refactor(errorsx): start hiding private details and moving around stuff (#424)

* refactor(errorsx): start hiding private details and moving around stuff

Part of https://github.com/ooni/probe/issues/1505

* fix: remove now-addressed todo comments

internal/errorsx/quic.go

@@ -3,6 +3,7 @@ package errorsx
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"net"
 
 	"github.com/lucas-clemente/quic-go"
@@ -86,7 +87,7 @@ func (d *ErrorWrapperQUICDialer) DialContext(
 	tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlySession, error) {
 	sess, err := d.Dialer.DialContext(ctx, network, host, tlsCfg, cfg)
 	err = SafeErrWrapperBuilder{
-		Classifier: ClassifyQUICFailure,
+		Classifier: classifyQUICFailure,
 		Error:      err,
 		Operation:  QUICHandshakeOperation,
 	}.MaybeBuild()
@@ -95,3 +96,85 @@ func (d *ErrorWrapperQUICDialer) DialContext(
 	}
 	return sess, nil
 }
+
+// classifyQUICFailure is a classifier to translate QUIC errors to OONI error strings.
+func classifyQUICFailure(err error) string {
+	var versionNegotiation *quic.VersionNegotiationError
+	var statelessReset *quic.StatelessResetError
+	var handshakeTimeout *quic.HandshakeTimeoutError
+	var idleTimeout *quic.IdleTimeoutError
+	var transportError *quic.TransportError
+
+	if errors.As(err, &versionNegotiation) {
+		return FailureNoCompatibleQUICVersion
+	}
+	if errors.As(err, &statelessReset) {
+		return FailureConnectionReset
+	}
+	if errors.As(err, &handshakeTimeout) {
+		return FailureGenericTimeoutError
+	}
+	if errors.As(err, &idleTimeout) {
+		return FailureGenericTimeoutError
+	}
+	if errors.As(err, &transportError) {
+		if transportError.ErrorCode == quic.ConnectionRefused {
+			return FailureConnectionRefused
+		}
+		// the TLS Alert constants are taken from RFC8446
+		errCode := uint8(transportError.ErrorCode)
+		if quicIsCertificateError(errCode) {
+			return FailureSSLInvalidCertificate
+		}
+		// TLSAlertDecryptError and TLSAlertHandshakeFailure are summarized to a FailureSSLHandshake error because both
+		// alerts are caused by a failed or corrupted parameter negotiation during the TLS handshake.
+		if errCode == quicTLSAlertDecryptError || errCode == quicTLSAlertHandshakeFailure {
+			return FailureSSLHandshake
+		}
+		if errCode == quicTLSAlertUnknownCA {
+			return FailureSSLUnknownAuthority
+		}
+		if errCode == quicTLSUnrecognizedName {
+			return FailureSSLInvalidHostname
+		}
+	}
+	return toFailureString(err)
+}
+
+// TLS alert protocol as defined in RFC8446
+const (
+	// Sender was unable to negotiate an acceptable set of security parameters given the options available.
+	quicTLSAlertHandshakeFailure = 40
+
+	// Certificate was corrupt, contained signatures that did not verify correctly, etc.
+	quicTLSAlertBadCertificate = 42
+
+	// Certificate was of an unsupported type.
+	quicTLSAlertUnsupportedCertificate = 43
+
+	// Certificate was revoked by its signer.
+	quicTLSAlertCertificateRevoked = 44
+
+	// Certificate has expired or is not currently valid.
+	quicTLSAlertCertificateExpired = 45
+
+	// Some unspecified issue arose in processing the certificate, rendering it unacceptable.
+	quicTLSAlertCertificateUnknown = 46
+
+	// Certificate was not accepted because the CA certificate could not be located or could not be matched with a known trust anchor.
+	quicTLSAlertUnknownCA = 48
+
+	// Handshake (not record layer) cryptographic operation failed.
+	quicTLSAlertDecryptError = 51
+
+	// Sent by servers when no server exists identified by the name provided by the client via the "server_name" extension.
+	quicTLSUnrecognizedName = 112
+)
+
+func quicIsCertificateError(alert uint8) bool {
+	return (alert == quicTLSAlertBadCertificate ||
+		alert == quicTLSAlertUnsupportedCertificate ||
+		alert == quicTLSAlertCertificateExpired ||
+		alert == quicTLSAlertCertificateRevoked ||
+		alert == quicTLSAlertCertificateUnknown)
+}