Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/chromeos/cros/onc_network_parser.cc

Index: chrome/browser/chromeos/cros/onc_network_parser.cc
diff --git a/chrome/browser/chromeos/cros/onc_network_parser.cc b/chrome/browser/chromeos/cros/onc_network_parser.cc
index 8814d0cb3d1dddf57500882a572486c78d74a33e..9986ddf7a4cc0375416ee0f7050b70fcf8ec6904 100644
--- a/chrome/browser/chromeos/cros/onc_network_parser.cc
+++ b/chrome/browser/chromeos/cros/onc_network_parser.cc
@@ -282,6 +282,7 @@ OncNetworkParser::OncNetworkParser(const std::string& onc_blob,
                                    NetworkUIData::ONCSource onc_source)
     : NetworkParser(get_onc_mapper()),
       onc_source_(onc_source),
+      allow_web_trust_from_policy_(false),
       network_configs_(NULL),
       certificates_(NULL) {
   VLOG(2) << __func__ << ": OncNetworkParser called on " << onc_blob;
@@ -329,6 +330,10 @@ const EnumMapper<PropertyIndex>* OncNetworkParser::property_mapper() {
   return get_onc_mapper();
 }
 
+void OncNetworkParser::AllowWebTrustFromPolicy() {

[Mattias Nissler (ping if slow), 2012/08/28 11:57:56]

Make this a regular setter? When I read the declaration, I wasn't sure what it
would do, just setting a flag or actually attempting to set the web trust?

[Joao da Silva, 2012/09/03 15:24:32]

Turned into a setter.

+  allow_web_trust_from_policy_ = true;
+}
+
 base::DictionaryValue* OncNetworkParser::Decrypt(
     const std::string& passphrase,
     base::DictionaryValue* root) {
@@ -850,6 +855,16 @@ OncNetworkParser::ParseServerOrCaCertificate(
     }
   }
 
+  if (web_trust &&
+      (onc_source_ == NetworkUIData::ONC_SOURCE_DEVICE_POLICY ||
+       onc_source_ == NetworkUIData::ONC_SOURCE_USER_POLICY) &&
+      !allow_web_trust_from_policy_) {
+    LOG(WARNING) << "Web trust not granted";
+    parse_error_ = l10n_util::GetStringUTF8(
+        IDS_NETWORK_CONFIG_ERROR_WEB_TRUST_NOT_ALLOWED);
+    return NULL;

[Mattias Nissler (ping if slow), 2012/08/28 11:57:56]

I don't think this is a good idea, as it'll abort the certificate import process
(correct me if I'm wrong). That means that you'll essentially break ONC
configuration that specifies this on non-enrolled (and foreign) devices. I guess
the only chance we have here is to not set the web trust bit and silently bail
out.

[Joao da Silva, 2012/09/03 15:24:32]

You're right, thanks! This is now dropping the web trust bit only.

+  }
+
   std::string x509_data;
   if (!certificate->GetString("X509", &x509_data) || x509_data.empty()) {
     LOG(WARNING) << "ONC File: certificate missing appropriate "