OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
| 8 #include <utility> |
8 | 9 |
9 #include "base/bind.h" | 10 #include "base/bind.h" |
10 #include "base/bind_helpers.h" | 11 #include "base/bind_helpers.h" |
11 #include "base/callback.h" | 12 #include "base/callback.h" |
12 #include "base/files/file_util.h" | 13 #include "base/files/file_util.h" |
13 #include "base/location.h" | 14 #include "base/location.h" |
14 #include "base/logging.h" | 15 #include "base/logging.h" |
15 #include "base/macros.h" | 16 #include "base/macros.h" |
16 #include "base/metrics/histogram.h" | 17 #include "base/metrics/histogram.h" |
17 #include "base/sequenced_task_runner.h" | 18 #include "base/sequenced_task_runner.h" |
(...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
148 policy_.reset(new em::PolicyFetchResponse(policy.cloud_policy())); | 149 policy_.reset(new em::PolicyFetchResponse(policy.cloud_policy())); |
149 } else { | 150 } else { |
150 LOG(WARNING) << "Failed to load legacy policy cache: " << result; | 151 LOG(WARNING) << "Failed to load legacy policy cache: " << result; |
151 } | 152 } |
152 policy_cache_ = NULL; | 153 policy_cache_ = NULL; |
153 CheckLoadFinished(); | 154 CheckLoadFinished(); |
154 } | 155 } |
155 | 156 |
156 void LegacyPolicyCacheLoader::CheckLoadFinished() { | 157 void LegacyPolicyCacheLoader::CheckLoadFinished() { |
157 if (!token_loader_.get() && !policy_cache_.get()) | 158 if (!token_loader_.get() && !policy_cache_.get()) |
158 callback_.Run(dm_token_, device_id_, status_, policy_.Pass()); | 159 callback_.Run(dm_token_, device_id_, status_, std::move(policy_)); |
159 } | 160 } |
160 | 161 |
161 // static | 162 // static |
162 CloudPolicyStore::Status LegacyPolicyCacheLoader::TranslateLoadResult( | 163 CloudPolicyStore::Status LegacyPolicyCacheLoader::TranslateLoadResult( |
163 UserPolicyDiskCache::LoadResult result) { | 164 UserPolicyDiskCache::LoadResult result) { |
164 switch (result) { | 165 switch (result) { |
165 case UserPolicyDiskCache::LOAD_RESULT_SUCCESS: | 166 case UserPolicyDiskCache::LOAD_RESULT_SUCCESS: |
166 case UserPolicyDiskCache::LOAD_RESULT_NOT_FOUND: | 167 case UserPolicyDiskCache::LOAD_RESULT_NOT_FOUND: |
167 return CloudPolicyStore::STATUS_OK; | 168 return CloudPolicyStore::STATUS_OK; |
168 case UserPolicyDiskCache::LOAD_RESULT_PARSE_ERROR: | 169 case UserPolicyDiskCache::LOAD_RESULT_PARSE_ERROR: |
(...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
250 NotifyStoreError(); | 251 NotifyStoreError(); |
251 return; | 252 return; |
252 } | 253 } |
253 | 254 |
254 policy_key_path_ = user_policy_key_dir_.Append( | 255 policy_key_path_ = user_policy_key_dir_.Append( |
255 base::StringPrintf(kPolicyKeyFile, sanitized_username.c_str())); | 256 base::StringPrintf(kPolicyKeyFile, sanitized_username.c_str())); |
256 LoadPolicyKey(policy_key_path_, &policy_key_); | 257 LoadPolicyKey(policy_key_path_, &policy_key_); |
257 policy_key_loaded_ = true; | 258 policy_key_loaded_ = true; |
258 | 259 |
259 scoped_ptr<UserCloudPolicyValidator> validator = | 260 scoped_ptr<UserCloudPolicyValidator> validator = |
260 CreateValidatorForLoad(policy.Pass()); | 261 CreateValidatorForLoad(std::move(policy)); |
261 validator->RunValidation(); | 262 validator->RunValidation(); |
262 OnRetrievedPolicyValidated(validator.get()); | 263 OnRetrievedPolicyValidated(validator.get()); |
263 } | 264 } |
264 | 265 |
265 void UserCloudPolicyStoreChromeOS::ValidatePolicyForStore( | 266 void UserCloudPolicyStoreChromeOS::ValidatePolicyForStore( |
266 scoped_ptr<em::PolicyFetchResponse> policy) { | 267 scoped_ptr<em::PolicyFetchResponse> policy) { |
267 // Create and configure a validator. | 268 // Create and configure a validator. |
268 scoped_ptr<UserCloudPolicyValidator> validator = | 269 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( |
269 CreateValidator(policy.Pass(), | 270 std::move(policy), CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); |
270 CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); | |
271 validator->ValidateUsername(username_, true); | 271 validator->ValidateUsername(username_, true); |
272 if (policy_key_.empty()) { | 272 if (policy_key_.empty()) { |
273 validator->ValidateInitialKey(GetPolicyVerificationKey(), | 273 validator->ValidateInitialKey(GetPolicyVerificationKey(), |
274 ExtractDomain(username_)); | 274 ExtractDomain(username_)); |
275 } else { | 275 } else { |
276 const bool allow_rotation = true; | 276 const bool allow_rotation = true; |
277 validator->ValidateSignature(policy_key_, | 277 validator->ValidateSignature(policy_key_, |
