commit 780d6dd0fed62edfc6e90930c59ee255387f9332
author David Benjamin <davidben@chromium.org> Tue Jan 06 12:03:19 2015 -0500
committer Adam Langley <agl@google.com> Tue Jan 06 18:31:49 2015 +0000
tree 9841f65f4a54da4c7a7a5c9894d0aff1d8315628
parent 2be62c304c3af7d7e02e07fb04edbd0d4c418b40

Treat handshake_failure in response to ClientHello special.

Add a dedicated error code to the queue for a handshake_failure alert in
response to ClientHello. This matches NSS's client behavior and gives a better
error on a (probable) failure to negotiate initial parameters.

BUG=https://crbug.com/446505

Change-Id: I34368712085a6cbf0031902daf2c00393783d96d
Reviewed-on: https://boringssl-review.googlesource.com/2751
Reviewed-by: Adam Langley <agl@google.com>

ssl/s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 1a45805..fdcaf76 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -748,6 +748,18 @@
                                  SSL_GET_MESSAGE_HASH_MESSAGE, &ok);
 
   if (!ok) {
+    uint32_t err = ERR_peek_error();
+    if (ERR_GET_LIB(err) == ERR_LIB_SSL &&
+        ERR_GET_REASON(err) == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE) {
+      /* Add a dedicated error code to the queue for a handshake_failure alert
+       * in response to ClientHello. This matches NSS's client behavior and
+       * gives a better error on a (probable) failure to negotiate initial
+       * parameters. Note: this error code comes after the original one.
+       *
+       * See https://crbug.com/446505. */
+      OPENSSL_PUT_ERROR(SSL, ssl3_get_server_hello,
+                        SSL_R_HANDSHAKE_FAILURE_ON_CLIENT_HELLO);
+    }
     return n;
   }