Home | History | Annotate | Download | only in policy 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chrome/browser/chromeos/policy/auto_enrollment_client.h"
      6 
      7 #include "base/bind.h"
      8 #include "base/guid.h"
      9 #include "base/location.h"
     10 #include "base/logging.h"
     11 #include "base/message_loop/message_loop_proxy.h"
     12 #include "base/metrics/histogram.h"
     13 #include "base/metrics/sparse_histogram.h"
     14 #include "base/prefs/pref_registry_simple.h"
     15 #include "base/prefs/pref_service.h"
     16 #include "base/prefs/scoped_user_pref_update.h"
     17 #include "chrome/browser/browser_process.h"
     18 #include "chrome/browser/chromeos/policy/server_backed_device_state.h"
     19 #include "chrome/common/chrome_content_client.h"
     20 #include "chrome/common/pref_names.h"
     21 #include "components/policy/core/common/cloud/device_management_service.h"
     22 #include "components/policy/core/common/cloud/system_policy_request_context.h"
     23 #include "content/public/browser/browser_thread.h"
     24 #include "crypto/sha2.h"
     25 #include "net/url_request/url_request_context_getter.h"
     26 #include "policy/proto/device_management_backend.pb.h"
     27 #include "url/gurl.h"
     28 
     29 using content::BrowserThread;
     30 
     31 namespace em = enterprise_management;
     32 
     33 namespace policy {
     34 
     35 namespace {
     36 
     37 // UMA histogram names.
     38 const char kUMAProtocolTime[] = "Enterprise.AutoEnrollmentProtocolTime";
     39 const char kUMAExtraTime[] = "Enterprise.AutoEnrollmentExtraTime";
     40 const char kUMARequestStatus[] = "Enterprise.AutoEnrollmentRequestStatus";
     41 const char kUMANetworkErrorCode[] =
     42     "Enterprise.AutoEnrollmentRequestNetworkErrorCode";
     43 
     44 // Returns the power of the next power-of-2 starting at |value|.
     45 int NextPowerOf2(int64 value) {
     46   for (int i = 0; i <= AutoEnrollmentClient::kMaximumPower; ++i) {
     47     if ((GG_INT64_C(1) << i) >= value)
     48       return i;
     49   }
     50   // No other value can be represented in an int64.
     51   return AutoEnrollmentClient::kMaximumPower + 1;
     52 }
     53 
     54 // Sets or clears a value in a dictionary.
     55 void UpdateDict(base::DictionaryValue* dict,
     56                 const char* pref_path,
     57                 bool set_or_clear,
     58                 base::Value* value) {
     59   scoped_ptr<base::Value> scoped_value(value);
     60   if (set_or_clear)
     61     dict->Set(pref_path, scoped_value.release());
     62   else
     63     dict->Remove(pref_path, NULL);
     64 }
     65 
     66 // Converts a restore mode enum value from the DM protocol into the
     67 // corresponding prefs string constant.
     68 std::string ConvertRestoreMode(
     69     em::DeviceStateRetrievalResponse::RestoreMode restore_mode) {
     70   switch (restore_mode) {
     71     case em::DeviceStateRetrievalResponse::RESTORE_MODE_NONE:
     72       return std::string();
     73     case em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_REQUESTED:
     74       return kDeviceStateRestoreModeReEnrollmentRequested;
     75     case em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED:
     76       return kDeviceStateRestoreModeReEnrollmentEnforced;
     77   }
     78 
     79   // Return is required to avoid compiler warning.
