Enable public key pinning of local trust anchors

net/http/transport_security_state.cc

Index: net/http/transport_security_state.cc
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
index 34039cecb05775f0e2ee3c57c6925ffdc80b5736..13676bca7f85b58076a54f6e0e9d7289ff0d2b0a 100644
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -616,6 +616,7 @@ TransportSecurityState::TransportSecurityState()
     : enable_static_pins_(true),
       enable_static_expect_ct_(true),
       enable_static_expect_staple_(false),
+      enable_pkp_bypass_for_local_trust_anchors_(true),
       sent_reports_cache_(kMaxHPKPReportCacheEntries) {
 // Static pinning is only enabled for official builds to make sure that
 // others don't end up with pins that cannot be easily updated.
@@ -774,6 +775,11 @@ void TransportSecurityState::AddHPKPInternal(const std::string& host,
   EnablePKPHost(host, pkp_state);
 }
 
+void TransportSecurityState::
+    SetEnablePublicKeyPinningBypassForLocalTrustAnchors(bool value) {
+  enable_pkp_bypass_for_local_trust_anchors_ = value;
+}
+
 void TransportSecurityState::EnableSTSHost(const std::string& host,
                                            const STSState& state) {
   DCHECK(CalledOnValidThread());
@@ -838,8 +844,12 @@ TransportSecurityState::CheckPinsAndMaybeSendReport(
     return PKPStatus::OK;
 
   // Don't report violations for certificates that chain to local roots.
-  if (!is_issued_by_known_root)
-    return PKPStatus::BYPASSED;
+  if (!is_issued_by_known_root) {
+    if (enable_pkp_bypass_for_local_trust_anchors_)
+      return PKPStatus::BYPASSED;
+    else
+      return PKPStatus::VIOLATED;
+  }

[Ryan Sleevi, 2016/07/01 01:17:24]

I would argue the right thing to do, from an API consistency perspective, is

if (!is_issued_by_known_root && enable_pkp_bypass_for_local_trust_anchors_)
  return PKPStatus::BYPASSED;

That seems to fit with the API contract more

[kapishnikov, 2016/07/01 17:20:54]

Agreed. Done.

 
   if (!report_sender_ ||
       report_status != TransportSecurityState::ENABLE_PIN_REPORTS ||