Add a new enable_user_alternate_protocol_ports flag.

When the new enable_user_alternate_protocol_ports flag is present
then Alternate-Protocol requests to user controlled ports (>1024)
from restricted ports (<1024) will be honored.

Review URL: https://chromiumcodereview.appspot.com/12089060

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180074 0039d316-1c4b-4281-b951-d872f2087c98

13 files changed, 129 insertions, 98 deletions

diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index fe5f91d..025fbe5 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc
@@ -350,7 +350,9 @@ IOThread::Globals::Globals()
       ignore_certificate_errors(false),
       http_pipelining_enabled(false),
       testing_fixed_http_port(0),
-      testing_fixed_https_port(0) {}
+      testing_fixed_https_port(0),
+      enable_user_alternate_protocol_ports(false) {
+}
 
 IOThread::Globals::~Globals() {}
 
@@ -526,7 +528,10 @@ void IOThread::Init() {
   if (command_line.HasSwitch(switches::kUseSpdyOverQuic)) {
     globals_->use_spdy_over_quic.set(true);
   }
-
+  if (command_line.HasSwitch(
+          switches::kEnableUserAlternateProtocolPorts)) {
+    globals_->enable_user_alternate_protocol_ports = true;
+  }
   InitializeNetworkOptions(command_line);
 
   net::HttpNetworkSession::Params session_params;
@@ -834,6 +839,8 @@ void IOThread::InitializeNetworkSessionParams(
   globals_->origin_port_to_force_quic_on.CopyToIfSet(
       &params->origin_port_to_force_quic_on);
   globals_->use_spdy_over_quic.CopyToIfSet(&params->use_spdy_over_quic);
+  params->enable_user_alternate_protocol_ports =
+      globals_->enable_user_alternate_protocol_ports;
 }
 
 net::SSLConfigService* IOThread::GetSSLConfigService() {
diff --git a/chrome/browser/io_thread.h b/chrome/browser/io_thread.h
index d612b35..431eb92 100644
--- a/chrome/browser/io_thread.h
+++ b/chrome/browser/io_thread.h
@@ -163,6 +163,7 @@ class IOThread : public content::BrowserThreadDelegate {
     Optional<bool> enable_quic;
     Optional<uint16> origin_port_to_force_quic_on;
     Optional<bool> use_spdy_over_quic;
+    bool enable_user_alternate_protocol_ports;
     // NetErrorTabHelper uses |dns_probe_service| to send DNS probes when a
     // main frame load fails with a DNS error in order to provide more useful
     // information to the renderer so it can show a more specific error page.
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index 29f59ec..024d66f 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -641,6 +641,10 @@ const char kEnableSyncDictionary[] = "enable-sync-dictionary";
 // Enables context menu for selecting groups of tabs.
 const char kEnableTabGroupsContextMenu[]    = "enable-tab-groups-context-menu";
 
+// Enables Alternate-Protocol when the port is user controlled (> 1024).
+const char kEnableUserAlternateProtocolPorts[] =
+    "enable-user-controlled-alternate-protocol-ports";
+
 // Spawns threads to watch for excessive delays in specified message loops.
 // User should set breakpoints on Alarm() to examine problematic thread.
 //
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index 4662ccb..2f138e7 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -180,6 +180,7 @@ extern const char kEnableStackedTabStrip[];
 extern const char kEnableSuggestionsTabPage[];
 extern const char kEnableSyncDictionary[];
 extern const char kEnableTabGroupsContextMenu[];
+extern const char kEnableUserAlternateProtocolPorts[];
 extern const char kEnableWatchdog[];
 extern const char kEnableWebSocketOverSpdy[];
 extern const char kExtensionsInActionBox[];
diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
index a53a31b..eedcf0d 100644
--- a/net/http/http_network_session.cc
+++ b/net/http/http_network_session.cc
@@ -82,7 +82,8 @@ HttpNetworkSession::Params::Params()
       time_func(&base::TimeTicks::Now),
       enable_quic(false),
       origin_port_to_force_quic_on(0),
-      use_spdy_over_quic(false) {
+      use_spdy_over_quic(false),
+      enable_user_alternate_protocol_ports(false) {
 }
 
