Implement SSLClientSocketPool.

net/http/http_network_transaction.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/format_macros.h"
 #include "base/histogram.h"
@@ skipping 22 matching lines @@
 #include "net/http/http_proxy_client_socket_pool.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_request_info.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_response_info.h"
 #include "net/http/http_util.h"
 #include "net/http/url_security_manager.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/socks_client_socket_pool.h"
 #include "net/socket/ssl_client_socket.h"
+#include "net/socket/ssl_client_socket_pool.h"
 #include "net/socket/tcp_client_socket_pool.h"
 #include "net/spdy/spdy_http_stream.h"
 #include "net/spdy/spdy_session.h"
 #include "net/spdy/spdy_session_pool.h"
 
 using base::Time;
 
 namespace net {
 
 namespace {
@@ skipping 199 matching lines @@
 
   next_state_ = STATE_RESOLVE_PROXY;
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_callback_ = callback;
   return rv;
 }
 
 int HttpNetworkTransaction::RestartIgnoringLastError(
     CompletionCallback* callback) {
-  if (connection_->socket()->IsConnectedAndIdle()) {
+  if (connection_->socket() && connection_->socket()->IsConnectedAndIdle()) {
     // TODO(wtc): Should we update any of the connection histograms that we
     // update in DoSSLConnectComplete if |result| is OK?
     if (using_spdy_) {
       // TODO(cbentzel): Add auth support to spdy. See http://crbug.com/46620
       next_state_ = STATE_SPDY_SEND_REQUEST;
     } else {
       next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN;
     }
   } else {
-    connection_->socket()->Disconnect();
+    if (connection_->socket())
+      connection_->socket()->Disconnect();
     connection_->Reset();
     next_state_ = STATE_INIT_CONNECTION;
   }
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_callback_ = callback;
   return rv;
 }
 
 int HttpNetworkTransaction::RestartWithCertificate(
@@ skipping 23 matching lines @@
   if (target == HttpAuth::AUTH_NONE) {
     NOTREACHED();
     return ERR_UNEXPECTED;
   }
   pending_auth_target_ = HttpAuth::AUTH_NONE;
 
   auth_controllers_[target]->ResetAuth(username, password);
 
   if (target == HttpAuth::AUTH_PROXY && using_ssl_ && proxy_info_.is_http()) {
     DCHECK(establishing_tunnel_);
+    next_state_ = STATE_INIT_CONNECTION;
     ResetStateForRestart();
-    next_state_ = STATE_TUNNEL_RESTART_WITH_AUTH;
   } else {
     PrepareForAuthRestart(target);
   }
 
   DCHECK(user_callback_ == NULL);
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_callback_ = callback;
 
   return rv;
@@ skipping 41 matching lines @@
   ResetStateForRestart();
 }
 
 int HttpNetworkTransaction::Read(IOBuffer* buf, int buf_len,
                                  CompletionCallback* callback) {
   DCHECK(buf);
   DCHECK_LT(0, buf_len);
 
   State next_state = STATE_NONE;
 
-  // Are we using SPDY or HTTP?
-  if (using_spdy_) {
-    DCHECK(!http_stream_.get());
-    DCHECK(spdy_http_stream_->GetResponseInfo()->headers);
-    next_state = STATE_SPDY_READ_BODY;
-  } else {
-    DCHECK(!spdy_http_stream_.get());
-    next_state = STATE_READ_BODY;
-
-    if (!connection_->is_initialized())
-      return 0;  // connection_->has been reset.  Treat like EOF.
-  }
-
   scoped_refptr<HttpResponseHeaders> headers = GetResponseHeaders();
-  DCHECK(headers.get());
-  if (establishing_tunnel_) {
+  if (headers_valid_ && headers.get() && establishing_tunnel_) {
     // We're trying to read the body of the response but we're still trying
     // to establish an SSL tunnel through the proxy.  We can't read these
     // bytes when establishing a tunnel because they might be controlled by
     // an active network attacker.  We don't worry about this for HTTP
     // because an active network attacker can already control HTTP sessions.
     // We reach this case when the user cancels a 407 proxy auth prompt.
     // See http://crbug.com/8473.
     DCHECK(proxy_info_.is_http());
     DCHECK_EQ(headers->response_code(), 407);
     LOG(WARNING) << "Blocked proxy response with status "
                  << headers->response_code() << " to CONNECT request for "
                  << GetHostAndPort(request_->url) << ".";
     return ERR_TUNNEL_CONNECTION_FAILED;
   }
 
