Add static domain security state generator tool.

net/tools/domain_security_preload_generator/cert_util.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_TOOLS_DOMAIN_SECURITY_PRELOAD_GENERATOR_CERT_UTIL_H_
+#define NET_TOOLS_DOMAIN_SECURITY_PRELOAD_GENERATOR_CERT_UTIL_H_
+
+#include <stdint.h>
+
+#include "base/strings/string_piece.h"
+
+namespace net {
+class SPKIHash;
+}  // namespace net
+
+// Extracts the SubjectPublicKeyInfo from the PEM encoded certificate and copies
+// the SHA256 digest to |out_hash|. Returns true on success and false on
+// failure.
+bool CalculateSPKIHashFromCertificate(base::StringPiece pem_certificate,
+                                      net::SPKIHash* out_hash);
+
+// Calculates the SHA256 of the SubjectPublicKeyInfo in the PEM encoded
+// |pem_key| and copies the digest to |out_hash|. Returns true on success and

[agl, 2016/12/06 18:51:35]

I think this should be clearer that the contents of the PEM block are expected
to be exactly an SPKI, since there are many forms of PEM-encoded public-key.

// Decodes a PEM block from |pem_key| and sets |*out_hash| to the SHA256 hash of
the contents.

[martijnc, 2016/12/07 22:37:53]

Clarified.

+// false on failure.
+bool CalculateSPKIHashFromKey(base::StringPiece pem_key,
+                              net::SPKIHash* out_hash);
+
+// Initializes BoringSSL.
+void InitializeCryptoLibrary();

[agl, 2016/12/06 18:51:35]

Use src/crypto/openssl_util.h:EnsureOpenSSLInit rather than this.

[martijnc, 2016/12/07 22:37:53]

Removed and updated domain_security_preload_generator.cc to call
crypto::EnsureOpenSSLInit().

+
+#endif  // NET_TOOLS_DOMAIN_SECURITY_PRELOAD_GENERATOR_CERT_UTIL_H_