 // TODO(mbelshe): Move the socket factories into HttpStreamFactory.
diff --git a/net/http/http_network_session.h b/net/http/http_network_session.h
index 9bb41d2..8999754 100644
--- a/net/http/http_network_session.h
+++ b/net/http/http_network_session.h
@@ -83,6 +83,7 @@ class NET_EXPORT HttpNetworkSession
     bool enable_quic;
     uint16 origin_port_to_force_quic_on;
     bool use_spdy_over_quic;
+    bool enable_user_alternate_protocol_ports;
   };
 
   enum SocketPoolType {
diff --git a/net/http/http_network_transaction_spdy2_unittest.cc b/net/http/http_network_transaction_spdy2_unittest.cc
index 09742a4..7cb6f91 100644
--- a/net/http/http_network_transaction_spdy2_unittest.cc
+++ b/net/http/http_network_transaction_spdy2_unittest.cc
@@ -256,6 +256,8 @@ class HttpNetworkTransactionSpdy2Test : public PlatformTest {
     PlatformTest::TearDown();
     NetworkChangeNotifier::NotifyObserversOfIPAddressChangeForTests();
     MessageLoop::current()->RunUntilIdle();
+    HttpStreamFactory::set_use_alternate_protocols(false);
+    HttpStreamFactory::SetNextProtos(std::vector<std::string>());
   }
 
   // Either |write_failure| specifies a write failure or |read_failure|
@@ -6590,7 +6592,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, GroupNameForDirectConnections) {
                 transport_conn_pool->last_group_name_received());
   }
 
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test, GroupNameForHTTPProxyConnections) {
@@ -6656,8 +6657,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, GroupNameForHTTPProxyConnections) {
       EXPECT_EQ(tests[i].expected_group_name,
                 http_proxy_pool->last_group_name_received());
   }
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test, GroupNameForSOCKSConnections) {
@@ -6730,8 +6729,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, GroupNameForSOCKSConnections) {
       EXPECT_EQ(tests[i].expected_group_name,
                 socks_conn_pool->last_group_name_received());
   }
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test, ReconsiderProxyAfterFailedConnection) {
@@ -7459,7 +7456,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, HonorAlternateProtocolHeader) {
   expected_alternate.protocol = NPN_SPDY_2;
   EXPECT_TRUE(expected_alternate.Equals(alternate));
 
-  HttpStreamFactory::set_use_alternate_protocols(false);
   HttpStreamFactory::SetNextProtos(std::vector<std::string>());
 }
 
@@ -7520,7 +7516,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
       http_server_properties->GetAlternateProtocol(
           HostPortPair::FromURL(request.url));
   EXPECT_EQ(ALTERNATE_PROTOCOL_BROKEN, alternate.protocol);
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test,
@@ -7569,8 +7564,55 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Invalid change to unrestricted port should fail.
   EXPECT_EQ(ERR_CONNECTION_REFUSED, callback.WaitForResult());
+}
 
-  HttpStreamFactory::set_use_alternate_protocols(false);
+TEST_F(HttpNetworkTransactionSpdy2Test,
+       AlternateProtocolPortRestrictedPermitted) {
+  // Ensure that we're allowed to redirect traffic via an alternate
+  // protocol to an unrestricted (port >= 1024) when the original traffic was
+  // on a restricted port (port < 1024) if we set
+  // enable_user_alternate_protocol_ports.
+
+  HttpStreamFactory::set_use_alternate_protocols(true);
+  SpdySessionDependencies session_deps;
+  session_deps.enable_user_alternate_protocol_ports = true;
+
+  HttpRequestInfo restricted_port_request;
+  restricted_port_request.method = "GET";
+  restricted_port_request.url = GURL("http://www.google.com:1023/");
+  restricted_port_request.load_flags = 0;
+
+  MockConnect mock_connect(ASYNC, ERR_CONNECTION_REFUSED);
+  StaticSocketDataProvider first_data;
+  first_data.set_connect_data(mock_connect);
+  session_deps.socket_factory->AddSocketDataProvider(&first_data);
+
+  MockRead data_reads[] = {
+    MockRead("HTTP/1.1 200 OK\r\n\r\n"),
+    MockRead("hello world"),
+    MockRead(ASYNC, OK),
+  };
+  StaticSocketDataProvider second_data(
+      data_reads, arraysize(data_reads), NULL, 0);
+  session_deps.socket_factory->AddSocketDataProvider(&second_data);
+
+  scoped_refptr<HttpNetworkSession> session(CreateSession(&session_deps));
+
+  HttpServerProperties* http_server_properties =
+      session->http_server_properties();
+  const int kUnrestrictedAlternatePort = 1024;
+  http_server_properties->SetAlternateProtocol(
+      HostPortPair::FromURL(restricted_port_request.url),
+      kUnrestrictedAlternatePort,
+      NPN_SPDY_3);
+
+  scoped_ptr<HttpTransaction> trans(new HttpNetworkTransaction(session));
+  TestCompletionCallback callback;
+
+  EXPECT_EQ(ERR_IO_PENDING, trans->Start(
+      &restricted_port_request, callback.callback(), BoundNetLog()));
+  // Change to unrestricted port should succeed.
+  EXPECT_EQ(OK, callback.WaitForResult());
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test,
@@ -7619,8 +7661,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Valid change to restricted port should pass.
   EXPECT_EQ(OK, callback.WaitForResult());
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test,
@@ -7669,8 +7709,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Valid change to restricted port should pass.
   EXPECT_EQ(OK, callback.WaitForResult());
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test,
@@ -7719,8 +7757,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Valid change to an unrestricted port should pass.
   EXPECT_EQ(OK, callback.WaitForResult());
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test,
@@ -7862,9 +7898,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, UseAlternateProtocolForNpnSpdy) {
 
