Home | History | Annotate | Download | only in settings 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chrome/browser/chromeos/settings/session_manager_operation.h"
      6 
      7 #include "base/bind.h"
      8 #include "base/bind_helpers.h"
      9 #include "base/files/file_path.h"
     10 #include "base/message_loop/message_loop.h"
     11 #include "base/stl_util.h"
     12 #include "base/task_runner_util.h"
     13 #include "base/threading/sequenced_worker_pool.h"
     14 #include "base/time/time.h"
     15 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
     16 #include "chrome/browser/chromeos/settings/owner_key_util.h"
     17 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
     18 #include "content/public/browser/browser_thread.h"
     19 #include "crypto/rsa_private_key.h"
     20 #include "crypto/signature_creator.h"
     21 #include "policy/proto/device_management_backend.pb.h"
     22 
     23 namespace em = enterprise_management;
     24 
     25 namespace chromeos {
     26 
     27 SessionManagerOperation::SessionManagerOperation(const Callback& callback)
     28     : session_manager_client_(NULL),
     29       weak_factory_(this),
     30       callback_(callback),
     31       force_key_load_(false),
     32       is_loading_(false) {}
     33 
     34 SessionManagerOperation::~SessionManagerOperation() {}
     35 
     36 void SessionManagerOperation::Start(
     37     SessionManagerClient* session_manager_client,
     38     scoped_refptr<OwnerKeyUtil> owner_key_util,
     39     scoped_refptr<OwnerKey> owner_key) {
     40   session_manager_client_ = session_manager_client;
     41   owner_key_util_ = owner_key_util;
     42   owner_key_ = owner_key;
     43   Run();
     44 }
     45 
     46 void SessionManagerOperation::RestartLoad(bool key_changed) {
     47   if (key_changed)
     48     owner_key_ = NULL;
     49 
     50   if (!is_loading_)
     51     return;
     52 
     53   // Abort previous load operations.
     54   weak_factory_.InvalidateWeakPtrs();
     55   // Mark as not loading to start loading again.
     56   is_loading_ = false;
     57   StartLoading();
     58 }
     59 
     60 void SessionManagerOperation::StartLoading() {
     61   if (is_loading_)
     62     return;
     63   is_loading_ = true;
     64   EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings,
     65                             weak_factory_.GetWeakPtr()));
     66 }
     67 
     68 void SessionManagerOperation::ReportResult(
     69     DeviceSettingsService::Status status) {
     70   callback_.Run(this, status);
     71 }
     72 
     73 void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) {
     74   if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) {
     75     scoped_refptr<base::TaskRunner> task_runner =
     76         content::BrowserThread::GetBlockingPool()->
     77         GetTaskRunnerWithShutdownBehavior(
     78             base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
     79     base::PostTaskAndReplyWithResult(
     80         task_runner.get(),
     81         FROM_HERE,
     82         base::Bind(&SessionManagerOperation::LoadOwnerKey,
     83                    owner_key_util_, owner_key_),
     84         base::Bind(&SessionManagerOperation::StoreOwnerKey,
     85                    weak_factory_.GetWeakPtr(), callback));
     86   } else {
     87     callback.Run();
     88   }
     89 }
     90 
     91 // static
     92 scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey(
     93     scoped_refptr<OwnerKeyUtil> util,
     94     scoped_refptr<OwnerKey> current_key) {
     95   scoped_ptr<std::vector<uint8> > public_key;
     96   scoped_ptr<crypto::RSAPrivateKey> private_key;
     97 
     98   // Keep any already-existing keys.
