http_network_transaction.cc revision cedac228d2dd51db4b79ea1e72c7f249408ee061
1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "net/http/http_network_transaction.h" 6 7#include <set> 8#include <vector> 9 10#include "base/bind.h" 11#include "base/bind_helpers.h" 12#include "base/compiler_specific.h" 13#include "base/format_macros.h" 14#include "base/memory/scoped_ptr.h" 15#include "base/metrics/field_trial.h" 16#include "base/metrics/histogram.h" 17#include "base/metrics/stats_counters.h" 18#include "base/stl_util.h" 19#include "base/strings/string_number_conversions.h" 20#include "base/strings/string_util.h" 21#include "base/strings/stringprintf.h" 22#include "base/time/time.h" 23#include "base/values.h" 24#include "build/build_config.h" 25#include "net/base/auth.h" 26#include "net/base/host_port_pair.h" 27#include "net/base/io_buffer.h" 28#include "net/base/load_flags.h" 29#include "net/base/load_timing_info.h" 30#include "net/base/net_errors.h" 31#include "net/base/net_util.h" 32#include "net/base/upload_data_stream.h" 33#include "net/http/http_auth.h" 34#include "net/http/http_auth_handler.h" 35#include "net/http/http_auth_handler_factory.h" 36#include "net/http/http_basic_stream.h" 37#include "net/http/http_chunked_decoder.h" 38#include "net/http/http_network_session.h" 39#include "net/http/http_proxy_client_socket.h" 40#include "net/http/http_proxy_client_socket_pool.h" 41#include "net/http/http_request_headers.h" 42#include "net/http/http_request_info.h" 43#include "net/http/http_response_headers.h" 44#include "net/http/http_response_info.h" 45#include "net/http/http_server_properties.h" 46#include "net/http/http_status_code.h" 47#include "net/http/http_stream_base.h" 48#include "net/http/http_stream_factory.h" 49#include "net/http/http_util.h" 50#include "net/http/transport_security_state.h" 51#include "net/http/url_security_manager.h" 52#include "net/socket/client_socket_factory.h" 53#include "net/socket/socks_client_socket_pool.h" 54#include "net/socket/ssl_client_socket.h" 55#include "net/socket/ssl_client_socket_pool.h" 56#include "net/socket/transport_client_socket_pool.h" 57#include "net/spdy/hpack_huffman_aggregator.h" 58#include "net/spdy/spdy_http_stream.h" 59#include "net/spdy/spdy_session.h" 60#include "net/spdy/spdy_session_pool.h" 61#include "net/ssl/ssl_cert_request_info.h" 62#include "net/ssl/ssl_connection_status_flags.h" 63#include "url/gurl.h" 64 65#if defined(SPDY_PROXY_AUTH_ORIGIN) 66#include <algorithm> 67#include "net/proxy/proxy_server.h" 68#endif 69 70 71using base::Time; 72using base::TimeDelta; 73 74namespace net { 75 76namespace { 77 78void ProcessAlternateProtocol( 79 HttpNetworkSession* session, 80 const HttpResponseHeaders& headers, 81 const HostPortPair& http_host_port_pair) { 82 std::string alternate_protocol_str; 83 84 if (!headers.EnumerateHeader(NULL, kAlternateProtocolHeader, 85 &alternate_protocol_str)) { 86 // Header is not present. 87 return; 88 } 89 90 session->http_stream_factory()->ProcessAlternateProtocol( 91 session->http_server_properties(), 92 alternate_protocol_str, 93 http_host_port_pair, 94 *session); 95} 96 97// Returns true if |error| is a client certificate authentication error. 98bool IsClientCertificateError(int error) { 99 switch (error) { 100 case ERR_BAD_SSL_CLIENT_AUTH_CERT: 101 case ERR_SSL_CLIENT_AUTH_PRIVATE_KEY_ACCESS_DENIED: 102 case ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY: 103 case ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED: 104 return true; 105 default: 106 return false; 107 } 108} 109 110base::Value* NetLogSSLVersionFallbackCallback( 111 const GURL* url, 112 int net_error, 113 uint16 version_before, 114 uint16 version_after, 115 NetLog::LogLevel /* log_level */) { 116 base::DictionaryValue* dict = new base::DictionaryValue(); 117 dict->SetString("host_and_port", GetHostAndPort(*url)); 118 dict->SetInteger("net_error", net_error); 119 dict->SetInteger("version_before", version_before); 120 dict->SetInteger("version_after", version_after); 121 return dict; 122} 123 124} // namespace 125 126//----------------------------------------------------------------------------- 127 128HttpNetworkTransaction::HttpNetworkTransaction(RequestPriority priority, 129 HttpNetworkSession* session) 130 : pending_auth_target_(HttpAuth::AUTH_NONE), 131 io_callback_(base::Bind(&HttpNetworkTransaction::OnIOComplete, 132 base::Unretained(this))), 133 session_(session), 134 request_(NULL), 135 priority_(priority), 136 headers_valid_(false), 137 logged_response_time_(false), 138 fallback_error_code_(ERR_SSL_INAPPROPRIATE_FALLBACK), 139 request_headers_(), 140 read_buf_len_(0), 141 total_received_bytes_(0), 142 next_state_(STATE_NONE), 143 establishing_tunnel_(false), 144 websocket_handshake_stream_base_create_helper_(NULL) { 145 session->ssl_config_service()->GetSSLConfig(&server_ssl_config_); 146 session->GetNextProtos(&server_ssl_config_.next_protos); 147 proxy_ssl_config_ = server_ssl_config_; 148} 149 150HttpNetworkTransaction::~HttpNetworkTransaction() { 151 if (stream_.get()) { 152 HttpResponseHeaders* headers = GetResponseHeaders(); 153 // TODO(mbelshe): The stream_ should be able to compute whether or not the 154 // stream should be kept alive. No reason to compute here 155 // and pass it in. 156 bool try_to_keep_alive = 157 next_state_ == STATE_NONE && 158 stream_->CanFindEndOfResponse() && 159 (!headers || headers->IsKeepAlive()); 160 if (!try_to_keep_alive) { 161 stream_->Close(true /* not reusable */); 162 } else { 163 if (stream_->IsResponseBodyComplete()) { 164 // If the response body is complete, we can just reuse the socket. 165 stream_->Close(false /* reusable */); 166 } else if (stream_->IsSpdyHttpStream()) { 167 // Doesn't really matter for SpdyHttpStream. Just close it. 168 stream_->Close(true /* not reusable */); 169 } else { 170 // Otherwise, we try to drain the response body. 171 HttpStreamBase* stream = stream_.release(); 172 stream->Drain(session_); 173 } 174 } 175 } 176 177 if (request_ && request_->upload_data_stream) 178 request_->upload_data_stream->Reset(); // Invalidate pending callbacks. 179} 180 181int HttpNetworkTransaction::Start(const HttpRequestInfo* request_info, 182 const CompletionCallback& callback, 183 const BoundNetLog& net_log) { 184 SIMPLE_STATS_COUNTER("HttpNetworkTransaction.Count"); 185 186 net_log_ = net_log; 187 request_ = request_info; 188 start_time_ = base::Time::Now(); 189 190 if (request_->load_flags & LOAD_DISABLE_CERT_REVOCATION_CHECKING) { 191 server_ssl_config_.rev_checking_enabled = false; 192 proxy_ssl_config_.rev_checking_enabled = false; 193 } 194 195 // Channel ID is disabled if privacy mode is enabled for this request. 