SSL fixes for sites with buggy DEFLATE support.

net/http/http_network_transaction.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/format_macros.h"
 #include "base/histogram.h"
 #include "base/scoped_ptr.h"
 #include "base/stats_counters.h"
+#include "base/stl_util-inl.h"
 #include "base/string_util.h"
 #include "base/trace_event.h"
 #include "build/build_config.h"
 #include "net/base/connection_type_histograms.h"
 #include "net/base/io_buffer.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/base/ssl_cert_request_info.h"
 #include "net/base/upload_data_stream.h"
@@ skipping 18 matching lines @@
 
 using base::Time;
 
 namespace net {
 
 namespace {
 
 const std::string* g_next_protos = NULL;
 bool g_use_alternate_protocols = false;
 
+// A set of host:port strings. These are servers which we have needed to back
+// off to SSLv3 for.
+std::set<std::string>* g_tls_intolerant_servers = NULL;
+
 void BuildRequestHeaders(const HttpRequestInfo* request_info,
                          const HttpRequestHeaders& authorization_headers,
                          const UploadDataStream* upload_data_stream,
                          bool using_proxy,
                          HttpRequestHeaders* request_headers) {
   const std::string path = using_proxy ?
       HttpUtil::SpecForRequest(request_info->url) :
       HttpUtil::PathForRequest(request_info->url);
   request_headers->SetRequestLine(
       request_info->method, path, "1.1");
@@ skipping 177 matching lines @@
       alternate_protocol_mode_(
           g_use_alternate_protocols ? kUnspecified :
           kDoNotUseAlternateProtocol),
       embedded_identity_used_(false),
       default_credentials_used_(false),
       read_buf_len_(0),
       next_state_(STATE_NONE) {
   session->ssl_config_service()->GetSSLConfig(&ssl_config_);
   if (g_next_protos)
     ssl_config_.next_protos = *g_next_protos;
+  if (!g_tls_intolerant_servers)
+    g_tls_intolerant_servers = new std::set<std::string>;
 }
 
 // static
 void HttpNetworkTransaction::SetUseAlternateProtocols(bool value) {
   g_use_alternate_protocols = value;
 }
 
 // static
 void HttpNetworkTransaction::SetNextProtos(const std::string& next_protos) {
   delete g_next_protos;
@@ skipping 580 matching lines @@
         establishing_tunnel_ = true;
     }
   }
 
   return OK;
 }
 
 int HttpNetworkTransaction::DoSSLConnect() {
   next_state_ = STATE_SSL_CONNECT_COMPLETE;
 
+  if (ContainsKey(*g_tls_intolerant_servers, GetHostAndPort(request_->url))) {
+    LOG(WARNING) << "Falling back to SSLv3 because host is TLS intolerant: "
+                 << GetHostAndPort(request_->url);
+    ssl_config_.tls1_enabled = false;
+  }
+
   if (request_->load_flags & LOAD_VERIFY_EV_CERT)
     ssl_config_.verify_ev_cert = true;
 
   ssl_connect_start_time_ = base::TimeTicks::Now();
 
   // Add a SSL socket on top of our existing transport socket.
   ClientSocket* s = connection_->release_socket();
   s = session_->socket_factory()->CreateSSLClientSocket(
       s, request_->url.HostNoBrackets(), ssl_config_);
   connection_->set_socket(s);
@@ skipping 157 matching lines @@
       // We don't handle a certificate error during SSL renegotiation, so we
       // have to return an error that's not in the certificate error range
       // (-2xx).
       LOG(ERROR) << "Got a server certificate with error " << result
                  << " during SSL renegotiation";
       result = ERR_CERT_ERROR_IN_SSL_RENEGOTIATION;
     } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
       result = HandleCertificateRequest(result);
       if (result == OK)
         return result;
+    } else if (result == ERR_SSL_DECOMPRESSION_FAILURE_ALERT &&
+               ssl_config_.tls1_enabled) {
+      // Some buggy servers select DEFLATE compression when offered and then
+      // fail to ever decompress anything. They will send a fatal alert telling
+      // us this. Normally we would pick this up during the handshake because
+      // our Finished message is compressed and we'll never get the server's
+      // Finished if it fails to process ours.
+      //
+      // However, with False Start, we'll believe that the handshake is
+      // complete as soon as we've /sent/ our Finished message. In this case,
+      // we only find out that the server is buggy here, when we try to read
+      // the initial reply.
+      g_tls_intolerant_servers->insert(GetHostAndPort(request_->url));
+      ResetConnectionAndRequestForResend();
+      return OK;
     }
   }
 
   if (result < 0 && result != ERR_CONNECTION_CLOSED)
     return HandleIOError(result);
 
   if (result == ERR_CONNECTION_CLOSED && ShouldResendRequest(result)) {
     ResetConnectionAndRequestForResend();
     return OK;
   }
@@ skipping 480 matching lines @@
 int HttpNetworkTransaction::HandleSSLHandshakeError(int error) {
   if (ssl_config_.send_client_cert &&
      (error == ERR_SSL_PROTOCOL_ERROR ||
       error == ERR_BAD_SSL_CLIENT_AUTH_CERT)) {
     session_->ssl_client_auth_cache()->Remove(GetHostAndPort(request_->url));
   }
 
   switch (error) {
     case ERR_SSL_PROTOCOL_ERROR:
     case ERR_SSL_VERSION_OR_CIPHER_MISMATCH:
+    case ERR_SSL_DECOMPRESSION_FAILURE_ALERT:
       if (ssl_config_.tls1_enabled) {
         // This could be a TLS-intolerant server or an SSL 3.0 server that
         // chose a TLS-only cipher suite.  Turn off TLS 1.0 and retry.
-        ssl_config_.tls1_enabled = false;
-        connection_->socket()->Disconnect();
-        connection_->Reset();
-        next_state_ = STATE_INIT_CONNECTION;
+        g_tls_intolerant_servers->insert(GetHostAndPort(request_->url));
+        ResetConnectionAndRequestForResend();
         error = OK;
       }
       break;
   }
   return error;
 }
 
 // This method determines whether it is safe to resend the request after an
 // IO error.  It can only be called in response to request header or body
 // write errors or response header read errors.  It should not be used in
@@ skipping 430 matching lines @@
       http_host_port_pair);
 
   alternate_protocol_mode_ = kDoNotUseAlternateProtocol;
   if (connection_->socket())
     connection_->socket()->Disconnect();
   connection_->Reset();
   next_state_ = STATE_INIT_CONNECTION;
 }
 
 }  // namespace net