Add a whitelist for QUIC hosts.

net/http/transport_security_state.h

Index: net/http/transport_security_state.h
diff --git a/net/http/transport_security_state.h b/net/http/transport_security_state.h
index afdf6c38b73a642faa0824f8989b07a9b4dfb38d..ea74db3562c340c6313b1232f282a398153b9615 100644
--- a/net/http/transport_security_state.h
+++ b/net/http/transport_security_state.h
@@ -282,6 +282,10 @@ class NET_EXPORT TransportSecurityState
                             STSState* sts_result,
                             PKPState* pkp_result) const;
 
+  // Returns true iff there is static (built-in) state for |host| that
+  // references the Google pins.

[Ryan Sleevi, 2016/01/11 23:54:27]

This is something I really have tried hard to keep out of //net, because //net
should not really know about Google or whitelisting.

At the least, could you please add clear comments and documentation indicating
this is temporary, a layering violation, and should be removed? Otherwise, we
should try to have a talk about the design to figure out if there's a better way
to avoid this from leaking into the API contract of //net (for example, the
policy object pushed into QUIC that contains the whitelist, which itself could
then figure out policy checks like this)

[Ryan Hamilton, 2016/01/12 00:22:46]

Should transport_security_state_static and friends move elsewhere?
Hopefully clear comment added.

[Ryan Sleevi, 2016/01/12 00:29:39]

TSS is fine - it's a vendor-neutral whitelist. Inferring which vendor is more of
the bit that's gross - especially when it's the vendor shipping the browser ;)

Comment works for me - perhaps even more clear than necessary :)

+  bool IsGooglePinnedHost(const std::string& host) const;
+
   // Returns true and updates |*expect_ct_result| iff there is a static
   // (built-in) state for |host| with expect_ct=true.
   bool GetStaticExpectCTState(const std::string& host,