ssl: Enhance error handling

7 files changed, 87 insertions, 147 deletions

diff --git a/lib/ssl/test/ssl_alpn_handshake_SUITE.erl b/lib/ssl/test/ssl_alpn_handshake_SUITE.erl
index 7f7c3da5ab..dfc780479e 100644
--- a/lib/ssl/test/ssl_alpn_handshake_SUITE.erl
+++ b/lib/ssl/test/ssl_alpn_handshake_SUITE.erl
@@ -153,41 +153,41 @@ protocols_must_be_a_binary_list(Config) when is_list(Config) ->
 
 empty_client(Config) when is_list(Config) ->
     run_failing_handshake(Config,
-        [{alpn_advertised_protocols, []}],
-        [{alpn_preferred_protocols, [<<"spdy/2">>, <<"spdy/3">>, <<"http/2">>]}],
-        {error,{tls_alert,"no application protocol"}}).
+                          [{alpn_advertised_protocols, []}],
+                          [{alpn_preferred_protocols, [<<"spdy/2">>, <<"spdy/3">>, <<"http/2">>]}],
+                          no_application_protocol).
 
 %--------------------------------------------------------------------------------
 
 empty_server(Config) when is_list(Config) ->
     run_failing_handshake(Config,
-        [{alpn_advertised_protocols, [<<"http/1.0">>, <<"http/1.1">>]}],
-        [{alpn_preferred_protocols, []}],
-        {error,{tls_alert,"no application protocol"}}).
+                          [{alpn_advertised_protocols, [<<"http/1.0">>, <<"http/1.1">>]}],
+                          [{alpn_preferred_protocols, []}],
+                          no_application_protocol).
 
 %--------------------------------------------------------------------------------
 
 empty_client_empty_server(Config) when is_list(Config) ->
     run_failing_handshake(Config,
-        [{alpn_advertised_protocols, []}],
-        [{alpn_preferred_protocols, []}],
-        {error,{tls_alert,"no application protocol"}}).
+                          [{alpn_advertised_protocols, []}],
+                          [{alpn_preferred_protocols, []}],
+                          no_application_protocol).
 
 %--------------------------------------------------------------------------------
 
 no_matching_protocol(Config) when is_list(Config) ->
     run_failing_handshake(Config,
-        [{alpn_advertised_protocols, [<<"http/1.0">>, <<"http/1.1">>]}],
-        [{alpn_preferred_protocols, [<<"spdy/2">>, <<"spdy/3">>, <<"http/2">>]}],
-        {error,{tls_alert,"no application protocol"}}).
+                          [{alpn_advertised_protocols, [<<"http/1.0">>, <<"http/1.1">>]}],
+                          [{alpn_preferred_protocols, [<<"spdy/2">>, <<"spdy/3">>, <<"http/2">>]}],
+                          no_application_protocol).
 
 %--------------------------------------------------------------------------------
 
 client_alpn_and_server_alpn(Config) when is_list(Config) ->
     run_handshake(Config,
-		    [{alpn_advertised_protocols, [<<"http/1.0">>, <<"http/1.1">>]}],
-		    [{alpn_preferred_protocols, [<<"spdy/2">>, <<"http/1.1">>, <<"http/1.0">>]}],
-		    {ok, <<"http/1.1">>}).
+                  [{alpn_advertised_protocols, [<<"http/1.0">>, <<"http/1.1">>]}],
+                  [{alpn_preferred_protocols, [<<"spdy/2">>, <<"http/1.1">>, <<"http/1.0">>]}],
+                  {ok, <<"http/1.1">>}).
 
