chromeos/network/onc/onc_validator.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/network/onc/onc_validator.h"
   6
   7 #include <algorithm>
   8 #include <string>
   9
  10 #include "base/json/json_writer.h"
  11 #include "base/logging.h"
  12 #include "base/strings/string_number_conversions.h"
  13 #include "base/strings/string_util.h"
  14 #include "base/values.h"
  15 #include "chromeos/network/onc/onc_signature.h"
  16 #include "components/onc/onc_constants.h"
  17
  18 namespace chromeos {
  19 namespace onc {
  20
  21 namespace {
  22
  23 template <typename T, size_t N>
  24 std::vector<T> toVector(T const (&array)[N]) {
  25   return std::vector<T>(array, array + N);
  26 }
  27
  28 // Copied from policy/configuration_policy_handler.cc.
  29 // TODO(pneubeck): move to a common place like base/.
  30 std::string ValueTypeToString(base::Value::Type type) {
  31   const char* const strings[] = {"null",   "boolean", "integer",    "double",
  32                                  "string", "binary",  "dictionary", "list"};
  33   CHECK(static_cast<size_t>(type) < arraysize(strings));
  34   return strings[type];
  35 }
  36
  37 }  // namespace
  38
  39 Validator::Validator(bool error_on_unknown_field,
  40                      bool error_on_wrong_recommended,
  41                      bool error_on_missing_field,
  42                      bool managed_onc)
  43     : error_on_unknown_field_(error_on_unknown_field),
  44       error_on_wrong_recommended_(error_on_wrong_recommended),
  45       error_on_missing_field_(error_on_missing_field),
  46       managed_onc_(managed_onc),
  47       onc_source_(::onc::ONC_SOURCE_NONE) {}
  48
  49 Validator::~Validator() {}
  50
  51 scoped_ptr<base::DictionaryValue> Validator::ValidateAndRepairObject(
  52     const OncValueSignature* object_signature,
  53     const base::DictionaryValue& onc_object,
  54     Result* result) {
  55   CHECK(object_signature);
  56   *result = VALID;
  57   error_or_warning_found_ = false;
  58   bool error = false;
  59   scoped_ptr<base::Value> result_value =
  60       MapValue(*object_signature, onc_object, &error);
  61   if (error) {
  62     *result = INVALID;
  63     result_value.reset();
  64   } else if (error_or_warning_found_) {
  65     *result = VALID_WITH_WARNINGS;
  66   }
  67   // The return value should be NULL if, and only if, |result| equals INVALID.
  68   DCHECK_EQ(result_value.get() == NULL, *result == INVALID);
  69
  70   base::DictionaryValue* result_dict = NULL;
  71   if (result_value) {
  72     result_value.release()->GetAsDictionary(&result_dict);
  73     CHECK(result_dict);
  74   }
  75
  76   return make_scoped_ptr(result_dict);
  77 }
  78
  79 scoped_ptr<base::Value> Validator::MapValue(const OncValueSignature& signature,
  80                                             const base::Value& onc_value,
  81                                             bool* error) {
  82   if (onc_value.GetType() != signature.onc_type) {
  83     LOG(ERROR) << MessageHeader() << "Found value '" << onc_value
  84                << "' of type '" << ValueTypeToString(onc_value.GetType())
  85                << "', but type '" << ValueTypeToString(signature.onc_type)
  86                << "' is required.";
  87     error_or_warning_found_ = *error = true;
  88     return scoped_ptr<base::Value>();
  89   }
  90
  91   scoped_ptr<base::Value> repaired =
  92       Mapper::MapValue(signature, onc_value, error);
  93   if (repaired)
  94     CHECK_EQ(repaired->GetType(), signature.onc_type);
  95   return repaired.Pass();
  96 }
  97
  98 scoped_ptr<base::DictionaryValue> Validator::MapObject(
  99     const OncValueSignature& signature,
 100     const base::DictionaryValue& onc_object,
 101     bool* error) {
 102   scoped_ptr<base::DictionaryValue> repaired(new base::DictionaryValue);
 103
 104   bool valid = ValidateObjectDefault(signature, onc_object, repaired.get());
 105   if (valid) {
 106     if (&signature == &kToplevelConfigurationSignature) {
 107       valid = ValidateToplevelConfiguration(repaired.get());
 108     } else if (&signature == &kNetworkConfigurationSignature) {
 109       valid = ValidateNetworkConfiguration(repaired.get());
 110     } else if (&signature == &kEthernetSignature) {
 111       valid = ValidateEthernet(repaired.get());
 112     } else if (&signature == &kIPConfigSignature ||
 113                &signature == &kSavedIPConfigSignature ||
 114                &signature == &kStaticIPConfigSignature) {
 115       valid = ValidateIPConfig(repaired.get());
 116     } else if (&signature == &kWiFiSignature) {
