Add a build flag to configure bundling of HSTS preload list

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <memory>
 #include <utility>
 #include <vector>
 
@@ skipping 621 matching lines @@
         hostname_offset--;
         break;
       }
     }
   }
 }
 
 bool DecodeHSTSPreload(const std::string& hostname, PreloadResult* out) {
   bool found;
   if (!DecodeHSTSPreloadRaw(hostname, &found, out)) {
-    DCHECK(false) << "Internal error in DecodeHSTSPreloadRaw for hostname "
-                  << hostname;
+    // This can happen when INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST is
+    // false, in which case BitReader.seek(0) will return false.

[Ryan Sleevi, 2017/07/07 16:45:13]

Could you explain the rationale for doing this change, versus using the build
flag?

That is, one option is

#if !BUILDFLAG(...)
  return false;
#else
  bool found;
  if (...) {
  }
  return found;
#endif

- that forces the linker to optimize out DecodeHSTSPreloadRaw (and all the
supporting code), which it should be capable of doing.

Alternatively, you could do

#if !BUILDFLAG(...)
bool DecodeHSTSPreloadRaw(const std::string& search_hostname, bool* out_found,
PreloadResult* out) {
  *out_found = false;
  return true;
}
#else
....

#endif

Which would explicitly compile that code out.

From my reading, this would fully allow you to compile out both the
HuffmanDecoder and the BitReader, which this current approach - removing the
DCHECK - doesn't do.

By removing the DCHECK, you're removing a guard for when
INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST is true - thus weakening the
preconditions. That seems undesirable, but I was curious if there was a reason
for that which I missed.

[xunjieli, 2017/07/10 22:20:40]

Done. That's very neat. Thank you for the suggestion.

     return false;
   }
 
   return found;
 }
 
 // Serializes an OCSPVerifyResult::ResponseStatus to a string enum, suitable for
 // the |response-status| field in an Expect-Staple report.
 std::string SerializeExpectStapleResponseStatus(
     OCSPVerifyResult::ResponseStatus status) {
@@ skipping 1191 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace net