Add a build flag to configure bundling of HSTS preload list

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <memory>
 #include <utility>
 #include <vector>
 
@@ skipping 22 matching lines @@
 
 #if !defined(OS_NACL)
 #include "base/metrics/field_trial.h"
 #endif
 
 namespace net {
 
 namespace {
 
 #include "net/http/transport_security_state_ct_policies.inc"
+
+#if BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST)
 #include "net/http/transport_security_state_static.h"
+// Points to the active transport security state source.
+const TransportSecurityStateSource* g_hsts_source = &kHSTSSource;
+#else
+const TransportSecurityStateSource* g_hsts_source = nullptr;

[xunjieli, 2017/07/10 22:20:40]

(This is needed now that |kHSTSSource| is not defined when the flag is turned
off.)

[Ryan Sleevi, 2017/07/11 15:29:40]

So you could probably abstract this a little, and thus avoid the whole need to
expose the GetTSSForTesting

#if BUILDFLAG(...)
#include
const TransportSecurityState* const kDefaultHSTSSource = &kHSTSSource;
#else
const TransportSecurityState* const kDefaultHSTSSource = nullptr;
#endif

const TransportSecurityState* g_hsts_source = kDefaultHSTSSource;

[xunjieli, 2017/07/11 16:45:21]

Done. Good idea. Thanks!

+#endif
 
 // Parameters for remembering sent HPKP and Expect-CT reports.
 const size_t kMaxReportCacheEntries = 50;
 const int kTimeToRememberReportsMins = 60;
 const size_t kReportCacheKeyLength = 16;
 
-// Points to the active transport security state source.
-const TransportSecurityStateSource* g_hsts_source = &kHSTSSource;
-
 // Override for CheckCTRequirements() for unit tests. Possible values:
 //  -1: Unless a delegate says otherwise, do not require CT.
 //   0: Use the default implementation (e.g. production)
 //   1: Unless a delegate says otherwise, require CT.
 int g_ct_required_for_testing = 0;
 
 bool IsDynamicExpectCTEnabled() {
   return base::FeatureList::IsEnabled(
       TransportSecurityState::kDynamicExpectCTFeature);
 }
@@ skipping 567 matching lines @@
       if (hostname[hostname_offset - 1] == c) {
         bit_offset = current_offset;
         hostname_offset--;
         break;
       }
     }
   }
 }
 
 bool DecodeHSTSPreload(const std::string& hostname, PreloadResult* out) {
+#if !BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST)
+  if (g_hsts_source == nullptr)

[xunjieli, 2017/07/10 22:20:40]

(transport_security_state_unittest.cc can choose to use a test-only static
source, so I returned false only when the test did not provide a |g_hsts_source|
and the flag is false.)

+    return false;
+#endif
+
   bool found;
   if (!DecodeHSTSPreloadRaw(hostname, &found, out)) {
     DCHECK(false) << "Internal error in DecodeHSTSPreloadRaw for hostname "
                   << hostname;
     return false;
   }
 
   return found;
 }
 
@@ skipping 77 matching lines @@
 }
 
 }  // namespace
 
 // static
 const base::Feature TransportSecurityState::kDynamicExpectCTFeature{
     "DynamicExpectCT", base::FEATURE_DISABLED_BY_DEFAULT};
 
 void SetTransportSecurityStateSourceForTesting(
     const TransportSecurityStateSource* source) {
-  g_hsts_source = source ? source : &kHSTSSource;
+  g_hsts_source = source;

[Ryan Sleevi, 2017/07/11 15:29:40]

And then here

g_hsts_source = source ? source : kDefaultHSTSSource;

[xunjieli, 2017/07/11 16:45:21]

Done.

+}
+
+const TransportSecurityStateSource*
+GetTransportSecurityStateSourceForTesting() {
+  return g_hsts_source;
 }
 
 TransportSecurityState::TransportSecurityState()
     : enable_static_pins_(true),
       enable_static_expect_ct_(true),
       enable_static_expect_staple_(true),
       enable_pkp_bypass_for_local_trust_anchors_(true),
       sent_hpkp_reports_cache_(kMaxReportCacheEntries),
       sent_expect_ct_reports_cache_(kMaxReportCacheEntries) {
 // Static pinning is only enabled for official builds to make sure that
@@ skipping 1097 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace net