Use per-user nssdb in onc certificate importer

chrome/browser/chromeos/policy/user_network_configuration_updater.h

Index: chrome/browser/chromeos/policy/user_network_configuration_updater.h
diff --git a/chrome/browser/chromeos/policy/user_network_configuration_updater.h b/chrome/browser/chromeos/policy/user_network_configuration_updater.h
index 90df5e72472c9e719af49460ee4ab266559f4a92..a271d5929aa7964579f62641219fc2237d20b9ea 100644
--- a/chrome/browser/chromeos/policy/user_network_configuration_updater.h
+++ b/chrome/browser/chromeos/policy/user_network_configuration_updater.h
@@ -15,8 +15,16 @@
 #include "chrome/browser/chromeos/policy/network_configuration_updater.h"
 #include "components/browser_context_keyed_service/browser_context_keyed_service.h"
 
+namespace base {
+class ListValue;
+}
+
 namespace chromeos {
 class User;
+
+namespace onc {
+class CertificateImporter;
+}
 }
 
 namespace net {
@@ -52,13 +60,17 @@ class UserNetworkConfigurationUpdater : public NetworkConfigurationUpdater,
   static scoped_ptr<UserNetworkConfigurationUpdater> CreateForUserPolicy(
       bool allow_trusted_certs_from_policy,
       const chromeos::User& user,
-      scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer,
       PolicyService* policy_service,
       chromeos::ManagedNetworkConfigurationHandler* network_config_handler);
 
   void AddTrustedCertsObserver(WebTrustedCertsObserver* observer);
   void RemoveTrustedCertsObserver(WebTrustedCertsObserver* observer);
 
+  // Sets the certificate importer that should be used to import certificate
+  // policies. If there is |pending_policy_onc_|, it gets imported.
+  void SetCertificateImporter(
+      scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer);
+
   // Sets |certs| to the list of Web trusted server and CA certificates from the
   // last received policy.
   void GetWebTrustedCertificates(net::CertificateList* certs) const;
@@ -69,7 +81,6 @@ class UserNetworkConfigurationUpdater : public NetworkConfigurationUpdater,
   UserNetworkConfigurationUpdater(
       bool allow_trusted_certs_from_policy,
       const chromeos::User& user,
-      scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer,
       PolicyService* policy_service,
       chromeos::ManagedNetworkConfigurationHandler* network_config_handler);
 
@@ -95,6 +106,15 @@ class UserNetworkConfigurationUpdater : public NetworkConfigurationUpdater,
   // be empty if Web trust from policy is not allowed.
   net::CertificateList web_trust_certs_;
 
+  // If |ImportCertificates| is called before |certificate_importer_|, gets set
+  // to a copy of the policy for which the import was requested.
+  // The policy will be processed when the certificate importer is set.
+  scoped_ptr<base::ListValue> pending_certificates_onc_;
+
+  // Certificate importer to be used for importing policy defined certificates.
+  // Set by |SetCertificateImporter|.
+  scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer_;
+
   DISALLOW_COPY_AND_ASSIGN(UserNetworkConfigurationUpdater);
 };