net: make pinning enforcement timeout after ten weeks.

net/url_request/url_request_http_job.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
+#include "base/base_switches.h"
 #include "base/bind.h"
-#include "base/base_switches.h"
+#include "base/build_time.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
 #include "base/file_version_info.h"
 #include "base/message_loop.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
 #include "base/rand_util.h"
 #include "base/string_util.h"
 #include "base/time.h"
@@ skipping 659 matching lines @@
         context_->transport_security_state()) {
       TransportSecurityState::DomainState domain_state;
       bool sni_available = SSLConfigService::IsSNIAvailable(
           context_->ssl_config_service());
       std::string host = request_->url().host();
 
       if (context_->transport_security_state()->HasPinsForHost(
               &domain_state, host, sni_available)) {
         if (!domain_state.IsChainOfPublicKeysPermitted(
                 ssl_info.public_key_hashes)) {
-          result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
-          UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess", false);
-          TransportSecurityState::ReportUMAOnPinFailure(host);
-          FraudulentCertificateReporter* reporter =
-              context_->fraudulent_certificate_reporter();
-          if (reporter != NULL)
-            reporter->SendReport(host, ssl_info, sni_available);
+          const base::Time build_time = base::GetBuildTime();
+          if ((base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */) {

[wtc, 2011/11/15 02:49:31]

Please add a comment to explain the purpose of this test.
It is not obvious.

+            result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
+            UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess", false);
+            TransportSecurityState::ReportUMAOnPinFailure(host);
+            FraudulentCertificateReporter* reporter =
+                context_->fraudulent_certificate_reporter();
+            if (reporter != NULL)
+              reporter->SendReport(host, ssl_info, sni_available);
+          }
         } else {
           UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess", true);
         }
       }
     }
   }
 #endif
 
   if (result == OK) {
     scoped_refptr<HttpResponseHeaders> headers = GetResponseHeaders();
@@ skipping 725 matching lines @@
   return override_response_headers_.get() ?
       override_response_headers_ :
       transaction_->GetResponseInfo()->headers;
 }
 
 void URLRequestHttpJob::NotifyURLRequestDestroyed() {
   awaiting_callback_ = false;
 }
 
 }  // namespace net