Use per-user nssdb in onc certificate importer

chrome/browser/chromeos/policy/network_configuration_updater_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/files/file_path.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/run_loop.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/login/user.h"
 #include "chrome/browser/chromeos/policy/device_network_configuration_updater.h"
 #include "chrome/browser/chromeos/policy/user_network_configuration_updater.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/settings/device_settings_service.h"
 #include "chrome/browser/chromeos/settings/stub_cros_settings_provider.h"
 #include "chromeos/network/fake_network_device_handler.h"
 #include "chromeos/network/mock_managed_network_configuration_handler.h"
 #include "chromeos/network/onc/mock_certificate_importer.h"
 #include "chromeos/network/onc/onc_test_utils.h"
 #include "chromeos/network/onc/onc_utils.h"
 #include "components/onc/onc_constants.h"
 #include "components/policy/core/common/external_data_fetcher.h"
 #include "components/policy/core/common/mock_configuration_policy_provider.h"
 #include "components/policy/core/common/policy_map.h"
 #include "components/policy/core/common/policy_service_impl.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "content/public/test/test_utils.h"
+#include "crypto/scoped_nss_types.h"
 #include "net/base/test_data_directory.h"
+#include "net/cert/nss_cert_database_chromeos.h"
 #include "net/cert/x509_certificate.h"
 #include "net/test/cert_test_util.h"
 #include "policy/policy_constants.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using testing::AnyNumber;
 using testing::AtLeast;
 using testing::Mock;
 using testing::Ne;
@@ skipping 86 matching lines @@
           std::string(negation ? "isn't" : "is") + " equal to " +
               ValueToString(*value)) {
   return value->Equals(&arg);
 }
 
 MATCHER(IsEmpty, std::string(negation ? "isn't" : "is") + " empty.") {
   return arg.empty();
 }
 
 ACTION_P(SetCertificateList, list) {
-  if (arg2)
-    *arg2 = list;
+  if (arg3)
+    *arg3 = list;
   return true;
 }
 
 }  // namespace
 
 class NetworkConfigurationUpdaterTest : public testing::Test {
  protected:
   NetworkConfigurationUpdaterTest() {
   }
 
   virtual void SetUp() OVERRIDE {
     EXPECT_CALL(provider_, IsInitializationComplete(_))
-        .WillRepeatedly(Return(true));
+        .WillRepeatedly(Return(false));
     provider_.Init();
     PolicyServiceImpl::Providers providers;
     providers.push_back(&provider_);
     policy_service_.reset(new PolicyServiceImpl(providers));
 
     scoped_ptr<base::DictionaryValue> fake_toplevel_onc =
         chromeos::onc::ReadDictionaryFromJson(kFakeONC);
 
     base::ListValue* network_configs = NULL;
     fake_toplevel_onc->GetListWithoutPathExpansion(
         onc::toplevel_config::kNetworkConfigurations, &network_configs);
     AppendAll(*network_configs, &fake_network_configs_);
 
     base::DictionaryValue* global_config = NULL;
     fake_toplevel_onc->GetDictionaryWithoutPathExpansion(
         onc::toplevel_config::kGlobalNetworkConfiguration, &global_config);
     fake_global_network_config_.MergeDictionary(global_config);
 
     base::ListValue* certs = NULL;
     fake_toplevel_onc->GetListWithoutPathExpansion(
         onc::toplevel_config::kCertificates, &certs);
     AppendAll(*certs, &fake_certificates_);
 
     certificate_importer_ =
         new StrictMock<chromeos::onc::MockCertificateImporter>();
     certificate_importer_owned_.reset(certificate_importer_);
+
+    // The database will not acutally be used for importing certificates, so
+    // it's OK to have empty slots.
+    test_nssdb_.reset(new net::NSSCertDatabaseChromeOS(
+        crypto::ScopedPK11Slot(),
+        crypto::ScopedPK11Slot()));
   }
 
   virtual void TearDown() OVERRIDE {
     network_configuration_updater_.reset();
     provider_.Shutdown();
     base::RunLoop().RunUntilIdle();
   }
 