196 if (request_->privacy_mode == PRIVACY_MODE_ENABLED) 197 server_ssl_config_.channel_id_enabled = false; 198 199 next_state_ = STATE_NOTIFY_BEFORE_CREATE_STREAM; 200 int rv = DoLoop(OK); 201 if (rv == ERR_IO_PENDING) 202 callback_ = callback; 203 return rv; 204} 205 206int HttpNetworkTransaction::RestartIgnoringLastError( 207 const CompletionCallback& callback) { 208 DCHECK(!stream_.get()); 209 DCHECK(!stream_request_.get()); 210 DCHECK_EQ(STATE_NONE, next_state_); 211 212 next_state_ = STATE_CREATE_STREAM; 213 214 int rv = DoLoop(OK); 215 if (rv == ERR_IO_PENDING) 216 callback_ = callback; 217 return rv; 218} 219 220int HttpNetworkTransaction::RestartWithCertificate( 221 X509Certificate* client_cert, const CompletionCallback& callback) { 222 // In HandleCertificateRequest(), we always tear down existing stream 223 // requests to force a new connection. So we shouldn't have one here. 224 DCHECK(!stream_request_.get()); 225 DCHECK(!stream_.get()); 226 DCHECK_EQ(STATE_NONE, next_state_); 227 228 SSLConfig* ssl_config = response_.cert_request_info->is_proxy ? 229 &proxy_ssl_config_ : &server_ssl_config_; 230 ssl_config->send_client_cert = true; 231 ssl_config->client_cert = client_cert; 232 session_->ssl_client_auth_cache()->Add( 233 response_.cert_request_info->host_and_port, client_cert); 234 // Reset the other member variables. 235 // Note: this is necessary only with SSL renegotiation. 236 ResetStateForRestart(); 237 next_state_ = STATE_CREATE_STREAM; 238 int rv = DoLoop(OK); 239 if (rv == ERR_IO_PENDING) 240 callback_ = callback; 241 return rv; 242} 243 244int HttpNetworkTransaction::RestartWithAuth( 245 const AuthCredentials& credentials, const CompletionCallback& callback) { 246 HttpAuth::Target target = pending_auth_target_; 247 if (target == HttpAuth::AUTH_NONE) { 248 NOTREACHED(); 249 return ERR_UNEXPECTED; 250 } 251 pending_auth_target_ = HttpAuth::AUTH_NONE; 252 253 auth_controllers_[target]->ResetAuth(credentials); 254 255 DCHECK(callback_.is_null()); 256 257 int rv = OK; 258 if (target == HttpAuth::AUTH_PROXY && establishing_tunnel_) { 259 // In this case, we've gathered credentials for use with proxy 260 // authentication of a tunnel. 261 DCHECK_EQ(STATE_CREATE_STREAM_COMPLETE, next_state_); 262 DCHECK(stream_request_ != NULL); 263 auth_controllers_[target] = NULL; 264 ResetStateForRestart(); 265 rv = stream_request_->RestartTunnelWithProxyAuth(credentials); 266 } else { 267 // In this case, we've gathered credentials for the server or the proxy 268 // but it is not during the tunneling phase. 269 DCHECK(stream_request_ == NULL); 270 PrepareForAuthRestart(target); 271 rv = DoLoop(OK); 272 } 273 274 if (rv == ERR_IO_PENDING) 275 callback_ = callback; 276 return rv; 277} 278 279void HttpNetworkTransaction::PrepareForAuthRestart(HttpAuth::Target target) { 280 DCHECK(HaveAuth(target)); 281 DCHECK(!stream_request_.get()); 282 283 bool keep_alive = false; 284 // Even if the server says the connection is keep-alive, we have to be 285 // able to find the end of each response in order to reuse the connection. 286 if (GetResponseHeaders()->IsKeepAlive() && 287 stream_->CanFindEndOfResponse()) { 288 // If the response body hasn't been completely read, we need to drain 289 // it first. 290 if (!stream_->IsResponseBodyComplete()) { 291 next_state_ = STATE_DRAIN_BODY_FOR_AUTH_RESTART; 292 read_buf_ = new IOBuffer(kDrainBodyBufferSize); // A bit bucket. 293 read_buf_len_ = kDrainBodyBufferSize; 294 return; 295 } 296 keep_alive = true; 297 } 298 299 // We don't need to drain the response body, so we act as if we had drained 300 // the response body. 301 DidDrainBodyForAuthRestart(keep_alive); 302} 303 304void HttpNetworkTransaction::DidDrainBodyForAuthRestart(bool keep_alive) { 305 DCHECK(!stream_request_.get()); 306 307 if (stream_.get()) { 308 total_received_bytes_ += stream_->GetTotalReceivedBytes(); 309 HttpStream* new_stream = NULL; 310 if (keep_alive && stream_->IsConnectionReusable()) { 311 // We should call connection_->set_idle_time(), but this doesn't occur 312 // often enough to be worth the trouble. 313 stream_->SetConnectionReused(); 314 new_stream = 315 static_cast<HttpStream*>(stream_.get())->RenewStreamForAuth(); 316 } 317 318 if (!new_stream) { 319 // Close the stream and mark it as not_reusable. Even in the 320 // keep_alive case, we've determined that the stream_ is not 321 // reusable if new_stream is NULL. 322 stream_->Close(true); 323 next_state_ = STATE_CREATE_STREAM; 324 } else { 325 // Renewed streams shouldn't carry over received bytes. 326 DCHECK_EQ(0, new_stream->GetTotalReceivedBytes()); 327 next_state_ = STATE_INIT_STREAM; 328 } 329 stream_.reset(new_stream); 330 } 331 332 // Reset the other member variables. 333 ResetStateForAuthRestart(); 334} 335 336bool HttpNetworkTransaction::IsReadyToRestartForAuth() { 337 return pending_auth_target_ != HttpAuth::AUTH_NONE && 338 HaveAuth(pending_auth_target_); 339} 340 341int HttpNetworkTransaction::Read(IOBuffer* buf, int buf_len, 342 const CompletionCallback& callback) { 343 DCHECK(buf); 344 DCHECK_LT(0, buf_len); 345 346 State next_state = STATE_NONE; 347 348 scoped_refptr<HttpResponseHeaders> headers(GetResponseHeaders()); 349 if (headers_valid_ && headers.get() && stream_request_.get()) { 350 // We're trying to read the body of the response but we're still trying 351 // to establish an SSL tunnel through an HTTP proxy. We can't read these 352 // bytes when establishing a tunnel because they might be controlled by 353 // an active network attacker. We don't worry about this for HTTP 354 // because an active network attacker can already control HTTP sessions. 355 // We reach this case when the user cancels a 407 proxy auth prompt. We 356 // also don't worry about this for an HTTPS Proxy, because the 357 // communication with the proxy is secure. 358 // See http://crbug.com/8473. 359 DCHECK(proxy_info_.is_http() || proxy_info_.is_https()); 360 DCHECK_EQ(headers->response_code(), HTTP_PROXY_AUTHENTICATION_REQUIRED); 361 LOG(WARNING) << "Blocked proxy response with status " 362 << headers->response_code() << " to CONNECT request for " 363 << GetHostAndPort(request_->url) << "."; 364 return ERR_TUNNEL_CONNECTION_FAILED; 365 } 366 367 // Are we using SPDY or HTTP? 368 next_state = STATE_READ_BODY; 369 370 read_buf_ = buf; 371 read_buf_len_ = buf_len; 372 373 next_state_ = next_state; 374 int rv = DoLoop(OK); 375 if (rv == ERR_IO_PENDING) 376 callback_ = callback; 377 return rv; 378} 379 380void HttpNetworkTransaction::StopCaching() {} 381 382bool HttpNetworkTransaction::GetFullRequestHeaders( 383 HttpRequestHeaders* headers) const { 384 // TODO(ttuttle): Make sure we've populated request_headers_. 385 *headers = request_headers_; 386 return true; 387} 388 389int64 HttpNetworkTransaction::GetTotalReceivedBytes() const { 390 int64 total_received_bytes = total_received_bytes_; 391 if (stream_) 392 total_received_bytes += stream_->GetTotalReceivedBytes(); 393 return total_received_bytes; 394} 395 396void HttpNetworkTransaction::DoneReading() {} 397 398const HttpResponseInfo* HttpNetworkTransaction::GetResponseInfo() const { 399 return ((headers_valid_ && response_.headers.get()) || 400 response_.ssl_info.cert.get() || response_.cert_request_info.get()) 401 ? &response_ 402 : NULL; 403} 404 405LoadState HttpNetworkTransaction::GetLoadState() const { 406 // TODO(wtc): Define a new LoadState value for the 407 // STATE_INIT_CONNECTION_COMPLETE state, which delays the HTTP request. 