| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/ssl/openssl_ssl_util.h" | |
| 6 | |
| 7 #include <errno.h> | |
| 8 | |
| 9 #include <openssl/err.h> | |
| 10 #include <openssl/ssl.h> | |
| 11 | |
| 12 #include "base/bind.h" | |
| 13 #include "base/lazy_instance.h" | |
| 14 #include "base/location.h" | |
| 15 #include "base/logging.h" | |
| 16 #include "base/values.h" | |
| 17 #include "crypto/openssl_util.h" | |
| 18 #include "net/base/net_errors.h" | |
| 19 | |
| 20 namespace net { | |
| 21 | |
| 22 SslSetClearMask::SslSetClearMask() | |
| 23 : set_mask(0), | |
| 24 clear_mask(0) { | |
| 25 } | |
| 26 | |
| 27 void SslSetClearMask::ConfigureFlag(long flag, bool state) { | |
| 28 (state ? set_mask : clear_mask) |= flag; | |
| 29 // Make sure we haven't got any intersection in the set & clear options. | |
| 30 DCHECK_EQ(0, set_mask & clear_mask) << flag << ":" << state; | |
| 31 } | |
| 32 | |
| 33 namespace { | |
| 34 | |
| 35 class OpenSSLNetErrorLibSingleton { | |
| 36 public: | |
| 37 OpenSSLNetErrorLibSingleton() { | |
| 38 crypto::EnsureOpenSSLInit(); | |
| 39 | |
| 40 // Allocate a new error library value for inserting net errors into | |
| 41 // OpenSSL. This does not register any ERR_STRING_DATA for the errors, so | |
| 42 // stringifying error codes through OpenSSL will return NULL. | |
| 43 net_error_lib_ = ERR_get_next_error_library(); | |
| 44 } | |
| 45 | |
| 46 int net_error_lib() const { return net_error_lib_; } | |
| 47 | |
| 48 private: | |
| 49 int net_error_lib_; | |
| 50 }; | |
| 51 | |
| 52 base::LazyInstance<OpenSSLNetErrorLibSingleton>::Leaky g_openssl_net_error_lib = | |
| 53 LAZY_INSTANCE_INITIALIZER; | |
| 54 | |
| 55 int OpenSSLNetErrorLib() { | |
| 56 return g_openssl_net_error_lib.Get().net_error_lib(); | |
| 57 } | |
| 58 | |
| 59 int MapOpenSSLErrorSSL(uint32_t error_code) { | |
| 60 DCHECK_EQ(ERR_LIB_SSL, ERR_GET_LIB(error_code)); | |
| 61 | |
| 62 DVLOG(1) << "OpenSSL SSL error, reason: " << ERR_GET_REASON(error_code) | |
| 63 << ", name: " << ERR_error_string(error_code, NULL); | |
| 64 switch (ERR_GET_REASON(error_code)) { | |
| 65 case SSL_R_READ_TIMEOUT_EXPIRED: | |
| 66 return ERR_TIMED_OUT; | |
| 67 case SSL_R_UNKNOWN_CERTIFICATE_TYPE: | |
| 68 case SSL_R_UNKNOWN_CIPHER_TYPE: | |
| 69 case SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE: | |
| 70 case SSL_R_UNKNOWN_SSL_VERSION: | |
| 71 return ERR_NOT_IMPLEMENTED; | |
| 72 case SSL_R_UNSUPPORTED_SSL_VERSION: | |
| 73 case SSL_R_NO_CIPHER_MATCH: | |
| 74 case SSL_R_NO_SHARED_CIPHER: | |
| 75 case SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY: | |
| 76 case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION: | |
| 77 case SSL_R_UNSUPPORTED_PROTOCOL: | |
| 78 return ERR_SSL_VERSION_OR_CIPHER_MISMATCH; | |
| 79 case SSL_R_SSLV3_ALERT_BAD_CERTIFICATE: | |
| 80 case SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE: | |
| 81 case SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED: | |
| 82 case SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED: | |
| 83 case SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN: | |
| 84 case SSL_R_TLSV1_ALERT_ACCESS_DENIED: | |
| 85 case SSL_R_TLSV1_ALERT_UNKNOWN_CA: | |
| 86 return ERR_BAD_SSL_CLIENT_AUTH_CERT; | |
| 87 case SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE: | |
| 88 return ERR_SSL_DECOMPRESSION_FAILURE_ALERT; | |
| 89 case SSL_R_SSLV3_ALERT_BAD_RECORD_MAC: | |
| 90 return ERR_SSL_BAD_RECORD_MAC_ALERT; | |
| 91 case SSL_R_TLSV1_ALERT_DECRYPT_ERROR: | |
