* Change logic of SpdySession::VerifyDomainAuthentication to

net/spdy/spdy_session.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_session.h"
 
 #include <map>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
@@ skipping 417 matching lines @@
   if (state_ != CONNECTED)
     return false;
 
   SSLInfo ssl_info;
   bool was_npn_negotiated;
   NextProto protocol_negotiated = kProtoUnknown;
   if (!GetSSLInfo(&ssl_info, &was_npn_negotiated, &protocol_negotiated))
     return true;   // This is not a secure session, so all domains are okay.
 
   return !ssl_info.client_cert_sent &&
-      (g_enable_credential_frames || !ssl_info.channel_id_sent) &&
+      (g_enable_credential_frames || !ssl_info.channel_id_sent ||
+       ServerBoundCertService::GetDomainForHost(domain) ==
+       ServerBoundCertService::GetDomainForHost(
+           host_port_proxy_pair_.first.host())) &&

[wtc, 2012/09/19 22:42:35]

It would be useful to add a comment to explain this new test.

If the new host name is in the same subdomain, then it shares
the same channel ID and therefore we don't need to send a
CREDENTIAL frame for the new host name.

       ssl_info.cert->VerifyNameMatch(domain);
 }
 
 void SpdySession::SetStreamHasWriteAvailable(SpdyStream* stream,
                                              SpdyIOBufferProducer* producer) {
   write_queue_.push(producer);
   stream_producers_[producer] = stream;
   WriteSocketLater();
 }
 
@@ skipping 1550 matching lines @@
 SSLClientSocket* SpdySession::GetSSLClientSocket() const {
   if (!is_secure_)
     return NULL;
   SSLClientSocket* ssl_socket =
       reinterpret_cast<SSLClientSocket*>(connection_->socket());
   DCHECK(ssl_socket);
   return ssl_socket;
 }
 
 }  // namespace net