Perform dynamic pin checks even when the build is not timely.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
@@ skipping 115 matching lines @@
 bool TransportSecurityState::CheckPublicKeyPins(
     const std::string& host,
     bool sni_available,
     bool is_issued_by_known_root,
     const HashValueVector& public_key_hashes,
     std::string* pinning_failure_log) {
   // Perform pin validation if, and only if, all these conditions obtain:
   //
   // * the server's certificate chain chains up to a known root (i.e. not a
   //   user-installed trust anchor); and
-  // * the build is recent (very old builds should fail open so that users
-  //   have some chance to recover).
   // * the server actually has public key pins.
-  //
-  // TODO(rsleevi): http://crbug.com/391032 - Only disable static HPKP if the
-  // build is not timely.
-  if (!is_issued_by_known_root || !IsBuildTimely() ||
-      !HasPublicKeyPins(host, sni_available)) {
+  if (!is_issued_by_known_root || !HasPublicKeyPins(host, sni_available)) {
     return true;
   }
 
   bool pins_are_valid = CheckPublicKeyPinsImpl(
       host, sni_available, public_key_hashes, pinning_failure_log);
   if (!pins_are_valid) {
     LOG(ERROR) << *pinning_failure_log;
     ReportUMAOnPinFailure(host);
   }
 
@@ skipping 658 matching lines @@
                                                   bool sni_enabled,
                                                   DomainState* out) const {
   DCHECK(CalledOnValidThread());
 
   const std::string canonicalized_host = CanonicalizeHost(host);
 
   out->sts.upgrade_mode = DomainState::MODE_FORCE_HTTPS;
   out->sts.include_subdomains = false;
   out->pkp.include_subdomains = false;
 
   const bool is_build_timely = IsBuildTimely();

[wtc, 2014/08/13 23:08:21]

Nit: I assume we are now relying on this IsBuildTimely() check for static pins.

Unless we need the side effect of line 821, we can return false directly if
is_build_timely is false.

 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     std::string host_sub_chunk(&canonicalized_host[i],
                                canonicalized_host.size() - i);
     out->domain = DNSDomainToString(host_sub_chunk);
     bool ret;
     if (is_build_timely && HasPreload(kPreloadedSTS,
                                       kNumPreloadedSTS,
                                       canonicalized_host,
                                       i,
@@ skipping 120 matching lines @@
   return pkp.spki_hashes.size() > 0 || pkp.bad_spki_hashes.size() > 0;
 }
 
 TransportSecurityState::DomainState::PKPState::PKPState() {
 }
 
 TransportSecurityState::DomainState::PKPState::~PKPState() {
 }
 
 }  // namespace