Disable certificate patterns for device policy ONC files

chrome/browser/chromeos/cros/onc_network_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/onc_network_parser.h"
 
 #include <keyhi.h>
 #include <pk11pub.h>
 
 #include "base/base64.h"
@@ skipping 1347 matching lines @@
   // Process the Host and Port values into net::HostPortPair, and then
   // net::ProxyServer for the specific scheme.
   net::HostPortPair host_port(host, static_cast<uint16>(port));
   return net::ProxyServer(scheme, host_port);
 }
 
 // static
 bool OncNetworkParser::ParseClientCertPattern(OncNetworkParser* parser,
                                               PropertyIndex index,
                                               const base::Value& value,
                                               Network* network) {

[Mattias Nissler (ping if slow), 2012/08/28 11:38:09]

Maybe it's better to put the check here instead of all case branches below?

[Greg Spencer (Chromium), 2012/09/17 18:25:44]

Done.  For some reason I thought it would mess with parsing if we didn't parse
all the bits here.  It doesn't, so of course this makes sense.

   // Only WiFi and VPN have this type.
   if (network->type() != TYPE_WIFI &&
       network->type() != TYPE_VPN) {
     LOG(WARNING) << "Tried to parse a ClientCertPattern from something "
                  << "that wasn't a WiFi or VPN network.";
     return false;
   }
 
+  // Below, we fail when parsing certificate patterns for device policy ONC so
+  // that an unmanaged user can't get to the place where a cert is presented for
+  // them involuntarily.
+
   switch (index) {
     case PROPERTY_INDEX_ONC_CERTIFICATE_PATTERN_ENROLLMENT_URI: {
       std::vector<std::string> resulting_list;
-      if (!GetAsListOfStrings(value, &resulting_list))
+      if (!GetAsListOfStrings(value, &resulting_list) ||
+          parser->onc_source() == NetworkUIData::ONC_SOURCE_DEVICE_POLICY)

[Mattias Nissler (ping if slow), 2012/08/28 11:38:09]

nit: Other code in this file seems to add curly braces for the
two-line-conditional, single-line-body case. Same below.

[Greg Spencer (Chromium), 2012/09/17 18:25:44]

Done.

         return false;
       CertificatePattern pattern = network->client_cert_pattern();
       pattern.set_enrollment_uri_list(resulting_list);
       network->set_client_cert_pattern(pattern);
       return true;
     }
     case PROPERTY_INDEX_ONC_CERTIFICATE_PATTERN_ISSUER_CA_REF: {
       std::vector<std::string> resulting_list;
-      if (!GetAsListOfStrings(value, &resulting_list))
+      if (!GetAsListOfStrings(value, &resulting_list) ||
+          parser->onc_source() == NetworkUIData::ONC_SOURCE_DEVICE_POLICY)
         return false;
       CertificatePattern pattern = network->client_cert_pattern();
       pattern.set_issuer_ca_ref_list(resulting_list);
       network->set_client_cert_pattern(pattern);
       return true;
     }
     case PROPERTY_INDEX_ONC_CERTIFICATE_PATTERN_ISSUER:
       return parser->ParseNestedObject(network,
                                        onc::certificate::kIssuer,
                                        value,
@@ skipping 10 matching lines @@
   }
   return false;
 }
 
 // static
 bool OncNetworkParser::ParseIssuerPattern(OncNetworkParser* parser,
                                           PropertyIndex index,
                                           const base::Value& value,
                                           Network* network) {
   IssuerSubjectPattern pattern;
-  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network)) {
+  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network) &&
+      parser->onc_source() != NetworkUIData::ONC_SOURCE_DEVICE_POLICY) {
     CertificatePattern cert_pattern = network->client_cert_pattern();
     cert_pattern.set_issuer(pattern);
     network->set_client_cert_pattern(cert_pattern);
     return true;
   }
   return false;
 }
 
 // static
 bool OncNetworkParser::ParseSubjectPattern(OncNetworkParser* parser,
                                            PropertyIndex index,
                                            const base::Value& value,
                                            Network* network) {
   IssuerSubjectPattern pattern;
-  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network)) {
+  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network) &&
+      parser->onc_source() != NetworkUIData::ONC_SOURCE_DEVICE_POLICY) {
     CertificatePattern cert_pattern = network->client_cert_pattern();
     cert_pattern.set_subject(pattern);
     network->set_client_cert_pattern(cert_pattern);
     return true;
   }
   return false;
 }
 
 // static
 bool OncNetworkParser::ParseIssuerSubjectPattern(IssuerSubjectPattern* pattern,
@@ skipping 565 matching lines @@
     // on the value of AuthenticationType.
     { "L2TP-IPsec", PROVIDER_TYPE_L2TP_IPSEC_PSK },
     { "OpenVPN", PROVIDER_TYPE_OPEN_VPN },
   };
   CR_DEFINE_STATIC_LOCAL(EnumMapper<ProviderType>, parser,
       (table, arraysize(table), PROVIDER_TYPE_MAX));
   return parser.Get(type);
 }
 
 }  // namespace chromeos