Report second-level domains for UMA on pin failure.

net/base/transport_security_state.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_TRANSPORT_SECURITY_STATE_H_
 #define NET_BASE_TRANSPORT_SECURITY_STATE_H_
 #pragma once
 
 #include <map>
 #include <string>
@@ skipping 110 matching lines @@
   // Note that like HasMetadata, if |host| matches both an exact entry and is a
   // subdomain of another entry, the exact match determines the return value.
   //
   // This function is used by ChromeFraudulentCertificateReporter to determine
   // whether or not we can automatically post fraudulent certificate reports to
   // Google; we only do so automatically in cases when the user was trying to
   // connect to Google in the first place.
   static bool IsGooglePinnedProperty(const std::string& host,
                                      bool sni_available);
 
+  // Report UMA statistics upon pin failure. Reports only down to the
+  // second-level domain of |host| (e.g. google.com), and only if |host| is

[wtc, 2011/10/25 00:49:57]

The example should say something like
"google.com if |host| is mail.google.com".

+  // an IsPreloadedSTS host (or, if |sni_available|, an SNI preloaded STS

[wtc, 2011/10/25 00:49:57]

Nit: IsPreloadedSTS is a private method, so it probably shouldn't
be used in the comment for a public method.

+  // host).
+  static void ReportUMAPinFailure(const std::string& host, bool sni_available);

[wtc, 2011/10/25 00:49:57]

"PinFailure" needs to be more specific, such as "CertPinFailure"
or "PublicKeyPinFailure".

The comment on line 131 ("pin failure") needs a similar change.

Also, "ReportUMAPinFailure" sounds like we want to report
"UMA pin" failure.  I think we need to add "On":
    ReportUMAOnPinFailure
or remove "UMA":
    ReportPinFailure

+
   // Deletes all records created since a given time.
   void DeleteSince(const base::Time& time);
 
   // Returns |true| if |value| parses as a valid *-Transport-Security
   // header value.  The values of max-age and and includeSubDomains are
   // returned in |max_age| and |include_subdomains|, respectively.  The out
   // parameters are not modified if the function returns |false|.
   static bool ParseHeader(const std::string& value,
                           int* max_age,
                           bool* include_subdomains);
@@ skipping 41 matching lines @@
 
   // Our delegate who gets notified when we are dirtied, or NULL.
   Delegate* delegate_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_TRANSPORT_SECURITY_STATE_H_