Apply HSTS rules to also upgrade ws:// -> wss:// if appropriate. This avoids

net/url_request/url_request_http_job.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
@@ skipping 165 matching lines @@
     NOTREACHED() << "requires a valid context";
     return new URLRequestErrorJob(request, ERR_INVALID_ARGUMENT);
   }
 
   TransportSecurityState::DomainState domain_state;
   if (scheme == "http" &&
       request->context()->transport_security_state() &&
       request->context()->transport_security_state()->IsEnabledForHost(
           &domain_state,
           request->url().host(),
-          IsSNIAvailable(request->context()))) {
+          request->context()->IsSNIAvailable())) {
     if (domain_state.mode ==
          TransportSecurityState::DomainState::MODE_STRICT) {
       DCHECK_EQ(request->url().scheme(), "http");
       url_canon::Replacements<char> replacements;
       static const char kNewScheme[] = "https";
       replacements.SetScheme(kNewScheme,
                              url_parse::Component(0, strlen(kNewScheme)));
       GURL new_location = request->url().ReplaceComponents(replacements);
       return new URLRequestRedirectJob(request, new_location);
     } else {
@@ skipping 461 matching lines @@
   // merges into a SPDY connection to www.example.com, and gets a different
   // certificate.
   const SSLInfo& ssl_info = transaction_->GetResponseInfo()->ssl_info;
   if (result == OK &&
       ssl_info.is_valid() &&
       context_->transport_security_state()) {
     TransportSecurityState::DomainState domain_state;
     if (context_->transport_security_state()->IsEnabledForHost(
             &domain_state,
             request_->url().host(),
-            IsSNIAvailable(context_)) &&
+            context_->IsSNIAvailable()) &&
         ssl_info.is_issued_by_known_root &&
         !domain_state.IsChainOfPublicKeysPermitted(ssl_info.public_key_hashes)){
       result = ERR_CERT_INVALID;
     }
   }
 
   if (result == OK) {
     SaveCookiesAndNotifyHeadersComplete();
   } else if (ShouldTreatAsCertificateError(result)) {
     // We encountered an SSL certificate error.  Ask our delegate to decide
@@ skipping 34 matching lines @@
   if (result == ERR_CERT_UNABLE_TO_CHECK_REVOCATION)
     return true;
 
   // Check whether our context is using Strict-Transport-Security.
   if (!context_->transport_security_state())
     return true;
 
   TransportSecurityState::DomainState domain_state;
   // TODO(agl): don't ignore opportunistic mode.
   const bool r = context_->transport_security_state()->IsEnabledForHost(
-      &domain_state, request_info_.url.host(), IsSNIAvailable(context_));
+      &domain_state, request_info_.url.host(), context_->IsSNIAvailable());
 
   return !r || domain_state.mode ==
                TransportSecurityState::DomainState::MODE_OPPORTUNISTIC;
 }
 
 void URLRequestHttpJob::RestartTransactionWithAuth(
     const string16& username,
     const string16& password) {
   username_ = username;
   password_ = password;
@@ skipping 629 matching lines @@
   }
 }
 
 bool URLRequestHttpJob::IsCompressibleContent() const {
   std::string mime_type;
   return GetMimeType(&mime_type) &&
       (IsSupportedJavascriptMimeType(mime_type.c_str()) ||
        IsSupportedNonImageMimeType(mime_type.c_str()));
 }
 
-// static
-bool URLRequestHttpJob::IsSNIAvailable(URLRequestContext* context) {
-  if (!context->ssl_config_service())
-    return false;
-
-  SSLConfig ssl_config;
-  context->ssl_config_service()->GetSSLConfig(&ssl_config);
-  return ssl_config.tls1_enabled;
-}
-
 }  // namespace net