The Schannel considers some cipher suites (e.g., the...

net/http/http_network_transaction.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/scoped_ptr.h"
 #include "base/compiler_specific.h"
 #include "base/string_util.h"
 #include "base/trace_event.h"
@@ skipping 478 matching lines @@
 }
 
 int HttpNetworkTransaction::DoConnectComplete(int result) {
   if (IsCertificateError(result))
     result = HandleCertificateError(result);
 
   if (result == OK) {
     next_state_ = STATE_WRITE_HEADERS;
     if (using_tunnel_)
       establishing_tunnel_ = true;
-  } else if (result == ERR_SSL_PROTOCOL_ERROR) {
+  } else {
     result = HandleSSLHandshakeError(result);
-  } else {
-    result = ReconsiderProxyAfterError(result);
+    if (result != OK)
+      result = ReconsiderProxyAfterError(result);
   }
   return result;
 }
 
 int HttpNetworkTransaction::DoSSLConnectOverTunnel() {
   next_state_ = STATE_SSL_CONNECT_OVER_TUNNEL_COMPLETE;
 
   // Add a SSL socket on top of our existing transport socket.
   ClientSocket* s = connection_.release_socket();
   s = socket_factory_->CreateSSLClientSocket(s, request_->url.host(),
                                              ssl_version_mask_);
   connection_.set_socket(s);
   return connection_.socket()->Connect(&io_callback_);
 }
 
 int HttpNetworkTransaction::DoSSLConnectOverTunnelComplete(int result) {
   if (IsCertificateError(result))
     result = HandleCertificateError(result);
 
   if (result == OK) {
     next_state_ = STATE_WRITE_HEADERS;
-  } else if (result == ERR_SSL_PROTOCOL_ERROR) {
+  } else {
     result = HandleSSLHandshakeError(result);
   }
   return result;
 }
 
 int HttpNetworkTransaction::DoWriteHeaders() {
   next_state_ = STATE_WRITE_HEADERS_COMPLETE;
 
   // This is constructed lazily (instead of within our Start method), so that
   // we have proxy info available.
@@ skipping 339 matching lines @@
     SSLClientSocket* ssl_socket =
         reinterpret_cast<SSLClientSocket*>(connection_.socket());
     ssl_socket->GetSSLInfo(&response_.ssl_info);
   }
 #endif
   return error;
 }
 
 int HttpNetworkTransaction::HandleSSLHandshakeError(int error) {
 #if defined(OS_WIN)
-  if (ssl_version_mask_ & SSLClientSocket::TLS1) {
-    // This could be a TLS-intolerant server.  Turn off TLS 1.0 and retry.
-    ssl_version_mask_ &= ~SSLClientSocket::TLS1;
-    connection_.set_socket(NULL);
-    connection_.Reset();
-    next_state_ = STATE_INIT_CONNECTION;
-    error = OK;
+  switch (error) {
+    case ERR_SSL_PROTOCOL_ERROR:
+    case ERR_SSL_VERSION_OR_CIPHER_MISMATCH:
+      if (ssl_version_mask_ & SSLClientSocket::TLS1) {
+        // This could be a TLS-intolerant server or an SSL 3.0 server that
+        // chose a TLS-only cipher suite.  Turn off TLS 1.0 and retry.
+        ssl_version_mask_ &= ~SSLClientSocket::TLS1;
+        connection_.set_socket(NULL);
+        connection_.Reset();
+        next_state_ = STATE_INIT_CONNECTION;
+        error = OK;
+      }
+      break;
   }
 #endif
   return error;
 }
 
 // This method determines whether it is safe to resend the request after an
 // IO error.  It can only be called in response to request header or body
 // write errors or response header read errors.  It should not be used in
 // other cases, such as a Connect error.
 int HttpNetworkTransaction::HandleIOError(int error) {
@@ skipping 171 matching lines @@
     auth_data_[target]->state = AUTH_STATE_NEED_AUTH;
   }
 
   response_.auth_challenge.swap(auth_info);
   auth_handler_[target].reset(auth_handler.release());
 
   return OK;
 }
 
 }  // namespace net