Fail the SPDY transaction if it does not meet TLS base requirements.

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 1102 matching lines @@
   if (existing_spdy_session_.get()) {
     // We picked up an existing session, so we don't need our socket.
     if (connection_->socket())
       connection_->socket()->Disconnect();
     connection_->Reset();
     std::swap(spdy_session, existing_spdy_session_);
   } else {
     SpdySessionPool* spdy_pool = session_->spdy_session_pool();
     spdy_session = spdy_pool->FindAvailableSession(spdy_session_key, net_log_);
     if (!spdy_session) {
-      new_spdy_session_ =
+      base::WeakPtr<SpdySession> new_spdy_session =
           spdy_pool->CreateAvailableSessionFromSocket(spdy_session_key,
                                                       connection_.Pass(),
                                                       net_log_,
                                                       spdy_certificate_error_,
                                                       using_ssl_);
+      if (!new_spdy_session->HasAcceptableTransportSecurity()) {
+        new_spdy_session->CloseSessionOnError(ERR_SPDY_PROTOCOL_ERROR,
+                                              "TLS security too low");

[Johnny, 2014/05/21 16:27:04]

Create an ERR mapping for INADEQUATE_SECURITY [1] and use that?

https://code.google.com/p/chromium/codesearch#chromium/src/net/spdy/spdy_prot...

[willchan no longer on Chromium, 2014/05/21 17:47:15]

Done.

+        return ERR_SPDY_PROTOCOL_ERROR;
+      }
+
+      new_spdy_session_ = new_spdy_session;
+      spdy_session_direct_ = direct;
       const HostPortPair& host_port_pair = spdy_session_key.host_port_pair();
       base::WeakPtr<HttpServerProperties> http_server_properties =
           session_->http_server_properties();
       if (http_server_properties)
         http_server_properties->SetSupportsSpdy(host_port_pair, true);
-      spdy_session_direct_ = direct;
 
       // Create a SpdyHttpStream attached to the session;
       // OnNewSpdySessionReadyCallback is not called until an event loop
       // iteration later, so if the SpdySession is closed between then, allow
       // reuse state from the underlying socket, sampled by SpdyHttpStream,
       // bubble up to the request.
       bool use_relative_url = direct || request_info_.url.SchemeIs("https");
       stream_.reset(new SpdyHttpStream(new_spdy_session_, use_relative_url));
 
       return OK;
@@ skipping 348 matching lines @@
       (net::LOAD_MAIN_FRAME | net::LOAD_SUB_FRAME | net::LOAD_PREFETCH |
        net::LOAD_IS_DOWNLOAD)) {
     // Avoid pipelining resources that may be streamed for a long time.
     return false;
   }
   return stream_factory_->http_pipelined_host_pool_.IsKeyEligibleForPipelining(
       *http_pipelining_key_.get());
 }
 
 }  // namespace net