Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

The MultiThreadedCertVerifier can optionally use a CertTrustAnchorProvider to
get a list of additional certificates to trust, without importing them into the
NSS database. This CL wraps the MultiThreadedCertVerifier with a custom verifier
that includes a trust anchor provider.

The trust anchor provider returns all the certificates from the user ONC policy
that have the Web trust flag. The PolicyCertVerifier also writes a preference
in the Profile once any such certificate is used.

This feature is currently behind a flag, until a warning UI is implemented.
The warning should be displayed if UsedPolicyCertificates() is true for the
given profile.

TBR=pneubeck@chromium.org
BUG=216495
NOTE: this is a reland of https://codereview.chromium.org/13035003, with tests fixed.


Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=192324

[Joao da Silva, 2013-04-04 10:35:35]

This is the same CL as https://codereview.chromium.org/13035003, which was
reverted because the tests fail on the bots.

I think the tests fail because the bot's version of NSS is not recent enough for
the trust anchors stuff, which requires 3.14.2 or later. Patch set 1 is the
original CL, and patch set 2 fixes the tests that need additional trust anchors.

If the try bot runs turn out green I'll land this, please have a look at the
changes. Thanks!

[pneubeck (no reviews), 2013-04-04 11:22:22]

lgtm

https://codereview.chromium.org/13532005/diff/3001/chrome/browser/chromeos/po...
File chrome/browser/chromeos/policy/policy_cert_verifier_browsertest.cc (right):

https://codereview.chromium.org/13532005/diff/3001/chrome/browser/chromeos/po...
chrome/browser/chromeos/policy/policy_cert_verifier_browsertest.cc:75:
scoped_refptr<net::CertVerifyProc> proc =
nit: you might drop the local variable.

[Joao da Silva, 2013-04-04 11:25:35]

https://codereview.chromium.org/13532005/diff/3001/chrome/browser/chromeos/po...
File chrome/browser/chromeos/policy/policy_cert_verifier_browsertest.cc (right):

https://codereview.chromium.org/13532005/diff/3001/chrome/browser/chromeos/po...
chrome/browser/chromeos/policy/policy_cert_verifier_browsertest.cc:75:
scoped_refptr<net::CertVerifyProc> proc =
On 2013/04/04 11:22:22, pneubeck wrote:
> nit: you might drop the local variable.

RefCounted objects have 0 refcounts when they are first created. They must be
stored in a scoped_refptr so that the count goes to 1, and then back to 0 when
the scoped_refptr goes out of scope. That will then delete the object.

This code will leak the CertVerifyProc:

  return net::CertVerifyProc::CreateDefault()->SupportsAdditionalTrustAnchors();

[commit-bot: I haz the power, 2013-04-04 12:08:16]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/joaodasilva@chromium.org/13532005/3001

[commit-bot: I haz the power, 2013-04-04 14:12:17]

Change committed as 192324