Enable client certificate patterns in device ONC policy

chromeos/network/network_connection_handler.cc

Index: chromeos/network/network_connection_handler.cc
diff --git a/chromeos/network/network_connection_handler.cc b/chromeos/network/network_connection_handler.cc
index 81d3492a47e1bb2af29b7fadf0690cb0785d85c7..d64bd5cafeceb413f4fabb3ea6dfd3f177986d84 100644
--- a/chromeos/network/network_connection_handler.cc
+++ b/chromeos/network/network_connection_handler.cc
@@ -422,8 +422,10 @@ void NetworkConnectionHandler::VerifyConfiguredAndConnect(
   std::string profile;
   service_properties.GetStringWithoutPathExpansion(shill::kProfileProperty,
                                                    &profile);
-  const base::DictionaryValue* user_policy =
-      managed_configuration_handler_->FindPolicyByGuidAndProfile(guid, profile);
+  ::onc::ONCSource onc_source;

[emaxx, 2017/04/20 20:10:39]

nit: I believe the general guideline is to initialize all variables with some
default values, even in such cases when it's actually an output parameter.

[pmarko, 2017/04/24 14:49:56]

Done. (also in chromeos/network/client_cert_resolver.cc)

+  const base::DictionaryValue* policy =
+      managed_configuration_handler_->FindPolicyByGuidAndProfile(guid, profile,
+                                                                 &onc_source);
 
   if (IsNetworkProhibitedByPolicy(type, guid, profile)) {
     ErrorCallbackForPendingRequest(service_path, kErrorUnmanagedNetwork);
@@ -431,8 +433,10 @@ void NetworkConnectionHandler::VerifyConfiguredAndConnect(
   }
 
   client_cert::ClientCertConfig cert_config_from_policy;
-  if (user_policy)
-    client_cert::OncToClientCertConfig(*user_policy, &cert_config_from_policy);
+  if (policy) {
+    client_cert::OncToClientCertConfig(onc_source, *policy,
+                                       &cert_config_from_policy);
+  }
 
   client_cert::ConfigType client_cert_type = client_cert::CONFIG_TYPE_NONE;
   if (type == shill::kTypeVPN) {
@@ -558,7 +562,7 @@ bool NetworkConnectionHandler::IsNetworkProhibitedByPolicy(
     return false;
   }
   return !managed_configuration_handler_->FindPolicyByGuidAndProfile(
-      guid, profile_path);
+      guid, profile_path, nullptr);
 }
 
 void NetworkConnectionHandler::QueueConnectRequest(