+  void MarkPolicyProviderInitialized() {
+    Mock::VerifyAndClearExpectations(&provider_);
+    EXPECT_CALL(provider_, IsInitializationComplete(_))
+        .WillRepeatedly(Return(true));
+    provider_.SetAutoRefresh();
+    provider_.RefreshPolicies();
+    base::RunLoop().RunUntilIdle();
+  }
+
   void UpdateProviderPolicy(const PolicyMap& policy) {
     provider_.UpdateChromePolicy(policy);
     base::RunLoop().RunUntilIdle();
   }
 
   UserNetworkConfigurationUpdater*
   CreateNetworkConfigurationUpdaterForUserPolicy(
-      bool allow_trusted_certs_from_policy) {
+      bool allow_trusted_certs_from_policy,
+      bool set_cert_database) {
     UserNetworkConfigurationUpdater* updater =
         UserNetworkConfigurationUpdater::CreateForUserPolicy(
             allow_trusted_certs_from_policy,
             fake_user_,
             certificate_importer_owned_.Pass(),
             policy_service_.get(),
             &network_config_handler_).release();
+    if (set_cert_database)
+      updater->SetCertDatabase(test_nssdb_.get());
     network_configuration_updater_.reset(updater);
     return updater;
   }
 
   void CreateNetworkConfigurationUpdaterForDevicePolicy() {
     network_configuration_updater_ =
         DeviceNetworkConfigurationUpdater::CreateForDevicePolicy(
             certificate_importer_owned_.Pass(),
             policy_service_.get(),
             &network_config_handler_,
@@ skipping 18 matching lines @@
   // released.
   StrictMock<chromeos::onc::MockCertificateImporter>* certificate_importer_;
   scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer_owned_;
 
   StrictMock<MockConfigurationPolicyProvider> provider_;
   scoped_ptr<PolicyServiceImpl> policy_service_;
   FakeUser fake_user_;
 
   scoped_ptr<NetworkConfigurationUpdater> network_configuration_updater_;
   content::TestBrowserThreadBundle thread_bundle_;
+
+  scoped_ptr<net::NSSCertDatabaseChromeOS> test_nssdb_;
 };
 
 TEST_F(NetworkConfigurationUpdaterTest, CellularAllowRoaming) {
   // Ignore networ config updates.
   EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _)).Times(AtLeast(1));
-  EXPECT_CALL(*certificate_importer_, ImportCertificates(_, _, _))
-      .Times(AtLeast(1));
+  EXPECT_CALL(*certificate_importer_, ImportCertificates(_, _, _, _))
+      .Times(AnyNumber());
 
   // Setup the DataRoaming device setting.
   chromeos::CrosSettings* cros_settings = chromeos::CrosSettings::Get();
   chromeos::CrosSettingsProvider* device_settings_provider =
       cros_settings->GetProvider(chromeos::kSignedDataRoamingEnabled);
   cros_settings->RemoveSettingsProvider(device_settings_provider);
   delete device_settings_provider;
   chromeos::StubCrosSettingsProvider* stub_settings_provider =
       new chromeos::StubCrosSettingsProvider;
   cros_settings->AddSettingsProvider(stub_settings_provider);
 
   chromeos::CrosSettings::Get()->Set(chromeos::kSignedDataRoamingEnabled,
                                      base::FundamentalValue(false));
   EXPECT_FALSE(network_device_handler_.allow_roaming_);
 
   CreateNetworkConfigurationUpdaterForDevicePolicy();
+  MarkPolicyProviderInitialized();
   chromeos::CrosSettings::Get()->Set(chromeos::kSignedDataRoamingEnabled,
                                      base::FundamentalValue(true));
   EXPECT_TRUE(network_device_handler_.allow_roaming_);
 
   chromeos::CrosSettings::Get()->Set(chromeos::kSignedDataRoamingEnabled,
                                      base::FundamentalValue(false));
   EXPECT_FALSE(network_device_handler_.allow_roaming_);
 }
 