 117       valid = ValidateWiFi(repaired.get());
 118     } else if (&signature == &kVPNSignature) {
 119       valid = ValidateVPN(repaired.get());
 120     } else if (&signature == &kIPsecSignature) {
 121       valid = ValidateIPsec(repaired.get());
 122     } else if (&signature == &kOpenVPNSignature) {
 123       valid = ValidateOpenVPN(repaired.get());
 124     } else if (&signature == &kVerifyX509Signature) {
 125       valid = ValidateVerifyX509(repaired.get());
 126     } else if (&signature == &kCertificatePatternSignature) {
 127       valid = ValidateCertificatePattern(repaired.get());
 128     } else if (&signature == &kProxySettingsSignature) {
 129       valid = ValidateProxySettings(repaired.get());
 130     } else if (&signature == &kProxyLocationSignature) {
 131       valid = ValidateProxyLocation(repaired.get());
 132     } else if (&signature == &kEAPSignature) {
 133       valid = ValidateEAP(repaired.get());
 134     } else if (&signature == &kCertificateSignature) {
 135       valid = ValidateCertificate(repaired.get());
 136     }
 137   }
 138
 139   if (valid) {
 140     return repaired.Pass();
 141   } else {
 142     DCHECK(error_or_warning_found_);
 143     error_or_warning_found_ = *error = true;
 144     return scoped_ptr<base::DictionaryValue>();
 145   }
 146 }
 147
 148 scoped_ptr<base::Value> Validator::MapField(
 149     const std::string& field_name,
 150     const OncValueSignature& object_signature,
 151     const base::Value& onc_value,
 152     bool* found_unknown_field,
 153     bool* error) {
 154   path_.push_back(field_name);
 155   bool current_field_unknown = false;
 156   scoped_ptr<base::Value> result = Mapper::MapField(
 157       field_name, object_signature, onc_value, &current_field_unknown, error);
 158
 159   DCHECK_EQ(field_name, path_.back());
 160   path_.pop_back();
 161
 162   if (current_field_unknown) {
 163     error_or_warning_found_ = *found_unknown_field = true;
 164     std::string message = MessageHeader() + "Field name '" + field_name +
 165         "' is unknown.";
 166     if (error_on_unknown_field_)
 167       LOG(ERROR) << message;
 168     else
 169       LOG(WARNING) << message;
 170   }
 171
 172   return result.Pass();
 173 }
 174
 175 scoped_ptr<base::ListValue> Validator::MapArray(
 176     const OncValueSignature& array_signature,
 177     const base::ListValue& onc_array,
 178     bool* nested_error) {
 179   bool nested_error_in_current_array = false;
 180   scoped_ptr<base::ListValue> result = Mapper::MapArray(
 181       array_signature, onc_array, &nested_error_in_current_array);
 182
 183   // Drop individual networks and certificates instead of rejecting all of
 184   // the configuration.
 185   if (nested_error_in_current_array &&
 186       &array_signature != &kNetworkConfigurationListSignature &&
 187       &array_signature != &kCertificateListSignature) {
 188     *nested_error = nested_error_in_current_array;
 189   }
 190   return result.Pass();
 191 }
 192
 193 scoped_ptr<base::Value> Validator::MapEntry(int index,
 194                                             const OncValueSignature& signature,
 195                                             const base::Value& onc_value,
 196                                             bool* error) {
 197   std::string str = base::IntToString(index);
 198   path_.push_back(str);
 199   scoped_ptr<base::Value> result =
 200       Mapper::MapEntry(index, signature, onc_value, error);
 201   DCHECK_EQ(str, path_.back());
 202   path_.pop_back();
 203   return result.Pass();
 204 }
 205
 206 bool Validator::ValidateObjectDefault(const OncValueSignature& signature,
 207                                       const base::DictionaryValue& onc_object,
 208                                       base::DictionaryValue* result) {
 209   bool found_unknown_field = false;
 210   bool nested_error_occured = false;
 211   MapFields(signature, onc_object, &found_unknown_field, &nested_error_occured,
 212             result);
 213
 214   if (found_unknown_field && error_on_unknown_field_) {
 215     DVLOG(1) << "Unknown field names are errors: Aborting.";
 216     return false;
 217   }
 218
 219   if (nested_error_occured)
 220     return false;
 221
 222   return ValidateRecommendedField(signature, result);
 223 }
 224
 225 bool Validator::ValidateRecommendedField(
 226     const OncValueSignature& object_signature,
 227     base::DictionaryValue* result) {
 228   CHECK(result);
 229
 230   scoped_ptr<base::ListValue> recommended;
 231   scoped_ptr<base::Value> recommended_value;
 232   // This remove passes ownership to |recommended_value|.
