Replace OncNetworkParser by the new ONC translator.

chromeos/network/onc/onc_validator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_validator.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/json/json_writer.h"
@@ skipping 128 matching lines @@
   else if (&signature == &kEAPSignature)
     valid = ValidateEAP(onc_object, repaired.get());
   else if (&signature == &kCertificateSignature)
     valid = ValidateCertificate(onc_object, repaired.get());
   else
     valid = ValidateObjectDefault(signature, onc_object, repaired.get());
 
   if (valid) {
     return repaired.Pass();
   } else {
+    DCHECK(error_or_warning_found_);
     error_or_warning_found_ = *error = true;
     return scoped_ptr<base::DictionaryValue>();
   }
 }
 
 scoped_ptr<base::Value> Validator::MapField(
     const std::string& field_name,
     const OncValueSignature& object_signature,
     const base::Value& onc_value,
     bool* found_unknown_field,
@@ skipping 197 matching lines @@
 bool Validator::RequireField(const base::DictionaryValue& dict,
                              const std::string& field_name) {
   if (dict.HasKey(field_name))
     return true;
   error_or_warning_found_ = true;
   LOG(ERROR) << ErrorHeader() << "The required field '" << field_name
              << "' is missing.";
   return false;
 }
 
+// Prohibit certificate patterns for device policy ONC so that an unmanaged user
+// won't have a certificate presented for them involuntarily.
+bool Validator::CertPatternInDevicePolicy(const std::string& cert_type) {
+  if (cert_type == certificate::kPattern &&
+      onc_source_ == ONC_SOURCE_DEVICE_POLICY) {
+    error_or_warning_found_ = true;
+    LOG(ERROR) << ErrorHeader() << "Client certificate patterns are "
+               << "prohibited in ONC device policies.";
+    return true;
+  }
+  return false;
+}
+
 bool Validator::ValidateToplevelConfiguration(
     const base::DictionaryValue& onc_object,
     base::DictionaryValue* result) {
   if (!ValidateObjectDefault(kToplevelConfigurationSignature,
                              onc_object, result)) {
     return false;
   }
 
   static const char* kValidTypes[] =
       { kUnencryptedConfiguration, kEncryptedConfiguration, NULL };
@@ skipping 38 matching lines @@
   bool allRequiredExist = RequireField(*result, kGUID);
 
   bool remove = false;
   result->GetBooleanWithoutPathExpansion(kRemove, &remove);
   if (!remove) {
     allRequiredExist &= RequireField(*result, kName);
     allRequiredExist &= RequireField(*result, kType);
 
     std::string type;
     result->GetStringWithoutPathExpansion(kType, &type);
+
+    // Prohibit anything but WiFi and Ethernet for device-level policy (which
+    // corresponds to shared networks). See also http://crosbug.com/28741.
+    if (onc_source_ == ONC_SOURCE_DEVICE_POLICY &&
+        type != kWiFi &&
+        type != kEthernet) {
+      error_or_warning_found_ = true;
+      LOG(ERROR) << ErrorHeader() << "Networks of type '"
+                 << type << "' are prohibited in ONC device policies.";
+      return false;
+    }
     allRequiredExist &= type.empty() || RequireField(*result, type);
   }
 
   return !error_on_missing_field_ || allRequiredExist;
 }
 
 bool Validator::ValidateEthernet(
     const base::DictionaryValue& onc_object,
     base::DictionaryValue* result) {
   using namespace onc::ethernet;
@@ skipping 116 matching lines @@
   bool allRequiredExist = RequireField(*result, kAuthenticationType) &
       RequireField(*result, kIKEVersion);
   std::string auth;
   result->GetStringWithoutPathExpansion(kAuthenticationType, &auth);
   if (auth == kCert) {
     allRequiredExist &= RequireField(*result, kClientCertType) &
         RequireField(*result, kServerCARef);
   }
   std::string cert_type;
   result->GetStringWithoutPathExpansion(kClientCertType, &cert_type);
+
+  if (CertPatternInDevicePolicy(cert_type))
+    return false;
+
   if (cert_type == kPattern)
     allRequiredExist &= RequireField(*result, kClientCertPattern);
   else if (cert_type == kRef)
     allRequiredExist &= RequireField(*result, kClientCertRef);
 
   return !error_on_missing_field_ || allRequiredExist;
 }
 
 bool Validator::ValidateOpenVPN(
     const base::DictionaryValue& onc_object,
@@ skipping 16 matching lines @@
                                     kValidAuthRetryValues) |
       FieldExistsAndHasNoValidValue(*result, kClientCertType, kValidCertTypes) |
       FieldExistsAndHasNoValidValue(*result, kRemoteCertTLS,
                                     kValidCertTlsValues)) {
     return false;
   }
 
   bool allRequiredExist = RequireField(*result, kClientCertType);
   std::string cert_type;
   result->GetStringWithoutPathExpansion(kClientCertType, &cert_type);
+
+  if (CertPatternInDevicePolicy(cert_type))
+    return false;
+
   if (cert_type == kPattern)
     allRequiredExist &= RequireField(*result, kClientCertPattern);
   else if (cert_type == kRef)
     allRequiredExist &= RequireField(*result, kClientCertRef);
 
   return !error_on_missing_field_ || allRequiredExist;
 }
 
 bool Validator::ValidateCertificatePattern(
     const base::DictionaryValue& onc_object,
@@ skipping 70 matching lines @@
   if (FieldExistsAndHasNoValidValue(*result, kInner, kValidInnerValues) |
       FieldExistsAndHasNoValidValue(*result, kOuter, kValidOuterValues) |
       FieldExistsAndHasNoValidValue(*result, kClientCertType,
                                     kValidCertTypes)) {
     return false;
   }
 
   bool allRequiredExist = RequireField(*result, kOuter);
   std::string cert_type;
   result->GetStringWithoutPathExpansion(kClientCertType, &cert_type);
+
+  if (CertPatternInDevicePolicy(cert_type))
+    return false;
+
   if (cert_type == kPattern)
     allRequiredExist &= RequireField(*result, kClientCertPattern);
   else if (cert_type == kRef)
     allRequiredExist &= RequireField(*result, kClientCertRef);
 
   return !error_on_missing_field_ || allRequiredExist;
 }
 
 bool Validator::ValidateCertificate(
     const base::DictionaryValue& onc_object,
@@ skipping 33 matching lines @@
 }
 
 std::string Validator::MessageHeader(bool is_error) {
   std::string path = path_.empty() ? "toplevel" : JoinString(path_, ".");
   std::string message = "At " + path + ": ";
   return message;
 }
 
 }  // namespace onc
 }  // namespace chromeos