Initial support for HSTS certificate locking. This isn't a finished work, but

net/url_request/url_request_http_job.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
@@ skipping 649 matching lines @@
     return;
 
   // If the transaction was destroyed, then the job was cancelled, and
   // we can just ignore this notification.
   if (!transaction_.get())
     return;
 
   // Clear the IO_PENDING status
   SetStatus(URLRequestStatus());
 
+  // Take care of any mandates for certificate locking.
+  const SSLInfo& ssl_info = transaction_->GetResponseInfo()->ssl_info;
+  if (result == OK &&
+      ssl_info.is_valid() &&
+      context_->transport_security_state()) {
+    scoped_refptr<X509Certificate> cert(ssl_info.cert);
+    if (!context_->transport_security_state()->IsAcceptableCertificate(
+        request_->url().host(), cert.get()))
+      result = ERR_CERT_INVALID;
+  }
+
   if (result == OK) {
     SaveCookiesAndNotifyHeadersComplete();
   } else if (ShouldTreatAsCertificateError(result)) {
     // We encountered an SSL certificate error.  Ask our delegate to decide
     // what we should do.
     // TODO(wtc): also pass ssl_info.cert_status, or just pass the whole
     // ssl_info.
     request_->delegate()->OnSSLCertificateError(
         request_, result, transaction_->GetResponseInfo()->ssl_info.cert);
   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
@@ skipping 22 matching lines @@
 bool URLRequestHttpJob::ShouldTreatAsCertificateError(int result) {
   if (!IsCertificateError(result))
     return false;
 
   // Revocation check failures are always certificate errors, even if the host
   // is using Strict-Transport-Security.
   if (result == ERR_CERT_UNABLE_TO_CHECK_REVOCATION)
     return true;
 
   // Check whether our context is using Strict-Transport-Security.
+  // TODO(cevans) -- this gives an error that makes it look more like the
+  // network connection is faulty than a certificate error. It would be better
+  // to simply use the normal browser "bad cert" UI but force
+  // SSLBlockingPage::ERROR_FATAL.
   if (!context_->transport_security_state())
     return true;
 
   TransportSecurityState::DomainState domain_state;
   // TODO(agl): don't ignore opportunistic mode.
   const bool r = context_->transport_security_state()->IsEnabledForHost(
       &domain_state, request_info_.url.host());
 
   return !r || domain_state.mode ==
                TransportSecurityState::DomainState::MODE_OPPORTUNISTIC;
@@ skipping 637 matching lines @@
 }
 
 bool URLRequestHttpJob::IsCompressibleContent() const {
   std::string mime_type;
   return GetMimeType(&mime_type) &&
       (IsSupportedJavascriptMimeType(mime_type.c_str()) ||
        IsSupportedNonImageMimeType(mime_type.c_str()));
 }
 
 }  // namespace net