Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/chromeos/cros/network_library.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_CHROMEOS_CROS_NETWORK_LIBRARY_H_
 #define CHROME_BROWSER_CHROMEOS_CROS_NETWORK_LIBRARY_H_
 
 #include <map>
 #include <string>
 #include <vector>
 
 #include "base/compiler_specific.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/singleton.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "base/timer.h"
 #include "chrome/browser/chromeos/cros/network_constants.h"
 #include "chrome/browser/chromeos/cros/network_ui_data.h"
 #include "chromeos/network/network_ip_config.h"
 #include "chromeos/network/network_util.h"
 #include "chromeos/network/onc/onc_constants.h"
+#include "net/base/x509_certificate.h"
 
 namespace base {
 class DictionaryValue;
 class Value;
 }  // namespace base
 
 namespace chromeos {
 
 class NetworkDeviceParser;
 class NetworkParser;
@@ skipping 1684 matching lines @@
       const std::string& service_path,
       const NetworkServicePropertiesCallback& callback) = 0;
 
   // This will connect to a preferred network if the currently connected
   // network is not preferred. This should be called when the active profile
   // changes.
   virtual void SwitchToPreferredNetwork() = 0;
 
   // Load networks from an Open Network Configuration blob.
   // If there was an error, returns false.
-  virtual bool LoadOncNetworks(const std::string& onc_blob,
-                               const std::string& passcode,
-                               onc::ONCSource source,
-                               bool allow_web_trust_from_policy) = 0;
+  virtual bool LoadOncNetworks(
+      const std::string& onc_blob,
+      const std::string& passcode,
+      onc::ONCSource source,
+      net::CertificateList* web_trust_certificates) = 0;

[Ryan Sleevi, 2013/03/25 21:09:53]

The name "web_trust_certificates" is going to be very confusing, because there
is an organization called "WebTrust" that is part of the auditing scheme of
public CAs.

policy_trusted_certificates ?
policy_trust_anchors ?
onc_trusted_certificates ?
onc_trust_anchors ?

[Joao da Silva, 2013/03/31 19:22:14]

Good point. LoadOncNetworks() can also load onc from a local file (user import),
so the list doesn't come necessarily from policy; and the certificates can be
used for other purposes, so I've renamed the argument to
"onc_trusted_certificates".

 
   // This sets the active network for the network type. Note: priority order
   // is unchanged (i.e. if a wifi network is set to active, but an ethernet
   // network is still active, active_network() will still return the ethernet
   // network). Other networks of the same type will become inactive.
   // Used for testing.
   virtual bool SetActiveNetwork(ConnectionType type,
                                 const std::string& service_path) = 0;
 
   // Factory function, creates a new instance and returns ownership.
   // For normal usage, access the singleton via CrosLibrary::Get().
   static NetworkLibrary* GetImpl(bool stub);
 };
 
 }  // namespace chromeos
 
 #endif  // CHROME_BROWSER_CHROMEOS_CROS_NETWORK_LIBRARY_H_