| 92 return ERR_SSL_DECRYPT_ERROR_ALERT; | |
| 93 case SSL_R_TLSV1_UNRECOGNIZED_NAME: | |
| 94 return ERR_SSL_UNRECOGNIZED_NAME_ALERT; | |
| 95 case SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED: | |
| 96 return ERR_SSL_UNSAFE_NEGOTIATION; | |
| 97 case SSL_R_BAD_DH_P_LENGTH: | |
| 98 return ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY; | |
| 99 // SSL_R_UNKNOWN_PROTOCOL is reported if premature application data is | |
| 100 // received (see http://crbug.com/42538), and also if all the protocol | |
| 101 // versions supported by the server were disabled in this socket instance. | |
| 102 // Mapped to ERR_SSL_PROTOCOL_ERROR for compatibility with other SSL sockets | |
| 103 // in the former scenario. | |
| 104 case SSL_R_UNKNOWN_PROTOCOL: | |
| 105 case SSL_R_SSL_HANDSHAKE_FAILURE: | |
| 106 case SSL_R_DECRYPTION_FAILED: | |
| 107 case SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC: | |
| 108 case SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG: | |
| 109 case SSL_R_DIGEST_CHECK_FAILED: | |
| 110 case SSL_R_ENCRYPTED_LENGTH_TOO_LONG: | |
| 111 case SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST: | |
| 112 case SSL_R_EXCESSIVE_MESSAGE_SIZE: | |
| 113 case SSL_R_EXTRA_DATA_IN_MESSAGE: | |
| 114 case SSL_R_GOT_A_FIN_BEFORE_A_CCS: | |
| 115 case SSL_R_INVALID_COMMAND: | |
| 116 case SSL_R_INVALID_TICKET_KEYS_LENGTH: | |
| 117 // SSL_do_handshake reports this error when the server responds to a | |
| 118 // ClientHello with a fatal close_notify alert. | |
| 119 case SSL_R_SSLV3_ALERT_CLOSE_NOTIFY: | |
| 120 case SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE: | |
| 121 case SSL_R_SSLV3_ALERT_NO_CERTIFICATE: | |
| 122 case SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER: | |
| 123 case SSL_R_TLSV1_ALERT_DECODE_ERROR: | |
| 124 case SSL_R_TLSV1_ALERT_DECRYPTION_FAILED: | |
| 125 case SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION: | |
| 126 case SSL_R_TLSV1_ALERT_INTERNAL_ERROR: | |
| 127 case SSL_R_TLSV1_ALERT_NO_RENEGOTIATION: | |
| 128 case SSL_R_TLSV1_ALERT_RECORD_OVERFLOW: | |
| 129 case SSL_R_TLSV1_ALERT_USER_CANCELLED: | |
| 130 return ERR_SSL_PROTOCOL_ERROR; | |
| 131 case SSL_R_CERTIFICATE_VERIFY_FAILED: | |
| 132 // The only way that the certificate verify callback can fail is if | |
| 133 // the leaf certificate changed during a renegotiation. | |
| 134 return ERR_SSL_SERVER_CERT_CHANGED; | |
| 135 case SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK: | |
| 136 return ERR_SSL_INAPPROPRIATE_FALLBACK; | |
| 137 // SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE may be returned from the server after | |
| 138 // receiving ClientHello if there's no common supported cipher. Map that | |
| 139 // specific case to ERR_SSL_VERSION_OR_CIPHER_MISMATCH to match the NSS | |
| 140 // implementation. See https://goo.gl/oMtZW and https://crbug.com/446505. | |
| 141 case SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE: { | |
| 142 uint32_t previous = ERR_peek_error(); | |
| 143 if (previous != 0 && ERR_GET_LIB(previous) == ERR_LIB_SSL && | |
| 144 ERR_GET_REASON(previous) == SSL_R_HANDSHAKE_FAILURE_ON_CLIENT_HELLO) { | |
| 145 return ERR_SSL_VERSION_OR_CIPHER_MISMATCH; | |
| 146 } | |
| 147 return ERR_SSL_PROTOCOL_ERROR; | |
| 148 } | |
| 149 default: | |
| 150 LOG(WARNING) << "Unmapped error reason: " << ERR_GET_REASON(error_code); | |
| 151 return ERR_SSL_PROTOCOL_ERROR; | |
| 152 } | |
| 153 } | |
| 154 | |
| 155 base::Value* NetLogOpenSSLErrorCallback(int net_error, | |