 233   if (!result->RemoveWithoutPathExpansion(::onc::kRecommended,
 234                                           &recommended_value)) {
 235     return true;
 236   }
 237   base::ListValue* recommended_list = NULL;
 238   recommended_value.release()->GetAsList(&recommended_list);
 239   CHECK(recommended_list);
 240
 241   recommended.reset(recommended_list);
 242
 243   if (!managed_onc_) {
 244     error_or_warning_found_ = true;
 245     LOG(WARNING) << MessageHeader() << "Found the field '"
 246                  << ::onc::kRecommended
 247                  << "' in an unmanaged ONC. Removing it.";
 248     return true;
 249   }
 250
 251   scoped_ptr<base::ListValue> repaired_recommended(new base::ListValue);
 252   for (base::ListValue::iterator it = recommended->begin();
 253        it != recommended->end(); ++it) {
 254     std::string field_name;
 255     if (!(*it)->GetAsString(&field_name)) {
 256       NOTREACHED();
 257       continue;
 258     }
 259
 260     const OncFieldSignature* field_signature =
 261         GetFieldSignature(object_signature, field_name);
 262
 263     bool found_error = false;
 264     std::string error_cause;
 265     if (!field_signature) {
 266       found_error = true;
 267       error_cause = "unknown";
 268     } else if (field_signature->value_signature->onc_type ==
 269                base::Value::TYPE_DICTIONARY) {
 270       found_error = true;
 271       error_cause = "dictionary-typed";
 272     }
 273
 274     if (found_error) {
 275       error_or_warning_found_ = true;
 276       path_.push_back(::onc::kRecommended);
 277       std::string message = MessageHeader() + "The " + error_cause +
 278           " field '" + field_name + "' cannot be recommended.";
 279       path_.pop_back();
 280       if (error_on_wrong_recommended_) {
 281         LOG(ERROR) << message;
 282         return false;
 283       } else {
 284         LOG(WARNING) << message;
 285         continue;
 286       }
 287     }
 288
 289     repaired_recommended->Append((*it)->DeepCopy());
 290   }
 291
 292   result->Set(::onc::kRecommended, repaired_recommended.release());
 293   return true;
 294 }
 295
 296 bool Validator::ValidateClientCertFields(bool allow_cert_type_none,
 297                                          base::DictionaryValue* result) {
 298   using namespace ::onc::client_cert;
 299   const char* const kValidCertTypes[] = {kRef, kPattern};
 300   std::vector<const char*> valid_cert_types(toVector(kValidCertTypes));
 301   if (allow_cert_type_none)
 302     valid_cert_types.push_back(kClientCertTypeNone);
 303   if (FieldExistsAndHasNoValidValue(*result, kClientCertType, valid_cert_types))
 304     return false;
 305
 306   std::string cert_type;
 307   result->GetStringWithoutPathExpansion(kClientCertType, &cert_type);
 308
 309   if (IsCertPatternInDevicePolicy(cert_type))
 310     return false;
 311
 312   bool all_required_exist = true;
 313
 314   if (cert_type == kPattern)
 315     all_required_exist &= RequireField(*result, kClientCertPattern);
 316   else if (cert_type == kRef)
 317     all_required_exist &= RequireField(*result, kClientCertRef);
 318
 319   return !error_on_missing_field_ || all_required_exist;
 320 }
 321
 322 namespace {
 323
 324 std::string JoinStringRange(const std::vector<const char*>& strings,
 325                             const std::string& separator) {
 326   std::vector<std::string> string_vector;
 327   std::copy(strings.begin(), strings.end(), std::back_inserter(string_vector));
 328   return JoinString(string_vector, separator);
 329 }
 330
 331 }  // namespace
 332
 333 bool Validator::FieldExistsAndHasNoValidValue(
 334     const base::DictionaryValue& object,
 335     const std::string& field_name,
 336     const std::vector<const char*>& valid_values) {
 337   std::string actual_value;
 338   if (!object.GetStringWithoutPathExpansion(field_name, &actual_value))
 339     return false;
 340
 341   for (std::vector<const char*>::const_iterator it = valid_values.begin();
 342        it != valid_values.end();
 343        ++it) {
 344     if (actual_value == *it)
 345       return false;
 346   }
 347   error_or_warning_found_ = true;
