Expose when PKP is bypassed in SSLInfo.

net/cert/cert_verify_result.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CERT_VERIFY_RESULT_H_
 #define NET_CERT_CERT_VERIFY_RESULT_H_
 
 #include <vector>
 
 #include "base/memory/ref_counted.h"
@@ skipping 51 matching lines @@
   // meaningless if the certificate was not trusted.
   bool is_issued_by_known_root;
 
   // is_issued_by_additional_trust_anchor is true if the root CA used for this
   // verification came from the list of additional trust anchors.
   bool is_issued_by_additional_trust_anchor;
 
   // True if a fallback to the common name was used when matching the host
   // name, rather than using the subjectAltName.
   bool common_name_fallback_used;
+
+  // True if PKP was bypassed for this certificate.
+  bool pkp_bypassed;

[Ryan Sleevi, 2016/06/09 19:17:32]

I believe this is a layering violation - the CertVerifier does not know about
PKP at present.

[estark, 2016/06/09 19:26:41]

That's only sort of true. The CertVerifier carries a CertStatus which knows
about PKP (CERT_STATUS_PINNED_KEY_MISSING). It sounds like we need to get rid of
that flag somehow.

 };
 
 }  // namespace net
 
 #endif  // NET_CERT_CERT_VERIFY_RESULT_H_