Enable public key pinning of local trust anchors

net/http/transport_security_state.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 346 matching lines @@
   // Adds explicitly-specified data as if it was processed from an HPKP header.
   // Note: This method will persist the HPKP if a Delegate is present. Make sure
   //       that the delegate is nullptr if the persistence is not desired.
   //       See |SetDelegate| method for more details.
   void AddHPKP(const std::string& host,
                const base::Time& expiry,
                bool include_subdomains,
                const HashValueVector& hashes,
                const GURL& report_uri);
 
+  // Enables pinning of local trust anchors. This method is used by Cronet only
+  // and *** MUST NOT *** be used by any other consumer. For more information
+  // see "How does key pinning interact with local proxies and filters?" at
+  // https://www.chromium.org/Home/chromium-security/security-faq

[Ryan Sleevi, 2016/06/21 00:52:26]

This should get a second-pass over with the overall naming.

[kapishnikov, 2016/06/29 23:04:32]

Done.

+  void SetEnableHPKPForLocalTrustAnchors(bool value);
+
   // Parses |value| as a Public-Key-Pins-Report-Only header value and
   // sends a HPKP report for |host_port_pair| if |ssl_info| violates the
   // pin. Returns true if |value| parses and includes a valid
   // report-uri, and false otherwise.
   bool ProcessHPKPReportOnlyHeader(const std::string& value,
                                    const HostPortPair& host_port_pair,
                                    const SSLInfo& ssl_info);
 
   // Parses |value| as a Expect CT header value and sends an Expect CT
   // report for |host_port_pair| if the following conditions are true:
@@ skipping 109 matching lines @@
 
   // True if static pins should be used.
   bool enable_static_pins_;
 
   // True if static expect-CT state should be used.
   bool enable_static_expect_ct_;
 
   // True if static expect-staple state should be used.
   bool enable_static_expect_staple_;
 
+  // True if pinning of local trust anchors is enabled
+  bool enable_hpkp_for_local_trust_anchors_;
+
   ExpectCTReporter* expect_ct_reporter_;
 
   // Keeps track of reports that have been sent recently for
   // rate-limiting.
   ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>>
       sent_reports_cache_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_TRANSPORT_SECURITY_STATE_H_