+  // Are we using SPDY or HTTP?
+  if (using_spdy_) {
+    DCHECK(!http_stream_.get());
+    DCHECK(spdy_http_stream_->GetResponseInfo()->headers);
+    next_state = STATE_SPDY_READ_BODY;
+  } else {
+    DCHECK(!spdy_http_stream_.get());
+    next_state = STATE_READ_BODY;
+
+    if (!connection_->is_initialized())
+      return 0;  // |*connection_| has been reset.  Treat like EOF.
+  }
+
   read_buf_ = buf;
   read_buf_len_ = buf_len;
 
   next_state_ = next_state;
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_callback_ = callback;
   return rv;
 }
 
@@ skipping 89 matching lines @@
       case STATE_RESOLVE_PROXY_COMPLETE:
         rv = DoResolveProxyComplete(rv);
         break;
       case STATE_INIT_CONNECTION:
         DCHECK_EQ(OK, rv);
         rv = DoInitConnection();
         break;
       case STATE_INIT_CONNECTION_COMPLETE:
         rv = DoInitConnectionComplete(rv);
         break;
-      case STATE_TUNNEL_RESTART_WITH_AUTH:
-        DCHECK_EQ(OK, rv);
-        rv = DoTunnelRestartWithAuth();
-        break;
-      case STATE_SSL_CONNECT:
-        DCHECK_EQ(OK, rv);
-        rv = DoSSLConnect();
-        break;
-      case STATE_SSL_CONNECT_COMPLETE:
-        rv = DoSSLConnectComplete(rv);
-        break;
       case STATE_GENERATE_PROXY_AUTH_TOKEN:
         DCHECK_EQ(OK, rv);
         rv = DoGenerateProxyAuthToken();
         break;
       case STATE_GENERATE_PROXY_AUTH_TOKEN_COMPLETE:
         rv = DoGenerateProxyAuthTokenComplete(rv);
         break;
       case STATE_GENERATE_SERVER_AUTH_TOKEN:
         DCHECK_EQ(OK, rv);
         rv = DoGenerateServerAuthToken();
@@ skipping 154 matching lines @@
     return ERR_NO_SUPPORTED_PROXIES;
   }
 
   next_state_ = STATE_INIT_CONNECTION;
   return OK;
 }
 
 int HttpNetworkTransaction::DoInitConnection() {
   DCHECK(!connection_->is_initialized());
   DCHECK(proxy_info_.proxy_server().is_valid());
+  next_state_ = STATE_INIT_CONNECTION_COMPLETE;
 
   // Now that the proxy server has been resolved, create the auth_controllers_.
   for (int i = 0; i < HttpAuth::AUTH_NUM_TARGETS; i++) {
     HttpAuth::Target target = static_cast<HttpAuth::Target>(i);
     if (!auth_controllers_[target].get())
       auth_controllers_[target] = new HttpAuthController(target,
                                                          AuthURL(target),
                                                          session_);
   }
 
-  next_state_ = STATE_INIT_CONNECTION_COMPLETE;
-
-  using_ssl_ = request_->url.SchemeIs("https") ||
-      (alternate_protocol_mode_ == kUsingAlternateProtocol &&
-       alternate_protocol_ == HttpAlternateProtocols::NPN_SPDY_1);
-
+  bool want_spdy = alternate_protocol_mode_ == kUsingAlternateProtocol
+      && alternate_protocol_ == HttpAlternateProtocols::NPN_SPDY_1;
+  using_ssl_ = request_->url.SchemeIs("https") || want_spdy;
   using_spdy_ = false;
-
-  // Build the string used to uniquely identify connections of this type.
-  // Determine the host and port to connect to.
-  std::string connection_group;
+  response_.was_fetched_via_proxy = !proxy_info_.is_direct();
 
