Enable client certificate patterns in device ONC policy

chromeos/cert_loader.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROMEOS_CERT_LOADER_H_
 #define CHROMEOS_CERT_LOADER_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 65 matching lines @@
 
   // Returns true if |cert| is hardware backed. See also
   // ForceHardwareBackedForTesting().
   static bool IsCertificateHardwareBacked(const net::X509Certificate* cert);
 
   // Returns true when the certificate list has been requested but not loaded.
   bool CertificatesLoading() const;
 
   bool certificates_loaded() const { return certificates_loaded_; }
 
-  // This will be empty until certificates_loaded() is true.
+  // Returns certificates from the system token. This will be empty until

[emaxx, 2017/04/20 20:10:39]

nit: Maybe move this method to be after cert_list, as the latter one is what the
most clients in the code will need?

[pmarko, 2017/04/24 14:49:55]

Done.

+  // certificates_loaded() is true.
+  const net::CertificateList& system_cert_list() const {
+    return system_cert_list_;
+  }
+
+  // Returns all certificates. This will be empty until certificates_loaded() is
+  // true.
   const net::CertificateList& cert_list() const { return *cert_list_; }
 
   // Called in tests if |IsCertificateHardwareBacked()| should always return
   // true.
   static void ForceHardwareBackedForTesting();
 
  private:
   CertLoader();
   ~CertLoader() override;
 
   // Trigger a certificate load. If a certificate loading task is already in
   // progress, will start a reload once the current task is finished.
   void LoadCertificates();
 
   // Called if a certificate load task is finished.
   void UpdateCertificates(std::unique_ptr<net::CertificateList> cert_list);
 
   void NotifyCertificatesLoaded(bool initial_load);
 
   // net::CertDatabase::Observer
   void OnCertDBChanged() override;
 
+  // Retruns true if |cert| is in the system token.

[emaxx, 2017/04/20 20:10:39]

nit: Typo in "Returns".

[pmarko, 2017/04/24 14:49:55]

Done.

+  bool IsCertificateInSystemToken(const net::X509Certificate* cert);
+
   base::ObserverList<Observer> observers_;
 
   // Flags describing current CertLoader state.
   bool certificates_loaded_;
   bool certificates_update_required_;
   bool certificates_update_running_;
 
   // The user-specific NSS certificate database from which the certificates
   // should be loaded.
   net::NSSCertDatabase* database_;
 
   // Cached Certificates loaded from the database.
   std::unique_ptr<net::CertificateList> cert_list_;
 
+  // Cached Certifictes from system token. Currently this is a sublist of
+  // cert_list_.

[emaxx, 2017/04/20 20:10:39]

nit: s/cert_list_/|cert_list_|/

[pmarko, 2017/04/24 14:49:55]

Done.

+  net::CertificateList system_cert_list_;
+
   base::ThreadChecker thread_checker_;
 
   base::WeakPtrFactory<CertLoader> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(CertLoader);
 };
 
 }  // namespace chromeos
 
 #endif  // CHROMEOS_CERT_LOADER_H_