Perform dynamic pin checks even when the build is not timely.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
@@ skipping 115 matching lines @@
 bool TransportSecurityState::CheckPublicKeyPins(
     const std::string& host,
     bool sni_available,
     bool is_issued_by_known_root,
     const HashValueVector& public_key_hashes,
     std::string* pinning_failure_log) {
   // Perform pin validation if, and only if, all these conditions obtain:
   //
   // * the server's certificate chain chains up to a known root (i.e. not a
   //   user-installed trust anchor); and
-  // * the build is recent (very old builds should fail open so that users
-  //   have some chance to recover).
   // * the server actually has public key pins.
-  //
-  // TODO(rsleevi): http://crbug.com/391032 - Only disable static HPKP if the
-  // build is not timely.
-  if (!is_issued_by_known_root || !IsBuildTimely() ||
-      !HasPublicKeyPins(host, sni_available)) {
+  if (!is_issued_by_known_root || !HasPublicKeyPins(host, sni_available)) {
     return true;
   }
 
   bool pins_are_valid = CheckPublicKeyPinsImpl(
       host, sni_available, public_key_hashes, pinning_failure_log);
   if (!pins_are_valid) {
     LOG(ERROR) << *pinning_failure_log;
     ReportUMAOnPinFailure(host);
   }
 
@@ skipping 638 matching lines @@
 
 bool TransportSecurityState::CheckPublicKeyPinsImpl(
     const std::string& host,
     bool sni_enabled,
     const HashValueVector& hashes,
     std::string* failure_log) {
   DomainState dynamic_state;
   if (GetDynamicDomainState(host, &dynamic_state))
     return dynamic_state.CheckPublicKeyPins(hashes, failure_log);
 
+  // Very old builds should fail open so that users have some chance
+  // to recover.
+  if (!IsBuildTimely())
+    return true;

[Ryan Sleevi, 2014/08/12 01:04:53]

This seems unnecessary, given that GetStaticDomainState checks is_build_timely
directly

[Ryan Hamilton, 2014/08/12 14:01:55]

Done. Hah! I totally missed that.

+
   DomainState static_state;
   if (GetStaticDomainState(host, sni_enabled, &static_state))
     return static_state.CheckPublicKeyPins(hashes, failure_log);
 
   // HasPublicKeyPins should have returned true in order for this method
   // to have been called, so if we fall through to here, it's an error.
   return false;
 }
 
 bool TransportSecurityState::GetStaticDomainState(const std::string& host,
@@ skipping 141 matching lines @@
   return pkp.spki_hashes.size() > 0 || pkp.bad_spki_hashes.size() > 0;
 }
 
 TransportSecurityState::DomainState::PKPState::PKPState() {
 }
 
 TransportSecurityState::DomainState::PKPState::~PKPState() {
 }
 
 }  // namespace