ONC: Cleanup client certificate related fields.

chromeos/network/onc/onc_validator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_validator.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/json/json_writer.h"
@@ skipping 272 matching lines @@
       }
     }
 
     repaired_recommended->Append((*it)->DeepCopy());
   }
 
   result->Set(::onc::kRecommended, repaired_recommended.release());
   return true;
 }
 
+bool Validator::ValidateClientCertFields(base::DictionaryValue* result,
+                                         bool allow_cert_type_none) {
+  using namespace ::onc::client_cert;
+  const char* const kValidCertTypes[] = {kRef, kPattern};
+  std::vector<const char*> valid_cert_types(toVector(kValidCertTypes));
+  if (allow_cert_type_none)
+    valid_cert_types.push_back(kNone);
+  if (FieldExistsAndHasNoValidValue(*result, kClientCertType, valid_cert_types))
+    return false;
+
+  std::string cert_type;
+  result->GetStringWithoutPathExpansion(kClientCertType, &cert_type);
+
+  if (IsCertPatternInDevicePolicy(cert_type))
+    return false;
+
+  bool all_required_exist = true;
+
+  if (cert_type == kPattern)
+    all_required_exist &= RequireField(*result, kClientCertPattern);
+  else if (cert_type == kRef)
+    all_required_exist &= RequireField(*result, kClientCertRef);
+
+  return !error_on_missing_field_ || all_required_exist;
+}
+
 namespace {
 
 std::string JoinStringRange(const std::vector<const char*>& strings,
                             const std::string& separator) {
   std::vector<std::string> string_vector;
   std::copy(strings.begin(), strings.end(), std::back_inserter(string_vector));
   return JoinString(string_vector, separator);
 }
 
 }  // namespace
@@ skipping 90 matching lines @@
       error_or_warning_found_ = true;
       LOG(ERROR) << MessageHeader() << "Found a duplicate GUID " << guid << ".";
       return false;
     }
     guids->insert(guid);
   }
   return true;
 }
 
 bool Validator::IsCertPatternInDevicePolicy(const std::string& cert_type) {
-  if (cert_type == ::onc::certificate::kPattern &&
+  if (cert_type == ::onc::client_cert::kPattern &&
       onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY) {
     error_or_warning_found_ = true;
     LOG(ERROR) << MessageHeader() << "Client certificate patterns are "
                << "prohibited in ONC device policies.";
     return true;
   }
   return false;
 }
 
 bool Validator::IsGlobalNetworkConfigInUserImport(
@@ skipping 80 matching lines @@
       NOTREACHED();
     }
   }
 
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateEthernet(base::DictionaryValue* result) {
   using namespace ::onc::ethernet;
 
-  const char* const kValidAuthentications[] = {kNone, k8021X};
+  const char* const kValidAuthentications[] = {kAuthenticationNone, k8021X};
   const std::vector<const char*> valid_authentications(
       toVector(kValidAuthentications));
   if (FieldExistsAndHasNoValidValue(
           *result, kAuthentication, valid_authentications)) {
     return false;
   }
 
   bool all_required_exist = true;
   std::string auth;
   result->GetStringWithoutPathExpansion(kAuthentication, &auth);
@@ skipping 25 matching lines @@
   bool all_required_exist = RequireField(*result, kIPAddress) &&
                             RequireField(*result, kRoutingPrefix) &&
                             RequireField(*result, ::onc::ipconfig::kType);
 
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateWiFi(base::DictionaryValue* result) {
   using namespace ::onc::wifi;
 
-  const char* const kValidSecurities[] = {kNone, kWEP_PSK, kWEP_8021X, kWPA_PSK,
-                                          kWPA_EAP};
+  const char* const kValidSecurities[] = {kSecurityNone, kWEP_PSK, kWEP_8021X,
+                                          kWPA_PSK, kWPA_EAP};
   const std::vector<const char*> valid_securities(toVector(kValidSecurities));
   if (FieldExistsAndHasNoValidValue(*result, kSecurity, valid_securities))
     return false;
 
   bool all_required_exist =
       RequireField(*result, kSecurity) && RequireField(*result, kSSID);
 
   std::string security;
   result->GetStringWithoutPathExpansion(kSecurity, &security);
   if (security == kWEP_8021X || security == kWPA_EAP)
@@ skipping 22 matching lines @@
   } else if (type == kTypeL2TP_IPsec) {
     all_required_exist &=
         RequireField(*result, kIPsec) && RequireField(*result, kL2TP);
   }
 
