commit b180b4c7af9108c7d9657f35ceb72c3624e30cfe
author Celeste Pan <celestepan@microsoft.com> Wed Oct 18 18:46:35 2023
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Oct 18 18:46:35 2023
tree 6ea00e11bfddc8235a77f3766788cff27949d64d
parent c23f99b74b4f738fe1f5a3e04cca8c9d2f17aaed

Add flag to bypass HSTS and use for AIA, CRL, and OCSP requests.

We were previously hitting an issue where AIA, CRL, and OCSP requests
were being upgraded to HTTPS, as the URLs were hosted by domains
that had HSTS applied. These requests should not ever be upgraded,
in order to avoid circular dependencies when verifying certificates.

We solve this by adding a new load_flag "should_bypass_hsts" which we
set to true whenever making AIA, CRL, or OCSP requests. We then check
for this flag when deciding whether or not to upgrade an HTTP request.


Added tests to ensure HSTS was bypassed even if a domain is set to
have HSTS and also tested round-tripping of setting load_flags in
a URL Request.

Bug: 1432246
Change-Id: I685298383c46c681a8f98c4852b2b4c3caa67304
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4863980
Reviewed-by: Brandon Maslen <brandm@microsoft.com>
Commit-Queue: Celeste Pan <celestepan@microsoft.com>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Matt Mueller <mattm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1211650}