chromeos/network/onc/onc_utils.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/network/onc/onc_utils.h"
   6
   7 #include "base/base64.h"
   8 #include "base/json/json_reader.h"
   9 #include "base/logging.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/strings/string_util.h"
  12 #include "base/values.h"
  13 #include "chromeos/network/network_event_log.h"
  14 #include "chromeos/network/onc/onc_mapper.h"
  15 #include "chromeos/network/onc/onc_signature.h"
  16 #include "chromeos/network/onc/onc_utils.h"
  17 #include "chromeos/network/onc/onc_validator.h"
  18 #include "crypto/encryptor.h"
  19 #include "crypto/hmac.h"
  20 #include "crypto/symmetric_key.h"
  21 #include "net/cert/pem_tokenizer.h"
  22 #include "net/cert/x509_certificate.h"
  23
  24 #define ONC_LOG_WARNING(message) NET_LOG_WARNING("ONC", message)
  25 #define ONC_LOG_ERROR(message) NET_LOG_ERROR("ONC", message)
  26
  27 using namespace ::onc;
  28
  29 namespace chromeos {
  30 namespace onc {
  31
  32 namespace {
  33
  34 const char kUnableToDecrypt[] = "Unable to decrypt encrypted ONC";
  35 const char kUnableToDecode[] = "Unable to decode encrypted ONC";
  36
  37 }  // namespace
  38
  39 const char kEmptyUnencryptedConfiguration[] =
  40     "{\"Type\":\"UnencryptedConfiguration\",\"NetworkConfigurations\":[],"
  41     "\"Certificates\":[]}";
  42
  43 scoped_ptr<base::DictionaryValue> ReadDictionaryFromJson(
  44     const std::string& json) {
  45   std::string error;
  46   base::Value* root = base::JSONReader::ReadAndReturnError(
  47       json, base::JSON_ALLOW_TRAILING_COMMAS, NULL, &error);
  48
  49   base::DictionaryValue* dict_ptr = NULL;
  50   if (!root || !root->GetAsDictionary(&dict_ptr)) {
  51     ONC_LOG_ERROR("Invalid JSON Dictionary: " + error);
  52     delete root;
  53   }
  54
  55   return make_scoped_ptr(dict_ptr);
  56 }
  57
  58 scoped_ptr<base::DictionaryValue> Decrypt(const std::string& passphrase,
  59                                           const base::DictionaryValue& root) {
  60   const int kKeySizeInBits = 256;
  61   const int kMaxIterationCount = 500000;
  62   std::string onc_type;
  63   std::string initial_vector;
  64   std::string salt;
  65   std::string cipher;
  66   std::string stretch_method;
  67   std::string hmac_method;
  68   std::string hmac;
  69   int iterations;
  70   std::string ciphertext;
  71
  72   if (!root.GetString(encrypted::kCiphertext, &ciphertext) ||
  73       !root.GetString(encrypted::kCipher, &cipher) ||
  74       !root.GetString(encrypted::kHMAC, &hmac) ||
  75       !root.GetString(encrypted::kHMACMethod, &hmac_method) ||
  76       !root.GetString(encrypted::kIV, &initial_vector) ||
  77       !root.GetInteger(encrypted::kIterations, &iterations) ||
  78       !root.GetString(encrypted::kSalt, &salt) ||
  79       !root.GetString(encrypted::kStretch, &stretch_method) ||
  80       !root.GetString(toplevel_config::kType, &onc_type) ||
  81       onc_type != toplevel_config::kEncryptedConfiguration) {
  82
  83     ONC_LOG_ERROR("Encrypted ONC malformed.");
  84     return scoped_ptr<base::DictionaryValue>();
  85   }
  86
  87   if (hmac_method != encrypted::kSHA1 ||
  88       cipher != encrypted::kAES256 ||
  89       stretch_method != encrypted::kPBKDF2) {
  90     ONC_LOG_ERROR("Encrypted ONC unsupported encryption scheme.");
  91     return scoped_ptr<base::DictionaryValue>();
  92   }
  93
  94   // Make sure iterations != 0, since that's not valid.
  95   if (iterations == 0) {
  96     ONC_LOG_ERROR(kUnableToDecrypt);
  97     return scoped_ptr<base::DictionaryValue>();
  98   }
  99
 100   // Simply a sanity check to make sure we can't lock up the machine
 101   // for too long with a huge number (or a negative number).
