Skip to content

GitLab

T
tangled
Commit 53bd931d authored by Pavol Marko's avatar Pavol Marko Committed by Chromium LUCI CQ
Browse files
Options

Remove PreSigninPolicyFetcher 

PreSigninPolicyFetcher was only used to evaluate the
EcryptfsMigrationStrategy policy which was removed in CL:2513205.

Bug: 832127
Change-Id: I73a84409706808f8c11412be1500896c71c3318c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2513592
Commit-Queue: Pavol Marko <pmarko@chromium.org>
Reviewed-by: default avatarRoman Sorokin [CET] <rsorokin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#836629}
parent f6c6a3d9
Hide whitespace changes
Inline Side-by-side
Showing with 0 additions and 507 deletions
chrome/browser/chromeos/BUILD.gn
View file @ 53bd931d
......@@ -2339,8 +2339,6 @@ source_set("chromeos") {
"policy/policy_pref_names.h",
"policy/powerwash_requirements_checker.cc",
"policy/powerwash_requirements_checker.h",
"policy/pre_signin_policy_fetcher.cc",
"policy/pre_signin_policy_fetcher.h",
"policy/remote_commands/affiliated_remote_commands_invalidator.cc",
"policy/remote_commands/affiliated_remote_commands_invalidator.h",
"policy/remote_commands/crd_host_delegate.cc",
......@@ -3784,7 +3782,6 @@ source_set("unit_tests") {
"policy/off_hours/off_hours_policy_applier_unittest.cc",
"policy/off_hours/off_hours_proto_parser_unittest.cc",
"policy/powerwash_requirements_checker_unittest.cc",
"policy/pre_signin_policy_fetcher_unittest.cc",
"policy/remote_commands/device_command_get_available_routines_job_unittest.cc",
"policy/remote_commands/device_command_get_routine_update_job_unittest.cc",
"policy/remote_commands/device_command_remote_powerwash_job_unittest.cc",
......
chrome/browser/chromeos/policy/pre_signin_policy_fetcher.cc deleted 100644 → 0
View file @ f6c6a3d9
// Copyright (c) 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/chromeos/policy/pre_signin_policy_fetcher.h"
#include <utility>
#include "base/bind.h"
#include "base/callback.h"
#include "base/files/file_path.h"
#include "base/location.h"
#include "base/logging.h"
#include "base/path_service.h"
#include "base/sequenced_task_runner.h"
#include "base/task/task_traits.h"
#include "base/task/thread_pool.h"
#include "base/time/time.h"
#include "chromeos/cryptohome/cryptohome_parameters.h"
#include "chromeos/cryptohome/cryptohome_util.h"
#include "chromeos/cryptohome/homedir_methods.h"
#include "chromeos/dbus/constants/dbus_paths.h"
#include "chromeos/dbus/cryptohome/cryptohome_client.h"
#include "chromeos/dbus/dbus_thread_manager.h"
#include "components/policy/core/common/cloud/cloud_policy_constants.h"
#include "components/policy/proto/device_management_backend.pb.h"
#include "google_apis/gaia/gaia_auth_util.h"
namespace em = enterprise_management;
namespace policy {
namespace {
// We will abort fresh policy fetch after this time and use cached policy.
const int kPolicyFetchTimeoutSecs = 10;
// Traits for the tasks posted on base::ThreadPool in pre-signin policy fetch.
// As this blocks signin, the tasks have user-visible priority.