     80   NOTREACHED() << "Bad restore mode " << restore_mode;
     81   return std::string();
     82 }
     83 
     84 }  // namespace
     85 
     86 AutoEnrollmentClient::AutoEnrollmentClient(
     87     const ProgressCallback& callback,
     88     DeviceManagementService* service,
     89     PrefService* local_state,
     90     scoped_refptr<net::URLRequestContextGetter> system_request_context,
     91     const std::string& server_backed_state_key,
     92     bool retrieve_device_state,
     93     int power_initial,
     94     int power_limit)
     95     : progress_callback_(callback),
     96       state_(AUTO_ENROLLMENT_STATE_IDLE),
     97       has_server_state_(false),
     98       device_state_available_(false),
     99       device_id_(base::GenerateGUID()),
    100       server_backed_state_key_(server_backed_state_key),
    101       retrieve_device_state_(retrieve_device_state),
    102       current_power_(power_initial),
    103       power_limit_(power_limit),
    104       modulus_updates_received_(0),
    105       device_management_service_(service),
    106       local_state_(local_state) {
    107   request_context_ = new SystemPolicyRequestContext(
    108       system_request_context, GetUserAgent());
    109 
    110   DCHECK_LE(current_power_, power_limit_);
    111   DCHECK(!progress_callback_.is_null());
    112   if (!server_backed_state_key_.empty()) {
    113     server_backed_state_key_hash_ =
    114         crypto::SHA256HashString(server_backed_state_key_);
    115   }
    116 }
    117 
    118 AutoEnrollmentClient::~AutoEnrollmentClient() {
    119   net::NetworkChangeNotifier::RemoveNetworkChangeObserver(this);
    120 }
    121 
    122 // static
    123 void AutoEnrollmentClient::RegisterPrefs(PrefRegistrySimple* registry) {
    124   registry->RegisterBooleanPref(prefs::kShouldAutoEnroll, false);
    125   registry->RegisterIntegerPref(prefs::kAutoEnrollmentPowerLimit, -1);
    126 }
    127 
    128 // static
    129 void AutoEnrollmentClient::CancelAutoEnrollment() {
    130   PrefService* local_state = g_browser_process->local_state();
    131   local_state->SetBoolean(prefs::kShouldAutoEnroll, false);
    132   local_state->ClearPref(prefs::kServerBackedDeviceState);
    133   local_state->CommitPendingWrite();
    134 }
    135 
    136 void AutoEnrollmentClient::Start() {
    137   // (Re-)register the network change observer.
    138   net::NetworkChangeNotifier::RemoveNetworkChangeObserver(this);
    139   net::NetworkChangeNotifier::AddNetworkChangeObserver(this);
    140 
    141   // Drop the previous job and reset state.
    142   request_job_.reset();
    143   state_ = AUTO_ENROLLMENT_STATE_PENDING;
    144   time_start_ = base::Time::Now();
    145   modulus_updates_received_ = 0;
    146   has_server_state_ = false;
    147   device_state_available_ = false;
    148 
    149   NextStep();
    150 }
    151 
    152 void AutoEnrollmentClient::Retry() {
    153   RetryStep();
    154 }
    155 
    156 void AutoEnrollmentClient::CancelAndDeleteSoon() {
    157   if (time_start_.is_null() || !request_job_) {
    158     // The client isn't running, just delete it.
    159     delete this;
    160   } else {
    161     // Client still running, but our owner isn't interested in the result
    162     // anymore. Wait until the protocol completes to measure the extra time
    163     // needed.
    164     time_extra_start_ = base::Time::Now();
    165     progress_callback_.Reset();
    166   }
    167 }
    168 
    169 void AutoEnrollmentClient::OnNetworkChanged(
    170     net::NetworkChangeNotifier::ConnectionType type) {
    171   if (type != net::NetworkChangeNotifier::CONNECTION_NONE &&
    172       !progress_callback_.is_null()) {
    173     RetryStep();
    174   }
    175 }
    176 
    177 bool AutoEnrollmentClient::GetCachedDecision() {
    178   const PrefService::Preference* has_server_state_pref =
    179       local_state_->FindPreference(prefs::kShouldAutoEnroll);
    180   const PrefService::Preference* previous_limit_pref =
    181       local_state_->FindPreference(prefs::kAutoEnrollmentPowerLimit);
    182   bool has_server_state = false;
    183   int previous_limit = -1;
    184 
    185   if (!has_server_state_pref ||
    186       has_server_state_pref->IsDefaultValue() ||
    187       !has_server_state_pref->GetValue()->GetAsBoolean(&has_server_state) ||
    188       !previous_limit_pref ||
    189       previous_limit_pref->IsDefaultValue() ||
    190       !previous_limit_pref->GetValue()->GetAsInteger(&previous_limit) ||
    191       power_limit_ > previous_limit) {
    192     return false;
    193   }
    194 
    195   has_server_state_ = has_server_state;
    196   return true;
    197 }
    198 
    199 bool AutoEnrollmentClient::RetryStep() {
    200   // If there is a pending request job, let it finish.
