Rename ONC field Trust to TrustBits.

chromeos/network/onc/onc_certificate_importer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_certificate_importer.h"
 
 #include <cert.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 
@@ skipping 52 matching lines @@
     return IMPORT_FAILED;
   } else {
     return IMPORT_INCOMPLETE;
   }
 }
 
 bool CertificateImporter::ParseAndStoreCertificate(
     const base::DictionaryValue& certificate) {
   // Get out the attributes of the given certificate.
   std::string guid;
-  certificate.GetString(certificate::kGUID, &guid);
+  certificate.GetStringWithoutPathExpansion(certificate::kGUID, &guid);
   DCHECK(!guid.empty());
 
   bool remove = false;
-  if (certificate.GetBoolean(kRemove, &remove) && remove) {
+  if (certificate.GetBooleanWithoutPathExpansion(kRemove, &remove) && remove) {
     if (!DeleteCertAndKeyByNickname(guid)) {
       ONC_LOG_ERROR("Unable to delete certificate");
       return false;
     } else {
       return true;
     }
   }
 
   // Not removing, so let's get the data we need to add this certificate.
   std::string cert_type;
-  certificate.GetString(certificate::kType, &cert_type);
+  certificate.GetStringWithoutPathExpansion(certificate::kType, &cert_type);
   if (cert_type == certificate::kServer ||
       cert_type == certificate::kAuthority) {
     return ParseServerOrCaCertificate(cert_type, guid, certificate);
   } else if (cert_type == certificate::kClient) {
     return ParseClientCertificate(guid, certificate);
   }
 
   NOTREACHED();
   return false;
 }
@@ skipping 55 matching lines @@
   }
   return result;
 }
 
 bool CertificateImporter::ParseServerOrCaCertificate(
     const std::string& cert_type,
     const std::string& guid,
     const base::DictionaryValue& certificate) {
   bool web_trust = false;
   const base::ListValue* trust_list = NULL;
-  if (certificate.GetList(certificate::kTrust, &trust_list)) {
-    for (size_t i = 0; i < trust_list->GetSize(); ++i) {
+  if (certificate.GetListWithoutPathExpansion(certificate::kTrustBits,
+                                              &trust_list)) {
+    for (base::ListValue::const_iterator it = trust_list->begin();
+         it != trust_list->end(); ++it) {
       std::string trust_type;
-      if (!trust_list->GetString(i, &trust_type))
+      if (!(*it)->GetAsString(&trust_type))
         NOTREACHED();
 
       if (trust_type == certificate::kWeb) {
         // "Web" implies that the certificate is to be trusted for SSL
         // identification.
         web_trust = true;
       } else {
-        ONC_LOG_ERROR("Certificate contains unknown trust type " + trust_type);
-        return false;
+        // Trust bits should only increase trust and never restrict. Thus,
+        // ignoring unknown bits should be safe.
+        ONC_LOG_WARNING("Certificate contains unknown trust type " +
+                        trust_type);

[Joao da Silva, 2013/04/03 12:49:53]

It'd be nice to add a test for this: have an ONC file with a "Foo" flag, and
check that the certificate is still imported.

[pneubeck (no reviews), 2013/04/04 11:24:49]

Added the flag to an existing test.

       }
     }
   }
 
   if (web_trust && !allow_web_trust_) {
-    LOG(WARNING) << "Web trust not granted for certificate: " << guid;
+    ONC_LOG_WARNING("Web trust not granted for certificate: " + guid);
     web_trust = false;
   }
 
   std::string x509_data;
-  if (!certificate.GetString(certificate::kX509, &x509_data) ||
+  if (!certificate.GetStringWithoutPathExpansion(certificate::kX509,
+                                                 &x509_data) ||
       x509_data.empty()) {
     ONC_LOG_ERROR(
         "Certificate missing appropriate certificate data for type: " +
         cert_type);
     return false;
   }
 
   // Parse PEM certificate, and get the decoded data for use in creating
   // certificate below.
   std::vector<std::string> pem_headers;
@@ skipping 45 matching lines @@
   // keep our own database for mapping GUIDs to certs in order to enable several
   // GUIDs to map to the same cert. See http://crosbug.com/26073.
   net::NSSCertDatabase* cert_database = net::NSSCertDatabase::GetInstance();
   if (x509_cert->os_cert_handle()->isperm) {
     if (!cert_database->DeleteCertAndKey(x509_cert.get())) {
       ONC_LOG_ERROR("Unable to delete X509 certificate.");
       return false;
     }
 
     // Reload the cert here to get an actual temporary cert instance.
-    x509_cert =
-        net::X509Certificate::CreateFromBytesWithNickname(
-            decoded_x509.data(),
-            decoded_x509.size(),
-            guid.c_str());
+    x509_cert = net::X509Certificate::CreateFromBytesWithNickname(
+        decoded_x509.data(),
+        decoded_x509.size(),
+        guid.c_str());
     if (!x509_cert.get()) {
       ONC_LOG_ERROR("Unable to create X509 certificate from bytes.");
       return false;
     }
     DCHECK(!x509_cert->os_cert_handle()->isperm);
     DCHECK(x509_cert->os_cert_handle()->istemp);
   }
 
   // Make sure the GUID is not already taken. Note that for the reimport case we
   // have removed the existing cert above.
@@ skipping 27 matching lines @@
     return false;
   }
 
   return true;
 }
 
 bool CertificateImporter::ParseClientCertificate(
     const std::string& guid,
     const base::DictionaryValue& certificate) {
   std::string pkcs12_data;
-  if (!certificate.GetString(certificate::kPKCS12, &pkcs12_data) ||
+  if (!certificate.GetStringWithoutPathExpansion(certificate::kPKCS12,
+                                                 &pkcs12_data) ||
       pkcs12_data.empty()) {
     ONC_LOG_ERROR("PKCS12 data is missing for client certificate.");
     return false;
   }
 
   std::string decoded_pkcs12;
   if (!base::Base64Decode(pkcs12_data, &decoded_pkcs12)) {
     ONC_LOG_ERROR(
         "Unable to base64 decode PKCS#12 data: \"" + pkcs12_data + "\".");
     return false;
@@ skipping 34 matching lines @@
     PK11_SetPrivateKeyNickname(private_key, const_cast<char*>(guid.c_str()));
     SECKEY_DestroyPrivateKey(private_key);
   } else {
     ONC_LOG_WARNING("Unable to find private key for certificate.");
   }
   return true;
 }
 
 }  // namespace onc
 }  // namespace chromeos