| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" |
| 6 | 6 |
| 7 #include <stddef.h> | 7 #include <stddef.h> |
| 8 #include <utility> |
| 8 | 9 |
| 9 #include "base/bind.h" | 10 #include "base/bind.h" |
| 10 #include "base/bind_helpers.h" | 11 #include "base/bind_helpers.h" |
| 11 #include "base/callback.h" | 12 #include "base/callback.h" |
| 12 #include "base/files/file_util.h" | 13 #include "base/files/file_util.h" |
| 13 #include "base/location.h" | 14 #include "base/location.h" |
| 14 #include "base/logging.h" | 15 #include "base/logging.h" |
| 15 #include "base/macros.h" | 16 #include "base/macros.h" |
| 16 #include "base/metrics/histogram.h" | 17 #include "base/metrics/histogram.h" |
| 17 #include "base/sequenced_task_runner.h" | 18 #include "base/sequenced_task_runner.h" |
| (...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 148 policy_.reset(new em::PolicyFetchResponse(policy.cloud_policy())); | 149 policy_.reset(new em::PolicyFetchResponse(policy.cloud_policy())); |
| 149 } else { | 150 } else { |
| 150 LOG(WARNING) << "Failed to load legacy policy cache: " << result; | 151 LOG(WARNING) << "Failed to load legacy policy cache: " << result; |
| 151 } | 152 } |
| 152 policy_cache_ = NULL; | 153 policy_cache_ = NULL; |
| 153 CheckLoadFinished(); | 154 CheckLoadFinished(); |
| 154 } | 155 } |
| 155 | 156 |
| 156 void LegacyPolicyCacheLoader::CheckLoadFinished() { | 157 void LegacyPolicyCacheLoader::CheckLoadFinished() { |
| 157 if (!token_loader_.get() && !policy_cache_.get()) | 158 if (!token_loader_.get() && !policy_cache_.get()) |
| 158 callback_.Run(dm_token_, device_id_, status_, policy_.Pass()); | 159 callback_.Run(dm_token_, device_id_, status_, std::move(policy_)); |
| 159 } | 160 } |
| 160 | 161 |
| 161 // static | 162 // static |
| 162 CloudPolicyStore::Status LegacyPolicyCacheLoader::TranslateLoadResult( | 163 CloudPolicyStore::Status LegacyPolicyCacheLoader::TranslateLoadResult( |
| 163 UserPolicyDiskCache::LoadResult result) { | 164 UserPolicyDiskCache::LoadResult result) { |
| 164 switch (result) { | 165 switch (result) { |
| 165 case UserPolicyDiskCache::LOAD_RESULT_SUCCESS: | 166 case UserPolicyDiskCache::LOAD_RESULT_SUCCESS: |
| 166 case UserPolicyDiskCache::LOAD_RESULT_NOT_FOUND: | 167 case UserPolicyDiskCache::LOAD_RESULT_NOT_FOUND: |
| 167 return CloudPolicyStore::STATUS_OK; | 168 return CloudPolicyStore::STATUS_OK; |
| 168 case UserPolicyDiskCache::LOAD_RESULT_PARSE_ERROR: | 169 case UserPolicyDiskCache::LOAD_RESULT_PARSE_ERROR: |
| (...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 250 NotifyStoreError(); | 251 NotifyStoreError(); |
| 251 return; | 252 return; |
| 252 } | 253 } |
| 253 | 254 |
| 254 policy_key_path_ = user_policy_key_dir_.Append( | 255 policy_key_path_ = user_policy_key_dir_.Append( |
| 255 base::StringPrintf(kPolicyKeyFile, sanitized_username.c_str())); | 256 base::StringPrintf(kPolicyKeyFile, sanitized_username.c_str())); |
| 256 LoadPolicyKey(policy_key_path_, &policy_key_); | 257 LoadPolicyKey(policy_key_path_, &policy_key_); |
| 257 policy_key_loaded_ = true; | 258 policy_key_loaded_ = true; |
| 258 | 259 |
| 259 scoped_ptr<UserCloudPolicyValidator> validator = | 260 scoped_ptr<UserCloudPolicyValidator> validator = |
| 260 CreateValidatorForLoad(policy.Pass()); | 261 CreateValidatorForLoad(std::move(policy)); |
| 261 validator->RunValidation(); | 262 validator->RunValidation(); |
| 262 OnRetrievedPolicyValidated(validator.get()); | 263 OnRetrievedPolicyValidated(validator.get()); |
| 263 } | 264 } |