 348   std::string valid_values_str =
 349       "[" + JoinStringRange(valid_values, ", ") + "]";
 350   path_.push_back(field_name);
 351   LOG(ERROR) << MessageHeader() << "Found value '" << actual_value <<
 352       "', but expected one of the values " << valid_values_str;
 353   path_.pop_back();
 354   return true;
 355 }
 356
 357 bool Validator::FieldExistsAndIsNotInRange(const base::DictionaryValue& object,
 358                                            const std::string& field_name,
 359                                            int lower_bound,
 360                                            int upper_bound) {
 361   int actual_value;
 362   if (!object.GetIntegerWithoutPathExpansion(field_name, &actual_value) ||
 363       (lower_bound <= actual_value && actual_value <= upper_bound)) {
 364     return false;
 365   }
 366   error_or_warning_found_ = true;
 367   path_.push_back(field_name);
 368   LOG(ERROR) << MessageHeader() << "Found value '" << actual_value
 369              << "', but expected a value in the range [" << lower_bound
 370              << ", " << upper_bound << "] (boundaries inclusive)";
 371   path_.pop_back();
 372   return true;
 373 }
 374
 375 bool Validator::FieldExistsAndIsEmpty(const base::DictionaryValue& object,
 376                                       const std::string& field_name) {
 377   const base::Value* value = NULL;
 378   if (!object.GetWithoutPathExpansion(field_name, &value))
 379     return false;
 380
 381   std::string str;
 382   const base::ListValue* list = NULL;
 383   if (value->GetAsString(&str)) {
 384     if (!str.empty())
 385       return false;
 386   } else if (value->GetAsList(&list)) {
 387     if (!list->empty())
 388       return false;
 389   } else {
 390     NOTREACHED();
 391     return false;
 392   }
 393
 394   error_or_warning_found_ = true;
 395   path_.push_back(field_name);
 396   LOG(ERROR) << MessageHeader() << "Found an empty string, but expected a "
 397              << "non-empty string.";
 398   path_.pop_back();
 399   return true;
 400 }
 401
 402 bool Validator::RequireField(const base::DictionaryValue& dict,
 403                              const std::string& field_name) {
 404   if (dict.HasKey(field_name))
 405     return true;
 406   error_or_warning_found_ = true;
 407   std::string message = MessageHeader() + "The required field '" + field_name +
 408       "' is missing.";
 409   if (error_on_missing_field_)
 410     LOG(ERROR) << message;
 411   else
 412     LOG(WARNING) << message;
 413   return false;
 414 }
 415
 416 bool Validator::CheckGuidIsUniqueAndAddToSet(const base::DictionaryValue& dict,
 417                                              const std::string& key_guid,
 418                                              std::set<std::string> *guids) {
 419   std::string guid;
 420   if (dict.GetStringWithoutPathExpansion(key_guid, &guid)) {
 421     if (guids->count(guid) != 0) {
 422       error_or_warning_found_ = true;
 423       LOG(ERROR) << MessageHeader() << "Found a duplicate GUID " << guid << ".";
 424       return false;
 425     }
 426     guids->insert(guid);
 427   }
 428   return true;
 429 }
 430
 431 bool Validator::IsCertPatternInDevicePolicy(const std::string& cert_type) {
 432   if (cert_type == ::onc::client_cert::kPattern &&
 433       onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY) {
 434     error_or_warning_found_ = true;
 435     LOG(ERROR) << MessageHeader() << "Client certificate patterns are "
 436                << "prohibited in ONC device policies.";
 437     return true;
 438   }
 439   return false;
 440 }
 441
 442 bool Validator::IsGlobalNetworkConfigInUserImport(
 443     const base::DictionaryValue& onc_object) {
 444   if (onc_source_ == ::onc::ONC_SOURCE_USER_IMPORT &&
 445       onc_object.HasKey(::onc::toplevel_config::kGlobalNetworkConfiguration)) {
 446     error_or_warning_found_ = true;
 447     LOG(ERROR) << MessageHeader() << "GlobalNetworkConfiguration is prohibited "
 448                << "in ONC user imports";
 449     return true;
 450   }
 451   return false;
 452 }
 453
 454 bool Validator::ValidateToplevelConfiguration(base::DictionaryValue* result) {
