Block port 443 for all protocols other than HTTPS or WSS.

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 606 matching lines @@
   origin_ = HostPortPair::FromURL(request_info_.url);
   origin_url_ = stream_factory_->ApplyHostMappingRules(
       request_info_.url, &origin_);
 
   net_log_.BeginEvent(NetLog::TYPE_HTTP_STREAM_JOB,
                       base::Bind(&NetLogHttpStreamJobCallback,
                                  &request_info_.url, &origin_url_,
                                  priority_));
 
   // Don't connect to restricted ports.
   bool is_port_allowed = IsPortAllowedByDefault(origin_.port());

[davidben, 2014/12/02 20:39:45]

This was in the original, but it's really weird that we compute this, throw it
away, and then call it again as part of the scheme-specific ones. How about
turning this into an if/else chain.

[lgarron, 2014/12/02 20:49:00]

What about a more general helper function called IsPortAllowedByScheme(...)?

   if (request_info_.url.SchemeIs("ftp")) {
     // Never share connection with other jobs for FTP requests.
     DCHECK(!waiting_job_);
 
     is_port_allowed = IsPortAllowedByFtp(origin_.port());
   }
+  if (request_info_.url.SchemeIs("https") ||
+      request_info_.url.SchemeIs("wss")) {
+    is_port_allowed = IsPortAllowedByHttpsOrWss(origin_.port());
+  }
+
   if (!is_port_allowed && !IsPortAllowedByOverride(origin_.port())) {
     if (waiting_job_) {
       waiting_job_->Resume(this);
       waiting_job_ = NULL;
     }
     return ERR_UNSAFE_PORT;
   }
 
   next_state_ = STATE_RESOLVE_PROXY;
   return OK;
@@ skipping 819 matching lines @@
 
   if (job_status_ == STATUS_SUCCEEDED && other_job_status_ == STATUS_BROKEN) {
     HistogramBrokenAlternateProtocolLocation(
         BROKEN_ALTERNATE_PROTOCOL_LOCATION_HTTP_STREAM_FACTORY_IMPL_JOB_MAIN);
     session_->http_server_properties()->SetBrokenAlternateProtocol(
         HostPortPair::FromURL(request_info_.url));
   }
 }
 
 }  // namespace net