Extract certificate policy application from NetworkLibrary.

chromeos/network/onc/onc_utils.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_utils.h"
 
 #include "base/base64.h"
 #include "base/json/json_reader.h"
 #include "base/logging.h"
+#include "base/metrics/histogram.h"
 #include "base/string_util.h"
 #include "base/values.h"
 #include "chromeos/network/network_event_log.h"
 #include "chromeos/network/onc/onc_mapper.h"
 #include "chromeos/network/onc/onc_signature.h"
+#include "chromeos/network/onc/onc_utils.h"
+#include "chromeos/network/onc/onc_validator.h"
 #include "crypto/encryptor.h"
 #include "crypto/hmac.h"
 #include "crypto/symmetric_key.h"
 
 #define ONC_LOG_WARNING(message) NET_LOG_WARNING("ONC", message)
 #define ONC_LOG_ERROR(message) NET_LOG_ERROR("ONC", message)
 
 namespace chromeos {
 namespace onc {
 
@@ skipping 223 matching lines @@
                                    found_unknown_field, error);
     }
   }
 
   // Mask to insert in place of the sensitive values.
   std::string mask_;
 };
 
 }  // namespace
 
-CHROMEOS_EXPORT scoped_ptr<base::DictionaryValue> MaskCredentialsInOncObject(
+scoped_ptr<base::DictionaryValue> MaskCredentialsInOncObject(
     const onc::OncValueSignature& signature,
     const base::DictionaryValue& onc_object,
     const std::string& mask) {
   return OncMaskValues::Mask(signature, onc_object, mask);
 }
 
+bool ParseAndValidateOncForImport(
+    const std::string& onc_blob,
+    chromeos::onc::ONCSource onc_source,
+    const std::string& passphrase,
+    scoped_ptr<base::ListValue>* network_configs,
+    scoped_ptr<base::ListValue>* certificates) {
+  if (onc_blob.empty()) {
+    network_configs->reset(new base::ListValue);

[stevenjb, 2013/04/22 16:53:41]

Could be network_configs->Clear()

[pneubeck (no reviews), 2013/04/23 18:05:25]

Done.

+    certificates->reset(new base::ListValue);
+    return true;
+  }
+
+  scoped_ptr<base::DictionaryValue> toplevel_onc =
+      onc::ReadDictionaryFromJson(onc_blob);
+  if (toplevel_onc.get() == NULL) {
+    LOG(ERROR) << "ONC loaded from " << onc::GetSourceAsString(onc_source)
+               << " is not a valid JSON dictionary.";
+    return false;
+  }
+
+  // Check and see if this is an encrypted ONC file. If so, decrypt it.
+  std::string onc_type;
+  toplevel_onc->GetStringWithoutPathExpansion(onc::toplevel_config::kType,
+                                              &onc_type);
+  if (onc_type == onc::toplevel_config::kEncryptedConfiguration) {
+    toplevel_onc = onc::Decrypt(passphrase, *toplevel_onc);
+    if (toplevel_onc.get() == NULL) {
+      LOG(ERROR) << "Couldn't decrypt the ONC from "
+                 << onc::GetSourceAsString(onc_source);
+      return false;
+    }
+  }
+
+  bool from_policy = (onc_source == onc::ONC_SOURCE_USER_POLICY ||
+                      onc_source == onc::ONC_SOURCE_DEVICE_POLICY);
+
+  // Validate the ONC dictionary. We are liberal and ignore unknown field
+  // names and ignore invalid field names in kRecommended arrays.
+  onc::Validator validator(false,  // Ignore unknown fields.
+                           false,  // Ignore invalid recommended field names.
+                           true,  // Fail on missing fields.

[stevenjb, 2013/04/22 16:53:41]

nit: align comments

[pneubeck (no reviews), 2013/04/23 18:05:25]

Done.

+                           from_policy);
+  validator.SetOncSource(onc_source);
+
+  onc::Validator::Result validation_result;
+  toplevel_onc = validator.ValidateAndRepairObject(
+      &onc::kToplevelConfigurationSignature,
+      *toplevel_onc,
+      &validation_result);
+
+  if (from_policy) {
+    UMA_HISTOGRAM_BOOLEAN("Enterprise.ONC.PolicyValidation",
+                          validation_result == onc::Validator::VALID);
+  }
+
+  bool success = true;
+  if (validation_result == onc::Validator::VALID_WITH_WARNINGS) {
+    LOG(WARNING) << "ONC from " << onc::GetSourceAsString(onc_source)
+                 << " produced warnings.";
+    success = false;
+  } else if (validation_result == onc::Validator::INVALID ||
+             toplevel_onc == NULL) {
+    LOG(ERROR) << "ONC from " << onc::GetSourceAsString(onc_source)
+               << " is invalid and couldn't be repaired.";
+    return false;
+  }
+
+  base::Value* certificates_value = NULL;
+  if (toplevel_onc->RemoveWithoutPathExpansion(
+          onc::toplevel_config::kCertificates, &certificates_value)) {
+    base::ListValue* certificates_listvalue = NULL;
+    certificates_value->GetAsList(&certificates_listvalue);
+    certificates->reset(certificates_listvalue);
+  } else {
+    certificates->reset(new base::ListValue);
+  }
+
+  base::Value* network_configs_value = NULL;
+  if (toplevel_onc->RemoveWithoutPathExpansion(
+          onc::toplevel_config::kNetworkConfigurations,
+          &network_configs_value)) {
+    base::ListValue* network_configs_listvalue = NULL;
+    network_configs_value->GetAsList(&network_configs_listvalue);
+    network_configs->reset(network_configs_listvalue);

[stevenjb, 2013/04/22 16:53:41]

Could be network_configs->Swap()

[pneubeck (no reviews), 2013/04/23 18:05:25]

Done.

+  } else {
+    network_configs->reset(new base::ListValue);
+  }
+
+  return success;
+}
+
 }  // namespace onc
 }  // namespace chromeos