| 156 int ssl_error, | |
| 157 const OpenSSLErrorInfo& error_info, | |
| 158 NetLog::LogLevel /* log_level */) { | |
| 159 base::DictionaryValue* dict = new base::DictionaryValue(); | |
| 160 dict->SetInteger("net_error", net_error); | |
| 161 dict->SetInteger("ssl_error", ssl_error); | |
| 162 if (error_info.error_code != 0) { | |
| 163 dict->SetInteger("error_lib", ERR_GET_LIB(error_info.error_code)); | |
| 164 dict->SetInteger("error_reason", ERR_GET_REASON(error_info.error_code)); | |
| 165 } | |
| 166 if (error_info.file != NULL) | |
| 167 dict->SetString("file", error_info.file); | |
| 168 if (error_info.line != 0) | |
| 169 dict->SetInteger("line", error_info.line); | |
| 170 return dict; | |
| 171 } | |
| 172 | |
| 173 } // namespace | |
| 174 | |
| 175 void OpenSSLPutNetError(const tracked_objects::Location& location, int err) { | |
| 176 // Net error codes are negative. Encode them as positive numbers. | |
| 177 err = -err; | |
| 178 if (err < 0 || err > 0xfff) { | |
| 179 // OpenSSL reserves 12 bits for the reason code. | |
| 180 NOTREACHED(); | |
| 181 err = ERR_INVALID_ARGUMENT; | |
| 182 } | |
| 183 ERR_put_error(OpenSSLNetErrorLib(), 0, err, | |
| 184 location.file_name(), location.line_number()); | |
| 185 } | |
| 186 | |
| 187 int MapOpenSSLError(int err, const crypto::OpenSSLErrStackTracer& tracer) { | |
| 188 OpenSSLErrorInfo error_info; | |
| 189 return MapOpenSSLErrorWithDetails(err, tracer, &error_info); | |
| 190 } | |
| 191 | |
| 192 int MapOpenSSLErrorWithDetails(int err, | |
| 193 const crypto::OpenSSLErrStackTracer& tracer, | |
| 194 OpenSSLErrorInfo* out_error_info) { | |
| 195 *out_error_info = OpenSSLErrorInfo(); | |
| 196 | |
| 197 switch (err) { | |
| 198 case SSL_ERROR_WANT_READ: | |
| 199 case SSL_ERROR_WANT_WRITE: | |
| 200 return ERR_IO_PENDING; | |
| 201 case SSL_ERROR_SYSCALL: | |
| 202 LOG(ERROR) << "OpenSSL SYSCALL error, earliest error code in " | |
| 203 "error queue: " << ERR_peek_error() << ", errno: " | |
| 204 << errno; | |
| 205 return ERR_FAILED; | |
| 206 case SSL_ERROR_SSL: | |
| 207 // Walk down the error stack to find an SSL or net error. | |
| 208 uint32_t error_code; | |
| 209 const char* file; | |
| 210 int line; | |
| 211 do { | |
| 212 error_code = ERR_get_error_line(&file, &line); | |
| 213 if (ERR_GET_LIB(error_code) == ERR_LIB_SSL) { | |
| 214 out_error_info->error_code = error_code; | |
| 215 out_error_info->file = file; | |
| 216 out_error_info->line = line; | |
| 217 return MapOpenSSLErrorSSL(error_code); | |
| 218 } else if (ERR_GET_LIB(error_code) == OpenSSLNetErrorLib()) { | |
| 219 out_error_info->error_code = error_code; | |
| 220 out_error_info->file = file; | |
| 221 out_error_info->line = line; | |
| 222 // Net error codes are negative but encoded in OpenSSL as positive | |
| 223 // numbers. | |
| 224 return -ERR_GET_REASON(error_code); | |
| 225 } | |
| 226 } while (error_code != 0); | |
| 227 return ERR_FAILED; | |
| 228 default: | |
| 229 // TODO(joth): Implement full mapping. | |
| 230 LOG(WARNING) << "Unknown OpenSSL error " << err; | |
| 231 return ERR_SSL_PROTOCOL_ERROR; | |
| 232 } | |
| 233 } | |
| 234 | |
| 235 NetLog::ParametersCallback CreateNetLogOpenSSLErrorCallback( | |
| 236 int net_error, | |
| 237 int ssl_error, | |
| 238 const OpenSSLErrorInfo& error_info) { | |
| 239 return base::Bind(&NetLogOpenSSLErrorCallback, | |
| 240 net_error, ssl_error, error_info); | |
| 241 } | |
| 242 | |
| 243 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master