   ASSERT_EQ(OK, ReadTransaction(trans.get(), &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test, AlternateProtocolWithSpdyLateBinding) {
@@ -7978,9 +8011,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, AlternateProtocolWithSpdyLateBinding) {
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans3, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test, StallAlternateProtocolForNpnSpdy) {
@@ -8053,9 +8083,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, StallAlternateProtocolForNpnSpdy) {
 
   ASSERT_EQ(OK, ReadTransaction(trans.get(), &response_data));
   EXPECT_EQ("hello world", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 class CapturingProxyResolver : public ProxyResolver {
@@ -8216,9 +8243,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
   EXPECT_TRUE(trans->GetLoadTimingInfo(&load_timing_info));
   TestLoadTimingNotReusedWithPac(load_timing_info,
                                  CONNECT_TIMING_HAS_SSL_TIMES);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test,
@@ -8332,9 +8356,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
 
   ASSERT_EQ(OK, ReadTransaction(trans.get(), &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 // GenerateAuthToken is a mighty big test.
@@ -9107,9 +9128,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, NpnWithHttpOverSSL) {
 
   EXPECT_FALSE(response->was_fetched_via_spdy);
   EXPECT_TRUE(response->was_npn_negotiated);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test, SpdyPostNPNServerHangup) {
@@ -9150,9 +9168,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, SpdyPostNPNServerHangup) {
   int rv = trans->Start(&request, callback.callback(), BoundNetLog());
   EXPECT_EQ(ERR_IO_PENDING, rv);
   EXPECT_EQ(ERR_CONNECTION_CLOSED, callback.WaitForResult());
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy2Test, SpdyAlternateProtocolThroughProxy) {
@@ -9308,9 +9323,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, SpdyAlternateProtocolThroughProxy) {
   EXPECT_TRUE(trans_2->GetLoadTimingInfo(&load_timing_info));
   TestLoadTimingNotReusedWithPac(load_timing_info,
                                  CONNECT_TIMING_HAS_SSL_TIMES);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 // Test that if we cancel the transaction as the connection is completing, that
@@ -10060,9 +10072,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, MAYBE_UseIPConnectionPooling) {
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans2, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 #undef MAYBE_UseIPConnectionPooling
 
@@ -10149,9 +10158,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test, UseIPConnectionPoolingAfterResolution) {
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans2, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 class OneTimeCachingHostResolver : public net::HostResolver {
@@ -10296,9 +10302,6 @@ TEST_F(HttpNetworkTransactionSpdy2Test,
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans2, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 #undef MAYBE_UseIPConnectionPoolingWithHostCacheExpiration
 
diff --git a/net/http/http_network_transaction_spdy3_unittest.cc b/net/http/http_network_transaction_spdy3_unittest.cc
index ff54dad..fdcf111 100644
--- a/net/http/http_network_transaction_spdy3_unittest.cc
+++ b/net/http/http_network_transaction_spdy3_unittest.cc
@@ -256,6 +256,8 @@ class HttpNetworkTransactionSpdy3Test : public PlatformTest {
     PlatformTest::TearDown();
     NetworkChangeNotifier::NotifyObserversOfIPAddressChangeForTests();
     MessageLoop::current()->RunUntilIdle();
+    HttpStreamFactory::set_use_alternate_protocols(false);
+    HttpStreamFactory::SetNextProtos(std::vector<std::string>());
   }
 