 %--------------------------------------------------------------------------------
 
@@ -297,7 +297,7 @@ alpn_not_supported_server(Config) when is_list(Config)->
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------
 
-run_failing_handshake(Config, ClientExtraOpts, ServerExtraOpts, ExpectedResult) ->
+run_failing_handshake(Config, ClientExtraOpts, ServerExtraOpts, ExpectedAlert) ->
     ClientOpts = ClientExtraOpts ++ ssl_test_lib:ssl_options(client_rsa_opts, Config),
     ServerOpts = ServerExtraOpts ++ ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
@@ -313,8 +313,7 @@ run_failing_handshake(Config, ClientExtraOpts, ServerExtraOpts, ExpectedResult)
                                            {from, self()},
                                            {mfa, {?MODULE, placeholder, []}},
                                            {options, ClientOpts}]),
-    ssl_test_lib:check_result(Server, ExpectedResult,
-                              Client, ExpectedResult).
+    ssl_test_lib:check_client_alert(Server, Client, ExpectedAlert).
 
 run_handshake(Config, ClientExtraOpts, ServerExtraOpts, ExpectedProtocol) ->
     Data = "hello world",
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index cfc4ec5770..72606db628 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -702,14 +702,7 @@ hello_client_cancel(Config) when is_list(Config) ->
                                                       {from, self()}, 
                                                       {options, ssl_test_lib:ssl_options([{handshake, hello}], Config)},
                                                       {continue_options, cancel}]),    
-      receive
-          {Server, {error, {tls_alert, "user canceled"}}} ->
-              ok;
-          {Server, {error, closed}} ->
-              ct:pal("Did not receive the ALERT"),
-              ok
-      end.
-
+    ssl_test_lib:check_server_alert(Server, user_canceled).
 %%--------------------------------------------------------------------
 hello_server_cancel() ->
     [{doc, "Test API function ssl:handshake_cancel/1 on the server side"}].
@@ -1183,9 +1176,8 @@ fallback(Config) when is_list(Config) ->
                                                            [{fallback, true},
                                                             {versions, ['tlsv1']}
                                                             | ClientOpts]}]),
-    
-    ssl_test_lib:check_result(Server, {error,{tls_alert,"inappropriate fallback"}},
-                              Client, {error,{tls_alert,"inappropriate fallback"}}).
+    ssl_test_lib:check_server_alert(Server, Client, inappropriate_fallback).
+   
 
 %%--------------------------------------------------------------------
 cipher_format() ->
@@ -2651,8 +2643,7 @@ default_reject_anonymous(Config) when is_list(Config) ->
                                                [{ciphers,[CipherSuite]} |
                                                 ClientOpts]}]),
 
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "insufficient security"}},
-                              Client, {error, {tls_alert, "insufficient security"}}).
+    ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
 
 %%--------------------------------------------------------------------
 ciphers_ecdsa_signed_certs() ->
@@ -3504,8 +3495,7 @@ no_common_signature_algs(Config) when is_list(Config) ->
                                               {options, [{signature_algs, [{sha384, rsa}]}
                                                          | ClientOpts]}]),
     
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "insufficient security"}},
-                              Client, {error, {tls_alert, "insufficient security"}}).
+    ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
 
 %%--------------------------------------------------------------------
 
@@ -4205,8 +4195,7 @@ tls_versions_option(Config) when is_list(Config) ->
 	{Server, _} ->
 	    ok
     end,	    
-   
-    ssl_test_lib:check_result(ErrClient, {error, {tls_alert, "protocol version"}}).
+    ssl_test_lib:check_client_alert(ErrClient, protocol_version).
 
 
 %%--------------------------------------------------------------------
diff --git a/lib/ssl/test/ssl_certificate_verify_SUITE.erl b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
index 588ca153a9..c0a5367a57 100644
--- a/lib/ssl/test/ssl_certificate_verify_SUITE.erl
+++ b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
@@ -298,15 +298,8 @@ server_require_peer_cert_fail(Config) when is_list(Config) ->
 					      {host, Hostname},
 					      {from, self()},
 					      {options, [{active, Active} | BadClientOpts]}]),
-    receive
-	{Server, {error, {tls_alert, "handshake failure"}}} ->
-	    receive
-		{Client, {error, {tls_alert, "handshake failure"}}} ->
-		    ok;
-		{Client, {error, closed}} ->
-		    ok
-	    end
-    end.
+
+    ssl_test_lib:check_server_alert(Server, Client, handshake_failure).
 
