From a04bced7333504dc489efa9e498b8b432f92fb39 Mon Sep 17 00:00:00 2001
From: Kershaw Chang <kershaw@mozilla.com>
Date: Mon, 1 Feb 2021 21:09:45 +0000
Subject: [PATCH] Bug 1690008 - Clear npnToken when we want to create a
 non-http3 connection info r=necko-reviewers,dragana

Differential Revision: https://phabricator.services.mozilla.com/D103690
---
 .../protocol/http/nsHttpConnectionInfo.cpp    | 21 +++++-------
 netwerk/protocol/http/nsHttpTransaction.cpp   | 33 ++++++++-----------
 2 files changed, 22 insertions(+), 32 deletions(-)

diff --git a/netwerk/protocol/http/nsHttpConnectionInfo.cpp b/netwerk/protocol/http/nsHttpConnectionInfo.cpp
index 176a77338efe..1f2fe9f4bb6a 100644
--- a/netwerk/protocol/http/nsHttpConnectionInfo.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionInfo.cpp
@@ -63,7 +63,8 @@ nsHttpConnectionInfo::nsHttpConnectionInfo(
   mEndToEndSSL = true;  // so DefaultPort() works
   mRoutedPort = routedPort == -1 ? DefaultPort() : routedPort;
 
-  if (!originHost.Equals(routedHost) || (originPort != routedPort)) {
+  if (!originHost.Equals(routedHost) || (originPort != routedPort) ||
+      aIsHttp3) {
     mRoutedHost = routedHost;
   }
   Init(originHost, originPort, npnToken, username, proxyInfo, originAttributes,
@@ -440,18 +441,12 @@ nsHttpConnectionInfo::DeserializeHttpConnectionInfoCloneArgs(
 }
 
 void nsHttpConnectionInfo::CloneAsDirectRoute(nsHttpConnectionInfo** outCI) {
-  if (mRoutedHost.IsEmpty()) {
-    RefPtr<nsHttpConnectionInfo> clone = Clone();
-    // Explicitly set mIsHttp3 to false, since CloneAsDirectRoute() is used to
-    // create a non-http3 connection info.
-    clone->mIsHttp3 = false;
-    clone.forget(outCI);
-    return;
-  }
-
-  RefPtr<nsHttpConnectionInfo> clone =
-      new nsHttpConnectionInfo(mOrigin, mOriginPort, ""_ns, mUsername,
-                               mProxyInfo, mOriginAttributes, mEndToEndSSL);
+  // Explicitly use an empty npnToken when |mIsHttp3| is true, since we want to
+  // create a non-http3 connection info.
+  RefPtr<nsHttpConnectionInfo> clone = new nsHttpConnectionInfo(
+      mOrigin, mOriginPort,
+      (mRoutedHost.IsEmpty() && !mIsHttp3) ? mNPNToken : ""_ns, mUsername,
+      mProxyInfo, mOriginAttributes, mEndToEndSSL);
   // Make sure the anonymous, insecure-scheme, and private flags are transferred
   clone->SetAnonymous(GetAnonymous());
   clone->SetPrivate(GetPrivate());
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 42cd868aa2f2..8d72d428fa30 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -1744,6 +1744,15 @@ bool nsHttpTransaction::ResponseTimeoutEnabled() const {
 // nsHttpTransaction <private>
 //-----------------------------------------------------------------------------
 
+static inline void RemoveAlternateServiceUsedHeader(
+    nsHttpRequestHead* aRequestHead) {
+  if (aRequestHead) {
+    DebugOnly<nsresult> rv =
+        aRequestHead->SetHeader(nsHttp::Alternate_Service_Used, "0"_ns);
+    MOZ_ASSERT(NS_SUCCEEDED(rv));
+  }
+}
+
 nsresult nsHttpTransaction::Restart() {
   MOZ_ASSERT(OnSocketThread(), "not on socket thread");
 
@@ -1794,11 +1803,7 @@ nsresult nsHttpTransaction::Restart() {
     RefPtr<nsHttpConnectionInfo> ci;
     mConnInfo->CloneAsDirectRoute(getter_AddRefs(ci));
     mConnInfo = ci;
-    if (mRequestHead) {
-      DebugOnly<nsresult> rv =
-          mRequestHead->SetHeader(nsHttp::Alternate_Service_Used, "0"_ns);
-      MOZ_ASSERT(NS_SUCCEEDED(rv));
-    }
+    RemoveAlternateServiceUsedHeader(mRequestHead);
   }
 
   // Reset mDoNotRemoveAltSvc for the next try.
@@ -2536,11 +2541,7 @@ void nsHttpTransaction::DisableHttp3() {
     // After CloneAsDirectRoute(), http3 will be disabled.
     RefPtr<nsHttpConnectionInfo> connInfo;
     mConnInfo->CloneAsDirectRoute(getter_AddRefs(connInfo));
-    if (mRequestHead) {
-      DebugOnly<nsresult> rv =
-          mRequestHead->SetHeader(nsHttp::Alternate_Service_Used, "0"_ns);
-      MOZ_ASSERT(NS_SUCCEEDED(rv));
-    }
+    RemoveAlternateServiceUsedHeader(mRequestHead);
     MOZ_ASSERT(!connInfo->IsHttp3());
     mConnInfo.swap(connInfo);
   }
@@ -2936,11 +2937,7 @@ nsresult nsHttpTransaction::RestartOnFastOpenError() {
     RefPtr<nsHttpConnectionInfo> ci;
     mConnInfo->CloneAsDirectRoute(getter_AddRefs(ci));
     mConnInfo = ci;
-    if (mRequestHead) {
-      DebugOnly<nsresult> rv =
-          mRequestHead->SetHeader(nsHttp::Alternate_Service_Used, "0"_ns);
-      MOZ_ASSERT(NS_SUCCEEDED(rv));
-    }
+    RemoveAlternateServiceUsedHeader(mRequestHead);
   }
   mEarlyDataDisposition = EARLY_NONE;
   m0RTTInProgress = false;
@@ -3226,16 +3223,14 @@ void nsHttpTransaction::MaybeCancelFallbackTimer() {
 void nsHttpTransaction::OnBackupConnectionReady() {
   LOG(("nsHttpTransaction::OnBackupConnectionReady [%p] mConnected=%d", this,
        mConnected));
-  if (mConnected || mClosed) {
+  if (mConnected || mClosed || mRestarted) {
     return;
   }
 
   HandleFallback(mBackupConnInfo);
 
   mCaps |= NS_HTTP_DISALLOW_HTTP3;
-  DebugOnly<nsresult> rv =
-      mRequestHead->SetHeader(nsHttp::Alternate_Service_Used, "0"_ns);
-  MOZ_ASSERT(NS_SUCCEEDED(rv));
+  RemoveAlternateServiceUsedHeader(mRequestHead);
 }
 
 void nsHttpTransaction::OnHttp3BackupTimer() {