SPDY: Make sure we don't try to send https/wss over an unauthenticated, but encrypted SSL socket.

net/spdy/spdy_session.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_session.h"
 
 #include "base/basictypes.h"
 #include "base/linked_ptr.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
@@ skipping 135 matching lines @@
           write_callback_(this, &SpdySession::OnWriteComplete)),
       host_port_pair_(host_port_pair),
       session_(session),
       connection_(new ClientSocketHandle),
       read_buffer_(new IOBuffer(kReadBufferSize)),
       read_pending_(false),
       stream_hi_water_mark_(1),  // Always start at 1 for the first stream id.
       write_pending_(false),
       delayed_write_pending_(false),
       is_secure_(false),
+      certificate_error_code_(OK),
       error_(OK),
       state_(IDLE),
       streams_initiated_count_(0),
       streams_pushed_count_(0),
       streams_pushed_and_claimed_count_(0),
       streams_abandoned_count_(0),
       sent_settings_(false),
       received_settings_(false),
       in_session_pool_(true),
       net_log_(BoundNetLog::Make(net_log, NetLog::SOURCE_SPDY_SESSION)) {
@@ skipping 18 matching lines @@
     // With Spdy we can't recycle sockets.
     connection_->socket()->Disconnect();
   }
 
   RecordHistograms();
 
   net_log_.EndEvent(NetLog::TYPE_SPDY_SESSION, NULL);
 }
 
 net::Error SpdySession::InitializeWithSSLSocket(
-    ClientSocketHandle* connection) {
+    ClientSocketHandle* connection,
+    int certificate_error_code) {
   static StatsCounter spdy_sessions("spdy.sessions");
   spdy_sessions.Increment();
 
   AdjustSocketBufferSizes(connection->socket());
 
   state_ = CONNECTED;
   connection_.reset(connection);
   is_secure_ = true;  // |connection| contains an SSLClientSocket.
+  certificate_error_code_ = certificate_error_code;
 
   // This is a newly initialized session that no client should have a handle to
   // yet, so there's no need to start writing data as in OnTCPConnect(), but we
   // should start reading data.
   net::Error error = ReadSocket();
   if (error == ERR_IO_PENDING)
     return OK;
   return error;
 }
 
@@ skipping 17 matching lines @@
   DCHECK(rv <= 0);
 
   // If the connect is pending, we still return ok.  The APIs enqueue
   // work until after the connect completes asynchronously later.
   if (rv == net::ERR_IO_PENDING)
     return net::OK;
   OnTCPConnect(rv);
   return static_cast<net::Error>(rv);
 }
 
-scoped_refptr<SpdyStream> SpdySession::GetPushStream(
+int SpdySession::GetPushStream(
     const GURL& url,
+    scoped_refptr<SpdyStream>* stream,
     const BoundNetLog& stream_net_log) {
   CHECK_NE(state_, CLOSED);
+
+  *stream = NULL;
+
+  // Don't allow access to secure push streams over an unauthenticated, but
+  // encrypted SSL socket.
+  if (is_secure_ && certificate_error_code_ != OK &&
+      (url.SchemeIs("https") || url.SchemeIs("wss"))) {
+    LOG(DFATAL) << "Tried to get pushed spdy stream for secure content over an "
+                << "unauthenticated session.";
+    return certificate_error_code_;
+  }
+
   const std::string& path = url.PathForRequest();
 
-  scoped_refptr<SpdyStream> stream = GetActivePushStream(path);
-  if (stream) {
+  *stream = GetActivePushStream(path);
+  if (stream->get()) {
     DCHECK(streams_pushed_and_claimed_count_ < streams_pushed_count_);
     streams_pushed_and_claimed_count_++;
-    return stream;
+    return OK;
   }
 
   // Check if we have a pending push stream for this url.
   // Note that we shouldn't have a pushed stream for non-GET method.
   PendingStreamMap::iterator it;
   it = pending_streams_.find(path);
   if (it != pending_streams_.end()) {
     // Server has advertised a stream, but not yet sent it.
     DCHECK(!it->second);
     // Server will assign a stream id when the push stream arrives.  Use 0 for
     // now.
     net_log_.AddEvent(NetLog::TYPE_SPDY_STREAM_ADOPTED_PUSH_STREAM, NULL);
-    stream = new SpdyStream(this, 0, true);
-    stream->set_path(path);
-    stream->set_net_log(stream_net_log);
-    it->second = stream;
-    return stream;
+    *stream = new SpdyStream(this, 0, true);
+    (*stream)->set_path(path);
+    (*stream)->set_net_log(stream_net_log);
+    it->second = *stream;
+    return OK;
   }
-  return NULL;
+  return OK;
 }
 
-const scoped_refptr<SpdyStream>& SpdySession::CreateStream(
+int SpdySession::CreateStream(
     const GURL& url,
     RequestPriority priority,
+    scoped_refptr<SpdyStream>* spdy_stream,
     const BoundNetLog& stream_net_log) {
+  // Make sure that we don't try to send https/wss over an unauthenticated, but
+  // encrypted SSL socket.
+  if (is_secure_ && certificate_error_code_ != OK &&
+      (url.SchemeIs("https") || url.SchemeIs("wss"))) {
+    LOG(DFATAL) << "Tried to create spdy stream for secure content over an "
+                << "unauthenticated session.";
+    return certificate_error_code_;
+  }
+
   const std::string& path = url.PathForRequest();
 
   const spdy::SpdyStreamId stream_id = GetNewStreamId();
 
-  scoped_refptr<SpdyStream> stream(new SpdyStream(this, stream_id, false));
+  *spdy_stream = new SpdyStream(this, stream_id, false);
+  const scoped_refptr<SpdyStream>& stream = *spdy_stream;
 
   stream->set_priority(priority);
   stream->set_path(path);
   stream->set_net_log(stream_net_log);
   ActivateStream(stream);
 
   UMA_HISTOGRAM_CUSTOM_COUNTS("Net.SpdyPriorityCount",
       static_cast<int>(priority), 0, 10, 11);
 
   LOG(INFO) << "SpdyStream: Creating stream " << stream_id << " for " << url;
   // TODO(mbelshe): Optimize memory allocations
   DCHECK(priority >= SPDY_PRIORITY_HIGHEST &&
          priority <= SPDY_PRIORITY_LOWEST);
 
   DCHECK_EQ(active_streams_[stream_id].get(), stream.get());
-  return active_streams_[stream_id];
+  return OK;
 }
 
 int SpdySession::WriteSynStream(
     spdy::SpdyStreamId stream_id,
     RequestPriority priority,
     spdy::SpdyControlFlags flags,
     const linked_ptr<spdy::SpdyHeaderBlock>& headers) {
   // Find our stream
   if (!IsStreamActive(stream_id))
     return ERR_INVALID_SPDY_STREAM;
@@ skipping 854 matching lines @@
           UMA_HISTOGRAM_CUSTOM_COUNTS("Net.SpdySettingsRetransRate",
                                       setting.second,
                                       1, 100, 50);
           break;
       }
     }
   }
 }
 
 }  // namespace net