src/chrome/browser/chromeos/settings/session_manager_operation.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/settings/session_manager_operation.h"
   6
   7 #include "base/bind.h"
   8 #include "base/bind_helpers.h"
   9 #include "base/files/file_path.h"
  10 #include "base/message_loop/message_loop.h"
  11 #include "base/stl_util.h"
  12 #include "base/task_runner_util.h"
  13 #include "base/threading/sequenced_worker_pool.h"
  14 #include "base/time/time.h"
  15 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
  16 #include "chrome/browser/chromeos/settings/owner_key_util.h"
  17 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
  18 #include "content/public/browser/browser_thread.h"
  19 #include "crypto/rsa_private_key.h"
  20 #include "crypto/signature_creator.h"
  21 #include "policy/proto/device_management_backend.pb.h"
  22
  23 namespace em = enterprise_management;
  24
  25 namespace chromeos {
  26
  27 SessionManagerOperation::SessionManagerOperation(const Callback& callback)
  28     : session_manager_client_(NULL),
  29       weak_factory_(this),
  30       callback_(callback),
  31       force_key_load_(false),
  32       is_loading_(false) {}
  33
  34 SessionManagerOperation::~SessionManagerOperation() {}
  35
  36 void SessionManagerOperation::Start(
  37     SessionManagerClient* session_manager_client,
  38     scoped_refptr<OwnerKeyUtil> owner_key_util,
  39     scoped_refptr<OwnerKey> owner_key) {
  40   session_manager_client_ = session_manager_client;
  41   owner_key_util_ = owner_key_util;
  42   owner_key_ = owner_key;
  43   Run();
  44 }
  45
  46 void SessionManagerOperation::RestartLoad(bool key_changed) {
  47   if (key_changed)
  48     owner_key_ = NULL;
  49
  50   if (!is_loading_)
  51     return;
  52
  53   // Abort previous load operations.
  54   weak_factory_.InvalidateWeakPtrs();
  55   // Mark as not loading to start loading again.
  56   is_loading_ = false;
  57   StartLoading();
  58 }
  59
  60 void SessionManagerOperation::StartLoading() {
  61   if (is_loading_)
  62     return;
  63   is_loading_ = true;
  64   EnsureOwnerKey(base::Bind(&SessionManagerOperation::RetrieveDeviceSettings,
  65                             weak_factory_.GetWeakPtr()));
  66 }
  67
  68 void SessionManagerOperation::ReportResult(
  69     DeviceSettingsService::Status status) {
  70   callback_.Run(this, status);
  71 }
  72
  73 void SessionManagerOperation::EnsureOwnerKey(const base::Closure& callback) {
  74   if (force_key_load_ || !owner_key_.get() || !owner_key_->public_key()) {
  75     scoped_refptr<base::TaskRunner> task_runner =
  76         content::BrowserThread::GetBlockingPool()->
  77         GetTaskRunnerWithShutdownBehavior(
  78             base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
  79     base::PostTaskAndReplyWithResult(
  80         task_runner.get(),
  81         FROM_HERE,
  82         base::Bind(&SessionManagerOperation::LoadOwnerKey,
  83                    owner_key_util_, owner_key_),
  84         base::Bind(&SessionManagerOperation::StoreOwnerKey,
  85                    weak_factory_.GetWeakPtr(), callback));
  86   } else {
  87     callback.Run();
  88   }
  89 }
  90
  91 // static
  92 scoped_refptr<OwnerKey> SessionManagerOperation::LoadOwnerKey(
  93     scoped_refptr<OwnerKeyUtil> util,
  94     scoped_refptr<OwnerKey> current_key) {
  95   scoped_ptr<std::vector<uint8> > public_key;
  96   scoped_ptr<crypto::RSAPrivateKey> private_key;
  97
  98   // Keep any already-existing keys.