 455   using namespace ::onc::toplevel_config;
 456
 457   const char* const kValidTypes[] = {kUnencryptedConfiguration,
 458                                      kEncryptedConfiguration};
 459   const std::vector<const char*> valid_types(toVector(kValidTypes));
 460   if (FieldExistsAndHasNoValidValue(*result, kType, valid_types))
 461     return false;
 462
 463   if (IsGlobalNetworkConfigInUserImport(*result))
 464     return false;
 465
 466   return true;
 467 }
 468
 469 bool Validator::ValidateNetworkConfiguration(base::DictionaryValue* result) {
 470   using namespace ::onc::network_config;
 471
 472   const char* const kValidTypes[] = {
 473       ::onc::network_type::kEthernet, ::onc::network_type::kVPN,
 474       ::onc::network_type::kWiFi, ::onc::network_type::kCellular};
 475   const std::vector<const char*> valid_types(toVector(kValidTypes));
 476   if (FieldExistsAndHasNoValidValue(*result, kType, valid_types) ||
 477       FieldExistsAndIsEmpty(*result, kGUID)) {
 478     return false;
 479   }
 480
 481   if (!CheckGuidIsUniqueAndAddToSet(*result, kGUID, &network_guids_))
 482     return false;
 483
 484   bool all_required_exist = RequireField(*result, kGUID);
 485
 486   bool remove = false;
 487   result->GetBooleanWithoutPathExpansion(::onc::kRemove, &remove);
 488   if (!remove) {
 489     all_required_exist &=
 490         RequireField(*result, kName) && RequireField(*result, kType);
 491
 492     std::string type;
 493     result->GetStringWithoutPathExpansion(kType, &type);
 494
 495     // Prohibit anything but WiFi and Ethernet for device-level policy (which
 496     // corresponds to shared networks). See also http://crosbug.com/28741.
 497     if (onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY &&
 498         type != ::onc::network_type::kWiFi &&
 499         type != ::onc::network_type::kEthernet) {
 500       error_or_warning_found_ = true;
 501       LOG(ERROR) << MessageHeader() << "Networks of type '"
 502                  << type << "' are prohibited in ONC device policies.";
 503       return false;
 504     }
 505
 506     if (type == ::onc::network_type::kWiFi) {
 507       all_required_exist &= RequireField(*result, ::onc::network_config::kWiFi);
 508     } else if (type == ::onc::network_type::kEthernet) {
 509       all_required_exist &=
 510           RequireField(*result, ::onc::network_config::kEthernet);
 511     } else if (type == ::onc::network_type::kCellular) {
 512       all_required_exist &=
 513           RequireField(*result, ::onc::network_config::kCellular);
 514     } else if (type == ::onc::network_type::kVPN) {
 515       all_required_exist &= RequireField(*result, ::onc::network_config::kVPN);
 516     } else if (!type.empty()) {
 517       NOTREACHED();
 518     }
 519   }
 520
 521   return !error_on_missing_field_ || all_required_exist;
 522 }
 523
 524 bool Validator::ValidateEthernet(base::DictionaryValue* result) {
 525   using namespace ::onc::ethernet;
 526
 527   const char* const kValidAuthentications[] = {kAuthenticationNone, k8021X};
 528   const std::vector<const char*> valid_authentications(
 529       toVector(kValidAuthentications));
 530   if (FieldExistsAndHasNoValidValue(
 531           *result, kAuthentication, valid_authentications)) {
 532     return false;
 533   }
 534
 535   bool all_required_exist = true;
 536   std::string auth;
 537   result->GetStringWithoutPathExpansion(kAuthentication, &auth);
 538   if (auth == k8021X)
 539     all_required_exist &= RequireField(*result, kEAP);
 540
 541   return !error_on_missing_field_ || all_required_exist;
 542 }
 543
 544 bool Validator::ValidateIPConfig(base::DictionaryValue* result) {
 545   using namespace ::onc::ipconfig;
 546
 547   const char* const kValidTypes[] = {kIPv4, kIPv6};
 548   const std::vector<const char*> valid_types(toVector(kValidTypes));
 549   if (FieldExistsAndHasNoValidValue(
 550           *result, ::onc::ipconfig::kType, valid_types))
 551     return false;
 552
 553   std::string type;
 554   result->GetStringWithoutPathExpansion(::onc::ipconfig::kType, &type);
 555   int lower_bound = 1;
 556   // In case of missing type, choose higher upper_bound.