408 switch (next_state_) { 409 case STATE_CREATE_STREAM: 410 return LOAD_STATE_WAITING_FOR_DELEGATE; 411 case STATE_CREATE_STREAM_COMPLETE: 412 return stream_request_->GetLoadState(); 413 case STATE_GENERATE_PROXY_AUTH_TOKEN_COMPLETE: 414 case STATE_GENERATE_SERVER_AUTH_TOKEN_COMPLETE: 415 case STATE_SEND_REQUEST_COMPLETE: 416 return LOAD_STATE_SENDING_REQUEST; 417 case STATE_READ_HEADERS_COMPLETE: 418 return LOAD_STATE_WAITING_FOR_RESPONSE; 419 case STATE_READ_BODY_COMPLETE: 420 return LOAD_STATE_READING_RESPONSE; 421 default: 422 return LOAD_STATE_IDLE; 423 } 424} 425 426UploadProgress HttpNetworkTransaction::GetUploadProgress() const { 427 if (!stream_.get()) 428 return UploadProgress(); 429 430 // TODO(bashi): This cast is temporary. Remove later. 431 return static_cast<HttpStream*>(stream_.get())->GetUploadProgress(); 432} 433 434void HttpNetworkTransaction::SetQuicServerInfo( 435 QuicServerInfo* quic_server_info) {} 436 437bool HttpNetworkTransaction::GetLoadTimingInfo( 438 LoadTimingInfo* load_timing_info) const { 439 if (!stream_ || !stream_->GetLoadTimingInfo(load_timing_info)) 440 return false; 441 442 load_timing_info->proxy_resolve_start = 443 proxy_info_.proxy_resolve_start_time(); 444 load_timing_info->proxy_resolve_end = proxy_info_.proxy_resolve_end_time(); 445 load_timing_info->send_start = send_start_time_; 446 load_timing_info->send_end = send_end_time_; 447 return true; 448} 449 450void HttpNetworkTransaction::SetPriority(RequestPriority priority) { 451 priority_ = priority; 452 if (stream_request_) 453 stream_request_->SetPriority(priority); 454 if (stream_) 455 stream_->SetPriority(priority); 456} 457 458void HttpNetworkTransaction::SetWebSocketHandshakeStreamCreateHelper( 459 WebSocketHandshakeStreamBase::CreateHelper* create_helper) { 460 websocket_handshake_stream_base_create_helper_ = create_helper; 461} 462 463void HttpNetworkTransaction::SetBeforeNetworkStartCallback( 464 const BeforeNetworkStartCallback& callback) { 465 before_network_start_callback_ = callback; 466} 467 468int HttpNetworkTransaction::ResumeNetworkStart() { 469 DCHECK_EQ(next_state_, STATE_CREATE_STREAM); 470 return DoLoop(OK); 471} 472 473void HttpNetworkTransaction::OnStreamReady(const SSLConfig& used_ssl_config, 474 const ProxyInfo& used_proxy_info, 475 HttpStreamBase* stream) { 476 DCHECK_EQ(STATE_CREATE_STREAM_COMPLETE, next_state_); 477 DCHECK(stream_request_.get()); 478 479 if (stream_) 480 total_received_bytes_ += stream_->GetTotalReceivedBytes(); 481 stream_.reset(stream); 482 server_ssl_config_ = used_ssl_config; 483 proxy_info_ = used_proxy_info; 484 response_.was_npn_negotiated = stream_request_->was_npn_negotiated(); 485 response_.npn_negotiated_protocol = SSLClientSocket::NextProtoToString( 486 stream_request_->protocol_negotiated()); 487 response_.was_fetched_via_spdy = stream_request_->using_spdy(); 488 response_.was_fetched_via_proxy = !proxy_info_.is_direct(); 489 490 OnIOComplete(OK); 491} 492 493void HttpNetworkTransaction::OnWebSocketHandshakeStreamReady( 494 const SSLConfig& used_ssl_config, 495 const ProxyInfo& used_proxy_info, 496 WebSocketHandshakeStreamBase* stream) { 497 OnStreamReady(used_ssl_config, used_proxy_info, stream); 498} 499 500void HttpNetworkTransaction::OnStreamFailed(int result, 501 const SSLConfig& used_ssl_config) { 502 DCHECK_EQ(STATE_CREATE_STREAM_COMPLETE, next_state_); 503 DCHECK_NE(OK, result); 504 DCHECK(stream_request_.get()); 505 DCHECK(!stream_.get()); 506 server_ssl_config_ = used_ssl_config; 507 508 OnIOComplete(result); 509} 510 511void HttpNetworkTransaction::OnCertificateError( 512 int result, 513 const SSLConfig& used_ssl_config, 514 const SSLInfo& ssl_info) { 515 DCHECK_EQ(STATE_CREATE_STREAM_COMPLETE, next_state_); 516 DCHECK_NE(OK, result); 517 DCHECK(stream_request_.get()); 518 DCHECK(!stream_.get()); 519 520 response_.ssl_info = ssl_info; 521 server_ssl_config_ = used_ssl_config; 522 523 // TODO(mbelshe): For now, we're going to pass the error through, and that 524 // will close the stream_request in all cases. This means that we're always 525 // going to restart an entire STATE_CREATE_STREAM, even if the connection is 526 // good and the user chooses to ignore the error. This is not ideal, but not 527 // the end of the world either. 528 529 OnIOComplete(result); 530} 531 532void HttpNetworkTransaction::OnNeedsProxyAuth( 533 const HttpResponseInfo& proxy_response, 534 const SSLConfig& used_ssl_config, 535 const ProxyInfo& used_proxy_info, 536 HttpAuthController* auth_controller) { 537 DCHECK(stream_request_.get()); 538 DCHECK_EQ(STATE_CREATE_STREAM_COMPLETE, next_state_); 539 540 establishing_tunnel_ = true; 541 response_.headers = proxy_response.headers; 542 response_.auth_challenge = proxy_response.auth_challenge; 543 headers_valid_ = true; 544 server_ssl_config_ = used_ssl_config; 545 proxy_info_ = used_proxy_info; 546 547 auth_controllers_[HttpAuth::AUTH_PROXY] = auth_controller; 548 pending_auth_target_ = HttpAuth::AUTH_PROXY; 549 550 DoCallback(OK); 551} 552 553void HttpNetworkTransaction::OnNeedsClientAuth( 554 const SSLConfig& used_ssl_config, 555 SSLCertRequestInfo* cert_info) { 556 DCHECK_EQ(STATE_CREATE_STREAM_COMPLETE, next_state_); 557 558 server_ssl_config_ = used_ssl_config; 559 response_.cert_request_info = cert_info; 560 OnIOComplete(ERR_SSL_CLIENT_AUTH_CERT_NEEDED); 561} 562 563void HttpNetworkTransaction::OnHttpsProxyTunnelResponse( 564 const HttpResponseInfo& response_info, 565 const SSLConfig& used_ssl_config, 566 const ProxyInfo& used_proxy_info, 567 HttpStreamBase* stream) { 568 DCHECK_EQ(STATE_CREATE_STREAM_COMPLETE, next_state_); 569 570 headers_valid_ = true; 571 response_ = response_info; 572 server_ssl_config_ = used_ssl_config; 573 proxy_info_ = used_proxy_info; 574 if (stream_) 575 total_received_bytes_ += stream_->GetTotalReceivedBytes(); 576 stream_.reset(stream); 577 stream_request_.reset(); // we're done with the stream request 578 OnIOComplete(ERR_HTTPS_PROXY_TUNNEL_RESPONSE); 579} 580 581bool HttpNetworkTransaction::is_https_request() const { 582 return request_->url.SchemeIs("https"); 583} 584 585void HttpNetworkTransaction::DoCallback(int rv) { 586 DCHECK_NE(rv, ERR_IO_PENDING); 587 DCHECK(!callback_.is_null()); 588 589 // Since Run may result in Read being called, clear user_callback_ up front. 