Revert revert 62918 - net: clean up SSLHostInfo construction."

Was reverted in r62922 due to a change landing between the try run and the
commit.

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63046 0039d316-1c4b-4281-b951-d872f2087c98

18 files changed, 132 insertions, 53 deletions

diff --git a/net/socket/client_socket_factory.cc b/net/socket/client_socket_factory.cc
index d0793cb..a31af007 100644
--- a/net/socket/client_socket_factory.cc
+++ b/net/socket/client_socket_factory.cc
@@ -6,6 +6,7 @@
 
 #include "base/singleton.h"
 #include "build/build_config.h"
+#include "net/base/ssl_host_info.h"
 #include "net/socket/client_socket_handle.h"
 #if defined(OS_WIN)
 #include "net/socket/ssl_client_socket_win.h"
@@ -26,13 +27,16 @@ namespace {
 SSLClientSocket* DefaultSSLClientSocketFactory(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config) {
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info) {
+  scoped_ptr<SSLHostInfo> shi(ssl_host_info);
 #if defined(OS_WIN)
   return new SSLClientSocketWin(transport_socket, hostname, ssl_config);
 #elif defined(USE_OPENSSL)
   return new SSLClientSocketOpenSSL(transport_socket, hostname, ssl_config);
 #elif defined(USE_NSS)
-  return new SSLClientSocketNSS(transport_socket, hostname, ssl_config);
+  return new SSLClientSocketNSS(transport_socket, hostname, ssl_config,
+                                shi.release());
 #elif defined(OS_MACOSX)
   // TODO(wtc): SSLClientSocketNSS can't do SSL client authentication using
   // Mac OS X CDSA/CSSM yet (http://crbug.com/45369), so fall back on
@@ -40,7 +44,8 @@ SSLClientSocket* DefaultSSLClientSocketFactory(
   if (ssl_config.send_client_cert)
     return new SSLClientSocketMac(transport_socket, hostname, ssl_config);
 
-  return new SSLClientSocketNSS(transport_socket, hostname, ssl_config);
+  return new SSLClientSocketNSS(transport_socket, hostname, ssl_config,
+                                shi.release());
 #else
   NOTIMPLEMENTED();
   return NULL;
@@ -61,8 +66,9 @@ class DefaultClientSocketFactory : public ClientSocketFactory {
   virtual SSLClientSocket* CreateSSLClientSocket(
       ClientSocketHandle* transport_socket,
       const std::string& hostname,
-      const SSLConfig& ssl_config) {
-    return g_ssl_factory(transport_socket, hostname, ssl_config);
+      const SSLConfig& ssl_config,
+      SSLHostInfo* ssl_host_info) {
+    return g_ssl_factory(transport_socket, hostname, ssl_config, ssl_host_info);
   }
 };
 
@@ -83,10 +89,12 @@ void ClientSocketFactory::SetSSLClientSocketFactory(
 SSLClientSocket* ClientSocketFactory::CreateSSLClientSocket(
     ClientSocket* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config) {
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info) {
   ClientSocketHandle* socket_handle = new ClientSocketHandle();
   socket_handle->set_socket(transport_socket);
-  return CreateSSLClientSocket(socket_handle, hostname, ssl_config);
+  return CreateSSLClientSocket(socket_handle, hostname, ssl_config,
+                               ssl_host_info);
 }
 
 }  // namespace net
diff --git a/net/socket/client_socket_factory.h b/net/socket/client_socket_factory.h
index 97fb361..ad2cc54 100644
--- a/net/socket/client_socket_factory.h
+++ b/net/socket/client_socket_factory.h
@@ -17,12 +17,14 @@ class ClientSocket;
 class ClientSocketHandle;
 class SSLClientSocket;
 struct SSLConfig;
+class SSLHostInfo;
 
 // Callback function to create new SSLClientSocket objects.
 typedef SSLClientSocket* (*SSLClientSocketFactory)(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config);
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info);
 
 // An interface used to instantiate ClientSocket objects.  Used to facilitate
 // testing code with mock socket implementations.
@@ -40,13 +42,14 @@ class ClientSocketFactory {
   virtual SSLClientSocket* CreateSSLClientSocket(
       ClientSocketHandle* transport_socket,
       const std::string& hostname,
-      const SSLConfig& ssl_config) = 0;
-
+      const SSLConfig& ssl_config,
+      SSLHostInfo* ssl_host_info) = 0;
 
   // Deprecated function (http://crbug.com/37810) that takes a ClientSocket.
   virtual SSLClientSocket* CreateSSLClientSocket(ClientSocket* transport_socket,
                                                  const std::string& hostname,
-                                                 const SSLConfig& ssl_config);
+                                                 const SSLConfig& ssl_config,
+                                                 SSLHostInfo* ssl_host_info);
 
   // Returns the default ClientSocketFactory.
   static ClientSocketFactory* GetDefaultFactory();
diff --git a/net/socket/client_socket_pool_base_unittest.cc b/net/socket/client_socket_pool_base_unittest.cc
index 0f06160..1f99b3d 100644
--- a/net/socket/client_socket_pool_base_unittest.cc
+++ b/net/socket/client_socket_pool_base_unittest.cc
@@ -106,8 +106,10 @@ class MockClientSocketFactory : public ClientSocketFactory {
   virtual SSLClientSocket* CreateSSLClientSocket(
       ClientSocketHandle* transport_socket,
       const std::string& hostname,
-      const SSLConfig& ssl_config) {
+      const SSLConfig& ssl_config,
+      SSLHostInfo* ssl_host_info) {
     NOTIMPLEMENTED();
+    delete ssl_host_info;
     return NULL;
   }
 
diff --git a/net/socket/client_socket_pool_manager.cc b/net/socket/client_socket_pool_manager.cc
index 0fca83d..512360b 100644
--- a/net/socket/client_socket_pool_manager.cc
+++ b/net/socket/client_socket_pool_manager.cc
@@ -56,12 +56,14 @@ ClientSocketPoolManager::ClientSocketPoolManager(
     ClientSocketFactory* socket_factory,
     HostResolver* host_resolver,
     DnsRRResolver* dnsrr_resolver,
+    SSLHostInfoFactory* ssl_host_info_factory,
     ProxyService* proxy_service,
     SSLConfigService* ssl_config_service)
     : net_log_(net_log),
       socket_factory_(socket_factory),
       host_resolver_(host_resolver),
       dnsrr_resolver_(dnsrr_resolver),
+      ssl_host_info_factory_(ssl_host_info_factory),
       proxy_service_(proxy_service),
       ssl_config_service_(ssl_config_service),
       tcp_pool_histograms_("TCP"),
@@ -77,6 +79,7 @@ ClientSocketPoolManager::ClientSocketPoolManager(
           &ssl_pool_histograms_,
           host_resolver,
           dnsrr_resolver,
+          ssl_host_info_factory,
           socket_factory,
           tcp_socket_pool_.get(),
           NULL /* no socks proxy */,
@@ -225,6 +228,7 @@ HttpProxyClientSocketPool* ClientSocketPoolManager::GetSocketPoolForHTTPProxy(
                   &ssl_for_https_proxy_pool_histograms_,
                   host_resolver_,
                   dnsrr_resolver_,
+                  ssl_host_info_factory_,
                   socket_factory_,
                   tcp_https_ret.first->second /* https proxy */,
                   NULL /* no socks proxy */,
@@ -259,6 +263,7 @@ SSLClientSocketPool* ClientSocketPoolManager::GetSocketPoolForSSLWithProxy(
       &ssl_pool_histograms_,
       host_resolver_,
       dnsrr_resolver_,
+      ssl_host_info_factory_,
       socket_factory_,
       NULL, /* no tcp pool, we always go through a proxy */
       GetSocketPoolForSOCKSProxy(proxy_server),
diff --git a/net/socket/client_socket_pool_manager.h b/net/socket/client_socket_pool_manager.h
index c455956..c6d8f6f 100644
--- a/net/socket/client_socket_pool_manager.h
+++ b/net/socket/client_socket_pool_manager.h
@@ -34,6 +34,7 @@ class ProxyService;
 class SOCKSClientSocketPool;
 class SSLClientSocketPool;
 class SSLConfigService;
+class SSLHostInfoFactory;
 class TCPClientSocketPool;
 
