Autoconnect policy for CrOS.

chromeos/network/onc/onc_validator.cc

Index: chromeos/network/onc/onc_validator.cc
diff --git a/chromeos/network/onc/onc_validator.cc b/chromeos/network/onc/onc_validator.cc
index cb2d4b4a0006ed92c924a063f8eb81b3643164b9..29e58ac7b53797ab4bed815e2a7d536eb00bb151 100644
--- a/chromeos/network/onc/onc_validator.cc
+++ b/chromeos/network/onc/onc_validator.cc
@@ -385,9 +385,7 @@ bool Validator::RequireField(const base::DictionaryValue& dict,
   return false;
 }
 
-// Prohibit certificate patterns for device policy ONC so that an unmanaged user
-// won't have a certificate presented for them involuntarily.
-bool Validator::CertPatternInDevicePolicy(const std::string& cert_type) {
+bool Validator::IsCertPatternInDevicePolicy(const std::string& cert_type) {
   if (cert_type == ::onc::certificate::kPattern &&
       onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY) {
     error_or_warning_found_ = true;
@@ -398,6 +396,18 @@ bool Validator::CertPatternInDevicePolicy(const std::string& cert_type) {
   return false;
 }
 
+bool Validator::IsGlobalNetworkConfigInUserImport(
+    const base::DictionaryValue& onc_object) {
+  if (onc_source_ == ::onc::ONC_SOURCE_USER_IMPORT &&
+      onc_object.HasKey(::onc::toplevel_config::kGlobalNetworkConfiguration)) {
+    error_or_warning_found_ = true;
+    LOG(ERROR) << MessageHeader() << "GlobalNetworkConfiguration is prohibited "
+               << "in ONC user imports";
+    return true;
+  }
+  return false;
+}
+
 bool Validator::ValidateToplevelConfiguration(
     const base::DictionaryValue& onc_object,
     base::DictionaryValue* result) {
@@ -429,6 +439,9 @@ bool Validator::ValidateToplevelConfiguration(
     allRequiredExist = false;
   }
 
+  if (IsGlobalNetworkConfigInUserImport(*result))
+    return false;
+
   return !error_on_missing_field_ || allRequiredExist;
 }
 
@@ -609,7 +622,7 @@ bool Validator::ValidateIPsec(
   result->GetStringWithoutPathExpansion(::onc::vpn::kClientCertType,
                                         &cert_type);
 
-  if (CertPatternInDevicePolicy(cert_type))
+  if (IsCertPatternInDevicePolicy(cert_type))
     return false;
 
   if (cert_type == kPattern)
@@ -648,7 +661,7 @@ bool Validator::ValidateOpenVPN(
   result->GetStringWithoutPathExpansion(::onc::vpn::kClientCertType,
                                         &cert_type);
 
-  if (CertPatternInDevicePolicy(cert_type))
+  if (IsCertPatternInDevicePolicy(cert_type))
     return false;
 
   if (cert_type == kPattern)
@@ -734,7 +747,7 @@ bool Validator::ValidateEAP(const base::DictionaryValue& onc_object,
   std::string cert_type;
   result->GetStringWithoutPathExpansion(kClientCertType, &cert_type);
 
-  if (CertPatternInDevicePolicy(cert_type))
+  if (IsCertPatternInDevicePolicy(cert_type))
     return false;
 
   if (cert_type == kPattern)