ccb3a644e1
We will move the sane part of this package to i/netxlite/errorsx and we will move the rest to i/e/legacy/errorsx. What is the sane part? The sane part is error classifiers plus the definition of ErrWrapper. The rest, including the rules on how to decide whether an operation is major, are tricky and we should consider them legacy and replace them with rules that are more easy to understand and reason on. Part of https://github.com/ooni/probe/issues/1591
56 lines
1.6 KiB
Go
56 lines
1.6 KiB
Go
package errorsx
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"errors"
|
|
"net"
|
|
)
|
|
|
|
// TLSHandshaker is the generic TLS handshaker
|
|
type TLSHandshaker interface {
|
|
Handshake(ctx context.Context, conn net.Conn, config *tls.Config) (
|
|
net.Conn, tls.ConnectionState, error)
|
|
}
|
|
|
|
// ErrorWrapperTLSHandshaker wraps the returned error to be an OONI error
|
|
type ErrorWrapperTLSHandshaker struct {
|
|
TLSHandshaker
|
|
}
|
|
|
|
// Handshake implements TLSHandshaker.Handshake
|
|
func (h *ErrorWrapperTLSHandshaker) Handshake(
|
|
ctx context.Context, conn net.Conn, config *tls.Config,
|
|
) (net.Conn, tls.ConnectionState, error) {
|
|
tlsconn, state, err := h.TLSHandshaker.Handshake(ctx, conn, config)
|
|
err = SafeErrWrapperBuilder{
|
|
Classifier: ClassifyTLSHandshakeError,
|
|
Error: err,
|
|
Operation: TLSHandshakeOperation,
|
|
}.MaybeBuild()
|
|
return tlsconn, state, err
|
|
}
|
|
|
|
// ClassifyTLSHandshakeError maps an error occurred during the TLS
|
|
// handshake to an OONI failure string.
|
|
func ClassifyTLSHandshakeError(err error) string {
|
|
var x509HostnameError x509.HostnameError
|
|
if errors.As(err, &x509HostnameError) {
|
|
// Test case: https://wrong.host.badssl.com/
|
|
return FailureSSLInvalidHostname
|
|
}
|
|
var x509UnknownAuthorityError x509.UnknownAuthorityError
|
|
if errors.As(err, &x509UnknownAuthorityError) {
|
|
// Test case: https://self-signed.badssl.com/. This error has
|
|
// never been among the ones returned by MK.
|
|
return FailureSSLUnknownAuthority
|
|
}
|
|
var x509CertificateInvalidError x509.CertificateInvalidError
|
|
if errors.As(err, &x509CertificateInvalidError) {
|
|
// Test case: https://expired.badssl.com/
|
|
return FailureSSLInvalidCertificate
|
|
}
|
|
return ClassifyGenericError(err)
|
|
}
|