 namespace internal {
@@ -60,6 +61,7 @@ class ClientSocketPoolManager : public NonThreadSafe {
                           ClientSocketFactory* socket_factory,
                           HostResolver* host_resolver,
                           DnsRRResolver* dnsrr_resolver,
+                          SSLHostInfoFactory* ssl_host_info_factory,
                           ProxyService* proxy_service,
                           SSLConfigService* ssl_config_service);
   ~ClientSocketPoolManager();
@@ -102,7 +104,8 @@ class ClientSocketPoolManager : public NonThreadSafe {
   NetLog* const net_log_;
   ClientSocketFactory* const socket_factory_;
   HostResolver* const host_resolver_;
-  DnsRRResolver* dnsrr_resolver_;
+  DnsRRResolver* const dnsrr_resolver_;
+  SSLHostInfoFactory* const ssl_host_info_factory_;
   const scoped_refptr<ProxyService> proxy_service_;
   const scoped_refptr<SSLConfigService> ssl_config_service_;
 
diff --git a/net/socket/socket_test_util.cc b/net/socket/socket_test_util.cc
index 6f03706..72126f1 100644
--- a/net/socket/socket_test_util.cc
+++ b/net/socket/socket_test_util.cc
@@ -466,6 +466,7 @@ MockSSLClientSocket::MockSSLClientSocket(
     net::ClientSocketHandle* transport_socket,
     const std::string& hostname,
     const net::SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info,
     net::SSLSocketDataProvider* data)
     : MockClientSocket(transport_socket->socket()->NetLog().net_log()),
       transport_(transport_socket),
@@ -473,6 +474,7 @@ MockSSLClientSocket::MockSSLClientSocket(
       is_npn_state_set_(false),
       new_npn_value_(false) {
   DCHECK(data_);
+  delete ssl_host_info;  // we take ownership but don't use it.
 }
 
 MockSSLClientSocket::~MockSSLClientSocket() {
@@ -976,10 +978,11 @@ ClientSocket* MockClientSocketFactory::CreateTCPClientSocket(
 SSLClientSocket* MockClientSocketFactory::CreateSSLClientSocket(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config) {
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info) {
   MockSSLClientSocket* socket =
       new MockSSLClientSocket(transport_socket, hostname, ssl_config,
-                              mock_ssl_data_.GetNext());
+                              ssl_host_info, mock_ssl_data_.GetNext());
   ssl_client_sockets_.push_back(socket);
   return socket;
 }
@@ -1020,10 +1023,11 @@ ClientSocket* DeterministicMockClientSocketFactory::CreateTCPClientSocket(
 SSLClientSocket* DeterministicMockClientSocketFactory::CreateSSLClientSocket(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config) {
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info) {
   MockSSLClientSocket* socket =
       new MockSSLClientSocket(transport_socket, hostname, ssl_config,
-                              mock_ssl_data_.GetNext());
+                              ssl_host_info, mock_ssl_data_.GetNext());
   ssl_client_sockets_.push_back(socket);
   return socket;
 }
diff --git a/net/socket/socket_test_util.h b/net/socket/socket_test_util.h
index eb54b84..445f3c7 100644
--- a/net/socket/socket_test_util.h
+++ b/net/socket/socket_test_util.h
@@ -48,6 +48,7 @@ enum {
 class ClientSocket;
 class MockClientSocket;
 class SSLClientSocket;
+class SSLHostInfo;
 
 struct MockConnect {
   // Asynchronous connection success.
@@ -533,7 +534,8 @@ class MockClientSocketFactory : public ClientSocketFactory {
   virtual SSLClientSocket* CreateSSLClientSocket(
       ClientSocketHandle* transport_socket,
       const std::string& hostname,
-      const SSLConfig& ssl_config);
+      const SSLConfig& ssl_config,
+      SSLHostInfo* ssl_host_info);
   SocketDataProviderArray<SocketDataProvider>& mock_data() {
     return mock_data_;
   }
@@ -688,6 +690,7 @@ class MockSSLClientSocket : public MockClientSocket {
       net::ClientSocketHandle* transport_socket,
       const std::string& hostname,
       const net::SSLConfig& ssl_config,
+      SSLHostInfo* ssl_host_info,
       net::SSLSocketDataProvider* socket);
   ~MockSSLClientSocket();
 
@@ -868,7 +871,8 @@ class DeterministicMockClientSocketFactory : public ClientSocketFactory {
   virtual SSLClientSocket* CreateSSLClientSocket(
       ClientSocketHandle* transport_socket,
       const std::string& hostname,
-      const SSLConfig& ssl_config);
+      const SSLConfig& ssl_config,
+      SSLHostInfo* ssl_host_info);
 
