ChromeOS: Add more host verification options for OpenVpn.

chromeos/network/onc/onc_validator.cc

Index: chromeos/network/onc/onc_validator.cc
diff --git a/chromeos/network/onc/onc_validator.cc b/chromeos/network/onc/onc_validator.cc
index 29e58ac7b53797ab4bed815e2a7d536eb00bb151..e161eb5d5d60c53e2c25920c27aa5001e634d93d 100644
--- a/chromeos/network/onc/onc_validator.cc
+++ b/chromeos/network/onc/onc_validator.cc
@@ -132,6 +132,8 @@ scoped_ptr<base::DictionaryValue> Validator::MapObject(
       valid = ValidateIPsec(onc_object, repaired.get());
     else if (&signature == &kOpenVPNSignature)
       valid = ValidateOpenVPN(onc_object, repaired.get());
+    else if (&signature == &kVerifyX509Signature)
+      valid = ValidateVerifyX509(onc_object, repaired.get());
     else if (&signature == &kCertificatePatternSignature)
       valid = ValidateCertificatePattern(onc_object, repaired.get());
     else if (&signature == &kProxySettingsSignature)
@@ -672,6 +674,21 @@ bool Validator::ValidateOpenVPN(
   return !error_on_missing_field_ || allRequiredExist;
 }
 
+bool Validator::ValidateVerifyX509(const base::DictionaryValue& onc_object,
+                                   base::DictionaryValue* result) {
+  using namespace ::onc::verify_x509;
+
+  static const char* kValidTypeValues[] =
+    {types::kName, types::kNamePrefix, types::kSubject, NULL};
+
+  if (FieldExistsAndHasNoValidValue(*result, kType, kValidTypeValues))
+    return false;
+
+  bool allRequiredExist = RequireField(*result, kName);

[armansito, 2013/11/11 20:01:41]

nit: s/allRequiredExist/all_required_exist. You could technically also just
short-circuit the call to RequireField, since you only refer to
|allRequiredExist| in the return line. I.e.:

return !error_on_missing_field_ || RequireField(*result, kName);

Unless of course you're depending on the call to RequireField to log a message.

[pneubeck (no reviews), 2013/11/12 13:11:04]

Good point. Actually, the intended behavior is:
if |error_on_missing_field_| is false, then missing required fields raise a
warning.
I.e. error_or_warning_found is true and the return value is true.

+
+  return !error_on_missing_field_ || allRequiredExist;
+}
+
 bool Validator::ValidateCertificatePattern(
     const base::DictionaryValue& onc_object,
     base::DictionaryValue* result) {