Device enterprise registration with a certificate.

components/policy/core/common/cloud/cloud_policy_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/policy/core/common/cloud/cloud_policy_client.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 35 matching lines @@
 CloudPolicyClient::Observer::~Observer() {}
 
 void CloudPolicyClient::Observer::OnRobotAuthCodesFetched(
     CloudPolicyClient* client) {}
 
 CloudPolicyClient::CloudPolicyClient(
     const std::string& machine_id,
     const std::string& machine_model,
     const std::string& verification_key_hash,
     DeviceManagementService* service,
-    scoped_refptr<net::URLRequestContextGetter> request_context)
+    scoped_refptr<net::URLRequestContextGetter> request_context,
+    SigningService* signing_service)
     : machine_id_(machine_id),
       machine_model_(machine_model),
       verification_key_hash_(verification_key_hash),
-      device_mode_(DEVICE_MODE_NOT_SET),
-      submit_machine_id_(false),
-      public_key_version_(-1),
-      public_key_version_valid_(false),
-      invalidation_version_(0),
-      fetched_invalidation_version_(0),
       service_(service),                  // Can be null for unit tests.
-      status_(DM_STATUS_SUCCESS),
-      request_context_(request_context) {
+      signing_service_(signing_service),
+      request_context_(request_context),
+      weak_ptr_factory_(this) {
 }
 
 CloudPolicyClient::~CloudPolicyClient() {
   base::STLDeleteValues(&responses_);
 }
 
 void CloudPolicyClient::SetupRegistration(const std::string& dm_token,
                                           const std::string& client_id) {
   DCHECK(!dm_token.empty());
   DCHECK(!client_id.empty());
   DCHECK(!is_registered());
 
   dm_token_ = dm_token;
   client_id_ = client_id;
   request_jobs_.clear();
   policy_fetch_request_job_.reset();
   base::STLDeleteValues(&responses_);
 
   NotifyRegistrationStateChanged();
 }
 
+// Sets the client ID or generate a new one. A new one is intentionally
+// generated on each new registration request in order to preserve privacy.
+// Reusing IDs would mean the server could track clients by their registration
+// attempts.
+void CloudPolicyClient::SetClientId(const std::string& client_id) {
+  client_id_ = client_id.empty() ?  base::GenerateGUID() : client_id;
+}
+
 void CloudPolicyClient::Register(em::DeviceRegisterRequest::Type type,
                                  em::DeviceRegisterRequest::Flavor flavor,
                                  const std::string& auth_token,
                                  const std::string& client_id,
                                  const std::string& requisition,
                                  const std::string& current_state_key) {
   DCHECK(service_);
   DCHECK(!auth_token.empty());
   DCHECK(!is_registered());
 
-  if (client_id.empty()) {
-    // Generate a new client ID. This is intentionally done on each new
-    // registration request in order to preserve privacy. Reusing IDs would mean
-    // the server could track clients by their registration attempts.
-    client_id_ = base::GenerateGUID();
-  } else {
-    client_id_ = client_id;
-  }
+  SetClientId(client_id);
 
   policy_fetch_request_job_.reset(
       service_->CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION,
                           GetRequestContext()));
   policy_fetch_request_job_->SetOAuthToken(auth_token);
   policy_fetch_request_job_->SetClientID(client_id_);
 
   em::DeviceRegisterRequest* request =
       policy_fetch_request_job_->GetRequest()->mutable_register_request();
   if (!client_id.empty())
     request->set_reregister(true);
   request->set_type(type);
   if (!machine_id_.empty())
     request->set_machine_id(machine_id_);
   if (!machine_model_.empty())
     request->set_machine_model(machine_model_);
   if (!requisition.empty())
     request->set_requisition(requisition);
   if (!current_state_key.empty())
     request->set_server_backed_state_key(current_state_key);
   request->set_flavor(flavor);
 
   policy_fetch_request_job_->SetRetryCallback(
-      base::Bind(&CloudPolicyClient::OnRetryRegister, base::Unretained(this)));
+      base::Bind(&CloudPolicyClient::OnRetryRegister,
+                 weak_ptr_factory_.GetWeakPtr()));
 
