Cleanup HPKP error handling and weak DH key handling

net/url_request/url_request_http_job.cc

Index: net/url_request/url_request_http_job.cc
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index 73fe8fa0d6ae110f6e8884f19642dd173f75101f..336d798a5adf41a06d709ac578c74164926d15f9 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -1083,21 +1083,11 @@ void URLRequestHttpJob::OnStartCompleted(int result) {
     SaveCookiesAndNotifyHeadersComplete(OK);
   } else if (IsCertificateError(result)) {
     // We encountered an SSL certificate error.
-    if (result == ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY ||
-        result == ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN) {

[davidben, 2016/06/21 00:14:12]

To confirm, if result is ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN, fatal switches
from true to ShouldSSLErrorsBeFatal. But I believe that's fine because
ShouldSSLErrorsBeFatal is always true if there is a pin. Is that your reasoning
as well?

[Ryan Sleevi, 2016/06/21 00:23:05]

Correct. Tried to explain this in the description, but happy to take wording
changes if you feel it's unclear (feel free to just edit it directly)

-      // These are hard failures. They're handled separately and don't have
-      // the correct cert status, so set it here.
-      SSLInfo info(transaction_->GetResponseInfo()->ssl_info);
-      info.cert_status = MapNetErrorToCertStatus(result);
-      NotifySSLCertificateError(info, true);
-    } else {
-      // Maybe overridable, maybe not. Ask the delegate to decide.
-      TransportSecurityState* state = context->transport_security_state();
-      const bool fatal =
-          state && state->ShouldSSLErrorsBeFatal(request_info_.url.host());
-      NotifySSLCertificateError(
-          transaction_->GetResponseInfo()->ssl_info, fatal);
-    }
+    // Maybe overridable, maybe not. Ask the delegate to decide.
+    TransportSecurityState* state = context->transport_security_state();
+    NotifySSLCertificateError(
+        transaction_->GetResponseInfo()->ssl_info,
+        state->ShouldSSLErrorsBeFatal(request_info_.url.host()));
   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
     NotifyCertificateRequested(
         transaction_->GetResponseInfo()->cert_request_info.get());