Home | History | Annotate | Download | only in settings 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chrome/browser/chromeos/settings/session_manager_operation.h"
      6 
      7 #include "base/bind.h"
      8 #include "base/bind_helpers.h"
      9 #include "base/files/file_path.h"
     10 #include "base/message_loop/message_loop.h"
     11 #include "base/stl_util.h"
     12 #include "base/task_runner_util.h"
     13 #include "base/threading/sequenced_worker_pool.h"
     14 #include "base/time/time.h"
     15 #include "chrome/browser/chromeos/settings/owner_key_util.h"
     16 #include "chrome/browser/policy/cloud/cloud_policy_constants.h"
     17 #include "chrome/browser/policy/proto/chromeos/chrome_device_policy.pb.h"
     18 #include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h"
     19 #include "content/public/browser/browser_thread.h"
     20 #include "crypto/rsa_private_key.h"
     21 #include "crypto/signature_creator.h"
     22 
     23 namespace em = enterprise_management;
     24 
     25 namespace chromeos {
     26 
     27 SessionManagerOperation::SessionManagerOperation(const Callback& callback)
     28     : session_manager_client_(NULL),
     29       weak_factory_(this),
     30       callback_(callback),
     31       force_key_load_(false),
     32       is_loading_(false) {}
     33 
     34 SessionManagerOperation::~SessionManagerOperation() {}
     35 
     36 void SessionManagerOperation::Start(
     37     SessionManagerClient* session_manager_client,
     38     scoped_refptr<OwnerKeyUtil> owner_key_util,
     39     scoped_refptr<OwnerKey> owner_key) {
     40   session_manager_client_ = session_manager_client;
     41   owner_key_util_ = owner_key_util;
     42   owner_key_ = owner_key;
     43   Run();
     44 }
     45 
     46 void SessionManagerOperation::RestartLoad(bool key_changed) {
     47   if (key_changed)
     48     owner_key_ = NULL;
     49 
     50   if (!is_loading_)
     51     return;
     52 
     53   // Abort previous load operations.
     54   weak_factory_.InvalidateWeakPtrs();
     55   StartLoading();
     56 }
     57 
     58 void SessionManagerOperation::StartLoading() {
     59   is_loading_ = true;
     60   EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings,
     61                             weak_factory_.GetWeakPtr()));
     62 }
     63 
     64 void SessionManagerOperation::ReportResult(
     65     DeviceSettingsService::Status status) {
     66   callback_.Run(this, status);
     67 }
     68 
     69 void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) {
     70   if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) {
     71     base::PostTaskAndReplyWithResult(
     72         content::BrowserThread::GetBlockingPool(),
     73         FROM_HERE,
     74         base::Bind(&SessionManagerOperation::LoadOwnerKey,
     75                    owner_key_util_, owner_key_),
     76         base::Bind(&SessionManagerOperation::StoreOwnerKey,
     77                    weak_factory_.GetWeakPtr(), callback));
     78   } else {
     79     callback.Run();
     80   }
     81 }
     82 
     83 // static
     84 scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey(
     85     scoped_refptr<OwnerKeyUtil> util,
     86     scoped_refptr<OwnerKey> current_key) {
     87   scoped_ptr<std::vector<uint8> > public_key;
     88   scoped_ptr<crypto::RSAPrivateKey> private_key;
     89 
     90   // Keep any already-existing keys.
     91   if (current_key.get()) {
     92     if (current_key->public_key())
     93       public_key.reset(new std::vector<uint8>(*current_key->public_key()));
     94     if (current_key->private_key())
     95       private_key.reset(current_key->private_key()->Copy());
     96   }
     97 
     98   if (!public_key.get() && util->IsPublicKeyPresent()) {
     99     public_key.reset(new std::vector<uint8>());
    100     if (!util->ImportPublicKey(public_key.get()))
    101       LOG(ERROR) << "Failed to load public owner key.";
    102   }
    103 
    104   if (public_key.get() && !private_key.get()) {
    105     private_key.reset(util->FindPrivateKey(*public_key));
    106     if (!private_key.get())
    107       VLOG(1) << "Failed to load private owner key.";
    108   }
    109 
    110   return new OwnerKey(public_key.Pass(), private_key.Pass());
    111 }
    112 
    113 void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback,
    114                                             scoped_refptr<OwnerKey> new_key) {
    115   force_key_load_ = false;
    116   owner_key_ = new_key;
    117 
    118   if (!owner_key_.get() || !owner_key_->public_key()) {
    119     ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
    120     return;
    121   }
    122 
    123   callback.Run();
    124 }
    125 
    126 void SessionManagerOperation::RetrieveDeviceSettings() {
    127   session_manager_client()->RetrieveDevicePolicy(
    128       base::Bind(&SessionManagerOperation::ValidateDeviceSettings,
    129                  weak_factory_.GetWeakPtr()));
    130 }
    131 
    132 void SessionManagerOperation::ValidateDeviceSettings(
    133     const std::string& policy_blob) {
    134   scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
    135   if (policy_blob.empty()) {
    136     ReportResult(DeviceSettingsService::STORE_NO_POLICY);
    137     return;
    138   }
    139 
    140   if (!policy->ParseFromString(policy_blob) ||
    141       !policy->IsInitialized()) {
    142     ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
    143     return;
    144   }
    145 
    146   policy::DeviceCloudPolicyValidator* validator =
    147       policy::DeviceCloudPolicyValidator::Create(policy.Pass());
    148 
    149   // Policy auto-generated by session manager doesn't include a timestamp, so we
    150   // need to allow missing timestamps.
    151   const bool require_timestamp =
    152       policy_data_.get() && policy_data_->has_request_token();
    153   validator->ValidateAgainstCurrentPolicy(
    154       policy_data_.get(),
    155       require_timestamp ?
