Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/chromeos/cros/onc_network_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/onc_network_parser.h"
 
 #include <keyhi.h>
 #include <pk11pub.h>
 
 #include "base/base64.h"
@@ skipping 264 matching lines @@
 
 }  // namespace
 
 // -------------------- OncNetworkParser --------------------
 
 OncNetworkParser::OncNetworkParser(const std::string& onc_blob,
                                    const std::string& passphrase,
                                    NetworkUIData::ONCSource onc_source)
     : NetworkParser(get_onc_mapper()),
       onc_source_(onc_source),
+      allow_web_trust_from_policy_(false),
       network_configs_(NULL),
       certificates_(NULL) {
   VLOG(2) << __func__ << ": OncNetworkParser called on " << onc_blob;
   JSONStringValueSerializer deserializer(onc_blob);
   deserializer.set_allow_trailing_comma(true);
   scoped_ptr<base::Value> root(deserializer.Deserialize(NULL, &parse_error_));
 
   if (!root.get() || root->GetType() != base::Value::TYPE_DICTIONARY) {
     LOG(WARNING) << "OncNetworkParser received bad ONC file: " << parse_error_;
   } else {
@@ skipping 647 matching lines @@
   // have removed the existing cert above.
   net::CertificateList certs;
   ListCertsWithNickname(guid, &certs);
   if (!certs.empty()) {
     LOG(WARNING) << "Cert GUID is already in use: " << guid;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_GUID_COLLISION);
     return NULL;
   }
 
+  // Web trust is only granted to certificates imported for a managed user on
+  // a managed device.
+  if ((onc_source_ == NetworkUIData::ONC_SOURCE_DEVICE_POLICY ||

[Mattias Nissler (ping if slow), 2012/09/04 09:57:04]

only for onc_source_ == USER_POLICY

[Joao da Silva, 2012/09/04 12:52:55]

Done. For DEVICE_POLICY this is now bailing out without importing the
certificate.

+       onc_source_ == NetworkUIData::ONC_SOURCE_USER_POLICY) &&
+      web_trust && !allow_web_trust_from_policy_) {
+    LOG(WARNING) << "Web trust not granted for certificate with guid " << guid;
+    web_trust = false;
+  }
+
   net::CertificateList cert_list;
   cert_list.push_back(x509_cert);
   net::CertDatabase::ImportCertFailureList failures;
   bool success = false;
   net::CertDatabase::TrustBits trust = web_trust ?
                                        net::CertDatabase::TRUSTED_SSL :
                                        net::CertDatabase::TRUST_DEFAULT;
   if (cert_type == "Server") {
     success = cert_database.ImportServerCert(cert_list, trust, &failures);
   } else {  // Authority cert
@@ skipping 1049 matching lines @@
     // on the value of AuthenticationType.
     { "L2TP-IPsec", PROVIDER_TYPE_L2TP_IPSEC_PSK },
     { "OpenVPN", PROVIDER_TYPE_OPEN_VPN },
   };
   CR_DEFINE_STATIC_LOCAL(EnumMapper<ProviderType>, parser,
       (table, arraysize(table), PROVIDER_TYPE_MAX));
   return parser.Get(type);
 }
 
 }  // namespace chromeos