Map the client certificate related SSL alerts to

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 403 matching lines @@
   if (verifier.rrtype() != kDNS_CAA)
     return DNSVR_CONTINUE;
 
   DNSValidationResult r = VerifyCAARecords(
       server_cert_nss, verifier.rrdatas(), port);
   SECITEM_FreeItem(&dnssec_embedded_chain, PR_FALSE);
 
   return r;
 }
 
+// Client-side error mapping functions.
+
+// Map NSS error code to network error code.
+int MapNSSClientError(PRErrorCode err) {
+  switch (err) {
+    case SSL_ERROR_BAD_CERT_ALERT:
+    case SSL_ERROR_UNSUPPORTED_CERT_ALERT:
+    case SSL_ERROR_REVOKED_CERT_ALERT:
+    case SSL_ERROR_EXPIRED_CERT_ALERT:
+    case SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT:
+    case SSL_ERROR_UNKNOWN_CA_ALERT:
+    case SSL_ERROR_ACCESS_DENIED_ALERT:
+      return ERR_BAD_SSL_CLIENT_AUTH_CERT;
+    default:
+      return MapNSSError(err);
+  }
+}
+
+// Map NSS error code from the first SSL handshake to network error code.
+int MapNSSClientHandshakeError(PRErrorCode err) {
+  switch (err) {
+    // If the server closed on us, it is a protocol error.
+    // Some TLS-intolerant servers do this when we request TLS.
+    case PR_END_OF_FILE_ERROR:
+      return ERR_SSL_PROTOCOL_ERROR;
+    default:
+      return MapNSSClientError(err);
+  }
+}
+
 }  // namespace
 
 SSLClientSocketNSS::SSLClientSocketNSS(ClientSocketHandle* transport_socket,
                                        const HostPortPair& host_and_port,
                                        const SSLConfig& ssl_config,
                                        SSLHostInfo* ssl_host_info,
                                        const SSLClientSocketContext& context)
     : transport_send_busy_(false),
       transport_recv_busy_(false),
       transport_recv_eof_(false),
@@ skipping 1119 matching lines @@
       if (!crypto::ECPrivateKey::ImportFromEncryptedPrivateKeyInfo(
           ServerBoundCertService::kEPKIPassword,
           reinterpret_cast<const unsigned char*>(
               domain_bound_private_key_.data()),
           domain_bound_private_key_.size(),
           &(*cert)->subjectPublicKeyInfo,
           false,
           false,
           key,
           &public_key)) {
+        int error = MapNSSError(PORT_GetError());

[wtc, 2012/05/29 23:41:00]

Get the NSS error code first, otherwise it could be overwritten
by the CERT_DestroyCertificate call.

         CERT_DestroyCertificate(*cert);
         *cert = NULL;
-        return MapNSSError(PORT_GetError());
+        return error;
       }
       SECKEY_DestroyPublicKey(public_key);
       break;
     }
 
     default:
       NOTREACHED();
       return ERR_INVALID_ARGUMENT;
   }
 
   return OK;
 }
 
 int SSLClientSocketNSS::DoGetDBCertComplete(int result) {
   SECStatus rv;
   net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_GET_DOMAIN_BOUND_CERT,
                                     result);
   client_auth_cert_needed_ = false;
   domain_bound_cert_request_handle_ = NULL;
 
   if (result != OK) {
     // Failed to get a DBC.  Proceed without.
     rv = SSL_RestartHandshakeAfterCertReq(nss_fd_, NULL, NULL, NULL);
     if (rv != SECSuccess)
-      return MapNSSError(PORT_GetError());
+      return HandleNSSError(PORT_GetError(), true);
     GotoState(STATE_HANDSHAKE);
     return OK;
   }
 
   CERTCertificate* cert;
   SECKEYPrivateKey* key;
   int error = ImportDBCertAndKey(&cert, &key);
   if (error != OK)
     return error;
 
   CERTCertificateList* cert_chain = CERT_CertChainFromCert(cert,
                                                            certUsageSSLClient,
                                                            PR_FALSE);
   net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED,
       make_scoped_refptr(new NetLogIntegerParameter("cert_count",
                                                     cert_chain->len)));
   rv = SSL_RestartHandshakeAfterCertReq(nss_fd_, cert, key, cert_chain);
   if (rv != SECSuccess)
-    return MapNSSError(PORT_GetError());
+    return HandleNSSError(PORT_GetError(), true);
 
   GotoState(STATE_HANDSHAKE);
   set_domain_bound_cert_type(domain_bound_cert_type_);
   return OK;
 }
 
 int SSLClientSocketNSS::DoVerifyDNSSEC(int result) {
   DNSValidationResult r = CheckDNSSECChain(host_and_port_.host(),
                                            server_cert_nss_,
                                            host_and_port_.port());
@@ skipping 391 matching lines @@
   }
   recv_buffer_ = NULL;
   memio_PutReadResult(nss_bufs_, MapErrorToNSS(result));
   transport_recv_busy_ = false;
   OnRecvComplete(result);
   LeaveFunction("");
 }
 
 int SSLClientSocketNSS::HandleNSSError(PRErrorCode nss_error,
                                        bool handshake_error) {
-  int net_error = handshake_error ? MapNSSHandshakeError(nss_error) :
-                                    MapNSSError(nss_error);
+  int net_error = handshake_error ? MapNSSClientHandshakeError(nss_error) :
+                                    MapNSSClientError(nss_error);
 
 #if defined(OS_WIN)
   // On Windows, a handle to the HCRYPTPROV is cached in the X509Certificate
   // os_cert_handle() as an optimization. However, if the certificate
   // private key is stored on a smart card, and the smart card is removed,
   // the cached HCRYPTPROV will not be able to obtain the HCRYPTKEY again,
   // preventing client certificate authentication. Because the
   // X509Certificate may outlive the individual SSLClientSocketNSS, due to
   // caching in X509Certificate, this failure ends up preventing client
   // certificate authentication with the same certificate for all future
@@ skipping 606 matching lines @@
   EnsureThreadIdAssigned();
   base::AutoLock auto_lock(lock_);
   return valid_thread_id_ == base::PlatformThread::CurrentId();
 }
 
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }
 
 }  // namespace net