 557   int upper_bound = (type == kIPv4) ? 32 : 128;
 558   if (FieldExistsAndIsNotInRange(
 559           *result, kRoutingPrefix, lower_bound, upper_bound)) {
 560     return false;
 561   }
 562
 563   bool all_required_exist = RequireField(*result, kIPAddress) &&
 564                             RequireField(*result, kRoutingPrefix) &&
 565                             RequireField(*result, ::onc::ipconfig::kType);
 566
 567   return !error_on_missing_field_ || all_required_exist;
 568 }
 569
 570 bool Validator::ValidateWiFi(base::DictionaryValue* result) {
 571   using namespace ::onc::wifi;
 572
 573   const char* const kValidSecurities[] = {kSecurityNone, kWEP_PSK, kWEP_8021X,
 574                                           kWPA_PSK, kWPA_EAP};
 575   const std::vector<const char*> valid_securities(toVector(kValidSecurities));
 576   if (FieldExistsAndHasNoValidValue(*result, kSecurity, valid_securities))
 577     return false;
 578
 579   bool all_required_exist =
 580       RequireField(*result, kSecurity) && RequireField(*result, kSSID);
 581
 582   std::string security;
 583   result->GetStringWithoutPathExpansion(kSecurity, &security);
 584   if (security == kWEP_8021X || security == kWPA_EAP)
 585     all_required_exist &= RequireField(*result, kEAP);
 586   else if (security == kWEP_PSK || security == kWPA_PSK)
 587     all_required_exist &= RequireField(*result, kPassphrase);
 588
 589   return !error_on_missing_field_ || all_required_exist;
 590 }
 591
 592 bool Validator::ValidateVPN(base::DictionaryValue* result) {
 593   using namespace ::onc::vpn;
 594
 595   const char* const kValidTypes[] = {kIPsec, kTypeL2TP_IPsec, kOpenVPN};
 596   const std::vector<const char*> valid_types(toVector(kValidTypes));
 597   if (FieldExistsAndHasNoValidValue(*result, ::onc::vpn::kType, valid_types))
 598     return false;
 599
 600   bool all_required_exist = RequireField(*result, ::onc::vpn::kType);
 601   std::string type;
 602   result->GetStringWithoutPathExpansion(::onc::vpn::kType, &type);
 603   if (type == kOpenVPN) {
 604     all_required_exist &= RequireField(*result, kOpenVPN);
 605   } else if (type == kIPsec) {
 606     all_required_exist &= RequireField(*result, kIPsec);
 607   } else if (type == kTypeL2TP_IPsec) {
 608     all_required_exist &=
 609         RequireField(*result, kIPsec) && RequireField(*result, kL2TP);
 610   }
 611
 612   return !error_on_missing_field_ || all_required_exist;
 613 }
 614
 615 bool Validator::ValidateIPsec(base::DictionaryValue* result) {
 616   using namespace ::onc::ipsec;
 617
 618   const char* const kValidAuthentications[] = {kPSK, kCert};
 619   const std::vector<const char*> valid_authentications(
 620       toVector(kValidAuthentications));
 621   if (FieldExistsAndHasNoValidValue(
 622           *result, kAuthenticationType, valid_authentications) ||
 623       FieldExistsAndIsEmpty(*result, kServerCARefs)) {
 624     return false;
 625   }
 626
 627   if (result->HasKey(kServerCARefs) && result->HasKey(kServerCARef)) {
 628     error_or_warning_found_ = true;
 629     LOG(ERROR) << MessageHeader() << "At most one of " << kServerCARefs
 630                << " and " << kServerCARef << " can be set.";
 631     return false;
 632   }
 633
 634   if (!ValidateClientCertFields(false,  // don't allow ClientCertType None
 635                                 result)) {
 636     return false;
 637   }
 638
 639   bool all_required_exist = RequireField(*result, kAuthenticationType) &&
 640                             RequireField(*result, kIKEVersion);
 641   std::string auth;
 642   result->GetStringWithoutPathExpansion(kAuthenticationType, &auth);
 643   bool has_server_ca_cert =
 644       result->HasKey(kServerCARefs) || result->HasKey(kServerCARef);
 645   if (auth == kCert) {
 646     all_required_exist &=
 647         RequireField(*result, ::onc::client_cert::kClientCertType);
 648     if (!has_server_ca_cert) {
 649       all_required_exist = false;
