Improve TransportSecurityState data storage.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 3458 matching lines @@
     TransportSecurityState::DomainState domain_state;
     if (transport_security_state_->GetDomainState(host, sni_available,
                                                   &domain_state) &&
         domain_state.HasPublicKeyPins()) {
       if (!domain_state.CheckPublicKeyPins(
                server_cert_verify_result_.public_key_hashes)) {
         // Pins are not enforced if the build is too old.
         if (TransportSecurityState::IsBuildTimely()) {
           result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
           UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess", false);
-          TransportSecurityState::ReportUMAOnPinFailure(host);
+          domain_state.ReportUMAOnPinFailure();

[palmer, 2013/04/02 22:56:05]

Re-reading the code around this line, which is my fault not yours, I see it is
unnecessarily confusing. I'm ginning up a CL that will clarify ("NO REALLY
PLEASE BELIEVE ME") this area, but it will probably cause you a merge conflict
when you rebase. You'll thank me later. ;)

[unsafe, 2013/04/03 05:21:42]

Yeah, I think the build-age and reporting should maybe go inside
CheckPublicKeyPins(), to make this a simpler call site.  You could potentially
go as far as removing HasPublicKeyPins(), IsBuildTimely(), and
ReportUMAOnPinFailure() from the public interface.   

         }
       } else {
         UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess", true);
       }
     }
   }
 #endif
 
   // Exit DoHandshakeLoop and return the result to the caller to Connect.
   DCHECK_EQ(STATE_NONE, next_handshake_state_);
@@ skipping 44 matching lines @@
   EnsureThreadIdAssigned();
   base::AutoLock auto_lock(lock_);
   return valid_thread_id_ == base::PlatformThread::CurrentId();
 }
 
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }
 
 }  // namespace net