Add command-line control of the HSTS preload list.

net/base/transport_security_state.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_TRANSPORT_SECURITY_STATE_H_
 #define NET_BASE_TRANSPORT_SECURITY_STATE_H_
 #pragma once
 
 #include <map>
 #include <string>
@@ skipping 13 matching lines @@
 // the in-memory store. A separate object must register itself with this object
 // in order to persist the state to disk.
 class TransportSecurityState :
     public base::RefCountedThreadSafe<TransportSecurityState> {
  public:
   TransportSecurityState();
 
   // A DomainState is the information that we persist about a given domain.
   struct DomainState {
     enum Mode {
+      // None means there is no HSTS for this domain.
+      MODE_NONE = 0,
       // Strict mode implies:
       //   * We generate internal redirects from HTTP -> HTTPS.
       //   * Certificate issues are fatal.
-      MODE_STRICT = 0,
+      MODE_STRICT = 1,
       // Opportunistic mode implies:
       //   * We'll request HTTP URLs over HTTPS
       //   * Certificate issues are ignored.
-      MODE_OPPORTUNISTIC = 1,
+      MODE_OPPORTUNISTIC = 2,
       // SPDY_ONLY (aka X-Bodge-Transport-Security) is a hopefully temporary
       // measure. It implies:
       //   * We'll request HTTP URLs over HTTPS iff we have SPDY support.
       //   * Certificate issues are fatal.
-      MODE_SPDY_ONLY = 2,
+      MODE_SPDY_ONLY = 3,
     };
 
     DomainState();
     ~DomainState();
 
     // IsChainOfPublicKeysPermitted takes a set of public key hashes and
     // returns true if:
     //   1) |public_key_hashes| is empty, i.e. no public keys have been pinned.
     //   2) |hashes| and |public_key_hashes| are not disjoint.
     bool IsChainOfPublicKeysPermitted(
@@ skipping 58 matching lines @@
 
   ~TransportSecurityState();
 
   // If we have a callback configured, call it to let our serialiser know that
   // our state is dirty.
   void DirtyNotify();
 
   static std::string CanonicalizeHost(const std::string& host);
   static bool IsPreloadedSTS(const std::string& canonicalized_host,
                              bool sni_available,
-                             bool* out_include_subdomains);
+                             DomainState* out);
 
   // The set of hosts that have enabled TransportSecurity. The keys here
   // are SHA256(DNSForm(domain)) where DNSForm converts from dotted form
   // ('www.google.com') to the form used in DNS: "\x03www\x06google\x03com"
   std::map<std::string, DomainState> enabled_hosts_;
 
   // Our delegate who gets notified when we are dirtied, or NULL.
   Delegate* delegate_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_TRANSPORT_SECURITY_STATE_H_