Add a check for server and CA certificates in device policies to the ONC validator.

chrome/browser/chromeos/cros/network_library_impl_base.cc

Index: chrome/browser/chromeos/cros/network_library_impl_base.cc
diff --git a/chrome/browser/chromeos/cros/network_library_impl_base.cc b/chrome/browser/chromeos/cros/network_library_impl_base.cc
index 87058dd2df08bcc2767be55af49cd333b8143b1c..320692b630ba0aa814b0e5d27bf559b5edb005c3 100644
--- a/chrome/browser/chromeos/cros/network_library_impl_base.cc
+++ b/chrome/browser/chromeos/cros/network_library_impl_base.cc
@@ -1140,7 +1140,11 @@ bool NetworkLibraryImplBase::LoadOncNetworks(const std::string& onc_blob,
   if (has_certificates) {
     VLOG(2) << "ONC file has " << certificates->GetSize() << " certificates";
 
-    onc::CertificateImporter cert_importer(source, allow_web_trust_from_policy);
+    // Web trust is only granted to certificates imported for a managed user
+    // on a managed device.
+    onc::CertificateImporter cert_importer(
+        source == onc::ONC_SOURCE_USER_POLICY &&
+        allow_web_trust_from_policy);

[Joao da Silva, 2013/01/16 15:03:57]

Web trust is also allowed for ONC_SOURCE_USER_IMPORT.

bool allow_web_trust =
  (source == onc::ONC_SOURCE_USER_IMPORT) ||
  (source == onc::ONC_SOURCE_USER_POLICY && allow_web_trust_from_policy);

[pneubeck (no reviews), 2013/01/16 15:18:04]

Done.

     if (cert_importer.ParseAndStoreCertificates(*certificates) !=
         onc::CertificateImporter::IMPORT_OK) {
       LOG(ERROR) << "Cannot parse some of the certificates in the ONC from "