Add revocation checking field trial.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 1442 matching lines @@
       end_time = base::TimeTicks::Now();
     UMA_HISTOGRAM_TIMES("Net.SSLVerificationMergedMsSaved",
                         end_time - ssl_host_info_->verification_start_time());
     server_cert_verify_result_ = &ssl_host_info_->cert_verify_result();
     return ssl_host_info_->WaitForCertVerification(&handshake_io_callback_);
   } else {
     UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 0 /* false */, 2);
   }
 
   int flags = 0;
-  if (ssl_config_.rev_checking_enabled)
-    flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED;
+  if (ssl_config_.rev_checking_enabled) {
+    const std::string& hostname = host_and_port_.host();
+    // is_pinned is an approximation but is currently accurate. Even if more
+    // pinned sites are added, this errs on the site of caution.
+    bool is_pinned = hostname == "google.com" ||
+                     (hostname.size() > 11 &&
+                      hostname.rfind(".google.com") == hostname.size() - 11);
+    if (!is_pinned ||
+        !SSLConfigService::rev_checking_disabled_for_pinned_sites()) {
+      flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED;
+    }
+  }
   if (ssl_config_.verify_ev_cert)
     flags |= X509Certificate::VERIFY_EV_CERT;
   verifier_.reset(new SingleRequestCertVerifier(cert_verifier_));
   server_cert_verify_result_ = &local_server_cert_verify_result_;
   return verifier_->Verify(server_cert_, host_and_port_.host(), flags,
                            &local_server_cert_verify_result_,
                            &handshake_io_callback_);
 }
 
 // Derived from AuthCertificateCallback() in
@@ skipping 697 matching lines @@
   valid_thread_id_ = base::PlatformThread::CurrentId();
 }
 
 bool SSLClientSocketNSS::CalledOnValidThread() const {
   EnsureThreadIdAssigned();
   base::AutoLock auto_lock(lock_);
   return valid_thread_id_ == base::PlatformThread::CurrentId();
 }
 
 }  // namespace net