Ensure that when using False Start + client auth, bad client certificates are not cached

net/http/http_stream_request.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_request.h"
 
 #include "base/stl_util-inl.h"
 #include "base/string_number_conversions.h"
 #include "base/string_util.h"
 #include "base/stringprintf.h"
@@ skipping 721 matching lines @@
         result = HandleCertificateError(result);
         if (result == OK && !connection_->socket()->IsConnectedAndIdle()) {
           connection_->socket()->Disconnect();
           connection_->Reset();
           next_state_ = STATE_INIT_CONNECTION;
           return result;
         }
       }
     }
     if (result < 0)
-      return HandleSSLHandshakeError(result);
+      return result;
   }
 
   next_state_ = STATE_CREATE_STREAM;
   return OK;
 }
 
 int HttpStreamRequest::DoWaitingUserAction(int result) {
   // This state indicates that the stream request is in a partially
   // completed state, and we've called back to the delegate for more
   // information.
@@ skipping 261 matching lines @@
   ssl_config()->allowed_bad_certs.push_back(bad_cert);
 
   int load_flags = request_info().load_flags;
   if (HttpStreamFactory::ignore_certificate_errors())
     load_flags |= LOAD_IGNORE_ALL_CERT_ERRORS;
   if (ssl_socket->IgnoreCertError(error, load_flags))
     return OK;
   return error;
 }
 
-int HttpStreamRequest::HandleSSLHandshakeError(int error) {
-  if (ssl_config()->send_client_cert &&
-      (error == ERR_SSL_PROTOCOL_ERROR ||
-       error == ERR_BAD_SSL_CLIENT_AUTH_CERT)) {
-    session_->ssl_client_auth_cache()->Remove(
-        GetHostAndPort(request_info().url));
-  }
-
-  switch (error) {
-    case ERR_SSL_PROTOCOL_ERROR:
-    case ERR_SSL_VERSION_OR_CIPHER_MISMATCH:
-    case ERR_SSL_DECOMPRESSION_FAILURE_ALERT:
-    case ERR_SSL_BAD_RECORD_MAC_ALERT:
-      if (ssl_config()->tls1_enabled &&
-          !SSLConfigService::IsKnownStrictTLSServer(
-          request_info().url.host())) {
-        // This could be a TLS-intolerant server, an SSL 3.0 server that
-        // chose a TLS-only cipher suite or a server with buggy DEFLATE
-        // support. Turn off TLS 1.0, DEFLATE support and retry.
-        factory_->AddTLSIntolerantServer(request_info().url);
-        next_state_ = STATE_INIT_CONNECTION;
-        DCHECK(!connection_.get() || !connection_->socket());
-        error = OK;
-      }
-      break;
-  }
-  return error;
-}
-
 void HttpStreamRequest::SwitchToSpdyMode() {
   if (HttpStreamFactory::spdy_enabled())
     using_spdy_ = true;
 }
 
 // static
 void HttpStreamRequest::LogHttpConnectedMetrics(
     const ClientSocketHandle& handle) {
   UMA_HISTOGRAM_ENUMERATION("Net.HttpSocketType", handle.reuse_type(),
                             ClientSocketHandle::NUM_TYPES);
@@ skipping 20 matching lines @@
                                  base::TimeDelta::FromMinutes(6),
                                  100);
       break;
     default:
       NOTREACHED();
       break;
   }
 }
 
 }  // namespace net