Resolve certificate references in ONC by PEM.

chrome/browser/chromeos/policy/network_configuration_updater_impl.cc

Index: chrome/browser/chromeos/policy/network_configuration_updater_impl.cc
diff --git a/chrome/browser/chromeos/policy/network_configuration_updater_impl.cc b/chrome/browser/chromeos/policy/network_configuration_updater_impl.cc
index 54e403331dd4cc0e51049da1904d3ca8f47a9834..5fa896cd6a6607c51ee83bf2c2955cc8cdcfdad8 100644
--- a/chrome/browser/chromeos/policy/network_configuration_updater_impl.cc
+++ b/chrome/browser/chromeos/policy/network_configuration_updater_impl.cc
@@ -97,15 +97,24 @@ void NetworkConfigurationUpdaterImpl::ApplyNetworkConfiguration(
   ParseAndValidateOncForImport(
       onc_blob, onc_source, "", &network_configs, &certificates);
 
+  chromeos::CertificateHandler::CertsByGUID imported_server_and_ca_certs;
+  scoped_ptr<net::CertificateList> web_trust_certs(new net::CertificateList);
+  certificate_handler_->ImportCertificates(
+      certificates, onc_source, web_trust_certs.get(),
+      &imported_server_and_ca_certs);
+
+  if (!chromeos::onc::ResolveServerCertRefsInNetworks(
+          imported_server_and_ca_certs, &network_configs)) {
+    LOG(ERROR) << "Some certificate references in the ONC policy for source "
+               << chromeos::onc::GetSourceAsString(onc_source)
+               << " could not be resolved.";

[Greg Spencer (Chromium), 2013/06/27 20:15:47]

Shouldn't this also somehow bubble up to the import process so that it fails? 
Seems like a pretty bad failure, and it should probably prevent the ONC from
being imported (as being malformed somehow).

[pneubeck (no reviews), 2013/06/28 09:41:03]

I can/wanted to add such a check to the validator in another CL. But at this
place we can't do more than logging an error.

+  }
+
   std::string userhash = onc_source == chromeos::onc::ONC_SOURCE_USER_POLICY ?
       hashed_username_ : std::string();
   chromeos::NetworkHandler::Get()->managed_network_configuration_handler()->
       SetPolicy(onc_source, userhash, network_configs);
 
-  scoped_ptr<net::CertificateList> web_trust_certs(new net::CertificateList);
-  certificate_handler_->ImportCertificates(
-      certificates, onc_source, web_trust_certs.get());
-
   if (onc_source == chromeos::onc::ONC_SOURCE_USER_POLICY)
     SetTrustAnchors(web_trust_certs.Pass());
 }