1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "chrome/browser/chromeos/settings/session_manager_operation.h"
8 #include "base/bind_helpers.h"
9 #include "base/files/file_path.h"
10 #include "base/message_loop/message_loop.h"
11 #include "base/stl_util.h"
12 #include "base/task_runner_util.h"
13 #include "base/threading/sequenced_worker_pool.h"
14 #include "base/time/time.h"
15 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
16 #include "chrome/browser/chromeos/settings/owner_key_util.h"
17 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
18 #include "content/public/browser/browser_thread.h"
19 #include "crypto/rsa_private_key.h"
20 #include "crypto/signature_creator.h"
21 #include "policy/proto/device_management_backend.pb.h"
23 namespace em = enterprise_management;
27 SessionManagerOperation::SessionManagerOperation(const Callback& callback)
28 : session_manager_client_(NULL),
31 force_key_load_(false),
34 SessionManagerOperation::~SessionManagerOperation() {}
36 void SessionManagerOperation::Start(
37 SessionManagerClient* session_manager_client,
38 scoped_refptr<OwnerKeyUtil> owner_key_util,
39 scoped_refptr<OwnerKey> owner_key) {
40 session_manager_client_ = session_manager_client;
41 owner_key_util_ = owner_key_util;
42 owner_key_ = owner_key;
46 void SessionManagerOperation::RestartLoad(bool key_changed) {
53 // Abort previous load operations.
54 weak_factory_.InvalidateWeakPtrs();
55 // Mark as not loading to start loading again.
60 void SessionManagerOperation::StartLoading() {
64 EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings,
65 weak_factory_.GetWeakPtr()));
68 void SessionManagerOperation::ReportResult(
69 DeviceSettingsService::Status status) {
70 callback_.Run(this, status);
73 void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) {
74 if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) {
75 scoped_refptr<base::TaskRunner> task_runner =
76 content::BrowserThread::GetBlockingPool()->
77 GetTaskRunnerWithShutdownBehavior(
78 base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
79 base::PostTaskAndReplyWithResult(
82 base::Bind(&SessionManagerOperation::LoadOwnerKey,
83 owner_key_util_, owner_key_),
84 base::Bind(&SessionManagerOperation::StoreOwnerKey,
85 weak_factory_.GetWeakPtr(), callback));
92 scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey(
93 scoped_refptr<OwnerKeyUtil> util,
94 scoped_refptr<OwnerKey> current_key) {
95 scoped_ptr<std::vector<uint8> > public_key;
96 scoped_ptr<crypto::RSAPrivateKey> private_key;
98 // Keep any already-existing keys.
99 if (current_key.get()) {
100 if (current_key->public_key())
101 public_key.reset(new std::vector<uint8>(*current_key->public_key()));
102 if (current_key->private_key())
103 private_key.reset(current_key->private_key()->Copy());
106 if (!public_key.get() && util->IsPublicKeyPresent()) {
107 public_key.reset(new std::vector<uint8>());
108 if (!util->ImportPublicKey(public_key.get()))
109 LOG(ERROR) << "Failed to load public owner key.";
112 if (public_key.get() && !private_key.get()) {
113 private_key.reset(util->FindPrivateKey(*public_key));
114 if (!private_key.get())
115 VLOG(1) << "Failed to load private owner key.";
118 return new OwnerKey(public_key.Pass(), private_key.Pass());
121 void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback,
122 scoped_refptr<OwnerKey> new_key) {
123 force_key_load_ = false;
124 owner_key_ = new_key;
126 if (!owner_key_.get() || !owner_key_->public_key()) {
127 ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
134 void SessionManagerOperation::RetrieveDeviceSettings() {
135 session_manager_client()->RetrieveDevicePolicy(
136 base::Bind(&SessionManagerOperation::ValidateDeviceSettings,
137 weak_factory_.GetWeakPtr()));
140 void SessionManagerOperation::ValidateDeviceSettings(
141 const std::string& policy_blob) {
142 scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
143 if (policy_blob.empty()) {
144 ReportResult(DeviceSettingsService::STORE_NO_POLICY);
148 if (!policy->ParseFromString(policy_blob) ||
149 !policy->IsInitialized()) {
150 ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
154 base::SequencedWorkerPool* pool =
155 content::BrowserThread::GetBlockingPool();
156 scoped_refptr<base::SequencedTaskRunner> background_task_runner =
157 pool->GetSequencedTaskRunnerWithShutdownBehavior(
158 pool->GetSequenceToken(),
159 base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
161 policy::DeviceCloudPolicyValidator* validator =
162 policy::DeviceCloudPolicyValidator::Create(policy.Pass(),
163 background_task_runner);
166 // Policy auto-generated by session manager doesn't include a timestamp, so
167 // the timestamp shouldn't be verified in that case.
169 // Additionally, offline devices can get their clock set backwards in time
170 // under some hardware conditions; checking the timestamp now could likely
171 // find a value in the future, and prevent the user from signing-in or
172 // starting guest mode. Tlsdate will eventually fix the clock when the device
173 // is back online, but the network configuration may come from device ONC.
