Add --ignore-certificate-errors-spki-list switch and UMA histogram.

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/base64.h"
@@ skipping 21 matching lines @@
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/data_usage/tab_id_annotator.h"
 #include "chrome/browser/data_use_measurement/chrome_data_use_ascriber.h"
 #include "chrome/browser/net/async_dns_field_trial.h"
 #include "chrome/browser/net/chrome_network_delegate.h"
 #include "chrome/browser/net/dns_probe_service.h"
 #include "chrome/browser/net/proxy_service_factory.h"
 #include "chrome/browser/net/sth_distributor_provider.h"
+#include "chrome/browser/ssl/ignore_errors_cert_verifier.h"
 #include "chrome/common/channel_info.h"
 #include "chrome/common/chrome_content_client.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "components/certificate_transparency/tree_state_tracker.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_prefs.h"
 #include "components/data_usage/core/data_use_aggregator.h"
 #include "components/data_usage/core/data_use_amortizer.h"
 #include "components/data_usage/core/data_use_annotator.h"
 #include "components/data_use_measurement/core/data_use_ascriber.h"
@@ skipping 522 matching lines @@
       std::move(external_estimate_provider), network_quality_estimator_params,
       net_log_));
 
   UpdateDnsClientEnabled();
 #if defined(OS_CHROMEOS)
   // Creates a CertVerifyProc that doesn't allow any profile-provided certs.
   globals_->cert_verifier = base::MakeUnique<net::CachingCertVerifier>(
       base::MakeUnique<net::MultiThreadedCertVerifier>(
           new chromeos::CertVerifyProcChromeOS()));
 #else
-  globals_->cert_verifier = net::CertVerifier::CreateDefault();
+  if (command_line.HasSwitch(switches::kUserDataDir) &&
+      command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList)) {
+    auto spki_list =
+        base::SplitString(command_line.GetSwitchValueASCII(
+                              switches::kIgnoreCertificateErrorsSPKIList),
+                          ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
+    globals_->cert_verifier = base::MakeUnique<IgnoreErrorsCertVerifier>(
+        net::CertVerifier::CreateDefault(),
+        IgnoreErrorsCertVerifier::MakeWhitelist(spki_list));
+  } else {
+    globals_->cert_verifier = net::CertVerifier::CreateDefault();
+  }
+  UMA_HISTOGRAM_BOOLEAN(
+      "Net.Certificate.kIgnoreCertificateErrorsSPKIList",
+      command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList));
 #endif
 
   globals_->transport_security_state.reset(new net::TransportSecurityState());
 
   std::vector<scoped_refptr<const net::CTLogVerifier>> ct_logs(
       net::ct::CreateLogVerifiersForKnownLogs());
 
   globals_->ct_logs.assign(ct_logs.begin(), ct_logs.end());
 
   net::MultiLogCTVerifier* ct_verifier = new net::MultiLogCTVerifier();
@@ skipping 517 matching lines @@
 
   // TODO(rtenneti): We should probably use HttpServerPropertiesManager for the
   // system URLRequestContext too. There's no reason this should be tied to a
   // profile.
   return context;
 }
 
 metrics::UpdateUsagePrefCallbackType IOThread::GetMetricsDataUseForwarder() {
   return base::Bind(&UpdateMetricsUsagePrefsOnUIThread);
 }