| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h" |
| 6 | 6 |
| 7 #include "base/bind.h" | 7 #include "base/bind.h" |
| 8 #include "base/command_line.h" | 8 #include "base/command_line.h" |
| 9 #include "base/logging.h" | 9 #include "base/logging.h" |
| 10 #include "base/message_loop/message_loop.h" | 10 #include "base/message_loop/message_loop.h" |
| (...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 69 device_mode_(DEVICE_MODE_NOT_SET), | 69 device_mode_(DEVICE_MODE_NOT_SET), |
| 70 enrollment_step_(STEP_PENDING), | 70 enrollment_step_(STEP_PENDING), |
| 71 lockbox_init_duration_(0), | 71 lockbox_init_duration_(0), |
| 72 weak_ptr_factory_(this) { | 72 weak_ptr_factory_(this) { |
| 73 CHECK(!client_->is_registered()); | 73 CHECK(!client_->is_registered()); |
| 74 CHECK_EQ(DM_STATUS_SUCCESS, client_->status()); | 74 CHECK_EQ(DM_STATUS_SUCCESS, client_->status()); |
| 75 CHECK(management_mode_ == em::PolicyData::ENTERPRISE_MANAGED || | 75 CHECK(management_mode_ == em::PolicyData::ENTERPRISE_MANAGED || |
| 76 management_mode_ == em::PolicyData::CONSUMER_MANAGED); | 76 management_mode_ == em::PolicyData::CONSUMER_MANAGED); |
| 77 store_->AddObserver(this); | 77 store_->AddObserver(this); |
| 78 client_->AddObserver(this); | 78 client_->AddObserver(this); |
| 79 client_->AddNamespaceToFetch(PolicyNamespaceKey( | 79 client_->AddPolicyTypeToFetch(dm_protocol::kChromeDevicePolicyType, |
| 80 dm_protocol::kChromeDevicePolicyType, std::string())); | 80 std::string()); |
| 81 } | 81 } |
| 82 | 82 |
| 83 EnrollmentHandlerChromeOS::~EnrollmentHandlerChromeOS() { | 83 EnrollmentHandlerChromeOS::~EnrollmentHandlerChromeOS() { |
| 84 Stop(); | 84 Stop(); |
| 85 store_->RemoveObserver(this); | 85 store_->RemoveObserver(this); |
| 86 } | 86 } |
| 87 | 87 |
| 88 void EnrollmentHandlerChromeOS::StartEnrollment() { | 88 void EnrollmentHandlerChromeOS::StartEnrollment() { |
| 89 CHECK_EQ(STEP_PENDING, enrollment_step_); | 89 CHECK_EQ(STEP_PENDING, enrollment_step_); |
| 90 enrollment_step_ = STEP_STATE_KEYS; | 90 enrollment_step_ = STEP_STATE_KEYS; |
| 91 state_keys_broker_->RequestStateKeys( | 91 state_keys_broker_->RequestStateKeys( |
| 92 base::Bind(&EnrollmentHandlerChromeOS::HandleStateKeysResult, | 92 base::Bind(&EnrollmentHandlerChromeOS::HandleStateKeysResult, |
| 93 weak_ptr_factory_.GetWeakPtr())); | 93 weak_ptr_factory_.GetWeakPtr())); |
| 94 } | 94 } |
| 95 | 95 |
| 96 scoped_ptr<CloudPolicyClient> EnrollmentHandlerChromeOS::ReleaseClient() { | 96 scoped_ptr<CloudPolicyClient> EnrollmentHandlerChromeOS::ReleaseClient() { |
| 97 Stop(); | 97 Stop(); |
| 98 return client_.Pass(); | 98 return client_.Pass(); |
| 99 } | 99 } |
| 100 | 100 |
| 101 void EnrollmentHandlerChromeOS::OnPolicyFetched(CloudPolicyClient* client) { | 101 void EnrollmentHandlerChromeOS::OnPolicyFetched(CloudPolicyClient* client) { |
| 102 DCHECK_EQ(client_.get(), client); | 102 DCHECK_EQ(client_.get(), client); |
| 103 CHECK_EQ(STEP_POLICY_FETCH, enrollment_step_); | 103 CHECK_EQ(STEP_POLICY_FETCH, enrollment_step_); |
| 104 | 104 |
| 105 enrollment_step_ = STEP_VALIDATION; | 105 enrollment_step_ = STEP_VALIDATION; |
| 106 | 106 |
| 107 // Validate the policy. | 107 // Validate the policy. |
| 108 const em::PolicyFetchResponse* policy = client_->GetPolicyFor( | 108 const em::PolicyFetchResponse* policy = client_->GetPolicyFor( |
| 109 PolicyNamespaceKey(dm_protocol::kChromeDevicePolicyType, std::string())); | 109 dm_protocol::kChromeDevicePolicyType, std::string()); |
| 110 if (!policy) { | 110 if (!policy) { |
| 111 ReportResult(EnrollmentStatus::ForFetchError( | 111 ReportResult(EnrollmentStatus::ForFetchError( |
| 112 DM_STATUS_RESPONSE_DECODING_ERROR)); | 112 DM_STATUS_RESPONSE_DECODING_ERROR)); |
| 113 return; | 113 return; |
| 114 } | 114 } |
| 115 | 115 |
