net: don't check revocation when fetching PAC files.

net/proxy/proxy_script_fetcher_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/proxy/proxy_script_fetcher_impl.h"
 
 #include "base/compiler_specific.h"
 #include "base/i18n/icu_string_conversions.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
@@ skipping 127 matching lines @@
 
   cur_request_.reset(new URLRequest(url, this));
   cur_request_->set_context(url_request_context_);
   cur_request_->set_method("GET");
 
   // Make sure that the PAC script is downloaded using a direct connection,
   // to avoid circular dependencies (fetching is a part of proxy resolution).
   // Also disable the use of the disk cache. The cache is disabled so that if
   // the user switches networks we don't potentially use the cached response
   // from old network when we should in fact be re-fetching on the new network.
-  cur_request_->set_load_flags(LOAD_BYPASS_PROXY | LOAD_DISABLE_CACHE);
+  // If the PAC script is hosted on an HTTPS server we bypass revocation
+  // checking in order to avoid a circular dependency when attempting to fetch
+  // the OCSP response or CRL. We could make the revocation check go direct but
+  // the proxy might be the only way to the outside world.
+  cur_request_->set_load_flags(LOAD_BYPASS_PROXY | LOAD_DISABLE_CACHE |
+                               LOAD_DISABLE_CERT_REVOCATION_CHECKING);
 
   // Save the caller's info for notification on completion.
   callback_ = callback;
   result_text_ = text;
 
   bytes_read_so_far_.clear();
 
   // Post a task to timeout this request if it takes too long.
   cur_request_id_ = ++next_id_;
   MessageLoop::current()->PostDelayedTask(FROM_HERE,
@@ skipping 148 matching lines @@
   // is still applicable.
   if (cur_request_id_ != id)
     return;
 
   DCHECK(cur_request_.get());
   result_code_ = ERR_TIMED_OUT;
   cur_request_->Cancel();
 }
 
 }  // namespace net