Rejecting networks/certificates independently on ONC import and policy loading.

chromeos/network/onc/onc_certificate_importer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_certificate_importer.h"
 
 #include <cert.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 
@@ skipping 25 matching lines @@
 
 CertificateImporter::CertificateImporter(
     ONCSource onc_source,
     bool allow_web_trust_from_policy)
     : onc_source_(onc_source),
       allow_web_trust_from_policy_(allow_web_trust_from_policy) {
 }
 
 CertificateImporter::ParseResult CertificateImporter::ParseAndStoreCertificates(
     const base::ListValue& certificates) {
+  size_t successful_imports = 0;
   for (size_t i = 0; i < certificates.GetSize(); ++i) {
     const base::DictionaryValue* certificate = NULL;
     if (!certificates.GetDictionary(i, &certificate)) {
       ONC_LOG_ERROR("Certificate data malformed");
-      return i > 0 ? IMPORT_INCOMPLETE : IMPORT_FAILED;
+      continue;
     }
 
-    if (VLOG_IS_ON(2))
-      VLOG(2) << "Parsing certificate at index " << i << ": " << *certificate;
+    VLOG(2) << "Parsing certificate at index " << i << ": " << *certificate;
 
     if (!ParseAndStoreCertificate(*certificate)) {
       ONC_LOG_ERROR(
           base::StringPrintf("Cannot parse certificate at index %zu", i));
-      return i > 0 ? IMPORT_INCOMPLETE : IMPORT_FAILED;
+    } else {
+      VLOG(2) << "Successfully imported certificate at index " << i;
+      ++successful_imports;
     }
+  }
 
-    VLOG(2) << "Successfully imported certificate at index " << i;
-  }
-  return IMPORT_OK;
+  if (successful_imports == certificates.GetSize())
+    return IMPORT_OK;
+  else if (successful_imports == 0)
+    return IMPORT_FAILED;
+  else
+    return IMPORT_INCOMPLETE;
 }
 
 bool CertificateImporter::ParseAndStoreCertificate(
     const base::DictionaryValue& certificate) {
   // Get out the attributes of the given certificate.
   std::string guid;
   if (!certificate.GetString(kGUID, &guid) || guid.empty()) {
     ONC_LOG_ERROR("Certificate missing GUID identifier");
     return false;
   }
 
   bool remove = false;
   if (certificate.GetBoolean(kRemove, &remove) && remove) {
     if (!DeleteCertAndKeyByNickname(guid)) {
-      ONC_LOG_WARNING("Unable to delete certificate");
+      ONC_LOG_ERROR("Unable to delete certificate");
       return false;
     } else {
       return true;
     }
   }
 
   // Not removing, so let's get the data we need to add this certificate.
   std::string cert_type;
   certificate.GetString(certificate::kType, &cert_type);
   if (cert_type == certificate::kServer || cert_type == certificate::kAuthority)
@@ skipping 269 matching lines @@
     PK11_SetPrivateKeyNickname(private_key, const_cast<char*>(guid.c_str()));
     SECKEY_DestroyPrivateKey(private_key);
   } else {
     ONC_LOG_WARNING("Unable to find private key for certificate.");
   }
   return true;
 }
 
 }  // chromeos
 }  // onc