Cleanup HPKP error handling and weak DH key handling

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <openssl/bio.h>
 #include <openssl/bytestring.h>
 #include <openssl/err.h>
@@ skipping 1317 matching lines @@
   }
 
   const CertStatus cert_status = server_cert_verify_result_.cert_status;
   if ((result == OK ||
        (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) &&
       !transport_security_state_->CheckPublicKeyPins(
           host_and_port_, server_cert_verify_result_.is_issued_by_known_root,
           server_cert_verify_result_.public_key_hashes, server_cert_.get(),
           server_cert_verify_result_.verified_cert.get(),
           TransportSecurityState::ENABLE_PIN_REPORTS, &pinning_failure_log_)) {
-    if (server_cert_verify_result_.is_issued_by_known_root)
+    if (server_cert_verify_result_.is_issued_by_known_root) {
+      server_cert_verify_result_.cert_status |= CERT_STATUS_PINNED_KEY_MISSING;

[davidben, 2016/06/21 00:14:12]

Think it's worth adding a line to SSLClientSocketTest.PKPEnforced?

       result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;

[davidben, 2016/06/21 00:14:12]

[Confirmed these are the two places in //net which produce this error.]

-    else
+    } else {
       pkp_bypassed_ = true;
+    }
   }
 
   if (result == OK) {
     // Only check Certificate Transparency if there were no other errors with
     // the connection.
     VerifyCT();
 
     DCHECK(!certificate_verified_);
     certificate_verified_ = true;
     MaybeCacheSession();
@@ skipping 950 matching lines @@
   if (rv != OK) {
     net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv);
     return;
   }
 
   net_log_.EndEvent(NetLog::TYPE_SSL_CONNECT,
                     base::Bind(&NetLogSSLInfoCallback, base::Unretained(this)));
 }
 
 }  // namespace net