constexpr base::TaskTraits kTaskTraits = {base::MayBlock(),
base::TaskPriority::USER_VISIBLE};
} // namespace
PreSigninPolicyFetcher::PreSigninPolicyFetcher(
chromeos::CryptohomeClient* cryptohome_client,
chromeos::SessionManagerClient* session_manager_client,
std::unique_ptr<CloudPolicyClient> cloud_policy_client,
bool is_active_directory_managed,
const AccountId& account_id,
const cryptohome::KeyDefinition& auth_key)
: cryptohome_client_(cryptohome_client),
session_manager_client_(session_manager_client),
cloud_policy_client_(std::move(cloud_policy_client)),
is_active_directory_managed_(is_active_directory_managed),
account_id_(account_id),
auth_key_(auth_key),
task_runner_(base::ThreadPool::CreateSequencedTaskRunner(kTaskTraits)) {
DCHECK(account_id_.GetAccountType() != AccountType::ACTIVE_DIRECTORY ||
is_active_directory_managed_);
}
PreSigninPolicyFetcher ::~PreSigninPolicyFetcher() {}
void PreSigninPolicyFetcher::FetchPolicy(PolicyFetchResultCallback callback) {
DCHECK(callback_.is_null());
callback_ = std::move(callback);
cryptohome::AuthorizationRequest auth;
cryptohome::Key* key = auth.mutable_key();
if (!auth_key_.label.empty()) {
key->mutable_data()->set_label(auth_key_.label);
}
key->set_secret(auth_key_.secret);
cryptohome::MountRequest mount;
mount.set_hidden_mount(true);
chromeos::CryptohomeClient::Get()->MountEx(
cryptohome::CreateAccountIdentifierFromAccountId(account_id_), auth,
mount,
base::BindOnce(&PreSigninPolicyFetcher::OnMountTemporaryUserHome,
weak_ptr_factory_.GetWeakPtr()));
}
bool PreSigninPolicyFetcher::ForceTimeoutForTesting() {
if (!policy_fetch_timeout_.IsRunning())
return false;
policy_fetch_timeout_.Stop();
OnPolicyFetchTimeout();
return true;
}
void PreSigninPolicyFetcher::OnMountTemporaryUserHome(
base::Optional<cryptohome::BaseReply> reply) {
if (MountExReplyToMountError(reply) != cryptohome::MOUNT_ERROR_NONE) {
LOG(ERROR) << "Temporary user home mount failed.";
NotifyCallback(PolicyFetchResult::ERROR, nullptr);
return;
}
session_manager_client_->RetrievePolicyForUserWithoutSession(
cryptohome::CreateAccountIdentifierFromAccountId(account_id_),
base::BindOnce(&PreSigninPolicyFetcher::OnCachedPolicyRetrieved,
weak_ptr_factory_.GetWeakPtr()));
}
void PreSigninPolicyFetcher::OnCachedPolicyRetrieved(
RetrievePolicyResponseType retrieve_policy_response,
const std::string& policy_blob) {
// We only need the cached policy key if there was policy and if the device is
// not joined to Active Directory (policy blobs from Active Directory servers
// are not signed).
if (!policy_blob.empty() && !is_active_directory_managed_) {
const base::FilePath policy_key_dir = base::PathService::CheckedGet(
chromeos::dbus_paths::DIR_USER_POLICY_KEYS);
cached_policy_key_loader_ = std::make_unique<CachedPolicyKeyLoaderChromeOS>(
cryptohome_client_, task_runner_, account_id_, policy_key_dir);
cached_policy_key_loader_->EnsurePolicyKeyLoaded(base::BindOnce(
&PreSigninPolicyFetcher::OnPolicyKeyLoaded,
weak_ptr_factory_.GetWeakPtr(), retrieve_policy_response, policy_blob));
} else {
// Skip and pretend we've loaded policy key. We won't need it anyway,
// because there is no policy to validate or because it's not signed (Active
// Directory).
OnPolicyKeyLoaded(retrieve_policy_response, policy_blob);
}
}
void PreSigninPolicyFetcher::OnPolicyKeyLoaded(
RetrievePolicyResponseType retrieve_policy_response,
const std::string& policy_blob) {
cryptohome_client_->UnmountEx(
cryptohome::UnmountRequest(),
base::BindOnce(&PreSigninPolicyFetcher::OnUnmountTemporaryUserHome,
weak_ptr_factory_.GetWeakPtr(), retrieve_policy_response,
policy_blob));
}
void PreSigninPolicyFetcher::OnUnmountTemporaryUserHome(
RetrievePolicyResponseType retrieve_policy_response,
const std::string& policy_blob,
base::Optional<cryptohome::BaseReply> reply) {
if (BaseReplyToMountError(reply) != cryptohome::MOUNT_ERROR_NONE) {
// The temporary userhome mount could not be unmounted. Log an error and
// continue, and hope that the unmount will be successful on the next mount
// (temporary user homes are automatically unmounted by cryptohomed on every
// mount request).
