Remove the "snionly" concept from the HSTS preload.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
@@ skipping 82 matching lines @@
   DCHECK(CalledOnValidThread());
 }
 
 TransportSecurityState::Iterator::Iterator(const TransportSecurityState& state)
     : iterator_(state.enabled_hosts_.begin()),
       end_(state.enabled_hosts_.end()) {
 }
 
 TransportSecurityState::Iterator::~Iterator() {}
 
-bool TransportSecurityState::ShouldSSLErrorsBeFatal(const std::string& host,
-                                                    bool sni_enabled) {
+bool TransportSecurityState::ShouldSSLErrorsBeFatal(const std::string& host) {
   DomainState state;
-  if (GetStaticDomainState(host, sni_enabled, &state))
+  if (GetStaticDomainState(host, &state))
     return true;
   return GetDynamicDomainState(host, &state);
 }
 
-bool TransportSecurityState::ShouldUpgradeToSSL(const std::string& host,
-                                                bool sni_enabled) {
+bool TransportSecurityState::ShouldUpgradeToSSL(const std::string& host) {
   DomainState dynamic_state;
   if (GetDynamicDomainState(host, &dynamic_state))
     return dynamic_state.ShouldUpgradeToSSL();
 
   DomainState static_state;
-  if (GetStaticDomainState(host, sni_enabled, &static_state) &&
+  if (GetStaticDomainState(host, &static_state) &&
       static_state.ShouldUpgradeToSSL()) {
       return true;
   }
 
   return false;
 }
 
 bool TransportSecurityState::CheckPublicKeyPins(
     const std::string& host,
-    bool sni_available,
     bool is_issued_by_known_root,
     const HashValueVector& public_key_hashes,
     std::string* pinning_failure_log) {
   // Perform pin validation if, and only if, all these conditions obtain:
   //
   // * the server's certificate chain chains up to a known root (i.e. not a
   //   user-installed trust anchor); and
   // * the server actually has public key pins.
-  if (!is_issued_by_known_root || !HasPublicKeyPins(host, sni_available)) {
+  if (!is_issued_by_known_root || !HasPublicKeyPins(host)) {
     return true;
   }
 
   bool pins_are_valid = CheckPublicKeyPinsImpl(
-      host, sni_available, public_key_hashes, pinning_failure_log);
+      host, public_key_hashes, pinning_failure_log);
   if (!pins_are_valid) {
     LOG(ERROR) << *pinning_failure_log;
     ReportUMAOnPinFailure(host);
   }
 
   UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess", pins_are_valid);
   return pins_are_valid;
 }
 
-bool TransportSecurityState::HasPublicKeyPins(const std::string& host,
-                                              bool sni_enabled) {
+bool TransportSecurityState::HasPublicKeyPins(const std::string& host) {
   DomainState dynamic_state;
   if (GetDynamicDomainState(host, &dynamic_state))
     return dynamic_state.HasPublicKeyPins();
 
   DomainState static_state;
-  if (GetStaticDomainState(host, sni_enabled, &static_state)) {
+  if (GetStaticDomainState(host, &static_state)) {
     if (static_state.HasPublicKeyPins())
       return true;
   }
 
   return false;
 }
 
 void TransportSecurityState::SetDelegate(
     TransportSecurityState::Delegate* delegate) {
   DCHECK(CalledOnValidThread());
@@ skipping 558 matching lines @@
 
   domain_state.pkp.last_observed = base::Time::Now();
   domain_state.pkp.include_subdomains = include_subdomains;
   domain_state.pkp.expiry = expiry;
   domain_state.pkp.spki_hashes = hashes;
   EnableHost(host, domain_state);
   return true;
 }
 
 // static
-bool TransportSecurityState::IsGooglePinnedProperty(const std::string& host,
-                                                    bool sni_enabled) {
+bool TransportSecurityState::IsGooglePinnedProperty(const std::string& host) {
   std::string canonicalized_host = CanonicalizeHost(host);
   const struct HSTSPreload* entry =
       GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS);
 
