Enable public key pinning of local trust anchors

net/http/transport_security_state.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 403 matching lines @@
   // Adds explicitly-specified data as if it was processed from an HPKP header.
   // Note: This method will persist the HPKP if a Delegate is present. Make sure
   //       that the delegate is nullptr if the persistence is not desired.
   //       See |SetDelegate| method for more details.
   void AddHPKP(const std::string& host,
                const base::Time& expiry,
                bool include_subdomains,
                const HashValueVector& hashes,
                const GURL& report_uri);
 
+  // Enables or disables public key pinning bypass for local trust anchors.
+  // Disabling the bypass for local trust anchors is highly discouraged.
+  // This method is used by Cronet only and *** MUST NOT *** be used by any
+  // other consumer. For more information see "How does key pinning interact
+  // with local proxies and filters?" at
+  // https://www.chromium.org/Home/chromium-security/security-faq
+  void SetEnablePublicKeyPinningBypassForLocalTrustAnchors(bool value);
+
   // Parses |value| as a Public-Key-Pins-Report-Only header value and
   // sends a HPKP report for |host_port_pair| if |ssl_info| violates the
   // pin. Returns true if |value| parses and includes a valid
   // report-uri, and false otherwise.
   bool ProcessHPKPReportOnlyHeader(const std::string& value,
                                    const HostPortPair& host_port_pair,
                                    const SSLInfo& ssl_info);
 
   // Parses |value| as a Expect CT header value and sends an Expect CT
   // report for |host_port_pair| if the following conditions are true:
@@ skipping 116 matching lines @@
 
   // True if static pins should be used.
   bool enable_static_pins_;
 
   // True if static expect-CT state should be used.
   bool enable_static_expect_ct_;
 
   // True if static expect-staple state should be used.
   bool enable_static_expect_staple_;
 
+  // True if public key pinning bypass is enabled for local trust anchors.
+  bool enable_pkp_bypass_for_local_trust_anchors_;
+
   ExpectCTReporter* expect_ct_reporter_ = nullptr;
 
   RequireCTDelegate* require_ct_delegate_ = nullptr;
 
   // Keeps track of reports that have been sent recently for
   // rate-limiting.
   ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>>
       sent_reports_cache_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_TRANSPORT_SECURITY_STATE_H_