LOG(ERROR) << "Couldn't unmount temporary mount point";
}
if (retrieve_policy_response != RetrievePolicyResponseType::SUCCESS) {
NotifyCallback(PolicyFetchResult::ERROR, nullptr);
return;
}
if (policy_blob.empty()) {
VLOG(1) << "No cached policy.";
NotifyCallback(PolicyFetchResult::NO_POLICY, nullptr);
return;
}
// Parse policy.
auto policy = std::make_unique<em::PolicyFetchResponse>();
if (!policy->ParseFromString(policy_blob)) {
NotifyCallback(PolicyFetchResult::ERROR, nullptr);
return;
}
// Before validating, check that we have a cached policy key. This does not
// apply to Active Directory joined devices (cached policy is unsigned there).
if (!is_active_directory_managed_ &&
cached_policy_key_loader_->cached_policy_key().empty()) {
LOG(ERROR) << "No cached policy key loaded.";
NotifyCallback(PolicyFetchResult::ERROR, nullptr);
return;
}
// Validate policy from session_manager.
UserCloudPolicyValidator::StartValidation(
CreateValidatorForCachedPolicy(std::move(policy)),
base::BindOnce(&PreSigninPolicyFetcher::OnCachedPolicyValidated,
weak_ptr_factory_.GetWeakPtr()));
}
void PreSigninPolicyFetcher::OnCachedPolicyValidated(
UserCloudPolicyValidator* validator) {
if (!validator->success()) {
NotifyCallback(PolicyFetchResult::ERROR, nullptr);
return;
}
policy_data_ = std::move(validator->policy_data());
policy_payload_ = std::move(validator->payload());
if (is_active_directory_managed_) {
// For AD, we don't support fresh policy fetch at the moment. Simply exit
// with cached policy.
NotifyCallback(PolicyFetchResult::SUCCESS, std::move(policy_payload_));
return;
}
// Try to retrieve fresh policy.
std::vector<std::string> user_affiliation_ids(
policy_data_->user_affiliation_ids().begin(),
policy_data_->user_affiliation_ids().end());
cloud_policy_client_->SetupRegistration(policy_data_->request_token(),
policy_data_->device_id(),
user_affiliation_ids);
cloud_policy_client_->AddPolicyTypeToFetch(
dm_protocol::kChromeUserPolicyType,
std::string() /* settings_entity_id */);
if (policy_data_->has_public_key_version()) {
cloud_policy_client_->set_public_key_version(
policy_data_->public_key_version());
}
cloud_policy_client_->AddObserver(this);
// Start a timer that will limit how long we wait for fresh policy.
policy_fetch_timeout_.Start(
FROM_HERE, base::TimeDelta::FromSeconds(kPolicyFetchTimeoutSecs),
base::BindOnce(&PreSigninPolicyFetcher::OnPolicyFetchTimeout,
weak_ptr_factory_.GetWeakPtr()));
cloud_policy_client_->FetchPolicy();
}
void PreSigninPolicyFetcher::OnPolicyFetched(CloudPolicyClient* client) {
policy_fetch_timeout_.Stop();
const em::PolicyFetchResponse* fetched_policy =
cloud_policy_client_->GetPolicyFor(
dm_protocol::kChromeUserPolicyType,
std::string() /* settings_entity_id */);
if (!fetched_policy || !fetched_policy->has_policy_data()) {
// policy_payload_ still holds cached policy loaded from session_manager.
NotifyCallback(PolicyFetchResult::SUCCESS, std::move(policy_payload_));
return;
}
// Make a copy because there's currently no way to transfer ownership out of
// CloudPolicyClient.
auto fetched_policy_copy =
std::make_unique<em::PolicyFetchResponse>(*fetched_policy);
// Validate fresh policy.
UserCloudPolicyValidator::StartValidation(
CreateValidatorForFetchedPolicy(std::move(fetched_policy_copy)),
base::BindOnce(&PreSigninPolicyFetcher::OnFetchedPolicyValidated,
weak_ptr_factory_.GetWeakPtr()));
}
void PreSigninPolicyFetcher::OnRegistrationStateChanged(
CloudPolicyClient* client) {
// Ignored.