590 CompletionCallback c = callback_; 591 callback_.Reset(); 592 c.Run(rv); 593} 594 595void HttpNetworkTransaction::OnIOComplete(int result) { 596 int rv = DoLoop(result); 597 if (rv != ERR_IO_PENDING) 598 DoCallback(rv); 599} 600 601int HttpNetworkTransaction::DoLoop(int result) { 602 DCHECK(next_state_ != STATE_NONE); 603 604 int rv = result; 605 do { 606 State state = next_state_; 607 next_state_ = STATE_NONE; 608 switch (state) { 609 case STATE_NOTIFY_BEFORE_CREATE_STREAM: 610 DCHECK_EQ(OK, rv); 611 rv = DoNotifyBeforeCreateStream(); 612 break; 613 case STATE_CREATE_STREAM: 614 DCHECK_EQ(OK, rv); 615 rv = DoCreateStream(); 616 break; 617 case STATE_CREATE_STREAM_COMPLETE: 618 rv = DoCreateStreamComplete(rv); 619 break; 620 case STATE_INIT_STREAM: 621 DCHECK_EQ(OK, rv); 622 rv = DoInitStream(); 623 break; 624 case STATE_INIT_STREAM_COMPLETE: 625 rv = DoInitStreamComplete(rv); 626 break; 627 case STATE_GENERATE_PROXY_AUTH_TOKEN: 628 DCHECK_EQ(OK, rv); 629 rv = DoGenerateProxyAuthToken(); 630 break; 631 case STATE_GENERATE_PROXY_AUTH_TOKEN_COMPLETE: 632 rv = DoGenerateProxyAuthTokenComplete(rv); 633 break; 634 case STATE_GENERATE_SERVER_AUTH_TOKEN: 635 DCHECK_EQ(OK, rv); 636 rv = DoGenerateServerAuthToken(); 637 break; 638 case STATE_GENERATE_SERVER_AUTH_TOKEN_COMPLETE: 639 rv = DoGenerateServerAuthTokenComplete(rv); 640 break; 641 case STATE_INIT_REQUEST_BODY: 642 DCHECK_EQ(OK, rv); 643 rv = DoInitRequestBody(); 644 break; 645 case STATE_INIT_REQUEST_BODY_COMPLETE: 646 rv = DoInitRequestBodyComplete(rv); 647 break; 648 case STATE_BUILD_REQUEST: 649 DCHECK_EQ(OK, rv); 650 net_log_.BeginEvent(NetLog::TYPE_HTTP_TRANSACTION_SEND_REQUEST); 651 rv = DoBuildRequest(); 652 break; 653 case STATE_BUILD_REQUEST_COMPLETE: 654 rv = DoBuildRequestComplete(rv); 655 break; 656 case STATE_SEND_REQUEST: 657 DCHECK_EQ(OK, rv); 658 rv = DoSendRequest(); 659 break; 660 case STATE_SEND_REQUEST_COMPLETE: 661 rv = DoSendRequestComplete(rv); 662 net_log_.EndEventWithNetErrorCode( 663 NetLog::TYPE_HTTP_TRANSACTION_SEND_REQUEST, rv); 664 break; 665 case STATE_READ_HEADERS: 666 DCHECK_EQ(OK, rv); 667 net_log_.BeginEvent(NetLog::TYPE_HTTP_TRANSACTION_READ_HEADERS); 668 rv = DoReadHeaders(); 669 break; 670 case STATE_READ_HEADERS_COMPLETE: 671 rv = DoReadHeadersComplete(rv); 672 net_log_.EndEventWithNetErrorCode( 673 NetLog::TYPE_HTTP_TRANSACTION_READ_HEADERS, rv); 674 break; 675 case STATE_READ_BODY: 676 DCHECK_EQ(OK, rv); 677 net_log_.BeginEvent(NetLog::TYPE_HTTP_TRANSACTION_READ_BODY); 678 rv = DoReadBody(); 679 break; 680 case STATE_READ_BODY_COMPLETE: 681 rv = DoReadBodyComplete(rv); 682 net_log_.EndEventWithNetErrorCode( 683 NetLog::TYPE_HTTP_TRANSACTION_READ_BODY, rv); 684 break; 685 case STATE_DRAIN_BODY_FOR_AUTH_RESTART: 686 DCHECK_EQ(OK, rv); 687 net_log_.BeginEvent( 688 NetLog::TYPE_HTTP_TRANSACTION_DRAIN_BODY_FOR_AUTH_RESTART); 689 rv = DoDrainBodyForAuthRestart(); 690 break; 691 case STATE_DRAIN_BODY_FOR_AUTH_RESTART_COMPLETE: 692 rv = DoDrainBodyForAuthRestartComplete(rv); 693 net_log_.EndEventWithNetErrorCode( 694 NetLog::TYPE_HTTP_TRANSACTION_DRAIN_BODY_FOR_AUTH_RESTART, rv); 695 break; 696 default: 697 NOTREACHED() << "bad state"; 698 rv = ERR_FAILED; 699 break; 700 } 701 } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE); 702 703 return rv; 704} 705 706int HttpNetworkTransaction::DoNotifyBeforeCreateStream() { 707 next_state_ = STATE_CREATE_STREAM; 708 bool defer = false; 709 if (!before_network_start_callback_.is_null()) 710 before_network_start_callback_.Run(&defer); 711 if (!defer) 712 return OK; 713 return ERR_IO_PENDING; 714} 715 716int HttpNetworkTransaction::DoCreateStream() { 717 next_state_ = STATE_CREATE_STREAM_COMPLETE; 718 if (ForWebSocketHandshake()) { 719 stream_request_.reset( 720 session_->http_stream_factory_for_websocket() 721 ->RequestWebSocketHandshakeStream( 722 *request_, 723 priority_, 724 server_ssl_config_, 725 proxy_ssl_config_, 726 this, 727 websocket_handshake_stream_base_create_helper_, 728 net_log_)); 729 } else { 730 stream_request_.reset( 731 session_->http_stream_factory()->RequestStream( 732 *request_, 733 priority_, 734 server_ssl_config_, 735 proxy_ssl_config_, 736 this, 737 net_log_)); 738 } 739 DCHECK(stream_request_.get()); 740 return ERR_IO_PENDING; 741} 742 743int HttpNetworkTransaction::DoCreateStreamComplete(int result) { 744 if (result == OK) { 745 next_state_ = STATE_INIT_STREAM; 746 DCHECK(stream_.get()); 747 } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) { 748 result = HandleCertificateRequest(result); 749 } else if (result == ERR_HTTPS_PROXY_TUNNEL_RESPONSE) { 750 // Return OK and let the caller read the proxy's error page 751 next_state_ = STATE_NONE; 752 return OK; 753 } 754 755 // Handle possible handshake errors that may have occurred if the stream 756 // used SSL for one or more of the layers. 757 result = HandleSSLHandshakeError(result); 758 759 // At this point we are done with the stream_request_. 760 stream_request_.reset(); 761 return result; 762} 763 764int HttpNetworkTransaction::DoInitStream() { 765 DCHECK(stream_.get()); 766 next_state_ = STATE_INIT_STREAM_COMPLETE; 767 return stream_->InitializeStream(request_, priority_, net_log_, io_callback_); 768} 769 770int HttpNetworkTransaction::DoInitStreamComplete(int result) { 771 if (result == OK) { 772 next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN; 773 } else { 774 if (result < 0) 775 result = HandleIOError(result); 776 777 // The stream initialization failed, so this stream will never be useful. 778 if (stream_) 779 total_received_bytes_ += stream_->GetTotalReceivedBytes(); 780 stream_.reset(); 781 } 782 783 return result; 784} 785 786int HttpNetworkTransaction::DoGenerateProxyAuthToken() { 787 next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN_COMPLETE; 788 if (!ShouldApplyProxyAuth()) 789 return OK; 790 HttpAuth::Target target = HttpAuth::AUTH_PROXY; 791 if (!auth_controllers_[target].get()) 792 auth_controllers_[target] = 793 new HttpAuthController(target, 794 AuthURL(target), 795 session_->http_auth_cache(), 796 session_->http_auth_handler_factory()); 797 return auth_controllers_[target]->MaybeGenerateAuthToken(request_, 798 io_callback_, 799 net_log_); 800} 801 802int HttpNetworkTransaction::DoGenerateProxyAuthTokenComplete(int rv) { 803 DCHECK_NE(ERR_IO_PENDING, rv); 804 if (rv == OK) 805 next_state_ = STATE_GENERATE_SERVER_AUTH_TOKEN; 806 return rv; 807} 808 809int HttpNetworkTransaction::DoGenerateServerAuthToken() { 810 next_state_ = STATE_GENERATE_SERVER_AUTH_TOKEN_COMPLETE; 811 HttpAuth::Target target = HttpAuth::AUTH_SERVER; 812 if (!auth_controllers_[target].get()) { 813 auth_controllers_[target] = 814 new HttpAuthController(target, 815 AuthURL(target), 816 session_->http_auth_cache(), 817 session_->http_auth_handler_factory()); 818 if (request_->load_flags & LOAD_DO_NOT_USE_EMBEDDED_IDENTITY) 819 auth_controllers_[target]->DisableEmbeddedIdentity(); 820 } 821 if (!ShouldApplyServerAuth()) 822 return OK; 823 return auth_controllers_[target]->MaybeGenerateAuthToken(request_, 824 io_callback_, 825 net_log_); 826} 827 828int HttpNetworkTransaction::DoGenerateServerAuthTokenComplete(int rv) { 829 DCHECK_NE(ERR_IO_PENDING, rv); 830 if (rv == OK) 831 next_state_ = STATE_INIT_REQUEST_BODY; 832 return rv; 833} 834 835void HttpNetworkTransaction::BuildRequestHeaders(bool using_proxy) { 836 request_headers_.SetHeader(HttpRequestHeaders::kHost, 837 GetHostAndOptionalPort(request_->url)); 838 839 // For compat with HTTP/1.0 servers and proxies: 840 if (using_proxy) { 841 request_headers_.SetHeader(HttpRequestHeaders::kProxyConnection, 842 "keep-alive"); 843 } else { 844 request_headers_.SetHeader(HttpRequestHeaders::kConnection, "keep-alive"); 845 } 846 847 // Add a content length header? 