 102   if (iterations < 0 || iterations > kMaxIterationCount) {
 103     ONC_LOG_ERROR("Too many iterations in encrypted ONC");
 104     return scoped_ptr<base::DictionaryValue>();
 105   }
 106
 107   if (!base::Base64Decode(salt, &salt)) {
 108     ONC_LOG_ERROR(kUnableToDecode);
 109     return scoped_ptr<base::DictionaryValue>();
 110   }
 111
 112   scoped_ptr<crypto::SymmetricKey> key(
 113       crypto::SymmetricKey::DeriveKeyFromPassword(crypto::SymmetricKey::AES,
 114                                                   passphrase,
 115                                                   salt,
 116                                                   iterations,
 117                                                   kKeySizeInBits));
 118
 119   if (!base::Base64Decode(initial_vector, &initial_vector)) {
 120     ONC_LOG_ERROR(kUnableToDecode);
 121     return scoped_ptr<base::DictionaryValue>();
 122   }
 123   if (!base::Base64Decode(ciphertext, &ciphertext)) {
 124     ONC_LOG_ERROR(kUnableToDecode);
 125     return scoped_ptr<base::DictionaryValue>();
 126   }
 127   if (!base::Base64Decode(hmac, &hmac)) {
 128     ONC_LOG_ERROR(kUnableToDecode);
 129     return scoped_ptr<base::DictionaryValue>();
 130   }
 131
 132   crypto::HMAC hmac_verifier(crypto::HMAC::SHA1);
 133   if (!hmac_verifier.Init(key.get()) ||
 134       !hmac_verifier.Verify(ciphertext, hmac)) {
 135     ONC_LOG_ERROR(kUnableToDecrypt);
 136     return scoped_ptr<base::DictionaryValue>();
 137   }
 138
 139   crypto::Encryptor decryptor;
 140   if (!decryptor.Init(key.get(), crypto::Encryptor::CBC, initial_vector))  {
 141     ONC_LOG_ERROR(kUnableToDecrypt);
 142     return scoped_ptr<base::DictionaryValue>();
 143   }
 144
 145   std::string plaintext;
 146   if (!decryptor.Decrypt(ciphertext, &plaintext)) {
 147     ONC_LOG_ERROR(kUnableToDecrypt);
 148     return scoped_ptr<base::DictionaryValue>();
 149   }
 150
 151   scoped_ptr<base::DictionaryValue> new_root =
 152       ReadDictionaryFromJson(plaintext);
 153   if (new_root.get() == NULL) {
 154     ONC_LOG_ERROR("Property dictionary malformed.");
 155     return scoped_ptr<base::DictionaryValue>();
 156   }
 157
 158   return new_root.Pass();
 159 }
 160
 161 std::string GetSourceAsString(ONCSource source) {
 162   switch (source) {
 163     case ONC_SOURCE_UNKNOWN:
 164       return "unknown";
 165     case ONC_SOURCE_NONE:
 166       return "none";
 167     case ONC_SOURCE_DEVICE_POLICY:
 168       return "device policy";
 169     case ONC_SOURCE_USER_POLICY:
 170       return "user policy";
 171     case ONC_SOURCE_USER_IMPORT:
 172       return "user import";
 173   }
 174   NOTREACHED() << "unknown ONC source " << source;
 175   return "unknown";
 176 }
 177
 178 void ExpandField(const std::string& fieldname,
 179                  const StringSubstitution& substitution,
 180                  base::DictionaryValue* onc_object) {
 181   std::string user_string;
 182   if (!onc_object->GetStringWithoutPathExpansion(fieldname, &user_string))
 183     return;
 184
 185   std::string login_id;
 186   if (substitution.GetSubstitute(substitutes::kLoginIDField, &login_id)) {
 187     ReplaceSubstringsAfterOffset(&user_string, 0,
 188                                  substitutes::kLoginIDField,
 189                                  login_id);
 190   }
 191
 192   std::string email;
 193   if (substitution.GetSubstitute(substitutes::kEmailField, &email)) {
 194     ReplaceSubstringsAfterOffset(&user_string, 0,
 195                                  substitutes::kEmailField,
 196                                  email);
 197   }
 198
 199   onc_object->SetStringWithoutPathExpansion(fieldname, user_string);
 200 }
 201
 202 void ExpandStringsInOncObject(
 203     const OncValueSignature& signature,
 204     const StringSubstitution& substitution,
 205     base::DictionaryValue* onc_object) {
 206   if (&signature == &kEAPSignature) {
 207     ExpandField(eap::kAnonymousIdentity, substitution, onc_object);
 208     ExpandField(eap::kIdentity, substitution, onc_object);
 209   } else if (&signature == &kL2TPSignature ||
 210              &signature == &kOpenVPNSignature) {
 211     ExpandField(vpn::kUsername, substitution, onc_object);
 212   }
 213
 214   // Recurse into nested objects.