   policy_fetch_request_job_->Start(
       base::Bind(&CloudPolicyClient::OnRegisterCompleted,
-                 base::Unretained(this)));
+                 weak_ptr_factory_.GetWeakPtr()));
+}
+
+void CloudPolicyClient::RegisterWithCertificate(
+    em::DeviceRegisterRequest::Type type,
+    em::DeviceRegisterRequest::Flavor flavor,
+    const std::string& pem_certificate_chain,
+    const std::string& client_id,
+    const std::string& requisition,
+    const std::string& current_state_key) {
+  DCHECK(signing_service_);
+  DCHECK(service_);
+  DCHECK(!pem_certificate_chain.empty());
+  DCHECK(!is_registered());
+
+  SetClientId(client_id);
+
+  em::CertificateBasedDeviceRegistrationData data;
+  data.set_certificate_type(em::CertificateBasedDeviceRegistrationData::
+      ENTERPRISE_ENROLLMENT_CERTIFICATE);
+  data.set_device_certificate(pem_certificate_chain);
+
+  em::DeviceRegisterRequest* request = data.mutable_device_register_request();
+  if (!client_id.empty())
+    request->set_reregister(true);
+  request->set_type(type);
+  if (!machine_id_.empty())
+    request->set_machine_id(machine_id_);
+  if (!machine_model_.empty())
+    request->set_machine_model(machine_model_);
+  if (!requisition.empty())
+    request->set_requisition(requisition);
+  if (!current_state_key.empty())
+    request->set_server_backed_state_key(current_state_key);
+  request->set_flavor(flavor);
+
+  signing_service_->SignData(data.SerializeAsString(),
+      base::Bind(&CloudPolicyClient::OnRegisterWithCertificateRequestSigned,
+                 weak_ptr_factory_.GetWeakPtr()));
+}
+
+void CloudPolicyClient::OnRegisterWithCertificateRequestSigned(bool success,
+    em::SignedData signed_data) {
+  if (!success) {
+    const em::DeviceManagementResponse response;
+    OnRegisterCompleted(DM_STATUS_CANNOT_SIGN_REQUEST, 0, response);
+    return;
+  }
+
+  policy_fetch_request_job_.reset(
+      service_->CreateJob(
+          DeviceManagementRequestJob::TYPE_CERT_BASED_REGISTRATION,
+          GetRequestContext()));
+  policy_fetch_request_job_->SetClientID(client_id_);
+  em::SignedData* signed_request = policy_fetch_request_job_->GetRequest()->
+      mutable_cert_based_register_request()->mutable_signed_request();
+  signed_request->set_data(signed_data.data());
+  signed_request->set_signature(signed_data.signature());
+  signed_request->set_extra_data_bytes(signed_data.extra_data_bytes());
+  policy_fetch_request_job_->SetRetryCallback(
+      base::Bind(&CloudPolicyClient::OnRetryRegister,
+                 weak_ptr_factory_.GetWeakPtr()));
+  policy_fetch_request_job_->Start(
+      base::Bind(&CloudPolicyClient::OnRegisterCompleted,
+                 weak_ptr_factory_.GetWeakPtr()));
 }
 
 void CloudPolicyClient::SetInvalidationInfo(int64_t version,
                                             const std::string& payload) {
   invalidation_version_ = version;
   invalidation_payload_ = payload;
 }
 
 void CloudPolicyClient::FetchPolicy() {
   CHECK(is_registered());
@@ skipping 52 matching lines @@
     }
   }
 
   // Set the fetched invalidation version to the latest invalidation version
   // since it is now the invalidation version used for the latest fetch.
   fetched_invalidation_version_ = invalidation_version_;
 
   // Fire the job.
   policy_fetch_request_job_->Start(
       base::Bind(&CloudPolicyClient::OnPolicyFetchCompleted,
-                 base::Unretained(this)));
+                 weak_ptr_factory_.GetWeakPtr()));
 }
 
 void CloudPolicyClient::FetchRobotAuthCodes(const std::string& auth_token) {
   CHECK(is_registered());
   DCHECK(!auth_token.empty());
 
   policy_fetch_request_job_.reset(service_->CreateJob(
       DeviceManagementRequestJob::TYPE_API_AUTH_CODE_FETCH,
       GetRequestContext()));
   // The credentials of a domain user are needed in order to mint a new OAuth2
   // authorization token for the robot account.
   policy_fetch_request_job_->SetOAuthToken(auth_token);
   policy_fetch_request_job_->SetDMToken(dm_token_);
   policy_fetch_request_job_->SetClientID(client_id_);
 
   em::DeviceServiceApiAccessRequest* request =
       policy_fetch_request_job_->GetRequest()->
       mutable_service_api_access_request();
   request->set_oauth2_client_id(
       GaiaUrls::GetInstance()->oauth2_chrome_client_id());
   request->add_auth_scope(GaiaConstants::kAnyApiOAuth2Scope);
 
