case SSL_R_SSLV3_ALERT_NO_CERTIFICATE:

	105 case SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER:

	106 case SSL_R_TLSV1_ALERT_DECODE_ERROR:

	107 case SSL_R_TLSV1_ALERT_DECRYPTION_FAILED:

	108 case SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION:

	109 case SSL_R_TLSV1_ALERT_INTERNAL_ERROR:

	110 case SSL_R_TLSV1_ALERT_NO_RENEGOTIATION:

	111 case SSL_R_TLSV1_ALERT_RECORD_OVERFLOW:

	112 case SSL_R_TLSV1_ALERT_USER_CANCELLED:

	113 return ERR_SSL_PROTOCOL_ERROR;

	114 case SSL_R_CERTIFICATE_VERIFY_FAILED:

	115 // The only way that the certificate verify callback can fail is if

	116 // the leaf certificate changed during a renegotiation.

	117 return ERR_SSL_SERVER_CERT_CHANGED;

	118 default:

	119 LOG(WARNING) << "Unmapped error reason: " << ERR_GET_REASON(error_code);

	120 return ERR_FAILED;

	121 }

	122 }

	123

	124 } // namespace

	125

	126 // Converts an OpenSSL error code into a net error code, walking the OpenSSL

	127 // error stack if needed. Note that \|tracer\| is not currently used in the

	128 // implementation, but is passed in anyway as this ensures the caller will clear

	129 // any residual codes left on the error stack.
	Ryan Sleevi 2014/05/12 01:35:25 This documentation belongs in the header. This documentation belongs in the header. byungchul 2014/05/12 18:25:23 Done. Show quoted text On 2014/05/12 01:35:25, Ryan Sleevi wrote: > This documentation belongs in the header. Done.
	130 int MapOpenSSLError(int err, const crypto::OpenSSLErrStackTracer& tracer) {
	Ryan Sleevi 2014/05/12 01:35:25 Definition order should match declaration order. Definition order should match declaration order. byungchul 2014/05/12 18:25:23 Done. Show quoted text On 2014/05/12 01:35:25, Ryan Sleevi wrote: > Definition order should match declaration order. Done.
	131 switch (err) {

	132 case SSL_ERROR_WANT_READ:

	133 case SSL_ERROR_WANT_WRITE:

	134 return ERR_IO_PENDING;

	135 case SSL_ERROR_SYSCALL:

	136 LOG(ERROR) << "OpenSSL SYSCALL error, earliest error code in "

	137 "error queue: " << ERR_peek_error() << ", errno: "

	138 << errno;

	139 return ERR_SSL_PROTOCOL_ERROR;

	140 case SSL_ERROR_SSL:

	141 return MapOpenSSLErrorSSL();

	142 default:

	143 // TODO(joth): Implement full mapping.

	144 LOG(WARNING) << "Unknown OpenSSL error " << err;

	145 return ERR_SSL_PROTOCOL_ERROR;

	146 }

	147 }

	148

	149 SslSetClearMask::SslSetClearMask()

	150 : set_mask(0),

	151 clear_mask(0) {

	152 }

	153

	154 void SslSetClearMask::ConfigureFlag(long flag, bool state) {

	155 (state ? set_mask : clear_mask) \|= flag;

	156 // Make sure we haven't got any intersection in the set & clear options.

	157 DCHECK_EQ(0, set_mask & clear_mask) << flag << ":" << state;

	158 }

	159

	160 } // namespace net

OLD	NEW

« net/socket/openssl_util.h ('K') | « net/socket/openssl_util.h ('k') | net/socket/ssl_client_socket_openssl.cc » ('j') | net/socket/ssl_server_socket_openssl.cc » ('J')