Fix case where a SPDY stream with an un-verified cert would kill the browser

if an https:// URL was attempted to be fetched across it.  Also fix a bug
where when two SSL connections are made, but only one is moved into a SPDY
session (because the second is redundant), close the redundant connection.
This had been leaking a un-verified SSL connection into the pool, which
could then get re-used as though it was verified.

BUG=64861
TEST=none

Review URL: http://codereview.chromium.org/5409004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@67869 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 8 insertions, 6 deletions

diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
index d1a7d19..2c79c45 100644
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -314,9 +314,10 @@ int SpdySession::GetPushStream(
   // encrypted SSL socket.
   if (is_secure_ && certificate_error_code_ != OK &&
       (url.SchemeIs("https") || url.SchemeIs("wss"))) {
-    LOG(DFATAL) << "Tried to get pushed spdy stream for secure content over an "
-                << "unauthenticated session.";
-    return certificate_error_code_;
+    LOG(ERROR) << "Tried to get pushed spdy stream for secure content over an "
+               << "unauthenticated session.";
+    CloseSessionOnError(static_cast<net::Error>(certificate_error_code_), true);
+    return ERR_SPDY_PROTOCOL_ERROR;
   }
 
   const std::string& path = url.PathForRequest();
@@ -411,9 +412,10 @@ int SpdySession::CreateStreamImpl(
   // encrypted SSL socket.
   if (is_secure_ && certificate_error_code_ != OK &&
       (url.SchemeIs("https") || url.SchemeIs("wss"))) {
-    LOG(DFATAL) << "Tried to create spdy stream for secure content over an "
-                << "unauthenticated session.";
-    return certificate_error_code_;
+    LOG(ERROR) << "Tried to create spdy stream for secure content over an "
+               << "unauthenticated session.";
+    CloseSessionOnError(static_cast<net::Error>(certificate_error_code_), true);
+    return ERR_SPDY_PROTOCOL_ERROR;
   }
 
   const std::string& path = url.PathForRequest();