Enable VPN from device policy before log-in

- Accept VPN from device policy in ONCValidator
- Display VPN pod before log in to allow connecting
  - But disable "Add" button in VPN panel

Bug: b:144202836
Change-Id: Ie5f6302549686e74aea5e0c395014ad257ee5d1b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2383366Reviewed-by: Pavol Marko <pmarko@chromium.org>
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Commit-Queue: Taoyu Li <taoyl@chromium.org>
Auto-Submit: Taoyu Li <taoyl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#804647}

ash/system/network/vpn_feature_pod_controller.cc

@@ -27,10 +27,6 @@ namespace ash {
 namespace {
 
 bool IsVPNVisibleInSystemTray() {
-  LoginStatus login_status = Shell::Get()->session_controller()->login_status();
-  if (login_status == LoginStatus::NOT_LOGGED_IN)
-    return false;
-
   TrayNetworkStateModel* model =
       Shell::Get()->system_tray_model()->network_state_model();
 

ash/system/network/vpn_list_view.cc

@@ -148,7 +148,13 @@ class VPNListProviderEntry : public views::ButtonListener, public views::View {
         this, enabled_icon, disabled_icon, button_accessible_name_id);
     add_vpn_button->SetInkDropColor(
         UnifiedSystemTrayView::GetBackgroundColor());
-    add_vpn_button->SetEnabled(enabled);
+
+    // 'Add VPN' is disabled in the login screen since user configured
+    // device-wide VPNs are unsupported.
+    LoginStatus login_status =
+        Shell::Get()->session_controller()->login_status();
+    add_vpn_button->SetEnabled(enabled &&
+                               login_status != LoginStatus::NOT_LOGGED_IN);
     tri_view->AddView(TriView::Container::END, add_vpn_button);
   }
 

chromeos/network/onc/onc_validator.cc

@@ -675,9 +675,11 @@ bool Validator::ValidateNetworkConfiguration(base::DictionaryValue* result) {
 
     std::string type = GetStringFromDict(*result, ::onc::network_config::kType);
 
-    // Prohibit anything but WiFi and Ethernet for device-level policy (which
-    // corresponds to shared networks). See also http://crosbug.com/28741.
+    // Prohibit anything but WiFi, Ethernet and VPN for device-level policy
+    // (which corresponds to shared networks). See also
+    // http://crosbug.com/28741.
     if (onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY && !type.empty() &&
+        type != ::onc::network_type::kVPN &&
         type != ::onc::network_type::kWiFi &&
         type != ::onc::network_type::kEthernet) {
       std::ostringstream msg;
@@ -686,7 +688,6 @@ bool Validator::ValidateNetworkConfiguration(base::DictionaryValue* result) {
       AddValidationIssue(true /* is_error */, msg.str());
       return false;
     }
-
     if (type == ::onc::network_type::kWiFi) {
       all_required_exist &= RequireField(*result, ::onc::network_config::kWiFi);
     } else if (type == ::onc::network_type::kEthernet) {

chromeos/network/onc/onc_validator_unittest.cc

@@ -173,6 +173,10 @@ INSTANTIATE_TEST_SUITE_P(
         OncParams("managed_toplevel_l2tpipsec.onc",
                   &kToplevelConfigurationSignature,
                   true),
+        OncParams("managed_toplevel_l2tpipsec.onc",
+                  &kToplevelConfigurationSignature,
+                  true,
+                  ::onc::ONC_SOURCE_DEVICE_POLICY),
         OncParams("managed_toplevel_with_server_and_ca_cert.onc",
                   &kToplevelConfigurationSignature,
                   true),
@@ -471,11 +475,6 @@ INSTANTIATE_TEST_SUITE_P(
                                  false),
                        ExpectBothNotValid("network-repaired",
                                           "network-repaired")),
-        std::make_pair(OncParams("toplevel-with-vpn",
-                                 &kToplevelConfigurationSignature,
-                                 false,
-                                 ::onc::ONC_SOURCE_DEVICE_POLICY),
-                       ExpectBothNotValid("toplevel-empty", "toplevel-empty")),
         std::make_pair(OncParams("wifi-ssid-and-hexssid-inconsistent",
                                  &kNetworkConfigurationSignature,
                                  false),