 %%--------------------------------------------------------------------
 server_require_peer_cert_empty_ok() ->
@@ -365,15 +358,8 @@ server_require_peer_cert_partial_chain(Config) when is_list(Config) ->
 					      {options, [{active, Active},
 							 {cacerts, [RootCA]} |
 							 proplists:delete(cacertfile, ClientOpts)]}]),
-    receive
-	{Server, {error, {tls_alert, "unknown ca"}}} ->
-	    receive
-		{Client, {error, {tls_alert, "unknown ca"}}} ->
-		    ok;
-		{Client, {error, closed}} ->
-		    ok
-	    end
-    end.
+    ssl_test_lib:check_server_alert(Server, Client, unknown_ca).
+
 %%--------------------------------------------------------------------
 server_require_peer_cert_allow_partial_chain() ->
     [{doc, "Server trusts intermediat CA and accepts a partial chain. (partial_chain option)"}].
@@ -446,17 +432,7 @@ server_require_peer_cert_do_not_allow_partial_chain(Config) when is_list(Config)
 					      {from, self()},
 					      {mfa, {ssl_test_lib, no_result, []}},
 					      {options, ClientOpts}]),
-
-    receive
-	 {Server, {error, {tls_alert, "unknown ca"}}} ->
-	    receive
-		{Client, {error, {tls_alert, "unknown ca"}}} ->
-		    ok;
-		{Client, {error, closed}} ->
-		    ok
-	    end
-    end.
-
+    ssl_test_lib:check_server_alert(Server, Client, unknown_ca).
  %%--------------------------------------------------------------------
 server_require_peer_cert_partial_chain_fun_fail() ->
     [{doc, "If parial_chain fun crashes, treat it as if it returned unkown_ca"}].
@@ -487,16 +463,7 @@ server_require_peer_cert_partial_chain_fun_fail(Config) when is_list(Config) ->
 					      {from, self()},
 					      {mfa, {ssl_test_lib, no_result, []}},
 					      {options, ClientOpts}]),
-
-    receive
-	 {Server, {error, {tls_alert, "unknown ca"}}} ->
-	    receive
-		{Client, {error, {tls_alert, "unknown ca"}}} ->
-		    ok;
-		{Client, {error, closed}} ->
-		    ok
-	    end
-    end.
+    ssl_test_lib:check_server_alert(Server, Client, unknown_ca).
 
 %%--------------------------------------------------------------------
 verify_fun_always_run_client() ->
@@ -535,14 +502,8 @@ verify_fun_always_run_client(Config) when is_list(Config) ->
 					       [{verify, verify_peer},
 						{verify_fun, FunAndState}
 						| ClientOpts]}]),
-    %% Server error may be {tls_alert,"handshake failure"} or closed depending on timing
-    %% this is not a bug it is a circumstance of how tcp works!
-    receive
-	{Server, ServerError} ->
-	    ct:log("Server Error ~p~n", [ServerError])
-    end,
 
-    ssl_test_lib:check_result(Client, {error, {tls_alert, "handshake failure"}}).
+    ssl_test_lib:check_client_alert(Server, Client, handshake_failure).
 
 %%--------------------------------------------------------------------
 verify_fun_always_run_server() ->
@@ -581,16 +542,8 @@ verify_fun_always_run_server(Config) when is_list(Config) ->
 					      {mfa, {ssl_test_lib,
 						     no_result, []}},
 					      {options, ClientOpts}]),
-
-    %% Client error may be {tls_alert, "handshake failure" } or closed depending on timing
-    %% this is not a bug it is a circumstance of how tcp works!
-    receive
-	{Client, ClientError} ->
-	    ct:log("Client Error ~p~n", [ClientError])
-    end,
-
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "handshake failure"}}).
-
+    
+    ssl_test_lib:check_client_alert(Server, Client, handshake_failure).
 %%--------------------------------------------------------------------
 
 cert_expired() ->
@@ -620,8 +573,7 @@ cert_expired(Config) when is_list(Config) ->
 					      {from, self()},
 					      {options, [{verify, verify_peer}, {active, Active}  | ClientOpts]}]),    
     