   SocketDataProviderArray<DeterministicSocketData>& mock_data() {
     return mock_data_;
diff --git a/net/socket/ssl_client_socket_mac_factory.cc b/net/socket/ssl_client_socket_mac_factory.cc
index ec41345..bc26261 100644
--- a/net/socket/ssl_client_socket_mac_factory.cc
+++ b/net/socket/ssl_client_socket_mac_factory.cc
@@ -11,7 +11,9 @@ namespace net {
 SSLClientSocket* SSLClientSocketMacFactory(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config) {
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info) {
+  delete ssl_host_info;
   return new SSLClientSocketMac(transport_socket, hostname, ssl_config);
 }
 
diff --git a/net/socket/ssl_client_socket_mac_factory.h b/net/socket/ssl_client_socket_mac_factory.h
index 2c793c2..ca97b00 100644
--- a/net/socket/ssl_client_socket_mac_factory.h
+++ b/net/socket/ssl_client_socket_mac_factory.h
@@ -10,11 +10,14 @@
 
 namespace net {
 
+class SSLHostInfo;
+
 // Creates SSLClientSocketMac objects.
 SSLClientSocket* SSLClientSocketMacFactory(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config);
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info);
 
 }  // namespace net
 
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index 39a2774..95458fa 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -400,7 +400,8 @@ HCERTSTORE SSLClientSocketNSS::cert_store_ = NULL;
 
 SSLClientSocketNSS::SSLClientSocketNSS(ClientSocketHandle* transport_socket,
                                        const std::string& hostname,
-                                       const SSLConfig& ssl_config)
+                                       const SSLConfig& ssl_config,
+                                       SSLHostInfo* ssl_host_info)
     : ALLOW_THIS_IN_INITIALIZER_LIST(buffer_send_callback_(
           this, &SSLClientSocketNSS::BufferSendComplete)),
       ALLOW_THIS_IN_INITIALIZER_LIST(buffer_recv_callback_(
@@ -431,7 +432,8 @@ SSLClientSocketNSS::SSLClientSocketNSS(ClientSocketHandle* transport_socket,
       nss_bufs_(NULL),
       net_log_(transport_socket->socket()->NetLog()),
       predicted_npn_status_(kNextProtoUnsupported),
-      predicted_npn_proto_used_(false) {
+      predicted_npn_proto_used_(false),
+      ssl_host_info_(ssl_host_info) {
   EnterFunction("");
 }
 
@@ -467,9 +469,9 @@ static const uint8 kSnapStartInfoVersion = 0;
 
 // SaveSnapStartInfo serialises the information needed to perform a Snap Start
 // with this server in the future (if any) and tells
-// |ssl_config_.ssl_host_info| to preserve it.
+// |ssl_host_info_| to preserve it.
 void SSLClientSocketNSS::SaveSnapStartInfo() {
-  if (!ssl_config_.ssl_host_info.get())
+  if (!ssl_host_info_.get())
     return;
 
   SECStatus rv;
@@ -592,7 +594,7 @@ void SSLClientSocketNSS::SaveSnapStartInfo() {
   DCHECK_EQ(j, len);
 
   LOG(ERROR) << "Setting Snap Start info " << hostname_ << " " << len;
-  ssl_config_.ssl_host_info->Set(std::string(
+  ssl_host_info_->Set(std::string(
         reinterpret_cast<const char *>(&data[0]), len));
 
   CERT_DestroyCertList(cert_list);
@@ -736,7 +738,7 @@ int SSLClientSocketNSS::Connect(CompletionCallback* callback) {
     return rv;
   }
 
-  if (ssl_config_.snap_start_enabled && ssl_config_.ssl_host_info.get()) {
+  if (ssl_config_.snap_start_enabled && ssl_host_info_.get()) {
     GotoState(STATE_SNAP_START_LOAD_INFO);
   } else {
     GotoState(STATE_HANDSHAKE);
@@ -1969,12 +1971,12 @@ void SSLClientSocketNSS::HandshakeCallback(PRFileDesc* socket,
 
 int SSLClientSocketNSS::DoSnapStartLoadInfo() {
   EnterFunction("");
-  int rv = ssl_config_.ssl_host_info->WaitForDataReady(&handshake_io_callback_);
+  int rv = ssl_host_info_->WaitForDataReady(&handshake_io_callback_);
 
