Add split tunnel interface to vpnProvider

extensions/browser/api/vpn_provider/vpn_provider_api.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/vpn_provider/vpn_provider_api.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_util.h"
 #include "base/values.h"
 #include "extensions/browser/api/vpn_provider/vpn_service.h"
 #include "extensions/browser/api/vpn_provider/vpn_service_factory.h"
 #include "extensions/common/api/vpn_provider.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
 namespace extensions {
 
 namespace {
 
 namespace api_vpn = extensions::core_api::vpn_provider;
 
 const char kCIDRSeperator[] = "/";
 
+bool CheckIPCIDRSanity(const std::string& value, bool cidr, bool ipv6) {
+  int dots = ipv6 ? 0 : 3;
+  int sep = cidr ? 1 : 0;
+  int colon = ipv6 ? 7 : 0;
+  bool hex_allowed = ipv6;

[bartfab (slow), 2015/02/20 14:56:37]

Nit: const.

+  int counter = 0;
+
+  for (const auto& elem : value) {
+    if (IsAsciiDigit(elem)) {
+      counter++;
+      continue;
+    }
+    if (elem == '.') {
+      if (!dots)
+        return false;
+      dots--;
+    } else if (elem == kCIDRSeperator[0]) {
+      if (!sep || dots || colon == 7 || !counter)
+        return false;
+      // Separator observed, no more dots and colons, only digits are allowed
+      // after observing separator. So setting hex_allowed to false.
+      sep--;
+      counter = 0;
+      colon = 0;

[bartfab (slow), 2015/02/20 14:56:37]

Since you reset |colon| here, the entire (colon < 7) check at the end of the
method becomes pointless.

+      hex_allowed = false;
+    } else if (elem == ':') {
+      if (!colon)
+        return false;
+      colon--;
+    } else if (!hex_allowed || !IsHexDigit(elem)) {
+      return false;
+    } else {

[bartfab (slow), 2015/02/20 14:56:37]

Nit: No else after return.

+      counter++;
+    }
+  }
+  return !sep && !dots && (colon < 7) && counter;
+}
+
+bool CheckIPCIDRSanityList(const std::vector<std::string>& list,
+                           bool cidr,
+                           bool ipv6) {
+  for (const auto& address : list) {
+    if (!CheckIPCIDRSanity(address, cidr, ipv6)) {
+      return false;
+    }
+  }
+  return true;
+}
+
 void ConvertParameters(const api_vpn::Parameters& parameters,
                        base::DictionaryValue* parameter_value,
                        std::string* error) {
-  std::vector<std::string> cidr_parts;
-  if (Tokenize(parameters.address, kCIDRSeperator, &cidr_parts) != 2) {
-    *error = "Invalid CIDR address.";
+  if (!CheckIPCIDRSanity(parameters.address, true /* CIDR */,
+                         false /*IPV4 */)) {
+    *error = "Address CIDR sanity check failed.";
     return;
   }
 
+  if (!CheckIPCIDRSanityList(parameters.exclusion_list, true /* CIDR */,
+                             false /*IPV4 */)) {
+    *error = "Exclusion list CIDR sanity check failed.";
+    return;
+  }
+
+  if (!CheckIPCIDRSanityList(parameters.inclusion_list, true /* CIDR */,
+                             false /*IPV4 */)) {
+    *error = "Inclusion list CIDR sanity check failed.";
+    return;
+  }
+
+  if (!CheckIPCIDRSanityList(parameters.dns_servers, false /* Not CIDR */,
+                             false /*IPV4 */)) {
+    *error = "DNS server IP sanity check failed.";
+    return;
+  }
+
+  std::vector<std::string> cidr_parts;
+  CHECK(Tokenize(parameters.address, kCIDRSeperator, &cidr_parts) == 2);
+
   parameter_value->SetStringWithoutPathExpansion(
       shill::kAddressParameterThirdPartyVpn, cidr_parts[0]);
 
   parameter_value->SetStringWithoutPathExpansion(
       shill::kSubnetPrefixParameterThirdPartyVpn, cidr_parts[1]);
 
   parameter_value->SetStringWithoutPathExpansion(
-      shill::kBypassTunnelForIpParameterThirdPartyVpn,
-      JoinString(parameters.bypass_tunnel_for_ip, shill::kIPDelimiter));
+      shill::kExclusionListParameterThirdPartyVpn,
+      JoinString(parameters.exclusion_list, shill::kIPDelimiter));
+
+  parameter_value->SetStringWithoutPathExpansion(
+      shill::kInclusionListParameterThirdPartyVpn,
+      JoinString(parameters.inclusion_list, shill::kIPDelimiter));
 
   if (parameters.mtu) {
     parameter_value->SetStringWithoutPathExpansion(
         shill::kMtuParameterThirdPartyVpn, *parameters.mtu);
   }
 
   if (parameters.broadcast_address) {
     parameter_value->SetStringWithoutPathExpansion(
         shill::kBroadcastAddressParameterThirdPartyVpn,
         *parameters.broadcast_address);
@@ skipping 172 matching lines @@
                      SignalCallCompletionSuccess,
                  this),
       base::Bind(&VpnProviderNotifyConnectionStateChangedFunction::
                      SignalCallCompletionFailure,
                  this));
 
   return RespondLater();
 }
 
 }  // namespace extensions