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "certificate expired"}},
-                              Client, {error, {tls_alert, "certificate expired"}}).
+    ssl_test_lib:check_client_alert(Server, Client, certificate_expired).
 
 two_digits_str(N) when N < 10 ->
     lists:flatten(io_lib:format("0~p", [N]));
@@ -727,12 +679,8 @@ critical_extension_verify_server(Config) when is_list(Config) ->
                 {options, [{verify, verify_none}, {active, Active} | ClientOpts]}]),
 
     %% This certificate has a critical extension that we don't
-    %% understand.  Therefore, verification should fail.      
-
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "unsupported certificate"}},
-                              Client, {error, {tls_alert, "unsupported certificate"}}),
-    
-    ssl_test_lib:close(Server).
+    %% understand.  Therefore, verification should fail.          
+    ssl_test_lib:check_server_alert(Server, Client, unsupported_certificate).
 %%--------------------------------------------------------------------
 
 critical_extension_verify_client() ->
@@ -763,12 +711,7 @@ critical_extension_verify_client(Config) when is_list(Config) ->
                 {mfa, {ssl_test_lib, ReceiveFunction, []}},
                 {options, [{verify, verify_peer}, {active, Active} | ClientOpts]}]),
 
-    %% This certificate has a critical extension that we don't
-    %% understand.  Therefore, verification should fail.
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "unsupported certificate"}},
-                              Client, {error, {tls_alert, "unsupported certificate"}}),
-
-    ssl_test_lib:close(Server).
+    ssl_test_lib:check_client_alert(Server, Client, unsupported_certificate).
 
 %%--------------------------------------------------------------------
 critical_extension_verify_none() ->
@@ -908,10 +851,7 @@ invalid_signature_server(Config) when is_list(Config) ->
 					      {host, Hostname},
 					      {from, self()},
 					      {options, [{verify, verify_peer} | ClientOpts]}]),
-
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "unknown ca"}},
-                              Client, {error, {tls_alert, "unknown ca"}}).
-
+    ssl_test_lib:check_server_alert(Server, Client, unknown_ca).
 %%--------------------------------------------------------------------
 
 invalid_signature_client() ->
@@ -946,9 +886,7 @@ invalid_signature_client(Config) when is_list(Config) ->
 					      {from, self()},
 					      {options, NewClientOpts}]),
 
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "unknown ca"}},
-                              Client, {error, {tls_alert, "unknown ca"}}).
-
+    ssl_test_lib:check_client_alert(Server, Client, unknown_ca).
 
 %%--------------------------------------------------------------------
 
@@ -1034,16 +972,7 @@ unknown_server_ca_fail(Config) when is_list(Config) ->
 					       [{verify, verify_peer},
 						{verify_fun, FunAndState}
 						| ClientOpts]}]),
-    receive
-	{Client, {error, {tls_alert, "unknown ca"}}} ->
-	    receive
-		{Server, {error, {tls_alert, "unknown ca"}}} ->
-		    ok;
-		{Server, {error, closed}} ->
-		    ok
-	    end
-    end.
-
+    ssl_test_lib:check_client_alert(Server, Client, unknown_ca).
 
