refactor(errorsx): start hiding private details and moving around stuff (#424)

* refactor(errorsx): start hiding private details and moving around stuff

Part of https://github.com/ooni/probe/issues/1505

* fix: remove now-addressed todo comments

internal/errorsx/tls.go

@@ -3,6 +3,8 @@ package errorsx
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
+	"errors"
 	"net"
 )
 
@@ -23,9 +25,30 @@ func (h *ErrorWrapperTLSHandshaker) Handshake(
 ) (net.Conn, tls.ConnectionState, error) {
 	tlsconn, state, err := h.TLSHandshaker.Handshake(ctx, conn, config)
 	err = SafeErrWrapperBuilder{
-		Classifier: ClassifyTLSFailure,
+		Classifier: classifyTLSFailure,
 		Error:      err,
 		Operation:  TLSHandshakeOperation,
 	}.MaybeBuild()
 	return tlsconn, state, err
 }
+
+// classifyTLSFailure is a classifier to translate TLS errors to OONI error strings.
+func classifyTLSFailure(err error) string {
+	var x509HostnameError x509.HostnameError
+	if errors.As(err, &x509HostnameError) {
+		// Test case: https://wrong.host.badssl.com/
+		return FailureSSLInvalidHostname
+	}
+	var x509UnknownAuthorityError x509.UnknownAuthorityError
+	if errors.As(err, &x509UnknownAuthorityError) {
+		// Test case: https://self-signed.badssl.com/. This error has
+		// never been among the ones returned by MK.
+		return FailureSSLUnknownAuthority
+	}
+	var x509CertificateInvalidError x509.CertificateInvalidError
+	if errors.As(err, &x509CertificateInvalidError) {
+		// Test case: https://expired.badssl.com/
+		return FailureSSLInvalidCertificate
+	}
+	return toFailureString(err)
+}