    201   if (request_job_)
    202     return true;
    203 
    204   if (GetCachedDecision()) {
    205     // The bucket download check has completed already. If it came back
    206     // positive, then device state should be (re-)downloaded.
    207     if (has_server_state_) {
    208       if (retrieve_device_state_ && !device_state_available_ &&
    209           SendDeviceStateRequest()) {
    210         return true;
    211       }
    212     }
    213   } else {
    214     // Start bucket download.
    215     if (SendBucketDownloadRequest())
    216       return true;
    217   }
    218 
    219   return false;
    220 }
    221 
    222 void AutoEnrollmentClient::ReportProgress(AutoEnrollmentState state) {
    223   state_ = state;
    224   if (progress_callback_.is_null()) {
    225     base::MessageLoopProxy::current()->DeleteSoon(FROM_HERE, this);
    226   } else {
    227     progress_callback_.Run(state_);
    228   }
    229 }
    230 
    231 void AutoEnrollmentClient::NextStep() {
    232   if (!RetryStep()) {
    233     // Protocol finished successfully, report result.
    234     bool trigger_enrollment = false;
    235     if (retrieve_device_state_) {
    236       const base::DictionaryValue* device_state_dict =
    237           local_state_->GetDictionary(prefs::kServerBackedDeviceState);
    238       std::string restore_mode;
    239       device_state_dict->GetString(kDeviceStateRestoreMode, &restore_mode);
    240       trigger_enrollment =
    241           (restore_mode == kDeviceStateRestoreModeReEnrollmentRequested ||
    242            restore_mode == kDeviceStateRestoreModeReEnrollmentEnforced);
    243     } else {
    244       trigger_enrollment = has_server_state_;
    245     }
    246 
    247     ReportProgress(trigger_enrollment ? AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT
    248                                       : AUTO_ENROLLMENT_STATE_NO_ENROLLMENT);
    249   }
    250 }
    251 
    252 bool AutoEnrollmentClient::SendBucketDownloadRequest() {
    253   if (server_backed_state_key_hash_.empty())
    254     return false;
    255 
    256   // Only power-of-2 moduli are supported for now. These are computed by taking
    257   // the lower |current_power_| bits of the hash.
    258   uint64 remainder = 0;
    259   for (int i = 0; 8 * i < current_power_; ++i) {
    260     uint64 byte = server_backed_state_key_hash_[31 - i] & 0xff;
    261     remainder = remainder | (byte << (8 * i));
    262   }
    263   remainder = remainder & ((GG_UINT64_C(1) << current_power_) - 1);
    264 
    265   ReportProgress(AUTO_ENROLLMENT_STATE_PENDING);
    266 
    267   request_job_.reset(
    268       device_management_service_->CreateJob(
    269           DeviceManagementRequestJob::TYPE_AUTO_ENROLLMENT,
    270           request_context_.get()));
    271   request_job_->SetClientID(device_id_);
    272   em::DeviceAutoEnrollmentRequest* request =
    273       request_job_->GetRequest()->mutable_auto_enrollment_request();
    274   request->set_remainder(remainder);
    275   request->set_modulus(GG_INT64_C(1) << current_power_);
    276   request_job_->Start(
    277       base::Bind(&AutoEnrollmentClient::HandleRequestCompletion,
    278                  base::Unretained(this),
    279                  &AutoEnrollmentClient::OnBucketDownloadRequestCompletion));
    280   return true;
    281 }
    282 
    283 bool AutoEnrollmentClient::SendDeviceStateRequest() {
    284   ReportProgress(AUTO_ENROLLMENT_STATE_PENDING);
    285 
    286   request_job_.reset(
    287       device_management_service_->CreateJob(