   if (rv == OK) {
     LOG(ERROR) << "SSL host info size " << hostname_ << " "
-               << ssl_config_.ssl_host_info->data().size();
-    if (LoadSnapStartInfo(ssl_config_.ssl_host_info->data())) {
+               << ssl_host_info_->data().size();
+    if (LoadSnapStartInfo(ssl_host_info_->data())) {
       pseudo_connected_ = true;
       GotoState(STATE_SNAP_START_WAIT_FOR_WRITE);
       if (user_connect_callback_)
diff --git a/net/socket/ssl_client_socket_nss.h b/net/socket/ssl_client_socket_nss.h
index db567c4..8518084 100644
--- a/net/socket/ssl_client_socket_nss.h
+++ b/net/socket/ssl_client_socket_nss.h
@@ -30,6 +30,7 @@ namespace net {
 class BoundNetLog;
 class CertVerifier;
 class ClientSocketHandle;
+class SSLHostInfo;
 class X509Certificate;
 
 // An SSL client socket implemented with Mozilla NSS.
@@ -41,7 +42,8 @@ class SSLClientSocketNSS : public SSLClientSocket {
   // settings.
   SSLClientSocketNSS(ClientSocketHandle* transport_socket,
                      const std::string& hostname,
-                     const SSLConfig& ssl_config);
+                     const SSLConfig& ssl_config,
+                     SSLHostInfo* ssl_host_info);
   ~SSLClientSocketNSS();
 
   // SSLClientSocket methods:
@@ -213,12 +215,14 @@ class SSLClientSocketNSS : public SSLClientSocket {
 
   // When performing Snap Start we need to predict the NPN protocol which the
   // server is going to speak before we actually perform the handshake. Thus
-  // the last NPN protocol used is serialised in |ssl_config.ssl_host_info|
+  // the last NPN protocol used is serialised in |ssl_host_info_|
   // and kept in these fields:
   SSLClientSocket::NextProtoStatus predicted_npn_status_;
   std::string predicted_npn_proto_;
   bool predicted_npn_proto_used_;
 
+  scoped_ptr<SSLHostInfo> ssl_host_info_;
+
 #if defined(OS_WIN)
   // A CryptoAPI in-memory certificate store.  We use it for two purposes:
   // 1. Import server certificates into this store so that we can verify and
diff --git a/net/socket/ssl_client_socket_nss_factory.cc b/net/socket/ssl_client_socket_nss_factory.cc
index 30de930..b5488d9 100644
--- a/net/socket/ssl_client_socket_nss_factory.cc
+++ b/net/socket/ssl_client_socket_nss_factory.cc
@@ -20,7 +20,9 @@ namespace net {
 SSLClientSocket* SSLClientSocketNSSFactory(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config) {
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info) {
+  scoped_ptr<SSLHostInfo> shi(ssl_host_info);
   // TODO(wtc): SSLClientSocketNSS can't do SSL client authentication using
   // CryptoAPI yet (http://crbug.com/37560), so we fall back on
   // SSLClientSocketWin.
@@ -29,7 +31,8 @@ SSLClientSocket* SSLClientSocketNSSFactory(
     return new SSLClientSocketWin(transport_socket, hostname, ssl_config);
 #endif
 
-  return new SSLClientSocketNSS(transport_socket, hostname, ssl_config);
+  return new SSLClientSocketNSS(transport_socket, hostname, ssl_config,
+                                shi.release());
 }
 
 }  // namespace net
diff --git a/net/socket/ssl_client_socket_nss_factory.h b/net/socket/ssl_client_socket_nss_factory.h
index f977109..d454bb9 100644
--- a/net/socket/ssl_client_socket_nss_factory.h
+++ b/net/socket/ssl_client_socket_nss_factory.h
@@ -10,11 +10,14 @@
 
 namespace net {
 
+class SSLHostInfo;
+
 // Creates SSLClientSocketNSS objects.
 SSLClientSocket* SSLClientSocketNSSFactory(
     ClientSocketHandle* transport_socket,
     const std::string& hostname,
-    const SSLConfig& ssl_config);
+    const SSLConfig& ssl_config,
+    SSLHostInfo* ssl_host_info);
 