 TEST_F(NetworkConfigurationUpdaterTest, PolicyIsValidatedAndRepaired) {
   scoped_ptr<base::DictionaryValue> onc_repaired =
       chromeos::onc::test_utils::ReadTestDictionary(
           "repaired_toplevel_partially_invalid.onc");
 
   base::ListValue* network_configs_repaired = NULL;
   onc_repaired->GetListWithoutPathExpansion(
       onc::toplevel_config::kNetworkConfigurations, &network_configs_repaired);
   ASSERT_TRUE(network_configs_repaired);
 
   base::DictionaryValue* global_config_repaired = NULL;
   onc_repaired->GetDictionaryWithoutPathExpansion(
       onc::toplevel_config::kGlobalNetworkConfiguration,
       &global_config_repaired);
   ASSERT_TRUE(global_config_repaired);
 
   std::string onc_policy =
       chromeos::onc::test_utils::ReadTestData("toplevel_partially_invalid.onc");
+
   PolicyMap policy;
   policy.Set(key::kOpenNetworkConfiguration,
              POLICY_LEVEL_MANDATORY,
              POLICY_SCOPE_USER,
              new base::StringValue(onc_policy),
              NULL);
   UpdateProviderPolicy(policy);
 
   EXPECT_CALL(network_config_handler_,
               SetPolicy(onc::ONC_SOURCE_USER_POLICY,
                         _,
                         IsEqualTo(network_configs_repaired),
                         IsEqualTo(global_config_repaired)));
-  EXPECT_CALL(*certificate_importer_,
-              ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, _));
+  EXPECT_CALL(
+      *certificate_importer_,
+      ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, test_nssdb_.get(), _));
 
   CreateNetworkConfigurationUpdaterForUserPolicy(
-      false /* do not allow trusted certs from policy */ );
+      false /* do not allow trusted certs from policy */,
+      true /* set certificate database */);
+  MarkPolicyProviderInitialized();
 }
 
 TEST_F(NetworkConfigurationUpdaterTest,
        DoNotAllowTrustedCertificatesFromPolicy) {
   net::CertificateList cert_list;
   cert_list =
       net::CreateCertificateListFromFile(net::GetTestCertsDirectory(),
                                          "ok_cert.pem",
                                          net::X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1u, cert_list.size());
 
   EXPECT_CALL(network_config_handler_,
               SetPolicy(onc::ONC_SOURCE_USER_POLICY, _, _, _));
-  EXPECT_CALL(*certificate_importer_, ImportCertificates(_, _, _))
+  EXPECT_CALL(*certificate_importer_,
+              ImportCertificates(_, _, test_nssdb_.get(), _))
       .WillRepeatedly(SetCertificateList(cert_list));
 
   UserNetworkConfigurationUpdater* updater =
       CreateNetworkConfigurationUpdaterForUserPolicy(
-          false /* do not allow trusted certs from policy */);
+          false /* do not allow trusted certs from policy */,
+          true /* set certificate database */);
+  MarkPolicyProviderInitialized();
 
   // Certificates with the "Web" trust flag set should not be forwarded to
   // observers.
   FakeWebTrustedCertsObserver observer;
   updater->AddTrustedCertsObserver(&observer);
 
   base::RunLoop().RunUntilIdle();
 
   net::CertificateList trust_anchors;
   updater->GetWebTrustedCertificates(&trust_anchors);
   EXPECT_TRUE(trust_anchors.empty());
 
   EXPECT_TRUE(observer.trust_anchors_.empty());
   updater->RemoveTrustedCertsObserver(&observer);
 }
 
 TEST_F(NetworkConfigurationUpdaterTest,
        AllowTrustedCertificatesFromPolicyInitially) {
   // Ignore network configuration changes.
   EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _))
       .Times(AnyNumber());
 
   net::CertificateList cert_list;
   cert_list =
       net::CreateCertificateListFromFile(net::GetTestCertsDirectory(),
                                          "ok_cert.pem",
                                          net::X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1u, cert_list.size());
 
-  EXPECT_CALL(*certificate_importer_,
-              ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, _))
-      .WillRepeatedly(SetCertificateList(cert_list));
+  EXPECT_CALL(
+      *certificate_importer_,
+      ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, test_nssdb_.get(), _))
+          .WillRepeatedly(SetCertificateList(cert_list));
 
