SSL Connect Job Waiting

net/socket/ssl_client_socket_pool.cc

Index: net/socket/ssl_client_socket_pool.cc
diff --git a/net/socket/ssl_client_socket_pool.cc b/net/socket/ssl_client_socket_pool.cc
index 2c704658820bc06a8404679c2f796be269657387..b1a26da953e4f3bc39dc9b1da3275a145ca019c4 100644
--- a/net/socket/ssl_client_socket_pool.cc
+++ b/net/socket/ssl_client_socket_pool.cc
@@ -107,6 +107,7 @@ SSLConnectJob::SSLConnectJob(const std::string& group_name,
                              ClientSocketFactory* client_socket_factory,
                              HostResolver* host_resolver,
                              const SSLClientSocketContext& context,
+                             PendingJobList* pending_jobs_list,
                              Delegate* delegate,
                              NetLog* net_log)
     : ConnectJob(group_name,
@@ -127,11 +128,16 @@ SSLConnectJob::SSLConnectJob(const std::string& group_name,
                (params->privacy_mode() == PRIVACY_MODE_ENABLED
                     ? "pm/" + context.ssl_session_cache_shard
                     : context.ssl_session_cache_shard)),
-      callback_(base::Bind(&SSLConnectJob::OnIOComplete,
-                           base::Unretained(this))) {}
+      io_callback_(
+          base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
+      pending_jobs_(pending_jobs_list) {
+}
 
 SSLConnectJob::~SSLConnectJob() {}
 
+// static
+bool SSLConnectJob::enable_job_waiting_ = false;
+
 LoadState SSLConnectJob::GetLoadState() const {
   switch (next_state_) {
     case STATE_TUNNEL_CONNECT_COMPLETE:
@@ -144,6 +150,8 @@ LoadState SSLConnectJob::GetLoadState() const {
     case STATE_SOCKS_CONNECT_COMPLETE:
     case STATE_TUNNEL_CONNECT:
       return transport_socket_handle_->GetLoadState();
+    case STATE_CREATE_SSL_SOCKET:
+    case STATE_CHECK_FOR_RESUME:
     case STATE_SSL_CONNECT:
     case STATE_SSL_CONNECT_COMPLETE:
       return LOAD_STATE_SSL_HANDSHAKE;
@@ -165,6 +173,10 @@ void SSLConnectJob::GetAdditionalErrorState(ClientSocketHandle* handle) {
     handle->set_is_ssl_error(true);
 }
 
+void SSLConnectJob::EnableJobWaiting(bool enable) {
+  enable_job_waiting_ = enable;
+}
+
 void SSLConnectJob::OnIOComplete(int result) {
   int rv = DoLoop(result);
   if (rv != ERR_IO_PENDING)
@@ -200,6 +212,12 @@ int SSLConnectJob::DoLoop(int result) {
       case STATE_TUNNEL_CONNECT_COMPLETE:
         rv = DoTunnelConnectComplete(rv);
         break;
+      case STATE_CREATE_SSL_SOCKET:
+        rv = DoCreateSSLSocket();
+        break;
+      case STATE_CHECK_FOR_RESUME:
+        rv = DoCheckForResume();
+        break;
       case STATE_SSL_CONNECT:
         DCHECK_EQ(OK, rv);
         rv = DoSSLConnect();
@@ -227,14 +245,16 @@ int SSLConnectJob::DoTransportConnect() {
   return transport_socket_handle_->Init(group_name(),
                                         direct_params,
                                         priority(),
-                                        callback_,
+                                        io_callback_,
                                         transport_pool_,
                                         net_log());
 }
 
 int SSLConnectJob::DoTransportConnectComplete(int result) {
-  if (result == OK)
-    next_state_ = STATE_SSL_CONNECT;
+  if (result != OK)
+    return result;
+
+  next_state_ = STATE_CREATE_SSL_SOCKET;
 
   return result;
 }
@@ -248,14 +268,16 @@ int SSLConnectJob::DoSOCKSConnect() {
   return transport_socket_handle_->Init(group_name(),
                                         socks_proxy_params,
                                         priority(),
-                                        callback_,
+                                        io_callback_,
                                         socks_pool_,
                                         net_log());
 }
 
 int SSLConnectJob::DoSOCKSConnectComplete(int result) {
-  if (result == OK)
-    next_state_ = STATE_SSL_CONNECT;
+  if (result != OK)
+    return result;
+
+  next_state_ = STATE_CREATE_SSL_SOCKET;
 
   return result;
 }
@@ -270,7 +292,7 @@ int SSLConnectJob::DoTunnelConnect() {
   return transport_socket_handle_->Init(group_name(),
                                         http_proxy_params,
                                         priority(),
-                                        callback_,
+                                        io_callback_,
                                         http_proxy_pool_,
                                         net_log());
 }
@@ -291,12 +313,15 @@ int SSLConnectJob::DoTunnelConnectComplete(int result) {
   if (result < 0)
     return result;
 
-  next_state_ = STATE_SSL_CONNECT;
+  next_state_ = STATE_CREATE_SSL_SOCKET;
   return result;
 }
 