    156           policy::CloudPolicyValidatorBase::TIMESTAMP_REQUIRED :
    157           policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
    158       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
    159   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
    160   validator->ValidatePayload();
    161   validator->ValidateSignature(*owner_key_->public_key(), false);
    162   validator->StartValidation(
    163       base::Bind(&SessionManagerOperation::ReportValidatorStatus,
    164                  weak_factory_.GetWeakPtr()));
    165 }
    166 
    167 void SessionManagerOperation::ReportValidatorStatus(
    168     policy::DeviceCloudPolicyValidator* validator) {
    169   DeviceSettingsService::Status status =
    170       DeviceSettingsService::STORE_VALIDATION_ERROR;
    171   if (validator->success()) {
    172     status = DeviceSettingsService::STORE_SUCCESS;
    173     policy_data_ = validator->policy_data().Pass();
    174     device_settings_ = validator->payload().Pass();
    175   } else {
    176     LOG(ERROR) << "Policy validation failed: " << validator->status();
    177 
    178     // Those are mostly caused by RTC loss and are recoverable.
    179     if (validator->status() ==
    180         policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) {
    181       status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR;
    182     }
    183   }
    184 
    185   ReportResult(status);
    186 }
    187 
    188 LoadSettingsOperation::LoadSettingsOperation(const Callback& callback)
    189     : SessionManagerOperation(callback) {}
    190 
    191 LoadSettingsOperation::~LoadSettingsOperation() {}
    192 
    193 void LoadSettingsOperation::Run() {
    194   StartLoading();
    195 }
    196 
    197 StoreSettingsOperation::StoreSettingsOperation(
    198     const Callback& callback,
    199     scoped_ptr<em::PolicyFetchResponse> policy)
    200     : SessionManagerOperation(callback),
    201       policy_(policy.Pass()),
    202       weak_factory_(this) {}
    203 
    204 StoreSettingsOperation::~StoreSettingsOperation() {}
    205 
    206 void StoreSettingsOperation::Run() {
    207   session_manager_client()->StoreDevicePolicy(
    208       policy_->SerializeAsString(),
    209       base::Bind(&StoreSettingsOperation::HandleStoreResult,
    210                  weak_factory_.GetWeakPtr()));
    211 }
    212 
    213 void StoreSettingsOperation::HandleStoreResult(bool success) {
    214   if (!success)
    215     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
    216   else
    217     StartLoading();
    218 }
    219 
    220 SignAndStoreSettingsOperation::SignAndStoreSettingsOperation(
    221     const Callback& callback,
    222     scoped_ptr<em::ChromeDeviceSettingsProto> new_settings,
    223     const std::string& username)
    224     : SessionManagerOperation(callback),
    225       new_settings_(new_settings.Pass()),
    226       username_(username),
    227       weak_factory_(this) {
    228   DCHECK(new_settings_.get());
    229 }
    230 
    231 SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {}
    232 
    233 void SignAndStoreSettingsOperation::Run() {
    234   EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning,
    235                             weak_factory_.GetWeakPtr()));
    236 }
    237 
    238 void SignAndStoreSettingsOperation::StartSigning() {
    239   if (!owner_key().get() || !owner_key()->private_key() || username_.empty()) {
    240     ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
    241     return;
    242   }
    243 
    244   base::PostTaskAndReplyWithResult(
    245       content::BrowserThread::GetBlockingPool(),
    246       FROM_HERE,
    247       base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy,
    248                  base::Passed(&new_settings_), username_, owner_key()),
    249       base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob,
    250                  weak_factory_.GetWeakPtr()));
    251 }
    252 
    253 // static
    254 std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy(
    255     scoped_ptr<em::ChromeDeviceSettingsProto> device_settings,
    256     const std::string& username,
    257     scoped_refptr<OwnerKey> owner_key) {
    258   // Assemble the policy.
    259   em::PolicyFetchResponse policy_response;
    260   em::PolicyData policy;
    261   policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType);
    262   policy.set_timestamp((base::Time::NowFromSystemTime() -
    263                         base::Time::UnixEpoch()).InMilliseconds());
    264   policy.set_username(username);
    265   if (!device_settings->SerializeToString(policy.mutable_policy_value()) ||
    266       !policy.SerializeToString(policy_response.mutable_policy_data())) {
    267     LOG(ERROR) << "Failed to encode policy payload.";
    268     return std::string();
    269   }
    270 
    271   // Generate the signature.
    272   scoped_ptr<crypto::SignatureCreator> signature_creator(
    273       crypto::SignatureCreator::Create(owner_key->private_key()));
    274   signature_creator->Update(
    275       reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()),
    276       policy_response.policy_data().size());
    277   std::vector<uint8> signature_bytes;
    278   std::string policy_blob;
    279   if (!signature_creator->Final(&signature_bytes)) {
    280     LOG(ERROR) << "Failed to create policy signature.";
    281     return std::string();
    282   }
    283 
    284   policy_response.mutable_policy_data_signature()->assign(
    285       reinterpret_cast<const char*>(vector_as_array(&signature_bytes)),
    286       signature_bytes.size());
    287   return policy_response.SerializeAsString();
    288 }
    289 
    290 void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob(
    291     std::string device_settings_blob) {
    292   if (device_settings_blob.empty()) {
    293     ReportResult(DeviceSettingsService::STORE_POLICY_ERROR);
    294     return;
    295   }
    296 
    297   session_manager_client()->StoreDevicePolicy(
    298       device_settings_blob,
    299       base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult,
    300                  weak_factory_.GetWeakPtr()));
    301 }
    302 
    303 void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
    304   if (!success)
    305     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
    306   else
    307     StartLoading();
    308 }
    309 
    310 }  // namespace chromeos
    311