   UserNetworkConfigurationUpdater* updater =
       CreateNetworkConfigurationUpdaterForUserPolicy(
-          true /* allow trusted certs from policy */);
+          true /* allow trusted certs from policy */,
+          true /* set certificate database */);
+  MarkPolicyProviderInitialized();
 
   base::RunLoop().RunUntilIdle();
 
   // Certificates with the "Web" trust flag set will be returned.
   net::CertificateList trust_anchors;
   updater->GetWebTrustedCertificates(&trust_anchors);
   EXPECT_EQ(1u, trust_anchors.size());
 }
 
+TEST_F(NetworkConfigurationUpdaterTest, ReapplyUserPolicyWhenCertDBSet) {
+  PolicyMap policy;
+  policy.Set(key::kOpenNetworkConfiguration, POLICY_LEVEL_MANDATORY,
+             POLICY_SCOPE_USER, new base::StringValue(kFakeONC), NULL);
+  UpdateProviderPolicy(policy);
+
+  EXPECT_CALL(network_config_handler_,
+              SetPolicy(onc::ONC_SOURCE_USER_POLICY,
+                        kFakeUsernameHash,
+                        IsEqualTo(&fake_network_configs_),
+                        IsEqualTo(&fake_global_network_config_)));
+  EXPECT_CALL(*certificate_importer_, ImportCertificates(_, _ ,_ , _)).Times(0);
+
+  UserNetworkConfigurationUpdater* updater =
+      CreateNetworkConfigurationUpdaterForUserPolicy(
+          true /* allow trusted certs from policy */,
+          false /* do not set certificate database */);
+  MarkPolicyProviderInitialized();
+
+  // If cert loader does not have its database set, Certificate import should
+  // be skipped.
+  Mock::VerifyAndClearExpectations(&network_config_handler_);
+  Mock::VerifyAndClearExpectations(certificate_importer_);
+
+  EXPECT_CALL(network_config_handler_,
+              SetPolicy(onc::ONC_SOURCE_USER_POLICY,
+                        kFakeUsernameHash,
+                        IsEqualTo(&fake_network_configs_),
+                        IsEqualTo(&fake_global_network_config_)));
+  EXPECT_CALL(*certificate_importer_,
+              ImportCertificates(IsEqualTo(&fake_certificates_),
+                                 onc::ONC_SOURCE_USER_POLICY,
+                                 test_nssdb_.get(),
+                                  _));
+
+  updater->SetCertDatabase(test_nssdb_.get());
+}
+
 TEST_F(NetworkConfigurationUpdaterTest,
        AllowTrustedCertificatesFromPolicyOnUpdate) {
   // Ignore network configuration changes.
   EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _))
       .Times(AnyNumber());
 
   // Start with an empty certificate list.
-  EXPECT_CALL(*certificate_importer_,
-              ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, _))
-      .WillRepeatedly(SetCertificateList(net::CertificateList()));
+  EXPECT_CALL(
+      *certificate_importer_,
+      ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, test_nssdb_.get(), _))
+          .WillRepeatedly(SetCertificateList(net::CertificateList()));
 
   UserNetworkConfigurationUpdater* updater =
       CreateNetworkConfigurationUpdaterForUserPolicy(
-          true /* allow trusted certs from policy */);
+          true /* allow trusted certs from policy */,
+          true /* set certificate database */);
+  MarkPolicyProviderInitialized();
 
   FakeWebTrustedCertsObserver observer;
   updater->AddTrustedCertsObserver(&observer);
 
   base::RunLoop().RunUntilIdle();
 
   // Verify that the returned certificate list is empty.
   Mock::VerifyAndClearExpectations(certificate_importer_);
   {
     net::CertificateList trust_anchors;
     updater->GetWebTrustedCertificates(&trust_anchors);
     EXPECT_TRUE(trust_anchors.empty());
   }
   EXPECT_TRUE(observer.trust_anchors_.empty());
 