   // Use the fixed testing ports if they've been provided.
   if (using_ssl_) {
     if (session_->fixed_https_port() != 0)
       endpoint_.port = session_->fixed_https_port();
   } else if (session_->fixed_http_port() != 0) {
     endpoint_.port = session_->fixed_http_port();
   }
 
-  response_.was_fetched_via_proxy = !proxy_info_.is_direct();
-
   // Check first if we have a spdy session for this group.  If so, then go
   // straight to using that.
   if (session_->spdy_session_pool()->HasSession(endpoint_)) {
     using_spdy_ = true;
     reused_socket_ = true;
+    next_state_ = STATE_SPDY_SEND_REQUEST;
     return OK;
   }
 
-  connection_group = endpoint_.ToString();
+  // Build the string used to uniquely identify connections of this type.
+  // Determine the host and port to connect to.
+  std::string connection_group = endpoint_.ToString();
   DCHECK(!connection_group.empty());
 
   if (using_ssl_)
     connection_group = StringPrintf("ssl/%s", connection_group.c_str());
 
   // If the user is refreshing the page, bypass the host cache.
   bool disable_resolver_cache = request_->load_flags & LOAD_BYPASS_CACHE ||
                                 request_->load_flags & LOAD_VALIDATE_CACHE ||
                                 request_->load_flags & LOAD_DISABLE_CACHE;
 
-  int rv;
-  if (!proxy_info_.is_direct()) {
+  // Build up the connection parameters.
+  scoped_refptr<TCPSocketParams> tcp_params;
+  scoped_refptr<HttpProxySocketParams> http_proxy_params;
+  scoped_refptr<SOCKSSocketParams> socks_params;
+  scoped_ptr<HostPortPair> proxy_host_port;
+
+  if (proxy_info_.is_direct()) {
+    tcp_params = new TCPSocketParams(endpoint_, request_->priority,
+                                     request_->referrer,
+                                     disable_resolver_cache);
+  } else {
     ProxyServer proxy_server = proxy_info_.proxy_server();
-    HostPortPair proxy_host_port_pair(proxy_server.HostNoBrackets(),
-                                      proxy_server.port());
-
-    scoped_refptr<TCPSocketParams> tcp_params =
-        new TCPSocketParams(proxy_host_port_pair, request_->priority,
+    proxy_host_port.reset(new HostPortPair(proxy_server.HostNoBrackets(),
+                                           proxy_server.port()));
+    scoped_refptr<TCPSocketParams> proxy_tcp_params =
+        new TCPSocketParams(*proxy_host_port, request_->priority,
                             request_->referrer, disable_resolver_cache);
 
-    if (proxy_info_.is_socks()) {
-      const char* socks_version;
-      bool socks_v5;
-      if (proxy_info_.proxy_server().scheme() == ProxyServer::SCHEME_SOCKS5) {
-        socks_version = "5";
-        socks_v5 = true;
-      } else {
-        socks_version = "4";
-        socks_v5 = false;
-      }
-
-      connection_group =
-          StringPrintf("socks%s/%s", socks_version, connection_group.c_str());
-
-      scoped_refptr<SOCKSSocketParams> socks_params =
-          new SOCKSSocketParams(tcp_params, socks_v5, endpoint_,
-                                request_->priority, request_->referrer);
-
-      rv = connection_->Init(
-          connection_group, socks_params, request_->priority,
-          &io_callback_,
-          session_->GetSocketPoolForSOCKSProxy(proxy_host_port_pair), net_log_);
-    } else {
-      DCHECK(proxy_info_.is_http());
+    if (proxy_info_.is_http()) {
       scoped_refptr<HttpAuthController> http_proxy_auth;
       if (using_ssl_) {
         http_proxy_auth = auth_controllers_[HttpAuth::AUTH_PROXY];
         establishing_tunnel_ = true;
       }
+      http_proxy_params = new HttpProxySocketParams(proxy_tcp_params,
+                                                    request_->url, endpoint_,
+                                                    http_proxy_auth,
+                                                    using_ssl_);
+    } else {
+      DCHECK(proxy_info_.is_socks());
+      char socks_version;
+      if (proxy_server.scheme() == ProxyServer::SCHEME_SOCKS5)
+        socks_version = '5';
+      else
+        socks_version = '4';
+      connection_group =
+          StringPrintf("socks%c/%s", socks_version, connection_group.c_str());
 
