DEPS roll openssl to 1.0.1c

DEPS roll openssl to 1.0.1c

Note: The ssl_client_socket_openssl.c change is necessary to avoid
breaking the HTTPSRequestTest.SSLv3Fallback unit test.

MapOpenSSLErrorSSL was returning ERR_FAILED instead of
ERR_SSL_VERSION_OR_CIPHER_MISMATCH because the function didn't support the
SSL_R_UNSUPPORTED_PROTOCOL returned by openssl during the test.

BUG=112445
NOTRY=true

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=172108

[digit1, 2012-11-22 17:15:09]

This fails hard on the 'linux_redux' build. I'm looking into it.

[wtc, 2012-11-22 18:37:31]

Drive-by review comments on patch set 1:

https://chromiumcodereview.appspot.com/11413143/diff/1/net/socket/ssl_client_...
File net/socket/ssl_client_socket_openssl.cc (right):

https://chromiumcodereview.appspot.com/11413143/diff/1/net/socket/ssl_client_...
net/socket/ssl_client_socket_openssl.cc:138: case SSL_R_UNSUPPORTED_PROTOCOL:

You should compare this function with the MapNSSError
function in net/socket/nss_ssl_util.cc. We have better
net::ERR_xxx error codes for some of these SSL errors.

It seems that OpenSSL's SSL_R_UNSUPPORTED_PROTOCOL is
equivalent to (one meaning of) NSS's
SSL_ERROR_NO_CYPHER_OVERLAP: the ServerHello selected a
protocol version that is not supported by the SSL client.
So I think SSL_R_UNSUPPORTED_PROTOCOL should be mapped to
ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

(You can review the rest of the error code mapping of this
function in a separate CL.)

[digit1, 2012-11-22 20:35:41]

Thanks Will, this is helpful, I'll try to see if the mapping you suggest works
too.

For the record, the breakage comes from the openssl configuration used for the
linux_redux build (i.e. the content of
third_party/openssl/config/{piii,k8}/openssl/opensslconf.h which is different
from the Android one). In a nutshell, this will require a small update to
third_party/openssl/, and then a DEPS roll to this newer version.

Also, there are nacl sources that assume that NSS is always used on Linux, fix
coming soon.

Phew... Insert "One does not simply roll openssl..." meme here :)

[Ryan Sleevi, 2012-12-08 00:15:37]

FYI, throwing out the lgtm for the DEPS roll if it hasn't happened yet. I know
you're still shuffling out some issues for the bots, but it would be good to
land this if it hasn't yet.

Otherwise, let's close this.

[Ryan Sleevi, 2012-12-08 00:38:04]

Confirmed this landed in http://crrev.com/166429

[digit1, 2012-12-10 08:35:02]

On 2012/12/08 00:38:04, Ryan Sleevi wrote:
> Confirmed this landed in http://crrev.com/166429

Actually, the patch was later reverted, so I reopened this issue. A new version
of the patch that uses the newest OpenSSL from
https://chromiumcodereview.appspot.com/11467016/ will be here soon.

[digit1, 2012-12-10 13:37:16]

The second path rebases the patch around a slightly more up-to-date version of
OpenSSL that doesn't break the linux_redux build.

As wtc said, it's much better to use ERR_SSL_VERSION_OR_CIPHER_MISMATCH when
mapping SSL_R_UNSUPPORTED_PROTOCOL, since the library returns this error when it
deals with an unsupported SSL version number in a ServerHello message (when
operating the client).

[commit-bot: I haz the power, 2012-12-10 13:37:32]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/digit@chromium.org/11413143/8001

[commit-bot: I haz the power, 2012-12-10 18:27:49]

Commit queue rejected this change because the description was changed
between the time the change entered the commit queue and the time it
was ready to commit. You can safely check the commit box again.

[wtc, 2012-12-10 19:18:45]

Patch set 2 LGTM.

In the CL's commit message, I think we should change
ERR_SSL_PROTOCOL_ERROR to ERR_SSL_VERSION_OR_CIPHER_MISMATCH
to reflect the new error code mapping.

[digit1, 2012-12-10 19:38:22]

Thanks, I've done that. Trying to commit again now.

[commit-bot: I haz the power, 2012-12-10 19:38:39]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/digit@chromium.org/11413143/8001

[commit-bot: I haz the power, 2012-12-10 19:39:44]

Change committed as 172108