848 if (request_->upload_data_stream) { 849 if (request_->upload_data_stream->is_chunked()) { 850 request_headers_.SetHeader( 851 HttpRequestHeaders::kTransferEncoding, "chunked"); 852 } else { 853 request_headers_.SetHeader( 854 HttpRequestHeaders::kContentLength, 855 base::Uint64ToString(request_->upload_data_stream->size())); 856 } 857 } else if (request_->method == "POST" || request_->method == "PUT" || 858 request_->method == "HEAD") { 859 // An empty POST/PUT request still needs a content length. As for HEAD, 860 // IE and Safari also add a content length header. Presumably it is to 861 // support sending a HEAD request to an URL that only expects to be sent a 862 // POST or some other method that normally would have a message body. 863 request_headers_.SetHeader(HttpRequestHeaders::kContentLength, "0"); 864 } 865 866 // Honor load flags that impact proxy caches. 867 if (request_->load_flags & LOAD_BYPASS_CACHE) { 868 request_headers_.SetHeader(HttpRequestHeaders::kPragma, "no-cache"); 869 request_headers_.SetHeader(HttpRequestHeaders::kCacheControl, "no-cache"); 870 } else if (request_->load_flags & LOAD_VALIDATE_CACHE) { 871 request_headers_.SetHeader(HttpRequestHeaders::kCacheControl, "max-age=0"); 872 } 873 874 if (ShouldApplyProxyAuth() && HaveAuth(HttpAuth::AUTH_PROXY)) 875 auth_controllers_[HttpAuth::AUTH_PROXY]->AddAuthorizationHeader( 876 &request_headers_); 877 if (ShouldApplyServerAuth() && HaveAuth(HttpAuth::AUTH_SERVER)) 878 auth_controllers_[HttpAuth::AUTH_SERVER]->AddAuthorizationHeader( 879 &request_headers_); 880 881 request_headers_.MergeFrom(request_->extra_headers); 882 response_.did_use_http_auth = 883 request_headers_.HasHeader(HttpRequestHeaders::kAuthorization) || 884 request_headers_.HasHeader(HttpRequestHeaders::kProxyAuthorization); 885} 886 887int HttpNetworkTransaction::DoInitRequestBody() { 888 next_state_ = STATE_INIT_REQUEST_BODY_COMPLETE; 889 int rv = OK; 890 if (request_->upload_data_stream) 891 rv = request_->upload_data_stream->Init(io_callback_); 892 return rv; 893} 894 895int HttpNetworkTransaction::DoInitRequestBodyComplete(int result) { 896 if (result == OK) 897 next_state_ = STATE_BUILD_REQUEST; 898 return result; 899} 900 901int HttpNetworkTransaction::DoBuildRequest() { 902 next_state_ = STATE_BUILD_REQUEST_COMPLETE; 903 headers_valid_ = false; 904 905 // This is constructed lazily (instead of within our Start method), so that 906 // we have proxy info available. 907 if (request_headers_.IsEmpty()) { 908 bool using_proxy = (proxy_info_.is_http() || proxy_info_.is_https()) && 909 !is_https_request(); 910 BuildRequestHeaders(using_proxy); 911 } 912 913 return OK; 914} 915 916int HttpNetworkTransaction::DoBuildRequestComplete(int result) { 917 if (result == OK) 918 next_state_ = STATE_SEND_REQUEST; 919 return result; 920} 921 922int HttpNetworkTransaction::DoSendRequest() { 923 send_start_time_ = base::TimeTicks::Now(); 924 next_state_ = STATE_SEND_REQUEST_COMPLETE; 925 926 return stream_->SendRequest(request_headers_, &response_, io_callback_); 927} 928 929int HttpNetworkTransaction::DoSendRequestComplete(int result) { 930 send_end_time_ = base::TimeTicks::Now(); 931 if (result < 0) 932 return HandleIOError(result); 933 response_.network_accessed = true; 934 next_state_ = STATE_READ_HEADERS; 935 return OK; 936} 937 938int HttpNetworkTransaction::DoReadHeaders() { 939 next_state_ = STATE_READ_HEADERS_COMPLETE; 940 return stream_->ReadResponseHeaders(io_callback_); 941} 942 943int HttpNetworkTransaction::DoReadHeadersComplete(int result) { 944 // We can get a certificate error or ERR_SSL_CLIENT_AUTH_CERT_NEEDED here 945 // due to SSL renegotiation. 946 if (IsCertificateError(result)) { 947 // We don't handle a certificate error during SSL renegotiation, so we 948 // have to return an error that's not in the certificate error range 949 // (-2xx). 950 LOG(ERROR) << "Got a server certificate with error " << result 951 << " during SSL renegotiation"; 952 result = ERR_CERT_ERROR_IN_SSL_RENEGOTIATION; 953 } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) { 954 // TODO(wtc): Need a test case for this code path! 955 DCHECK(stream_.get()); 956 DCHECK(is_https_request()); 957 response_.cert_request_info = new SSLCertRequestInfo; 958 stream_->GetSSLCertRequestInfo(response_.cert_request_info.get()); 959 result = HandleCertificateRequest(result); 960 if (result == OK) 961 return result; 962 } 963 964 if (result == ERR_QUIC_HANDSHAKE_FAILED) { 965 ResetConnectionAndRequestForResend(); 966 return OK; 967 } 968 969 // After we call RestartWithAuth a new response_time will be recorded, and 970 // we need to be cautious about incorrectly logging the duration across the 971 // authentication activity. 972 if (result == OK) 973 LogTransactionConnectedMetrics(); 974 975 // ERR_CONNECTION_CLOSED is treated differently at this point; if partial 976 // response headers were received, we do the best we can to make sense of it 977 // and send it back up the stack. 978 // 979 // TODO(davidben): Consider moving this to HttpBasicStream, It's a little 980 // bizarre for SPDY. Assuming this logic is useful at all. 981 // TODO(davidben): Bubble the error code up so we do not cache? 982 if (result == ERR_CONNECTION_CLOSED && response_.headers.get()) 983 result = OK; 984 985 if (result < 0) 986 return HandleIOError(result); 987 988 DCHECK(response_.headers.get()); 989 990#if defined(SPDY_PROXY_AUTH_ORIGIN) 991 // Server-induced fallback; see: http://crbug.com/143712 992 if (response_.was_fetched_via_proxy) { 993 ProxyService::DataReductionProxyBypassEventType proxy_bypass_event = 994 ProxyService::BYPASS_EVENT_TYPE_MAX; 995 bool data_reduction_proxy_used = 996 proxy_info_.proxy_server().isDataReductionProxy(); 997 bool data_reduction_fallback_proxy_used = false; 998#if defined(DATA_REDUCTION_FALLBACK_HOST) 999 if (!data_reduction_proxy_used) { 1000 data_reduction_fallback_proxy_used = 1001 proxy_info_.proxy_server().isDataReductionProxyFallback(); 1002 } 1003#endif 1004 1005 if (data_reduction_proxy_used || data_reduction_fallback_proxy_used) { 1006 net::HttpResponseHeaders::DataReductionProxyInfo 1007 data_reduction_proxy_info; 1008 proxy_bypass_event 1009 = response_.headers->GetDataReductionProxyBypassEventType( 1010 &data_reduction_proxy_info); 1011 if (proxy_bypass_event < ProxyService::BYPASS_EVENT_TYPE_MAX) { 1012 ProxyService* proxy_service = session_->proxy_service(); 1013 1014 proxy_service->RecordDataReductionProxyBypassInfo( 1015 data_reduction_proxy_used, proxy_info_.proxy_server(), 1016 proxy_bypass_event); 1017 1018 ProxyServer proxy_server; 1019#if defined(DATA_REDUCTION_FALLBACK_HOST) 1020 if (data_reduction_proxy_used && data_reduction_proxy_info.bypass_all) { 1021 // TODO(bengr): Rename as DATA_REDUCTION_FALLBACK_ORIGIN. 1022 GURL proxy_url(DATA_REDUCTION_FALLBACK_HOST); 1023 if (proxy_url.SchemeIsHTTPOrHTTPS()) { 1024 proxy_server = ProxyServer(proxy_url.SchemeIs("http") ? 1025 ProxyServer::SCHEME_HTTP : 1026 ProxyServer::SCHEME_HTTPS, 1027 HostPortPair::FromURL(proxy_url)); 1028 } 1029 } 1030#endif 1031 if (proxy_service->MarkProxiesAsBadUntil( 1032 proxy_info_, 1033 data_reduction_proxy_info.bypass_duration, 1034 proxy_server, 1035 net_log_)) { 1036 // Only retry idempotent methods. We don't want to resubmit a POST 1037 // if the proxy took some action. 