 215   for (base::DictionaryValue::Iterator it(*onc_object); !it.IsAtEnd();
 216        it.Advance()) {
 217     base::DictionaryValue* inner_object = NULL;
 218     if (!onc_object->GetDictionaryWithoutPathExpansion(it.key(), &inner_object))
 219       continue;
 220
 221     const OncFieldSignature* field_signature =
 222         GetFieldSignature(signature, it.key());
 223     if (!field_signature)
 224       continue;
 225
 226     ExpandStringsInOncObject(*field_signature->value_signature,
 227                              substitution, inner_object);
 228   }
 229 }
 230
 231 void ExpandStringsInNetworks(const StringSubstitution& substitution,
 232                              base::ListValue* network_configs) {
 233   for (base::ListValue::iterator it = network_configs->begin();
 234        it != network_configs->end(); ++it) {
 235     base::DictionaryValue* network = NULL;
 236     (*it)->GetAsDictionary(&network);
 237     DCHECK(network);
 238     ExpandStringsInOncObject(
 239         kNetworkConfigurationSignature, substitution, network);
 240   }
 241 }
 242
 243 namespace {
 244
 245 class OncMaskValues : public Mapper {
 246  public:
 247   static scoped_ptr<base::DictionaryValue> Mask(
 248       const OncValueSignature& signature,
 249       const base::DictionaryValue& onc_object,
 250       const std::string& mask) {
 251     OncMaskValues masker(mask);
 252     bool unused_error;
 253     return masker.MapObject(signature, onc_object, &unused_error);
 254   }
 255
 256  protected:
 257   explicit OncMaskValues(const std::string& mask)
 258       : mask_(mask) {
 259   }
 260
 261   virtual scoped_ptr<base::Value> MapField(
 262       const std::string& field_name,
 263       const OncValueSignature& object_signature,
 264       const base::Value& onc_value,
 265       bool* found_unknown_field,
 266       bool* error) OVERRIDE {
 267     if (FieldIsCredential(object_signature, field_name)) {
 268       return scoped_ptr<base::Value>(new base::StringValue(mask_));
 269     } else {
 270       return Mapper::MapField(field_name, object_signature, onc_value,
 271                               found_unknown_field, error);
 272     }
 273   }
 274
 275   // Mask to insert in place of the sensitive values.
 276   std::string mask_;
 277 };
 278
 279 }  // namespace
 280
 281 scoped_ptr<base::DictionaryValue> MaskCredentialsInOncObject(
 282     const OncValueSignature& signature,
 283     const base::DictionaryValue& onc_object,
 284     const std::string& mask) {
 285   return OncMaskValues::Mask(signature, onc_object, mask);
 286 }
 287
 288 namespace {
 289
 290 std::string DecodePEM(const std::string& pem_encoded) {
 291   // The PEM block header used for DER certificates
 292   const char kCertificateHeader[] = "CERTIFICATE";
 293
 294   // This is an older PEM marker for DER certificates.
 295   const char kX509CertificateHeader[] = "X509 CERTIFICATE";
 296
 297   std::vector<std::string> pem_headers;
 298   pem_headers.push_back(kCertificateHeader);
 299   pem_headers.push_back(kX509CertificateHeader);
 300
 301   net::PEMTokenizer pem_tokenizer(pem_encoded, pem_headers);
 302   std::string decoded;
 303   if (pem_tokenizer.GetNext()) {
 304     decoded = pem_tokenizer.data();
 305   } else {
 306     // If we failed to read the data as a PEM file, then try plain base64 decode
 307     // in case the PEM marker strings are missing. For this to work, there has
 308     // to be no white space, and it has to only contain the base64-encoded data.