-      scoped_refptr<HttpProxySocketParams> http_proxy_params =
-          new HttpProxySocketParams(tcp_params, request_->url, endpoint_,
-                                    http_proxy_auth, using_ssl_);
+      socks_params = new SOCKSSocketParams(proxy_tcp_params,
+                                           socks_version == '5',
+                                           endpoint_,
+                                           request_->priority,
+                                           request_->referrer);
+    }
+  }
 
-      rv = connection_->Init(connection_group, http_proxy_params,
-                             request_->priority, &io_callback_,
-                             session_->GetSocketPoolForHTTPProxy(
-                                 proxy_host_port_pair),
-                             net_log_);
+  // Deal with SSL - which layers on top of any given proxy.
+  if (using_ssl_) {
+    if (ContainsKey(*g_tls_intolerant_servers, GetHostAndPort(request_->url))) {
+      LOG(WARNING) << "Falling back to SSLv3 because host is TLS intolerant: "
+                   << GetHostAndPort(request_->url);
+      ssl_config_.tls1_enabled = false;
     }
-  } else {
-    scoped_refptr<TCPSocketParams> tcp_params =
-        new TCPSocketParams(endpoint_, request_->priority, request_->referrer,
-                            disable_resolver_cache);
-    rv = connection_->Init(connection_group, tcp_params, request_->priority,
+
+    int load_flags = request_->load_flags;
+    if (g_ignore_certificate_errors)
+      load_flags |= LOAD_IGNORE_ALL_CERT_ERRORS;
+    if (request_->load_flags & LOAD_VERIFY_EV_CERT)
+      ssl_config_.verify_ev_cert = true;
+
+    scoped_refptr<SSLSocketParams> ssl_params =
+        new SSLSocketParams(tcp_params, http_proxy_params, socks_params,
+                            proxy_info_.proxy_server().scheme(),
+                            request_->url.HostNoBrackets(), ssl_config_,
+                            load_flags, want_spdy);
+
+    scoped_refptr<SSLClientSocketPool> ssl_pool;
+    if (proxy_info_.is_direct())
+      ssl_pool = session_->ssl_socket_pool();
+    else
+      ssl_pool = session_->GetSocketPoolForSSLWithProxy(*proxy_host_port);
+
+    return connection_->Init(connection_group, ssl_params, request_->priority,
+                             &io_callback_, ssl_pool, net_log_);
+  }
+
+  // Finally, get the connection started.
+  if (proxy_info_.is_http()) {
+    return connection_->Init(
+        connection_group, http_proxy_params, request_->priority, &io_callback_,
+        session_->GetSocketPoolForHTTPProxy(*proxy_host_port), net_log_);
+  }
+
+  if (proxy_info_.is_socks()) {
+    return connection_->Init(
+        connection_group, socks_params, request_->priority, &io_callback_,
+        session_->GetSocketPoolForSOCKSProxy(*proxy_host_port), net_log_);
+  }
+
+  DCHECK(proxy_info_.is_direct());
+  return connection_->Init(connection_group, tcp_params, request_->priority,
                            &io_callback_, session_->tcp_socket_pool(),
                            net_log_);
-  }
-
-  return rv;
 }
 
