Prevent requests for http://host:port/ from being sent over an existing spdy session to https://hos…

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
@@ skipping 223 matching lines @@
 void HttpStreamFactoryImpl::Job::GetSSLInfo() {
   DCHECK(using_ssl_);
   DCHECK(!establishing_tunnel_);
   DCHECK(connection_.get() && connection_->socket());
   SSLClientSocket* ssl_socket =
       static_cast<SSLClientSocket*>(connection_->socket());
   ssl_socket->GetSSLInfo(&ssl_info_);
 }
 
 HostPortProxyPair HttpStreamFactoryImpl::Job::GetSpdySessionKey() const {
+  // In the case that we're using an HTTPS proxy for an HTTP url,
+  // we look for a SPDY session *to* the proxy, instead of to the
+  // origin server.
   if (IsHttpsProxyAndHttpUrl()) {
     return HostPortProxyPair(proxy_info_.proxy_server().host_port_pair(),
                              ProxyServer::Direct());
   } else {
     return HostPortProxyPair(origin_, proxy_info_.proxy_server());
   }
 }
 
+bool HttpStreamFactoryImpl::Job::CanUseExistingSpdySession() const {
+  // We need to make sure that if a spdy session was created for
+  // https://somehost/ that we don't use that session for http://somehost:443/.
+  // The only time we can use an existing session is if the request URL is
+  // https (the normal case) or if we're connection to a SPDY proxy, or
+  // if we're running with force_spdy_always_.  crbug.com/133176
+  return request_info_.url.SchemeIs("https") ||
+         proxy_info_.proxy_server().is_https() ||
+         force_spdy_always_;
+}
+
 void HttpStreamFactoryImpl::Job::OnStreamReadyCallback() {
   DCHECK(stream_.get());
   DCHECK(!IsPreconnecting());
   if (IsOrphaned()) {
     stream_factory_->OnOrphanedJobComplete(this);
   } else {
     request_->Complete(was_npn_negotiated(),
                        protocol_negotiated(),
                        using_spdy(),
                        net_log_);
@@ skipping 382 matching lines @@
   next_state_ = STATE_INIT_CONNECTION_COMPLETE;
 
   using_ssl_ = request_info_.url.SchemeIs("https") || ShouldForceSpdySSL();
   using_spdy_ = false;
 
   // Check first if we have a spdy session for this group.  If so, then go
   // straight to using that.
   HostPortProxyPair spdy_session_key = GetSpdySessionKey();
   scoped_refptr<SpdySession> spdy_session =
       session_->spdy_session_pool()->GetIfExists(spdy_session_key, net_log_);
-  if (spdy_session) {
+  if (spdy_session && CanUseExistingSpdySession()) {
     // If we're preconnecting, but we already have a SpdySession, we don't
     // actually need to preconnect any sockets, so we're done.
     if (IsPreconnecting())
       return OK;
     using_spdy_ = true;
     next_state_ = STATE_CREATE_STREAM;
     existing_spdy_session_ = spdy_session;
     return OK;
   } else if (request_ && (using_ssl_ || ShouldForceSpdyWithoutSSL())) {
     // Update the spdy session key for the request that launched this job.
@@ skipping 52 matching lines @@
         request_info_.priority,
         session_,
         proxy_info_,
         ShouldForceSpdySSL(),
         want_spdy_over_npn,
         server_ssl_config_,
         proxy_ssl_config_,
         net_log_,
         num_streams_);
   } else {
+    // If we can't use a SPDY session, don't both checking for one after
+    // the hostname is resolved.
+    OnHostResolutionCallback resolution_callback = CanUseExistingSpdySession() ?
+        base::Bind(&Job::OnHostResolution, session_->spdy_session_pool(),
+                   GetSpdySessionKey()) :
+        OnHostResolutionCallback();
     return InitSocketHandleForHttpRequest(
         origin_url_, request_info_.extra_headers, request_info_.load_flags,
         request_info_.priority, session_, proxy_info_, ShouldForceSpdySSL(),
         want_spdy_over_npn, server_ssl_config_, proxy_ssl_config_, net_log_,
-        connection_.get(),
-        //OnHostResolutionCallback(),
-        base::Bind(&Job::OnHostResolution, session_->spdy_session_pool(),
-                   GetSpdySessionKey()),
-        io_callback_);
+        connection_.get(), resolution_callback, io_callback_);
   }
 }
 
 int HttpStreamFactoryImpl::Job::DoInitConnectionComplete(int result) {
   if (IsPreconnecting()) {
     DCHECK_EQ(OK, result);
     return OK;
   }
 
   if (result == ERR_SPDY_SESSION_ALREADY_EXISTS) {
@@ skipping 519 matching lines @@
       (net::LOAD_MAIN_FRAME | net::LOAD_SUB_FRAME | net::LOAD_PREFETCH |
        net::LOAD_IS_DOWNLOAD)) {
     // Avoid pipelining resources that may be streamed for a long time.
     return false;
   }
   return stream_factory_->http_pipelined_host_pool_.IsKeyEligibleForPipelining(
       *http_pipelining_key_.get());
 }
 
 }  // namespace net