Add DeviceSettingsService.

chrome/browser/policy/cloud_policy_validator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/cloud_policy_validator.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/message_loop.h"
 #include "chrome/browser/policy/cloud_policy_constants.h"
@@ skipping 17 matching lines @@
 const uint8 kSignatureAlgorithm[] = {
     0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
     0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00
 };
 
 }  // namespace
 
 CloudPolicyValidatorBase::~CloudPolicyValidatorBase() {}
 
 void CloudPolicyValidatorBase::ValidateTimestamp(base::Time not_before,
-                                                 base::Time now) {
+                                                 base::Time now,
+                                                 bool allow_missing_timestamp) {
   // Timestamp should be from the past. We allow for a 1-minute grace interval
   // to cover clock drift.
   validation_flags_ |= VALIDATE_TIMESTAMP;
   timestamp_not_before_ = not_before;
   timestamp_not_after_ =
       now + base::TimeDelta::FromSeconds(kTimestampGraceIntervalSeconds);
+  allow_missing_timestamp_ = allow_missing_timestamp;
 }
 
 void CloudPolicyValidatorBase::ValidateUsername(
     const std::string& expected_user) {
   validation_flags_ |= VALIDATE_USERNAME;
   user_ = gaia::CanonicalizeEmail(expected_user);
 }
 
 void CloudPolicyValidatorBase::ValidateDomain(
     const std::string& expected_domain) {
   validation_flags_ |= VALIDATE_DOMAIN;
   domain_ = gaia::CanonicalizeDomain(expected_domain);
 }
 
 void CloudPolicyValidatorBase::ValidateDMToken(const std::string& token) {
   validation_flags_ |= VALIDATE_TOKEN;
   token_ = token;
 }
 
 void CloudPolicyValidatorBase::ValidatePolicyType(
     const std::string& policy_type) {
   validation_flags_ |= VALIDATE_POLICY_TYPE;
   policy_type_ = policy_type;
 }
 
 void CloudPolicyValidatorBase::ValidatePayload() {
   validation_flags_ |= VALIDATE_PAYLOAD;
 }
 
-void CloudPolicyValidatorBase::ValidateSignature(const std::string& key) {
+void CloudPolicyValidatorBase::ValidateSignature(const std::string& key,
+                                                 bool allow_key_rotation) {
   validation_flags_ |= VALIDATE_SIGNATURE;
   key_ = key;
+  allow_key_rotation_ = allow_key_rotation;
 }
 
 void CloudPolicyValidatorBase::ValidateInitialKey() {
   validation_flags_ |= VALIDATE_INITIAL_KEY;
 }
 
 void CloudPolicyValidatorBase::ValidateAgainstCurrentPolicy(
-    const em::PolicyData* policy_data) {
+    const em::PolicyData* policy_data,
+    bool allow_missing_timestamp) {
   base::Time last_policy_timestamp;
   std::string expected_dm_token;
   if (policy_data) {
     last_policy_timestamp =
         base::Time::UnixEpoch() +
         base::TimeDelta::FromMilliseconds(policy_data->timestamp());
     expected_dm_token = policy_data->request_token();
   }
-  ValidateTimestamp(last_policy_timestamp, base::Time::NowFromSystemTime());
+  ValidateTimestamp(last_policy_timestamp, base::Time::NowFromSystemTime(),
+                    allow_missing_timestamp);
   if (!expected_dm_token.empty())
     ValidateDMToken(expected_dm_token);
 }
 
 void CloudPolicyValidatorBase::StartValidation() {
   content::BrowserThread::PostTask(
       content::BrowserThread::FILE, FROM_HERE,
       base::Bind(&CloudPolicyValidatorBase::PerformValidation,
                  base::Passed(scoped_ptr<CloudPolicyValidatorBase>(this)),
                  MessageLoop::current()->message_loop_proxy()));
@@ skipping 68 matching lines @@
     if (validation_flags_ & kCheckFunctions[i].flag) {
       status_ = (this->*(kCheckFunctions[i].checkFunction))();
       if (status_ != VALIDATION_OK)
         break;
     }
   }
 }
 
 CloudPolicyValidatorBase::Status CloudPolicyValidatorBase::CheckSignature() {
   std::string signature_key(key_);
-  if (policy_->has_new_public_key()) {
+  if (policy_->has_new_public_key() && allow_key_rotation_) {
     signature_key = policy_->new_public_key();
     if (!policy_->has_new_public_key_signature() ||
         !VerifySignature(policy_->new_public_key(), key_,
                          policy_->new_public_key_signature())) {
       LOG(ERROR) << "New public key signature verification failed";
       return VALIDATION_BAD_SIGNATURE;
     }
   }
 
   if (!policy_->has_policy_data_signature() ||
@@ skipping 22 matching lines @@
   if (!policy_data_->has_policy_type() ||
        policy_data_->policy_type() != policy_type_) {
     LOG(ERROR) << "Wrong policy type " << policy_data_->policy_type();
     return VALIDATION_WRONG_POLICY_TYPE;
   }
 
   return VALIDATION_OK;
 }
 
 CloudPolicyValidatorBase::Status CloudPolicyValidatorBase::CheckTimestamp() {
+  if (!policy_data_->has_timestamp()) {
+    if (allow_missing_timestamp_) {
+      return VALIDATION_OK;
+    } else {
+      LOG(ERROR) << "Policy timestamp missing";
+      return VALIDATION_BAD_TIMESTAMP;
+    }
+  }
+
   base::Time policy_time =
       base::Time::UnixEpoch() +
       base::TimeDelta::FromMilliseconds(policy_data_->timestamp());
-  if (!policy_data_->has_timestamp()) {
-    LOG(ERROR) << "Policy timestamp missing";
-    return VALIDATION_BAD_TIMESTAMP;
-  }
   if (policy_time < timestamp_not_before_) {
     LOG(ERROR) << "Policy too old: " << policy_data_->timestamp();
     return VALIDATION_BAD_TIMESTAMP;
   }
   if (policy_time > timestamp_not_after_) {
     LOG(ERROR) << "Policy in the future: " << policy_data_->timestamp();
     return VALIDATION_BAD_TIMESTAMP;
   }
 
   return VALIDATION_OK;
@@ skipping 96 matching lines @@
     : CloudPolicyValidatorBase(policy_response.Pass(), payload.get(),
                                base::Bind(completion_callback, this)),
       payload_(payload.Pass()) {}
 
 template class CloudPolicyValidator<
     enterprise_management::ChromeDeviceSettingsProto>;
 template class CloudPolicyValidator<
     enterprise_management::CloudPolicySettings>;
 
 }  // namespace policy