| 116 scoped_ptr<DeviceCloudPolicyValidator> validator( | 116 scoped_ptr<DeviceCloudPolicyValidator> validator( |
| 117 DeviceCloudPolicyValidator::Create( | 117 DeviceCloudPolicyValidator::Create( |
| 118 scoped_ptr<em::PolicyFetchResponse>( | 118 scoped_ptr<em::PolicyFetchResponse>( |
| 119 new em::PolicyFetchResponse(*policy)), | 119 new em::PolicyFetchResponse(*policy)), |
| (...skipping 14 matching lines...) Expand all Loading... |
| 134 validator->ValidatePolicyType(dm_protocol::kChromeDevicePolicyType); | 134 validator->ValidatePolicyType(dm_protocol::kChromeDevicePolicyType); |
| 135 validator->ValidatePayload(); | 135 validator->ValidatePayload(); |
| 136 if (management_mode_ == em::PolicyData::CONSUMER_MANAGED) { | 136 if (management_mode_ == em::PolicyData::CONSUMER_MANAGED) { |
| 137 // For consumer-managed devices, although we don't store the policy, we | 137 // For consumer-managed devices, although we don't store the policy, we |
| 138 // still need to verify its integrity since we use the request token in it. | 138 // still need to verify its integrity since we use the request token in it. |
| 139 // The consumer device management server does not have the verification | 139 // The consumer device management server does not have the verification |
| 140 // key, and we need to skip checking on that by passing an empty key to | 140 // key, and we need to skip checking on that by passing an empty key to |
| 141 // ValidateInitialKey(). ValidateInitialKey() still checks that the policy | 141 // ValidateInitialKey(). ValidateInitialKey() still checks that the policy |
| 142 // data is correctly signed by the new public key when the verification key | 142 // data is correctly signed by the new public key when the verification key |
| 143 // is empty. | 143 // is empty. |
| 144 validator->ValidateInitialKey("", ""); | 144 validator->ValidateInitialKey(std::string(), std::string()); |
| 145 } else { | 145 } else { |
| 146 // If |domain| is empty here, the policy validation code will just use the | 146 // If |domain| is empty here, the policy validation code will just use the |
| 147 // domain from the username field in the policy itself to do key validation. | 147 // domain from the username field in the policy itself to do key validation. |
| 148 // TODO(mnissler): Plumb the enrolling user's username into this object so | 148 // TODO(mnissler): Plumb the enrolling user's username into this object so |
| 149 // we can validate the username on the resulting policy, and use the domain | 149 // we can validate the username on the resulting policy, and use the domain |
| 150 // from that username to validate the key below (http://crbug.com/343074). | 150 // from that username to validate the key below (http://crbug.com/343074). |
| 151 validator->ValidateInitialKey(GetPolicyVerificationKey(), domain); | 151 validator->ValidateInitialKey(GetPolicyVerificationKey(), domain); |
| 152 } | 152 } |
| 153 validator.release()->StartValidation( | 153 validator.release()->StartValidation( |
| 154 base::Bind(&EnrollmentHandlerChromeOS::HandlePolicyValidationResult, | 154 base::Bind(&EnrollmentHandlerChromeOS::HandlePolicyValidationResult, |
| (...skipping 299 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 454 << ", validation: " << status.validation_status() | 454 << ", validation: " << status.validation_status() |
| 455 << ", store: " << status.store_status() | 455 << ", store: " << status.store_status() |
| 456 << ", lock: " << status.lock_status(); | 456 << ", lock: " << status.lock_status(); |
| 457 } | 457 } |
| 458 | 458 |
| 459 if (!callback.is_null()) | 459 if (!callback.is_null()) |
| 460 callback.Run(status); | 460 callback.Run(status); |
| 461 } | 461 } |
| 462 | 462 |
| 463 } // namespace policy | 463 } // namespace policy |
| OLD | NEW |