   policy_fetch_request_job_->Start(
       base::Bind(&CloudPolicyClient::OnFetchRobotAuthCodesCompleted,
-                 base::Unretained(this)));
+                 weak_ptr_factory_.GetWeakPtr()));
 }
 
 void CloudPolicyClient::Unregister() {
   DCHECK(service_);
   policy_fetch_request_job_.reset(
       service_->CreateJob(DeviceManagementRequestJob::TYPE_UNREGISTRATION,
                           GetRequestContext()));
   policy_fetch_request_job_->SetDMToken(dm_token_);
   policy_fetch_request_job_->SetClientID(client_id_);
   policy_fetch_request_job_->GetRequest()->mutable_unregister_request();
   policy_fetch_request_job_->Start(
       base::Bind(&CloudPolicyClient::OnUnregisterCompleted,
-                 base::Unretained(this)));
+                 weak_ptr_factory_.GetWeakPtr()));
 }
 
 void CloudPolicyClient::UploadCertificate(
     const std::string& certificate_data,
     const CloudPolicyClient::StatusCallback& callback) {
   CHECK(is_registered());
   std::unique_ptr<DeviceManagementRequestJob> request_job(
       service_->CreateJob(DeviceManagementRequestJob::TYPE_UPLOAD_CERTIFICATE,
                           GetRequestContext()));
   request_job->SetDMToken(dm_token_);
   request_job->SetClientID(client_id_);
 
   em::DeviceManagementRequest* request = request_job->GetRequest();
   request->mutable_cert_upload_request()->set_device_certificate(
       certificate_data);
 
   const DeviceManagementRequestJob::Callback job_callback =
       base::Bind(&CloudPolicyClient::OnCertificateUploadCompleted,
-                 base::Unretained(this), request_job.get(), callback);
+                 weak_ptr_factory_.GetWeakPtr(), request_job.get(), callback);
 
   request_jobs_.push_back(std::move(request_job));
   request_jobs_.back()->Start(job_callback);
 }
 
 void CloudPolicyClient::UploadDeviceStatus(
     const em::DeviceStatusReportRequest* device_status,
     const em::SessionStatusReportRequest* session_status,
     const CloudPolicyClient::StatusCallback& callback) {
   CHECK(is_registered());
   // Should pass in at least one type of status.
   DCHECK(device_status || session_status);
   std::unique_ptr<DeviceManagementRequestJob> request_job(service_->CreateJob(
       DeviceManagementRequestJob::TYPE_UPLOAD_STATUS, GetRequestContext()));
   request_job->SetDMToken(dm_token_);
   request_job->SetClientID(client_id_);
 
   em::DeviceManagementRequest* request = request_job->GetRequest();
   if (device_status)
     *request->mutable_device_status_report_request() = *device_status;
   if (session_status)
     *request->mutable_session_status_report_request() = *session_status;
 
   const DeviceManagementRequestJob::Callback job_callback =
       base::Bind(&CloudPolicyClient::OnStatusUploadCompleted,
-                 base::Unretained(this), request_job.get(), callback);
+                 weak_ptr_factory_.GetWeakPtr(), request_job.get(), callback);
 
   request_jobs_.push_back(std::move(request_job));
   request_jobs_.back()->Start(job_callback);
 }
 
 void CloudPolicyClient::FetchRemoteCommands(
     std::unique_ptr<RemoteCommandJob::UniqueIDType> last_command_id,
     const std::vector<em::RemoteCommandResult>& command_results,
     const RemoteCommandCallback& callback) {
   CHECK(is_registered());
   std::unique_ptr<DeviceManagementRequestJob> request_job(service_->CreateJob(
       DeviceManagementRequestJob::TYPE_REMOTE_COMMANDS, GetRequestContext()));
 
   request_job->SetDMToken(dm_token_);
   request_job->SetClientID(client_id_);
 
   em::DeviceRemoteCommandRequest* const request =
       request_job->GetRequest()->mutable_remote_command_request();
 
   if (last_command_id)
     request->set_last_command_unique_id(*last_command_id);
 
   for (const auto& command_result : command_results)
     *request->add_command_results() = command_result;
 
   const DeviceManagementRequestJob::Callback job_callback =
       base::Bind(&CloudPolicyClient::OnRemoteCommandsFetched,
-                 base::Unretained(this), request_job.get(), callback);
+                 weak_ptr_factory_.GetWeakPtr(), request_job.get(), callback);
 