 309     if (!base::Base64Decode(pem_encoded, &decoded)) {
 310       LOG(ERROR) << "Unable to base64 decode X509 data: " << pem_encoded;
 311       return std::string();
 312     }
 313   }
 314   return decoded;
 315 }
 316
 317 CertPEMsByGUIDMap GetServerAndCACertsByGUID(
 318     const base::ListValue& certificates) {
 319   CertPEMsByGUIDMap certs_by_guid;
 320   for (base::ListValue::const_iterator it = certificates.begin();
 321       it != certificates.end(); ++it) {
 322     base::DictionaryValue* cert = NULL;
 323     (*it)->GetAsDictionary(&cert);
 324
 325     std::string guid;
 326     cert->GetStringWithoutPathExpansion(certificate::kGUID, &guid);
 327     std::string cert_type;
 328     cert->GetStringWithoutPathExpansion(certificate::kType, &cert_type);
 329     if (cert_type != certificate::kServer &&
 330         cert_type != certificate::kAuthority) {
 331       continue;
 332     }
 333     std::string x509_data;
 334     cert->GetStringWithoutPathExpansion(certificate::kX509, &x509_data);
 335
 336     std::string der = DecodePEM(x509_data);
 337     std::string pem;
 338     if (der.empty() || !net::X509Certificate::GetPEMEncodedFromDER(der, &pem)) {
 339       LOG(ERROR) << "Certificate with GUID " << guid
 340                  << " is not in PEM encoding.";
 341       continue;
 342     }
 343     certs_by_guid[guid] = pem;
 344   }
 345
 346   return certs_by_guid;
 347 }
 348
 349 }  // namespace
 350
 351 bool ParseAndValidateOncForImport(const std::string& onc_blob,
 352                                   ONCSource onc_source,
 353                                   const std::string& passphrase,
 354                                   base::ListValue* network_configs,
 355                                   base::DictionaryValue* global_network_config,
 356                                   base::ListValue* certificates) {
 357   network_configs->Clear();
 358   global_network_config->Clear();
 359   certificates->Clear();
 360   if (onc_blob.empty())
 361     return true;
 362
 363   scoped_ptr<base::DictionaryValue> toplevel_onc =
 364       ReadDictionaryFromJson(onc_blob);
 365   if (toplevel_onc.get() == NULL) {
 366     LOG(ERROR) << "ONC loaded from " << GetSourceAsString(onc_source)
 367                << " is not a valid JSON dictionary.";
 368     return false;
 369   }
 370
 371   // Check and see if this is an encrypted ONC file. If so, decrypt it.
 372   std::string onc_type;
 373   toplevel_onc->GetStringWithoutPathExpansion(toplevel_config::kType,
 374                                               &onc_type);
 375   if (onc_type == toplevel_config::kEncryptedConfiguration) {
 376     toplevel_onc = Decrypt(passphrase, *toplevel_onc);
 377     if (toplevel_onc.get() == NULL) {
 378       LOG(ERROR) << "Couldn't decrypt the ONC from "
 379                  << GetSourceAsString(onc_source);
 380       return false;
 381     }
 382   }
 383
 384   bool from_policy = (onc_source == ONC_SOURCE_USER_POLICY ||
 385                       onc_source == ONC_SOURCE_DEVICE_POLICY);
 386
 387   // Validate the ONC dictionary. We are liberal and ignore unknown field
 388   // names and ignore invalid field names in kRecommended arrays.
 389   Validator validator(false,  // Ignore unknown fields.
 390                       false,  // Ignore invalid recommended field names.
 391                       true,   // Fail on missing fields.
