The Schannel considers some cipher suites (e.g., the...

net/http/http_transaction_winhttp.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_transaction_winhttp.h"
 
 #include <winhttp.h>
 
 #include "base/lock.h"
 #include "base/memory_debug.h"
@@ skipping 40 matching lines @@
     case ERROR_WINHTTP_INVALID_URL:
       return ERR_INVALID_URL;
     case ERROR_WINHTTP_NAME_NOT_RESOLVED:
       return ERR_NAME_NOT_RESOLVED;
     case ERROR_WINHTTP_OPERATION_CANCELLED:
       return ERR_ABORTED;
     case ERROR_WINHTTP_SECURE_CHANNEL_ERROR:
     case ERROR_WINHTTP_SECURE_FAILURE:
     case SEC_E_ILLEGAL_MESSAGE:
       return ERR_SSL_PROTOCOL_ERROR;
+    case SEC_E_ALGORITHM_MISMATCH:
+      return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;
     case ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED:
       return ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
     case ERROR_WINHTTP_UNRECOGNIZED_SCHEME:
       return ERR_UNKNOWN_URL_SCHEME;
     case ERROR_WINHTTP_INVALID_SERVER_RESPONSE:
       return ERR_INVALID_RESPONSE;
 
     // SSL certificate errors
     case ERROR_WINHTTP_SECURE_CERT_CN_INVALID:
       return ERR_CERT_COMMON_NAME_INVALID;
@@ skipping 1265 matching lines @@
                                                         load_flags_);
     // If load_flags_ ignores all the errors in secure_failure, we shouldn't
     // get the ERROR_WINHTTP_SECURE_FAILURE error.
     DCHECK(filtered_secure_failure || !secure_failure);
     error = MapSecureFailureToError(filtered_secure_failure);
   }
 
   last_error_ = error;
   rv = TranslateOSError(error);
 
-  if (rv == ERR_SSL_PROTOCOL_ERROR &&
+  if ((rv == ERR_SSL_PROTOCOL_ERROR ||
+       rv == ERR_SSL_VERSION_OR_CIPHER_MISMATCH) &&
       !session_callback_->request_was_probably_sent() &&
       session_->tls_enabled() && !is_tls_intolerant_) {
-    // The server might be TLS intolerant.  Downgrade to SSL 3.0 and retry.
+    // The server might be TLS intolerant.  Or it might be an SSL 3.0 server
+    // that chose a TLS-only cipher suite, which we handle in the same way.
+    // Downgrade to SSL 3.0 and retry.
     is_tls_intolerant_ = true;
     if (!ReopenRequest())
       return TranslateLastOSError();
     CompletionCallback* callback = callback_;
     callback_ = NULL;
     return Restart(callback);
   }
   if (rv == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
     // TODO(wtc): Bug 1230409: We don't support SSL client authentication yet.
     // For now we set a null client certificate, which works on XP SP3, Vista
@@ skipping 425 matching lines @@
 
   if (rv == ERR_IO_PENDING) {
     session_callback_->AddRef();  // balanced when callback runs.
   } else if (callback_) {
     DoCallback(rv);
   }
 }
 
 }  // namespace net