278 GetPolicyVerificationKey(), | 278 GetPolicyVerificationKey(), |
279 ExtractDomain(username_), | 279 ExtractDomain(username_), |
280 allow_rotation); | 280 allow_rotation); |
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
361 EnsurePolicyKeyLoaded( | 361 EnsurePolicyKeyLoaded( |
362 base::Bind(&UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy, | 362 base::Bind(&UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy, |
363 weak_factory_.GetWeakPtr(), | 363 weak_factory_.GetWeakPtr(), |
364 base::Passed(&policy))); | 364 base::Passed(&policy))); |
365 } | 365 } |
366 | 366 |
367 void UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy( | 367 void UserCloudPolicyStoreChromeOS::ValidateRetrievedPolicy( |
368 scoped_ptr<em::PolicyFetchResponse> policy) { | 368 scoped_ptr<em::PolicyFetchResponse> policy) { |
369 // Create and configure a validator for the loaded policy. | 369 // Create and configure a validator for the loaded policy. |
370 scoped_ptr<UserCloudPolicyValidator> validator = | 370 scoped_ptr<UserCloudPolicyValidator> validator = |
371 CreateValidatorForLoad(policy.Pass()); | 371 CreateValidatorForLoad(std::move(policy)); |
372 // Start validation. The Validator will delete itself once validation is | 372 // Start validation. The Validator will delete itself once validation is |
373 // complete. | 373 // complete. |
374 validator.release()->StartValidation( | 374 validator.release()->StartValidation( |
375 base::Bind(&UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated, | 375 base::Bind(&UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated, |
376 weak_factory_.GetWeakPtr())); | 376 weak_factory_.GetWeakPtr())); |
377 } | 377 } |
378 | 378 |
379 void UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated( | 379 void UserCloudPolicyStoreChromeOS::OnRetrievedPolicyValidated( |
380 UserCloudPolicyValidator* validator) { | 380 UserCloudPolicyValidator* validator) { |
381 validation_status_ = validator->status(); | 381 validation_status_ = validator->status(); |
382 | 382 |
383 UMA_HISTOGRAM_ENUMERATION( | 383 UMA_HISTOGRAM_ENUMERATION( |
384 "Enterprise.UserPolicyValidationLoadStatus", | 384 "Enterprise.UserPolicyValidationLoadStatus", |
385 validation_status_, | 385 validation_status_, |
386 UserCloudPolicyValidator::VALIDATION_STATUS_SIZE); | 386 UserCloudPolicyValidator::VALIDATION_STATUS_SIZE); |
387 | 387 |
388 if (!validator->success()) { | 388 if (!validator->success()) { |
389 status_ = STATUS_VALIDATION_ERROR; | 389 status_ = STATUS_VALIDATION_ERROR; |
390 NotifyStoreError(); | 390 NotifyStoreError(); |
391 return; | 391 return; |
392 } | 392 } |
393 | 393 |
394 InstallPolicy(validator->policy_data().Pass(), validator->payload().Pass()); | 394 InstallPolicy(std::move(validator->policy_data()), |
| 395 std::move(validator->payload())); |
395 status_ = STATUS_OK; | 396 status_ = STATUS_OK; |
396 | 397 |
397 // Policy has been loaded successfully. This indicates that new-style policy | 398 // Policy has been loaded successfully. This indicates that new-style policy |
398 // is working, so the legacy cache directory can be removed. | 399 // is working, so the legacy cache directory can be removed. |
399 if (!legacy_cache_dir_.empty()) { | 400 if (!legacy_cache_dir_.empty()) { |
400 background_task_runner()->PostTask( | 401 background_task_runner()->PostTask( |
401 FROM_HERE, | 402 FROM_HERE, |
402 base::Bind(&UserCloudPolicyStoreChromeOS::RemoveLegacyCacheDir, | 403 base::Bind(&UserCloudPolicyStoreChromeOS::RemoveLegacyCacheDir, |
403 legacy_cache_dir_)); | 404 legacy_cache_dir_)); |
404 legacy_cache_dir_.clear(); | 405 legacy_cache_dir_.clear(); |
405 } | 406 } |
406 NotifyStoreLoaded(); | 407 NotifyStoreLoaded(); |
407 } | 408 } |
408 | 409 |
409 void UserCloudPolicyStoreChromeOS::OnLegacyLoadFinished( | 410 void UserCloudPolicyStoreChromeOS::OnLegacyLoadFinished( |
410 const std::string& dm_token, | 411 const std::string& dm_token, |
411 const std::string& device_id, | 412 const std::string& device_id, |
412 Status status, | 413 Status status, |
413 scoped_ptr<em::PolicyFetchResponse> policy) { | 414 scoped_ptr<em::PolicyFetchResponse> policy) { |
414 status_ = status; | 415 status_ = status; |
415 if (policy.get()) { | 416 if (policy.get()) { |
416 // Create and configure a validator for the loaded legacy policy. Note that | 417 // Create and configure a validator for the loaded legacy policy. Note that |
417 // the signature on this policy is not verified. | 418 // the signature on this policy is not verified. |