 392                       from_policy);
 393   validator.SetOncSource(onc_source);
 394
 395   Validator::Result validation_result;
 396   toplevel_onc = validator.ValidateAndRepairObject(
 397       &kToplevelConfigurationSignature,
 398       *toplevel_onc,
 399       &validation_result);
 400
 401   if (from_policy) {
 402     UMA_HISTOGRAM_BOOLEAN("Enterprise.ONC.PolicyValidation",
 403                           validation_result == Validator::VALID);
 404   }
 405
 406   bool success = true;
 407   if (validation_result == Validator::VALID_WITH_WARNINGS) {
 408     LOG(WARNING) << "ONC from " << GetSourceAsString(onc_source)
 409                  << " produced warnings.";
 410     success = false;
 411   } else if (validation_result == Validator::INVALID || toplevel_onc == NULL) {
 412     LOG(ERROR) << "ONC from " << GetSourceAsString(onc_source)
 413                << " is invalid and couldn't be repaired.";
 414     return false;
 415   }
 416
 417   base::ListValue* validated_certs = NULL;
 418   if (toplevel_onc->GetListWithoutPathExpansion(toplevel_config::kCertificates,
 419                                                 &validated_certs)) {
 420     certificates->Swap(validated_certs);
 421   }
 422
 423   base::ListValue* validated_networks = NULL;
 424   if (toplevel_onc->GetListWithoutPathExpansion(
 425           toplevel_config::kNetworkConfigurations, &validated_networks)) {
 426     CertPEMsByGUIDMap server_and_ca_certs =
 427         GetServerAndCACertsByGUID(*certificates);
 428
 429     if (!ResolveServerCertRefsInNetworks(server_and_ca_certs,
 430                                          validated_networks)) {
 431       LOG(ERROR) << "Some certificate references in the ONC policy for source "
 432                  << GetSourceAsString(onc_source) << " could not be resolved.";
 433       success = false;
 434     }
 435
 436     network_configs->Swap(validated_networks);
 437   }
 438
 439   base::DictionaryValue* validated_global_config = NULL;
 440   if (toplevel_onc->GetDictionaryWithoutPathExpansion(
 441           toplevel_config::kGlobalNetworkConfiguration,
 442           &validated_global_config)) {
 443     global_network_config->Swap(validated_global_config);
 444   }
 445
 446   return success;
 447 }
 448
 449 scoped_refptr<net::X509Certificate> DecodePEMCertificate(
 450     const std::string& pem_encoded) {
 451   std::string decoded = DecodePEM(pem_encoded);
 452   scoped_refptr<net::X509Certificate> cert =
 453       net::X509Certificate::CreateFromBytes(decoded.data(), decoded.size());
 454   LOG_IF(ERROR, !cert.get()) << "Couldn't create certificate from X509 data: "
 455                              << decoded;
 456   return cert;
 457 }
 458
 459 namespace {
 460
 461 bool GUIDRefToPEMEncoding(const CertPEMsByGUIDMap& certs_by_guid,
 462                           const std::string& guid_ref,
 463                           std::string* pem_encoded) {
 464   CertPEMsByGUIDMap::const_iterator it = certs_by_guid.find(guid_ref);
 465   if (it == certs_by_guid.end()) {
 466     LOG(ERROR) << "Couldn't resolve certificate reference " << guid_ref;
 467     return false;
 468   }
 469   *pem_encoded = it->second;
 470   if (pem_encoded->empty()) {
 471     LOG(ERROR) << "Couldn't PEM-encode certificate with GUID " << guid_ref;
 472     return false;
 473   }
 474   return true;
 475 }
 476
 477 bool ResolveSingleCertRef(const CertPEMsByGUIDMap& certs_by_guid,
 478                           const std::string& key_guid_ref,
 479                           const std::string& key_pem,
 480                           base::DictionaryValue* onc_object) {
 481   std::string guid_ref;
 482   if (!onc_object->GetStringWithoutPathExpansion(key_guid_ref, &guid_ref))
 483     return true;
 484
 485   std::string pem_encoded;
 486   if (!GUIDRefToPEMEncoding(certs_by_guid, guid_ref, &pem_encoded))
 487     return false;
 488
 489   onc_object->RemoveWithoutPathExpansion(key_guid_ref, NULL);
 490   onc_object->SetStringWithoutPathExpansion(key_pem, pem_encoded);
 491   return true;
 492 }
 493
 494 bool ResolveCertRefList(const CertPEMsByGUIDMap& certs_by_guid,
 495                         const std::string& key_guid_ref_list,
 496                         const std::string& key_pem_list,
 497                         base::DictionaryValue* onc_object) {
 498   const base::ListValue* guid_ref_list = NULL;
 499   if (!onc_object->GetListWithoutPathExpansion(key_guid_ref_list,
 500                                                &guid_ref_list)) {
 501     return true;
 502   }
 503
 504   scoped_ptr<base::ListValue> pem_list(new base::ListValue);
