1// Copyright 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef CHROME_BROWSER_CHROMEOS_POLICY_USER_NETWORK_CONFIGURATION_UPDATER_H_
6#define CHROME_BROWSER_CHROMEOS_POLICY_USER_NETWORK_CONFIGURATION_UPDATER_H_
7
8#include <vector>
9
10#include "base/basictypes.h"
11#include "base/compiler_specific.h"
12#include "base/memory/ref_counted.h"
13#include "base/memory/scoped_ptr.h"
14#include "base/memory/weak_ptr.h"
15#include "base/observer_list.h"
16#include "chrome/browser/chromeos/policy/network_configuration_updater.h"
17#include "components/keyed_service/core/keyed_service.h"
18#include "content/public/browser/notification_observer.h"
19#include "content/public/browser/notification_registrar.h"
20
21class Profile;
22
23namespace base {
24class ListValue;
25}
26
27namespace user_manager {
28class User;
29}
30
31namespace chromeos {
32
33namespace onc {
34class CertificateImporter;
35}
36}
37
38namespace net {
39class NSSCertDatabase;
40class X509Certificate;
41typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
42}
43
44namespace policy {
45
46class PolicyService;
47
48// Implements additional special handling of ONC user policies. Namely string
49// expansion with the user's name (or email address, etc.) and handling of "Web"
50// trust of certificates.
51class UserNetworkConfigurationUpdater : public NetworkConfigurationUpdater,
52                                        public KeyedService,
53                                        public content::NotificationObserver {
54 public:
55  class WebTrustedCertsObserver {
56   public:
57    // Is called everytime the list of imported certificates with Web trust is
58    // changed.
59    virtual void OnTrustAnchorsChanged(
60        const net::CertificateList& trust_anchors) = 0;
61  };
62
63  virtual ~UserNetworkConfigurationUpdater();
64
65  // Creates an updater that applies the ONC user policy from |policy_service|
66  // for user |user| once the policy service is completely initialized and on
67  // each policy change. Imported certificates, that request it, are only
68  // granted Web trust if |allow_trusted_certs_from_policy| is true. A reference
69  // to |user| is stored. It must outlive the returned updater.
70  static scoped_ptr<UserNetworkConfigurationUpdater> CreateForUserPolicy(
71      Profile* profile,
72      bool allow_trusted_certs_from_policy,
73      const user_manager::User& user,
74      PolicyService* policy_service,
75      chromeos::ManagedNetworkConfigurationHandler* network_config_handler);
76
77  void AddTrustedCertsObserver(WebTrustedCertsObserver* observer);
78  void RemoveTrustedCertsObserver(WebTrustedCertsObserver* observer);
79
80  // Sets |certs| to the list of Web trusted server and CA certificates from the
81  // last received policy.
82  void GetWebTrustedCertificates(net::CertificateList* certs) const;
83
84  // Helper method to expose |SetCertificateImporter| for usage in tests.
85  void SetCertificateImporterForTest(
86      scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer);
87
88 private:
89  class CrosTrustAnchorProvider;
90
91  UserNetworkConfigurationUpdater(
92      Profile* profile,
93      bool allow_trusted_certs_from_policy,
94      const user_manager::User& user,
95      PolicyService* policy_service,
96      chromeos::ManagedNetworkConfigurationHandler* network_config_handler);
97
98  // Called by the CertificateImporter when an import finished.
99  void OnCertificatesImported(
100      bool success,
101      const net::CertificateList& onc_trusted_certificates);
102
103  // NetworkConfigurationUpdater:
104  virtual void ImportCertificates(
105      const base::ListValue& certificates_onc) OVERRIDE;
106  virtual void ApplyNetworkPolicy(
107      base::ListValue* network_configs_onc,
108      base::DictionaryValue* global_network_config) OVERRIDE;
109
110  // content::NotificationObserver implementation. Observes the profile to which
111  // |this| belongs to for PROFILE_ADDED notification.
112  virtual void Observe(int type,
113                       const content::NotificationSource& source,
114                       const content::NotificationDetails& details) OVERRIDE;
115
116  // Creates onc::CertImporter with |database| and passes it to
117  // |SetCertificateImporter|.
118  void CreateAndSetCertificateImporter(net::NSSCertDatabase* database);
119
120  // Sets the certificate importer that should be used to import certificate
121  // policies. If there is |pending_certificates_onc_|, it gets imported.
122  void SetCertificateImporter(
123      scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer);
124
125  void NotifyTrustAnchorsChanged();
126
127  // Whether Web trust is allowed or not.
128  bool allow_trusted_certificates_from_policy_;
129
130  // The user for whom the user policy will be applied.
131  const user_manager::User* user_;
132
133  ObserverList<WebTrustedCertsObserver, true> observer_list_;
134
135  // Contains the certificates of the last import that requested web trust. Must
136  // be empty if Web trust from policy is not allowed.
137  net::CertificateList web_trust_certs_;
138
139  // If |ImportCertificates| is called before |SetCertificateImporter|, gets set
140  // to a copy of the policy for which the import was requested.
141  // The policy will be processed when the certificate importer is set.
142  scoped_ptr<base::ListValue> pending_certificates_onc_;
143
144  // Certificate importer to be used for importing policy defined certificates.
145  // Set by |SetCertificateImporter|.
146  scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer_;
147
148  content::NotificationRegistrar registrar_;
149
150  base::WeakPtrFactory<UserNetworkConfigurationUpdater> weak_factory_;
151
152  DISALLOW_COPY_AND_ASSIGN(UserNetworkConfigurationUpdater);
153};
154
155}  // namespace policy
156
157#endif  // CHROME_BROWSER_CHROMEOS_POLICY_USER_NETWORK_CONFIGURATION_UPDATER_H_
158