 int HttpNetworkTransaction::DoInitConnectionComplete(int result) {
-  if (result < 0) {
-    if (result == ERR_RETRY_CONNECTION) {
-      DCHECK(establishing_tunnel_);
-      next_state_ = STATE_INIT_CONNECTION;
-      connection_->socket()->Disconnect();
-      connection_->Reset();
-      return OK;
+  // |result| may be the result of any of the stacked pools. The following
+  // logic is used when determining how to interpret an error.
+  // If |result| < 0:
+  //   and connection_->socket() != NULL, then the SSL handshake ran and it
+  //     is a potentially recoverable error.
+  //   and connection_->socket == NULL and connection_->is_ssl_error() is true,
+  //     then the SSL handshake ran with an unrecoverable error.
+  //   otherwise, the error came from one of the other pools.
+  bool ssl_started = using_ssl_ && (result == OK || connection_->socket() ||
+                                    connection_->is_ssl_error());
+
+  if (ssl_started && (result == OK || IsCertificateError(result))) {
+    SSLClientSocket* ssl_socket =
+      static_cast<SSLClientSocket*>(connection_->socket());
+    if (ssl_socket->wasNpnNegotiated()) {
+      response_.was_npn_negotiated = true;
+      std::string proto;
+      ssl_socket->GetNextProto(&proto);
+      if (SSLClientSocket::NextProtoFromString(proto) ==
+          SSLClientSocket::kProtoSPDY1)
+        using_spdy_ = true;
     }
-
-    if (result == ERR_PROXY_AUTH_REQUESTED) {
-      DCHECK(establishing_tunnel_);
-      HttpProxyClientSocket* tunnel_socket =
-          static_cast<HttpProxyClientSocket*>(connection_->socket());
-      DCHECK(tunnel_socket);
-      DCHECK(!tunnel_socket->IsConnected());
-      const HttpResponseInfo* auth_response = tunnel_socket->GetResponseInfo();
-
-      response_.headers = auth_response->headers;
-      headers_valid_ = true;
-      response_.auth_challenge = auth_response->auth_challenge;
-      pending_auth_target_ = HttpAuth::AUTH_PROXY;
-      return OK;
-    }
-
-    if (alternate_protocol_mode_ == kUsingAlternateProtocol) {
-      // Mark the alternate protocol as broken and fallback.
-      MarkBrokenAlternateProtocolAndFallback();
-      return OK;
-    }
-
-    return ReconsiderProxyAfterError(result);
   }
 
-  DCHECK_EQ(OK, result);
-  if (establishing_tunnel_) {
-    DCHECK(connection_->socket()->IsConnected());
-    establishing_tunnel_ = false;
-  }
+  if (result == ERR_PROXY_AUTH_REQUESTED) {
+    DCHECK(!ssl_started);
+    const HttpResponseInfo& tunnel_auth_response =
+        connection_->tunnel_auth_response_info();
 
-  if (using_spdy_) {
-    DCHECK(!connection_->is_initialized());
-    // TODO(cbentzel): Add auth support to spdy. See http://crbug.com/46620
-    next_state_ = STATE_SPDY_SEND_REQUEST;
+    response_.headers = tunnel_auth_response.headers;
+    response_.auth_challenge = tunnel_auth_response.auth_challenge;
+    headers_valid_ = true;
+    pending_auth_target_ = HttpAuth::AUTH_PROXY;
     return OK;
   }
 
