Centralize the logic for checking public key pins

net/http/transport_security_state.h

Index: net/http/transport_security_state.h
diff --git a/net/http/transport_security_state.h b/net/http/transport_security_state.h
index 364593791455030cc4d5cd37a30b2dc03f3ec6c4..6f04a262106b93438b07e8ca24c267fc1793a141 100644
--- a/net/http/transport_security_state.h
+++ b/net/http/transport_security_state.h
@@ -252,6 +252,13 @@ class NET_EXPORT TransportSecurityState
   bool AddHPKP(const std::string& host, const base::Time& expiry,
                bool include_subdomains, const HashValueVector& hashes);
 
+  // Returns true if |cert_verify_result| meets the pinning constrains of
+  // |host|, or if the build it out of date, or if the root is unknown.

[wtc, 2014/08/05 18:16:24]

1. Typo: the build it out of date => the build is out of date

2. "the root is unknown" is confusing. We should say "the root is not a built-in
trusted root".

3. Please document the output parameter pinning_failure_log, which is written to
on failure.

[Ryan Hamilton, 2014/08/06 21:51:01]

Done.

+  bool VerifyPinning(const CertVerifyResult& cert_verify_result,
+                     bool sni_available,
+                     const std::string& host,
+                     std::string* pinning_failure_log);
+
   // Returns true iff we have any static public key pins for the |host| and
   // iff its set of required pins is the set we expect for Google
   // properties.