session_manager_operation.cc revision c2e0dbddbe15c98d52c4786dac06cb8952a8ae6d
1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "chrome/browser/chromeos/settings/session_manager_operation.h" 6 7#include "base/bind.h" 8#include "base/bind_helpers.h" 9#include "base/file_util.h" 10#include "base/files/file_path.h" 11#include "base/message_loop.h" 12#include "base/stl_util.h" 13#include "base/task_runner_util.h" 14#include "base/threading/sequenced_worker_pool.h" 15#include "base/time.h" 16#include "chrome/browser/chromeos/settings/owner_key_util.h" 17#include "chrome/browser/policy/cloud/cloud_policy_constants.h" 18#include "chrome/browser/policy/proto/chromeos/chrome_device_policy.pb.h" 19#include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h" 20#include "content/public/browser/browser_thread.h" 21#include "crypto/rsa_private_key.h" 22#include "crypto/signature_creator.h" 23 24namespace em = enterprise_management; 25 26namespace chromeos { 27 28SessionManagerOperation::SessionManagerOperation(const Callback& callback) 29 : session_manager_client_(NULL), 30 weak_factory_(this), 31 callback_(callback), 32 force_key_load_(false), 33 is_loading_(false) {} 34 35SessionManagerOperation::~SessionManagerOperation() {} 36 37void SessionManagerOperation::Start( 38 SessionManagerClient* session_manager_client, 39 scoped_refptr<OwnerKeyUtil> owner_key_util, 40 scoped_refptr<OwnerKey> owner_key) { 41 session_manager_client_ = session_manager_client; 42 owner_key_util_ = owner_key_util; 43 owner_key_ = owner_key; 44 Run(); 45} 46 47void SessionManagerOperation::RestartLoad(bool key_changed) { 48 if (key_changed) 49 owner_key_ = NULL; 50 51 if (!is_loading_) 52 return; 53 54 // Abort previous load operations. 55 weak_factory_.InvalidateWeakPtrs(); 56 StartLoading(); 57} 58 59void SessionManagerOperation::StartLoading() { 60 is_loading_ = true; 61 EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings, 62 weak_factory_.GetWeakPtr())); 63} 64 65void SessionManagerOperation::ReportResult( 66 DeviceSettingsService::Status status) { 67 callback_.Run(this, status); 68} 69 70void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) { 71 if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) { 72 base::PostTaskAndReplyWithResult( 73 content::BrowserThread::GetBlockingPool(), 74 FROM_HERE, 75 base::Bind(&SessionManagerOperation::LoadOwnerKey, 76 owner_key_util_, owner_key_), 77 base::Bind(&SessionManagerOperation::StoreOwnerKey, 78 weak_factory_.GetWeakPtr(), callback)); 79 } else { 80 callback.Run(); 81 } 82} 83 84// static 85scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey( 86 scoped_refptr<OwnerKeyUtil> util, 87 scoped_refptr<OwnerKey> current_key) { 88 scoped_ptr<std::vector<uint8> > public_key; 89 scoped_ptr<crypto::RSAPrivateKey> private_key; 90 91 // Keep any already-existing keys. 92 if (current_key.get()) { 93 if (current_key->public_key()) 94 public_key.reset(new std::vector<uint8>(*current_key->public_key())); 95 if (current_key->private_key()) 96 private_key.reset(current_key->private_key()->Copy()); 97 } 98 99 if (!public_key.get() && util->IsPublicKeyPresent()) { 100 public_key.reset(new std::vector<uint8>()); 101 if (!util->ImportPublicKey(public_key.get())) 102 LOG(ERROR) << "Failed to load public owner key."; 103 } 104 105 if (public_key.get() && !private_key.get()) { 106 private_key.reset(util->FindPrivateKey(*public_key)); 107 if (!private_key.get()) 108 VLOG(1) << "Failed to load private owner key."; 109 } 110 111 return new OwnerKey(public_key.Pass(), private_key.Pass()); 112} 113 114void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback, 115 scoped_refptr<OwnerKey> new_key) { 116 force_key_load_ = false; 117 owner_key_ = new_key; 118 119 if (!owner_key_.get() || !owner_key_->public_key()) { 120 ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE); 121 return; 122 } 123 124 callback.Run(); 125} 126 127void SessionManagerOperation::RetrieveDeviceSettings() { 128 session_manager_client()->RetrieveDevicePolicy( 129 base::Bind(&SessionManagerOperation::ValidateDeviceSettings, 130 weak_factory_.GetWeakPtr())); 131} 132 133void SessionManagerOperation::ValidateDeviceSettings( 134 const std::string& policy_blob) { 135 scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse()); 136 if (policy_blob.empty()) { 137 ReportResult(DeviceSettingsService::STORE_NO_POLICY); 138 return; 139 } 140 141 if (!policy->ParseFromString(policy_blob) || 142 !policy->IsInitialized()) { 143 ReportResult(DeviceSettingsService::STORE_INVALID_POLICY); 144 return; 145 } 146 147 policy::DeviceCloudPolicyValidator* validator = 148 policy::DeviceCloudPolicyValidator::Create(policy.Pass()); 149 150 // Policy auto-generated by session manager doesn't include a timestamp, so we 151 // need to allow missing timestamps. 152 const bool require_timestamp = 153 policy_data_.get() && policy_data_->has_request_token(); 154 validator->ValidateAgainstCurrentPolicy( 155 policy_data_.get(), 156 require_timestamp ? 