 %%--------------------------------------------------------------------
 unknown_server_ca_accept_verify_none() ->
@@ -1193,11 +1122,7 @@ customize_hostname_check(Config) when is_list(Config) ->
                                                {mfa, {ssl_test_lib, no_result, []}},
                                                {options, ClientOpts}
                                               ]),    
-    ssl_test_lib:check_result(Client1, {error, {tls_alert, "handshake failure"}},
-                              Server,  {error, {tls_alert, "handshake failure"}}),
-    
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
+    ssl_test_lib:check_client_alert(Server, Client1, handshake_failure).
 
 incomplete_chain() ->
     [{doc,"Test option verify_peer"}].
diff --git a/lib/ssl/test/ssl_crl_SUITE.erl b/lib/ssl/test/ssl_crl_SUITE.erl
index c61039b5da..b2fd3874a8 100644
--- a/lib/ssl/test/ssl_crl_SUITE.erl
+++ b/lib/ssl/test/ssl_crl_SUITE.erl
@@ -238,7 +238,7 @@ crl_verify_revoked(Config)  when is_list(Config) ->
 		  end,	
     
     crl_verify_error(Hostname, ServerNode, ServerOpts, ClientNode, ClientOpts,
-                     "certificate revoked").
+                     certificate_revoked).
 
 crl_verify_no_crl() ->
     [{doc,"Verify a simple CRL chain when the CRL is missing"}].
@@ -277,10 +277,10 @@ crl_verify_no_crl(Config) when is_list(Config) ->
             %% The error "revocation status undetermined" gets turned
             %% into "bad certificate".
             crl_verify_error(Hostname, ServerNode, ServerOpts, ClientNode, ClientOpts,
-                             "bad certificate");
+                             bad_certificate);
         peer ->
             crl_verify_error(Hostname, ServerNode, ServerOpts, ClientNode, ClientOpts,
-                             "bad certificate");
+                             bad_certificate);
         best_effort ->
             %% In "best effort" mode, we consider the certificate not
             %% to be revoked if we can't find the appropriate CRL.
@@ -341,7 +341,7 @@ crl_hash_dir_collision(Config) when is_list(Config) ->
 
     %% First certificate revoked; first fails, second succeeds.
     crl_verify_error(Hostname, ServerNode, ServerOpts1, ClientNode, ClientOpts,
-                     "certificate revoked"),
+                     certificate_revoked),
     crl_verify_valid(Hostname, ServerNode, ServerOpts2, ClientNode, ClientOpts),
 
     make_certs:revoke(PrivDir, CA2, "collision-client-2", CertsConfig),
@@ -352,9 +352,9 @@ crl_hash_dir_collision(Config) when is_list(Config) ->
 
     %% Second certificate revoked; both fail.
     crl_verify_error(Hostname, ServerNode, ServerOpts1, ClientNode, ClientOpts,
-                     "certificate revoked"),
+                     certificate_revoked),
     crl_verify_error(Hostname, ServerNode, ServerOpts2, ClientNode, ClientOpts,
-                     "certificate revoked"),
+                     certificate_revoked),
 
     ok.
 
@@ -400,10 +400,10 @@ crl_hash_dir_expired(Config) when is_list(Config) ->
             %% The error "revocation status undetermined" gets turned
             %% into "bad certificate".
             crl_verify_error(Hostname, ServerNode, ServerOpts, ClientNode, ClientOpts,
-                             "bad certificate");
+                             bad_certificate);
         peer ->
             crl_verify_error(Hostname, ServerNode, ServerOpts, ClientNode, ClientOpts,
-                             "bad certificate");
+                             bad_certificate);
         best_effort ->
             %% In "best effort" mode, we consider the certificate not
             %% to be revoked if we can't find the appropriate CRL.
@@ -451,11 +451,8 @@ crl_verify_error(Hostname, ServerNode, ServerOpts, ClientNode, ClientOpts, Expec
 					      {host, Hostname},
 					      {from, self()},
 					      {options, ClientOpts}]),
-    receive
-	{Server, AlertOrClose} ->
-	    ct:pal("Server Alert or Close ~p", [AlertOrClose])
-    end,
-    ssl_test_lib:check_result(Client, {error, {tls_alert, ExpectedAlert}}).
+
+    ssl_test_lib:check_client_alert(Server, Client, ExpectedAlert).
 
