session_manager_operation.cc revision 5d1f7b1de12d16ceb2c938c56701a3e8bfa558f7 
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/chromeos/settings/session_manager_operation.h"
6
7#include "base/bind.h"
8#include "base/bind_helpers.h"
9#include "base/files/file_path.h"
10#include "base/message_loop/message_loop.h"
11#include "base/stl_util.h"
12#include "base/task_runner_util.h"
13#include "base/threading/sequenced_worker_pool.h"
14#include "base/time/time.h"
15#include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
16#include "chrome/browser/chromeos/settings/owner_key_util.h"
17#include "components/policy/core/common/cloud/cloud_policy_constants.h"
18#include "content/public/browser/browser_thread.h"
19#include "crypto/rsa_private_key.h"
20#include "crypto/signature_creator.h"
21#include "policy/proto/device_management_backend.pb.h"
22
23namespace em = enterprise_management;
24
25namespace chromeos {
26
27SessionManagerOperation::SessionManagerOperation(const Callback& callback)
28    : session_manager_client_(NULL),
29      weak_factory_(this),
30      callback_(callback),
31      force_key_load_(false),
32      is_loading_(false) {}
33
34SessionManagerOperation::~SessionManagerOperation() {}
35
36void SessionManagerOperation::Start(
37    SessionManagerClient* session_manager_client,
38    scoped_refptr<OwnerKeyUtil> owner_key_util,
39    scoped_refptr<OwnerKey> owner_key) {
40  session_manager_client_ = session_manager_client;
41  owner_key_util_ = owner_key_util;
42  owner_key_ = owner_key;
43  Run();
44}
45
46void SessionManagerOperation::RestartLoad(bool key_changed) {
47  if (key_changed)
48    owner_key_ = NULL;
49
50  if (!is_loading_)
51    return;
52
53  // Abort previous load operations.
54  weak_factory_.InvalidateWeakPtrs();
55  // Mark as not loading to start loading again.
56  is_loading_ = false;
57  StartLoading();
58}
59
60void SessionManagerOperation::StartLoading() {
61  if (is_loading_)
62    return;
63  is_loading_ = true;
64  EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings,
65                            weak_factory_.GetWeakPtr()));
66}
67
68void SessionManagerOperation::ReportResult(
69    DeviceSettingsService::Status status) {
70  callback_.Run(this, status);
71}
72
73void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) {
74  if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) {
75    scoped_refptr<base::TaskRunner> task_runner =
76        content::BrowserThread::GetBlockingPool()->
77        GetTaskRunnerWithShutdownBehavior(
78            base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
79    base::PostTaskAndReplyWithResult(
80        task_runner.get(),
81        FROM_HERE,
82        base::Bind(&SessionManagerOperation::LoadOwnerKey,
83                   owner_key_util_, owner_key_),
84        base::Bind(&SessionManagerOperation::StoreOwnerKey,
85                   weak_factory_.GetWeakPtr(), callback));
86  } else {
87    callback.Run();
88  }
89}
90
91// static
92scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey(
93    scoped_refptr<OwnerKeyUtil> util,
94    scoped_refptr<OwnerKey> current_key) {
95  scoped_ptr<std::vector<uint8> > public_key;
96  scoped_ptr<crypto::RSAPrivateKey> private_key;
97
98  // Keep any already-existing keys.
99  if (current_key.get()) {
100    if (current_key->public_key())
101      public_key.reset(new std::vector<uint8>(*current_key->public_key()));
102    if (current_key->private_key())
103      private_key.reset(current_key->private_key()->Copy());
104  }
105
106  if (!public_key.get() && util->IsPublicKeyPresent()) {
107    public_key.reset(new std::vector<uint8>());
108    if (!util->ImportPublicKey(public_key.get()))
109      LOG(ERROR) << "Failed to load public owner key.";
110  }
111
112  if (public_key.get() && !private_key.get()) {
113    private_key.reset(util->FindPrivateKey(*public_key));
114    if (!private_key.get())
115      VLOG(1) << "Failed to load private owner key.";
116  }
117
118  return new OwnerKey(public_key.Pass(), private_key.Pass());
119}
120
121void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback,
122                                            scoped_refptr<OwnerKey> new_key) {
123  force_key_load_ = false;
124  owner_key_ = new_key;
125
126  if (!owner_key_.get() || !owner_key_->public_key()) {
127    ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
128    return;
129  }
130
131  callback.Run();
132}
133
134void SessionManagerOperation::RetrieveDeviceSettings() {
135  session_manager_client()->RetrieveDevicePolicy(
136      base::Bind(&SessionManagerOperation::ValidateDeviceSettings,
137                 weak_factory_.GetWeakPtr()));
138}
139
140void SessionManagerOperation::ValidateDeviceSettings(
141    const std::string& policy_blob) {
142  scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
143  if (policy_blob.empty()) {
144    ReportResult(DeviceSettingsService::STORE_NO_POLICY);
145    return;
146  }
147
148  if (!policy->ParseFromString(policy_blob) ||
149      !policy->IsInitialized()) {
150    ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
151    return;
152  }
153
154  base::SequencedWorkerPool* pool =
155      content::BrowserThread::GetBlockingPool();
156  scoped_refptr<base::SequencedTaskRunner> background_task_runner =
157      pool->GetSequencedTaskRunnerWithShutdownBehavior(
158          pool->GetSequenceToken(),
159          base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
160
161  policy::DeviceCloudPolicyValidator* validator =
162      policy::DeviceCloudPolicyValidator::Create(policy.Pass(),
163                                                 background_task_runner);
164
165
166  // Policy auto-generated by session manager doesn't include a timestamp, so
167  // the timestamp shouldn't be verified in that case.
168  //
169  // Additionally, offline devices can get their clock set backwards in time
170  // under some hardware conditions; checking the timestamp now could likely
171  // find a value in the future, and prevent the user from signing-in or
172  // starting guest mode. Tlsdate will eventually fix the clock when the device
173  // is back online, but the network configuration may come from device ONC.
174  //
175  // To prevent all of these issues the timestamp is just not verified when
176  // loading the device policy from the cache. Note that the timestamp is still
177  // verified during enrollment and when a new policy is fetched from the
178  // server.
179  validator->ValidateAgainstCurrentPolicy(
180      policy_data_.get(),
181      policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
182      policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
183  validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
184  validator->ValidatePayload();
185  // We don't check the DMServer verification key below, because the signing
186  // key is validated when it is installed.
187  validator->ValidateSignature(owner_key_->public_key_as_string(),
188                               std::string(),  // No key validation check.
189                               std::string(),
190                               false);
191  validator->StartValidation(
192      base::Bind(&SessionManagerOperation::ReportValidatorStatus,
193                 weak_factory_.GetWeakPtr()));
194}
195
196void SessionManagerOperation::ReportValidatorStatus(
197    policy::DeviceCloudPolicyValidator* validator) {
198  DeviceSettingsService::Status status =
199      DeviceSettingsService::STORE_VALIDATION_ERROR;
200  if (validator->success()) {
201    status = DeviceSettingsService::STORE_SUCCESS;
202    policy_data_ = validator->policy_data().Pass();
203    device_settings_ = validator->payload().Pass();
204  } else {
205    LOG(ERROR) << "Policy validation failed: " << validator->status();
206
207    // Those are mostly caused by RTC loss and are recoverable.
