Add a check for server and CA certificates in device policies to the ONC validator.

chromeos/network/onc/onc_validator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_validator.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/json/json_writer.h"
@@ skipping 336 matching lines @@
   }
   error_or_warning_found_ = true;
   path_.push_back(field_name);
   LOG(ERROR) << ErrorHeader() << "Found value '" << actual_value
              << "', but expected a value in the range [" << lower_bound
              << ", " << upper_bound << "] (boundaries inclusive)";
   path_.pop_back();
   return true;
 }
 
+bool Validator::FieldExistsAndIsEmpty(const base::DictionaryValue& object,
+                                      const std::string& field_name) {
+  std::string value;
+  if (!object.GetStringWithoutPathExpansion(field_name, &value) ||
+      !value.empty()) {
+    return false;
+  }
+
+  error_or_warning_found_ = true;
+  path_.push_back(field_name);
+  LOG(ERROR) << ErrorHeader() << "Found an empty string, but expected a "
+             << "non-empty string.";
+  path_.pop_back();
+  return true;
+}
+
 bool Validator::RequireField(const base::DictionaryValue& dict,
                              const std::string& field_name) {
   if (dict.HasKey(field_name))
     return true;
   error_or_warning_found_ = true;
   LOG(ERROR) << ErrorHeader() << "The required field '" << field_name
              << "' is missing.";
   return false;
 }
 
@@ skipping 57 matching lines @@
   if (!ValidateObjectDefault(kNetworkConfigurationSignature,
                              onc_object, result)) {
     return false;
   }
 
   static const char* kValidTypes[] = { network_type::kEthernet,
                                        network_type::kVPN,
                                        network_type::kWiFi,
                                        network_type::kCellular,
                                        NULL };
-  if (FieldExistsAndHasNoValidValue(*result,
-                                    kType,
-                                    kValidTypes))
+  if (FieldExistsAndHasNoValidValue(*result, kType, kValidTypes) ||
+      FieldExistsAndIsEmpty(*result, kGUID)) {
     return false;
+  }
 
   bool allRequiredExist = RequireField(*result, kGUID);
 
   bool remove = false;
   result->GetBooleanWithoutPathExpansion(kRemove, &remove);
   if (!remove) {
     allRequiredExist &= RequireField(*result, kName);
     allRequiredExist &= RequireField(*result, kType);
 
     std::string type;
@@ skipping 302 matching lines @@
 }
 
 bool Validator::ValidateCertificate(
     const base::DictionaryValue& onc_object,
     base::DictionaryValue* result) {
   using namespace onc::certificate;
   if (!ValidateObjectDefault(kCertificateSignature, onc_object, result))
     return false;
 
   static const char* kValidTypes[] = { kClient, kServer, kAuthority, NULL };
-  if (FieldExistsAndHasNoValidValue(*result, kType, kValidTypes))
+  if (FieldExistsAndHasNoValidValue(*result, kType, kValidTypes) ||
+      FieldExistsAndIsEmpty(*result, kGUID)) {
     return false;
+  }
+
+  std::string type;
+  result->GetStringWithoutPathExpansion(kType, &type);
+  if (onc_source_ == ONC_SOURCE_DEVICE_POLICY &&
+      (type == kServer || type == kAuthority)) {
+    error_or_warning_found_ = true;
+    LOG(ERROR) << ErrorHeader() << "Server and authority certificates are "
+               << "prohibited in ONC device policies.";
+    return false;
+  }
 
   bool allRequiredExist = RequireField(*result, kGUID);
 
   bool remove = false;
   result->GetBooleanWithoutPathExpansion(kRemove, &remove);
   if (!remove) {
     allRequiredExist &= RequireField(*result, kType);
 
-    std::string type;
-    result->GetStringWithoutPathExpansion(kType, &type);
     if (type == kClient)
       allRequiredExist &= RequireField(*result, kPKCS12);
     else if (type == kServer || type == kAuthority)
       allRequiredExist &= RequireField(*result, kX509);
   }
 
   return !error_on_missing_field_ || allRequiredExist;
 }
 
 std::string Validator::WarningHeader() {
   return MessageHeader(false);
 }
 
 std::string Validator::ErrorHeader() {
   return MessageHeader(true);
 }
 
 std::string Validator::MessageHeader(bool is_error) {
   std::string path = path_.empty() ? "toplevel" : JoinString(path_, ".");
   std::string message = "At " + path + ": ";
   return message;
 }
 
 }  // namespace onc
 }  // namespace chromeos