 }  // namespace net
 
diff --git a/net/socket/ssl_client_socket_pool.cc b/net/socket/ssl_client_socket_pool.cc
index a338a7f..048ff4b 100644
--- a/net/socket/ssl_client_socket_pool.cc
+++ b/net/socket/ssl_client_socket_pool.cc
@@ -8,6 +8,7 @@
 #include "base/values.h"
 #include "net/base/net_errors.h"
 #include "net/base/ssl_cert_request_info.h"
+#include "net/base/ssl_host_info.h"
 #include "net/http/http_proxy_client_socket.h"
 #include "net/http/http_proxy_client_socket_pool.h"
 #include "net/socket/client_socket_factory.h"
@@ -76,6 +77,7 @@ SSLConnectJob::SSLConnectJob(
     ClientSocketFactory* client_socket_factory,
     HostResolver* host_resolver,
     DnsRRResolver* dnsrr_resolver,
+    SSLHostInfoFactory* ssl_host_info_factory,
     Delegate* delegate,
     NetLog* net_log)
     : ConnectJob(group_name, timeout_duration, delegate,
@@ -87,6 +89,7 @@ SSLConnectJob::SSLConnectJob(
       client_socket_factory_(client_socket_factory),
       resolver_(host_resolver),
       dnsrr_resolver_(dnsrr_resolver),
+      ssl_host_info_factory_(ssl_host_info_factory),
       ALLOW_THIS_IN_INITIALIZER_LIST(
           callback_(this, &SSLConnectJob::OnIOComplete)) {}
 
@@ -188,10 +191,14 @@ int SSLConnectJob::DoLoop(int result) {
 int SSLConnectJob::DoTCPConnect() {
   DCHECK(tcp_pool_);
 
-  if (params_->ssl_config().ssl_host_info.get()) {
+  if (ssl_host_info_factory_ && SSLConfigService::snap_start_enabled()) {
+      ssl_host_info_.reset(
+          ssl_host_info_factory_->GetForHost(params_->hostname()));
+  }
+  if (ssl_host_info_.get()) {
     // This starts fetching the SSL host info from the disk cache for Snap
     // Start.
-    params_->ssl_config().ssl_host_info->Start();
+    ssl_host_info_->Start();
   }
 
   next_state_ = STATE_TCP_CONNECT_COMPLETE;
@@ -277,7 +284,7 @@ int SSLConnectJob::DoSSLConnect() {
 
   ssl_socket_.reset(client_socket_factory_->CreateSSLClientSocket(
         transport_socket_handle_.release(), params_->hostname(),
-        params_->ssl_config()));
+        params_->ssl_config(), ssl_host_info_.release()));
   return ssl_socket_->Connect(&callback_);
 }
 
@@ -348,7 +355,8 @@ ConnectJob* SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
   return new SSLConnectJob(group_name, request.params(), ConnectionTimeout(),
                            tcp_pool_, socks_pool_, http_proxy_pool_,
                            client_socket_factory_, host_resolver_,
-                           dnsrr_resolver_, delegate, net_log_);
+                           dnsrr_resolver_, ssl_host_info_factory_, delegate,
+                           net_log_);
 }
 
 SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
@@ -358,6 +366,7 @@ SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
     ClientSocketFactory* client_socket_factory,
     HostResolver* host_resolver,
     DnsRRResolver* dnsrr_resolver,
+    SSLHostInfoFactory* ssl_host_info_factory,
     NetLog* net_log)
     : tcp_pool_(tcp_pool),
       socks_pool_(socks_pool),
@@ -365,6 +374,7 @@ SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
       client_socket_factory_(client_socket_factory),
       host_resolver_(host_resolver),
       dnsrr_resolver_(dnsrr_resolver),
+      ssl_host_info_factory_(ssl_host_info_factory),
       net_log_(net_log) {
   base::TimeDelta max_transport_timeout = base::TimeDelta();
   base::TimeDelta pool_timeout;
@@ -390,6 +400,7 @@ SSLClientSocketPool::SSLClientSocketPool(
     ClientSocketPoolHistograms* histograms,
     HostResolver* host_resolver,
     DnsRRResolver* dnsrr_resolver,
+    SSLHostInfoFactory* ssl_host_info_factory,
     ClientSocketFactory* client_socket_factory,
     TCPClientSocketPool* tcp_pool,
     SOCKSClientSocketPool* socks_pool,
@@ -405,7 +416,8 @@ SSLClientSocketPool::SSLClientSocketPool(
             base::TimeDelta::FromSeconds(kUsedIdleSocketTimeout),
             new SSLConnectJobFactory(tcp_pool, socks_pool, http_proxy_pool,
                                      client_socket_factory, host_resolver,
-                                     dnsrr_resolver, net_log)),
+                                     dnsrr_resolver, ssl_host_info_factory,
+                                     net_log)),
       ssl_config_service_(ssl_config_service) {
   if (ssl_config_service_)
     ssl_config_service_->AddObserver(this);
diff --git a/net/socket/ssl_client_socket_pool.h b/net/socket/ssl_client_socket_pool.h
index 935a0d7..1711722 100644
--- a/net/socket/ssl_client_socket_pool.h
+++ b/net/socket/ssl_client_socket_pool.h
@@ -30,6 +30,7 @@ class HttpProxySocketParams;
 class SOCKSClientSocketPool;
 class SOCKSSocketParams;
 class SSLClientSocket;
+class SSLHostInfoFactory;
 class TCPClientSocketPool;
 class TCPSocketParams;
 struct RRResponse;
@@ -93,6 +94,7 @@ class SSLConnectJob : public ConnectJob {
       ClientSocketFactory* client_socket_factory,
       HostResolver* host_resolver,
       DnsRRResolver* dnsrr_resolver,
+      SSLHostInfoFactory* ssl_host_info_factory,
       Delegate* delegate,
       NetLog* net_log);
   virtual ~SSLConnectJob();
@@ -140,12 +142,14 @@ class SSLConnectJob : public ConnectJob {
   HttpProxyClientSocketPool* const http_proxy_pool_;
   ClientSocketFactory* const client_socket_factory_;
   HostResolver* const resolver_;
-  DnsRRResolver* dnsrr_resolver_;
+  DnsRRResolver* const dnsrr_resolver_;
+  SSLHostInfoFactory* const ssl_host_info_factory_;
 
