session_manager_operation.cc revision c2e0dbddbe15c98d52c4786dac06cb8952a8ae6d 
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/chromeos/settings/session_manager_operation.h"
6
7#include "base/bind.h"
8#include "base/bind_helpers.h"
9#include "base/file_util.h"
10#include "base/files/file_path.h"
11#include "base/message_loop.h"
12#include "base/stl_util.h"
13#include "base/task_runner_util.h"
14#include "base/threading/sequenced_worker_pool.h"
15#include "base/time.h"
16#include "chrome/browser/chromeos/settings/owner_key_util.h"
17#include "chrome/browser/policy/cloud/cloud_policy_constants.h"
18#include "chrome/browser/policy/proto/chromeos/chrome_device_policy.pb.h"
19#include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h"
20#include "content/public/browser/browser_thread.h"
21#include "crypto/rsa_private_key.h"
22#include "crypto/signature_creator.h"
23
24namespace em = enterprise_management;
25
26namespace chromeos {
27
28SessionManagerOperation::SessionManagerOperation(const Callback& callback)
29    : session_manager_client_(NULL),
30      weak_factory_(this),
31      callback_(callback),
32      force_key_load_(false),
33      is_loading_(false) {}
34
35SessionManagerOperation::~SessionManagerOperation() {}
36
37void SessionManagerOperation::Start(
38    SessionManagerClient* session_manager_client,
39    scoped_refptr<OwnerKeyUtil> owner_key_util,
40    scoped_refptr<OwnerKey> owner_key) {
41  session_manager_client_ = session_manager_client;
42  owner_key_util_ = owner_key_util;
43  owner_key_ = owner_key;
44  Run();
45}
46
47void SessionManagerOperation::RestartLoad(bool key_changed) {
48  if (key_changed)
49    owner_key_ = NULL;
50
51  if (!is_loading_)
52    return;
53
54  // Abort previous load operations.
55  weak_factory_.InvalidateWeakPtrs();
56  StartLoading();
57}
58
59void SessionManagerOperation::StartLoading() {
60  is_loading_ = true;
61  EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings,
62                            weak_factory_.GetWeakPtr()));
63}
64
65void SessionManagerOperation::ReportResult(
66    DeviceSettingsService::Status status) {
67  callback_.Run(this, status);
68}
69
70void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) {
71  if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) {
72    base::PostTaskAndReplyWithResult(
73        content::BrowserThread::GetBlockingPool(),
74        FROM_HERE,
75        base::Bind(&SessionManagerOperation::LoadOwnerKey,
76                   owner_key_util_, owner_key_),
77        base::Bind(&SessionManagerOperation::StoreOwnerKey,
78                   weak_factory_.GetWeakPtr(), callback));
79  } else {
80    callback.Run();
81  }
82}
83
84// static
85scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey(
86    scoped_refptr<OwnerKeyUtil> util,
87    scoped_refptr<OwnerKey> current_key) {
88  scoped_ptr<std::vector<uint8> > public_key;
89  scoped_ptr<crypto::RSAPrivateKey> private_key;
90
91  // Keep any already-existing keys.
92  if (current_key.get()) {
93    if (current_key->public_key())
94      public_key.reset(new std::vector<uint8>(*current_key->public_key()));
95    if (current_key->private_key())
96      private_key.reset(current_key->private_key()->Copy());
97  }
98
99  if (!public_key.get() && util->IsPublicKeyPresent()) {
100    public_key.reset(new std::vector<uint8>());
101    if (!util->ImportPublicKey(public_key.get()))
102      LOG(ERROR) << "Failed to load public owner key.";
103  }
104
105  if (public_key.get() && !private_key.get()) {
106    private_key.reset(util->FindPrivateKey(*public_key));
107    if (!private_key.get())
108      VLOG(1) << "Failed to load private owner key.";
109  }
110
111  return new OwnerKey(public_key.Pass(), private_key.Pass());
112}
113
114void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback,
115                                            scoped_refptr<OwnerKey> new_key) {
116  force_key_load_ = false;
117  owner_key_ = new_key;
118
119  if (!owner_key_.get() || !owner_key_->public_key()) {
120    ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
121    return;
122  }
123
124  callback.Run();
125}
126
127void SessionManagerOperation::RetrieveDeviceSettings() {
128  session_manager_client()->RetrieveDevicePolicy(
129      base::Bind(&SessionManagerOperation::ValidateDeviceSettings,
130                 weak_factory_.GetWeakPtr()));
131}
132
133void SessionManagerOperation::ValidateDeviceSettings(
134    const std::string& policy_blob) {
135  scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
136  if (policy_blob.empty()) {
137    ReportResult(DeviceSettingsService::STORE_NO_POLICY);
138    return;
139  }
140
141  if (!policy->ParseFromString(policy_blob) ||
142      !policy->IsInitialized()) {
143    ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
144    return;
145  }
146
147  policy::DeviceCloudPolicyValidator* validator =
148      policy::DeviceCloudPolicyValidator::Create(policy.Pass());
149
150  // Policy auto-generated by session manager doesn't include a timestamp, so we
151  // need to allow missing timestamps.
152  const bool require_timestamp =
153      policy_data_.get() && policy_data_->has_request_token();
154  validator->ValidateAgainstCurrentPolicy(
155      policy_data_.get(),
156      require_timestamp ?
