Add enterprise policy to exempt hosts from Certificate Transparency

net/http/transport_security_state.h

Index: net/http/transport_security_state.h
diff --git a/net/http/transport_security_state.h b/net/http/transport_security_state.h
index a76f235e43be6e8c5a08b821752cfa06b42cf04c..c29f8590c0d74980b5caeaf67e429d7281f02636 100644
--- a/net/http/transport_security_state.h
+++ b/net/http/transport_security_state.h
@@ -441,6 +441,11 @@ class NET_EXPORT TransportSecurityState
                              const HostPortPair& host_port_pair,
                              const SSLInfo& ssl_info);
 
+  // For unit tests only; causes ShouldRequireCT() to return |*required|
+  // by default (that is, unless a RequireCTDelegate overrides). Set to
+  // nullptr to reset.
+  static void SetShouldRequireCTForTesting(bool* required);

[battre, 2016/06/28 08:33:14]

Why don't you just take a boolean and either document that this defaults to
false or have a static void ResetShouldRequireCTForTesting();?

[Ryan Sleevi, 2016/06/28 16:41:27]

Because it won't default to false shortly (but a more complicated policy, per
the commit description), and the implementation of Set/Reset would have been as
complex (because it still has to deal with the tristate - yes, no, default)

[battre, 2016/06/29 09:14:43]

Acknowledged.

+
  private:
   friend class TransportSecurityStateTest;
   FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly);