Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chromeos/network/onc/onc_certificate_importer.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_H_
 #define CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 31 matching lines @@
   // and Authority certificates with the Trust attribute "Web" if the
   // |allow_web_trust| permission is granted, otherwise the attribute is
   // ignored.
   explicit CertificateImporter(bool allow_web_trust);
 
   // Parses and stores the certificates in |onc_certificates| into the
   // certificate store. If the "Remove" field of a certificate is enabled, then
   // removes the certificate from the store instead of importing. Returns the
   // result of the parse operation. In case of IMPORT_INCOMPLETE, some of the
   // certificates may be stored/removed successfully while others had errors.
+  // |web_trust_certificates| will be filled with the list of certificates that
+  // requested the Web trust flag, if not NULL.

[pneubeck (no reviews), 2013/03/26 10:01:25]

NIT: "if not NULL" to the beginning of the sentence

[Joao da Silva, 2013/03/31 19:22:14]

Done.

   // If no error occurred, returns IMPORT_OK.
   ParseResult ParseAndStoreCertificates(
-      const base::ListValue& onc_certificates);
+      const base::ListValue& onc_certificates,
+      net::CertificateList* web_trust_certificates);
 
   // Parses and stores/removes |certificate| in/from the certificate
   // store. Returns true if the operation succeeded.
-  bool ParseAndStoreCertificate(const base::DictionaryValue& certificate);
+  bool ParseAndStoreCertificate(

[pneubeck (no reviews), 2013/03/26 10:01:25]

you can make this one private. it's never called from the outside.

[Joao da Silva, 2013/03/31 19:22:14]

Done.

+      const base::DictionaryValue& certificate,
+      net::CertificateList* web_trust_certificates);
 
   // Lists the certificates that have the string |label| as their certificate
   // nickname (exact match).
   static void ListCertsWithNickname(const std::string& label,
                                     net::CertificateList* result);
 
  protected:
   // Deletes any certificate that has the string |label| as its nickname (exact
   // match).
   static bool DeleteCertAndKeyByNickname(const std::string& label);
 
  private:
-  bool ParseServerOrCaCertificate(const std::string& cert_type,
-                                  const std::string& guid,
-                                  const base::DictionaryValue& certificate);
+  bool ParseServerOrCaCertificate(
+      const std::string& cert_type,
+      const std::string& guid,
+      const base::DictionaryValue& certificate,
+      net::CertificateList* web_trust_certificates);
 
   bool ParseClientCertificate(const std::string& guid,
                               const base::DictionaryValue& certificate);
 
   // Whether certificates with Trust attribute "Web" should be stored with web
   // trust.
   bool allow_web_trust_;
 
   DISALLOW_COPY_AND_ASSIGN(CertificateImporter);
 };
 
 }  // namespace onc
 }  // namespace chromeos
 
 #endif  // CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_H_