Don't reject server and CA certs during device ONC validation

chromeos/network/onc/onc_certificate_importer_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_certificate_importer_impl.h"
 
 #include <cert.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <stddef.h>
@@ skipping 84 matching lines @@
   bool allow_trust_imports = source == ::onc::ONC_SOURCE_USER_IMPORT;
   net::CertificateList onc_trusted_certificates;
   bool success = true;
   for (size_t i = 0; i < certificates->GetSize(); ++i) {
     const base::DictionaryValue* certificate = NULL;
     certificates->GetDictionary(i, &certificate);
     DCHECK(certificate != NULL);
 
     VLOG(2) << "Parsing certificate at index " << i << ": " << *certificate;
 
-    if (!ParseAndStoreCertificate(allow_trust_imports,
-                                  *certificate,
-                                  nssdb,
-                                  &onc_trusted_certificates)) {
+    if (!ParseAndStoreCertificate(source, allow_trust_imports, *certificate,
+                                  nssdb, &onc_trusted_certificates)) {
       success = false;
       LOG(ERROR) << "Cannot parse certificate at index " << i;
     } else {
       VLOG(2) << "Successfully imported certificate at index " << i;
     }
   }
 
   done_callback.Run(success, onc_trusted_certificates);
 }
 
 void CertificateImporterImpl::RunDoneCallback(
     const CertificateImporter::DoneCallback& callback,
     bool success,
     const net::CertificateList& onc_trusted_certificates) {
   if (!success)
     NET_LOG_ERROR("ONC Certificate Import Error", "");
   callback.Run(success, onc_trusted_certificates);
 }
 
 bool CertificateImporterImpl::ParseAndStoreCertificate(
+    ::onc::ONCSource source,
     bool allow_trust_imports,
     const base::DictionaryValue& certificate,
     net::NSSCertDatabase* nssdb,
     net::CertificateList* onc_trusted_certificates) {
   std::string guid;
   certificate.GetStringWithoutPathExpansion(::onc::certificate::kGUID, &guid);
   DCHECK(!guid.empty());
 
   std::string cert_type;
   certificate.GetStringWithoutPathExpansion(::onc::certificate::kType,
                                             &cert_type);
   if (cert_type == ::onc::certificate::kServer ||
       cert_type == ::onc::certificate::kAuthority) {
-    return ParseServerOrCaCertificate(allow_trust_imports,
-                                      cert_type,
-                                      guid,
-                                      certificate,
-                                      nssdb,
+    return ParseServerOrCaCertificate(source, allow_trust_imports, cert_type,
+                                      guid, certificate, nssdb,
                                       onc_trusted_certificates);
   } else if (cert_type == ::onc::certificate::kClient) {
     return ParseClientCertificate(guid, certificate, nssdb);
   }
 
   NOTREACHED();
   return false;
 }
 
 bool CertificateImporterImpl::ParseServerOrCaCertificate(
+    ::onc::ONCSource source,
     bool allow_trust_imports,
     const std::string& cert_type,
     const std::string& guid,
     const base::DictionaryValue& certificate,
     net::NSSCertDatabase* nssdb,
     net::CertificateList* onc_trusted_certificates) {
+  // Device policy can't import certificates.
+  if (source == ::onc::ONC_SOURCE_DEVICE_POLICY) {
+    // This isn't a parsing error.
+    LOG(WARNING) << "Refusing to import certificate from device policy.";

[stevenjb, 2017/05/17 16:18:20]

nit: include the guid here.

[pmarko, 2017/05/18 12:21:41]

Done.

+    return true;
+  }
+
   bool web_trust_flag = false;
   const base::ListValue* trust_list = NULL;
   if (certificate.GetListWithoutPathExpansion(::onc::certificate::kTrustBits,
                                               &trust_list)) {
     for (base::ListValue::const_iterator it = trust_list->begin();
          it != trust_list->end(); ++it) {
       std::string trust_type;
       if (!it->GetAsString(&trust_type))
         NOTREACHED();
 
@@ skipping 147 matching lines @@
     PK11_SetPrivateKeyNickname(private_key, const_cast<char*>(guid.c_str()));
     SECKEY_DestroyPrivateKey(private_key);
   } else {
     LOG(WARNING) << "Unable to find private key for certificate.";
   }
   return true;
 }
 
 }  // namespace onc
 }  // namespace chromeos