   // Either |write_failure| specifies a write failure or |read_failure|
@@ -6590,7 +6592,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, GroupNameForDirectConnections) {
                 transport_conn_pool->last_group_name_received());
   }
 
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, GroupNameForHTTPProxyConnections) {
@@ -6656,8 +6657,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, GroupNameForHTTPProxyConnections) {
       EXPECT_EQ(tests[i].expected_group_name,
                 http_proxy_pool->last_group_name_received());
   }
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, GroupNameForSOCKSConnections) {
@@ -6730,8 +6729,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, GroupNameForSOCKSConnections) {
       EXPECT_EQ(tests[i].expected_group_name,
                 socks_conn_pool->last_group_name_received());
   }
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, ReconsiderProxyAfterFailedConnection) {
@@ -7459,7 +7456,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, HonorAlternateProtocolHeader) {
   expected_alternate.protocol = NPN_SPDY_3;
   EXPECT_TRUE(expected_alternate.Equals(alternate));
 
-  HttpStreamFactory::set_use_alternate_protocols(false);
   HttpStreamFactory::SetNextProtos(std::vector<std::string>());
 }
 
@@ -7520,7 +7516,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
       http_server_properties->GetAlternateProtocol(
           HostPortPair::FromURL(request.url));
   EXPECT_EQ(ALTERNATE_PROTOCOL_BROKEN, alternate.protocol);
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test,
@@ -7569,8 +7564,55 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Invalid change to unrestricted port should fail.
   EXPECT_EQ(ERR_CONNECTION_REFUSED, callback.WaitForResult());
+}
 
-  HttpStreamFactory::set_use_alternate_protocols(false);
+TEST_F(HttpNetworkTransactionSpdy3Test,
+       AlternateProtocolPortRestrictedPermitted) {
+  // Ensure that we're allowed to redirect traffic via an alternate
+  // protocol to an unrestricted (port >= 1024) when the original traffic was
+  // on a restricted port (port < 1024) if we set
+  // enable_user_alternate_protocol_ports.
+
+  HttpStreamFactory::set_use_alternate_protocols(true);
+  SpdySessionDependencies session_deps;
+  session_deps.enable_user_alternate_protocol_ports = true;
+
+  HttpRequestInfo restricted_port_request;
+  restricted_port_request.method = "GET";
+  restricted_port_request.url = GURL("http://www.google.com:1023/");
+  restricted_port_request.load_flags = 0;
+
+  MockConnect mock_connect(ASYNC, ERR_CONNECTION_REFUSED);
+  StaticSocketDataProvider first_data;
+  first_data.set_connect_data(mock_connect);
+  session_deps.socket_factory->AddSocketDataProvider(&first_data);
+
+  MockRead data_reads[] = {
+    MockRead("HTTP/1.1 200 OK\r\n\r\n"),
+    MockRead("hello world"),
+    MockRead(ASYNC, OK),
+  };
+  StaticSocketDataProvider second_data(
+      data_reads, arraysize(data_reads), NULL, 0);
+  session_deps.socket_factory->AddSocketDataProvider(&second_data);
+
+  scoped_refptr<HttpNetworkSession> session(CreateSession(&session_deps));
+
+  HttpServerProperties* http_server_properties =
+      session->http_server_properties();
+  const int kUnrestrictedAlternatePort = 1024;
+  http_server_properties->SetAlternateProtocol(
+      HostPortPair::FromURL(restricted_port_request.url),
+      kUnrestrictedAlternatePort,
+      NPN_SPDY_3);
+
+  scoped_ptr<HttpTransaction> trans(new HttpNetworkTransaction(session));
+  TestCompletionCallback callback;
+
+  EXPECT_EQ(ERR_IO_PENDING, trans->Start(
+      &restricted_port_request, callback.callback(), BoundNetLog()));
+  // Change to unrestricted port should succeed.
+  EXPECT_EQ(OK, callback.WaitForResult());
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test,
@@ -7619,8 +7661,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Valid change to restricted port should pass.
   EXPECT_EQ(OK, callback.WaitForResult());
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test,
@@ -7669,8 +7709,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Valid change to restricted port should pass.
   EXPECT_EQ(OK, callback.WaitForResult());
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test,
@@ -7719,8 +7757,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
   EXPECT_EQ(ERR_IO_PENDING, rv);
   // Valid change to an unrestricted port should pass.
   EXPECT_EQ(OK, callback.WaitForResult());
-
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, AlternateProtocolUnsafeBlocked) {
@@ -7861,9 +7897,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, UseAlternateProtocolForNpnSpdy) {
 
