Allow a non-200 (or non-407) response for a CONNECT request from an HTTPS pro...

net/socket/ssl_client_socket_pool.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_pool.h"
 
 #include "base/metrics/histogram.h"
 #include "base/values.h"
 #include "net/base/net_errors.h"
 #include "net/base/host_port_pair.h"
@@ skipping 242 matching lines @@
 int SSLConnectJob::DoTunnelConnectComplete(int result) {
   // Extract the information needed to prompt for appropriate proxy
   // authentication so that when ClientSocketPoolBaseHelper calls
   // |GetAdditionalErrorState|, we can easily set the state.
   if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
     error_response_info_ = transport_socket_handle_->ssl_error_response_info();
   } else if (result == ERR_PROXY_AUTH_REQUESTED) {
     ClientSocket* socket = transport_socket_handle_->socket();
     HttpProxyClientSocket* tunnel_socket =
         static_cast<HttpProxyClientSocket*>(socket);
-    error_response_info_ = *tunnel_socket->GetResponseInfo();
+    error_response_info_ = *tunnel_socket->GetConnectResponseInfo();
+  } else if (result == ERR_HTTPS_PROXY_TUNNEL_CONNECTION_RESPONSE) {
+    error_response_info_ = transport_socket_handle_->ssl_error_response_info();
+    pending_https_proxy_response_stream_.reset(
+        transport_socket_handle_->

[vandebo (ex-Chrome), 2010/12/04 00:30:37]

Indeed, you get the pending https proxy response stream from the transport
socket (recoverable error) and not the additional error state.  Since you can't
do the same thing here (the socket would be returned to the wrong pool), maybe
you should always use the additional error state method and not treat the http
proxy client socket non200/407 as a recoverable error.

+            release_pending_https_proxy_response_stream());
   }
   if (result < 0)
     return result;
 
   next_state_ = STATE_SSL_CONNECT;
   return result;
 }
 
 void SSLConnectJob::GetAdditionalErrorState(ClientSocketHandle * handle) {
   // Headers in |error_response_info_| indicate a proxy tunnel setup
   // problem. See DoTunnelConnectComplete.
   if (error_response_info_.headers) {
     handle->set_pending_http_proxy_connection(
         transport_socket_handle_.release());
   }
   handle->set_ssl_error_response_info(error_response_info_);
+  if (pending_https_proxy_response_stream_.get())
+    handle->set_pending_https_proxy_response_stream(
+        pending_https_proxy_response_stream_.release());
   if (!ssl_connect_start_time_.is_null())
     handle->set_is_ssl_error(true);
 }
 
 int SSLConnectJob::DoSSLConnect() {
   next_state_ = STATE_SSL_CONNECT_COMPLETE;
   // Reset the timeout to just the time allowed for the SSL handshake.
   ResetTimer(base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds));
   ssl_connect_start_time_ = base::TimeTicks::Now();
 
@@ skipping 224 matching lines @@
       list->Append(http_proxy_pool_->GetInfoAsValue("http_proxy_pool",
                                                     "http_proxy_pool",
                                                     true));
     }
     dict->Set("nested_pools", list);
   }
   return dict;
 }
 
 }  // namespace net