Perform dynamic pin checks even when the build is not timely.

Perform dynamic pin checks even when the build is not timely.

BUG=391032
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=289389

[Ryan Hamilton, 2014-08-08 16:32:03]

I think this small CL fixes the associated bug. I'd add a test, but I'm not
really sure how to mock out the "IsBuildTimely" check.

[Ryan Hamilton, 2014-08-08 22:40:34]

+wtc

[Ryan Sleevi, 2014-08-12 01:04:53]

https://codereview.chromium.org/452183002/diff/1/net/http/transport_security_...
File net/http/transport_security_state.cc (right):

https://codereview.chromium.org/452183002/diff/1/net/http/transport_security_...
net/http/transport_security_state.cc:799: return true;
This seems unnecessary, given that GetStaticDomainState checks is_build_timely
directly

[Ryan Hamilton, 2014-08-12 14:01:55]

https://codereview.chromium.org/452183002/diff/1/net/http/transport_security_...
File net/http/transport_security_state.cc (right):

https://codereview.chromium.org/452183002/diff/1/net/http/transport_security_...
net/http/transport_security_state.cc:799: return true;
On 2014/08/12 01:04:53, Ryan Sleevi wrote:
> This seems unnecessary, given that GetStaticDomainState checks is_build_timely
> directly

Done. Hah! I totally missed that.

[Ryan Hamilton, 2014-08-12 14:01:55]

https://codereview.chromium.org/452183002/diff/1/net/http/transport_security_...
File net/http/transport_security_state.cc (right):

https://codereview.chromium.org/452183002/diff/1/net/http/transport_security_...
net/http/transport_security_state.cc:799: return true;
On 2014/08/12 01:04:53, Ryan Sleevi wrote:
> This seems unnecessary, given that GetStaticDomainState checks is_build_timely
> directly

Done. Hah! I totally missed that.

[Ryan Sleevi, 2014-08-12 20:04:42]

lgtm

[Ryan Sleevi, 2014-08-12 20:05:37]

Actually, I say that, but please hold off CQing until you hear from David

David: Did we fix the IsIssuedByKnownRoot *completely* on Android? Or only
latest devices, meaning we need to gate this bit?

[davidben, 2014-08-12 20:13:00]

On 2014/08/12 20:05:37, Ryan Sleevi wrote:
> Actually, I say that, but please hold off CQing until you hear from David
> 
> David: Did we fix the IsIssuedByKnownRoot *completely* on Android? Or only
> latest devices, meaning we need to gate this bit?

On devices where we can get the chain out (API level 17 and higher), we should
populate the bit correctly. On older devices, it conservatively reports false
because most checks are gated on it being true. So I think this works?

[Ryan Hamilton, 2014-08-13 15:17:56]

The CQ bit was checked by rch@chromium.org

[commit-bot: I haz the power, 2014-08-13 15:19:34]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/rch@chromium.org/452183002/20001

[commit-bot: I haz the power, 2014-08-13 20:48:42]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  mac_chromium_rel_swarming on tryserver.chromium.mac
(http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[commit-bot: I haz the power, 2014-08-13 21:53:41]

Committed patchset #2 (20001) as 289389

[wtc, 2014-08-13 23:08:21]

Patch set 2 LGTM.

https://codereview.chromium.org/452183002/diff/20001/net/http/transport_secur...
File net/http/transport_security_state.cc (right):

https://codereview.chromium.org/452183002/diff/20001/net/http/transport_secur...
net/http/transport_security_state.cc:816: const bool is_build_timely =
IsBuildTimely();

Nit: I assume we are now relying on this IsBuildTimely() check for static pins.

Unless we need the side effect of line 821, we can return false directly if
is_build_timely is false.