-int SSLConnectJob::DoSSLConnect() {
-  next_state_ = STATE_SSL_CONNECT_COMPLETE;
+int SSLConnectJob::DoCreateSSLSocket() {
+  if (enable_job_waiting_)
+    next_state_ = STATE_CHECK_FOR_RESUME;
+  else
+    next_state_ = STATE_SSL_CONNECT;
   // Reset the timeout to just the time allowed for the SSL handshake.
   ResetTimer(base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds));
 
@@ -314,14 +339,44 @@ int SSLConnectJob::DoSSLConnect() {
     connect_timing_.dns_end = socket_connect_timing.dns_end;
   }
 
-  connect_timing_.ssl_start = base::TimeTicks::Now();
-
   ssl_socket_ = client_socket_factory_->CreateSSLClientSocket(
       transport_socket_handle_.Pass(),
       params_->host_and_port(),
       params_->ssl_config(),
       context_);
-  return ssl_socket_->Connect(callback_);
+  return OK;
+}
+
+int SSLConnectJob::DoCheckForResume() {
+  // If the group's session is in the cache, continue with the session
+  // resumption SSL handshake.
+  next_state_ = STATE_SSL_CONNECT;
+
+  if (ssl_socket_->InSessionCache()) {
+    return OK;
+  }
+
+  // If there are pending jobs, wait.
+  if (!pending_jobs_->empty()) {
+    pending_jobs_->push_back(this);
+    return ERR_IO_PENDING;
+  }
+
+  // If there are no pending jobs, continue the full SSL handshake
+  // because a resumption handshake is not possible.
+  //
+  // We add |this| to pending jobs to ensure that future jobs
+  // will know that there is a job in progress.

[Ryan Sleevi, 2014/06/24 23:40:44]

nit: Pronouns considered harmful (
https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/NH-S6KCkr2M
)

// Add |this| to pending jobs, so ensure that future jobs will
// know that there is already a job in progress.

[mshelley1, 2014/06/25 17:03:56]

Done.

+  pending_jobs_->push_back(this);
+  return OK;
+}
+
+int SSLConnectJob::DoSSLConnect() {
+  next_state_ = STATE_SSL_CONNECT_COMPLETE;
+
+  connect_timing_.ssl_start = base::TimeTicks::Now();
+
+  return ssl_socket_->Connect(io_callback_);
 }
 
 int SSLConnectJob::DoSSLConnectComplete(int result) {
@@ -351,8 +406,11 @@ int SSLConnectJob::DoSSLConnectComplete(int result) {
       ssl_socket_->set_was_spdy_negotiated(true);
     }
   }
-  if (params_->want_spdy_over_npn() && !ssl_socket_->was_spdy_negotiated())
+  if (params_->want_spdy_over_npn() && !ssl_socket_->was_spdy_negotiated()) {
+    if (enable_job_waiting_)
+      ProcessPendingJobs(ERR_NPN_NEGOTIATION_FAILED);
     return ERR_NPN_NEGOTIATION_FAILED;
+  }
 
   // Spdy might be turned on by default, or it might be over npn.
   bool using_spdy = params_->force_spdy_over_ssl() ||
@@ -411,9 +469,9 @@ int SSLConnectJob::DoSSLConnectComplete(int result) {
     }
 
     const std::string& host = params_->host_and_port().host();
-    bool is_google = host == "google.com" ||
-                     (host.size() > 11 &&
-                      host.rfind(".google.com") == host.size() - 11);
+    bool is_google =
+        host == "google.com" ||
+        (host.size() > 11 && host.rfind(".google.com") == host.size() - 11);
     if (is_google) {
       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google2",
                                  connect_duration,
@@ -446,9 +504,45 @@ int SSLConnectJob::DoSSLConnectComplete(int result) {
         error_response_info_.cert_request_info.get());
   }
 
+  if (enable_job_waiting_)
+    ProcessPendingJobs(result);
+
   return result;
 }
 
+void SSLConnectJob::ProcessPendingJobs(int result) {
+  // If there is a pending list
+  if (!pending_jobs_->empty()) {
+    // The first element of the vector will always be the leading job.
+    PendingJobList::iterator it = pending_jobs_->begin();
+
+    if (result == OK) {
+      // If the connection was successful, tell all pending jobs to proceed.
+      for (PendingJobList::iterator job = it + 1; job != pending_jobs_->end();
+           ++job) {
+        (*job)->ResumeSSLConnection();
+      }
+      pending_jobs_->clear();

[Ryan Sleevi, 2014/06/24 23:40:44]

DANGER: A pending job may cause a modification to pending_jobs_

job->ResumeSSLConnection()
  job::OnIOComplete(...)
    job::DoConnect(...)
      SSLCS::DoConnect(...)
        SSLCS::DoLoop(...)
          SSLCS::DoHandshake(...)
            transport_->Write(...)
      return err;
    job::DoConnectComplete(...)
    job::[...] (notify whatever layer that the job failed)
      [some higher layer] -> RequestSocket(...)
        ClientSocketPoolBase::NewConnectJob(...)
           ...
           SSLConnectJob::DoCheckForResume
             pending_jobs_->push_back(this);

It's a very convoluted call sequence, but this would be the danger.

