Disable certificate patterns for device policy ONC files

chrome/browser/chromeos/cros/network_library.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/network_library.h"
 
 #include <dbus/dbus-glib.h>
 
 #include "base/i18n/icu_encoding_detection.h"
 #include "base/i18n/icu_string_conversions.h"
@@ skipping 711 matching lines @@
     SetOrClearStringProperty(flimflam::kL2tpIpsecClientCertSlotProperty,
                              slot, NULL);
     SetOrClearStringProperty(flimflam::kL2tpIpsecPinProperty, pin, NULL);
   }
 }
 
 void VirtualNetwork::MatchCertificatePattern(bool allow_enroll,
                                              const base::Closure& connect) {
   DCHECK(client_cert_type() == CLIENT_CERT_TYPE_PATTERN);
   DCHECK(!client_cert_pattern().Empty());
-  if (client_cert_pattern().Empty()) {
+
+  // We skip certificate patterns for device policy ONC so that an unmanaged
+  // user can't get to the place where a cert is presented for them
+  // involuntarily.
+  if (client_cert_pattern().Empty() ||
+      ui_data().onc_source() == NetworkUIData::ONC_SOURCE_DEVICE_POLICY) {

[Greg Spencer (Chromium), 2012/08/27 21:22:52]

I added this check in addition to the ONC file loading failure so that already
imported policies will not do this either.

     connect.Run();
     return;
   }
 
   scoped_refptr<net::X509Certificate> matching_cert =
       client_cert_pattern().GetMatch();
   if (matching_cert.get()) {
     std::string client_cert_id =
         x509_certificate_model::GetPkcs11Id(matching_cert->os_cert_handle());
     if (provider_type() == PROVIDER_TYPE_OPEN_VPN) {
       SetStringProperty(flimflam::kOpenVPNClientCertIdProperty,
                         client_cert_id, &client_cert_id_);
     } else {
       SetStringProperty(flimflam::kL2tpIpsecClientCertIdProperty,
                         client_cert_id, &client_cert_id_);
     }
   } else {
     if (allow_enroll && enrollment_delegate()) {
       // Wrap the closure in another callback so that we can retry the
       // certificate match again before actually connecting.
       base::Closure wrapped_connect =
           base::Bind(&VirtualNetwork::MatchCertificatePattern,
                      weak_pointer_factory_.GetWeakPtr(),
                      false,
                      connect);
 
-     enrollment_delegate()->Enroll(client_cert_pattern().enrollment_uri_list(),
-                                   wrapped_connect);
+      enrollment_delegate()->Enroll(client_cert_pattern().enrollment_uri_list(),
+                                    wrapped_connect);
       // Enrollment delegate will take care of running the closure at the
       // appropriate time, if the user doesn't cancel.
       return;
     }
   }
   connect.Run();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // WirelessNetwork
@@ skipping 567 matching lines @@
   NetworkLibrary* impl;
   if (stub)
     impl = new NetworkLibraryImplStub();
   else
     impl = new NetworkLibraryImplCros();
   impl->Init();
   return impl;
 }
 
 }  // namespace chromeos