Set HexSSID in network config before matching it against policies

chromeos/network/managed_network_configuration_handler_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/managed_network_configuration_handler_impl.h"
 
 #include <memory>
 #include <utility>
 #include <vector>
 
@@ skipping 336 matching lines @@
       service_path, *shill_dictionary,
       NetworkConfigurationObserver::SOURCE_USER_ACTION, callback,
       error_callback);
 }
 
 void ManagedNetworkConfigurationHandlerImpl::CreateConfiguration(
     const std::string& userhash,
     const base::DictionaryValue& properties,
     const network_handler::ServiceResultCallback& callback,
     const network_handler::ErrorCallback& error_callback) const {
+  // Validate the ONC dictionary. We are liberal and ignore unknown field
+  // names. User settings are only partial ONC, thus we ignore missing fields.
+  onc::Validator validator(false,   // Ignore unknown fields.
+                           false,   // Ignore invalid recommended field names.
+                           false,   // Ignore missing fields.
+                           false);  // This ONC does not come from policy.
+
+  onc::Validator::Result validation_result;
+  std::unique_ptr<base::DictionaryValue> validated_properties =
+      validator.ValidateAndRepairObject(&onc::kNetworkConfigurationSignature,
+                                        properties, &validation_result);
+
+  if (validation_result == onc::Validator::INVALID) {
+    InvokeErrorCallback("", error_callback, kInvalidUserSettings);
+    return;
+  }
+
+  if (validation_result == onc::Validator::VALID_WITH_WARNINGS)
+    LOG(WARNING) << "Validation of ONC user settings produced warnings.";
+
+  // Fill in HexSSID field from contents of SSID field if not set already - this
+  // is required to properly match the configuration against existing policies.
+  if (validated_properties) {
+    onc::FillInHexSSIDFieldsInOncObject(onc::kNetworkConfigurationSignature,
+                                        validated_properties.get());
+  }
+
+  // Make user the network is not configured through a user policy.
   const Policies* policies = GetPoliciesForUser(userhash);
   if (!policies) {
     InvokeErrorCallback("", error_callback, kPoliciesNotInitialized);
     return;
   }
 
   if (policy_util::FindMatchingPolicy(policies->per_network_config,
-                                      properties)) {
+                                      *validated_properties)) {
     InvokeErrorCallback("", error_callback, kNetworkAlreadyConfigured);
     return;
   }
+
+  // Make user the network is not configured through a device policy.
+  policies = GetPoliciesForUser("");

[tbarzic, 2017/03/24 19:35:17]

I'm not 100% sure this is right, but not allowing a user config to override
device policy provided config (which would be in the shared profile) seems
reasonable to me.

+  if (!policies) {
+    InvokeErrorCallback("", error_callback, kPoliciesNotInitialized);
+    return;
+  }
+
+  if (policy_util::FindMatchingPolicy(policies->per_network_config,
+                                      *validated_properties)) {
+    InvokeErrorCallback("", error_callback, kNetworkAlreadyConfigured);
+    return;
+  }
 
   const NetworkProfile* profile =
       network_profile_handler_->GetProfileForUserhash(userhash);
   if (!profile) {
     InvokeErrorCallback("", error_callback, kProfileNotInitialized);
     return;
   }
 
   // TODO(pneubeck): In case of WiFi, check that no other configuration for the
   // same {SSID, mode, security} exists. We don't support such multiple
   // configurations, yet.
 
   // Generate a new GUID for this configuration. Ignore the maybe provided GUID
   // in |properties| as it is not our own and from an untrusted source.
   std::string guid = base::GenerateGUID();
   std::unique_ptr<base::DictionaryValue> shill_dictionary(
       policy_util::CreateShillConfiguration(*profile, guid,
                                             NULL,  // no global policy
                                             NULL,  // no network policy
-                                            &properties));
+                                            validated_properties.get()));
 
   network_configuration_handler_->CreateShillConfiguration(
       *shill_dictionary, NetworkConfigurationObserver::SOURCE_USER_ACTION,
       callback, error_callback);
 }
 
 void ManagedNetworkConfigurationHandlerImpl::RemoveConfiguration(
     const std::string& service_path,
     const base::Closure& callback,
     const network_handler::ErrorCallback& error_callback) const {
@@ skipping 454 matching lines @@
     std::unique_ptr<base::DictionaryValue> network_properties,
     GetDevicePropertiesCallback send_callback,
     const std::string& error_name,
     std::unique_ptr<base::DictionaryValue> error_data) {
   NET_LOG_ERROR("Error getting device properties", service_path);
   send_callback.Run(service_path, std::move(network_properties));
 }
 
 
 }  // namespace chromeos