| 264 | 265 |
| 265 void UserCloudPolicyStoreChromeOS::ValidatePolicyForStore( | 266 void UserCloudPolicyStoreChromeOS::ValidatePolicyForStore( |
| 266 scoped_ptr<em::PolicyFetchResponse> policy) { | 267 scoped_ptr<em::PolicyFetchResponse> policy) { |
| 267 // Create and configure a validator. | 268 // Create and configure a validator. |
| 268 scoped_ptr<UserCloudPolicyValidator> validator = | 269 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( |
| 269 CreateValidator(policy.Pass(), | 270 std::move(policy), CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); |
| 270 CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); | |
| 271 validator->ValidateUsername(username_, true); | 271 validator->ValidateUsername(username_, true); |
| 272 if (policy_key_.empty()) { | 272 if (policy_key_.empty()) { |
| 273 validator->ValidateInitialKey(GetPolicyVerificationKey(), | 273 validator->ValidateInitialKey(GetPolicyVerificationKey(), |
| 274 ExtractDomain(username_)); | 274 ExtractDomain(username_)); |
| 275 } else { | 275 } else { |
| 276 const bool allow_rotation = true; | 276 const bool allow_rotation = true; |
| 277 validator->ValidateSignature(policy_key_, | 277 validator->ValidateSignature(policy_key_, |
| 278 GetPolicyVerificationKey(), | 278 GetPolicyVerificationKey(), |
| 279 ExtractDomain(username_), | 279 ExtractDomain(username_), |
| 280 allow_rotation); | 280 allow_rotation); |
| (...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 361 EnsurePolicyKeyLoaded( | 361 EnsurePolicyKeyLoaded( |
| 362 base::Bind(&UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy, | 362 base::Bind(&UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy, |
| 363 weak_factory_.GetWeakPtr(), | 363 weak_factory_.GetWeakPtr(), |
| 364 base::Passed(&policy))); | 364 base::Passed(&policy))); |
| 365 } | 365 } |
| 366 | 366 |
| 367 void UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy( | 367 void UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy( |
| 368 scoped_ptr<em::PolicyFetchResponse> policy) { | 368 scoped_ptr<em::PolicyFetchResponse> policy) { |
| 369 // Create and configure a validator for the loaded policy. | 369 // Create and configure a validator for the loaded policy. |
| 370 scoped_ptr<UserCloudPolicyValidator> validator = | 370 scoped_ptr<UserCloudPolicyValidator> validator = |
| 371 CreateValidatorForLoad(policy.Pass()); | 371 CreateValidatorForLoad(std::move(policy)); |
| 372 // Start validation. The Validator will delete itself once validation is | 372 // Start validation. The Validator will delete itself once validation is |
| 373 // complete. | 373 // complete. |
| 374 validator.release()->StartValidation( | 374 validator.release()->StartValidation( |
| 375 base::Bind(&UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated, | 375 base::Bind(&UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated, |
| 376 weak_factory_.GetWeakPtr())); | 376 weak_factory_.GetWeakPtr())); |
| 377 } | 377 } |
| 378 | 378 |
| 379 void UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated( | 379 void UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated( |
| 380 UserCloudPolicyValidator* validator) { | 380 UserCloudPolicyValidator* validator) { |
| 381 validation_status_ = validator->status(); | 381 validation_status_ = validator->status(); |
| 382 | 382 |
| 383 UMA_HISTOGRAM_ENUMERATION( | 383 UMA_HISTOGRAM_ENUMERATION( |
| 384 "Enterprise.UserPolicyValidationLoadStatus", | 384 "Enterprise.UserPolicyValidationLoadStatus", |
| 385 validation_status_, | 385 validation_status_, |
| 386 UserCloudPolicyValidator::VALIDATION_STATUS_SIZE); | 386 UserCloudPolicyValidator::VALIDATION_STATUS_SIZE); |
| 387 | 387 |
| 388 if (!validator->success()) { | 388 if (!validator->success()) { |
| 389 status_ = STATUS_VALIDATION_ERROR; | 389 status_ = STATUS_VALIDATION_ERROR; |
| 390 NotifyStoreError(); | 390 NotifyStoreError(); |
| 391 return; | 391 return; |
| 392 } | 392 } |
| 393 | 393 |
| 394 InstallPolicy(validator->policy_data().Pass(), validator->payload().Pass()); | 394 InstallPolicy(std::move(validator->policy_data()), |
| 395 std::move(validator->payload())); |
| 395 status_ = STATUS_OK; | 396 status_ = STATUS_OK; |
| 396 | 397 |
| 397 // Policy has been loaded successfully. This indicates that new-style policy | 398 // Policy has been loaded successfully. This indicates that new-style policy |
| 398 // is working, so the legacy cache directory can be removed. | 399 // is working, so the legacy cache directory can be removed. |
| 399 if (!legacy_cache_dir_.empty()) { | 400 if (!legacy_cache_dir_.empty()) { |
| 400 background_task_runner()->PostTask( | 401 background_task_runner()->PostTask( |
| 401 FROM_HERE, | 402 FROM_HERE, |
| 402 base::Bind(&UserCloudPolicyStoreChromeOS::RemoveLegacyCacheDir, | 403 base::Bind(&UserCloudPolicyStoreChromeOS::RemoveLegacyCacheDir, |
| 403 legacy_cache_dir_)); | 404 legacy_cache_dir_)); |
| 404 legacy_cache_dir_.clear(); | 405 legacy_cache_dir_.clear(); |
| 405 } | 406 } |
| 406 NotifyStoreLoaded(); | 407 NotifyStoreLoaded(); |
| 407 } | 408 } |
| 408 | 409 |
| 409 void UserCloudPolicyStoreChromeOS::OnLegacyLoadFinished( | 410 void UserCloudPolicyStoreChromeOS::OnLegacyLoadFinished( |
| 410 const std::string& dm_token, | 411 const std::string& dm_token, |
| 411 const std::string& device_id, | 412 const std::string& device_id, |
| 412 Status status, | 413 Status status, |
| 413 scoped_ptr<em::PolicyFetchResponse> policy) { | 414 scoped_ptr<em::PolicyFetchResponse> policy) { |
| 414 status_ = status; | 415 status_ = status; |
| 415 if (policy.get()) { | 416 if (policy.get()) { |
| 416 // Create and configure a validator for the loaded legacy policy. Note that | 417 // Create and configure a validator for the loaded legacy policy. Note that |
| 417 // the signature on this policy is not verified. | 418 // the signature on this policy is not verified. |
| 418 scoped_ptr<UserCloudPolicyValidator> validator = | 419 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( |
| 419 CreateValidator(policy.Pass(), | 420 std::move(policy), CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); |
| 420 CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); | |
| 421 validator->ValidateUsername(username_, true); | 421 validator->ValidateUsername(username_, true); |
| 422 validator.release()->StartValidation( | 422 validator.release()->StartValidation( |
| 423 base::Bind(&UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated, | 423 base::Bind(&UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated, |
| 424 weak_factory_.GetWeakPtr(), | 424 weak_factory_.GetWeakPtr(), |
| 425 dm_token, | 425 dm_token, |
| 426 device_id)); | 426 device_id)); |
| 427 } else { | 427 } else { |
| 428 InstallLegacyTokens(dm_token, device_id); | 428 InstallLegacyTokens(dm_token, device_id); |
| 429 } | 429 } |
| 430 } | 430 } |
| 431 | 431 |
| 432 void UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated( | 432 void UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated( |