   request_jobs_.push_back(std::move(request_job));
   request_jobs_.back()->Start(job_callback);
 }
 
 void CloudPolicyClient::GetDeviceAttributeUpdatePermission(
     const std::string &auth_token,
     const CloudPolicyClient::StatusCallback& callback) {
   // TODO(pbond): remove this LOG once http://crbug.com/586961 is fixed.
   LOG(WARNING) << "Send DeviceAttributeUpdatePermissionRequest";
   CHECK(is_registered());
   DCHECK(!auth_token.empty());
 
   std::unique_ptr<DeviceManagementRequestJob> request_job(service_->CreateJob(
       DeviceManagementRequestJob::TYPE_ATTRIBUTE_UPDATE_PERMISSION,
       GetRequestContext()));
 
   request_job->SetOAuthToken(auth_token);
   request_job->SetClientID(client_id_);
 
   request_job->GetRequest()->
       mutable_device_attribute_update_permission_request();
 
   const DeviceManagementRequestJob::Callback job_callback =
       base::Bind(&CloudPolicyClient::OnDeviceAttributeUpdatePermissionCompleted,
-      base::Unretained(this), request_job.get(), callback);
+      weak_ptr_factory_.GetWeakPtr(), request_job.get(), callback);
 
   request_jobs_.push_back(std::move(request_job));
   request_jobs_.back()->Start(job_callback);
 }
 
 void CloudPolicyClient::UpdateDeviceAttributes(
     const std::string& auth_token,
     const std::string& asset_id,
     const std::string& location,
     const CloudPolicyClient::StatusCallback& callback) {
   CHECK(is_registered());
   DCHECK(!auth_token.empty());
 
   std::unique_ptr<DeviceManagementRequestJob> request_job(service_->CreateJob(
       DeviceManagementRequestJob::TYPE_ATTRIBUTE_UPDATE, GetRequestContext()));
 
   request_job->SetOAuthToken(auth_token);
   request_job->SetClientID(client_id_);
 
   em::DeviceAttributeUpdateRequest* request =
       request_job->GetRequest()->mutable_device_attribute_update_request();
 
   request->set_asset_id(asset_id);
   request->set_location(location);
 
   const DeviceManagementRequestJob::Callback job_callback =
       base::Bind(&CloudPolicyClient::OnDeviceAttributeUpdated,
-      base::Unretained(this), request_job.get(), callback);
+      weak_ptr_factory_.GetWeakPtr(), request_job.get(), callback);
 
   request_jobs_.push_back(std::move(request_job));
   request_jobs_.back()->Start(job_callback);
 }
 
 void CloudPolicyClient::UpdateGcmId(
     const std::string& gcm_id,
     const CloudPolicyClient::StatusCallback& callback) {
   CHECK(is_registered());
 
   std::unique_ptr<DeviceManagementRequestJob> request_job(service_->CreateJob(
       DeviceManagementRequestJob::TYPE_GCM_ID_UPDATE, GetRequestContext()));
 
   request_job->SetDMToken(dm_token_);
   request_job->SetClientID(client_id_);
 
   em::GcmIdUpdateRequest* const request =
       request_job->GetRequest()->mutable_gcm_id_update_request();
 
   request->set_gcm_id(gcm_id);
 
   const DeviceManagementRequestJob::Callback job_callback =
-      base::Bind(&CloudPolicyClient::OnGcmIdUpdated, base::Unretained(this),
-                 request_job.get(), callback);
+      base::Bind(&CloudPolicyClient::OnGcmIdUpdated,
+                 weak_ptr_factory_.GetWeakPtr(), request_job.get(), callback);
 
   request_jobs_.push_back(std::move(request_job));
   request_jobs_.back()->Start(job_callback);
 }
 
 void CloudPolicyClient::AddObserver(Observer* observer) {
   observers_.AddObserver(observer);
 }
 
 void CloudPolicyClient::RemoveObserver(Observer* observer) {
@@ skipping 309 matching lines @@
 
 void CloudPolicyClient::NotifyRobotAuthCodesFetched() {
   FOR_EACH_OBSERVER(Observer, observers_, OnRobotAuthCodesFetched(this));
 }
 
 void CloudPolicyClient::NotifyClientError() {
   FOR_EACH_OBSERVER(Observer, observers_, OnClientError(this));
 }
 
 }  // namespace policy