    288           DeviceManagementRequestJob::TYPE_DEVICE_STATE_RETRIEVAL,
    289           request_context_.get()));
    290   request_job_->SetClientID(device_id_);
    291   em::DeviceStateRetrievalRequest* request =
    292       request_job_->GetRequest()->mutable_device_state_retrieval_request();
    293   request->set_server_backed_state_key(server_backed_state_key_);
    294   request_job_->Start(
    295       base::Bind(&AutoEnrollmentClient::HandleRequestCompletion,
    296                  base::Unretained(this),
    297                  &AutoEnrollmentClient::OnDeviceStateRequestCompletion));
    298   return true;
    299 }
    300 
    301 void AutoEnrollmentClient::HandleRequestCompletion(
    302     RequestCompletionHandler handler,
    303     DeviceManagementStatus status,
    304     int net_error,
    305     const em::DeviceManagementResponse& response) {
    306   UMA_HISTOGRAM_SPARSE_SLOWLY(kUMARequestStatus, status);
    307   if (status != DM_STATUS_SUCCESS) {
    308     LOG(ERROR) << "Auto enrollment error: " << status;
    309     if (status == DM_STATUS_REQUEST_FAILED)
    310       UMA_HISTOGRAM_SPARSE_SLOWLY(kUMANetworkErrorCode, -net_error);
    311     request_job_.reset();
    312 
    313     // Abort if CancelAndDeleteSoon has been called meanwhile.
    314     if (progress_callback_.is_null()) {
    315       base::MessageLoopProxy::current()->DeleteSoon(FROM_HERE, this);
    316     } else {
    317       ReportProgress(status == DM_STATUS_REQUEST_FAILED
    318                          ? AUTO_ENROLLMENT_STATE_CONNECTION_ERROR
    319                          : AUTO_ENROLLMENT_STATE_SERVER_ERROR);
    320     }
    321     return;
    322   }
    323 
    324   bool progress = (this->*handler)(status, net_error, response);
    325   request_job_.reset();
    326   if (progress)
    327     NextStep();
    328   else
    329     ReportProgress(AUTO_ENROLLMENT_STATE_SERVER_ERROR);
    330 }
    331 
    332 bool AutoEnrollmentClient::OnBucketDownloadRequestCompletion(
    333     DeviceManagementStatus status,
    334     int net_error,
    335     const em::DeviceManagementResponse& response) {
    336   bool progress = false;
    337   const em::DeviceAutoEnrollmentResponse& enrollment_response =
    338       response.auto_enrollment_response();
    339   if (!response.has_auto_enrollment_response()) {
    340     LOG(ERROR) << "Server failed to provide auto-enrollment response.";
    341   } else if (enrollment_response.has_expected_modulus()) {
    342     // Server is asking us to retry with a different modulus.
    343     modulus_updates_received_++;
    344 
    345     int64 modulus = enrollment_response.expected_modulus();
    346     int power = NextPowerOf2(modulus);
    347     if ((GG_INT64_C(1) << power) != modulus) {
    348       LOG(WARNING) << "Auto enrollment: the server didn't ask for a power-of-2 "
    349                    << "modulus. Using the closest power-of-2 instead "
    350                    << "(" << modulus << " vs 2^" << power << ")";
    351     }
    352     if (modulus_updates_received_ >= 2) {
    353       LOG(ERROR) << "Auto enrollment error: already retried with an updated "
    354                  << "modulus but the server asked for a new one again: "
    355                  << power;
    356     } else if (power > power_limit_) {
    357       LOG(ERROR) << "Auto enrollment error: the server asked for a larger "
    358                  << "modulus than the client accepts (" << power << " vs "
    359                  << power_limit_ << ").";
    360     } else {
    361       // Retry at most once with the modulus that the server requested.