  99   if (current_key.get()) {
 100     if (current_key->public_key())
 101       public_key.reset(new std::vector<uint8>(*current_key->public_key()));
 102     if (current_key->private_key())
 103       private_key.reset(current_key->private_key()->Copy());
 104   }
 105
 106   if (!public_key.get() && util->IsPublicKeyPresent()) {
 107     public_key.reset(new std::vector<uint8>());
 108     if (!util->ImportPublicKey(public_key.get()))
 109       LOG(ERROR) << "Failed to load public owner key.";
 110   }
 111
 112   if (public_key.get() && !private_key.get()) {
 113     private_key.reset(util->FindPrivateKey(*public_key));
 114     if (!private_key.get())
 115       VLOG(1) << "Failed to load private owner key.";
 116   }
 117
 118   return new OwnerKey(public_key.Pass(), private_key.Pass());
 119 }
 120
 121 void SessionManagerOperation::StoreOwnerKey(const base::Closure& callback,
 122                                             scoped_refptr<OwnerKey> new_key) {
 123   force_key_load_ = false;
 124   owner_key_ = new_key;
 125
 126   if (!owner_key_.get() || !owner_key_->public_key()) {
 127     ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
 128     return;
 129   }
 130
 131   callback.Run();
 132 }
 133
 134 void SessionManagerOperation::RetrieveDeviceSettings() {
 135   session_manager_client()->RetrieveDevicePolicy(
 136       base::Bind(&SessionManagerOperation::ValidateDeviceSettings,
 137                  weak_factory_.GetWeakPtr()));
 138 }
 139
 140 void SessionManagerOperation::ValidateDeviceSettings(
 141     const std::string& policy_blob) {
 142   scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
 143   if (policy_blob.empty()) {
 144     ReportResult(DeviceSettingsService::STORE_NO_POLICY);
 145     return;
 146   }
 147
 148   if (!policy->ParseFromString(policy_blob) ||
 149       !policy->IsInitialized()) {
 150     ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
 151     return;
 152   }
 153
 154   base::SequencedWorkerPool* pool =
 155       content::BrowserThread::GetBlockingPool();
 156   scoped_refptr<base::SequencedTaskRunner> background_task_runner =
 157       pool->GetSequencedTaskRunnerWithShutdownBehavior(
 158           pool->GetSequenceToken(),
 159           base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
 160
 161   policy::DeviceCloudPolicyValidator* validator =
 162       policy::DeviceCloudPolicyValidator::Create(policy.Pass(),
 163                                                  background_task_runner);
 164
 165
 166   // Policy auto-generated by session manager doesn't include a timestamp, so
 167   // the timestamp shouldn't be verified in that case.
 168   //
 169   // Additionally, offline devices can get their clock set backwards in time
 170   // under some hardware conditions; checking the timestamp now could likely
 171   // find a value in the future, and prevent the user from signing-in or
 172   // starting guest mode. Tlsdate will eventually fix the clock when the device
 173   // is back online, but the network configuration may come from device ONC.
 174   //
 175   // To prevent all of these issues the timestamp is just not verified when
 176   // loading the device policy from the cache. Note that the timestamp is still
 177   // verified during enrollment and when a new policy is fetched from the
 178   // server.
 179   validator->ValidateAgainstCurrentPolicy(
 180       policy_data_.get(),
 181       policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
 182       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
 183   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
 184   validator->ValidatePayload();
 185   // We don't check the DMServer verification key below, because the signing
 186   // key is validated when it is installed.
 187   validator->ValidateSignature(owner_key_->public_key_as_string(),
 188                                std::string(),  // No key validation check.
 189                                std::string(),
 190                                false);
 191   validator->StartValidation(
 192       base::Bind(&SessionManagerOperation::ReportValidatorStatus,
 193                  weak_factory_.GetWeakPtr()));
 194 }
 195
 196 void SessionManagerOperation::ReportValidatorStatus(
 197     policy::DeviceCloudPolicyValidator* validator) {
 198   DeviceSettingsService::Status status =
 199       DeviceSettingsService::STORE_VALIDATION_ERROR;
 200   if (validator->success()) {
 201     status = DeviceSettingsService::STORE_SUCCESS;
 202     policy_data_ = validator->policy_data().Pass();
 203     device_settings_ = validator->payload().Pass();
 204   } else {
 205     LOG(ERROR) << "Policy validation failed: " << validator->status();
 206
 207     // Those are mostly caused by RTC loss and are recoverable.
