Fix case where a SPDY stream with an un-verified cert would kill the browser

if an https:// URL was attempted to be fetched across it.  Also fix a bug
where when two SSL connections are made, but only one is moved into a SPDY
session (because the second is redundant), close the redundant connection.
This had been leaking a un-verified SSL connection into the pool, which
could then get re-used as though it was verified.

BUG=64861
TEST=none

Review URL: http://codereview.chromium.org/5409004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@67869 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 14 insertions, 7 deletions

diff --git a/net/http/http_stream_request.cc b/net/http/http_stream_request.cc
index eaaad16..6f0a39e9 100644
--- a/net/http/http_stream_request.cc
+++ b/net/http/http_stream_request.cc
@@ -759,7 +759,12 @@ int HttpStreamRequest::DoCreateStream() {
     direct = false;
   }
 
-  if (!spdy_session.get()) {
+  if (spdy_session.get()) {
+    // We picked up an existing session, so we don't need our socket.
+    if (connection_->socket())
+      connection_->socket()->Disconnect();
+    connection_->Reset();
+  } else {
     // SPDY can be negotiated using the TLS next protocol negotiation (NPN)
     // extension, or just directly using SSL. Either way, |connection_| must
     // contain an SSLClientSocket.
diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
index d1a7d19..2c79c45 100644
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -314,9 +314,10 @@ int SpdySession::GetPushStream(
   // encrypted SSL socket.
   if (is_secure_ && certificate_error_code_ != OK &&
       (url.SchemeIs("https") || url.SchemeIs("wss"))) {
-    LOG(DFATAL) << "Tried to get pushed spdy stream for secure content over an "
-                << "unauthenticated session.";
-    return certificate_error_code_;
+    LOG(ERROR) << "Tried to get pushed spdy stream for secure content over an "
+               << "unauthenticated session.";
+    CloseSessionOnError(static_cast<net::Error>(certificate_error_code_), true);
+    return ERR_SPDY_PROTOCOL_ERROR;
   }
 
   const std::string& path = url.PathForRequest();
@@ -411,9 +412,10 @@ int SpdySession::CreateStreamImpl(
   // encrypted SSL socket.
   if (is_secure_ && certificate_error_code_ != OK &&
       (url.SchemeIs("https") || url.SchemeIs("wss"))) {
-    LOG(DFATAL) << "Tried to create spdy stream for secure content over an "
-                << "unauthenticated session.";
-    return certificate_error_code_;
+    LOG(ERROR) << "Tried to create spdy stream for secure content over an "
+               << "unauthenticated session.";
+    CloseSessionOnError(static_cast<net::Error>(certificate_error_code_), true);
+    return ERR_SPDY_PROTOCOL_ERROR;
   }
 
   const std::string& path = url.PathForRequest();