Add a check for server and CA certificates in device policies to the ONC validator.

chromeos/network/onc/onc_validator_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_validator.h"
 
 #include <string>
 #include <utility>
 
 #include "base/logging.h"
@@ skipping 11 matching lines @@
 class ONCValidatorTest : public ::testing::Test {
  public:
   // Validate |onc_object| with the given |signature|. The object is considered
   // to be managed if |managed_onc| is true. A strict validator is used if
   // |strict| is true. |onc_object| and the resulting repaired object of the
   // validation is stored, so that expectations can be checked afterwards using
   // one of the Expect* functions below.
   void Validate(bool strict,
                 scoped_ptr<base::DictionaryValue> onc_object,
                 const OncValueSignature* signature,
-                bool managed_onc) {
-    Validate(strict, onc_object.Pass(), signature, managed_onc,
-             ONC_SOURCE_NONE);
-  }
-
-  void Validate(bool strict,
-                scoped_ptr<base::DictionaryValue> onc_object,
-                const OncValueSignature* signature,
                 bool managed_onc,
                 ONCSource onc_source) {
     scoped_ptr<Validator> validator;
     if (strict) {
       // Create a strict validator that complains about every error.
       validator.reset(new Validator(true, true, true, managed_onc));
     } else {
       // Create a liberal validator that ignores or repairs non-critical errors.
       validator.reset(new Validator(false, false, false, managed_onc));
     }
@@ skipping 27 matching lines @@
   scoped_ptr<const base::DictionaryValue> repaired_object_;
 };
 
 namespace {
 
 struct OncParams {
   // |location_of_object| is a string to identify the object to be tested. It
   // may be used as a filename or as a dictionary key.
   OncParams(const std::string& location_of_object,
             const OncValueSignature* onc_signature,
-            bool is_managed_onc)
+            bool is_managed_onc,
+            ONCSource onc_source = ONC_SOURCE_NONE)

[pastarmovj, 2013/01/16 14:49:38]

Default values are not allowed by the style guide.

       : location(location_of_object),
         signature(onc_signature),
-        is_managed(is_managed_onc) {
+        is_managed(is_managed_onc),
+        onc_source(onc_source) {
   }
 
   std::string location;
   const OncValueSignature* signature;
   bool is_managed;
+  ONCSource onc_source;
 };
 
 ::std::ostream& operator<<(::std::ostream& os, const OncParams& onc) {
   return os << "(" << onc.location << ", " << onc.signature << ", "
-            << (onc.is_managed ? "managed" : "unmanaged") << ")";
+            << (onc.is_managed ? "managed" : "unmanaged") << ", "
+            << GetSourceAsString(onc.onc_source) << ")";
 }
 
 }  // namespace
 
 // Ensure that the constant |kEmptyUnencryptedConfiguration| describes a valid
 // ONC toplevel object.
 TEST_F(ONCValidatorTest, EmptyUnencryptedConfiguration) {
   Validate(true, ReadDictionaryFromJson(kEmptyUnencryptedConfiguration),
-           &kToplevelConfigurationSignature, false);
+           &kToplevelConfigurationSignature, false, ONC_SOURCE_NONE);
   ExpectValid();
 }
 
-// Ensure that VPN is rejected in device policies.
-TEST_F(ONCValidatorTest, VPNInDevicePolicyInvalid) {
-  Validate(true, test_utils::ReadTestDictionary("valid_openvpn.onc"),
-           &kNetworkConfigurationSignature, true, ONC_SOURCE_DEVICE_POLICY);
-  ExpectInvalid();
-}
-
-// Ensure that client certificate patterns are rejected in device policies.
-TEST_F(ONCValidatorTest, ClientCertPatternInDevicePolicyInvalid) {
-  Validate(true, test_utils::ReadTestDictionary("valid_wifi_clientcert.onc"),
-           &kNetworkConfigurationSignature, true, ONC_SOURCE_DEVICE_POLICY);
-  ExpectInvalid();
-}
-
-// Check that at least one configuration is accepted for device policies.
-TEST_F(ONCValidatorTest, ValidNetworkInDevicePolicy) {
-  Validate(true, test_utils::ReadTestDictionary("valid_wifi_psk.onc"),
-           &kNetworkConfigurationSignature, true, ONC_SOURCE_DEVICE_POLICY);
-  ExpectValid();
-}
-
 // This test case is about validating valid ONC objects without any errors. Both
 // the strict and the liberal validator accept the object.
 class ONCValidatorValidTest : public ONCValidatorTest,
                               public ::testing::WithParamInterface<OncParams> {
 };
 
 TEST_P(ONCValidatorValidTest, StrictValidationValid) {
   OncParams onc = GetParam();
   Validate(true, test_utils::ReadTestDictionary(onc.location), onc.signature,
-           onc.is_managed);
+           onc.is_managed, onc.onc_source);
   ExpectValid();
 }
 
 TEST_P(ONCValidatorValidTest, LiberalValidationValid) {
   OncParams onc = GetParam();
   Validate(false, test_utils::ReadTestDictionary(onc.location), onc.signature,
-           onc.is_managed);
+           onc.is_managed, onc.onc_source);
   ExpectValid();
 }
 
