Add --ignore-certificate-errors-spki-list switch and UMA histogram.

net/cert/x509_certificate_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <cryptohi.h>
 #include <keyhi.h>
 #include <nss.h>
 #include <pk11pub.h>
 #include <prtime.h>
@@ skipping 200 matching lines @@
   }
   unsigned int result_len;
   HASH_End(sha256_ctx, sha256.data, &result_len,
            HASH_ResultLenContext(sha256_ctx));
   HASH_Destroy(sha256_ctx);
 
   return sha256;
 }
 
 // static
+SHA256HashValue X509Certificate::CalculatePublicKeyHashSHA256(
+    OSCertHandle cert) {
+  SHA256HashValue sha256;
+  memset(sha256.data, 0, sizeof(sha256.data));
+
+  DCHECK(NULL != cert->derPublicKey.data);
+  DCHECK_NE(0U, cert->derPublicKey.len);
+  SECStatus rv = HASH_HashBuf(HASH_AlgSHA256, sha256.data,
+                              cert->derPublicKey.data, cert->derPublicKey.len);
+  DCHECK_EQ(rv, SECSuccess);
+
+  return sha256;
+}
+
+// static
 X509Certificate::OSCertHandle X509Certificate::ReadOSCertHandleFromPickle(
     base::PickleIterator* pickle_iter) {
   return x509_util::ReadOSCertHandleFromPickle(pickle_iter);
 }
 
 // static
 bool X509Certificate::WriteOSCertHandleToPickle(OSCertHandle cert_handle,
                                                 base::Pickle* pickle) {
   return pickle->WriteData(
       reinterpret_cast<const char*>(cert_handle->derCert.data),
@@ skipping 14 matching lines @@
     return false;
   if (SECSuccess != CERT_VerifySignedDataWithPublicKey(
                         &cert_handle->signatureWrap, public_key.get(), NULL)) {
     return false;
   }
   return CERT_CompareName(&cert_handle->subject, &cert_handle->issuer) ==
          SECEqual;
 }
 
 }  // namespace net