-  LogHttpConnectedMetrics(*connection_);
-
-  // Set the reused_socket_ flag to indicate that we are using a keep-alive
-  // connection.  This flag is used to handle errors that occur while we are
-  // trying to reuse a keep-alive connection.
-  reused_socket_ = connection_->is_reused();
-  if (reused_socket_) {
-    if (using_ssl_) {
-      SSLClientSocket* ssl_socket =
-          reinterpret_cast<SSLClientSocket*>(connection_->socket());
-      response_.was_npn_negotiated = ssl_socket->wasNpnNegotiated();
-    }
-    next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN;
-  } else {
-    // Now we have a TCP connected socket.  Perform other connection setup as
-    // needed.
-    UpdateConnectionTypeHistograms(CONNECTION_HTTP);
-    if (using_ssl_)
-      next_state_ = STATE_SSL_CONNECT;
-    else
-      next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN;
-  }
-
-  return OK;
-}
-
-int HttpNetworkTransaction::DoTunnelRestartWithAuth() {
-  next_state_ = STATE_INIT_CONNECTION_COMPLETE;
-  HttpProxyClientSocket* tunnel_socket =
-    reinterpret_cast<HttpProxyClientSocket*>(connection_->socket());
-
-  return tunnel_socket->RestartWithAuth(&io_callback_);
-}
-
-int HttpNetworkTransaction::DoSSLConnect() {
-  next_state_ = STATE_SSL_CONNECT_COMPLETE;
-
-  if (ContainsKey(*g_tls_intolerant_servers, GetHostAndPort(request_->url))) {
-    LOG(WARNING) << "Falling back to SSLv3 because host is TLS intolerant: "
-                 << GetHostAndPort(request_->url);
-    ssl_config_.tls1_enabled = false;
-  }
-
-  if (request_->load_flags & LOAD_VERIFY_EV_CERT)
-    ssl_config_.verify_ev_cert = true;
-
-  ssl_connect_start_time_ = base::TimeTicks::Now();
-
-  // Add a SSL socket on top of our existing transport socket.
-  ClientSocket* s = connection_->release_socket();
-  s = session_->socket_factory()->CreateSSLClientSocket(
-      s, request_->url.HostNoBrackets(), ssl_config_);
-  connection_->set_socket(s);
-  return connection_->socket()->Connect(&io_callback_);
-}
-
-int HttpNetworkTransaction::DoSSLConnectComplete(int result) {
-  SSLClientSocket* ssl_socket =
-      reinterpret_cast<SSLClientSocket*>(connection_->socket());
-
-  SSLClientSocket::NextProtoStatus status =
-      SSLClientSocket::kNextProtoUnsupported;
-  std::string proto;
-  // GetNextProto will fail and and trigger a NOTREACHED if we pass in a socket
-  // that hasn't had SSL_ImportFD called on it. If we get a certificate error
-  // here, then we know that we called SSL_ImportFD.
-  if (result == OK || IsCertificateError(result))
-    status = ssl_socket->GetNextProto(&proto);
-
-  if (status == SSLClientSocket::kNextProtoNegotiated) {
-    ssl_socket->setWasNpnNegotiated(true);
-    response_.was_npn_negotiated = true;
-    if (SSLClientSocket::NextProtoFromString(proto) ==
-        SSLClientSocket::kProtoSPDY1) {
-          using_spdy_ = true;
-    }
-  }
-
-  if (alternate_protocol_mode_ == kUsingAlternateProtocol &&
-      alternate_protocol_ == HttpAlternateProtocols::NPN_SPDY_1 &&
-      !using_spdy_) {
-    // We tried using the NPN_SPDY_1 alternate protocol, but failed, so we
-    // fallback.
+  if ((!ssl_started && result < 0 &&
+       alternate_protocol_mode_ == kUsingAlternateProtocol) ||
+      result == ERR_NPN_NEGOTIATION_FAILED) {
+    // Mark the alternate protocol as broken and fallback.
     MarkBrokenAlternateProtocolAndFallback();
     return OK;
   }
 
+  if (result < 0 && !ssl_started)
+    return ReconsiderProxyAfterError(result);
+  establishing_tunnel_ = false;
+
+  if (connection_->socket()) {
+    LogHttpConnectedMetrics(*connection_);
+
+    // Set the reused_socket_ flag to indicate that we are using a keep-alive
+    // connection.  This flag is used to handle errors that occur while we are
+    // trying to reuse a keep-alive connection.
+    reused_socket_ = connection_->is_reused();
+    // TODO(vandebo) should we exclude SPDY in the following if?
+    if (!reused_socket_)
+      UpdateConnectionTypeHistograms(CONNECTION_HTTP);
+
+    if (!using_ssl_) {
+      DCHECK_EQ(OK, result);
+      next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN;
+      return result;
+    }
+  }
+
+  // Handle SSL errors below.
+  DCHECK(using_ssl_);
+  DCHECK(ssl_started);
   if (IsCertificateError(result)) {
     if (using_spdy_ && request_->url.SchemeIs("http")) {
       // We ignore certificate errors for http over spdy.
       spdy_certificate_error_ = result;
       result = OK;
     } else {
       result = HandleCertificateError(result);
       if (result == OK && !connection_->socket()->IsConnectedAndIdle()) {
         connection_->socket()->Disconnect();
         connection_->Reset();
         next_state_ = STATE_INIT_CONNECTION;
         return result;
       }
     }
   }
 
