Add Enterprise Policy for whitelisting hosts as exempt from CT

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 75582b6d87d6160d1c404b05780bd10a52548596..0b3d8e3400c4f9423616d7a5a78e40b55a5a0f52 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -137,7 +137,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 333
+#   For your editing convenience: highest ID currently used: 334
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -7918,6 +7918,34 @@
       Otherwise, if compatibility with a buggy server must be maintained, this policy may be set to "tls1.1". This is a stopgap measure and the server should be rapidly fixed.''',
     },
     {
+      'name': 'CertificateTransparencyEnforcementDisabledForUrls',
+      'type': 'list',
+      'schema': {
+        'type': 'array',
+        'items': { 'type': 'string' },
+      },
+      'supported_on': [
+        'chrome.*:53-',
+        'chrome_os:53-',
+        'android:53-',
+      ],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': False,
+      },
+      'example_value': ['example.com', '[.*].example.com'],
+      'id': 334,
+      'caption': '''Disable Certificate Transparency enforcement for a list of URLs''',
+      'tags': ['system-security'],
+      'desc': '''Disables enforcing Certificate Transparency requirements to the listed URLs.
+
+      This policy allows certificates for the hostnames in the specified URLs to not be disclosed via Certificate Transparency. This allows certificates that would otherwise be untrusted, because they were not properly publicly disclosed, to continue to be used, but makes it harder to detect misissued certificates for those hosts.

[Andrew T Wilson (Slow), 2016/06/21 08:37:48]

This is fine, but I'm curious why we need this policy - do we still require
certificate transparency even for policies in the local trust root? Couldn't
enterprises who don't want their server certificates exposed via CT just put
them in the local trust root on their managed devices?

[Ryan Sleevi, 2016/06/21 17:01:01]

That's our preferred/recommended path.

However, it's claimed that for interoperability between their managed devices
and their unmanaged devices (e.g. needing to use VOIP phones that talk to the
same server as users, or server-to-server communications to API endpoints on the
same things that clients are interfacing with), they need to have a period where
they're still using a publicly-trusted certificate subject to this policy, but
want Chrome to be exempt.

+
+      A URL pattern is formatted according to https://www.chromium.org/administrators/url-blacklist-filter-format, but because certificates are valid for any port and path on the server, only the hostname will be considered.

[Thiemo Nagel, 2016/06/21 10:54:06]

I think it's fair to re-use the blacklist filter format, however please specify
how the scheme part is treated, e.g. if someone sets "http://example.com" (note
the missing "s").  I assume the intention is to ignore the scheme as well?  This
might not work out for all schemes, though, iirc the parsing of some schemes may
yield surprises (eg. "file://example.com/").  Thus maybe it would be best to
explicitly require no scheme or https in the docs.

[Ryan Sleevi, 2016/06/21 17:01:01]

Correct - everything but the hostname is ignored. Scheme, port, path, and
authority - ignored.

+
+      If this policy is not set, any certificate that is required to be disclosed via Certificate Transparency will be treated as untrusted if it is not disclosed.''',
+    },
+    {
       'name': 'RC4Enabled',
       'type': 'main',
       'schema': {