Fail the SPDY transaction if it does not meet TLS base requirements.

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 23 matching lines @@
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/client_socket_pool.h"
 #include "net/socket/client_socket_pool_manager.h"
 #include "net/socket/socks_client_socket_pool.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/ssl_client_socket_pool.h"
 #include "net/spdy/spdy_http_stream.h"
 #include "net/spdy/spdy_session.h"
 #include "net/spdy/spdy_session_pool.h"
 #include "net/ssl/ssl_cert_request_info.h"
+#include "net/ssl/ssl_connection_status_flags.h"
 
 namespace net {
 
 // Returns parameters associated with the start of a HTTP stream job.
 base::Value* NetLogHttpStreamJobCallback(const GURL* original_url,
                                          const GURL* url,
                                          RequestPriority priority,
                                          NetLog::LogLevel /* log_level */) {
   base::DictionaryValue* dict = new base::DictionaryValue();
   dict->SetString("original_url", original_url->GetOrigin().spec());
@@ skipping 1058 matching lines @@
   if (existing_spdy_session_.get()) {
     // We picked up an existing session, so we don't need our socket.
     if (connection_->socket())
       connection_->socket()->Disconnect();
     connection_->Reset();
     std::swap(spdy_session, existing_spdy_session_);
   } else {
     SpdySessionPool* spdy_pool = session_->spdy_session_pool();
     spdy_session = spdy_pool->FindAvailableSession(spdy_session_key, net_log_);
     if (!spdy_session) {
-      new_spdy_session_ =
+      SSLInfo ssl_info;
+      if (using_ssl_) {
+        SSLClientSocket* ssl_socket =
+            static_cast<SSLClientSocket*>(connection_->socket());
+        ssl_socket->GetSSLInfo(&ssl_info);
+      }
+
+      base::WeakPtr<SpdySession> new_spdy_session =
           spdy_pool->CreateAvailableSessionFromSocket(spdy_session_key,
                                                       connection_.Pass(),
                                                       net_log_,
                                                       spdy_certificate_error_,
                                                       using_ssl_);
+      if (using_ssl_) {
+        if (SSLConnectionStatusToVersion(ssl_info.connection_status) <
+            SSL_CONNECTION_VERSION_TLS1_2) {
+          new_spdy_session->CloseSessionOnError(
+              ERR_SPDY_PROTOCOL_ERROR,
+              base::StringPrintf(
+                  "TLS Version[%d] too old",
+                  SSLConnectionStatusToVersion(ssl_info.connection_status)));
+          return ERR_SPDY_PROTOCOL_ERROR;
+        }
+      }
+
+      new_spdy_session_ = new_spdy_session;
+      spdy_session_direct_ = direct;
       const HostPortPair& host_port_pair = spdy_session_key.host_port_pair();
       base::WeakPtr<HttpServerProperties> http_server_properties =
           session_->http_server_properties();
       if (http_server_properties)
         http_server_properties->SetSupportsSpdy(host_port_pair, true);
-      spdy_session_direct_ = direct;
 
       // Create a SpdyHttpStream attached to the session;
       // OnNewSpdySessionReadyCallback is not called until an event loop
       // iteration later, so if the SpdySession is closed between then, allow
       // reuse state from the underlying socket, sampled by SpdyHttpStream,
       // bubble up to the request.
       bool use_relative_url = direct || request_info_.url.SchemeIs("https");
       stream_.reset(new SpdyHttpStream(new_spdy_session_, use_relative_url));
 
       return OK;
@@ skipping 348 matching lines @@
       (net::LOAD_MAIN_FRAME | net::LOAD_SUB_FRAME | net::LOAD_PREFETCH |
        net::LOAD_IS_DOWNLOAD)) {
     // Avoid pipelining resources that may be streamed for a long time.
     return false;
   }
   return stream_factory_->http_pipelined_host_pool_.IsKeyEligibleForPipelining(
       *http_pipelining_key_.get());
 }
 
 }  // namespace net