1038 if (request_->method == "GET" || 1039 request_->method == "OPTIONS" || 1040 request_->method == "HEAD" || 1041 request_->method == "PUT" || 1042 request_->method == "DELETE" || 1043 request_->method == "TRACE") { 1044 ResetConnectionAndRequestForResend(); 1045 return OK; 1046 } 1047 } 1048 } 1049 } 1050 } 1051#endif // defined(SPDY_PROXY_AUTH_ORIGIN) 1052 1053 // Like Net.HttpResponseCode, but only for MAIN_FRAME loads. 1054 if (request_->load_flags & LOAD_MAIN_FRAME) { 1055 const int response_code = response_.headers->response_code(); 1056 UMA_HISTOGRAM_ENUMERATION( 1057 "Net.HttpResponseCode_Nxx_MainFrame", response_code/100, 10); 1058 } 1059 1060 net_log_.AddEvent( 1061 NetLog::TYPE_HTTP_TRANSACTION_READ_RESPONSE_HEADERS, 1062 base::Bind(&HttpResponseHeaders::NetLogCallback, response_.headers)); 1063 1064 if (response_.headers->GetParsedHttpVersion() < HttpVersion(1, 0)) { 1065 // HTTP/0.9 doesn't support the PUT method, so lack of response headers 1066 // indicates a buggy server. See: 1067 // https://bugzilla.mozilla.org/show_bug.cgi?id=193921 1068 if (request_->method == "PUT") 1069 return ERR_METHOD_NOT_SUPPORTED; 1070 } 1071 1072 // Check for an intermediate 100 Continue response. An origin server is 1073 // allowed to send this response even if we didn't ask for it, so we just 1074 // need to skip over it. 1075 // We treat any other 1xx in this same way (although in practice getting 1076 // a 1xx that isn't a 100 is rare). 1077 // Unless this is a WebSocket request, in which case we pass it on up. 1078 if (response_.headers->response_code() / 100 == 1 && 1079 !ForWebSocketHandshake()) { 1080 response_.headers = new HttpResponseHeaders(std::string()); 1081 next_state_ = STATE_READ_HEADERS; 1082 return OK; 1083 } 1084 1085 HostPortPair endpoint = HostPortPair(request_->url.HostNoBrackets(), 1086 request_->url.EffectiveIntPort()); 1087 ProcessAlternateProtocol(session_, 1088 *response_.headers.get(), 1089 endpoint); 1090 1091 int rv = HandleAuthChallenge(); 1092 if (rv != OK) 1093 return rv; 1094 1095 if (is_https_request()) 1096 stream_->GetSSLInfo(&response_.ssl_info); 1097 1098 headers_valid_ = true; 1099 1100 if (session_->huffman_aggregator()) { 1101 session_->huffman_aggregator()->AggregateTransactionCharacterCounts( 1102 *request_, 1103 request_headers_, 1104 proxy_info_.proxy_server(), 1105 *response_.headers); 1106 } 1107 return OK; 1108} 1109 1110int HttpNetworkTransaction::DoReadBody() { 1111 DCHECK(read_buf_.get()); 1112 DCHECK_GT(read_buf_len_, 0); 1113 DCHECK(stream_ != NULL); 1114 1115 next_state_ = STATE_READ_BODY_COMPLETE; 1116 return stream_->ReadResponseBody( 1117 read_buf_.get(), read_buf_len_, io_callback_); 1118} 1119 1120int HttpNetworkTransaction::DoReadBodyComplete(int result) { 1121 // We are done with the Read call. 1122 bool done = false; 1123 if (result <= 0) { 1124 DCHECK_NE(ERR_IO_PENDING, result); 1125 done = true; 1126 } 1127 1128 bool keep_alive = false; 1129 if (stream_->IsResponseBodyComplete()) { 1130 // Note: Just because IsResponseBodyComplete is true, we're not 1131 // necessarily "done". We're only "done" when it is the last 1132 // read on this HttpNetworkTransaction, which will be signified 1133 // by a zero-length read. 1134 // TODO(mbelshe): The keepalive property is really a property of 1135 // the stream. No need to compute it here just to pass back 1136 // to the stream's Close function. 1137 // TODO(rtenneti): CanFindEndOfResponse should return false if there are no 1138 // ResponseHeaders. 1139 if (stream_->CanFindEndOfResponse()) { 1140 HttpResponseHeaders* headers = GetResponseHeaders(); 1141 if (headers) 1142 keep_alive = headers->IsKeepAlive(); 1143 } 1144 } 1145 1146 // Clean up connection if we are done. 1147 if (done) { 1148 LogTransactionMetrics(); 1149 stream_->Close(!keep_alive); 1150 // Note: we don't reset the stream here. We've closed it, but we still 1151 // need it around so that callers can call methods such as 1152 // GetUploadProgress() and have them be meaningful. 1153 // TODO(mbelshe): This means we closed the stream here, and we close it 1154 // again in ~HttpNetworkTransaction. Clean that up. 1155 1156 // The next Read call will return 0 (EOF). 1157 } 1158 1159 // Clear these to avoid leaving around old state. 1160 read_buf_ = NULL; 1161 read_buf_len_ = 0; 1162 1163 return result; 1164} 1165 1166int HttpNetworkTransaction::DoDrainBodyForAuthRestart() { 1167 // This method differs from DoReadBody only in the next_state_. So we just 1168 // call DoReadBody and override the next_state_. Perhaps there is a more 1169 // elegant way for these two methods to share code. 1170 int rv = DoReadBody(); 1171 DCHECK(next_state_ == STATE_READ_BODY_COMPLETE); 1172 next_state_ = STATE_DRAIN_BODY_FOR_AUTH_RESTART_COMPLETE; 1173 return rv; 1174} 1175 1176// TODO(wtc): This method and the DoReadBodyComplete method are almost 1177// the same. Figure out a good way for these two methods to share code. 1178int HttpNetworkTransaction::DoDrainBodyForAuthRestartComplete(int result) { 1179 // keep_alive defaults to true because the very reason we're draining the 1180 // response body is to reuse the connection for auth restart. 1181 bool done = false, keep_alive = true; 1182 if (result < 0) { 1183 // Error or closed connection while reading the socket. 1184 done = true; 1185 keep_alive = false; 1186 } else if (stream_->IsResponseBodyComplete()) { 1187 done = true; 1188 } 1189 1190 if (done) { 1191 DidDrainBodyForAuthRestart(keep_alive); 1192 } else { 1193 // Keep draining. 1194 next_state_ = STATE_DRAIN_BODY_FOR_AUTH_RESTART; 1195 } 1196 1197 return OK; 1198} 1199 1200void HttpNetworkTransaction::LogTransactionConnectedMetrics() { 1201 if (logged_response_time_) 1202 return; 1203 1204 logged_response_time_ = true; 1205 1206 base::TimeDelta total_duration = response_.response_time - start_time_; 1207 1208 UMA_HISTOGRAM_CUSTOM_TIMES( 1209 "Net.Transaction_Connected", 1210 total_duration, 1211 base::TimeDelta::FromMilliseconds(1), base::TimeDelta::FromMinutes(10), 1212 100); 1213 1214 bool reused_socket = stream_->IsConnectionReused(); 1215 if (!reused_socket) { 1216 UMA_HISTOGRAM_CUSTOM_TIMES( 1217 "Net.Transaction_Connected_New_b", 1218 total_duration, 1219 base::TimeDelta::FromMilliseconds(1), base::TimeDelta::FromMinutes(10), 1220 100); 1221 } 1222 1223 // Currently, non-HIGHEST priority requests are frame or sub-frame resource 1224 // types. This will change when we also prioritize certain subresources like 1225 // css, js, etc. 1226 if (priority_ != HIGHEST) { 1227 UMA_HISTOGRAM_CUSTOM_TIMES( 1228 "Net.Priority_High_Latency_b", 1229 total_duration, 1230 base::TimeDelta::FromMilliseconds(1), base::TimeDelta::FromMinutes(10), 1231 100); 1232 } else { 1233 UMA_HISTOGRAM_CUSTOM_TIMES( 1234 "Net.Priority_Low_Latency_b", 1235 total_duration, 1236 base::TimeDelta::FromMilliseconds(1), base::TimeDelta::FromMinutes(10), 1237 100); 1238 } 1239} 1240 1241void HttpNetworkTransaction::LogTransactionMetrics() const { 1242 base::TimeDelta duration = base::Time::Now() - 1243 response_.request_time; 1244 if (60 < duration.InMinutes()) 1245 return; 1246 1247 base::TimeDelta total_duration = base::Time::Now() - start_time_; 1248 1249 UMA_HISTOGRAM_CUSTOM_TIMES("Net.Transaction_Latency_b", duration, 1250 base::TimeDelta::FromMilliseconds(1), 1251 base::TimeDelta::FromMinutes(10), 1252 100); 1253 UMA_HISTOGRAM_CUSTOM_TIMES("Net.Transaction_Latency_Total", 1254 total_duration, 1255 base::TimeDelta::FromMilliseconds(1), 1256 base::TimeDelta::FromMinutes(10), 100); 1257 1258 if (!stream_->IsConnectionReused()) { 1259 UMA_HISTOGRAM_CUSTOM_TIMES( 1260 "Net.Transaction_Latency_Total_New_Connection", 1261 total_duration, base::TimeDelta::FromMilliseconds(1), 1262 base::TimeDelta::FromMinutes(10), 100); 1263 } 1264} 1265 1266int HttpNetworkTransaction::HandleCertificateRequest(int error) { 1267 // There are two paths through which the server can request a certificate 1268 // from us. The first is during the initial handshake, the second is 1269 // during SSL renegotiation. 