Enable client certificate patterns in device ONC policy

chromeos/cert_loader.h

Index: chromeos/cert_loader.h
diff --git a/chromeos/cert_loader.h b/chromeos/cert_loader.h
index 7243c6ddab009804ae2f695c0d4abaf6e87034b7..8469be83a503151c1ed4b5231c0565b73d4a73b6 100644
--- a/chromeos/cert_loader.h
+++ b/chromeos/cert_loader.h
@@ -83,7 +83,14 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
 
   bool certificates_loaded() const { return certificates_loaded_; }
 
-  // This will be empty until certificates_loaded() is true.
+  // Returns certificates from the system token. This will be empty until

[emaxx, 2017/04/20 20:10:39]

nit: Maybe move this method to be after cert_list, as the latter one is what the
most clients in the code will need?

[pmarko, 2017/04/24 14:49:55]

Done.

+  // certificates_loaded() is true.
+  const net::CertificateList& system_cert_list() const {
+    return system_cert_list_;
+  }
+
+  // Returns all certificates. This will be empty until certificates_loaded() is
+  // true.
   const net::CertificateList& cert_list() const { return *cert_list_; }
 
   // Called in tests if |IsCertificateHardwareBacked()| should always return
@@ -106,6 +113,9 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
   // net::CertDatabase::Observer
   void OnCertDBChanged() override;
 
+  // Retruns true if |cert| is in the system token.

[emaxx, 2017/04/20 20:10:39]

nit: Typo in "Returns".

[pmarko, 2017/04/24 14:49:55]

Done.

+  bool IsCertificateInSystemToken(const net::X509Certificate* cert);
+
   base::ObserverList<Observer> observers_;
 
   // Flags describing current CertLoader state.
@@ -120,6 +130,10 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
   // Cached Certificates loaded from the database.
   std::unique_ptr<net::CertificateList> cert_list_;
 
+  // Cached Certifictes from system token. Currently this is a sublist of
+  // cert_list_.

[emaxx, 2017/04/20 20:10:39]

nit: s/cert_list_/|cert_list_|/

[pmarko, 2017/04/24 14:49:55]

Done.

+  net::CertificateList system_cert_list_;
+
   base::ThreadChecker thread_checker_;
 
   base::WeakPtrFactory<CertLoader> weak_factory_;