-  if (result == OK) {
-    DCHECK(ssl_connect_start_time_ != base::TimeTicks());
-    base::TimeDelta connect_duration =
-        base::TimeTicks::Now() - ssl_connect_start_time_;
+  if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED)
+    return HandleCertificateRequest(result);
+  if (result < 0)
+    return HandleSSLHandshakeError(result);
 
-    if (using_spdy_) {
-      UMA_HISTOGRAM_CUSTOM_TIMES("Net.SpdyConnectionLatency",
-                                 connect_duration,
-                                 base::TimeDelta::FromMilliseconds(1),
-                                 base::TimeDelta::FromMinutes(10),
-                                 100);
-
-      UpdateConnectionTypeHistograms(CONNECTION_SPDY);
-      // TODO(cbentzel): Add auth support to spdy. See http://crbug.com/46620
-      next_state_ = STATE_SPDY_SEND_REQUEST;
-    } else {
-      UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency",
-                                 connect_duration,
-                                 base::TimeDelta::FromMilliseconds(1),
-                                 base::TimeDelta::FromMinutes(10),
-                                 100);
-
-      next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN;
-    }
-  } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
-    result = HandleCertificateRequest(result);
+  if (using_spdy_) {
+    UpdateConnectionTypeHistograms(CONNECTION_SPDY);
+    // TODO(cbentzel): Add auth support to spdy. See http://crbug.com/46620
+    next_state_ = STATE_SPDY_SEND_REQUEST;
   } else {
-    result = HandleSSLHandshakeError(result);
+    next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN;
   }
-  return result;
+  return OK;
 }
 
 int HttpNetworkTransaction::DoGenerateProxyAuthToken() {
   next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN_COMPLETE;
   if (!ShouldApplyProxyAuth())
     return OK;
   return auth_controllers_[HttpAuth::AUTH_PROXY]->MaybeGenerateAuthToken(
       request_, &io_callback_, net_log_);
 }
 
@@ skipping 177 matching lines @@
   ProcessAlternateProtocol(*response_.headers,
                            endpoint_,
                            session_->mutable_alternate_protocols());
 
   int rv = HandleAuthChallenge();
   if (rv != OK)
     return rv;
 
   if (using_ssl_) {
     SSLClientSocket* ssl_socket =
-        reinterpret_cast<SSLClientSocket*>(connection_->socket());
+        static_cast<SSLClientSocket*>(connection_->socket());
     ssl_socket->GetSSLInfo(&response_.ssl_info);
   }
 
   headers_valid_ = true;
   return OK;
 }
 
 int HttpNetworkTransaction::DoReadBody() {
   DCHECK(read_buf_);
   DCHECK_GT(read_buf_len_, 0);
@@ skipping 322 matching lines @@
         total_duration, base::TimeDelta::FromMilliseconds(1),
         base::TimeDelta::FromMinutes(10), 100);
   }
 }
 
 int HttpNetworkTransaction::HandleCertificateError(int error) {
   DCHECK(using_ssl_);
   DCHECK(IsCertificateError(error));
 
   SSLClientSocket* ssl_socket =
-      reinterpret_cast<SSLClientSocket*>(connection_->socket());
+      static_cast<SSLClientSocket*>(connection_->socket());
   ssl_socket->GetSSLInfo(&response_.ssl_info);
 
   // Add the bad certificate to the set of allowed certificates in the
   // SSL info object. This data structure will be consulted after calling
   // RestartIgnoringLastError(). And the user will be asked interactively
   // before RestartIgnoringLastError() is ever called.
   SSLConfig::CertAndStatus bad_cert;
   bad_cert.cert = response_.ssl_info.cert;
   bad_cert.cert_status = response_.ssl_info.cert_status;
   ssl_config_.allowed_bad_certs.push_back(bad_cert);
 
