Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/policy/browser_policy_connector.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/browser_policy_connector.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
@@ skipping 10 matching lines @@
 #include "chrome/browser/policy/cloud/cloud_policy_service.h"
 #include "chrome/browser/policy/cloud/device_management_service.h"
 #include "chrome/browser/policy/configuration_policy_provider.h"
 #include "chrome/browser/policy/managed_mode_policy_provider.h"
 #include "chrome/browser/policy/policy_service_impl.h"
 #include "chrome/browser/policy/policy_statistics_collector.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
+#include "components/user_prefs/pref_registry_syncable.h"
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "google_apis/gaia/gaia_constants.h"
 #include "grit/generated_resources.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "policy/policy_constants.h"
 #include "third_party/icu/public/i18n/unicode/regex.h"
 
 #if defined(OS_WIN)
 #include "chrome/browser/policy/policy_loader_win.h"
@@ skipping 183 matching lines @@
   // call SetPolicyProviderForTesting() again. It is still owned by the test.
   g_testing_provider = NULL;
   if (platform_provider_)
     platform_provider_->Shutdown();
 
 #if defined(OS_CHROMEOS)
   // The AppPackUpdater may be observing the |device_cloud_policy_subsystem_|.
   // Delete it first.
   app_pack_updater_.reset();
 
+  network_configuration_updater_.reset();
+
   if (device_cloud_policy_manager_)
     device_cloud_policy_manager_->Shutdown();
   if (device_local_account_policy_provider_)
     device_local_account_policy_provider_->Shutdown();
   if (device_local_account_policy_service_)
     device_local_account_policy_service_->Disconnect();
   if (user_cloud_policy_manager_)
     user_cloud_policy_manager_->Shutdown();
   global_user_cloud_policy_provider_.Shutdown();
 #endif
@@ skipping 222 matching lines @@
       UTF8ToUTF16(gaia::ExtractDomainName(gaia::CanonicalizeEmail(username)));
   for (size_t i = 0; i < arraysize(kNonManagedDomainPatterns); i++) {
     string16 pattern = WideToUTF16(kNonManagedDomainPatterns[i]);
     if (MatchDomain(domain, pattern))
       return true;
   }
   return false;
 }
 
 // static
+bool BrowserPolicyConnector::UsedPolicyCertificates(Profile* profile) {
+#if defined(OS_CHROMEOS)
+  if (profile->GetPrefs()->GetBoolean(prefs::kUsedPolicyCertificatesOnce))
+    return true;
+#endif
+  return false;
+}
+
+// static
 void BrowserPolicyConnector::RegisterPrefs(PrefRegistrySimple* registry) {
   registry->RegisterIntegerPref(prefs::kUserPolicyRefreshRate,
                                 kDefaultPolicyRefreshRateMs);
 #if defined(OS_CHROMEOS)
   registry->RegisterIntegerPref(prefs::kDevicePolicyRefreshRate,
                                 kDefaultPolicyRefreshRateMs);
 #endif
 }
 
+// static
+void BrowserPolicyConnector::RegisterUserPrefs(PrefRegistrySyncable* registry) {
+#if defined(OS_CHROMEOS)
+  registry->RegisterBooleanPref(prefs::kUsedPolicyCertificatesOnce,
+                                false,
+                                PrefRegistrySyncable::UNSYNCABLE_PREF);
+#endif
+}
+
 void BrowserPolicyConnector::SetTimezoneIfPolicyAvailable() {
 #if defined(OS_CHROMEOS)
   typedef chromeos::CrosSettingsProvider Provider;
   Provider::TrustedStatus result =
       chromeos::CrosSettings::Get()->PrepareTrustedValues(
           base::Bind(&BrowserPolicyConnector::SetTimezoneIfPolicyAvailable,
                      weak_ptr_factory_.GetWeakPtr()));
 
   if (result != Provider::TRUSTED)
     return;
@@ skipping 57 matching lines @@
     return new AsyncPolicyProvider(loader.Pass());
   } else {
     return NULL;
   }
 #else
   return NULL;
 #endif
 }
 
 }  // namespace policy