Add --ignore-certificate-errors-spki-list switch and UMA histogram.

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/base64.h"
@@ skipping 1006 matching lines @@
         if (!quic_origin.IsEmpty())
           params->origins_to_force_quic_on.insert(quic_origin);
       }
     }
   }
 
   // Parameters only controlled by command line.
   if (command_line.HasSwitch(switches::kEnableUserAlternateProtocolPorts)) {
     params->enable_user_alternate_protocol_ports = true;
   }
+  if (command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList)) {
+    std::string spki_list = command_line.GetSwitchValueASCII(
+        switches::kIgnoreCertificateErrorsSPKIList);
+    for (const std::string& spki : base::SplitString(
+             spki_list, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) {
+      net::HashValue hash;
+      if (!hash.FromString("sha256/" + spki)) {
+        LOG(ERROR) << "Invalid SPKI in --ignore-certificate-errors-spki-list: "
+                   << spki;
+      } else {
+        net::SHA256HashValue hv;
+        DCHECK_EQ(hash.size(), sizeof(hv));
+        memcpy(&hv, hash.data(), sizeof(hv));
+        params->ignore_certificate_error_spki_set.insert(hv);
+      }
+    }
+  }

[Ryan Sleevi, 2017/03/30 15:12:09]

So a thought - if we didn't want to plumb the SPKI logic all the way down, and
force it into the override, we could simply create a wrapping CertVerifier
around 578-585 which would call in to the normal CertVerifier, and then either
bypass calling the OS verifier (for those certs in the bypass list) or mask off
the errors.

That is, I'm wondering whether something like

class IgnoreErrorsCertVerifier : public CertVerifier {
 public:
  IgnoreErrorsCertVerifier(scoped_ptr<CertVerifier> next_verifier,
                           HashValueVector certs);

  ...
};

Makes more sense?

The main difference with that is that by masking off the error at the
CertVerifier level, we potentially allow it to store entries to the disk cache
or to use H/2 pooling, which I don't think the current approach would allow.

The other thing is whether we should force user-data-dir to be present (e.g. see
https://cs.chromium.org/chromium/src/chrome/browser/chrome_content_browser_cl...
or
https://cs.chromium.org/chromium/src/chrome/common/secure_origin_whitelist.cc...)

[martinkr, 2017/03/30 17:33:38]

Yeah, I think it would also be easier to understand than the current override
logic (at least for me who's not terribly familiar with this code).
 
Good question. I lean towards yes because it doesn't seem to complicate things
when this switch is used in test automation but probably provides a meaningful
security benefit for human users. OTOH, there is nothing preventing you from
setting user-data-dir to  ~/.config/google-chrome/Default, is there? So if we're
worried about users whitelisting some SPKI because stackoverflow told them so
after they couldn't connect to a site, then this is probably not an additional
deterrent against that.

+  UMA_HISTOGRAM_BOOLEAN(
+      "Net.Certificate.kIgnoreCertificateErrorsSPKIList",
+      command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList));
   if (command_line.HasSwitch(switches::kIgnoreCertificateErrors)) {
     params->ignore_certificate_errors = true;
   }
   UMA_HISTOGRAM_BOOLEAN(
       "Net.Certificate.IgnoreErrors",
       command_line.HasSwitch(switches::kIgnoreCertificateErrors));
   if (command_line.HasSwitch(switches::kTestingFixedHttpPort)) {
     params->testing_fixed_http_port =
         GetSwitchValueAsInt(command_line, switches::kTestingFixedHttpPort);
   }
@@ skipping 75 matching lines @@
 
   // TODO(rtenneti): We should probably use HttpServerPropertiesManager for the
   // system URLRequestContext too. There's no reason this should be tied to a
   // profile.
   return context;
 }
 
 metrics::UpdateUsagePrefCallbackType IOThread::GetMetricsDataUseForwarder() {
   return base::Bind(&UpdateMetricsUsagePrefsOnUIThread);
 }