157 policy::CloudPolicyValidatorBase::TIMESTAMP_REQUIRED : 158 policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED, 159 policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED); 160 validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType); 161 validator->ValidatePayload(); 162 validator->ValidateSignature(*owner_key_->public_key(), false); 163 validator->StartValidation( 164 base::Bind(&SessionManagerOperation::ReportValidatorStatus, 165 weak_factory_.GetWeakPtr())); 166} 167 168void SessionManagerOperation::ReportValidatorStatus( 169 policy::DeviceCloudPolicyValidator* validator) { 170 DeviceSettingsService::Status status = 171 DeviceSettingsService::STORE_VALIDATION_ERROR; 172 if (validator->success()) { 173 status = DeviceSettingsService::STORE_SUCCESS; 174 policy_data_ = validator->policy_data().Pass(); 175 device_settings_ = validator->payload().Pass(); 176 } else { 177 LOG(ERROR) << "Policy validation failed: " << validator->status(); 178 179 // Those are mostly caused by RTC loss and are recoverable. 180 if (validator->status() == 181 policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) { 182 status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR; 183 } 184 } 185 186 ReportResult(status); 187} 188 189LoadSettingsOperation::LoadSettingsOperation(const Callback& callback) 190 : SessionManagerOperation(callback) {} 191 192LoadSettingsOperation::~LoadSettingsOperation() {} 193 194void LoadSettingsOperation::Run() { 195 StartLoading(); 196} 197 198StoreSettingsOperation::StoreSettingsOperation( 199 const Callback& callback, 200 scoped_ptr<em::PolicyFetchResponse> policy) 201 : SessionManagerOperation(callback), 202 policy_(policy.Pass()), 203 weak_factory_(this) {} 204 205StoreSettingsOperation::~StoreSettingsOperation() {} 206 207void StoreSettingsOperation::Run() { 208 session_manager_client()->StoreDevicePolicy( 209 policy_->SerializeAsString(), 210 base::Bind(&StoreSettingsOperation::HandleStoreResult, 211 weak_factory_.GetWeakPtr())); 212} 213 214void StoreSettingsOperation::HandleStoreResult(bool success) { 215 if (!success) 216 ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED); 217 else 218 StartLoading(); 219} 220 221SignAndStoreSettingsOperation::SignAndStoreSettingsOperation( 222 const Callback& callback, 223 scoped_ptr<em::ChromeDeviceSettingsProto> new_settings, 224 const std::string& username) 225 : SessionManagerOperation(callback), 226 new_settings_(new_settings.Pass()), 227 username_(username), 228 weak_factory_(this) { 229 DCHECK(new_settings_.get()); 230} 231 232SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {} 233 234void SignAndStoreSettingsOperation::Run() { 235 EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning, 236 weak_factory_.GetWeakPtr())); 237} 238 239void SignAndStoreSettingsOperation::StartSigning() { 240 if (!owner_key() || !owner_key()->private_key() || username_.empty()) { 241 ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE); 242 return; 243 } 244 245 base::PostTaskAndReplyWithResult( 246 content::BrowserThread::GetBlockingPool(), 247 FROM_HERE, 248 base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy, 249 base::Passed(&new_settings_), username_, owner_key()), 250 base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob, 251 weak_factory_.GetWeakPtr())); 252} 253 254// static 255std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy( 256 scoped_ptr<em::ChromeDeviceSettingsProto> device_settings, 257 const std::string& username, 258 scoped_refptr<OwnerKey> owner_key) { 259 // Assemble the policy. 260 em::PolicyFetchResponse policy_response; 261 em::PolicyData policy; 262 policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType); 263 policy.set_timestamp((base::Time::NowFromSystemTime() - 264 base::Time::UnixEpoch()).InMilliseconds()); 265 policy.set_username(username); 266 if (!device_settings->SerializeToString(policy.mutable_policy_value()) || 267 !policy.SerializeToString(policy_response.mutable_policy_data())) { 268 LOG(ERROR) << "Failed to encode policy payload."; 269 return std::string(); 270 } 271 272 // Generate the signature. 273 scoped_ptr<crypto::SignatureCreator> signature_creator( 274 crypto::SignatureCreator::Create(owner_key->private_key())); 275 signature_creator->Update( 276 reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()), 277 policy_response.policy_data().size()); 278 std::vector<uint8> signature_bytes; 279 std::string policy_blob; 280 if (!signature_creator->Final(&signature_bytes)) { 281 LOG(ERROR) << "Failed to create policy signature."; 282 return std::string(); 283 } 284 285 policy_response.mutable_policy_data_signature()->assign( 286 reinterpret_cast<const char*>(vector_as_array(&signature_bytes)), 287 signature_bytes.size()); 288 return policy_response.SerializeAsString(); 289} 290 291void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob( 292 std::string device_settings_blob) { 293 if (device_settings_blob.empty()) { 294 ReportResult(DeviceSettingsService::STORE_POLICY_ERROR); 295 return; 296 } 297 298 session_manager_client()->StoreDevicePolicy( 299 device_settings_blob, 300 base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult, 301 weak_factory_.GetWeakPtr())); 302} 303 304void SignAndStoreSettingsOperation::HandleStoreResult(bool success) { 305 if (!success) 306 ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED); 307 else 308 StartLoading(); 309} 310 311} // namespace chromeos 312