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateIPsec(base::DictionaryValue* result) {
   using namespace ::onc::ipsec;
-  using namespace ::onc::certificate;
 
   const char* const kValidAuthentications[] = {kPSK, kCert};
   const std::vector<const char*> valid_authentications(
       toVector(kValidAuthentications));
-  const char* const kValidCertTypes[] = {kRef, kPattern};
-  const std::vector<const char*> valid_cert_types(toVector(kValidCertTypes));
   if (FieldExistsAndHasNoValidValue(
           *result, kAuthenticationType, valid_authentications) ||
-      FieldExistsAndHasNoValidValue(
-          *result, ::onc::vpn::kClientCertType, valid_cert_types) ||
       FieldExistsAndIsEmpty(*result, kServerCARefs)) {
     return false;
   }
 
   if (result->HasKey(kServerCARefs) && result->HasKey(kServerCARef)) {
     error_or_warning_found_ = true;
     LOG(ERROR) << MessageHeader() << "At most one of " << kServerCARefs
                << " and " << kServerCARef << " can be set.";
     return false;
   }
 
+  if (!ValidateClientCertFields(result,
+                                false /* don't allow ClientCertType None */)) {
+    return false;
+  }
+
   bool all_required_exist = RequireField(*result, kAuthenticationType) &&
                             RequireField(*result, kIKEVersion);
   std::string auth;
   result->GetStringWithoutPathExpansion(kAuthenticationType, &auth);
   bool has_server_ca_cert =
       result->HasKey(kServerCARefs) || result->HasKey(kServerCARef);
   if (auth == kCert) {
-    all_required_exist &= RequireField(*result, ::onc::vpn::kClientCertType);
+    all_required_exist &=
+        RequireField(*result, ::onc::client_cert::kClientCertType);
     if (!has_server_ca_cert) {
       all_required_exist = false;
       error_or_warning_found_ = true;
       std::string message = MessageHeader() + "The required field '" +
                             kServerCARefs + "' is missing.";
       if (error_on_missing_field_)
         LOG(ERROR) << message;
       else
         LOG(WARNING) << message;
     }
   } else if (has_server_ca_cert) {
     error_or_warning_found_ = true;
     LOG(ERROR) << MessageHeader() << kServerCARefs << " (or " << kServerCARef
                << ") can only be set if " << kAuthenticationType
                << " is set to " << kCert << ".";
     return false;
   }
 
-  std::string cert_type;
-  result->GetStringWithoutPathExpansion(::onc::vpn::kClientCertType,
-                                        &cert_type);
-
-  if (IsCertPatternInDevicePolicy(cert_type))
-    return false;
-
-  if (cert_type == kPattern)
-    all_required_exist &= RequireField(*result, ::onc::vpn::kClientCertPattern);
-  else if (cert_type == kRef)
-    all_required_exist &= RequireField(*result, ::onc::vpn::kClientCertRef);
-
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateOpenVPN(base::DictionaryValue* result) {
   using namespace ::onc::openvpn;
-  using namespace ::onc::certificate;
 
   const char* const kValidAuthRetryValues[] = {::onc::openvpn::kNone, kInteract,
                                                kNoInteract};
   const std::vector<const char*> valid_auth_retry_values(
       toVector(kValidAuthRetryValues));
-  const char* const kValidCertTypes[] = {::onc::certificate::kNone, kRef,
-                                         kPattern};
-  const std::vector<const char*> valid_cert_types(toVector(kValidCertTypes));
   const char* const kValidCertTlsValues[] = {::onc::openvpn::kNone,
                                              ::onc::openvpn::kServer};
   const std::vector<const char*> valid_cert_tls_values(
       toVector(kValidCertTlsValues));
 
   if (FieldExistsAndHasNoValidValue(
           *result, kAuthRetry, valid_auth_retry_values) ||
       FieldExistsAndHasNoValidValue(
-          *result, ::onc::vpn::kClientCertType, valid_cert_types) ||
-      FieldExistsAndHasNoValidValue(
           *result, kRemoteCertTLS, valid_cert_tls_values) ||
       FieldExistsAndIsEmpty(*result, kServerCARefs)) {
     return false;
   }
 
   if (result->HasKey(kServerCARefs) && result->HasKey(kServerCARef)) {
     error_or_warning_found_ = true;
     LOG(ERROR) << MessageHeader() << "At most one of " << kServerCARefs
                << " and " << kServerCARef << " can be set.";
     return false;
   }
 
-  bool all_required_exist = RequireField(*result, ::onc::vpn::kClientCertType);
-  std::string cert_type;
-  result->GetStringWithoutPathExpansion(::onc::vpn::kClientCertType,
-                                        &cert_type);
-
-  if (IsCertPatternInDevicePolicy(cert_type))
+  if (!ValidateClientCertFields(result, true /* allow ClientCertType None */))
     return false;
 