 505   for (base::ListValue::const_iterator it = guid_ref_list->begin();
 506        it != guid_ref_list->end(); ++it) {
 507     std::string guid_ref;
 508     (*it)->GetAsString(&guid_ref);
 509
 510     std::string pem_encoded;
 511     if (!GUIDRefToPEMEncoding(certs_by_guid, guid_ref, &pem_encoded))
 512       return false;
 513
 514     pem_list->AppendString(pem_encoded);
 515   }
 516
 517   onc_object->RemoveWithoutPathExpansion(key_guid_ref_list, NULL);
 518   onc_object->SetWithoutPathExpansion(key_pem_list, pem_list.release());
 519   return true;
 520 }
 521
 522 bool ResolveSingleCertRefToList(const CertPEMsByGUIDMap& certs_by_guid,
 523                                 const std::string& key_guid_ref,
 524                                 const std::string& key_pem_list,
 525                                 base::DictionaryValue* onc_object) {
 526   std::string guid_ref;
 527   if (!onc_object->GetStringWithoutPathExpansion(key_guid_ref, &guid_ref))
 528     return true;
 529
 530   std::string pem_encoded;
 531   if (!GUIDRefToPEMEncoding(certs_by_guid, guid_ref, &pem_encoded))
 532     return false;
 533
 534   scoped_ptr<base::ListValue> pem_list(new base::ListValue);
 535   pem_list->AppendString(pem_encoded);
 536   onc_object->RemoveWithoutPathExpansion(key_guid_ref, NULL);
 537   onc_object->SetWithoutPathExpansion(key_pem_list, pem_list.release());
 538   return true;
 539 }
 540
 541 // Resolves the reference list at |key_guid_refs| if present and otherwise the
 542 // single reference at |key_guid_ref|. Returns whether the respective resolving
 543 // was successful.
 544 bool ResolveCertRefsOrRefToList(const CertPEMsByGUIDMap& certs_by_guid,
 545                                 const std::string& key_guid_refs,
 546                                 const std::string& key_guid_ref,
 547                                 const std::string& key_pem_list,
 548                                 base::DictionaryValue* onc_object) {
 549   if (onc_object->HasKey(key_guid_refs)) {
 550     if (onc_object->HasKey(key_guid_ref)) {
 551       LOG(ERROR) << "Found both " << key_guid_refs << " and " << key_guid_ref
 552                  << ". Ignoring and removing the latter.";
 553       onc_object->RemoveWithoutPathExpansion(key_guid_ref, NULL);
 554     }
 555     return ResolveCertRefList(
 556         certs_by_guid, key_guid_refs, key_pem_list, onc_object);
 557   }
 558
 559   // Only resolve |key_guid_ref| if |key_guid_refs| isn't present.
 560   return ResolveSingleCertRefToList(
 561       certs_by_guid, key_guid_ref, key_pem_list, onc_object);
 562 }
 563
 564 bool ResolveServerCertRefsInObject(const CertPEMsByGUIDMap& certs_by_guid,
 565                                    const OncValueSignature& signature,
 566                                    base::DictionaryValue* onc_object) {
 567   if (&signature == &kCertificatePatternSignature) {
 568     if (!ResolveCertRefList(certs_by_guid,
 569                             client_cert::kIssuerCARef,
 570                             client_cert::kIssuerCAPEMs,
 571                             onc_object)) {
 572       return false;
 573     }
 574   } else if (&signature == &kEAPSignature) {
 575     if (!ResolveCertRefsOrRefToList(certs_by_guid,
 576                                     eap::kServerCARefs,
 577                                     eap::kServerCARef,
 578                                     eap::kServerCAPEMs,
 579                                     onc_object)) {
 580       return false;
 581     }
 582   } else if (&signature == &kIPsecSignature) {
 583     if (!ResolveCertRefsOrRefToList(certs_by_guid,
 584                                     ipsec::kServerCARefs,
 585                                     ipsec::kServerCARef,
 586                                     ipsec::kServerCAPEMs,
 587                                     onc_object)) {
 588       return false;
 589     }
 590   } else if (&signature == &kIPsecSignature ||
 591              &signature == &kOpenVPNSignature) {
 592     if (!ResolveSingleCertRef(certs_by_guid,
 593                               openvpn::kServerCertRef,
 594                               openvpn::kServerCertPEM,
 595                               onc_object) ||
 596         !ResolveCertRefsOrRefToList(certs_by_guid,
 597                                     openvpn::kServerCARefs,
 598                                     openvpn::kServerCARef,
 599                                     openvpn::kServerCAPEMs,
 600                                     onc_object)) {
 601       return false;
 602     }
 603   }
 604
 605   // Recurse into nested objects.
