net/socket: Improve force tunneling

src/net/socket/client_socket_pool.cc

@@ -237,9 +237,9 @@ std::unique_ptr<ConnectJob> ClientSocketPool::CreateConnectJob(
         is_for_websockets_);
   }
 
-  // Force a CONNECT tunnel for websockets. If this is false, the connect job
-  // may still use a tunnel for other reasons.
-  bool force_tunnel = is_for_websockets_;
+  // Naive requires a CONNECT tunnel for raw sockets, even when the endpoint
+  // uses an HTTP scheme. Keep this independent of WebSocket ALPN and pooling.
+  bool force_tunnel = true;
 
   // Only offer HTTP/1.1 for WebSockets. Although RFC 8441 defines WebSockets
   // over HTTP/2, a single WSS/HTTPS origin may support HTTP over HTTP/2

src/net/socket/client_socket_pool_manager_impl.cc

@@ -89,8 +89,8 @@ ClientSocketPool* ClientSocketPoolManagerImpl::GetSocketPool(
     new_pool = std::make_unique<TransportClientSocketPool>(
         sockets_per_proxy_chain, sockets_per_group,
         unused_idle_socket_timeout(pool_type_), proxy_chain,
-        /*force_tunnel=*/true, &common_connect_job_params_,
-        cleanup_on_ip_address_change_);
+        pool_type_ == HttpNetworkSession::SocketPoolType::kWebSocket,
+        &common_connect_job_params_, cleanup_on_ip_address_change_);
   }
 
   std::pair<SocketPoolMap::iterator, bool> ret =