Add a whitelist for QUIC hosts.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/base64.h"
@@ skipping 1082 matching lines @@
       while (*sha256_hash) {
         AddHash(*sha256_hash, &pkp_state->bad_spki_hashes);
         sha256_hash++;
       }
     }
   }
 
   return true;
 }
 
+bool TransportSecurityState::IsGooglePinnedHost(const std::string& host) const {
+  DCHECK(CalledOnValidThread());
+
+  if (!IsBuildTimely())
+    return false;
+
+  PreloadResult result;
+  if (!DecodeHSTSPreload(host, &result))
+    return false;
+
+  if (!result.has_pins)

[Ryan Sleevi, 2016/01/12 00:29:39]

BUG? You should be checking enable_static_pins_, right? You seem to be
duplicating the subset of GetStaticDomainState relevant for this function.

[Ryan Hamilton, 2016/01/12 01:21:24]

I think this is a feature. In the initial version of this CL, I called into
GetStaticDomainState() and observed to agl that this meant that local builds
would not have these hosts on the whitelist. He suggested that since the data
still exists, we could make use of it, so not checking enable_static_pins_ is
intentional. 

+    return false;
+
+  return kPinsets[result.pinset_id].accepted_pins == kGoogleAcceptableCerts;

[Ryan Sleevi, 2016/01/12 00:29:39]

BUG? The original code defends against corruption for pinset_id (see lines
1077/1078). Why is that not necessary here? Is that above check unnecessary?

[Ryan Hamilton, 2016/01/12 01:21:24]

It's defending against corruption? Interesting. I didn't catch that.
Done.

+}
+
 bool TransportSecurityState::GetStaticExpectCTState(
     const std::string& host,
     ExpectCTState* expect_ct_state) const {
   DCHECK(CalledOnValidThread());
 
   if (!IsBuildTimely())
     return false;
 
   PreloadResult result;
   if (!DecodeHSTSPreload(host, &result))
@@ skipping 186 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace