OLD | NEW |
| (Empty) |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef CHROME_BROWSER_POLICY_CLOUD_POLICY_CACHE_H_ | |
6 #define CHROME_BROWSER_POLICY_CLOUD_POLICY_CACHE_H_ | |
7 | |
8 #include <string> | |
9 | |
10 #include "base/file_path.h" | |
11 #include "base/gtest_prod_util.h" | |
12 #include "base/memory/ref_counted.h" | |
13 #include "base/memory/scoped_ptr.h" | |
14 #include "base/observer_list.h" | |
15 #include "base/threading/non_thread_safe.h" | |
16 #include "base/time.h" | |
17 #include "chrome/browser/policy/configuration_policy_provider.h" | |
18 #include "chrome/browser/policy/policy_map.h" | |
19 #include "chrome/browser/policy/proto/device_management_backend.pb.h" | |
20 #include "policy/configuration_policy_type.h" | |
21 | |
22 class DictionaryValue; | |
23 class ListValue; | |
24 class Value; | |
25 | |
26 using google::protobuf::RepeatedPtrField; | |
27 | |
28 namespace policy { | |
29 | |
30 namespace em = enterprise_management; | |
31 | |
32 // Keeps the authoritative copy of cloud policy information as read from the | |
33 // persistence file or determined by the policy backend. The cache doesn't talk | |
34 // to the service directly, but receives updated policy information through | |
35 // SetPolicy() calls, which is then persisted and decoded into the internal | |
36 // Value representation chrome uses. | |
37 class CloudPolicyCache : public base::NonThreadSafe { | |
38 public: | |
39 // Used to distinguish mandatory from recommended policies. | |
40 enum PolicyLevel { | |
41 // Policy is forced upon the user and should always take effect. | |
42 POLICY_LEVEL_MANDATORY, | |
43 // The value is just a recommendation that the user may override. | |
44 POLICY_LEVEL_RECOMMENDED, | |
45 }; | |
46 | |
47 explicit CloudPolicyCache(const FilePath& backing_file_path); | |
48 ~CloudPolicyCache(); | |
49 | |
50 // Loads policy information from the backing file. Non-existing or erroneous | |
51 // cache files are ignored. | |
52 void LoadFromFile(); | |
53 | |
54 // Resets the policy information. | |
55 void SetPolicy(const em::PolicyFetchResponse& policy); | |
56 void SetDevicePolicy(const em::DevicePolicyResponse& policy); | |
57 | |
58 ConfigurationPolicyProvider* GetManagedPolicyProvider(); | |
59 ConfigurationPolicyProvider* GetRecommendedPolicyProvider(); | |
60 | |
61 void SetUnmanaged(); | |
62 bool is_unmanaged() const { | |
63 return is_unmanaged_; | |
64 } | |
65 | |
66 // Returns the time at which the policy was last fetched. | |
67 base::Time last_policy_refresh_time() const { | |
68 return last_policy_refresh_time_; | |
69 } | |
70 | |
71 // Returns true if this cache holds (old-style) device policy that should be | |
72 // given preference over (new-style) mandatory/recommended policy. | |
73 bool has_device_policy() const { | |
74 return has_device_policy_; | |
75 } | |
76 | |
77 private: | |
78 class CloudPolicyProvider; | |
79 | |
80 friend class CloudPolicyCacheTest; | |
81 friend class DeviceManagementPolicyCacheTest; | |
82 friend class DeviceManagementPolicyCacheDecodeTest; | |
83 | |
84 // Decodes a CloudPolicyResponse into two (ConfigurationPolicyType -> Value*) | |
85 // maps and a timestamp. Also performs verification, returns NULL if any | |
86 // check fails. | |
87 static bool DecodePolicyResponse( | |
88 const em::PolicyFetchResponse& policy_response, | |
89 PolicyMap* mandatory, | |
90 PolicyMap* recommended, | |
91 base::Time* timestamp); | |
92 | |
93 // Returns true if |certificate_chain| is trusted and a |signature| created | |
94 // from it matches |data|. | |
95 static bool VerifySignature( | |
96 const std::string& signature, | |
97 const std::string& data, | |
98 const RepeatedPtrField<std::string>& certificate_chain); | |
99 | |
100 // Decodes an int64 value. Checks whether the passed value fits the numeric | |
101 // limits of the value representation. Returns a value (ownership is | |
102 // transferred to the caller) on success, NULL on failure. | |
103 static Value* DecodeIntegerValue(google::protobuf::int64 value); | |
104 | |
105 // Decode a GenericValue message to the Value representation used internally. | |
106 // Returns NULL if |value| is invalid (i.e. contains no actual value). | |
107 static Value* DecodeValue(const em::GenericValue& value); | |
108 | |
109 // Decodes a policy message and returns it in Value representation. Ownership | |
110 // of the returned dictionary is transferred to the caller. | |
111 static DictionaryValue* DecodeDevicePolicy( | |
112 const em::DevicePolicyResponse& response); | |
113 | |
114 // The file in which we store a cached version of the policy information. | |
115 const FilePath backing_file_path_; | |
116 | |
117 // Policy key-value information. | |
118 PolicyMap mandatory_policy_; | |
119 PolicyMap recommended_policy_; | |
120 scoped_ptr<DictionaryValue> device_policy_; | |
121 | |
122 // Whether initialization has been completed. This is the case when we have | |
123 // valid policy, learned that the device is unmanaged or ran into | |
124 // unrecoverable errors. | |
125 bool initialization_complete_; | |
126 | |
127 // Whether the the server has indicated this device is unmanaged. | |
128 bool is_unmanaged_; | |
129 | |
130 // Tracks whether the cache currently stores |device_policy_| that should be | |
131 // given preference over |mandatory_policy_| and |recommended_policy_|. | |
132 bool has_device_policy_; | |
133 | |
134 // The time at which the policy was last refreshed. | |
135 base::Time last_policy_refresh_time_; | |
136 | |
137 // Policy providers. | |
138 scoped_ptr<ConfigurationPolicyProvider> managed_policy_provider_; | |
139 scoped_ptr<ConfigurationPolicyProvider> recommended_policy_provider_; | |
140 | |
141 // Provider observers that are registered with this cache's providers. | |
142 ObserverList<ConfigurationPolicyProvider::Observer, true> observer_list_; | |
143 | |
144 DISALLOW_COPY_AND_ASSIGN(CloudPolicyCache); | |
145 }; | |
146 | |
147 } // namespace policy | |
148 | |
149 #endif // CHROME_BROWSER_POLICY_CLOUD_POLICY_CACHE_H_ | |
OLD | NEW |