Verify alternative server certificate validity for origin.

net/http/http_stream_factory_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl.h"
 
 #include <string>
 
 #include "base/logging.h"
 #include "base/stl_util.h"
@@ skipping 144 matching lines @@
     return kNoAlternativeService;
 
   HostPortPair origin = HostPortPair::FromURL(original_url);
   HttpServerProperties& http_server_properties =
       *session_->http_server_properties();
   const AlternativeService alternative_service =
       http_server_properties.GetAlternativeService(origin);
 
   if (alternative_service.protocol == UNINITIALIZED_ALTERNATE_PROTOCOL)
     return kNoAlternativeService;
-  // TODO(bnc):  Make sure that callers connect to the specified host, and that
-  // certificate requirements are enforced.  Then remove the following two
-  // lines.
-  if (alternative_service.host != origin.host())
-    return kNoAlternativeService;
   if (http_server_properties.IsAlternativeServiceBroken(alternative_service)) {
     HistogramAlternateProtocolUsage(ALTERNATE_PROTOCOL_USAGE_BROKEN);
     return kNoAlternativeService;
   }
   if (!IsAlternateProtocolValid(alternative_service.protocol)) {
     NOTREACHED();
     return kNoAlternativeService;
   }
 
   // Some shared unix systems may have user home directories (like
@@ skipping 14 matching lines @@
     if (!HttpStreamFactory::spdy_enabled())
       return kNoAlternativeService;
 
     if (session_->HasSpdyExclusion(origin))
       return kNoAlternativeService;
 
     return alternative_service;
   }
 
   DCHECK_EQ(QUIC, alternative_service.protocol);
+  // TODO(bnc):  Make sure that certificate requirements are enforced when using
+  // QUIC, then remove the following two lines.
+  if (alternative_service.host != origin.host())
+    return kNoAlternativeService;

[Ryan Hamilton, 2015/04/10 18:37:36]

We actually intend to make use of this feature first in QUIC. I'm not sure if
that affects your sequencing of work, but just FYI.

[Bence, 2015/04/10 19:55:16]

Okay.  I started with HTTP/2 tests because there are half as many of them.  I'll
get to the QUIC case next.

   if (!session_->params().enable_quic)
     return kNoAlternativeService;
 
   if (session_->quic_stream_factory()->IsQuicDisabled(origin.port()))
     return kNoAlternativeService;
 
   return alternative_service;
 }
 
 void HttpStreamFactoryImpl::OrphanJob(Job* job, const Request* request) {
@@ skipping 55 matching lines @@
   delete job;
 }
 
 void HttpStreamFactoryImpl::OnPreconnectsComplete(const Job* job) {
   preconnect_job_set_.erase(job);
   delete job;
   OnPreconnectsCompleteInternal();
 }
 
 }  // namespace net