Add support for speaking SSL to an HTTP Proxy, to HttpProxyClientSocketPool (and friends)

net/http/http_network_transaction.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include <set>
 #include <vector>
 
 #include "base/compiler_specific.h"
@@ skipping 304 matching lines @@
 
   scoped_refptr<HttpResponseHeaders> headers = GetResponseHeaders();
   if (headers_valid_ && headers.get() && stream_request_.get()) {
     // We're trying to read the body of the response but we're still trying
     // to establish an SSL tunnel through the proxy.  We can't read these
     // bytes when establishing a tunnel because they might be controlled by
     // an active network attacker.  We don't worry about this for HTTP
     // because an active network attacker can already control HTTP sessions.
     // We reach this case when the user cancels a 407 proxy auth prompt.
     // See http://crbug.com/8473.
-    DCHECK(proxy_info_.is_http());
+    DCHECK(proxy_info_.is_http() || proxy_info_.is_https());
     DCHECK_EQ(headers->response_code(), 407);
     LOG(WARNING) << "Blocked proxy response with status "
                  << headers->response_code() << " to CONNECT request for "
                  << GetHostAndPort(request_->url) << ".";
     return ERR_TUNNEL_CONNECTION_FAILED;
   }
 
   // Are we using SPDY or HTTP?
   next_state = STATE_READ_BODY;
   DCHECK(stream_->GetResponseInfo()->headers);
@@ skipping 315 matching lines @@
     if (have_proxy_auth)
       auth_controllers_[HttpAuth::AUTH_PROXY]->AddAuthorizationHeader(
           &authorization_headers);
     if (have_server_auth)
       auth_controllers_[HttpAuth::AUTH_SERVER]->AddAuthorizationHeader(
           &authorization_headers);
     std::string request_line;
     HttpRequestHeaders request_headers;
 
     BuildRequestHeaders(request_, authorization_headers, request_body,
-                        !is_https_request() && proxy_info_.is_http(),
+                        !is_https_request() && (proxy_info_.is_http() ||
+                                        proxy_info_.is_https()),
                         &request_line, &request_headers);
 
     if (session_->network_delegate())
       session_->network_delegate()->OnSendHttpRequest(&request_headers);
 
     if (net_log_.HasListener()) {
       net_log_.AddEvent(
           NetLog::TYPE_HTTP_TRANSACTION_SEND_REQUEST_HEADERS,
           new NetLogHttpRequestParameter(request_line, request_headers));
     }
@@ skipping 414 matching lines @@
   }
 
   // We need to clear request_headers_ because it contains the real request
   // headers, but we may need to resend the CONNECT request first to recreate
   // the SSL tunnel.
   request_headers_.clear();
   next_state_ = STATE_INIT_STREAM;  // Resend the request.
 }
 
 bool HttpNetworkTransaction::ShouldApplyProxyAuth() const {
-  return !is_https_request() && proxy_info_.is_http();
+  return !is_https_request() &&
+      (proxy_info_.is_https() || proxy_info_.is_http());
 }
 
 bool HttpNetworkTransaction::ShouldApplyServerAuth() const {
   return !(request_->load_flags & LOAD_DO_NOT_SEND_AUTH_DATA);
 }
 
 int HttpNetworkTransaction::HandleAuthChallenge() {
   scoped_refptr<HttpResponseHeaders> headers = GetResponseHeaders();
   DCHECK(headers);
 
@@ skipping 20 matching lines @@
 }
 
 bool HttpNetworkTransaction::HaveAuth(HttpAuth::Target target) const {
   return auth_controllers_[target].get() &&
       auth_controllers_[target]->HaveAuth();
 }
 
 
 GURL HttpNetworkTransaction::AuthURL(HttpAuth::Target target) const {
   switch (target) {
-    case HttpAuth::AUTH_PROXY:
+    case HttpAuth::AUTH_PROXY: {
       if (!proxy_info_.proxy_server().is_valid() ||
           proxy_info_.proxy_server().is_direct()) {
         return GURL();  // There is no proxy server.
       }
-      return GURL("http://" +
+      const char* scheme = proxy_info_.is_https() ? "https://" : "http://";
+      return GURL(scheme +
                   proxy_info_.proxy_server().host_port_pair().ToString());
+    }
     case HttpAuth::AUTH_SERVER:
       return request_->url;
     default:
      return GURL();
   }
 }
 
 #define STATE_CASE(s)  case s: \
                          description = StringPrintf("%s (0x%08X)", #s, s); \
                          break
@@ skipping 31 matching lines @@
     default:
       return priority;
   }
 }
 
 
 
 #undef STATE_CASE
 
 }  // namespace net