Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(552)

Unified Diff: net/url_request/url_request_http_job.cc

Issue 7976036: net: make HSTS hosts use the normal SSL interstitials (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: ... Created 9 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: net/url_request/url_request_http_job.cc
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index cdb94faeb7e067c069bda0c05117f88b06434a49..5dbe0b5d4598e96f8d6d4ab1017ca78b9218c435 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -689,10 +689,17 @@ void URLRequestHttpJob::OnStartCompleted(int result) {
} else if (ShouldTreatAsCertificateError(result)) {
// We encountered an SSL certificate error. Ask our delegate to decide
// what we should do.
- // TODO(wtc): also pass ssl_info.cert_status, or just pass the whole
- // ssl_info.
wtc 2011/09/23 00:04:51 The ssl_info structure has become much bigger than
+
+ TransportSecurityState::DomainState domain_state;
+ const bool r = context_->transport_security_state()->IsEnabledForHost(
wtc 2011/09/23 00:04:51 Please pick a better variable name than |r|.
+ &domain_state, request_info_.url.host(),
+ SSLConfigService::IsSNIAvailable(context_->ssl_config_service()));
+ // ERR_CERT_UNABLE_TO_CHECK_REVOCATION isn't forced to fatal, even for HSTS
+ // sites, because it happens due to transient network issues.
+ bool must_be_fatal = r && result != ERR_CERT_UNABLE_TO_CHECK_REVOCATION;
+
NotifySSLCertificateError(
- result, transaction_->GetResponseInfo()->ssl_info.cert);
+ result, transaction_->GetResponseInfo()->ssl_info, must_be_fatal);
wtc 2011/09/23 00:04:51 In our current design of SSL error handling, I bel
} else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
NotifyCertificateRequested(
transaction_->GetResponseInfo()->cert_request_info);
@@ -720,24 +727,7 @@ void URLRequestHttpJob::OnReadCompleted(int result) {
}
bool URLRequestHttpJob::ShouldTreatAsCertificateError(int result) {
wtc 2011/09/23 00:04:51 We should remove the ShouldTreatAsCertificateError
- if (!IsCertificateError(result))
- return false;
-
- // Revocation check failures are always certificate errors, even if the host
- // is using Strict-Transport-Security.
- if (result == ERR_CERT_UNABLE_TO_CHECK_REVOCATION)
- return true;
-
- // Check whether our context is using Strict-Transport-Security.
- if (!context_->transport_security_state())
- return true;
-
- TransportSecurityState::DomainState domain_state;
- const bool r = context_->transport_security_state()->IsEnabledForHost(
- &domain_state, request_info_.url.host(),
- SSLConfigService::IsSNIAvailable(context_->ssl_config_service()));
-
- return !r;
+ return IsCertificateError(result);
}
void URLRequestHttpJob::RestartTransactionWithAuth(

Powered by Google App Engine
This is Rietveld 408576698