-  if (entry && entry->pins.required_hashes == kGoogleAcceptableCerts)
-    return true;
-
-  if (sni_enabled) {
-    entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
-                           kNumPreloadedSNISTS);
-    if (entry && entry->pins.required_hashes == kGoogleAcceptableCerts)
-      return true;
-  }
-
-  return false;
+  return entry && entry->pins.required_hashes == kGoogleAcceptableCerts;
 }
 
 // static
 void TransportSecurityState::ReportUMAOnPinFailure(const std::string& host) {
   std::string canonicalized_host = CanonicalizeHost(host);
 
   const struct HSTSPreload* entry =
       GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS);
 
   if (!entry) {
-    entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
-                           kNumPreloadedSNISTS);
-  }
-
-  if (!entry) {
     // We don't care to report pin failures for dynamic pins.
     return;
   }
 
   DCHECK(entry);
   DCHECK(entry->pins.required_hashes);
   DCHECK(entry->second_level_domain_name != DOMAIN_NOT_PINNED);
 
   UMA_HISTOGRAM_ENUMERATION("Net.PublicKeyPinFailureDomain",
                             entry->second_level_domain_name, DOMAIN_NUM_EVENTS);
 }
 
 // static
 bool TransportSecurityState::IsBuildTimely() {
   const base::Time build_time = base::GetBuildTime();
   // We consider built-in information to be timely for 10 weeks.
   return (base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */;
 }
 
 bool TransportSecurityState::CheckPublicKeyPinsImpl(
     const std::string& host,
-    bool sni_enabled,
     const HashValueVector& hashes,
     std::string* failure_log) {
   DomainState dynamic_state;
   if (GetDynamicDomainState(host, &dynamic_state))
     return dynamic_state.CheckPublicKeyPins(hashes, failure_log);
 
   DomainState static_state;
-  if (GetStaticDomainState(host, sni_enabled, &static_state))
+  if (GetStaticDomainState(host, &static_state))
     return static_state.CheckPublicKeyPins(hashes, failure_log);
 
   // HasPublicKeyPins should have returned true in order for this method
   // to have been called, so if we fall through to here, it's an error.
   return false;
 }
 
 bool TransportSecurityState::GetStaticDomainState(const std::string& host,
-                                                  bool sni_enabled,
                                                   DomainState* out) const {
   DCHECK(CalledOnValidThread());
 
   const std::string canonicalized_host = CanonicalizeHost(host);
 
   out->sts.upgrade_mode = DomainState::MODE_FORCE_HTTPS;
   out->sts.include_subdomains = false;
   out->pkp.include_subdomains = false;
 
   const bool is_build_timely = IsBuildTimely();
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     std::string host_sub_chunk(&canonicalized_host[i],
                                canonicalized_host.size() - i);
     out->domain = DNSDomainToString(host_sub_chunk);
     bool ret;
     if (is_build_timely && HasPreload(kPreloadedSTS,
                                       kNumPreloadedSTS,
                                       canonicalized_host,
                                       i,
                                       enable_static_pins_,
                                       out,
                                       &ret)) {
       return ret;
     }
-    if (sni_enabled && is_build_timely && HasPreload(kPreloadedSNISTS,
-                                                     kNumPreloadedSNISTS,
-                                                     canonicalized_host,
-                                                     i,
-                                                     enable_static_pins_,
-                                                     out,
-                                                     &ret)) {
-      return ret;
-    }
   }
 
   return false;
 }
 
 bool TransportSecurityState::GetDynamicDomainState(const std::string& host,
                                                    DomainState* result) {
   DCHECK(CalledOnValidThread());
 
   DomainState state;
@@ skipping 96 matching lines @@
   return pkp.spki_hashes.size() > 0 || pkp.bad_spki_hashes.size() > 0;
 }
 
 TransportSecurityState::DomainState::PKPState::PKPState() {
 }
 
 TransportSecurityState::DomainState::PKPState::~PKPState() {
 }
 
 }  // namespace