418 scoped_ptr<UserCloudPolicyValidator> validator = | 419 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( |
419 CreateValidator(policy.Pass(), | 420 std::move(policy), CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); |
420 CloudPolicyValidatorBase::TIMESTAMP_REQUIRED); | |
421 validator->ValidateUsername(username_, true); | 421 validator->ValidateUsername(username_, true); |
422 validator.release()->StartValidation( | 422 validator.release()->StartValidation( |
423 base::Bind(&UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated, | 423 base::Bind(&UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated, |
424 weak_factory_.GetWeakPtr(), | 424 weak_factory_.GetWeakPtr(), |
425 dm_token, | 425 dm_token, |
426 device_id)); | 426 device_id)); |
427 } else { | 427 } else { |
428 InstallLegacyTokens(dm_token, device_id); | 428 InstallLegacyTokens(dm_token, device_id); |
429 } | 429 } |
430 } | 430 } |
431 | 431 |
432 void UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated( | 432 void UserCloudPolicyStoreChromeOS::OnLegacyPolicyValidated( |
433 const std::string& dm_token, | 433 const std::string& dm_token, |
434 const std::string& device_id, | 434 const std::string& device_id, |
435 UserCloudPolicyValidator* validator) { | 435 UserCloudPolicyValidator* validator) { |
436 validation_status_ = validator->status(); | 436 validation_status_ = validator->status(); |
437 if (validator->success()) { | 437 if (validator->success()) { |
438 status_ = STATUS_OK; | 438 status_ = STATUS_OK; |
439 InstallPolicy(validator->policy_data().Pass(), validator->payload().Pass()); | 439 InstallPolicy(std::move(validator->policy_data()), |
| 440 std::move(validator->payload())); |
440 | 441 |
441 // Clear the public key version. The public key version field would | 442 // Clear the public key version. The public key version field would |
442 // otherwise indicate that we have key installed in the store when in fact | 443 // otherwise indicate that we have key installed in the store when in fact |
443 // we haven't. This may result in policy updates failing signature | 444 // we haven't. This may result in policy updates failing signature |
444 // verification. | 445 // verification. |
445 policy_->clear_public_key_version(); | 446 policy_->clear_public_key_version(); |
446 } else { | 447 } else { |
447 status_ = STATUS_VALIDATION_ERROR; | 448 status_ = STATUS_VALIDATION_ERROR; |
448 } | 449 } |
449 | 450 |
(...skipping 99 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
549 } else { | 550 } else { |
550 SampleValidationFailure(VALIDATION_FAILURE_DBUS); | 551 SampleValidationFailure(VALIDATION_FAILURE_DBUS); |
551 } | 552 } |
552 ReloadPolicyKey(callback); | 553 ReloadPolicyKey(callback); |
553 } | 554 } |
554 | 555 |
555 scoped_ptr<UserCloudPolicyValidator> | 556 scoped_ptr<UserCloudPolicyValidator> |
556 UserCloudPolicyStoreChromeOS::CreateValidatorForLoad( | 557 UserCloudPolicyStoreChromeOS::CreateValidatorForLoad( |
557 scoped_ptr<em::PolicyFetchResponse> policy) { | 558 scoped_ptr<em::PolicyFetchResponse> policy) { |
558 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( | 559 scoped_ptr<UserCloudPolicyValidator> validator = CreateValidator( |
559 policy.Pass(), CloudPolicyValidatorBase::TIMESTAMP_NOT_BEFORE); | 560 std::move(policy), CloudPolicyValidatorBase::TIMESTAMP_NOT_BEFORE); |
560 validator->ValidateUsername(username_, true); | 561 validator->ValidateUsername(username_, true); |
561 const bool allow_rotation = false; | 562 const bool allow_rotation = false; |
562 const std::string empty_key = std::string(); | 563 const std::string empty_key = std::string(); |
563 // The policy loaded from session manager need not be validated using the | 564 // The policy loaded from session manager need not be validated using the |
564 // verification key since it is secure, and since there may be legacy policy | 565 // verification key since it is secure, and since there may be legacy policy |
565 // data that was stored without a verification key. Hence passing an empty | 566 // data that was stored without a verification key. Hence passing an empty |
566 // value for the verification key. | 567 // value for the verification key. |
567 validator->ValidateSignature( | 568 validator->ValidateSignature( |
568 policy_key_, empty_key, ExtractDomain(username_), allow_rotation); | 569 policy_key_, empty_key, ExtractDomain(username_), allow_rotation); |
569 return validator.Pass(); | 570 return validator; |
570 } | 571 } |
571 } // namespace policy | 572 } // namespace policy |
OLD | NEW |