session_manager_operation.cc revision 8bcbed890bc3ce4d7a057a8f32cab53fa534672e 
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/chromeos/settings/session_manager_operation.h"
6
7#include "base/bind.h"
8#include "base/bind_helpers.h"
9#include "base/files/file_path.h"
10#include "base/message_loop/message_loop.h"
11#include "base/stl_util.h"
12#include "base/task_runner_util.h"
13#include "base/threading/sequenced_worker_pool.h"
14#include "base/time/time.h"
15#include "chrome/browser/chromeos/settings/owner_key_util.h"
16#include "chrome/browser/policy/cloud/cloud_policy_constants.h"
17#include "chrome/browser/policy/proto/chromeos/chrome_device_policy.pb.h"
18#include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h"
19#include "content/public/browser/browser_thread.h"
20#include "crypto/rsa_private_key.h"
21#include "crypto/signature_creator.h"
22
23namespace em = enterprise_management;
24
25namespace chromeos {
26
27SessionManagerOperation::SessionManagerOperation(const Callback& callback)
28    : session_manager_client_(NULL),
29      weak_factory_(this),
30      callback_(callback),
31      force_key_load_(false),
32      is_loading_(false) {}
33
34SessionManagerOperation::~SessionManagerOperation() {}
35
36void SessionManagerOperation::Start(
37    SessionManagerClient* session_manager_client,
38    scoped_refptr<OwnerKeyUtil> owner_key_util,
39    scoped_refptr<OwnerKey> owner_key) {
40  session_manager_client_ = session_manager_client;
41  owner_key_util_ = owner_key_util;
42  owner_key_ = owner_key;
43  Run();
44}
45
46void SessionManagerOperation::RestartLoad(bool key_changed) {
47  if (key_changed)
48    owner_key_ = NULL;
49
50  if (!is_loading_)
51    return;
52
53  // Abort previous load operations.
54  weak_factory_.InvalidateWeakPtrs();
55  StartLoading();
56}
57
58void SessionManagerOperation::StartLoading() {
59  is_loading_ = true;
60  EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings,
61                            weak_factory_.GetWeakPtr()));
62}
63
64void SessionManagerOperation::ReportResult(
65    DeviceSettingsService::Status status) {
66  callback_.Run(this, status);
67}
68
69void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) {
70  if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) {
71    base::PostTaskAndReplyWithResult(
72        content::BrowserThread::GetBlockingPool(),
73        FROM_HERE,
74        base::Bind(&SessionManagerOperation::LoadOwnerKey,
75                   owner_key_util_, owner_key_),
76        base::Bind(&SessionManagerOperation::StoreOwnerKey,
77                   weak_factory_.GetWeakPtr(), callback));
78  } else {
79    callback.Run();
80  }
81}
82
83// static
84scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey(
85    scoped_refptr<OwnerKeyUtil> util,
86    scoped_refptr<OwnerKey> current_key) {
87  scoped_ptr<std::vector<uint8> > public_key;
88  scoped_ptr<crypto::RSAPrivateKey> private_key;
89
90  // Keep any already-existing keys.
91  if (current_key.get()) {
92    if (current_key->public_key())
93      public_key.reset(new std::vector<uint8>(*current_key->public_key()));
94    if (current_key->private_key())
95      private_key.reset(current_key->private_key()->Copy());
96  }
97
98  if (!public_key.get() && util->IsPublicKeyPresent()) {
99    public_key.reset(new std::vector<uint8>());
100    if (!util->ImportPublicKey(public_key.get()))
101      LOG(ERROR) << "Failed to load public owner key.";
102  }
103
104  if (public_key.get() && !private_key.get()) {
105    private_key.reset(util->FindPrivateKey(*public_key));
106    if (!private_key.get())
107      VLOG(1) << "Failed to load private owner key.";
108  }
109
110  return new OwnerKey(public_key.Pass(), private_key.Pass());
111}
112
113void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback,
114                                            scoped_refptr<OwnerKey> new_key) {
115  force_key_load_ = false;
116  owner_key_ = new_key;
117
118  if (!owner_key_.get() || !owner_key_->public_key()) {
119    ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
120    return;
121  }
122
123  callback.Run();
124}
125
126void SessionManagerOperation::RetrieveDeviceSettings() {
127  session_manager_client()->RetrieveDevicePolicy(
128      base::Bind(&SessionManagerOperation::ValidateDeviceSettings,
129                 weak_factory_.GetWeakPtr()));
130}
131
132void SessionManagerOperation::ValidateDeviceSettings(
133    const std::string& policy_blob) {
134  scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
135  if (policy_blob.empty()) {
136    ReportResult(DeviceSettingsService::STORE_NO_POLICY);
137    return;
138  }
139
140  if (!policy->ParseFromString(policy_blob) ||
141      !policy->IsInitialized()) {
142    ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
143    return;
144  }
145
146  base::SequencedWorkerPool* pool =
147      content::BrowserThread::GetBlockingPool();
148  scoped_refptr<base::SequencedTaskRunner> background_task_runner =
149      pool->GetSequencedTaskRunnerWithShutdownBehavior(
150          pool->GetSequenceToken(),
151          base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
152
153  policy::DeviceCloudPolicyValidator* validator =
154      policy::DeviceCloudPolicyValidator::Create(policy.Pass(),
155                                                 background_task_runner);
156
157  // Policy auto-generated by session manager doesn't include a timestamp, so we
158  // need to allow missing timestamps.