   // Now use a non-empty certificate list to test the observer notification.
   net::CertificateList cert_list;
   cert_list =
       net::CreateCertificateListFromFile(net::GetTestCertsDirectory(),
                                          "ok_cert.pem",
                                          net::X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1u, cert_list.size());
 
-  EXPECT_CALL(*certificate_importer_,
-              ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, _))
-      .WillOnce(SetCertificateList(cert_list));
+  EXPECT_CALL(
+      *certificate_importer_,
+      ImportCertificates(_, onc::ONC_SOURCE_USER_POLICY, test_nssdb_.get(), _))
+          .WillOnce(SetCertificateList(cert_list));
 
   // Change to any non-empty policy, so that updates are triggered. The actual
   // content of the policy is irrelevant.
   PolicyMap policy;
   policy.Set(key::kOpenNetworkConfiguration,
              POLICY_LEVEL_MANDATORY,
              POLICY_SCOPE_USER,
              new base::StringValue(kFakeONC),
              NULL);
   UpdateProviderPolicy(policy);
@@ skipping 24 matching lines @@
   }
 
   // Returns the expected username hash to push policies to
   // ManagedNetworkConfigurationHandler.
   std::string ExpectedUsernameHash() {
     if (GetParam() == key::kOpenNetworkConfiguration)
       return kFakeUsernameHash;
     return std::string();
   }
 
+  size_t ExpectedImportCertificatesCallCount() {
+    if (GetParam() == key::kOpenNetworkConfiguration)
+      return 1u;
+    return 0u;
+  }
+
   void CreateNetworkConfigurationUpdater() {
     if (GetParam() == key::kOpenNetworkConfiguration) {
       CreateNetworkConfigurationUpdaterForUserPolicy(
-          false /* do not allow trusted certs from policy */);
+          false /* do not allow trusted certs from policy */,
+          true /* do not set certificate database */);
     } else {
       CreateNetworkConfigurationUpdaterForDevicePolicy();
     }
   }
 };
 
 TEST_P(NetworkConfigurationUpdaterTestWithParam, InitialUpdates) {
   PolicyMap policy;
   policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
              new base::StringValue(kFakeONC), NULL);
   UpdateProviderPolicy(policy);
 
   EXPECT_CALL(network_config_handler_,
               SetPolicy(CurrentONCSource(),
                         ExpectedUsernameHash(),
                         IsEqualTo(&fake_network_configs_),
                         IsEqualTo(&fake_global_network_config_)));
   EXPECT_CALL(*certificate_importer_,
-              ImportCertificates(
-                  IsEqualTo(&fake_certificates_), CurrentONCSource(), _));
+              ImportCertificates(IsEqualTo(&fake_certificates_),
+                                 CurrentONCSource(),
+                                 test_nssdb_.get(),
+                                  _))
+      .Times(ExpectedImportCertificatesCallCount());
+
+  CreateNetworkConfigurationUpdater();
+  MarkPolicyProviderInitialized();
+}
+
+TEST_P(NetworkConfigurationUpdaterTestWithParam,
+    PolicyNotSetBeforePolicyProviderInitialized) {
+  PolicyMap policy;
+  policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+             new base::StringValue(kFakeONC), NULL);
+  UpdateProviderPolicy(policy);
+
+  EXPECT_CALL(network_config_handler_,
+              SetPolicy(CurrentONCSource(),
+                        ExpectedUsernameHash(),
+                        IsEqualTo(&fake_network_configs_),
+                        IsEqualTo(&fake_global_network_config_)))
+      .Times(0);
+  EXPECT_CALL(*certificate_importer_,
+              ImportCertificates(IsEqualTo(&fake_certificates_),
+                                 CurrentONCSource(),
+                                 test_nssdb_.get(),
+                                  _))
+      .Times(0);
+
+  CreateNetworkConfigurationUpdater();
+
+  Mock::VerifyAndClearExpectations(&network_config_handler_);
+  Mock::VerifyAndClearExpectations(certificate_importer_);
+
+  EXPECT_CALL(network_config_handler_,
+              SetPolicy(CurrentONCSource(),
+                        ExpectedUsernameHash(),
+                        IsEqualTo(&fake_network_configs_),
+                        IsEqualTo(&fake_global_network_config_)));
+  EXPECT_CALL(*certificate_importer_,
+              ImportCertificates(IsEqualTo(&fake_certificates_),
+                                 CurrentONCSource(),
+                                 test_nssdb_.get(),
+                                  _))
+      .Times(ExpectedImportCertificatesCallCount());
+
+  MarkPolicyProviderInitialized();
+}
+
+TEST_P(NetworkConfigurationUpdaterTestWithParam,
+       PolicyProviderInitializedBeforeUpdater) {
+  MarkPolicyProviderInitialized();
+  PolicyMap policy;
+  policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+             new base::StringValue(kFakeONC), NULL);
+  UpdateProviderPolicy(policy);
+
+  // Should be called when network configuration updater is created and
+  // initialized and when the updater database gets set (if it gets set).
+  EXPECT_CALL(network_config_handler_,
+              SetPolicy(CurrentONCSource(),
+                        ExpectedUsernameHash(),
+                        IsEqualTo(&fake_network_configs_),
+                        IsEqualTo(&fake_global_network_config_)))
+      .Times(ExpectedImportCertificatesCallCount() + 1);
+  EXPECT_CALL(*certificate_importer_,
+              ImportCertificates(IsEqualTo(&fake_certificates_),
+                                 CurrentONCSource(),
+                                 test_nssdb_.get(),
+                                  _))
+      .Times(ExpectedImportCertificatesCallCount());
 