-  if (cert_type == kPattern)
-    all_required_exist &= RequireField(*result, ::onc::vpn::kClientCertPattern);
-  else if (cert_type == kRef)
-    all_required_exist &= RequireField(*result, ::onc::vpn::kClientCertRef);
+  bool all_required_exist =
+      RequireField(*result, ::onc::client_cert::kClientCertType);
 
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateVerifyX509(base::DictionaryValue* result) {
   using namespace ::onc::verify_x509;
 
   const char* const kValidTypes[] = {types::kName, types::kNamePrefix,
                                      types::kSubject};
   const std::vector<const char*> valid_types(toVector(kValidTypes));
 
   if (FieldExistsAndHasNoValidValue(*result, kType, valid_types))
     return false;
 
   bool all_required_exist = RequireField(*result, kName);
 
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateCertificatePattern(base::DictionaryValue* result) {
-  using namespace ::onc::certificate;
+  using namespace ::onc::client_cert;
 
   bool all_required_exist = true;
   if (!result->HasKey(kSubject) && !result->HasKey(kIssuer) &&
       !result->HasKey(kIssuerCARef)) {
     error_or_warning_found_ = true;
     all_required_exist = false;
     std::string message = MessageHeader() + "None of the fields '" + kSubject +
         "', '" + kIssuer + "', and '" + kIssuerCARef +
         "' is present, but at least one is required.";
     if (error_on_missing_field_)
@@ skipping 28 matching lines @@
   using namespace ::onc::proxy;
 
   bool all_required_exist =
       RequireField(*result, kHost) && RequireField(*result, kPort);
 
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateEAP(base::DictionaryValue* result) {
   using namespace ::onc::eap;
-  using namespace ::onc::certificate;
 
   const char* const kValidInnerValues[] = {kAutomatic, kMD5, kMSCHAPv2, kPAP};
   const std::vector<const char*> valid_inner_values(
       toVector(kValidInnerValues));
   const char* const kValidOuterValues[] = {
       kPEAP, kEAP_TLS, kEAP_TTLS, kLEAP, kEAP_SIM, kEAP_FAST, kEAP_AKA};
   const std::vector<const char*> valid_outer_values(
       toVector(kValidOuterValues));
-  const char* const kValidCertTypes[] = {kRef, kPattern};
-  const std::vector<const char*> valid_cert_types(toVector(kValidCertTypes));
 
   if (FieldExistsAndHasNoValidValue(*result, kInner, valid_inner_values) ||
       FieldExistsAndHasNoValidValue(*result, kOuter, valid_outer_values) ||
-      FieldExistsAndHasNoValidValue(
-          *result, kClientCertType, valid_cert_types) ||
       FieldExistsAndIsEmpty(*result, kServerCARefs)) {
     return false;
   }
 
   if (result->HasKey(kServerCARefs) && result->HasKey(kServerCARef)) {
     error_or_warning_found_ = true;
     LOG(ERROR) << MessageHeader() << "At most one of " << kServerCARefs
                << " and " << kServerCARef << " can be set.";
     return false;
   }
 
+  if (!ValidateClientCertFields(result,
+                                false /* don't allow ClientCertType None */)) {
+    return false;
+  }
+
   bool all_required_exist = RequireField(*result, kOuter);
-  std::string cert_type;
-  result->GetStringWithoutPathExpansion(kClientCertType, &cert_type);
-
-  if (IsCertPatternInDevicePolicy(cert_type))
-    return false;
-
-  if (cert_type == kPattern)
-    all_required_exist &= RequireField(*result, kClientCertPattern);
-  else if (cert_type == kRef)
-    all_required_exist &= RequireField(*result, kClientCertRef);
 
   return !error_on_missing_field_ || all_required_exist;
 }
 
 bool Validator::ValidateCertificate(base::DictionaryValue* result) {
   using namespace ::onc::certificate;
 
   const char* const kValidTypes[] = {kClient, kServer, kAuthority};
   const std::vector<const char*> valid_types(toVector(kValidTypes));
   if (FieldExistsAndHasNoValidValue(*result, kType, valid_types) ||
@@ skipping 31 matching lines @@
 }
 
 std::string Validator::MessageHeader() {
   std::string path = path_.empty() ? "toplevel" : JoinString(path_, ".");
   std::string message = "At " + path + ": ";
   return message;
 }
 
 }  // namespace onc
 }  // namespace chromeos