Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/chromeos/cros/onc_network_parser.cc

Index: chrome/browser/chromeos/cros/onc_network_parser.cc
diff --git a/chrome/browser/chromeos/cros/onc_network_parser.cc b/chrome/browser/chromeos/cros/onc_network_parser.cc
index 8814d0cb3d1dddf57500882a572486c78d74a33e..fccef229e7d40dca92c3a973c05d0e7412305da4 100644
--- a/chrome/browser/chromeos/cros/onc_network_parser.cc
+++ b/chrome/browser/chromeos/cros/onc_network_parser.cc
@@ -282,6 +282,7 @@ OncNetworkParser::OncNetworkParser(const std::string& onc_blob,
                                    NetworkUIData::ONCSource onc_source)
     : NetworkParser(get_onc_mapper()),
       onc_source_(onc_source),
+      allow_web_trust_from_policy_(false),
       network_configs_(NULL),
       certificates_(NULL) {
   VLOG(2) << __func__ << ": OncNetworkParser called on " << onc_blob;
@@ -949,6 +950,15 @@ OncNetworkParser::ParseServerOrCaCertificate(
     return NULL;
   }
 
+  // Web trust is only granted to certificates imported for a managed user on
+  // a managed device.
+  if ((onc_source_ == NetworkUIData::ONC_SOURCE_DEVICE_POLICY ||

[Mattias Nissler (ping if slow), 2012/09/04 09:57:04]

only for onc_source_ == USER_POLICY

[Joao da Silva, 2012/09/04 12:52:55]

Done. For DEVICE_POLICY this is now bailing out without importing the
certificate.

+       onc_source_ == NetworkUIData::ONC_SOURCE_USER_POLICY) &&
+      web_trust && !allow_web_trust_from_policy_) {
+    LOG(WARNING) << "Web trust not granted for certificate with guid " << guid;
+    web_trust = false;
+  }
+
   net::CertificateList cert_list;
   cert_list.push_back(x509_cert);
   net::CertDatabase::ImportCertFailureList failures;