    362       if (power <= current_power_) {
    363         LOG(WARNING) << "Auto enrollment: the server asked to use a modulus ("
    364                      << power << ") that isn't larger than the first used ("
    365                      << current_power_ << "). Retrying anyway.";
    366       }
    367       // Remember this value, so that eventual retries start with the correct
    368       // modulus.
    369       current_power_ = power;
    370       return true;
    371     }
    372   } else {
    373     // Server should have sent down a list of hashes to try.
    374     has_server_state_ = IsIdHashInProtobuf(enrollment_response.hash());
    375     // Cache the current decision in local_state, so that it is reused in case
    376     // the device reboots before enrolling.
    377     local_state_->SetBoolean(prefs::kShouldAutoEnroll, has_server_state_);
    378     local_state_->SetInteger(prefs::kAutoEnrollmentPowerLimit, power_limit_);
    379     local_state_->CommitPendingWrite();
    380     VLOG(1) << "Auto enrollment check complete, has_server_state_ = "
    381             << has_server_state_;
    382     progress = true;
    383   }
    384 
    385   // Bucket download done, update UMA.
    386   UpdateBucketDownloadTimingHistograms();
    387   return progress;
    388 }
    389 
    390 bool AutoEnrollmentClient::OnDeviceStateRequestCompletion(
    391     DeviceManagementStatus status,
    392     int net_error,
    393     const enterprise_management::DeviceManagementResponse& response) {
    394   bool progress = false;
    395   if (!response.has_device_state_retrieval_response()) {
    396     LOG(ERROR) << "Server failed to provide auto-enrollment response.";
    397   } else {
    398     const em::DeviceStateRetrievalResponse& state_response =
    399         response.device_state_retrieval_response();
    400     {
    401       DictionaryPrefUpdate dict(local_state_, prefs::kServerBackedDeviceState);
    402       UpdateDict(dict.Get(),
    403                  kDeviceStateManagementDomain,
    404                  state_response.has_management_domain(),
    405                  new base::StringValue(state_response.management_domain()));
    406 
    407       std::string restore_mode =
    408           ConvertRestoreMode(state_response.restore_mode());
    409       UpdateDict(dict.Get(),
    410                  kDeviceStateRestoreMode,
    411                  !restore_mode.empty(),
    412                  new base::StringValue(restore_mode));
    413     }
    414     local_state_->CommitPendingWrite();
    415     device_state_available_ = true;
    416     progress = true;
    417   }
    418 
    419   return progress;
    420 }
    421 
    422 bool AutoEnrollmentClient::IsIdHashInProtobuf(
    423       const google::protobuf::RepeatedPtrField<std::string>& hashes) {
    424   for (int i = 0; i < hashes.size(); ++i) {
    425     if (hashes.Get(i) == server_backed_state_key_hash_)
    426       return true;
    427   }
    428   return false;
    429 }
    430 
    431 void AutoEnrollmentClient::UpdateBucketDownloadTimingHistograms() {
    432   // The minimum time can't be 0, must be at least 1.
    433   static const base::TimeDelta kMin = base::TimeDelta::FromMilliseconds(1);
    434   static const base::TimeDelta kMax = base::TimeDelta::FromMinutes(5);
    435   // However, 0 can still be sampled.
    436   static const base::TimeDelta kZero = base::TimeDelta::FromMilliseconds(0);
    437   static const int kBuckets = 50;
    438 
    439   base::Time now = base::Time::Now();
    440   if (!time_start_.is_null()) {
    441     base::TimeDelta delta = now - time_start_;
    442     UMA_HISTOGRAM_CUSTOM_TIMES(kUMAProtocolTime, delta, kMin, kMax, kBuckets);
    443   }
    444   base::TimeDelta delta = kZero;
    445   if (!time_extra_start_.is_null())
    446     delta = now - time_extra_start_;
    447   // This samples |kZero| when there was no need for extra time, so that we can
    448   // measure the ratio of users that succeeded without needing a delay to the
    449   // total users going through OOBE.
    450   UMA_HISTOGRAM_CUSTOM_TIMES(kUMAExtraTime, delta, kMin, kMax, kBuckets);
    451 }
    452 
    453 }  // namespace policy
    454