   State next_state_;
   CompletionCallbackImpl<SSLConnectJob> callback_;
   scoped_ptr<ClientSocketHandle> transport_socket_handle_;
   scoped_ptr<SSLClientSocket> ssl_socket_;
+  scoped_ptr<SSLHostInfo> ssl_host_info_;
 
   // The time the DoSSLConnect() method was called.
   base::TimeTicks ssl_connect_start_time_;
@@ -166,6 +170,7 @@ class SSLClientSocketPool : public ClientSocketPool,
       ClientSocketPoolHistograms* histograms,
       HostResolver* host_resolver,
       DnsRRResolver* dnsrr_resolver,
+      SSLHostInfoFactory* ssl_host_info_factory,
       ClientSocketFactory* client_socket_factory,
       TCPClientSocketPool* tcp_pool,
       SOCKSClientSocketPool* socks_pool,
@@ -238,6 +243,7 @@ class SSLClientSocketPool : public ClientSocketPool,
         ClientSocketFactory* client_socket_factory,
         HostResolver* host_resolver,
         DnsRRResolver* dnsrr_resolver,
+        SSLHostInfoFactory* ssl_host_info_factory,
         NetLog* net_log);
 
     virtual ~SSLConnectJobFactory() {}
@@ -256,7 +262,8 @@ class SSLClientSocketPool : public ClientSocketPool,
     HttpProxyClientSocketPool* const http_proxy_pool_;
     ClientSocketFactory* const client_socket_factory_;
     HostResolver* const host_resolver_;
-    DnsRRResolver* dnsrr_resolver_;
+    DnsRRResolver* const dnsrr_resolver_;
+    SSLHostInfoFactory* const ssl_host_info_factory_;
     base::TimeDelta timeout_;
     NetLog* net_log_;
 
diff --git a/net/socket/ssl_client_socket_pool_unittest.cc b/net/socket/ssl_client_socket_pool_unittest.cc
index 755bd44..3ee9394 100644
--- a/net/socket/ssl_client_socket_pool_unittest.cc
+++ b/net/socket/ssl_client_socket_pool_unittest.cc
@@ -40,6 +40,7 @@ class SSLClientSocketPoolTest : public testing::Test {
             host_resolver_.get())),
         session_(new HttpNetworkSession(host_resolver_.get(),
                                         NULL /* dnsrr_resolver */,
+                                        NULL /* ssl_host_info_factory */,
                                         ProxyService::CreateDirect(),
                                         &socket_factory_,
                                         new SSLConfigServiceDefaults,
@@ -96,6 +97,7 @@ class SSLClientSocketPoolTest : public testing::Test {
         ssl_histograms_.get(),
         NULL,
         NULL /* dnsrr_resolver */,
+        NULL /* ssl_host_info_factory */,
         &socket_factory_,
         tcp_pool ? &tcp_socket_pool_ : NULL,
         socks_pool ? &socks_socket_pool_ : NULL,
diff --git a/net/socket/ssl_client_socket_unittest.cc b/net/socket/ssl_client_socket_unittest.cc
index b367a80..bfcbe81 100644
--- a/net/socket/ssl_client_socket_unittest.cc
+++ b/net/socket/ssl_client_socket_unittest.cc
@@ -67,7 +67,8 @@ TEST_F(SSLClientSocketTest, Connect) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(transport,
-          test_server.host_port_pair().host(), kDefaultSSLConfig));
+          test_server.host_port_pair().host(), kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   EXPECT_FALSE(sock->IsConnected());
 