175 // To prevent all of these issues the timestamp is just not verified when
176 // loading the device policy from the cache. Note that the timestamp is still
177 // verified during enrollment and when a new policy is fetched from the
179 validator->ValidateAgainstCurrentPolicy(
181 policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
182 policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
183 validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
184 validator->ValidatePayload();
185 // We don't check the DMServer verification key below, because the signing
186 // key is validated when it is installed.
187 validator->ValidateSignature(owner_key_->public_key_as_string(),
188 std::string(), // No key validation check.
191 validator->StartValidation(
192 base::Bind(&SessionManagerOperation::ReportValidatorStatus,
193 weak_factory_.GetWeakPtr()));
196 void SessionManagerOperation::ReportValidatorStatus(
197 policy::DeviceCloudPolicyValidator* validator) {
198 DeviceSettingsService::Status status =
199 DeviceSettingsService::STORE_VALIDATION_ERROR;
200 if (validator->success()) {
201 status = DeviceSettingsService::STORE_SUCCESS;
202 policy_data_ = validator->policy_data().Pass();
203 device_settings_ = validator->payload().Pass();
205 LOG(ERROR) << "Policy validation failed: " << validator->status();
207 // Those are mostly caused by RTC loss and are recoverable.
208 if (validator->status() ==
209 policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) {
210 status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR;
214 ReportResult(status);
217 LoadSettingsOperation::LoadSettingsOperation(const Callback& callback)
218 : SessionManagerOperation(callback) {}
220 LoadSettingsOperation::~LoadSettingsOperation() {}
222 void LoadSettingsOperation::Run() {
226 StoreSettingsOperation::StoreSettingsOperation(
227 const Callback& callback,
228 scoped_ptr<em::PolicyFetchResponse> policy)
229 : SessionManagerOperation(callback),
230 policy_(policy.Pass()),
231 weak_factory_(this) {}
233 StoreSettingsOperation::~StoreSettingsOperation() {}
235 void StoreSettingsOperation::Run() {
236 session_manager_client()->StoreDevicePolicy(
237 policy_->SerializeAsString(),
238 base::Bind(&StoreSettingsOperation::HandleStoreResult,
239 weak_factory_.GetWeakPtr()));
242 void StoreSettingsOperation::HandleStoreResult(bool success) {
244 ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
249 SignAndStoreSettingsOperation::SignAndStoreSettingsOperation(
250 const Callback& callback,
251 scoped_ptr<em::ChromeDeviceSettingsProto> new_settings,
252 const std::string& username)
253 : SessionManagerOperation(callback),
254 new_settings_(new_settings.Pass()),
256 weak_factory_(this) {
257 DCHECK(new_settings_.get());
260 SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {}
262 void SignAndStoreSettingsOperation::Run() {
263 EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning,
264 weak_factory_.GetWeakPtr()));
267 void SignAndStoreSettingsOperation::StartSigning() {
268 if (!owner_key().get() || !owner_key()->private_key() || username_.empty()) {
269 ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
273 base::PostTaskAndReplyWithResult(
274 content::BrowserThread::GetBlockingPool(),
276 base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy,
277 base::Passed(&new_settings_), username_, owner_key()),
278 base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob,
279 weak_factory_.GetWeakPtr()));
283 std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy(
284 scoped_ptr<em::ChromeDeviceSettingsProto> device_settings,
285 const std::string& username,
286 scoped_refptr<OwnerKey> owner_key) {
287 // Assemble the policy.
288 em::PolicyFetchResponse policy_response;
289 em::PolicyData policy;
290 policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType);
291 policy.set_timestamp((base::Time::NowFromSystemTime() -
292 base::Time::UnixEpoch()).InMilliseconds());
293 policy.set_username(username);
294 if (!device_settings->SerializeToString(policy.mutable_policy_value()) ||
295 !policy.SerializeToString(policy_response.mutable_policy_data())) {
296 LOG(ERROR) << "Failed to encode policy payload.";
297 return std::string();
300 // Generate the signature.
301 scoped_ptr<crypto::SignatureCreator> signature_creator(
302 crypto::SignatureCreator::Create(owner_key->private_key()));
303 signature_creator->Update(
304 reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()),
305 policy_response.policy_data().size());
306 std::vector<uint8> signature_bytes;
307 std::string policy_blob;
308 if (!signature_creator->Final(&signature_bytes)) {
309 LOG(ERROR) << "Failed to create policy signature.";
310 return std::string();
313 policy_response.mutable_policy_data_signature()->assign(
314 reinterpret_cast<const char*>(vector_as_array(&signature_bytes)),
315 signature_bytes.size());
316 return policy_response.SerializeAsString();
319 void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob(
320 std::string device_settings_blob) {
321 if (device_settings_blob.empty()) {
322 ReportResult(DeviceSettingsService::STORE_POLICY_ERROR);
326 session_manager_client()->StoreDevicePolicy(
327 device_settings_blob,
328 base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult,
329 weak_factory_.GetWeakPtr()));
332 void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
334 ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
339 } // namespace chromeos