 606   for (base::DictionaryValue::Iterator it(*onc_object); !it.IsAtEnd();
 607        it.Advance()) {
 608     base::DictionaryValue* inner_object = NULL;
 609     if (!onc_object->GetDictionaryWithoutPathExpansion(it.key(), &inner_object))
 610       continue;
 611
 612     const OncFieldSignature* field_signature =
 613         GetFieldSignature(signature, it.key());
 614     if (!field_signature)
 615       continue;
 616
 617     if (!ResolveServerCertRefsInObject(certs_by_guid,
 618                                        *field_signature->value_signature,
 619                                        inner_object)) {
 620       return false;
 621     }
 622   }
 623   return true;
 624 }
 625
 626 }  // namespace
 627
 628 bool ResolveServerCertRefsInNetworks(const CertPEMsByGUIDMap& certs_by_guid,
 629                                      base::ListValue* network_configs) {
 630   bool success = true;
 631   for (base::ListValue::iterator it = network_configs->begin();
 632        it != network_configs->end(); ) {
 633     base::DictionaryValue* network = NULL;
 634     (*it)->GetAsDictionary(&network);
 635     if (!ResolveServerCertRefsInNetwork(certs_by_guid, network)) {
 636       std::string guid;
 637       network->GetStringWithoutPathExpansion(network_config::kGUID, &guid);
 638       // This might happen even with correct validation, if the referenced
 639       // certificate couldn't be imported.
 640       LOG(ERROR) << "Couldn't resolve some certificate reference of network "
 641                  << guid;
 642       it = network_configs->Erase(it, NULL);
 643       success = false;
 644       continue;
 645     }
 646     ++it;
 647   }
 648   return success;
 649 }
 650
 651 bool ResolveServerCertRefsInNetwork(const CertPEMsByGUIDMap& certs_by_guid,
 652                                     base::DictionaryValue* network_config) {
 653   return ResolveServerCertRefsInObject(certs_by_guid,
 654                                        kNetworkConfigurationSignature,
 655                                        network_config);
 656 }
 657
 658 NetworkTypePattern NetworkTypePatternFromOncType(const std::string& type) {
 659   if (type == ::onc::network_type::kAllTypes)
 660     return NetworkTypePattern::Default();
 661   if (type == ::onc::network_type::kCellular)
 662     return NetworkTypePattern::Cellular();
 663   if (type == ::onc::network_type::kEthernet)
 664     return NetworkTypePattern::Ethernet();
 665   if (type == ::onc::network_type::kVPN)
 666     return NetworkTypePattern::VPN();
 667   if (type == ::onc::network_type::kWiFi)
 668     return NetworkTypePattern::WiFi();
 669   if (type == ::onc::network_type::kWimax)
 670     return NetworkTypePattern::Wimax();
 671   if (type == ::onc::network_type::kWireless)
 672     return NetworkTypePattern::Wireless();
 673   NOTREACHED();
 674   return NetworkTypePattern::Default();
 675 }
 676
 677 bool IsRecommendedValue(const base::DictionaryValue* onc,
 678                         const std::string& property_key) {
 679   std::string property_basename, recommended_property_key;
 680   size_t pos = property_key.find_last_of('.');
 681   if (pos != std::string::npos) {
 682     // 'WiFi.AutoConnect' -> 'AutoConnect', 'WiFi.Recommended'
 683     property_basename = property_key.substr(pos + 1);
 684     recommended_property_key =
 685         property_key.substr(0, pos + 1) + ::onc::kRecommended;
 686   } else {
 687     // 'Name' -> 'Name', 'Recommended'
 688     property_basename = property_key;
 689     recommended_property_key = ::onc::kRecommended;
 690   }
 691
 692   const base::ListValue* recommended_keys = NULL;
 693   return (onc->GetList(recommended_property_key, &recommended_keys) &&
 694           recommended_keys->Find(base::StringValue(property_basename)) !=
 695           recommended_keys->end());
 696 }
 697
 698 }  // namespace onc
 699 }  // namespace chromeos