| 433 const std::string& dm_token, | 433 const std::string& dm_token, |
| 434 const std::string& device_id, | 434 const std::string& device_id, |
| 435 UserCloudPolicyValidator* validator) { | 435 UserCloudPolicyValidator* validator) { |
| 436 validation_status_ = validator->status(); | 436 validation_status_ = validator->status(); |
| 437 if (validator->success()) { | 437 if (validator->success()) { |
| 438 status_ = STATUS_OK; | 438 status_ = STATUS_OK; |
| 439 InstallPolicy(validator->policy_data().Pass(), validator->payload().Pass()); | 439 InstallPolicy(std::move(validator->policy_data()), |
| 440 std::move(validator->payload())); |
| 440 | 441 |
| 441 // Clear the public key version. The public key version field would | 442 // Clear the public key version. The public key version field would |
| 442 // otherwise indicate that we have key installed in the store when in fact | 443 // otherwise indicate that we have key installed in the store when in fact |
| 443 // we haven't. This may result in policy updates failing signature | 444 // we haven't. This may result in policy updates failing signature |
| 444 // verification. | 445 // verification. |
| 445 policy_->clear_public_key_version(); | 446 policy_->clear_public_key_version(); |
| 446 } else { | 447 } else { |
| 447 status_ = STATUS_VALIDATION_ERROR; | 448 status_ = STATUS_VALIDATION_ERROR; |
| 448 } | 449 } |
| 449 | 450 |
| (...skipping 99 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 549 } else { | 550 } else { |
| 550 SampleValidationFailure(VALIDATION_FAILURE_DBUS); | 551 SampleValidationFailure(VALIDATION_FAILURE_DBUS); |
| 551 } | 552 } |
| 552 ReloadPolicyKey(callback); | 553 ReloadPolicyKey(callback); |
| 553 } | 554 } |
| 554 | 555 |
| 555 scoped_ptr<UserCloudPolicyValidator> | 556 scoped_ptr<UserCloudPolicyValidator> |
| 556 UserCloudPolicyStoreChromeOS::CreateValidatorForLoad( | 557 UserCloudPolicyStoreChromeOS::CreateValidatorForLoad( |
| 557 scoped_ptr<em::PolicyFetchResponse> policy) { | 558 scoped_ptr<em::PolicyFetchResponse> policy) { |
| 558 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( | 559 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( |
| 559 policy.Pass(), CloudPolicyValidatorBase::TIMESTAMP_NOT_BEFORE); | 560 std::move(policy), CloudPolicyValidatorBase::TIMESTAMP_NOT_BEFORE); |
| 560 validator->ValidateUsername(username_, true); | 561 validator->ValidateUsername(username_, true); |
| 561 const bool allow_rotation = false; | 562 const bool allow_rotation = false; |
| 562 const std::string empty_key = std::string(); | 563 const std::string empty_key = std::string(); |
| 563 // The policy loaded from session manager need not be validated using the | 564 // The policy loaded from session manager need not be validated using the |
| 564 // verification key since it is secure, and since there may be legacy policy | 565 // verification key since it is secure, and since there may be legacy policy |
| 565 // data that was stored without a verification key. Hence passing an empty | 566 // data that was stored without a verification key. Hence passing an empty |
| 566 // value for the verification key. | 567 // value for the verification key. |
| 567 validator->ValidateSignature( | 568 validator->ValidateSignature( |
| 568 policy_key_, empty_key, ExtractDomain(username_), allow_rotation); | 569 policy_key_, empty_key, ExtractDomain(username_), allow_rotation); |
| 569 return validator.Pass(); | 570 return validator; |
| 570 } | 571 } |
| 571 } // namespace policy | 572 } // namespace policy |
| OLD | NEW |