 208     if (validator->status() ==
 209         policy::DeviceCloudPolicyValidator::VALIDATION_BAD_TIMESTAMP) {
 210       status = DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR;
 211     }
 212   }
 213
 214   ReportResult(status);
 215 }
 216
 217 LoadSettingsOperation::LoadSettingsOperation(const Callback& callback)
 218     : SessionManagerOperation(callback) {}
 219
 220 LoadSettingsOperation::~LoadSettingsOperation() {}
 221
 222 void LoadSettingsOperation::Run() {
 223   StartLoading();
 224 }
 225
 226 StoreSettingsOperation::StoreSettingsOperation(
 227     const Callback& callback,
 228     scoped_ptr<em::PolicyFetchResponse> policy)
 229     : SessionManagerOperation(callback),
 230       policy_(policy.Pass()),
 231       weak_factory_(this) {}
 232
 233 StoreSettingsOperation::~StoreSettingsOperation() {}
 234
 235 void StoreSettingsOperation::Run() {
 236   session_manager_client()->StoreDevicePolicy(
 237       policy_->SerializeAsString(),
 238       base::Bind(&StoreSettingsOperation::HandleStoreResult,
 239                  weak_factory_.GetWeakPtr()));
 240 }
 241
 242 void StoreSettingsOperation::HandleStoreResult(bool success) {
 243   if (!success)
 244     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
 245   else
 246     StartLoading();
 247 }
 248
 249 SignAndStoreSettingsOperation::SignAndStoreSettingsOperation(
 250     const Callback& callback,
 251     scoped_ptr<em::ChromeDeviceSettingsProto> new_settings,
 252     const std::string& username)
 253     : SessionManagerOperation(callback),
 254       new_settings_(new_settings.Pass()),
 255       username_(username),
 256       weak_factory_(this) {
 257   DCHECK(new_settings_.get());
 258 }
 259
 260 SignAndStoreSettingsOperation::~SignAndStoreSettingsOperation() {}
 261
 262 void SignAndStoreSettingsOperation::Run() {
 263   EnsureOwnerKey(base::Bind(&SignAndStoreSettingsOperation::StartSigning,
 264                             weak_factory_.GetWeakPtr()));
 265 }
 266
 267 void SignAndStoreSettingsOperation::StartSigning() {
 268   if (!owner_key().get() || !owner_key()->private_key() || username_.empty()) {
 269     ReportResult(DeviceSettingsService::STORE_KEY_UNAVAILABLE);
 270     return;
 271   }
 272
 273   base::PostTaskAndReplyWithResult(
 274       content::BrowserThread::GetBlockingPool(),
 275       FROM_HERE,
 276       base::Bind(&SignAndStoreSettingsOperation::AssembleAndSignPolicy,
 277                  base::Passed(&new_settings_), username_, owner_key()),
 278       base::Bind(&SignAndStoreSettingsOperation::StoreDeviceSettingsBlob,
 279                  weak_factory_.GetWeakPtr()));
 280 }
 281
 282 // static
 283 std::string SignAndStoreSettingsOperation::AssembleAndSignPolicy(
 284     scoped_ptr<em::ChromeDeviceSettingsProto> device_settings,
 285     const std::string& username,
 286     scoped_refptr<OwnerKey> owner_key) {
 287   // Assemble the policy.
 288   em::PolicyFetchResponse policy_response;
 289   em::PolicyData policy;
 290   policy.set_policy_type(policy::dm_protocol::kChromeDevicePolicyType);
 291   policy.set_timestamp((base::Time::NowFromSystemTime() -
 292                         base::Time::UnixEpoch()).InMilliseconds());
 293   policy.set_username(username);
 294   if (!device_settings->SerializeToString(policy.mutable_policy_value()) ||
 295       !policy.SerializeToString(policy_response.mutable_policy_data())) {
 296     LOG(ERROR) << "Failed to encode policy payload.";
 297     return std::string();
 298   }
 299
 300   // Generate the signature.
 301   scoped_ptr<crypto::SignatureCreator> signature_creator(
 302       crypto::SignatureCreator::Create(owner_key->private_key()));
 303   signature_creator->Update(
 304       reinterpret_cast<const uint8*>(policy_response.policy_data().c_str()),
 305       policy_response.policy_data().size());
 306   std::vector<uint8> signature_bytes;
 307   std::string policy_blob;
 308   if (!signature_creator->Final(&signature_bytes)) {
 309     LOG(ERROR) << "Failed to create policy signature.";
 310     return std::string();
 311   }
 312
 313   policy_response.mutable_policy_data_signature()->assign(
 314       reinterpret_cast<const char*>(vector_as_array(&signature_bytes)),
 315       signature_bytes.size());
 316   return policy_response.SerializeAsString();
 317 }
 318
 319 void SignAndStoreSettingsOperation::StoreDeviceSettingsBlob(
 320     std::string device_settings_blob) {
 321   if (device_settings_blob.empty()) {
 322     ReportResult(DeviceSettingsService::STORE_POLICY_ERROR);
 323     return;
 324   }
 325
 326   session_manager_client()->StoreDevicePolicy(
 327       device_settings_blob,
 328       base::Bind(&SignAndStoreSettingsOperation::HandleStoreResult,
 329                  weak_factory_.GetWeakPtr()));
 330 }
 331
 332 void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
 333   if (!success)
 334     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
 335   else
 336     StartLoading();
 337 }
 338
 339 }  // namespace chromeos