     99   if (current_key.get()) {
    100     if (current_key->public_key())
    101       public_key.reset(new std::vector<uint8>(*current_key->public_key()));
    102     if (current_key->private_key())
    103       private_key.reset(current_key->private_key()->Copy());
    104   }
    105 
    106   if (!public_key.get() && util->IsPublicKeyPresent()) {
    107     public_key.reset(new std::vector<uint8>());
    108     if (!util->ImportPublicKey(public_key.get()))
    109       LOG(ERROR) << "Failed to load public owner key.";
    110   }
    111 
    112   if (public_key.get() && !private_key.get()) {
    113     private_key.reset(util->FindPrivateKey(*public_key));
    114     if (!private_key.get())
    115       VLOG(1) << "Failed to load private owner key.";
    116   }
    117 
    118   return new OwnerKey(public_key.Pass(), private_key.Pass());
    119 }
    120 
    121 void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback,
    122                                             scoped_refptr<OwnerKey> new_key) {
    123   force_key_load_ = false;
    124   owner_key_ = new_key;
    125 
    126   if (!owner_key_.get() || !owner_key_->public_key()) {
    127     ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
    128     return;
    129   }
    130 
    131   callback.Run();
    132 }
    133 
    134 void SessionManagerOperation::RetrieveDeviceSettings() {
    135   session_manager_client()->RetrieveDevicePolicy(
    136       base::Bind(&SessionManagerOperation::ValidateDeviceSettings,
    137                  weak_factory_.GetWeakPtr()));
    138 }
    139 
    140 void SessionManagerOperation::ValidateDeviceSettings(
    141     const std::string& policy_blob) {
    142   scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
    143   if (policy_blob.empty()) {
    144     ReportResult(DeviceSettingsService::STORE_NO_POLICY);
    145     return;
    146   }
    147 
    148   if (!policy->ParseFromString(policy_blob) ||
    149       !policy->IsInitialized()) {
    150     ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
    151     return;
    152   }
    153 
    154   base::SequencedWorkerPool* pool =
    155       content::BrowserThread::GetBlockingPool();
    156   scoped_refptr<base::SequencedTaskRunner> background_task_runner =
    157       pool->GetSequencedTaskRunnerWithShutdownBehavior(
    158           pool->GetSequenceToken(),
    159           base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
    160 
    161   policy::DeviceCloudPolicyValidator* validator =
    162       policy::DeviceCloudPolicyValidator::Create(policy.Pass(),
    163                                                  background_task_runner);
    164 
    165 
    166   // Policy auto-generated by session manager doesn't include a timestamp, so
    167   // the timestamp shouldn't be verified in that case.
    168   //
    169   // Additionally, offline devices can get their clock set backwards in time
    170   // under some hardware conditions; checking the timestamp now could likely
    171   // find a value in the future, and prevent the user from signing-in or
    172   // starting guest mode. Tlsdate will eventually fix the clock when the device
    173   // is back online, but the network configuration may come from device ONC.
    174   //
    175   // To prevent all of these issues the timestamp is just not verified when
    176   // loading the device policy from the cache. Note that the timestamp is still
    177   // verified during enrollment and when a new policy is fetched from the
    178   // server.
    179   validator->ValidateAgainstCurrentPolicy(
    180       policy_data_.get(),
    181       policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
    182       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
    183   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
    184   validator->ValidatePayload();
    185   validator->ValidateSignature(*owner_key_->public_key(), false);
    186   validator->StartValidation(
    187       base::Bind(&SessionManagerOperation::ReportValidatorStatus,
    188                  weak_factory_.GetWeakPtr()));
    189 }
    190 
    191 void SessionManagerOperation::ReportValidatorStatus(
    192     policy::DeviceCloudPolicyValidator* validator) {
    193   DeviceSettingsService::Status status =
    194       DeviceSettingsService::STORE_VALIDATION_ERROR;
    195   if (validator->success()) {
    196     status = DeviceSettingsService::STORE_SUCCESS;
    197     policy_data_ = validator->policy_data().Pass();
    198     device_settings_ = validator->payload().Pass();
    199   } else {
    200     LOG(ERROR) << "Policy validation failed: " << validator->status();
    201 
    202     // Those are mostly caused by RTC loss and are recoverable.
