Disable False Start and clear the SSL client auth cache for HTTPS proxies on failure

net/http/http_stream_request.cc

Index: net/http/http_stream_request.cc
diff --git a/net/http/http_stream_request.cc b/net/http/http_stream_request.cc
index ea0b588ec4388b2fe5244bfe289a3e5f2c5bd8ad..777deadb7be1e39fddc37eed8d236c58f7d71bbb 100644
--- a/net/http/http_stream_request.cc
+++ b/net/http/http_stream_request.cc
@@ -909,6 +909,18 @@ scoped_refptr<SSLSocketParams> HttpStreamRequest::GenerateSSLParams(
     ssl_config()->tls1_enabled = false;
   }
 
+  if (proxy_info()->is_https() && ssl_config()->send_client_cert) {
+    // When connecting through an HTTPS proxy, disable TLS False Start so
+    // that client authentication errors can be distinguished between those
+    // originating from the proxy server (ERR_PROXY_CONNECTION_FAILED) and
+    // those originating from the endpoint (ERR_SSL_PROTOCOL_ERROR /
+    // ERR_BAD_SSL_CLIENT_AUTH_CERT).
+    // TODO(rch): This assumes that the HTTPS proxy will only request a
+    // client certificate during the initial handshake.
+    // http://crbug.com/FIXME

[wtc, 2011/01/11 23:31:36]

Please replace "FIXME" with the bug number.

Is ssl_config() the SSL config for the destination server
or the HTTPS proxy?  I believe it is the SSL config for
the destination server.  If so, we should open a bug for
adding an SSL config for HTTPS proxy, or convince ourselves
that the destination server and HTTPS proxy can share SSL
config.

+    ssl_config()->false_start_enabled = false;
+  }
+
   UMA_HISTOGRAM_ENUMERATION("Net.ConnectionUsedSSLv3Fallback",
                             static_cast<int>(ssl_config()->ssl3_fallback), 2);
 
@@ -997,6 +1009,11 @@ int HttpStreamRequest::ReconsiderProxyAfterError(int error) {
     return error;
   }
 
+  if (proxy_info()->is_https() && ssl_config_->send_client_cert) {

[wtc, 2011/01/11 23:31:36]

Why don't you test for ERR_PROXY_CONNECTION_FAILED here?

Perhaps we should add a new error code
ERR_PROXY_SSL_CLIENT_AUTH_CERT_NEEDED for this case?

Or perhaps we should move the manipulation of
ssl_client_auth_cache to the SSLClientSocket class, rather
than spreading across HttpNetworkTransaction and
HttpStreamRequest?  That seems like the best long-term
solution.

+    session_->ssl_client_auth_cache()->Remove(
+        proxy_info()->proxy_server().host_port_pair().ToString());
+  }
+
   int rv = session_->proxy_service()->ReconsiderProxyAfterError(
       request_info().url, proxy_info(), &io_callback_, &pac_request_,
       net_log_);