Merge 17919 - We don't handle certificate errors during SSL renegotiation....

net/http/http_network_transaction.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/scoped_ptr.h"
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/string_util.h"
@@ skipping 735 matching lines @@
     return ERR_EMPTY_RESPONSE;
   }
 
   // Assume everything else is a HTTP/0.9 response (including responses
   // of 'h', 'ht', 'htt').
   header_buf_body_offset_ = 0;
   return OK;
 }
 
 int HttpNetworkTransaction::DoReadHeadersComplete(int result) {
+  if (using_ssl_ && IsCertificateError(result)) {
+    // We don't handle a certificate error during SSL renegotiation, so we
+    // have to return an error that's not in the certificate error range
+    // (-2xx).
+    LOG(ERROR) << "Got a server certificate with error " << result
+               << " during SSL renegotiation";
+    result = ERR_CERT_ERROR_IN_SSL_RENEGOTIATION;
+  }
+
   if (result < 0)
     return HandleIOError(result);
 
   if (result == 0 && ShouldResendRequest())
     return result;
 
   // Record our best estimate of the 'response time' as the time when we read
   // the first bytes of the response headers.
   if (header_buf_len_ == 0)
     response_.response_time = Time::Now();
@@ skipping 766 matching lines @@
   if (target == HttpAuth::AUTH_PROXY) {
     auth_info->host = ASCIIToWide(proxy_info_.proxy_server().host_and_port());
   } else {
     DCHECK(target == HttpAuth::AUTH_SERVER);
     auth_info->host = ASCIIToWide(request_->url.host());
   }
   response_.auth_challenge = auth_info;
 }
 
 }  // namespace net