@@ -110,7 +111,8 @@ TEST_F(SSLClientSocketTest, ConnectExpired) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(transport,
-          test_server.host_port_pair().host(), kDefaultSSLConfig));
+          test_server.host_port_pair().host(), kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   EXPECT_FALSE(sock->IsConnected());
 
@@ -152,7 +154,8 @@ TEST_F(SSLClientSocketTest, ConnectMismatched) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(transport,
-          test_server.host_port_pair().host(), kDefaultSSLConfig));
+          test_server.host_port_pair().host(), kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   EXPECT_FALSE(sock->IsConnected());
 
@@ -197,7 +200,8 @@ TEST_F(SSLClientSocketTest, FLAKY_ConnectClientAuthCertRequested) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(transport,
-          test_server.host_port_pair().host(), kDefaultSSLConfig));
+          test_server.host_port_pair().host(), kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   EXPECT_FALSE(sock->IsConnected());
 
@@ -247,7 +251,8 @@ TEST_F(SSLClientSocketTest, ConnectClientAuthSendNullCert) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(transport,
-          test_server.host_port_pair().host(), ssl_config));
+          test_server.host_port_pair().host(), ssl_config,
+          NULL /* ssl_host_info */));
 
   EXPECT_FALSE(sock->IsConnected());
 
@@ -297,7 +302,8 @@ TEST_F(SSLClientSocketTest, Read) {
       socket_factory_->CreateSSLClientSocket(
           transport,
           test_server.host_port_pair().host(),
-          kDefaultSSLConfig));
+          kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   rv = sock->Connect(&callback);
   if (rv != net::OK) {
@@ -357,7 +363,8 @@ TEST_F(SSLClientSocketTest, Read_FullDuplex) {
       socket_factory_->CreateSSLClientSocket(
           transport,
           test_server.host_port_pair().host(),
-          kDefaultSSLConfig));
+          kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   rv = sock->Connect(&callback);
   if (rv != net::OK) {
@@ -414,7 +421,8 @@ TEST_F(SSLClientSocketTest, Read_SmallChunks) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(transport,
-          test_server.host_port_pair().host(), kDefaultSSLConfig));
+          test_server.host_port_pair().host(), kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   rv = sock->Connect(&callback);
   if (rv != net::OK) {
@@ -467,7 +475,8 @@ TEST_F(SSLClientSocketTest, Read_Interrupted) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(transport,
-          test_server.host_port_pair().host(), kDefaultSSLConfig));
+          test_server.host_port_pair().host(), kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   rv = sock->Connect(&callback);
   if (rv != net::OK) {
@@ -540,7 +549,8 @@ TEST_F(SSLClientSocketTest, PrematureApplicationData) {
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig));
+          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
+          NULL /* ssl_host_info */));
 
   rv = sock->Connect(&callback);
   EXPECT_EQ(net::ERR_SSL_PROTOCOL_ERROR, rv);
diff --git a/net/socket/tcp_client_socket_pool_unittest.cc b/net/socket/tcp_client_socket_pool_unittest.cc
index c550232..32ac9f8 100644
--- a/net/socket/tcp_client_socket_pool_unittest.cc
+++ b/net/socket/tcp_client_socket_pool_unittest.cc
@@ -245,8 +245,10 @@ class MockClientSocketFactory : public ClientSocketFactory {
   virtual SSLClientSocket* CreateSSLClientSocket(
       ClientSocketHandle* transport_socket,
       const std::string& hostname,
-      const SSLConfig& ssl_config) {
+      const SSLConfig& ssl_config,
+      SSLHostInfo* ssl_host_info) {
     NOTIMPLEMENTED();
+    delete ssl_host_info;
     return NULL;
   }