SPDY: Make sure we don't try to send https/wss over an unauthenticated, but encrypted SSL socket.

net/http/http_network_transaction.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/format_macros.h"
 #include "base/histogram.h"
@@ skipping 270 matching lines @@
       user_callback_(NULL),
       session_(session),
       request_(NULL),
       pac_request_(NULL),
       connection_(new ClientSocketHandle),
       reused_socket_(false),
       headers_valid_(false),
       logged_response_time_(false),
       using_ssl_(false),
       using_spdy_(false),
+      spdy_certificate_error_(OK),
       alternate_protocol_mode_(
           g_use_alternate_protocols ? kUnspecified :
           kDoNotUseAlternateProtocol),
       read_buf_len_(0),
       next_state_(STATE_NONE) {
   session->ssl_config_service()->GetSSLConfig(&ssl_config_);
   if (g_next_protos)
     ssl_config_.next_protos = *g_next_protos;
   if (!g_tls_intolerant_servers)
     g_tls_intolerant_servers = new std::set<std::string>;
@@ skipping 834 matching lines @@
   if (alternate_protocol_mode_ == kUsingAlternateProtocol &&
       alternate_protocol_ == HttpAlternateProtocols::NPN_SPDY_1 &&
       !using_spdy_) {
     // We tried using the NPN_SPDY_1 alternate protocol, but failed, so we
     // fallback.
     MarkBrokenAlternateProtocolAndFallback();
     return OK;
   }
 
   if (IsCertificateError(result)) {
-    result = HandleCertificateError(result);
-    if (result == OK && !connection_->socket()->IsConnectedAndIdle()) {
-      connection_->socket()->Disconnect();
-      connection_->Reset();
-      next_state_ = STATE_INIT_CONNECTION;
-      return result;
+    if (using_spdy_ && request_->url.SchemeIs("http")) {
+      // We ignore certificate errors for http over spdy.
+      spdy_certificate_error_ = result;
+      result = OK;
+    } else {
+      result = HandleCertificateError(result);
+      if (result == OK && !connection_->socket()->IsConnectedAndIdle()) {
+        connection_->socket()->Disconnect();
+        connection_->Reset();
+        next_state_ = STATE_INIT_CONNECTION;
+        return result;
+      }
     }
   }
 
   if (result == OK) {
     DCHECK(ssl_connect_start_time_ != base::TimeTicks());
     base::TimeDelta connect_duration =
         base::TimeTicks::Now() - ssl_connect_start_time_;
 
     if (using_spdy_) {
       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SpdyConnectionLatency",
@@ skipping 326 matching lines @@
   scoped_refptr<SpdySession> spdy_session;
 
   if (spdy_pool->HasSession(endpoint_)) {
     spdy_session = spdy_pool->Get(endpoint_, session_, net_log_);
   } else {
     // SPDY is negotiated using the TLS next protocol negotiation (NPN)
     // extension, so |connection_| must contain an SSLClientSocket.
     DCHECK(using_ssl_);
     CHECK(connection_->socket());
     int error = spdy_pool->GetSpdySessionFromSSLSocket(
-        endpoint_, session_, connection_.release(), net_log_, spdy_session);
+        endpoint_, session_, connection_.release(), net_log_,
+        spdy_certificate_error_, &spdy_session);
     if (error != OK)
       return error;
   }
 
   CHECK(spdy_session.get());
 
   UploadDataStream* upload_data = NULL;
   if (request_->upload_data) {
     int error_code = OK;
     upload_data = UploadDataStream::Create(request_->upload_data, &error_code);
     if (!upload_data)
       return error_code;
   }
   headers_valid_ = false;
   scoped_refptr<SpdyStream> spdy_stream;
-  if (request_->method == "GET")
-    spdy_stream = spdy_session->GetPushStream(request_->url, net_log_);
+  if (request_->method == "GET") {
+    int error =
+        spdy_session->GetPushStream(request_->url, &spdy_stream, net_log_);
+    if (error != OK)
+      return error;
+  }
   if (spdy_stream.get()) {
     DCHECK(spdy_stream->pushed());
     CHECK(spdy_stream->GetDelegate() == NULL);
     spdy_http_stream_.reset(new SpdyHttpStream(spdy_stream));
     spdy_http_stream_->InitializeRequest(*request_, base::Time::Now(), NULL);
   } else {
-    spdy_stream = spdy_session->CreateStream(request_->url,
-                                             request_->priority,
-                                             net_log_);
+    int error = spdy_session->CreateStream(request_->url,
+                                           request_->priority,
+                                           &spdy_stream,
+                                           net_log_);
+    if (error != OK)
+      return error;
     DCHECK(!spdy_stream->pushed());
     CHECK(spdy_stream->GetDelegate() == NULL);
     spdy_http_stream_.reset(new SpdyHttpStream(spdy_stream));
     spdy_http_stream_->InitializeRequest(
         *request_, base::Time::Now(), upload_data);
   }
   return spdy_http_stream_->SendRequest(&response_, &io_callback_);
 }
 
 int HttpNetworkTransaction::DoSpdySendRequestComplete(int result) {
@@ skipping 494 matching lines @@
       endpoint_);
 
   alternate_protocol_mode_ = kDoNotUseAlternateProtocol;
   if (connection_->socket())
     connection_->socket()->Disconnect();
   connection_->Reset();
   next_state_ = STATE_INIT_CONNECTION;
 }
 
 }  // namespace net