157          policy::CloudPolicyValidatorBase::TIMESTAMP_REQUIRED :
158          policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
159      policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
160  validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
161  validator->ValidatePayload();
162  validator->ValidateSignature(*owner_key_->public_key(), false);
163  validator->StartValidation(
164      base::Bind(&SessionManagerOperation::ReportValidatorStatus,
165                 weak_factory_.GetWeakPtr()));
166}
167
168void SessionManagerOperation::ReportValidatorStatus(
169    policy::DeviceCloudPolicyValidator* validator) {
170  DeviceSettingsService::Status status =
171      DeviceSettingsService::STORE_VALIDATION_ERROR;
172  if (validator->success()) {
173    status = DeviceSettingsService::STORE_SUCCESS;
174    policy_data_ = validator->policy_data().Pass();
175    device_settings_ = validator->payload().Pass();
176  } else {
177    LOG(ERROR) << "Policy validation failed: " << validator->status();
178
179    // Those are mostly caused by RTC loss and are recoverable.
180    if (validator->status() ==
181        policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) {
182      status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR;
183    }
184  }
185
186  ReportResult(status);
187}
188
189LoadSettingsOperation::LoadSettingsOperation(const Callback& callback)
190    : SessionManagerOperation(callback) {}
191
192LoadSettingsOperation::~LoadSettingsOperation() {}
193
194void LoadSettingsOperation::Run() {
195  StartLoading();
196}
197
198StoreSettingsOperation::StoreSettingsOperation(
199    const Callback& callback,
200    scoped_ptr<em::PolicyFetchResponse> policy)
201    : SessionManagerOperation(callback),
202      policy_(policy.Pass()),
203      weak_factory_(this) {}
204
205StoreSettingsOperation::~StoreSettingsOperation() {}
206
207void StoreSettingsOperation::Run() {
208  session_manager_client()->StoreDevicePolicy(
209      policy_->SerializeAsString(),
210      base::Bind(&StoreSettingsOperation::HandleStoreResult,
211                 weak_factory_.GetWeakPtr()));
212}
213
214void StoreSettingsOperation::HandleStoreResult(bool success) {
215  if (!success)
216    ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
217  else
218    StartLoading();
219}
220
221SignAndStoreSettingsOperation::SignAndStoreSettingsOperation(
222    const Callback& callback,
223    scoped_ptr<em::ChromeDeviceSettingsProto> new_settings,
224    const std::string& username)
225    : SessionManagerOperation(callback),
226      new_settings_(new_settings.Pass()),
227      username_(username),
228      weak_factory_(this) {
229  DCHECK(new_settings_.get());
230}
231
232SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {}
233
234void SignAndStoreSettingsOperation::Run() {
235  EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning,
236                            weak_factory_.GetWeakPtr()));
237}
238
239void SignAndStoreSettingsOperation::StartSigning() {
240  if (!owner_key() || !owner_key()->private_key() || username_.empty()) {
241    ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
242    return;
243  }
244
245  base::PostTaskAndReplyWithResult(
246      content::BrowserThread::GetBlockingPool(),
247      FROM_HERE,
248      base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy,
249                 base::Passed(&new_settings_), username_, owner_key()),
250      base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob,
251                 weak_factory_.GetWeakPtr()));
252}
253
254// static
255std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy(
256    scoped_ptr<em::ChromeDeviceSettingsProto> device_settings,
257    const std::string& username,
258    scoped_refptr<OwnerKey> owner_key) {
259  // Assemble the policy.
260  em::PolicyFetchResponse policy_response;
261  em::PolicyData policy;
262  policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType);
263  policy.set_timestamp((base::Time::NowFromSystemTime() -
264                        base::Time::UnixEpoch()).InMilliseconds());
265  policy.set_username(username);
266  if (!device_settings->SerializeToString(policy.mutable_policy_value()) ||
267      !policy.SerializeToString(policy_response.mutable_policy_data())) {
268    LOG(ERROR) << "Failed to encode policy payload.";
269    return std::string();
270  }
271
272  // Generate the signature.
273  scoped_ptr<crypto::SignatureCreator> signature_creator(
274      crypto::SignatureCreator::Create(owner_key->private_key()));
275  signature_creator->Update(
276      reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()),
277      policy_response.policy_data().size());
278  std::vector<uint8> signature_bytes;
279  std::string policy_blob;
280  if (!signature_creator->Final(&signature_bytes)) {
281    LOG(ERROR) << "Failed to create policy signature.";
282    return std::string();
283  }
284
285  policy_response.mutable_policy_data_signature()->assign(
286      reinterpret_cast<const char*>(vector_as_array(&signature_bytes)),
287      signature_bytes.size());
288  return policy_response.SerializeAsString();
289}
290
291void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob(
292    std::string device_settings_blob) {
293  if (device_settings_blob.empty()) {
294    ReportResult(DeviceSettingsService::STORE_POLICY_ERROR);
295    return;
296  }
297
298  session_manager_client()->StoreDevicePolicy(
299      device_settings_blob,
300      base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult,
301                 weak_factory_.GetWeakPtr()));
302}
303
304void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
305  if (!success)
306    ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
307  else
308    StartLoading();
309}
310
311}  // namespace chromeos
312