Enable client certificate patterns in device ONC policy

chromeos/network/network_connection_handler.cc

Index: chromeos/network/network_connection_handler.cc
diff --git a/chromeos/network/network_connection_handler.cc b/chromeos/network/network_connection_handler.cc
index 81d3492a47e1bb2af29b7fadf0690cb0785d85c7..53eb7ff45ef11ea06d349252929f45bcfeeccea9 100644
--- a/chromeos/network/network_connection_handler.cc
+++ b/chromeos/network/network_connection_handler.cc
@@ -422,8 +422,10 @@ void NetworkConnectionHandler::VerifyConfiguredAndConnect(
   std::string profile;
   service_properties.GetStringWithoutPathExpansion(shill::kProfileProperty,
                                                    &profile);
-  const base::DictionaryValue* user_policy =
-      managed_configuration_handler_->FindPolicyByGuidAndProfile(guid, profile);
+  ::onc::ONCSource onc_source = onc::ONC_SOURCE_NONE;
+  const base::DictionaryValue* policy =
+      managed_configuration_handler_->FindPolicyByGuidAndProfile(guid, profile,
+                                                                 &onc_source);
 
   if (IsNetworkProhibitedByPolicy(type, guid, profile)) {
     ErrorCallbackForPendingRequest(service_path, kErrorUnmanagedNetwork);
@@ -431,8 +433,10 @@ void NetworkConnectionHandler::VerifyConfiguredAndConnect(
   }
 
   client_cert::ClientCertConfig cert_config_from_policy;
-  if (user_policy)
-    client_cert::OncToClientCertConfig(*user_policy, &cert_config_from_policy);
+  if (policy) {
+    client_cert::OncToClientCertConfig(onc_source, *policy,
+                                       &cert_config_from_policy);
+  }
 
   client_cert::ConfigType client_cert_type = client_cert::CONFIG_TYPE_NONE;
   if (type == shill::kTypeVPN) {
@@ -481,9 +485,7 @@ void NetworkConnectionHandler::VerifyConfiguredAndConnect(
     if (cert_config_from_policy.client_cert_type ==
         onc::client_cert::kPattern) {
       if (!ClientCertResolver::ResolveCertificatePatternSync(
-              client_cert_type,
-              cert_config_from_policy.pattern,
-              &config_properties)) {
+              client_cert_type, cert_config_from_policy, &config_properties)) {
         ErrorCallbackForPendingRequest(service_path, kErrorCertificateRequired);
         return;
       }
@@ -558,7 +560,7 @@ bool NetworkConnectionHandler::IsNetworkProhibitedByPolicy(
     return false;
   }
   return !managed_configuration_handler_->FindPolicyByGuidAndProfile(
-      guid, profile_path);
+      guid, profile_path, nullptr /* onc_source */);
 }
 
 void NetworkConnectionHandler::QueueConnectRequest(