Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/policy/browser_policy_connector.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/browser_policy_connector.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
@@ skipping 10 matching lines @@
 #include "chrome/browser/policy/cloud/cloud_policy_service.h"
 #include "chrome/browser/policy/cloud/device_management_service.h"
 #include "chrome/browser/policy/configuration_policy_provider.h"
 #include "chrome/browser/policy/managed_mode_policy_provider.h"
 #include "chrome/browser/policy/policy_service_impl.h"
 #include "chrome/browser/policy/policy_statistics_collector.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
+#include "components/user_prefs/pref_registry_syncable.h"
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "google_apis/gaia/gaia_constants.h"
 #include "grit/generated_resources.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "policy/policy_constants.h"
 #include "third_party/icu/public/i18n/unicode/regex.h"
 
 #if defined(OS_WIN)
 #include "chrome/browser/policy/policy_loader_win.h"
@@ skipping 183 matching lines @@
   // call SetPolicyProviderForTesting() again. It is still owned by the test.
   g_testing_provider = NULL;
   if (platform_provider_)
     platform_provider_->Shutdown();
 
 #if defined(OS_CHROMEOS)
   // The AppPackUpdater may be observing the |device_cloud_policy_subsystem_|.
   // Delete it first.
   app_pack_updater_.reset();
 
+  network_configuration_updater_.reset();
+
   if (device_cloud_policy_manager_)
     device_cloud_policy_manager_->Shutdown();
   if (device_local_account_policy_provider_)
     device_local_account_policy_provider_->Shutdown();
   if (device_local_account_policy_service_)
     device_local_account_policy_service_->Disconnect();
   if (user_cloud_policy_manager_)
     user_cloud_policy_manager_->Shutdown();
   global_user_cloud_policy_provider_.Shutdown();
 #endif
@@ skipping 48 matching lines @@
 }
 
 #if defined(OS_CHROMEOS)
 void BrowserPolicyConnector::InitializeUserPolicy(
     const std::string& user_name,
     bool is_public_account,
     bool wait_for_policy_fetch) {
   // If the user is managed then importing certificates from ONC policy is
   // allowed, otherwise it's not. Update this flag once the user has signed in,
   // and before user policy is loaded.
-  GetNetworkConfigurationUpdater()->set_allow_web_trust(
+  GetNetworkConfigurationUpdater()->set_allow_trusted_certificates_from_policy(
       GetUserAffiliation(user_name) == USER_AFFILIATION_MANAGED);
 
   // Re-initializing user policy is disallowed for two reasons:
   // (a) Existing profiles may hold pointers to |user_cloud_policy_manager_|.
   // (b) Implementing UserCloudPolicyManager::IsInitializationComplete()
   //     correctly is impossible for re-initialization.
   CHECK(!user_cloud_policy_manager_);
 
   CommandLine* command_line = CommandLine::ForCurrentProcess();
 
@@ skipping 64 matching lines @@
 
 #if defined(OS_CHROMEOS)
 AppPackUpdater* BrowserPolicyConnector::GetAppPackUpdater() {
   // request_context_ is NULL in unit tests.
   if (!app_pack_updater_ && request_context_) {
     app_pack_updater_.reset(
         new AppPackUpdater(request_context_, install_attributes_.get()));
   }
   return app_pack_updater_.get();
 }
-#endif
 
-#if defined(OS_CHROMEOS)
 NetworkConfigurationUpdater*
     BrowserPolicyConnector::GetNetworkConfigurationUpdater() {
   if (!network_configuration_updater_) {
     network_configuration_updater_.reset(new NetworkConfigurationUpdater(
         GetPolicyService(),
         chromeos::CrosLibrary::Get()->GetNetworkLibrary()));
   }
   return network_configuration_updater_.get();
 }
+
+net::CertTrustAnchorProvider*
+    BrowserPolicyConnector::GetCertTrustAnchorProvider() {
+  return GetNetworkConfigurationUpdater()->GetCertTrustAnchorProvider();
+}
 #endif
 
 void BrowserPolicyConnector::SetDeviceManagementServiceForTesting(
     scoped_ptr<DeviceManagementService> service) {
   device_management_service_ = service.Pass();
 }
 
 // static
 void BrowserPolicyConnector::SetPolicyProviderForTesting(
     ConfigurationPolicyProvider* provider) {
@@ skipping 57 matching lines @@
       UTF8ToUTF16(gaia::ExtractDomainName(gaia::CanonicalizeEmail(username)));
   for (size_t i = 0; i < arraysize(kNonManagedDomainPatterns); i++) {
     string16 pattern = WideToUTF16(kNonManagedDomainPatterns[i]);
     if (MatchDomain(domain, pattern))
       return true;
   }
   return false;
 }
 
 // static
+bool BrowserPolicyConnector::UsedPolicyCertificates(Profile* profile) {
+#if defined(OS_CHROMEOS)
+  if (profile->GetPrefs()->GetBoolean(prefs::kUsedPolicyCertificatesOnce))
+    return true;
+#endif
+  return false;
+}
+
+// static
 void BrowserPolicyConnector::RegisterPrefs(PrefRegistrySimple* registry) {
   registry->RegisterIntegerPref(prefs::kUserPolicyRefreshRate,
                                 kDefaultPolicyRefreshRateMs);
 #if defined(OS_CHROMEOS)
   registry->RegisterIntegerPref(prefs::kDevicePolicyRefreshRate,
                                 kDefaultPolicyRefreshRateMs);
 #endif
 }
 
+// static
+void BrowserPolicyConnector::RegisterUserPrefs(PrefRegistrySyncable* registry) {
+#if defined(OS_CHROMEOS)
+  registry->RegisterBooleanPref(prefs::kUsedPolicyCertificatesOnce,
+                                false,
+                                PrefRegistrySyncable::UNSYNCABLE_PREF);
+#endif
+}
+
 void BrowserPolicyConnector::SetTimezoneIfPolicyAvailable() {
 #if defined(OS_CHROMEOS)
   typedef chromeos::CrosSettingsProvider Provider;
   Provider::TrustedStatus result =
       chromeos::CrosSettings::Get()->PrepareTrustedValues(
           base::Bind(&BrowserPolicyConnector::SetTimezoneIfPolicyAvailable,
                      weak_ptr_factory_.GetWeakPtr()));
 
   if (result != Provider::TRUSTED)
     return;
@@ skipping 57 matching lines @@
     return new AsyncPolicyProvider(loader.Pass());
   } else {
     return NULL;
   }
 #else
   return NULL;
 #endif
 }
 
 }  // namespace policy