net: set Google pins for our ccTLDs domains and others.

net: set Google pins for our ccTLDs domains and others.

BUG=141444
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=156812

[agl, 2012-08-14 01:13:40]

palmer, rsleevi: please both review. I'll need rsleevi's LGTM in order to use
the commit bot.

These names were taken from our large, ccTLD certificate.

[Ryan Sleevi, 2012-08-14 01:56:03]

https://chromiumcodereview.appspot.com/10834300/diff/1/net/base/transport_sec...
File net/base/transport_security_state_static.h (right):

https://chromiumcodereview.appspot.com/10834300/diff/1/net/base/transport_sec...
net/base/transport_security_state_static.h:345: {6, true, "\001g\002co", false,
kGooglePins, DOMAIN_G_CO },
Are these ready to be pinned?

Seems like they may have gotten slurped up in the ccTLD export

https://chromiumcodereview.appspot.com/10834300/diff/1/net/base/transport_sec...
net/base/transport_security_state_static.h:373: {11, true, "\006google\002cn",
false, kGooglePins, DOMAIN_GOOGLE_CN },
?

[palmer, 2012-08-14 16:47:46]

The only problem/potential problem I experienced is with google.cn — but I
didn't try them all. Do we need a little Python/openssl shell script to hit all
those servers and make sure their chains would pass a pin validation?

https://chromiumcodereview.appspot.com/10834300/diff/1/net/base/transport_sec...
File net/base/transport_security_state_static.h (right):

https://chromiumcodereview.appspot.com/10834300/diff/1/net/base/transport_sec...
net/base/transport_security_state_static.h:345: {6, true, "\001g\002co", false,
kGooglePins, DOMAIN_G_CO },
> Are these ready to be pinned?
> 
> Seems like they may have gotten slurped up in the ccTLD export

Do you mean g.co and goo.gl? They both chain up through GIA, which seems right
to me. (Mixed content issues aside...)

https://chromiumcodereview.appspot.com/10834300/diff/1/net/base/transport_sec...
net/base/transport_security_state_static.h:373: {11, true, "\006google\002cn",
false, kGooglePins, DOMAIN_GOOGLE_CN },
> ?

For better or worse, I can't even get there.

This is likely to have political implications...

[Ryan Sleevi, 2012-08-15 18:04:41]

lgtm

[agl, 2012-08-24 17:27:35]

Note: we're not forcing HTTPS on any of these domains. We're just requiring a
pinned certificate if we happen to be making an HTTPS request anyway. I chatted
with rsleevi about this before my vacation and he seemed happy with that so I'll
flip the commit bit on this.

[commit-bot: I haz the power, 2012-08-24 17:27:45]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/agl@chromium.org/10834300/4001

[commit-bot: I haz the power, 2012-08-24 17:27:47]

Presubmit check for 10834300-4001 failed and returned exit status 1.


Running presubmit commit checks ...

** Presubmit Warnings **
Found lines longer than 80 characters (first 5 shown).
  net/base/transport_security_state_static.h, line 341, 90 chars

Was the presubmit check useful? Please send feedback & hate mail to
maruel@chromium.org!