Verify alternative server certificate validity for origin.

net/http/http_stream_factory_impl_job.h

Index: net/http/http_stream_factory_impl_job.h
diff --git a/net/http/http_stream_factory_impl_job.h b/net/http/http_stream_factory_impl_job.h
index 27c5f00ec0fafa39f80396c0413b239326e30e7a..e19d0a9f89a073e33743e4193b2a25ebdf532cb4 100644
--- a/net/http/http_stream_factory_impl_job.h
+++ b/net/http/http_stream_factory_impl_job.h
@@ -140,6 +140,50 @@ class HttpStreamFactoryImpl::Job {
     STATUS_SUCCEEDED
   };
 
+  // Wrapper class for SpdySessionPool methods to enforce certificate
+  // requirements for SpdySessions.
+  class ValidSpdySessionPool {
+   public:
+    ValidSpdySessionPool(SpdySessionPool* spdy_session_pool,
+                         GURL& origin_url,
+                         bool is_spdy_alternate);
+
+    // Returns OK if a SpdySession was not found (in which case |spdy_session|
+    // is set to nullptr), or if one was found (in which case |spdy_session| is
+    // set to it) and it has an associated SSL certificate with is valid for
+    // |origin_url_|, or if this requirement does not apply because the Job is
+    // not a SPDY alternate job.  Returns the appropriate error code otherwise,
+    // in which case |spdy_session| should not be used.
+    int FindAvailableSession(const SpdySessionKey& key,
+                             const BoundNetLog& net_log,
+                             base::WeakPtr<SpdySession>* spdy_session);
+
+    // Creates a SpdySession and sets |spdy_session| to point to it.  Returns OK
+    // if the associated SSL certificate is valid for |origin_url_|, or if this
+    // requirement does not apply because the Job is not a SPDY alternate job.
+    // Returns the appropriate error code otherwise, in which case
+    // |spdy_session| should not be used.
+    int CreateAvailableSessionFromSocket(
+        const SpdySessionKey& key,
+        scoped_ptr<ClientSocketHandle> connection,
+        const BoundNetLog& net_log,
+        int certificate_error_code,
+        bool is_secure,
+        base::WeakPtr<SpdySession>* spdy_session);
+
+   private:
+    // Returns OK if |spdy_session| has an associated SSL certificate with is
+    // valid for |origin_url_|, or if this requirement does not apply because
+    // the Job is not a SPDY alternate job, or if |spdy_session| is null.
+    // Returns appropriate error code otherwise.
+    int CheckAlternativeServiceValidityForOrigin(
+        base::WeakPtr<SpdySession> spdy_session);
+
+    SpdySessionPool* const spdy_session_pool_;
+    const GURL origin_url_;
+    const bool is_spdy_alternate_;
+  };
+
   void OnStreamReadyCallback();
   void OnWebSocketHandshakeStreamReadyCallback();
   // This callback function is called when a new SPDY session is created.
@@ -327,6 +371,8 @@ class HttpStreamFactoryImpl::Job {
   // preconnect.
   int num_streams_;
 
+  scoped_ptr<ValidSpdySessionPool> valid_spdy_session_pool_;
+
   // Initialized when we create a new SpdySession.
   base::WeakPtr<SpdySession> new_spdy_session_;