Preserve transport errors for OpenSSL sockets.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 456 matching lines @@
     case SSL_ERROR_EXPIRED_CERT_ALERT:
     case SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT:
     case SSL_ERROR_UNKNOWN_CA_ALERT:
     case SSL_ERROR_ACCESS_DENIED_ALERT:
       return ERR_BAD_SSL_CLIENT_AUTH_CERT;
     default:
       return MapNSSError(err);
   }
 }
 
-// Map NSS error code from the first SSL handshake to network error code.
-int MapNSSClientHandshakeError(PRErrorCode err) {
-  switch (err) {
-    // If the server closed on us, it is a protocol error.
-    // Some TLS-intolerant servers do this when we request TLS.
-    case PR_END_OF_FILE_ERROR:
-      return ERR_SSL_PROTOCOL_ERROR;
-    default:
-      return MapNSSClientError(err);
-  }
-}
-
 }  // namespace
 
 // SSLClientSocketNSS::Core provides a thread-safe, ref-counted core that is
 // able to marshal data between NSS functions and an underlying transport
 // socket.
 //
 // All public functions are meant to be called from the network task runner,
 // and any callbacks supplied will be invoked there as well, provided that
 // Detach() has not been called yet.
 //
@@ skipping 214 matching lines @@
 
   // Called by NSS once the handshake has completed.
   // |arg| contains a pointer to the current SSLClientSocketNSS::Core.
   static void HandshakeCallback(PRFileDesc* socket, void* arg);
 
   // Called once the handshake has succeeded.
   void HandshakeSucceeded();
 
   // Handles an NSS error generated while handshaking or performing IO.
   // Returns a network error code mapped from the original NSS error.
-  int HandleNSSError(PRErrorCode error, bool handshake_error);
+  int HandleNSSError(PRErrorCode error);
 
   int DoHandshakeLoop(int last_io_result);
   int DoReadLoop(int result);
   int DoWriteLoop(int result);
 
   int DoHandshake();
   int DoGetDBCertComplete(int result);
 
   int DoPayloadRead();
   int DoPayloadWrite();
@@ skipping 941 matching lines @@
   UpdateConnectionStatus();
   UpdateNextProto();
 
   // Update the network task runners view of the handshake state whenever
   // a handshake has completed.
   PostOrRunCallback(
       FROM_HERE, base::Bind(&Core::OnHandshakeStateUpdated, this,
                             nss_handshake_state_));
 }
 
-int SSLClientSocketNSS::Core::HandleNSSError(PRErrorCode nss_error,
-                                             bool handshake_error) {
+int SSLClientSocketNSS::Core::HandleNSSError(PRErrorCode nss_error) {
   DCHECK(OnNSSTaskRunner());
 
-  int net_error = handshake_error ? MapNSSClientHandshakeError(nss_error) :
-                                    MapNSSClientError(nss_error);
+  int net_error = MapNSSClientError(nss_error);
 
 #if defined(OS_WIN)
   // On Windows, a handle to the HCRYPTPROV is cached in the X509Certificate
   // os_cert_handle() as an optimization. However, if the certificate
   // private key is stored on a smart card, and the smart card is removed,
   // the cached HCRYPTPROV will not be able to obtain the HCRYPTKEY again,
   // preventing client certificate authentication. Because the
   // X509Certificate may outlive the individual SSLClientSocketNSS, due to
   // caching in X509Certificate, this failure ends up preventing client
   // certificate authentication with the same certificate for all future
@@ skipping 137 matching lines @@
     // cert again.
     if (rv == SECSuccess && SSL_InvalidateSession(nss_fd_) != SECSuccess)
       LOG(WARNING) << "Couldn't invalidate SSL session: " << PR_GetError();
   } else if (rv == SECSuccess) {
     if (!handshake_callback_called_) {
       false_started_ = true;
       HandshakeSucceeded();
     }
   } else {
     PRErrorCode prerr = PR_GetError();
-    net_error = HandleNSSError(prerr, true);
-
-    // Some network devices that inspect application-layer packets seem to
-    // inject TCP reset packets to break the connections when they see
-    // TLS 1.1 in ClientHello or ServerHello. See http://crbug.com/130293.
-    //
-    // Only allow ERR_CONNECTION_RESET to trigger a fallback from TLS 1.1 or
-    // 1.2. We don't lose much in this fallback because the explicit IV for CBC
-    // mode in TLS 1.1 is approximated by record splitting in TLS 1.0. The
-    // fallback will be more painful for TLS 1.2 when we have GCM support.
-    //
-    // ERR_CONNECTION_RESET is a common network error, so we don't want it
-    // to trigger a version fallback in general, especially the TLS 1.0 ->
-    // SSL 3.0 fallback, which would drop TLS extensions.
-    if (prerr == PR_CONNECT_RESET_ERROR &&
-        ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1_1) {
-      net_error = ERR_SSL_PROTOCOL_ERROR;
-    }
+    net_error = HandleNSSError(prerr);
 
     // If not done, stay in this state
     if (net_error == ERR_IO_PENDING) {
       GotoState(STATE_HANDSHAKE);
     } else {
       PostOrRunCallback(
           FROM_HERE,
           base::Bind(&AddLogEventWithCallback, weak_net_log_,
                      NetLog::TYPE_SSL_HANDSHAKE_ERROR,
                      CreateNetLogSSLErrorCallback(net_error, prerr)));
@@ skipping 106 matching lines @@
       next_result = &pending_read_result_;
     }
 
     if (client_auth_cert_needed_) {
       *next_result = ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
       pending_read_nss_error_ = 0;
     } else if (*next_result < 0) {
       // If *next_result == 0, then that indicates EOF, and no special error
       // handling is needed.
       pending_read_nss_error_ = PR_GetError();
-      *next_result = HandleNSSError(pending_read_nss_error_, false);
+      *next_result = HandleNSSError(pending_read_nss_error_);
       if (rv > 0 && *next_result == ERR_IO_PENDING) {
         // If at least some data was read from PR_Read(), do not treat
         // insufficient data as an error to return in the next call to
         // DoPayloadRead() - instead, let the call fall through to check
         // PR_Read() again. This is because DoTransportIO() may complete
         // in between the next call to DoPayloadRead(), and thus it is
         // important to check PR_Read() on subsequent invocations to see
         // if a complete record may now be read.
         pending_read_nss_error_ = 0;
         pending_read_result_ = kNoPendingReadResult;
@@ skipping 41 matching lines @@
         FROM_HERE,
         base::Bind(&LogByteTransferEvent, weak_net_log_,
                    NetLog::TYPE_SSL_SOCKET_BYTES_SENT, rv,
                    scoped_refptr<IOBuffer>(user_write_buf_)));
     return rv;
   }
   PRErrorCode prerr = PR_GetError();
   if (prerr == PR_WOULD_BLOCK_ERROR)
     return ERR_IO_PENDING;
 
-  rv = HandleNSSError(prerr, false);
+  rv = HandleNSSError(prerr);
   PostOrRunCallback(
       FROM_HERE,
       base::Bind(&AddLogEventWithCallback, weak_net_log_,
                  NetLog::TYPE_SSL_WRITE_ERROR,
                  CreateNetLogSSLErrorCallback(rv, prerr)));
   return rv;
 }
 
 // Do as much network I/O as possible between the buffer and the
 // transport socket. Return true if some I/O performed, false
@@ skipping 1549 matching lines @@
 scoped_refptr<X509Certificate>
 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const {
   return core_->state().server_cert.get();
 }
 
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }
 
 }  // namespace net