159  const bool require_timestamp =
160      policy_data_.get() && policy_data_->has_request_token();
161  validator->ValidateAgainstCurrentPolicy(
162      policy_data_.get(),
163      require_timestamp ?
164          policy::CloudPolicyValidatorBase::TIMESTAMP_REQUIRED :
165          policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
166      policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
167  validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
168  validator->ValidatePayload();
169  validator->ValidateSignature(*owner_key_->public_key(), false);
170  validator->StartValidation(
171      base::Bind(&SessionManagerOperation::ReportValidatorStatus,
172                 weak_factory_.GetWeakPtr()));
173}
174
175void SessionManagerOperation::ReportValidatorStatus(
176    policy::DeviceCloudPolicyValidator* validator) {
177  DeviceSettingsService::Status status =
178      DeviceSettingsService::STORE_VALIDATION_ERROR;
179  if (validator->success()) {
180    status = DeviceSettingsService::STORE_SUCCESS;
181    policy_data_ = validator->policy_data().Pass();
182    device_settings_ = validator->payload().Pass();
183  } else {
184    LOG(ERROR) << "Policy validation failed: " << validator->status();
185
186    // Those are mostly caused by RTC loss and are recoverable.
187    if (validator->status() ==
188        policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) {
189      status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR;
190    }
191  }
192
193  ReportResult(status);
194}
195
196LoadSettingsOperation::LoadSettingsOperation(const Callback& callback)
197    : SessionManagerOperation(callback) {}
198
199LoadSettingsOperation::~LoadSettingsOperation() {}
200
201void LoadSettingsOperation::Run() {
202  StartLoading();
203}
204
205StoreSettingsOperation::StoreSettingsOperation(
206    const Callback& callback,
207    scoped_ptr<em::PolicyFetchResponse> policy)
208    : SessionManagerOperation(callback),
209      policy_(policy.Pass()),
210      weak_factory_(this) {}
211
212StoreSettingsOperation::~StoreSettingsOperation() {}
213
214void StoreSettingsOperation::Run() {
215  session_manager_client()->StoreDevicePolicy(
216      policy_->SerializeAsString(),
217      base::Bind(&StoreSettingsOperation::HandleStoreResult,
218                 weak_factory_.GetWeakPtr()));
219}
220
221void StoreSettingsOperation::HandleStoreResult(bool success) {
222  if (!success)
223    ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
224  else
225    StartLoading();
226}
227
228SignAndStoreSettingsOperation::SignAndStoreSettingsOperation(
229    const Callback& callback,
230    scoped_ptr<em::ChromeDeviceSettingsProto> new_settings,
231    const std::string& username)
232    : SessionManagerOperation(callback),
233      new_settings_(new_settings.Pass()),
234      username_(username),
235      weak_factory_(this) {
236  DCHECK(new_settings_.get());
237}
238
239SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {}
240
241void SignAndStoreSettingsOperation::Run() {
242  EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning,
243                            weak_factory_.GetWeakPtr()));
244}
245
246void SignAndStoreSettingsOperation::StartSigning() {
247  if (!owner_key().get() || !owner_key()->private_key() || username_.empty()) {
248    ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
249    return;
250  }
251
252  base::PostTaskAndReplyWithResult(
253      content::BrowserThread::GetBlockingPool(),
254      FROM_HERE,
255      base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy,
256                 base::Passed(&new_settings_), username_, owner_key()),
257      base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob,
258                 weak_factory_.GetWeakPtr()));
259}
260
261// static
262std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy(
263    scoped_ptr<em::ChromeDeviceSettingsProto> device_settings,
264    const std::string& username,
265    scoped_refptr<OwnerKey> owner_key) {
266  // Assemble the policy.
267  em::PolicyFetchResponse policy_response;
268  em::PolicyData policy;
269  policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType);
270  policy.set_timestamp((base::Time::NowFromSystemTime() -
271                        base::Time::UnixEpoch()).InMilliseconds());
272  policy.set_username(username);
273  if (!device_settings->SerializeToString(policy.mutable_policy_value()) ||
274      !policy.SerializeToString(policy_response.mutable_policy_data())) {
275    LOG(ERROR) << "Failed to encode policy payload.";
276    return std::string();
277  }
278
279  // Generate the signature.
280  scoped_ptr<crypto::SignatureCreator> signature_creator(
281      crypto::SignatureCreator::Create(owner_key->private_key()));
282  signature_creator->Update(
283      reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()),
284      policy_response.policy_data().size());
285  std::vector<uint8> signature_bytes;
286  std::string policy_blob;
287  if (!signature_creator->Final(&signature_bytes)) {
288    LOG(ERROR) << "Failed to create policy signature.";
289    return std::string();
290  }
291
292  policy_response.mutable_policy_data_signature()->assign(
293      reinterpret_cast<const char*>(vector_as_array(&signature_bytes)),
294      signature_bytes.size());
295  return policy_response.SerializeAsString();
296}
297
298void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob(
299    std::string device_settings_blob) {
300  if (device_settings_blob.empty()) {
301    ReportResult(DeviceSettingsService::STORE_POLICY_ERROR);
302    return;
303  }
304
305  session_manager_client()->StoreDevicePolicy(
306      device_settings_blob,
307      base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult,
308                 weak_factory_.GetWeakPtr()));
309}
310
311void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
312  if (!success)
313    ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
314  else
315    StartLoading();
316}
317
318}  // namespace chromeos
319