Add --ignore-certificate-errors-spki-list switch and UMA histogram.

net/cert/ignore_errors_cert_verifier.h

Index: net/cert/ignore_errors_cert_verifier.h
diff --git a/net/cert/ignore_errors_cert_verifier.h b/net/cert/ignore_errors_cert_verifier.h
new file mode 100644
index 0000000000000000000000000000000000000000..83bbc019b18b93e58307c7065ab60838c555e0a1
--- /dev/null
+++ b/net/cert/ignore_errors_cert_verifier.h
@@ -0,0 +1,52 @@
+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_
+#define NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_

[Ryan Sleevi, 2017/04/07 16:08:05]

Seems like this could be moved to chrome/browser/ssl , right?

Is there a reason for putting it in //net ?

[martinkr, 2017/04/07 21:40:57]

Ah yes, I wasn't super familiar with the code organization, but this makes
sense.

Done.

+
+#include <memory>
+
+#include "base/containers/flat_set.h"
+#include "net/cert/cert_verifier.h"
+
+namespace net {
+
+// IgnoreErrorsCertVerifier wraps another CertVerifier in order to ignore
+// verification errors from certificate chains that match a whitelist of SPKI
+// fingerprints.
+class NET_EXPORT IgnoreErrorsCertVerifier : public CertVerifier {
+ public:
+  // SPKIHashSet is a set of SHA-256 SPKI fingerprints (RFC 7469, Section 2.4).
+  using SPKIHashSet = base::flat_set<SHA256HashValue, SHA256HashValueLessThan>;
+
+  // MakeWhitelist converts a vector of Base64-encoded SHA-256 SPKI fingerprints
+  // into an SPKIHashSet. Invalid fingerprints are logged and skipped.
+  static SPKIHashSet MakeWhitelist(
+      const std::vector<std::string>& fingerprints);
+
+  IgnoreErrorsCertVerifier(std::unique_ptr<CertVerifier> verifier,
+                           SPKIHashSet whitelist);
+
+  ~IgnoreErrorsCertVerifier() override;
+
+  // Verify invokes Verify() on the wrapped CertVerifier. If any of the
+  // certificates from the chain in |params| match one of the SPKI fingerprints
+  // from the whitelist, it returns OK regardless of the actual verification
+  // result (or ERR_IO_PENDING on asynchronous completion). Otherwise the actual
+  // result is returned.
+  int Verify(const RequestParams& params,
+             CRLSet* crl_set,
+             CertVerifyResult* verify_result,
+             const CompletionCallback& callback,
+             std::unique_ptr<Request>* out_req,
+             const NetLogWithSource& net_log) override;
+
+ private:
+  std::unique_ptr<CertVerifier> verifier_;
+  SPKIHashSet whitelist_;
+};
+
+}  // namespace net
+
+#endif  // NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_