net: make HSTS hosts use the normal SSL interstitials

net/url_request/url_request_http_job.cc

Index: net/url_request/url_request_http_job.cc
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index cdb94faeb7e067c069bda0c05117f88b06434a49..5dbe0b5d4598e96f8d6d4ab1017ca78b9218c435 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -689,10 +689,17 @@ void URLRequestHttpJob::OnStartCompleted(int result) {
   } else if (ShouldTreatAsCertificateError(result)) {
     // We encountered an SSL certificate error.  Ask our delegate to decide
     // what we should do.
-    // TODO(wtc): also pass ssl_info.cert_status, or just pass the whole
-    // ssl_info.

[wtc, 2011/09/23 00:04:51]

The ssl_info structure has become much bigger than it was
when I wrote this comment.  So I was wondering if it's better
to pass only ssl_info.cert_status.

After I reviewed the entire CL, I believe it is better to
pass ssl_info.

+
+    TransportSecurityState::DomainState domain_state;
+    const bool r = context_->transport_security_state()->IsEnabledForHost(

[wtc, 2011/09/23 00:04:51]

Please pick a better variable name than |r|.

+        &domain_state, request_info_.url.host(),
+        SSLConfigService::IsSNIAvailable(context_->ssl_config_service()));
+    // ERR_CERT_UNABLE_TO_CHECK_REVOCATION isn't forced to fatal, even for HSTS
+    // sites, because it happens due to transient network issues.
+    bool must_be_fatal = r && result != ERR_CERT_UNABLE_TO_CHECK_REVOCATION;
+
     NotifySSLCertificateError(
-        result, transaction_->GetResponseInfo()->ssl_info.cert);
+        result, transaction_->GetResponseInfo()->ssl_info, must_be_fatal);

[wtc, 2011/09/23 00:04:51]

In our current design of SSL error handling, I believe it is
better to simply pass the boolean info "is HSTS host" to
NotifySSLCertificateError, and let the SSL policy decide
whether the certificate error should be fatal.

   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
     NotifyCertificateRequested(
         transaction_->GetResponseInfo()->cert_request_info);
@@ -720,24 +727,7 @@ void URLRequestHttpJob::OnReadCompleted(int result) {
 }
 
 bool URLRequestHttpJob::ShouldTreatAsCertificateError(int result) {

[wtc, 2011/09/23 00:04:51]

We should remove the ShouldTreatAsCertificateError method.

-  if (!IsCertificateError(result))
-    return false;
-
-  // Revocation check failures are always certificate errors, even if the host
-  // is using Strict-Transport-Security.
-  if (result == ERR_CERT_UNABLE_TO_CHECK_REVOCATION)
-    return true;
-
-  // Check whether our context is using Strict-Transport-Security.
-  if (!context_->transport_security_state())
-    return true;
-
-  TransportSecurityState::DomainState domain_state;
-  const bool r = context_->transport_security_state()->IsEnabledForHost(
-      &domain_state, request_info_.url.host(),
-      SSLConfigService::IsSNIAvailable(context_->ssl_config_service()));
-
-  return !r;
+  return IsCertificateError(result);
 }
 
 void URLRequestHttpJob::RestartTransactionWithAuth(