net: Disconnect proxy sockets that have a certificate error.

net/http/http_proxy_client_socket_pool.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_proxy_client_socket_pool.h"
 
 #include <algorithm>
 
 #include "base/time.h"
 #include "base/values.h"
@@ skipping 199 matching lines @@
       group_name(), params_->ssl_params(),
       params_->ssl_params()->transport_params()->destination().priority(),
       callback_, ssl_pool_, net_log());
 }
 
 int HttpProxyConnectJob::DoSSLConnectComplete(int result) {
   if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
     error_response_info_ = transport_socket_handle_->ssl_error_response_info();
     DCHECK(error_response_info_.cert_request_info.get());
     error_response_info_.cert_request_info->is_proxy = true;
     return result;

[wtc, 2012/03/05 21:08:14]

rch: do we also need to disconnect the socket here?

[agl, 2012/03/05 21:16:15]

I thought about this when writing the patch but decided that the socket, in this
case, was unusable. So even if we do need to call Disconnect here, it's not a
security issue because writing to the socket wouldn't work (or so I expect).
Therefore, since this patch was scheduled for merging, it was best to keep it
minimal.

   }
   if (IsCertificateError(result)) {
     if (params_->ssl_params()->load_flags() & LOAD_IGNORE_ALL_CERT_ERRORS) {
       result = OK;
     } else {
       // TODO(rch): allow the user to deal with proxy cert errors in the
       // same way as server cert errors.
+      transport_socket_handle_->socket()->Disconnect();

[wtc, 2012/03/05 21:08:14]

rch: the code on lines 233-234 below has a null pointer check.

I guess the null pointer check is not necessary here because
if the socket is null, we cannot possibly get a certificate
error?

       return ERR_PROXY_CERTIFICATE_INVALID;
     }
   }
   if (result < 0) {
     if (transport_socket_handle_->socket())
       transport_socket_handle_->socket()->Disconnect();
     return ERR_PROXY_CONNECTION_FAILED;
   }
 
   SSLClientSocket* ssl =
@@ skipping 241 matching lines @@
 
 base::TimeDelta HttpProxyClientSocketPool::ConnectionTimeout() const {
   return base_.ConnectionTimeout();
 }
 
 ClientSocketPoolHistograms* HttpProxyClientSocketPool::histograms() const {
   return base_.histograms();
 }
 
 }  // namespace net