1270 // 1271 // In both cases, we want to close the connection before proceeding. 1272 // We do this for two reasons: 1273 // First, we don't want to keep the connection to the server hung for a 1274 // long time while the user selects a certificate. 1275 // Second, even if we did keep the connection open, NSS has a bug where 1276 // restarting the handshake for ClientAuth is currently broken. 1277 DCHECK_EQ(error, ERR_SSL_CLIENT_AUTH_CERT_NEEDED); 1278 1279 if (stream_.get()) { 1280 // Since we already have a stream, we're being called as part of SSL 1281 // renegotiation. 1282 DCHECK(!stream_request_.get()); 1283 total_received_bytes_ += stream_->GetTotalReceivedBytes(); 1284 stream_->Close(true); 1285 stream_.reset(); 1286 } 1287 1288 // The server is asking for a client certificate during the initial 1289 // handshake. 1290 stream_request_.reset(); 1291 1292 // If the user selected one of the certificates in client_certs or declined 1293 // to provide one for this server before, use the past decision 1294 // automatically. 1295 scoped_refptr<X509Certificate> client_cert; 1296 bool found_cached_cert = session_->ssl_client_auth_cache()->Lookup( 1297 response_.cert_request_info->host_and_port, &client_cert); 1298 if (!found_cached_cert) 1299 return error; 1300 1301 // Check that the certificate selected is still a certificate the server 1302 // is likely to accept, based on the criteria supplied in the 1303 // CertificateRequest message. 1304 if (client_cert.get()) { 1305 const std::vector<std::string>& cert_authorities = 1306 response_.cert_request_info->cert_authorities; 1307 1308 bool cert_still_valid = cert_authorities.empty() || 1309 client_cert->IsIssuedByEncoded(cert_authorities); 1310 if (!cert_still_valid) 1311 return error; 1312 } 1313 1314 // TODO(davidben): Add a unit test which covers this path; we need to be 1315 // able to send a legitimate certificate and also bypass/clear the 1316 // SSL session cache. 1317 SSLConfig* ssl_config = response_.cert_request_info->is_proxy ? 1318 &proxy_ssl_config_ : &server_ssl_config_; 1319 ssl_config->send_client_cert = true; 1320 ssl_config->client_cert = client_cert; 1321 next_state_ = STATE_CREATE_STREAM; 1322 // Reset the other member variables. 1323 // Note: this is necessary only with SSL renegotiation. 1324 ResetStateForRestart(); 1325 return OK; 1326} 1327 1328void HttpNetworkTransaction::HandleClientAuthError(int error) { 1329 if (server_ssl_config_.send_client_cert && 1330 (error == ERR_SSL_PROTOCOL_ERROR || IsClientCertificateError(error))) { 1331 session_->ssl_client_auth_cache()->Remove( 1332 HostPortPair::FromURL(request_->url)); 1333 } 1334} 1335 1336// TODO(rch): This does not correctly handle errors when an SSL proxy is 1337// being used, as all of the errors are handled as if they were generated 1338// by the endpoint host, request_->url, rather than considering if they were 1339// generated by the SSL proxy. http://crbug.com/69329 1340int HttpNetworkTransaction::HandleSSLHandshakeError(int error) { 1341 DCHECK(request_); 1342 HandleClientAuthError(error); 1343 1344 bool should_fallback = false; 1345 uint16 version_max = server_ssl_config_.version_max; 1346 1347 switch (error) { 1348 case ERR_SSL_PROTOCOL_ERROR: 1349 case ERR_SSL_VERSION_OR_CIPHER_MISMATCH: 1350 if (version_max >= SSL_PROTOCOL_VERSION_TLS1 && 1351 version_max > server_ssl_config_.version_min) { 1352 // This could be a TLS-intolerant server or a server that chose a 1353 // cipher suite defined only for higher protocol versions (such as 1354 // an SSL 3.0 server that chose a TLS-only cipher suite). Fall 1355 // back to the next lower version and retry. 1356 // NOTE: if the SSLClientSocket class doesn't support TLS 1.1, 1357 // specifying TLS 1.1 in version_max will result in a TLS 1.0 1358 // handshake, so falling back from TLS 1.1 to TLS 1.0 will simply 1359 // repeat the TLS 1.0 handshake. To avoid this problem, the default 1360 // version_max should match the maximum protocol version supported 1361 // by the SSLClientSocket class. 1362 version_max--; 1363 1364 // Fallback to the lower SSL version. 1365 // While SSL 3.0 fallback should be eliminated because of security 1366 // reasons, there is a high risk of breaking the servers if this is 1367 // done in general. 1368 should_fallback = true; 1369 } 1370 break; 1371 case ERR_SSL_BAD_RECORD_MAC_ALERT: 1372 if (version_max >= SSL_PROTOCOL_VERSION_TLS1_1 && 1373 version_max > server_ssl_config_.version_min) { 1374 // Some broken SSL devices negotiate TLS 1.0 when sent a TLS 1.1 or 1375 // 1.2 ClientHello, but then return a bad_record_mac alert. See 1376 // crbug.com/260358. In order to make the fallback as minimal as 1377 // possible, this fallback is only triggered for >= TLS 1.1. 1378 version_max--; 1379 should_fallback = true; 1380 } 1381 break; 1382 case ERR_SSL_INAPPROPRIATE_FALLBACK: 1383 // The server told us that we should not have fallen back. A buggy server 1384 // could trigger ERR_SSL_INAPPROPRIATE_FALLBACK with the initial 1385 // connection. |fallback_error_code_| is initialised to 1386 // ERR_SSL_INAPPROPRIATE_FALLBACK to catch this case. 1387 error = fallback_error_code_; 1388 break; 1389 } 1390 1391 if (should_fallback) { 1392 net_log_.AddEvent( 1393 NetLog::TYPE_SSL_VERSION_FALLBACK, 1394 base::Bind(&NetLogSSLVersionFallbackCallback, 1395 &request_->url, error, server_ssl_config_.version_max, 1396 version_max)); 1397 fallback_error_code_ = error; 1398 server_ssl_config_.version_max = version_max; 1399 server_ssl_config_.version_fallback = true; 1400 ResetConnectionAndRequestForResend(); 1401 error = OK; 1402 } 1403 1404 return error; 1405} 1406 1407// This method determines whether it is safe to resend the request after an 1408// IO error. It can only be called in response to request header or body 1409// write errors or response header read errors. It should not be used in 1410// other cases, such as a Connect error. 1411int HttpNetworkTransaction::HandleIOError(int error) { 1412 // Because the peer may request renegotiation with client authentication at 1413 // any time, check and handle client authentication errors. 