Add initial version of captive portal list checking.

chrome/browser/ssl/ssl_error_assistant.proto

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 syntax = "proto2";
 
 option optimize_for = LITE_RUNTIME;
 
 package chrome_browser_ssl;
 
 message CaptivePortalCert {
   // Sha256 hash of the certificate's public key. The fingerprint is prefixed
   // with "sha256/" and encoded in base64 (same format as
   // src/net/http/transport_security_state_static.pins)
   // Example: sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+  //
+  // NOTE: Only leaf certs must be added here.

[Ryan Sleevi, 2017/02/01 22:06:06]

When I read this outloud, it sounds weird, but it may be totally valid.

Alternative wordings might be

NOTE: Only leaf certificates are supported.
NOTE: Certificates other than leaf certificates are not supported.

Basically, I'm trying to parse the "must" here, to understand what happens if
that must is violated (e.g. does it crash or is it just not supported)

[meacer, 2017/02/02 01:56:05]

Technically intermediates and roots can also be added, and they will trigger a
captive portal interstitial. The warning was to discourage doing that, but since
it's also not an invalid thing to do not sure if unsupported is the right word
-- it seems possible to me that a captive portal vendor owns an intermediate and
that we decide to add it here?

   optional string sha256_hash = 1;
 }
 
 message SSLErrorAssistantConfig {
   optional uint32 version_id = 1;
   repeated CaptivePortalCert captive_portal_cert = 2;
 }