Index: net/url_request/url_request_http_job.cc |
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc |
index cdb94faeb7e067c069bda0c05117f88b06434a49..5dbe0b5d4598e96f8d6d4ab1017ca78b9218c435 100644 |
--- a/net/url_request/url_request_http_job.cc |
+++ b/net/url_request/url_request_http_job.cc |
@@ -689,10 +689,17 @@ void URLRequestHttpJob::OnStartCompleted(int result) { |
} else if (ShouldTreatAsCertificateError(result)) { |
// We encountered an SSL certificate error. Ask our delegate to decide |
// what we should do. |
- // TODO(wtc): also pass ssl_info.cert_status, or just pass the whole |
- // ssl_info. |
wtc
2011/09/23 00:04:51
The ssl_info structure has become much bigger than
|
+ |
+ TransportSecurityState::DomainState domain_state; |
+ const bool r = context_->transport_security_state()->IsEnabledForHost( |
wtc
2011/09/23 00:04:51
Please pick a better variable name than |r|.
|
+ &domain_state, request_info_.url.host(), |
+ SSLConfigService::IsSNIAvailable(context_->ssl_config_service())); |
+ // ERR_CERT_UNABLE_TO_CHECK_REVOCATION isn't forced to fatal, even for HSTS |
+ // sites, because it happens due to transient network issues. |
+ bool must_be_fatal = r && result != ERR_CERT_UNABLE_TO_CHECK_REVOCATION; |
+ |
NotifySSLCertificateError( |
- result, transaction_->GetResponseInfo()->ssl_info.cert); |
+ result, transaction_->GetResponseInfo()->ssl_info, must_be_fatal); |
wtc
2011/09/23 00:04:51
In our current design of SSL error handling, I bel
|
} else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) { |
NotifyCertificateRequested( |
transaction_->GetResponseInfo()->cert_request_info); |
@@ -720,24 +727,7 @@ void URLRequestHttpJob::OnReadCompleted(int result) { |
} |
bool URLRequestHttpJob::ShouldTreatAsCertificateError(int result) { |
wtc
2011/09/23 00:04:51
We should remove the ShouldTreatAsCertificateError
|
- if (!IsCertificateError(result)) |
- return false; |
- |
- // Revocation check failures are always certificate errors, even if the host |
- // is using Strict-Transport-Security. |
- if (result == ERR_CERT_UNABLE_TO_CHECK_REVOCATION) |
- return true; |
- |
- // Check whether our context is using Strict-Transport-Security. |
- if (!context_->transport_security_state()) |
- return true; |
- |
- TransportSecurityState::DomainState domain_state; |
- const bool r = context_->transport_security_state()->IsEnabledForHost( |
- &domain_state, request_info_.url.host(), |
- SSLConfigService::IsSNIAvailable(context_->ssl_config_service())); |
- |
- return !r; |
+ return IsCertificateError(result); |
} |
void URLRequestHttpJob::RestartTransactionWithAuth( |