Disable certificate patterns for device policy ONC files

chrome/browser/chromeos/cros/onc_network_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/onc_network_parser.h"
 
 #include <keyhi.h>
 #include <pk11pub.h>
 
 #include "base/base64.h"
@@ skipping 1361 matching lines @@
   // net::ProxyServer for the specific scheme.
   net::HostPortPair host_port(host, static_cast<uint16>(port));
   return net::ProxyServer(scheme, host_port);
 }
 
 // static
 bool OncNetworkParser::ParseClientCertPattern(OncNetworkParser* parser,
                                               PropertyIndex index,
                                               const base::Value& value,
                                               Network* network) {
+  // Ignore certificate patterns for device policy ONC so that an unmanaged user
+  // won't have a certificate presented for them involuntarily.
+  if (parser->onc_source() == NetworkUIData::ONC_SOURCE_DEVICE_POLICY)
+    return false;
+
   // Only WiFi and VPN have this type.
   if (network->type() != TYPE_WIFI &&
       network->type() != TYPE_VPN) {
     LOG(WARNING) << "Tried to parse a ClientCertPattern from something "
                  << "that wasn't a WiFi or VPN network.";
     return false;
   }
 
+
   switch (index) {
     case PROPERTY_INDEX_ONC_CERTIFICATE_PATTERN_ENROLLMENT_URI: {
       std::vector<std::string> resulting_list;
       if (!GetAsListOfStrings(value, &resulting_list))
         return false;
       CertificatePattern pattern = network->client_cert_pattern();
       pattern.set_enrollment_uri_list(resulting_list);
       network->set_client_cert_pattern(pattern);
       return true;
     }
@@ skipping 624 matching lines @@
     // on the value of AuthenticationType.
     { "L2TP-IPsec", PROVIDER_TYPE_L2TP_IPSEC_PSK },
     { "OpenVPN", PROVIDER_TYPE_OPEN_VPN },
   };
   CR_DEFINE_STATIC_LOCAL(EnumMapper<ProviderType>, parser,
       (table, arraysize(table), PROVIDER_TYPE_MAX));
   return parser.Get(type);
 }
 
 }  // namespace chromeos