 650       error_or_warning_found_ = true;
 651       std::string message = MessageHeader() + "The required field '" +
 652                             kServerCARefs + "' is missing.";
 653       if (error_on_missing_field_)
 654         LOG(ERROR) << message;
 655       else
 656         LOG(WARNING) << message;
 657     }
 658   } else if (has_server_ca_cert) {
 659     error_or_warning_found_ = true;
 660     LOG(ERROR) << MessageHeader() << kServerCARefs << " (or " << kServerCARef
 661                << ") can only be set if " << kAuthenticationType
 662                << " is set to " << kCert << ".";
 663     return false;
 664   }
 665
 666   return !error_on_missing_field_ || all_required_exist;
 667 }
 668
 669 bool Validator::ValidateOpenVPN(base::DictionaryValue* result) {
 670   using namespace ::onc::openvpn;
 671
 672   const char* const kValidAuthRetryValues[] = {::onc::openvpn::kNone, kInteract,
 673                                                kNoInteract};
 674   const std::vector<const char*> valid_auth_retry_values(
 675       toVector(kValidAuthRetryValues));
 676   const char* const kValidCertTlsValues[] = {::onc::openvpn::kNone,
 677                                              ::onc::openvpn::kServer};
 678   const std::vector<const char*> valid_cert_tls_values(
 679       toVector(kValidCertTlsValues));
 680
 681   if (FieldExistsAndHasNoValidValue(
 682           *result, kAuthRetry, valid_auth_retry_values) ||
 683       FieldExistsAndHasNoValidValue(
 684           *result, kRemoteCertTLS, valid_cert_tls_values) ||
 685       FieldExistsAndIsEmpty(*result, kServerCARefs)) {
 686     return false;
 687   }
 688
 689   if (result->HasKey(kServerCARefs) && result->HasKey(kServerCARef)) {
 690     error_or_warning_found_ = true;
 691     LOG(ERROR) << MessageHeader() << "At most one of " << kServerCARefs
 692                << " and " << kServerCARef << " can be set.";
 693     return false;
 694   }
 695
 696   if (!ValidateClientCertFields(true /* allow ClientCertType None */, result))
 697     return false;
 698
 699   bool all_required_exist =
 700       RequireField(*result, ::onc::client_cert::kClientCertType);
 701
 702   return !error_on_missing_field_ || all_required_exist;
 703 }
 704
 705 bool Validator::ValidateVerifyX509(base::DictionaryValue* result) {
 706   using namespace ::onc::verify_x509;
 707
 708   const char* const kValidTypes[] = {types::kName, types::kNamePrefix,
 709                                      types::kSubject};
 710   const std::vector<const char*> valid_types(toVector(kValidTypes));
 711
 712   if (FieldExistsAndHasNoValidValue(*result, kType, valid_types))
 713     return false;
 714
 715   bool all_required_exist = RequireField(*result, kName);
 716
 717   return !error_on_missing_field_ || all_required_exist;
 718 }
 719
 720 bool Validator::ValidateCertificatePattern(base::DictionaryValue* result) {
 721   using namespace ::onc::client_cert;
 722
 723   bool all_required_exist = true;
 724   if (!result->HasKey(kSubject) && !result->HasKey(kIssuer) &&
 725       !result->HasKey(kIssuerCARef)) {
 726     error_or_warning_found_ = true;
 727     all_required_exist = false;
 728     std::string message = MessageHeader() + "None of the fields '" + kSubject +
 729         "', '" + kIssuer + "', and '" + kIssuerCARef +
 730         "' is present, but at least one is required.";
 731     if (error_on_missing_field_)
 732       LOG(ERROR) << message;
 733     else
 734       LOG(WARNING) << message;
 735   }
 736
 737   return !error_on_missing_field_ || all_required_exist;
 738 }
 739
 740 bool Validator::ValidateProxySettings(base::DictionaryValue* result) {
 741   using namespace ::onc::proxy;
 742
 743   const char* const kValidTypes[] = {kDirect, kManual, kPAC, kWPAD};
 744   const std::vector<const char*> valid_types(toVector(kValidTypes));
 745   if (FieldExistsAndHasNoValidValue(*result, ::onc::proxy::kType, valid_types))