208    if (validator->status() ==
209        policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) {
210      status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR;
211    }
212  }
213
214  ReportResult(status);
215}
216
217LoadSettingsOperation::LoadSettingsOperation(const Callback& callback)
218    : SessionManagerOperation(callback) {}
219
220LoadSettingsOperation::~LoadSettingsOperation() {}
221
222void LoadSettingsOperation::Run() {
223  StartLoading();
224}
225
226StoreSettingsOperation::StoreSettingsOperation(
227    const Callback& callback,
228    scoped_ptr<em::PolicyFetchResponse> policy)
229    : SessionManagerOperation(callback),
230      policy_(policy.Pass()),
231      weak_factory_(this) {}
232
233StoreSettingsOperation::~StoreSettingsOperation() {}
234
235void StoreSettingsOperation::Run() {
236  session_manager_client()->StoreDevicePolicy(
237      policy_->SerializeAsString(),
238      base::Bind(&StoreSettingsOperation::HandleStoreResult,
239                 weak_factory_.GetWeakPtr()));
240}
241
242void StoreSettingsOperation::HandleStoreResult(bool success) {
243  if (!success)
244    ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
245  else
246    StartLoading();
247}
248
249SignAndStoreSettingsOperation::SignAndStoreSettingsOperation(
250    const Callback& callback,
251    scoped_ptr<em::ChromeDeviceSettingsProto> new_settings,
252    const std::string& username)
253    : SessionManagerOperation(callback),
254      new_settings_(new_settings.Pass()),
255      username_(username),
256      weak_factory_(this) {
257  DCHECK(new_settings_.get());
258}
259
260SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {}
261
262void SignAndStoreSettingsOperation::Run() {
263  EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning,
264                            weak_factory_.GetWeakPtr()));
265}
266
267void SignAndStoreSettingsOperation::StartSigning() {
268  if (!owner_key().get() || !owner_key()->private_key() || username_.empty()) {
269    ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
270    return;
271  }
272
273  base::PostTaskAndReplyWithResult(
274      content::BrowserThread::GetBlockingPool(),
275      FROM_HERE,
276      base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy,
277                 base::Passed(&new_settings_), username_, owner_key()),
278      base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob,
279                 weak_factory_.GetWeakPtr()));
280}
281
282// static
283std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy(
284    scoped_ptr<em::ChromeDeviceSettingsProto> device_settings,
285    const std::string& username,
286    scoped_refptr<OwnerKey> owner_key) {
287  // Assemble the policy.
288  em::PolicyFetchResponse policy_response;
289  em::PolicyData policy;
290  policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType);
291  policy.set_timestamp((base::Time::NowFromSystemTime() -
292                        base::Time::UnixEpoch()).InMilliseconds());
293  policy.set_username(username);
294  if (!device_settings->SerializeToString(policy.mutable_policy_value()) ||
295      !policy.SerializeToString(policy_response.mutable_policy_data())) {
296    LOG(ERROR) << "Failed to encode policy payload.";
297    return std::string();
298  }
299
300  // Generate the signature.
301  scoped_ptr<crypto::SignatureCreator> signature_creator(
302      crypto::SignatureCreator::Create(owner_key->private_key()));
303  signature_creator->Update(
304      reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()),
305      policy_response.policy_data().size());
306  std::vector<uint8> signature_bytes;
307  std::string policy_blob;
308  if (!signature_creator->Final(&signature_bytes)) {
309    LOG(ERROR) << "Failed to create policy signature.";
310    return std::string();
311  }
312
313  policy_response.mutable_policy_data_signature()->assign(
314      reinterpret_cast<const char*>(vector_as_array(&signature_bytes)),
315      signature_bytes.size());
316  return policy_response.SerializeAsString();
317}
318
319void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob(
320    std::string device_settings_blob) {
321  if (device_settings_blob.empty()) {
322    ReportResult(DeviceSettingsService::STORE_POLICY_ERROR);
323    return;
324  }
325
326  session_manager_client()->StoreDevicePolicy(
327      device_settings_blob,
328      base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult,
329                 weak_factory_.GetWeakPtr()));
330}
331
332void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
333  if (!success)
334    ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
335  else
336    StartLoading();
337}
338
339}  // namespace chromeos
340