+  int load_flags = request_->load_flags;
   if (g_ignore_certificate_errors)
+    load_flags |= LOAD_IGNORE_ALL_CERT_ERRORS;
+  if (ssl_socket->IgnoreCertError(error, load_flags))
     return OK;
-
-  const int kCertFlags = LOAD_IGNORE_CERT_COMMON_NAME_INVALID |
-                         LOAD_IGNORE_CERT_DATE_INVALID |
-                         LOAD_IGNORE_CERT_AUTHORITY_INVALID |
-                         LOAD_IGNORE_CERT_WRONG_USAGE;
-  if (request_->load_flags & kCertFlags) {
-    switch (error) {
-      case ERR_CERT_COMMON_NAME_INVALID:
-        if (request_->load_flags & LOAD_IGNORE_CERT_COMMON_NAME_INVALID)
-          error = OK;
-        break;
-      case ERR_CERT_DATE_INVALID:
-        if (request_->load_flags & LOAD_IGNORE_CERT_DATE_INVALID)
-          error = OK;
-        break;
-      case ERR_CERT_AUTHORITY_INVALID:
-        if (request_->load_flags & LOAD_IGNORE_CERT_AUTHORITY_INVALID)
-          error = OK;
-        break;
-    }
-  }
   return error;
 }
 
 int HttpNetworkTransaction::HandleCertificateRequest(int error) {
   // Assert that the socket did not send a client certificate.
   // Note: If we got a reused socket, it was created with some other
   // transaction's ssl_config_, so we need to disable this assertion.  We can
   // get a certificate request on a reused socket when the server requested
   // renegotiation (rehandshake).
   // TODO(wtc): add a GetSSLParams method to SSLClientSocket so we can query
   // the SSL parameters it was created with and get rid of the reused_socket_
   // test.
   DCHECK(reused_socket_ || !ssl_config_.send_client_cert);
 
   response_.cert_request_info = new SSLCertRequestInfo;
   SSLClientSocket* ssl_socket =
-      reinterpret_cast<SSLClientSocket*>(connection_->socket());
+      static_cast<SSLClientSocket*>(connection_->socket());
   ssl_socket->GetSSLCertRequestInfo(response_.cert_request_info);
 
   // Close the connection while the user is selecting a certificate to send
   // to the server.
   connection_->socket()->Disconnect();
   connection_->Reset();
 
   // If the user selected one of the certificate in client_certs for this
   // server before, use it automatically.
   X509Certificate* client_cert = session_->ssl_client_auth_cache()->
@@ skipping 84 matching lines @@
   // This automatically prevents an infinite resend loop because we'll run
   // out of the cached keep-alive connections eventually.
   if (!connection_->ShouldResendFailedRequest(error) ||
       GetResponseHeaders()) {  // We have received some response headers.
     return false;
   }
   return true;
 }
 
 void HttpNetworkTransaction::ResetConnectionAndRequestForResend() {
-  connection_->socket()->Disconnect();
+  if (connection_->socket())
+    connection_->socket()->Disconnect();
   connection_->Reset();
   // We need to clear request_headers_ because it contains the real request
   // headers, but we may need to resend the CONNECT request first to recreate
   // the SSL tunnel.
+
   request_headers_.clear();
   next_state_ = STATE_INIT_CONNECTION;  // Resend the request.
 }
 
 int HttpNetworkTransaction::ReconsiderProxyAfterError(int error) {
   DCHECK(!pac_request_);
 
   // A failure to resolve the hostname or any error related to establishing a
   // TCP connection could be grounds for trying a new proxy configuration.
   //
@@ skipping 158 matching lines @@
     default:
       description = StringPrintf("Unknown state 0x%08X (%u)", state, state);
       break;
   }
   return description;
 }
 
 #undef STATE_CASE
 
 }  // namespace net