 746     return false;
 747
 748   bool all_required_exist = RequireField(*result, ::onc::proxy::kType);
 749   std::string type;
 750   result->GetStringWithoutPathExpansion(::onc::proxy::kType, &type);
 751   if (type == kManual)
 752     all_required_exist &= RequireField(*result, kManual);
 753   else if (type == kPAC)
 754     all_required_exist &= RequireField(*result, kPAC);
 755
 756   return !error_on_missing_field_ || all_required_exist;
 757 }
 758
 759 bool Validator::ValidateProxyLocation(base::DictionaryValue* result) {
 760   using namespace ::onc::proxy;
 761
 762   bool all_required_exist =
 763       RequireField(*result, kHost) && RequireField(*result, kPort);
 764
 765   return !error_on_missing_field_ || all_required_exist;
 766 }
 767
 768 bool Validator::ValidateEAP(base::DictionaryValue* result) {
 769   using namespace ::onc::eap;
 770
 771   const char* const kValidInnerValues[] = {kAutomatic, kMD5, kMSCHAPv2, kPAP};
 772   const std::vector<const char*> valid_inner_values(
 773       toVector(kValidInnerValues));
 774   const char* const kValidOuterValues[] = {
 775       kPEAP, kEAP_TLS, kEAP_TTLS, kLEAP, kEAP_SIM, kEAP_FAST, kEAP_AKA};
 776   const std::vector<const char*> valid_outer_values(
 777       toVector(kValidOuterValues));
 778
 779   if (FieldExistsAndHasNoValidValue(*result, kInner, valid_inner_values) ||
 780       FieldExistsAndHasNoValidValue(*result, kOuter, valid_outer_values) ||
 781       FieldExistsAndIsEmpty(*result, kServerCARefs)) {
 782     return false;
 783   }
 784
 785   if (result->HasKey(kServerCARefs) && result->HasKey(kServerCARef)) {
 786     error_or_warning_found_ = true;
 787     LOG(ERROR) << MessageHeader() << "At most one of " << kServerCARefs
 788                << " and " << kServerCARef << " can be set.";
 789     return false;
 790   }
 791
 792   if (!ValidateClientCertFields(false,  // don't allow ClientCertType None
 793                                 result)) {
 794     return false;
 795   }
 796
 797   bool all_required_exist = RequireField(*result, kOuter);
 798
 799   return !error_on_missing_field_ || all_required_exist;
 800 }
 801
 802 bool Validator::ValidateCertificate(base::DictionaryValue* result) {
 803   using namespace ::onc::certificate;
 804
 805   const char* const kValidTypes[] = {kClient, kServer, kAuthority};
 806   const std::vector<const char*> valid_types(toVector(kValidTypes));
 807   if (FieldExistsAndHasNoValidValue(*result, kType, valid_types) ||
 808       FieldExistsAndIsEmpty(*result, kGUID)) {
 809     return false;
 810   }
 811
 812   std::string type;
 813   result->GetStringWithoutPathExpansion(kType, &type);
 814   if (onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY &&
 815       (type == kServer || type == kAuthority)) {
 816     error_or_warning_found_ = true;
 817     LOG(ERROR) << MessageHeader() << "Server and authority certificates are "
 818                << "prohibited in ONC device policies.";
 819     return false;
 820   }
 821
 822   if (!CheckGuidIsUniqueAndAddToSet(*result, kGUID, &certificate_guids_))
 823     return false;
 824
 825   bool all_required_exist = RequireField(*result, kGUID);
 826
 827   bool remove = false;
 828   result->GetBooleanWithoutPathExpansion(::onc::kRemove, &remove);
 829   if (!remove) {
 830     all_required_exist &= RequireField(*result, kType);
 831
 832     if (type == kClient)
 833       all_required_exist &= RequireField(*result, kPKCS12);
 834     else if (type == kServer || type == kAuthority)
 835       all_required_exist &= RequireField(*result, kX509);
 836   }
 837
 838   return !error_on_missing_field_ || all_required_exist;
 839 }
 840
 841 std::string Validator::MessageHeader() {
 842   std::string path = path_.empty() ? "toplevel" : JoinString(path_, ".");
 843   std::string message = "At " + path + ": ";
 844   return message;
 845 }
 846
 847 }  // namespace onc
 848 }  // namespace chromeos