   ASSERT_EQ(OK, ReadTransaction(trans.get(), &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, AlternateProtocolWithSpdyLateBinding) {
@@ -7977,9 +8010,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, AlternateProtocolWithSpdyLateBinding) {
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans3, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, StallAlternateProtocolForNpnSpdy) {
@@ -8052,9 +8082,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, StallAlternateProtocolForNpnSpdy) {
 
   ASSERT_EQ(OK, ReadTransaction(trans.get(), &response_data));
   EXPECT_EQ("hello world", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 class CapturingProxyResolver : public ProxyResolver {
@@ -8215,9 +8242,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
   EXPECT_TRUE(trans->GetLoadTimingInfo(&load_timing_info));
   TestLoadTimingNotReusedWithPac(load_timing_info,
                                  CONNECT_TIMING_HAS_SSL_TIMES);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test,
@@ -8331,9 +8355,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
 
   ASSERT_EQ(OK, ReadTransaction(trans.get(), &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 // GenerateAuthToken is a mighty big test.
@@ -9106,9 +9127,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, NpnWithHttpOverSSL) {
 
   EXPECT_FALSE(response->was_fetched_via_spdy);
   EXPECT_TRUE(response->was_npn_negotiated);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, SpdyPostNPNServerHangup) {
@@ -9149,9 +9167,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, SpdyPostNPNServerHangup) {
   int rv = trans->Start(&request, callback.callback(), BoundNetLog());
   EXPECT_EQ(ERR_IO_PENDING, rv);
   EXPECT_EQ(ERR_CONNECTION_CLOSED, callback.WaitForResult());
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, SpdyAlternateProtocolThroughProxy) {
@@ -9307,9 +9322,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, SpdyAlternateProtocolThroughProxy) {
   EXPECT_TRUE(trans_2->GetLoadTimingInfo(&load_timing_info));
   TestLoadTimingNotReusedWithPac(load_timing_info,
                                  CONNECT_TIMING_HAS_SSL_TIMES);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 // Test that if we cancel the transaction as the connection is completing, that
@@ -10052,9 +10064,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, UseIPConnectionPooling) {
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans2, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, UseIPConnectionPoolingAfterResolution) {
@@ -10140,9 +10149,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test, UseIPConnectionPoolingAfterResolution) {
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans2, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 class OneTimeCachingHostResolver : public net::HostResolver {
@@ -10281,9 +10287,6 @@ TEST_F(HttpNetworkTransactionSpdy3Test,
   EXPECT_TRUE(response->was_npn_negotiated);
   ASSERT_EQ(OK, ReadTransaction(&trans2, &response_data));
   EXPECT_EQ("hello!", response_data);
-
-  HttpStreamFactory::SetNextProtos(std::vector<std::string>());
-  HttpStreamFactory::set_use_alternate_protocols(false);
 }
 