1414 HandleClientAuthError(error); 1415 1416 switch (error) { 1417 // If we try to reuse a connection that the server is in the process of 1418 // closing, we may end up successfully writing out our request (or a 1419 // portion of our request) only to find a connection error when we try to 1420 // read from (or finish writing to) the socket. 1421 case ERR_CONNECTION_RESET: 1422 case ERR_CONNECTION_CLOSED: 1423 case ERR_CONNECTION_ABORTED: 1424 // There can be a race between the socket pool checking checking whether a 1425 // socket is still connected, receiving the FIN, and sending/reading data 1426 // on a reused socket. If we receive the FIN between the connectedness 1427 // check and writing/reading from the socket, we may first learn the socket 1428 // is disconnected when we get a ERR_SOCKET_NOT_CONNECTED. This will most 1429 // likely happen when trying to retrieve its IP address. 1430 // See http://crbug.com/105824 for more details. 1431 case ERR_SOCKET_NOT_CONNECTED: 1432 // If a socket is closed on its initial request, HttpStreamParser returns 1433 // ERR_EMPTY_RESPONSE. This may still be close/reuse race if the socket was 1434 // preconnected but failed to be used before the server timed it out. 1435 case ERR_EMPTY_RESPONSE: 1436 if (ShouldResendRequest()) { 1437 net_log_.AddEventWithNetErrorCode( 1438 NetLog::TYPE_HTTP_TRANSACTION_RESTART_AFTER_ERROR, error); 1439 ResetConnectionAndRequestForResend(); 1440 error = OK; 1441 } 1442 break; 1443 case ERR_SPDY_PING_FAILED: 1444 case ERR_SPDY_SERVER_REFUSED_STREAM: 1445 case ERR_QUIC_HANDSHAKE_FAILED: 1446 net_log_.AddEventWithNetErrorCode( 1447 NetLog::TYPE_HTTP_TRANSACTION_RESTART_AFTER_ERROR, error); 1448 ResetConnectionAndRequestForResend(); 1449 error = OK; 1450 break; 1451 } 1452 return error; 1453} 1454 1455void HttpNetworkTransaction::ResetStateForRestart() { 1456 ResetStateForAuthRestart(); 1457 if (stream_) 1458 total_received_bytes_ += stream_->GetTotalReceivedBytes(); 1459 stream_.reset(); 1460} 1461 1462void HttpNetworkTransaction::ResetStateForAuthRestart() { 1463 send_start_time_ = base::TimeTicks(); 1464 send_end_time_ = base::TimeTicks(); 1465 1466 pending_auth_target_ = HttpAuth::AUTH_NONE; 1467 read_buf_ = NULL; 1468 read_buf_len_ = 0; 1469 headers_valid_ = false; 1470 request_headers_.Clear(); 1471 response_ = HttpResponseInfo(); 1472 establishing_tunnel_ = false; 1473} 1474 1475HttpResponseHeaders* HttpNetworkTransaction::GetResponseHeaders() const { 1476 return response_.headers.get(); 1477} 1478 1479bool HttpNetworkTransaction::ShouldResendRequest() const { 1480 bool connection_is_proven = stream_->IsConnectionReused(); 1481 bool has_received_headers = GetResponseHeaders() != NULL; 1482 1483 // NOTE: we resend a request only if we reused a keep-alive connection. 1484 // This automatically prevents an infinite resend loop because we'll run 1485 // out of the cached keep-alive connections eventually. 1486 if (connection_is_proven && !has_received_headers) 1487 return true; 1488 return false; 1489} 1490 1491void HttpNetworkTransaction::ResetConnectionAndRequestForResend() { 1492 if (stream_.get()) { 1493 stream_->Close(true); 1494 stream_.reset(); 1495 } 1496 1497 // We need to clear request_headers_ because it contains the real request 1498 // headers, but we may need to resend the CONNECT request first to recreate 1499 // the SSL tunnel. 1500 request_headers_.Clear(); 1501 next_state_ = STATE_CREATE_STREAM; // Resend the request. 1502} 1503 1504bool HttpNetworkTransaction::ShouldApplyProxyAuth() const { 1505 return !is_https_request() && 1506 (proxy_info_.is_https() || proxy_info_.is_http()); 1507} 1508 1509bool HttpNetworkTransaction::ShouldApplyServerAuth() const { 1510 return !(request_->load_flags & LOAD_DO_NOT_SEND_AUTH_DATA); 1511} 1512 1513int HttpNetworkTransaction::HandleAuthChallenge() { 1514 scoped_refptr<HttpResponseHeaders> headers(GetResponseHeaders()); 1515 DCHECK(headers.get()); 1516 1517 int status = headers->response_code(); 1518 if (status != HTTP_UNAUTHORIZED && 1519 status != HTTP_PROXY_AUTHENTICATION_REQUIRED) 1520 return OK; 1521 HttpAuth::Target target = status == HTTP_PROXY_AUTHENTICATION_REQUIRED ? 1522 HttpAuth::AUTH_PROXY : HttpAuth::AUTH_SERVER; 1523 if (target == HttpAuth::AUTH_PROXY && proxy_info_.is_direct()) 1524 return ERR_UNEXPECTED_PROXY_AUTH; 1525 1526 // This case can trigger when an HTTPS server responds with a "Proxy 1527 // authentication required" status code through a non-authenticating 1528 // proxy. 1529 if (!auth_controllers_[target].get()) 1530 return ERR_UNEXPECTED_PROXY_AUTH; 1531 1532 int rv = auth_controllers_[target]->HandleAuthChallenge( 1533 headers, (request_->load_flags & LOAD_DO_NOT_SEND_AUTH_DATA) != 0, false, 1534 net_log_); 1535 if (auth_controllers_[target]->HaveAuthHandler()) 1536 pending_auth_target_ = target; 1537 1538 scoped_refptr<AuthChallengeInfo> auth_info = 1539 auth_controllers_[target]->auth_info(); 1540 if (auth_info.get()) 1541 response_.auth_challenge = auth_info; 1542 1543 return rv; 1544} 1545 1546bool HttpNetworkTransaction::HaveAuth(HttpAuth::Target target) const { 1547 return auth_controllers_[target].get() && 1548 auth_controllers_[target]->HaveAuth(); 1549} 1550 1551GURL HttpNetworkTransaction::AuthURL(HttpAuth::Target target) const { 1552 switch (target) { 1553 case HttpAuth::AUTH_PROXY: { 1554 if (!proxy_info_.proxy_server().is_valid() || 1555 proxy_info_.proxy_server().is_direct()) { 1556 return GURL(); // There is no proxy server. 1557 } 1558 const char* scheme = proxy_info_.is_https() ? "https://" : "http://"; 1559 return GURL(scheme + 1560 proxy_info_.proxy_server().host_port_pair().ToString()); 1561 } 1562 case HttpAuth::AUTH_SERVER: 1563 return request_->url; 1564 default: 1565 return GURL(); 1566 } 1567} 1568 1569bool HttpNetworkTransaction::ForWebSocketHandshake() const { 1570 return websocket_handshake_stream_base_create_helper_ && 1571 request_->url.SchemeIsWSOrWSS(); 1572} 1573 1574#define STATE_CASE(s) \ 1575 case s: \ 1576 description = base::StringPrintf("%s (0x%08X)", #s, s); \ 1577 break 1578 1579std::string HttpNetworkTransaction::DescribeState(State state) { 1580 std::string description; 1581 switch (state) { 1582 STATE_CASE(STATE_NOTIFY_BEFORE_CREATE_STREAM); 1583 STATE_CASE(STATE_CREATE_STREAM); 1584 STATE_CASE(STATE_CREATE_STREAM_COMPLETE); 1585 STATE_CASE(STATE_INIT_REQUEST_BODY); 1586 STATE_CASE(STATE_INIT_REQUEST_BODY_COMPLETE); 1587 STATE_CASE(STATE_BUILD_REQUEST); 1588 STATE_CASE(STATE_BUILD_REQUEST_COMPLETE); 1589 STATE_CASE(STATE_SEND_REQUEST); 1590 STATE_CASE(STATE_SEND_REQUEST_COMPLETE); 1591 STATE_CASE(STATE_READ_HEADERS); 1592 STATE_CASE(STATE_READ_HEADERS_COMPLETE); 1593 STATE_CASE(STATE_READ_BODY); 1594 STATE_CASE(STATE_READ_BODY_COMPLETE); 1595 STATE_CASE(STATE_DRAIN_BODY_FOR_AUTH_RESTART); 1596 STATE_CASE(STATE_DRAIN_BODY_FOR_AUTH_RESTART_COMPLETE); 1597 STATE_CASE(STATE_NONE); 1598 default: 1599 description = base::StringPrintf("Unknown state 0x%08X (%u)", state, 1600 state); 1601 break; 1602 } 1603 return description; 1604} 1605 1606#undef STATE_CASE 1607 1608} // namespace net 1609