Enable public key pinning of local trust anchors

net/http/transport_security_state.cc

Index: net/http/transport_security_state.cc
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
index 16217a0c022e9f2149c698e9b45e9b1e1b6ed9ec..1dad2c7e5027d74dd20fdc0a2326a10804431f13 100644
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -618,6 +618,7 @@ TransportSecurityState::TransportSecurityState()
       enable_static_pins_(true),
       enable_static_expect_ct_(true),
       enable_static_expect_staple_(false),
+      enable_local_trust_anchor_pinning_(false),
       expect_ct_reporter_(nullptr),
       sent_reports_cache_(kMaxHPKPReportCacheEntries) {
 // Static pinning is only enabled for official builds to make sure that
@@ -664,12 +665,17 @@ bool TransportSecurityState::CheckPublicKeyPins(
     const X509Certificate* validated_certificate_chain,
     const PublicKeyPinReportStatus report_status,
     std::string* pinning_failure_log) {
-  // Perform pin validation if, and only if, all these conditions obtain:
+  // Perform pin validation if, and only if:
   //
-  // * the server's certificate chain chains up to a known root (i.e. not a
-  //   user-installed trust anchor); and
-  // * the server actually has public key pins.
-  if (!is_issued_by_known_root || !HasPublicKeyPins(host_port_pair.host())) {
+  // 1.   the server actually has public key pins; and one of the following
+  //      conditions is met:
+  // 2.1. the server's certificate chain chains up to a known root (i.e. not a
+  //      user-installed trust anchor).
+  // 2.2  the server's certificate chain chains up to user-installed trust
+  //      anchor and local trust pinning is enabled.
+  //
+  if ((!is_issued_by_known_root && !enable_local_trust_anchor_pinning_) ||
+      !HasPublicKeyPins(host_port_pair.host())) {
     return true;
   }
 
@@ -754,6 +760,10 @@ void TransportSecurityState::AddHPKPInternal(const std::string& host,
   EnablePKPHost(host, pkp_state);
 }
 
+void TransportSecurityState::EnableLocalTrustAnchorPinning(bool value) {
+  enable_local_trust_anchor_pinning_ = value;
+}
+
 void TransportSecurityState::EnableSTSHost(const std::string& host,
                                            const STSState& state) {
   DCHECK(CalledOnValidThread());
@@ -1058,7 +1068,7 @@ bool TransportSecurityState::ProcessHPKPReportOnlyHeader(
   pkp_state.domain = DNSDomainToString(CanonicalizeHost(host_port_pair.host()));
 
   // Only perform pin validation if the cert chains up to a known root.
-  if (!ssl_info.is_issued_by_known_root)
+  if (!ssl_info.is_issued_by_known_root && !enable_local_trust_anchor_pinning_)
     return true;
 
   CheckPinsAndMaybeSendReport(