Add a check for server and CA certificates in device policies to the ONC validator.

chromeos/network/onc/onc_certificate_importer.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_H_
 #define CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 20 matching lines @@
 // imports) into the certificate store. In particular, the GUID of certificates
 // is stored together with the certificate as Nickname.
 class CHROMEOS_EXPORT CertificateImporter {
  public:
   enum ParseResult {
     IMPORT_OK,
     IMPORT_INCOMPLETE,
     IMPORT_FAILED,
   };
 
-  // Certificates pushed from a policy source with Web trust are only imported
-  // with ParseCertificate() if the |allow_web_trust_from_policy| permission is
-  // granted.
-  CertificateImporter(ONCSource onc_source,
-                      bool allow_web_trust_from_policy);
+  // During import with ParseCertificate(), Web trust is only applied to Server
+  // and Authority certificates with the Trust attribute "Web" if the
+  // |allow_web_trust| permission is granted, otherwise the attribute is
+  // ignored.
+  explicit CertificateImporter(bool allow_web_trust);
 
   // Parses and stores the certificates in |onc_certificates| into the
   // certificate store. If the "Remove" field of a certificate is enabled, then
   // removes the certificate from the store instead of importing. Returns the
   // result of the parse operation. In case of IMPORT_INCOMPLETE, some of the
   // certificates may be stored/removed successfully while others had errors.
   // If no error occurred, returns IMPORT_OK.
   ParseResult ParseAndStoreCertificates(
       const base::ListValue& onc_certificates);
 
@@ skipping 13 matching lines @@
 
  private:
   bool ParseServerOrCaCertificate(const std::string& cert_type,
                                   const std::string& guid,
                                   const base::DictionaryValue& certificate);
 
   bool ParseClientCertificate(const std::string& guid,
                               const base::DictionaryValue& certificate);
 
   // Where the ONC blob comes from.
   ONCSource onc_source_;

[Joao da Silva, 2013/01/16 15:03:57]

This field isn't used anymore.

[pneubeck (no reviews), 2013/01/16 15:18:04]

Done.

 
-  // Whether certificates with Web trust should be stored when pushed from a
-  // policy source.
-  bool allow_web_trust_from_policy_;
+  // Whether certificates with Trust attribute "Web" should be stored with web
+  // trust.
+  bool allow_web_trust_;
 
   DISALLOW_COPY_AND_ASSIGN(CertificateImporter);
 };
 
 }  // namespace onc
 }  // namespace chromeos
 
 #endif  // CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_H_