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
diff --git a/lib/ssl/test/ssl_sni_SUITE.erl b/lib/ssl/test/ssl_sni_SUITE.erl
index 251b6a2639..7629d75100 100644
--- a/lib/ssl/test/ssl_sni_SUITE.erl
+++ b/lib/ssl/test/ssl_sni_SUITE.erl
@@ -236,8 +236,8 @@ dns_name_reuse(Config) ->
                                          {mfa, {ssl_test_lib, session_info_result, []}},
                                          {from, self()},  {options, [{verify, verify_peer} | ClientConf]}]),
     
-    ssl_test_lib:check_result(Client1, {error, {tls_alert, "handshake failure"}}),
-    ssl_test_lib:close(Client0).
+    ssl_test_lib:check_client_alert(Client1, handshake_failure).
+
 %%--------------------------------------------------------------------
 %% Internal Functions ------------------------------------------------
 %%--------------------------------------------------------------------
@@ -370,8 +370,8 @@ unsuccessfull_connect(ServerOptions, ClientOptions, Hostname0, Config) ->
 					      {from, self()}, 
 					      {options, ClientOptions}]),
     
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "handshake failure"}},
-			      Client, {error, {tls_alert, "handshake failure"}}).
+    ssl_test_lib:check_server_alert(Server, Client, handshake_failure).
+
 host_name(undefined, Hostname) ->
     Hostname;
 host_name(Hostname, _) ->
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 3eb505de1d..d51fa9d64f 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -438,6 +438,37 @@ check_result(Pid, Msg) ->
 		      {got, Unexpected}},
 	    ct:fail(Reason)
     end.
+check_server_alert(Pid, Alert) ->
+    receive
+	{Pid, {error, {tls_alert, {Alert, _}}}} ->
+            ok
+    end.
+check_server_alert(Server, Client, Alert) ->
+    receive
+	{Server, {error, {tls_alert, {Alert, _}}}} ->
+	    receive
+		{Client, {error, {tls_alert, {Alert, _}}}} ->
+		    ok;
+		{Client, {error, closed}} ->
+		    ok
+	    end
+    end.
+check_client_alert(Pid, Alert) ->
+    receive
+	{Pid, {error, {tls_alert, {Alert, _}}}} ->
+            ok
+    end.
+check_client_alert(Server, Client, Alert) ->
+    receive
+	{Client, {error, {tls_alert, {Alert, _}}}} ->
+	    receive
+		{Server, {error, {tls_alert, {Alert, _}}}} ->
+		    ok;
+		{Server, {error, closed}} ->
+		    ok
+	    end
+    end.
+
 
 wait_for_result(Server, ServerMsg, Client, ClientMsg) -> 
     receive 
@@ -1072,8 +1103,7 @@ ecc_test(Expect, COpts, SOpts, CECCOpts, SECCOpts, Config) ->
 ecc_test_error(COpts, SOpts, CECCOpts, SECCOpts, Config) ->
     {Server, Port} = start_server_ecc_error(erlang, SOpts, SECCOpts, Config),
     Client = start_client_ecc_error(erlang, Port, COpts, CECCOpts, Config),
-    Error = {error, {tls_alert, "insufficient security"}},
-    check_result(Server, Error, Client, Error).
+    check_server_alert(Server, Client, insufficient_security).
 
 start_client(openssl, Port, ClientOpts, Config) ->
     Cert = proplists:get_value(certfile, ClientOpts),
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index d180021439..87a1edfd96 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -1249,7 +1249,7 @@ ssl2_erlang_server_openssl_client(Config) when is_list(Config) ->
 
     ct:log("Ports ~p~n", [[erlang:port_info(P) || P <- erlang:ports()]]), 
     ssl_test_lib:consume_port_exit(OpenSslPort),
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "bad record mac"}}),
+    ssl_test_lib:check_server_alert(Server, bad_record_mac),
     process_flag(trap_exit, false).
 
 %%--------------------------------------------------------------------