user_network_configuration_updater.h revision 1320f92c476a1ad9d19dba2a48c72b75566198e9
1// Copyright 2013 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef CHROME_BROWSER_CHROMEOS_POLICY_USER_NETWORK_CONFIGURATION_UPDATER_H_ 6#define CHROME_BROWSER_CHROMEOS_POLICY_USER_NETWORK_CONFIGURATION_UPDATER_H_ 7 8#include <vector> 9 10#include "base/basictypes.h" 11#include "base/compiler_specific.h" 12#include "base/memory/ref_counted.h" 13#include "base/memory/scoped_ptr.h" 14#include "base/memory/weak_ptr.h" 15#include "base/observer_list.h" 16#include "chrome/browser/chromeos/policy/network_configuration_updater.h" 17#include "components/keyed_service/core/keyed_service.h" 18#include "content/public/browser/notification_observer.h" 19#include "content/public/browser/notification_registrar.h" 20 21class Profile; 22 23namespace base { 24class ListValue; 25} 26 27namespace user_manager { 28class User; 29} 30 31namespace chromeos { 32 33namespace onc { 34class CertificateImporter; 35} 36} 37 38namespace net { 39class NSSCertDatabase; 40class X509Certificate; 41typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; 42} 43 44namespace policy { 45 46class PolicyService; 47 48// Implements additional special handling of ONC user policies. Namely string 49// expansion with the user's name (or email address, etc.) and handling of "Web" 50// trust of certificates. 51class UserNetworkConfigurationUpdater : public NetworkConfigurationUpdater, 52 public KeyedService, 53 public content::NotificationObserver { 54 public: 55 class WebTrustedCertsObserver { 56 public: 57 // Is called everytime the list of imported certificates with Web trust is 58 // changed. 59 virtual void OnTrustAnchorsChanged( 60 const net::CertificateList& trust_anchors) = 0; 61 }; 62 63 virtual ~UserNetworkConfigurationUpdater(); 64 65 // Creates an updater that applies the ONC user policy from |policy_service| 66 // for user |user| once the policy service is completely initialized and on 67 // each policy change. Imported certificates, that request it, are only 68 // granted Web trust if |allow_trusted_certs_from_policy| is true. A reference 69 // to |user| is stored. It must outlive the returned updater. 70 static scoped_ptr<UserNetworkConfigurationUpdater> CreateForUserPolicy( 71 Profile* profile, 72 bool allow_trusted_certs_from_policy, 73 const user_manager::User& user, 74 PolicyService* policy_service, 75 chromeos::ManagedNetworkConfigurationHandler* network_config_handler); 76 77 void AddTrustedCertsObserver(WebTrustedCertsObserver* observer); 78 void RemoveTrustedCertsObserver(WebTrustedCertsObserver* observer); 79 80 // Sets |certs| to the list of Web trusted server and CA certificates from the 81 // last received policy. 82 void GetWebTrustedCertificates(net::CertificateList* certs) const; 83 84 // Helper method to expose |SetCertificateImporter| for usage in tests. 85 void SetCertificateImporterForTest( 86 scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer); 87 88 private: 89 class CrosTrustAnchorProvider; 90 91 UserNetworkConfigurationUpdater( 92 Profile* profile, 93 bool allow_trusted_certs_from_policy, 94 const user_manager::User& user, 95 PolicyService* policy_service, 96 chromeos::ManagedNetworkConfigurationHandler* network_config_handler); 97 98 // Called by the CertificateImporter when an import finished. 99 void OnCertificatesImported( 100 bool success, 101 const net::CertificateList& onc_trusted_certificates); 102 103 // NetworkConfigurationUpdater: 104 virtual void ImportCertificates( 105 const base::ListValue& certificates_onc) OVERRIDE; 106 virtual void ApplyNetworkPolicy( 107 base::ListValue* network_configs_onc, 108 base::DictionaryValue* global_network_config) OVERRIDE; 109 110 // content::NotificationObserver implementation. Observes the profile to which 111 // |this| belongs to for PROFILE_ADDED notification. 112 virtual void Observe(int type, 113 const content::NotificationSource& source, 114 const content::NotificationDetails& details) OVERRIDE; 115 116 // Creates onc::CertImporter with |database| and passes it to 117 // |SetCertificateImporter|. 118 void CreateAndSetCertificateImporter(net::NSSCertDatabase* database); 119 120 // Sets the certificate importer that should be used to import certificate 121 // policies. If there is |pending_certificates_onc_|, it gets imported. 122 void SetCertificateImporter( 123 scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer); 124 125 void NotifyTrustAnchorsChanged(); 126 127 // Whether Web trust is allowed or not. 128 bool allow_trusted_certificates_from_policy_; 129 130 // The user for whom the user policy will be applied. 131 const user_manager::User* user_; 132 133 ObserverList<WebTrustedCertsObserver, true> observer_list_; 134 135 // Contains the certificates of the last import that requested web trust. Must 136 // be empty if Web trust from policy is not allowed. 137 net::CertificateList web_trust_certs_; 138 139 // If |ImportCertificates| is called before |SetCertificateImporter|, gets set 140 // to a copy of the policy for which the import was requested. 141 // The policy will be processed when the certificate importer is set. 142 scoped_ptr<base::ListValue> pending_certificates_onc_; 143 144 // Certificate importer to be used for importing policy defined certificates. 145 // Set by |SetCertificateImporter|. 146 scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer_; 147 148 content::NotificationRegistrar registrar_; 149 150 base::WeakPtrFactory<UserNetworkConfigurationUpdater> weak_factory_; 151 152 DISALLOW_COPY_AND_ASSIGN(UserNetworkConfigurationUpdater); 153}; 154 155} // namespace policy 156 157#endif // CHROME_BROWSER_CHROMEOS_POLICY_USER_NETWORK_CONFIGURATION_UPDATER_H_ 158