Resolve certificate references in ONC by PEM.

chrome/browser/chromeos/policy/network_configuration_updater_impl_cros.cc

Index: chrome/browser/chromeos/policy/network_configuration_updater_impl_cros.cc
diff --git a/chrome/browser/chromeos/policy/network_configuration_updater_impl_cros.cc b/chrome/browser/chromeos/policy/network_configuration_updater_impl_cros.cc
index 41a998699e25b29d85023c347ab252eda94190bf..d814f4bb39fa3f01b4a4c447da8ab46c5959eb22 100644
--- a/chrome/browser/chromeos/policy/network_configuration_updater_impl_cros.cc
+++ b/chrome/browser/chromeos/policy/network_configuration_updater_impl_cros.cc
@@ -165,11 +165,30 @@ void NetworkConfigurationUpdaterImplCros::ApplyNetworkConfiguration(
   ParseAndValidateOncForImport(
       onc_blob, onc_source, "", &network_configs, &certificates);
 
-  network_library_->LoadOncNetworks(network_configs, onc_source);
-
+  chromeos::CertificateHandler::CertsByGUID imported_server_and_ca_certs;
   scoped_ptr<net::CertificateList> web_trust_certs(new net::CertificateList);
   certificate_handler_->ImportCertificates(
-      certificates, onc_source, web_trust_certs.get());
+      certificates, onc_source, web_trust_certs.get(),
+      &imported_server_and_ca_certs);
+
+  if (!chromeos::onc::ResolveServerCertRefsInNetworks(
+          imported_server_and_ca_certs, &network_configs)) {
+    LOG(ERROR) << "Some certificate references in the ONC policy for source "
+               << chromeos::onc::GetSourceAsString(onc_source)
+               << " could not be resolved.";
+  }
+
+  net::CertificateList imported_server_and_ca_certs_list;
+  for (chromeos::CertificateHandler::CertsByGUID::iterator it =
+           imported_server_and_ca_certs.begin();
+       it != imported_server_and_ca_certs.end(); ++it) {
+    imported_server_and_ca_certs_list.push_back(it->second);
+  }
+  network_library_->LoadOncNetworks(
+      network_configs,
+      onc_source,
+      base::Bind(&chromeos::onc::GetPEMEncodedCertFromFingerprint,
+                 imported_server_and_ca_certs_list));

[stevenjb, 2013/06/21 22:47:13]

This feels awkward. Do we really need to abstract this, or can we just pass a
imported_server_and_ca_certs_list through and have LocalTranslator call
GetPEMEncodedCertFromFingerprint directly?

[pneubeck (no reviews), 2013/06/24 08:12:31]

This way it's easier to test the Translator and LoadOncNetworks. The
dependencies are also simpler.
Note, that X509Certificate is not an interface and does not provide a way for
Mocks/Stubs, which could have fake fingerprints.

[stevenjb, 2013/06/27 17:23:31]

I looked at this more closely, and I still don't like it much. 

* We call LoadOncNetworks() from two non-test places; both bind this to
GetPEMEncodedCertFromFingerprint().
* NetworkLibraryStubTest calls LoadOncNetworks() with a test callback, but it
uses the Stub implementation, which could override LoadOncNetworks() (or add a
private GetPEMEncodedCertFromFingerprint() method to NetworkLibrary that has the
different implementations in the stub vs. cros impl).

onc::GetPEMEncodedCertFromFingerprint seems like an implementation detail that
the caller shouldn't need to know about. I would much rather see that detail
provided by the cros / stub implementation.

I guess I don't care too much because I am hoping to move LoadOncNetworks() out
of NetworkLibrary very soon, but generally speaking I do not think the added
code complexity is justified for the sake of a unit test. Stub implementations
or test setters seem like better options.

 
   if (onc_source == chromeos::onc::ONC_SOURCE_USER_POLICY)
     SetTrustAnchors(web_trust_certs.Pass());