    203     if (validator->status() ==
    204         policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) {
    205       status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR;
    206     }
    207   }
    208 
    209   ReportResult(status);
    210 }
    211 
    212 LoadSettingsOperation::LoadSettingsOperation(const Callback& callback)
    213     : SessionManagerOperation(callback) {}
    214 
    215 LoadSettingsOperation::~LoadSettingsOperation() {}
    216 
    217 void LoadSettingsOperation::Run() {
    218   StartLoading();
    219 }
    220 
    221 StoreSettingsOperation::StoreSettingsOperation(
    222     const Callback& callback,
    223     scoped_ptr<em::PolicyFetchResponse> policy)
    224     : SessionManagerOperation(callback),
    225       policy_(policy.Pass()),
    226       weak_factory_(this) {}
    227 
    228 StoreSettingsOperation::~StoreSettingsOperation() {}
    229 
    230 void StoreSettingsOperation::Run() {
    231   session_manager_client()->StoreDevicePolicy(
    232       policy_->SerializeAsString(),
    233       base::Bind(&StoreSettingsOperation::HandleStoreResult,
    234                  weak_factory_.GetWeakPtr()));
    235 }
    236 
    237 void StoreSettingsOperation::HandleStoreResult(bool success) {
    238   if (!success)
    239     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
    240   else
    241     StartLoading();
    242 }
    243 
    244 SignAndStoreSettingsOperation::SignAndStoreSettingsOperation(
    245     const Callback& callback,
    246     scoped_ptr<em::ChromeDeviceSettingsProto> new_settings,
    247     const std::string& username)
    248     : SessionManagerOperation(callback),
    249       new_settings_(new_settings.Pass()),
    250       username_(username),
    251       weak_factory_(this) {
    252   DCHECK(new_settings_.get());
    253 }
    254 
    255 SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {}
    256 
    257 void SignAndStoreSettingsOperation::Run() {
    258   EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning,
    259                             weak_factory_.GetWeakPtr()));
    260 }
    261 
    262 void SignAndStoreSettingsOperation::StartSigning() {
    263   if (!owner_key().get() || !owner_key()->private_key() || username_.empty()) {
    264     ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
    265     return;
    266   }
    267 
    268   base::PostTaskAndReplyWithResult(
    269       content::BrowserThread::GetBlockingPool(),
    270       FROM_HERE,
    271       base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy,
    272                  base::Passed(&new_settings_), username_, owner_key()),
    273       base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob,
    274                  weak_factory_.GetWeakPtr()));
    275 }
    276 
    277 // static
    278 std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy(
    279     scoped_ptr<em::ChromeDeviceSettingsProto> device_settings,
    280     const std::string& username,
    281     scoped_refptr<OwnerKey> owner_key) {
    282   // Assemble the policy.
    283   em::PolicyFetchResponse policy_response;
    284   em::PolicyData policy;
    285   policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType);
    286   policy.set_timestamp((base::Time::NowFromSystemTime() -
    287                         base::Time::UnixEpoch()).InMilliseconds());
    288   policy.set_username(username);
    289   if (!device_settings->SerializeToString(policy.mutable_policy_value()) ||
    290       !policy.SerializeToString(policy_response.mutable_policy_data())) {
    291     LOG(ERROR) << "Failed to encode policy payload.";
    292     return std::string();
    293   }
    294 
    295   // Generate the signature.
    296   scoped_ptr<crypto::SignatureCreator> signature_creator(
    297       crypto::SignatureCreator::Create(owner_key->private_key()));
    298   signature_creator->Update(
    299       reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()),
    300       policy_response.policy_data().size());
    301   std::vector<uint8> signature_bytes;
    302   std::string policy_blob;
    303   if (!signature_creator->Final(&signature_bytes)) {
    304     LOG(ERROR) << "Failed to create policy signature.";
    305     return std::string();
    306   }
    307 
    308   policy_response.mutable_policy_data_signature()->assign(
    309       reinterpret_cast<const char*>(vector_as_array(&signature_bytes)),
    310       signature_bytes.size());
    311   return policy_response.SerializeAsString();
    312 }
    313 
    314 void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob(
    315     std::string device_settings_blob) {
    316   if (device_settings_blob.empty()) {
    317     ReportResult(DeviceSettingsService::STORE_POLICY_ERROR);
    318     return;
    319   }
    320 
    321   session_manager_client()->StoreDevicePolicy(
    322       device_settings_blob,
    323       base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult,
    324                  weak_factory_.GetWeakPtr()));
    325 }
    326 
    327 void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
    328   if (!success)
    329     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
    330   else
    331     StartLoading();
    332 }
    333 
    334 }  // namespace chromeos
    335