 // The parameters are:
 // OncParams(string: Filename of a ONC file that is to be validated,
 //           OncValueSignature: signature of that ONC,
 //           bool: true if the ONC is managed).
 INSTANTIATE_TEST_CASE_P(
     ONCValidatorValidTest,
     ONCValidatorValidTest,
     ::testing::Values(OncParams("managed_toplevel1.onc",
                                 &kToplevelConfigurationSignature,
                                 true),
                       OncParams("managed_toplevel2.onc",
                                 &kToplevelConfigurationSignature,
                                 true),
+                      // Check that at least one configuration is accepted for
+                      // device policies.
+                      OncParams("managed_toplevel_wifi_peap.onc",
+                                &kToplevelConfigurationSignature,
+                                true,
+                                ONC_SOURCE_DEVICE_POLICY),
                       OncParams("toplevel_wifi_wpa_psk.onc",
                                 &kToplevelConfigurationSignature,
                                 false),
                       OncParams("encrypted.onc",
                                 &kToplevelConfigurationSignature,
                                 true),
                       OncParams("managed_vpn.onc",
                                 &kNetworkConfigurationSignature,
                                 true),
                       OncParams("managed_ethernet.onc",
@@ skipping 42 matching lines @@
         test_utils::ReadTestDictionary("invalid_settings_with_repairs.json"));
     const base::DictionaryValue* onc_object = NULL;
     CHECK(dict->GetDictionary(name, &onc_object));
     return make_scoped_ptr(onc_object->DeepCopy());
   }
 };
 
 TEST_P(ONCValidatorTestRepairable, StrictValidation) {
   OncParams onc = GetParam().first;
   Validate(true, GetDictionaryFromTestFile(onc.location), onc.signature,
-           onc.is_managed);
+           onc.is_managed, onc.onc_source);
   std::string location_of_repaired =
       GetParam().second.location_of_strict_repaired;
   if (location_of_repaired.empty())
     ExpectInvalid();
   else
     ExpectRepairWithWarnings(*GetDictionaryFromTestFile(location_of_repaired));
 }
 
 TEST_P(ONCValidatorTestRepairable, LiberalValidation) {
   OncParams onc = GetParam().first;
   Validate(false, GetDictionaryFromTestFile(onc.location), onc.signature,
-           onc.is_managed);
+           onc.is_managed, onc.onc_source);
   std::string location_of_repaired =
       GetParam().second.location_of_liberal_repaired;
   if (location_of_repaired.empty())
     ExpectInvalid();
   else
     ExpectRepairWithWarnings(*GetDictionaryFromTestFile(location_of_repaired));
 }
 
 // The parameters for all test case instantations below are:
 // OncParams(string: A fieldname in the dictionary from the file
@@ skipping 52 matching lines @@
                                      "toplevel-repaired")),
          std::make_pair(OncParams("toplevel-invalid-network",
                                   &kToplevelConfigurationSignature,
                                   true),
                         RepairParams("toplevel-repaired",
                                      "toplevel-repaired")),
          // Ignore recommended arrays in unmanaged ONC.
          std::make_pair(OncParams("network-with-illegal-recommended",
                                   &kNetworkConfigurationSignature,
                                   false),
-                        RepairParams("network-repaired", "network-repaired"))));
+                        RepairParams("network-repaired", "network-repaired")),
+         std::make_pair(OncParams("toplevel-with-vpn",
+                                  &kToplevelConfigurationSignature,
+                                  false,
+                                  ONC_SOURCE_DEVICE_POLICY),
+                        RepairParams("toplevel-empty", "toplevel-empty")),
+         std::make_pair(OncParams("toplevel-with-server-and-ca-cert",
+                                  &kToplevelConfigurationSignature,
+                                  true,
+                                  ONC_SOURCE_DEVICE_POLICY),
+                        RepairParams("toplevel-server-and-ca-cert-dropped",
+                                     "toplevel-server-and-ca-cert-dropped"))));
 
 // Strict and liberal validator both repair, but with different results.
 INSTANTIATE_TEST_CASE_P(
     StrictAndLiberalRepairDifferently,
     ONCValidatorTestRepairable,
     ::testing::Values(
          std::make_pair(OncParams("toplevel-with-nested-warning",
                                   &kToplevelConfigurationSignature,
                                   false),
                         RepairParams("toplevel-empty", "toplevel-repaired"))));
@@ skipping 13 matching lines @@
                                   &kNetworkConfigurationSignature, false),
                         RepairParams("", "")),
          std::make_pair(OncParams("managed-network-value-out-of-range",
                                   &kNetworkConfigurationSignature, true),
                         RepairParams("", "")),
          std::make_pair(OncParams("network-wrong-type",
                                   &kNetworkConfigurationSignature, false),
                         RepairParams("", "")),
          std::make_pair(OncParams("managed-network-wrong-type",
                                   &kNetworkConfigurationSignature, true),
+                        RepairParams("", "")),
+         std::make_pair(OncParams("network-with-client-cert-pattern",
+                                  &kNetworkConfigurationSignature, true,
+                                  ONC_SOURCE_DEVICE_POLICY),
                         RepairParams("", ""))));
 
 }  // namespace onc
 }  // namespace chromeos