net: also do TLS 1.1 -> 1.0 fallback on ERR_CONNECTION_ABORTED.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 1886 matching lines @@
     }
     // Done!
   } else {
     PRErrorCode prerr = PR_GetError();
     net_error = HandleNSSError(prerr, true);
 
     // Some network devices that inspect application-layer packets seem to
     // inject TCP reset packets to break the connections when they see
     // TLS 1.1 in ClientHello or ServerHello. See http://crbug.com/130293.
     //
-    // Only allow ERR_CONNECTION_RESET to trigger a TLS 1.1 -> TLS 1.0
-    // fallback. We don't lose much in this fallback because the explicit
-    // IV for CBC mode in TLS 1.1 is approximated by record splitting in
-    // TLS 1.0.
+    // Only allow ERR_CONNECTION_RESET/ABORTED to trigger a TLS 1.1 -> TLS 1.0
+    // fallback. We don't lose much in this fallback because the explicit IV
+    // for CBC mode in TLS 1.1 is approximated by record splitting in TLS 1.0.
     //
-    // ERR_CONNECTION_RESET is a common network error, so we don't want it
-    // to trigger a version fallback in general, especially the TLS 1.0 ->
+    // ERR_CONNECTION_RESET/ABORTED are common network errors, so we don't want
+    // them to trigger a version fallback in general, especially the TLS 1.0 ->
     // SSL 3.0 fallback, which would drop TLS extensions.
-    if (prerr == PR_CONNECT_RESET_ERROR &&
+    //
+    // ERR_CONNECTION_ABORTED was added because we sometimes get it instead of
+    // RESET on Windows. See crbug.com/178672.

[wtc, 2013/03/04 23:51:27]

I found one change to tcp_client_socket_win.cc in Chrome 25
that could explain the ERR_CONNECTION_RESET to
ERR_CONNECTION_ABORTED change. rsleevi changed how
SSLClientSocket reads from the TCPClientSocket, but his change
(r174136) is cross-platform and is in Chrome 26 only
(Chrome 25 branched at revision 173683). So I think
pmeenan's change to tcp_client_socket_win.cc (r165170)
is the most likely cause for the error code change on
Windows.

[wtc, 2013/03/05 18:27:10]

We can replace "sometimes" with something like "if non-blocking
reads instead of async/overlapped reads are used"

[agl, 2013/03/05 18:48:20]

Done.

+    if ((prerr == PR_CONNECT_RESET_ERROR ||
+         prerr == PR_CONNECT_ABORTED_ERROR) &&

[wtc, 2013/03/04 20:55:49]

Perhaps only allow PR_CONNECT_ABORTED_ERROR for OS_WIN?
It would require some ugly #ifdef. Not sure if that's worth
it.

[agl, 2013/03/04 21:01:13]

I would tend not to have different behaviours on different platforms unless it's
clearly warranted, and I'm not sure that it is here. Maybe we have a subtle
issue on all platforms that's only just showing through on some Windows boxes.

         ssl_config_.version_max == SSL_PROTOCOL_VERSION_TLS1_1) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
 
     // If not done, stay in this state
     if (net_error == ERR_IO_PENDING) {
       GotoState(STATE_HANDSHAKE);
     } else {
       PostOrRunCallback(
           FROM_HERE,
@@ skipping 1604 matching lines @@
   EnsureThreadIdAssigned();
   base::AutoLock auto_lock(lock_);
   return valid_thread_id_ == base::PlatformThread::CurrentId();
 }
 
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }
 
 }  // namespace net