 TEST_F(HttpNetworkTransactionSpdy3Test, ReadPipelineEvictionFallback) {
diff --git a/net/http/http_stream_factory_impl.cc b/net/http/http_stream_factory_impl.cc
index 24ae8a6..3324670 100644
--- a/net/http/http_stream_factory_impl.cc
+++ b/net/http/http_stream_factory_impl.cc
@@ -171,7 +171,9 @@ bool HttpStreamFactoryImpl::GetAlternateProtocolRequestFor(
   // These systems also enforce ports <1024 as restricted ports.  So don't
   // allow protocol upgrades to user-controllable ports.
   const int kUnrestrictedPort = 1024;
-  if (alternate.port >= kUnrestrictedPort && origin.port() < kUnrestrictedPort)
+  if (!session_->params().enable_user_alternate_protocol_ports &&
+      (alternate.port >= kUnrestrictedPort &&
+       origin.port() < kUnrestrictedPort))
     return false;
 
   origin.set_port(alternate.port);
diff --git a/net/spdy/spdy_test_util_spdy2.cc b/net/spdy/spdy_test_util_spdy2.cc
index 179977e..0b1939f 100644
--- a/net/spdy/spdy_test_util_spdy2.cc
+++ b/net/spdy/spdy_test_util_spdy2.cc
@@ -862,6 +862,7 @@ SpdySessionDependencies::SpdySessionDependencies()
       enable_ip_pooling(true),
       enable_compression(false),
       enable_ping(false),
+      enable_user_alternate_protocol_ports(false),
       time_func(&base::TimeTicks::Now),
       net_log(NULL) {
   // Note: The CancelledTransaction test does cleanup by running all
@@ -927,6 +928,8 @@ net::HttpNetworkSession::Params SpdySessionDependencies::CreateSessionParams(
   params.enable_spdy_ip_pooling = session_deps->enable_ip_pooling;
   params.enable_spdy_compression = session_deps->enable_compression;
   params.enable_spdy_ping_based_connection_checking = session_deps->enable_ping;
+  params.enable_user_alternate_protocol_ports =
+      session_deps->enable_user_alternate_protocol_ports;
   params.spdy_default_protocol = kProtoSPDY2;
   params.time_func = session_deps->time_func;
   params.trusted_spdy_proxy = session_deps->trusted_spdy_proxy;
diff --git a/net/spdy/spdy_test_util_spdy2.h b/net/spdy/spdy_test_util_spdy2.h
index bc0eb0d..cfacdd2 100644
--- a/net/spdy/spdy_test_util_spdy2.h
+++ b/net/spdy/spdy_test_util_spdy2.h
@@ -368,6 +368,7 @@ struct SpdySessionDependencies {
   bool enable_ip_pooling;
   bool enable_compression;
   bool enable_ping;
+  bool enable_user_alternate_protocol_ports;
   SpdySession::TimeFunc time_func;
   std::string trusted_spdy_proxy;
   NetLog* net_log;
diff --git a/net/spdy/spdy_test_util_spdy3.cc b/net/spdy/spdy_test_util_spdy3.cc
index fc82a32..e3a08c7 100644
--- a/net/spdy/spdy_test_util_spdy3.cc
+++ b/net/spdy/spdy_test_util_spdy3.cc
@@ -904,6 +904,7 @@ SpdySessionDependencies::SpdySessionDependencies()
       enable_ip_pooling(true),
       enable_compression(false),
       enable_ping(false),
+      enable_user_alternate_protocol_ports(false),
       initial_recv_window_size(kSpdyStreamInitialWindowSize),
       time_func(&base::TimeTicks::Now),
       net_log(NULL) {
@@ -970,6 +971,8 @@ net::HttpNetworkSession::Params SpdySessionDependencies::CreateSessionParams(
   params.http_server_properties = &session_deps->http_server_properties;
   params.enable_spdy_compression = session_deps->enable_compression;
   params.enable_spdy_ping_based_connection_checking = session_deps->enable_ping;
+  params.enable_user_alternate_protocol_ports =
+      session_deps->enable_user_alternate_protocol_ports;
   params.spdy_default_protocol = kProtoSPDY3;
   params.spdy_initial_recv_window_size = session_deps->initial_recv_window_size;
   params.time_func = session_deps->time_func;
diff --git a/net/spdy/spdy_test_util_spdy3.h b/net/spdy/spdy_test_util_spdy3.h
index a3d202b..24abd60 100644
--- a/net/spdy/spdy_test_util_spdy3.h
+++ b/net/spdy/spdy_test_util_spdy3.h
@@ -408,6 +408,7 @@ struct SpdySessionDependencies {
   bool enable_ip_pooling;
   bool enable_compression;
   bool enable_ping;
+  bool enable_user_alternate_protocol_ports;
   size_t initial_recv_window_size;
   SpdySession::TimeFunc time_func;
   std::string trusted_spdy_proxy;