Enable client certificate patterns in device ONC policy

chromeos/network/client_cert_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROMEOS_NETWORK_CLIENT_CERT_UTIL_H_
 #define CHROMEOS_NETWORK_CLIENT_CERT_UTIL_H_
 
 #include <string>
 #include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "chromeos/chromeos_export.h"
 #include "chromeos/network/certificate_pattern.h"
+#include "components/onc/onc_constants.h"
 
 namespace base {
 class DictionaryValue;
 }
 
 namespace net {
 struct CertPrincipal;
 class X509Certificate;
 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
 }
@@ skipping 19 matching lines @@
   ConfigType location;
 
   // One of the ClientCertTypes defined in ONC: kNone, kRef, or kPattern.
   std::string client_cert_type;
 
   // If |client_cert_type| equals kPattern, this contains the pattern.
   CertificatePattern pattern;
 
   // The value of kIdentity, to enable substitutions.
   std::string policy_identity;
+
+  // true if the source of this ClientCertConfig is device ONC.
+  bool source_is_device_policy_;

[emaxx, 2017/04/20 20:10:39]

Maybe just including ONCSource here would be better? This will allow more
granularity if someone wants it in the future.

[emaxx, 2017/04/20 20:10:39]

nit: The trailing underscore is extra.

[pmarko, 2017/04/24 14:49:56]

Done. (both - renamed to onc_source)

 };
 
 // Returns true only if any fields set in this pattern match exactly with
 // similar fields in the principal.  If organization_ or organizational_unit_
 // are set, then at least one of the organizations or units in the principal
 // must match.
 bool CertPrincipalMatches(const IssuerSubjectPattern& pattern,
                           const net::CertPrincipal& principal);
 
 // Returns the PKCS11 and slot ID of |cert_id|, which is expected to be a
@@ skipping 29 matching lines @@
 CHROMEOS_EXPORT void SetEmptyShillProperties(const ConfigType cert_config_type,
                                              base::DictionaryValue* properties);
 
 // Returns true if all required configuration properties are set and not empty.
 bool IsCertificateConfigured(const client_cert::ConfigType cert_config_type,
                              const base::DictionaryValue& service_properties);
 
 // Determines the type of the CertificatePattern configuration, i.e. is it a
 // pattern within an EAP, IPsec or OpenVPN configuration.
 CHROMEOS_EXPORT void OncToClientCertConfig(
+    ::onc::ONCSource onc_source,
     const base::DictionaryValue& network_config,
     ClientCertConfig* cert_config);
 
 }  // namespace client_cert
 
 }  // namespace chromeos
 
 #endif  // CHROMEOS_NETWORK_CLIENT_CERT_UTIL_H_