Add a preference for enabling the TLS origin-bound certificates extension.

chrome/browser/net/ssl_config_service_manager_pref.cc

Index: chrome/browser/net/ssl_config_service_manager_pref.cc
===================================================================
--- chrome/browser/net/ssl_config_service_manager_pref.cc	(revision 112382)
+++ chrome/browser/net/ssl_config_service_manager_pref.cc	(working copy)
@@ -140,6 +140,7 @@
   BooleanPrefMember rev_checking_enabled_;
   BooleanPrefMember ssl3_enabled_;
   BooleanPrefMember tls1_enabled_;
+  BooleanPrefMember origin_bound_certs_enabled_;
 
   // The cached list of disabled SSL cipher suites.
   std::vector<uint16> disabled_cipher_suites_;
@@ -158,6 +159,8 @@
                              local_state, this);
   ssl3_enabled_.Init(prefs::kSSL3Enabled, local_state, this);
   tls1_enabled_.Init(prefs::kTLS1Enabled, local_state, this);
+  origin_bound_certs_enabled_.Init(prefs::kEnableOriginBoundCerts,
+                                   local_state, this);
   pref_change_registrar_.Init(local_state);
   pref_change_registrar_.Add(prefs::kCipherSuiteBlacklist, this);
 
@@ -176,6 +179,8 @@
                              default_config.ssl3_enabled);
   prefs->RegisterBooleanPref(prefs::kTLS1Enabled,
                              default_config.tls1_enabled);
+  prefs->RegisterBooleanPref(prefs::kEnableOriginBoundCerts,
+                             default_config.origin_bound_certs_enabled);
   prefs->RegisterListPref(prefs::kCipherSuiteBlacklist);
   // The Options menu used to allow changing the ssl.ssl3.enabled and
   // ssl.tls1.enabled preferences, so some users' Local State may have
@@ -221,6 +226,7 @@
   config->ssl3_enabled = ssl3_enabled_.GetValue();
   config->tls1_enabled = tls1_enabled_.GetValue();
   config->disabled_cipher_suites = disabled_cipher_suites_;
+  config->origin_bound_certs_enabled = origin_bound_certs_enabled_.GetValue();

[Mattias Nissler (ping if slow), 2011/12/02 12:40:08]

This is also invoked on PREF_CHANGED notifications. If the SetSSLConfigFlags
call below activates the new configuration, you can set the dynamic_refresh flag
in the policy template. To test whether it works, you can write the policy file
in Linux, wait 5 seconds, and watch the PREF_CHANGED event to fire and call this
function.

[wtc, 2011/12/02 18:31:54]

The SetSSLConfigFlags call below does not activate the new
configuration, but the SetNewSSLConfig task posted on line
217 above does.  So I changed the dynamic_refresh flag in
the policy template to 1.

   SSLConfigServicePref::SetSSLConfigFlags(config);
 }