   CreateNetworkConfigurationUpdater();
 }
 
-
 TEST_P(NetworkConfigurationUpdaterTestWithParam, PolicyChange) {
   // Ignore the initial updates.
   EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _)).Times(AtLeast(1));
-  EXPECT_CALL(*certificate_importer_, ImportCertificates(_, _, _))
-      .Times(AtLeast(1));
+  EXPECT_CALL(*certificate_importer_, ImportCertificates(_, _, _, _))
+      .Times(AtLeast(ExpectedImportCertificatesCallCount()));
   CreateNetworkConfigurationUpdater();
+  MarkPolicyProviderInitialized();
   Mock::VerifyAndClearExpectations(&network_config_handler_);
   Mock::VerifyAndClearExpectations(certificate_importer_);
 
   // The Updater should update if policy changes.
   EXPECT_CALL(network_config_handler_,
               SetPolicy(CurrentONCSource(),
                         _,
                         IsEqualTo(&fake_network_configs_),
                         IsEqualTo(&fake_global_network_config_)));
   EXPECT_CALL(*certificate_importer_,
-              ImportCertificates(
-                  IsEqualTo(&fake_certificates_), CurrentONCSource(), _));
+              ImportCertificates(IsEqualTo(&fake_certificates_),
+                                 CurrentONCSource(),
+                                 test_nssdb_.get(),
+                                  _))
+      .Times(ExpectedImportCertificatesCallCount());
 
   PolicyMap policy;
   policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
              new base::StringValue(kFakeONC), NULL);
   UpdateProviderPolicy(policy);
   Mock::VerifyAndClearExpectations(&network_config_handler_);
   Mock::VerifyAndClearExpectations(certificate_importer_);
 
   // Another update is expected if the policy goes away.
   EXPECT_CALL(network_config_handler_,
               SetPolicy(CurrentONCSource(), _, IsEmpty(), IsEmpty()));
-  EXPECT_CALL(*certificate_importer_,
-              ImportCertificates(IsEmpty(), CurrentONCSource(), _));
+  EXPECT_CALL(
+      *certificate_importer_,
+      ImportCertificates(IsEmpty(), CurrentONCSource(), test_nssdb_.get(), _))
+      .Times(ExpectedImportCertificatesCallCount());
 
   policy.Erase(GetParam());
   UpdateProviderPolicy(policy);
 }
 
 INSTANTIATE_TEST_CASE_P(NetworkConfigurationUpdaterTestWithParamInstance,
                         NetworkConfigurationUpdaterTestWithParam,
                         testing::Values(key::kDeviceOpenNetworkConfiguration,
                                         key::kOpenNetworkConfiguration));
 
 }  // namespace policy