To handle this, you need to do something like

PendingJobsList pending_jobs(it + 1, pending_jobs_->end());
pending_jobs_->clear();
for (PendingJobsList::iterator it = pending_jobs.begin();
     it != pending_jobs.end();
     ++it) {
  ... Stuff
}

[mshelley1, 2014/06/25 17:03:56]

Done.

+    } else {
+      // If the connection failed, tell one (if any) of the remaining jobs
+      // to proceed as the new leader.
+      if (it + 1 != pending_jobs_->end())
+        (*(it + 1))->ResumeSSLConnection();
+      pending_jobs_->erase(it);

[Ryan Sleevi, 2014/06/24 23:40:44]

Ditto here, for the possibility of mutations when you resume affecting things.

Note that this also potentially violates the statement from line 516 that it
will be the leading job; if ResumeSSLConnection() causes a failure, you could
end up in the ProcessPendingJobs for that one, except it will be this job, and
it+1 will be the actual 'leading' job.

Luckily, this is easy to solve:
it = pending_jobs_->erase(it);
// "it" now contains "it+1" - that is, erase() returns the item that followed,
or, if there was no item, pending_jobs_->end()

[mshelley1, 2014/06/25 17:03:56]

Done.

+    }
+  }
+}
+
+void SSLConnectJob::ResumeSSLConnection() {
+  DCHECK_EQ(next_state_, STATE_SSL_CONNECT);
+  next_state_ = STATE_SSL_CONNECT;
+  OnIOComplete(OK);
+}
+
+bool SSLConnectJob::GetEnableJobWaiting() {
+  return enable_job_waiting_;
+}
+
 SSLConnectJob::State SSLConnectJob::GetInitialState(
     SSLSocketParams::ConnectionType connection_type) {
   switch (connection_type) {
@@ -520,21 +614,24 @@ SSLClientSocketPool::SSLClientSocketPool(
     : transport_pool_(transport_pool),
       socks_pool_(socks_pool),
       http_proxy_pool_(http_proxy_pool),
-      base_(this, max_sockets, max_sockets_per_group, histograms,
+      base_(this,
+            max_sockets,
+            max_sockets_per_group,
+            histograms,
             ClientSocketPool::unused_idle_socket_timeout(),
             ClientSocketPool::used_idle_socket_timeout(),
-            new SSLConnectJobFactory(transport_pool,
-                                     socks_pool,
-                                     http_proxy_pool,
-                                     client_socket_factory,
-                                     host_resolver,
-                                     SSLClientSocketContext(
-                                         cert_verifier,
-                                         server_bound_cert_service,
-                                         transport_security_state,
-                                         cert_transparency_verifier,
-                                         ssl_session_cache_shard),
-                                     net_log)),
+            new SSLConnectJobFactory(
+                transport_pool,
+                socks_pool,
+                http_proxy_pool,
+                client_socket_factory,
+                host_resolver,
+                SSLClientSocketContext(cert_verifier,
+                                       server_bound_cert_service,
+                                       transport_security_state,
+                                       cert_transparency_verifier,
+                                       ssl_session_cache_shard),
+                net_log)),
       ssl_config_service_(ssl_config_service) {
   if (ssl_config_service_.get())
     ssl_config_service_->AddObserver(this);
@@ -556,11 +653,35 @@ SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
     const std::string& group_name,
     const PoolBase::Request& request,
     ConnectJob::Delegate* delegate) const {
-  return scoped_ptr<ConnectJob>(
-      new SSLConnectJob(group_name, request.priority(), request.params(),
-                        ConnectionTimeout(), transport_pool_, socks_pool_,
-                        http_proxy_pool_, client_socket_factory_,
-                        host_resolver_, context_, delegate, net_log_));
+  SSLConnectJob::PendingJobList* pending_job_list;
+  if (SSLConnectJob::GetEnableJobWaiting()) {
+    PendingJobMap::const_iterator it = pending_jobs_map_->find(group_name);
+    if (it == pending_jobs_map_->end()) {
+      std::pair<PendingJobMap::iterator, bool> iter =
+          pending_jobs_map_->insert(PendingJobMap::value_type(
+              group_name, new SSLConnectJob::PendingJobList()));
+
+      it = iter.first;
+    }
+
+    pending_job_list = it->second;
+  } else {
+    pending_job_list = NULL;
+  }
+
+  return scoped_ptr<ConnectJob>(new SSLConnectJob(group_name,
+                                                  request.priority(),
+                                                  request.params(),
+                                                  ConnectionTimeout(),
+                                                  transport_pool_,
+                                                  socks_pool_,
+                                                  http_proxy_pool_,
+                                                  client_socket_factory_,
+                                                  host_resolver_,
+                                                  context_,
+                                                  pending_job_list,
+                                                  delegate,
+                                                  net_log_));
 }
 
 base::TimeDelta