Block port 443 for all protocols other than HTTPS or WSS.

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 605 matching lines @@
 int HttpStreamFactoryImpl::Job::DoStart() {
   origin_ = HostPortPair::FromURL(request_info_.url);
   origin_url_ = stream_factory_->ApplyHostMappingRules(
       request_info_.url, &origin_);
 
   net_log_.BeginEvent(NetLog::TYPE_HTTP_STREAM_JOB,
                       base::Bind(&NetLogHttpStreamJobCallback,
                                  &request_info_.url, &origin_url_,
                                  priority_));
 
-  // Don't connect to restricted ports.
-  bool is_port_allowed = IsPortAllowedByDefault(origin_.port());
   if (request_info_.url.SchemeIs("ftp")) {
     // Never share connection with other jobs for FTP requests.
     DCHECK(!waiting_job_);
+  }
 
-    is_port_allowed = IsPortAllowedByFtp(origin_.port());
-  }
-  if (!is_port_allowed && !IsPortAllowedByOverride(origin_.port())) {
+  // Don't connect to restricted ports.
+  // Note: origin_.port() == request_info_.url.EffectiveIntPort()
+  if (!IsEffectivePortAllowedByScheme(request_info_.url) &&
+      !IsPortAllowedByOverride(origin_.port())) {
     if (waiting_job_) {
       waiting_job_->Resume(this);
       waiting_job_ = NULL;
     }
     return ERR_UNSAFE_PORT;
   }
 
   next_state_ = STATE_RESOLVE_PROXY;
   return OK;
 }
@@ skipping 818 matching lines @@
 
   if (job_status_ == STATUS_SUCCEEDED && other_job_status_ == STATUS_BROKEN) {
     HistogramBrokenAlternateProtocolLocation(
         BROKEN_ALTERNATE_PROTOCOL_LOCATION_HTTP_STREAM_FACTORY_IMPL_JOB_MAIN);
     session_->http_server_properties()->SetBrokenAlternateProtocol(
         HostPortPair::FromURL(request_info_.url));
   }
 }
 
 }  // namespace net