Fix imported server certs being distrusted in NSS 3.13.

chrome/browser/chromeos/cros/onc_network_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/onc_network_parser.h"
 
 #include <keyhi.h>
 #include <pk11pub.h>
 
 #include "base/base64.h"
@@ skipping 810 matching lines @@
   if (certificate->GetList("Trust", &trust_list)) {
     for (size_t i = 0; i < trust_list->GetSize(); ++i) {
       std::string trust_type;
       if (!trust_list->GetString(i, &trust_type)) {
         LOG(WARNING) << "ONC File: certificate trust is invalid at index "
                      << cert_index;
         parse_error_ = l10n_util::GetStringUTF8(
             IDS_NETWORK_CONFIG_ERROR_CERT_TRUST_INVALID);
         return NULL;
       }
       if (trust_type == "Web") {

[wtc, 2012/05/22 00:28:39]

It may be a good idea to copy what "Web" trust means
from the PDF file you cited: "Web" implies that the
certificate is to be trusted for HTTPS SSL identification.

[mattm, 2012/05/26 03:41:35]

Done.

         web_trust = true;
       } else {
         LOG(WARNING) << "ONC File: certificate contains unknown "
                      << "trust type: " << trust_type
                      << " at index " << cert_index;
         parse_error_ = l10n_util::GetStringUTF8(
             IDS_NETWORK_CONFIG_ERROR_CERT_TRUST_UNKNOWN);
         return NULL;
       }
     }
@@ skipping 80 matching lines @@
     LOG(WARNING) << "Cert GUID is already in use: " << guid;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_GUID_COLLISION);
     return NULL;
   }
 
   net::CertificateList cert_list;
   cert_list.push_back(x509_cert);
   net::CertDatabase::ImportCertFailureList failures;
   bool success = false;
+  net::CertDatabase::TrustBits trust = web_trust ?
+                                       net::CertDatabase::TRUSTED_SSL :
+                                       net::CertDatabase::TRUST_DEFAULT;
   if (cert_type == "Server") {
-    success = cert_database.ImportServerCert(cert_list, &failures);
+    success = cert_database.ImportServerCert(cert_list, trust, &failures);
   } else {  // Authority cert
-    net::CertDatabase::TrustBits trust = web_trust ?
-                                         net::CertDatabase::TRUSTED_SSL :
-                                         net::CertDatabase::UNTRUSTED;
     success = cert_database.ImportCACerts(cert_list, trust, &failures);
   }
   if (!failures.empty()) {
     LOG(WARNING) << "ONC File: Error ("
                  << net::ErrorToString(failures[0].net_error)
                  << ") importing " << cert_type << " certificate at index "
                  << cert_index;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_IMPORT);
     return NULL;
@@ skipping 1039 matching lines @@
     // on the value of AuthenticationType.
     { "L2TP-IPsec", PROVIDER_TYPE_L2TP_IPSEC_PSK },
     { "OpenVPN", PROVIDER_TYPE_OPEN_VPN },
   };
   CR_DEFINE_STATIC_LOCAL(EnumMapper<ProviderType>, parser,
       (table, arraysize(table), PROVIDER_TYPE_MAX));
   return parser.Get(type);
 }
 
 }  // namespace chromeos