}
void PreSigninPolicyFetcher::OnClientError(CloudPolicyClient* client) {
policy_fetch_timeout_.Stop();
VLOG(1) << "Fresh policy fetch failed.";
// policy_payload_ still holds cached policy loaded from session_manager.
NotifyCallback(PolicyFetchResult::SUCCESS, std::move(policy_payload_));
}
void PreSigninPolicyFetcher::OnPolicyFetchTimeout() {
VLOG(1) << "Fresh policy fetch timed out.";
// Invalidate all weak pointrs so OnPolicyFetched is not called back anymore.
weak_ptr_factory_.InvalidateWeakPtrs();
NotifyCallback(PolicyFetchResult::SUCCESS, std::move(policy_payload_));
}
void PreSigninPolicyFetcher::OnFetchedPolicyValidated(
UserCloudPolicyValidator* validator) {
if (!validator->success()) {
VLOG(1) << "Validation of fetched policy failed.";
// Return the cached policy.
NotifyCallback(PolicyFetchResult::SUCCESS, std::move(policy_payload_));
return;
}
policy_data_ = std::move(validator->policy_data());
policy_payload_ = std::move(validator->payload());
NotifyCallback(PolicyFetchResult::SUCCESS, std::move(policy_payload_));
}
void PreSigninPolicyFetcher::NotifyCallback(
PolicyFetchResult result,
std::unique_ptr<em::CloudPolicySettings> policy_payload) {
// Clean up instances created during the policy fetch procedure.
cached_policy_key_loader_.reset();
policy_data_.reset();
if (cloud_policy_client_) {
cloud_policy_client_->RemoveObserver(this);
}
DCHECK(callback_);
std::move(callback_).Run(result, std::move(policy_payload));
}
std::unique_ptr<UserCloudPolicyValidator>
PreSigninPolicyFetcher::CreateValidatorForCachedPolicy(
std::unique_ptr<em::PolicyFetchResponse> policy) {
auto validator = std::make_unique<UserCloudPolicyValidator>(std::move(policy),
task_runner_);
validator->ValidatePolicyType(dm_protocol::kChromeUserPolicyType);
validator->ValidatePayload();
if (!is_active_directory_managed_) {
// Also validate the user and the signature (except for authpolicy).
validator->ValidateUser(account_id_);
validator->ValidateSignature(
cached_policy_key_loader_->cached_policy_key());
}
return validator;
}
std::unique_ptr<UserCloudPolicyValidator>
PreSigninPolicyFetcher::CreateValidatorForFetchedPolicy(
std::unique_ptr<em::PolicyFetchResponse> policy) {
// Configure the validator to validate based on cached policy.
auto validator = std::make_unique<UserCloudPolicyValidator>(std::move(policy),
task_runner_);
validator->ValidatePolicyType(dm_protocol::kChromeUserPolicyType);
validator->ValidateAgainstCurrentPolicy(
policy_data_.get(), CloudPolicyValidatorBase::TIMESTAMP_VALIDATED,
CloudPolicyValidatorBase::DM_TOKEN_REQUIRED,
CloudPolicyValidatorBase::DEVICE_ID_REQUIRED);
validator->ValidatePayload();
if (!is_active_directory_managed_) {
// Also validate the signature.
const std::string domain = gaia::ExtractDomainName(
gaia::CanonicalizeEmail(account_id_.GetUserEmail()));
validator->ValidateSignatureAllowingRotation(
cached_policy_key_loader_->cached_policy_key(), domain);
}
return validator;
}
} // namespace policy
chrome/browser/chromeos/policy/pre_signin_policy_fetcher.h deleted 100644 → 0
View file @ f6c6a3d9
// Copyright (c) 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROME_BROWSER_CHROMEOS_POLICY_PRE_SIGNIN_POLICY_FETCHER_H_
#define CHROME_BROWSER_CHROMEOS_POLICY_PRE_SIGNIN_POLICY_FETCHER_H_
#include <memory>
#include <string>
#include "base/macros.h"
#include "base/memory/ref_counted.h"
#include "base/memory/weak_ptr.h"
#include "base/optional.h"
#include "base/timer/timer.h"
#include "chrome/browser/chromeos/policy/cached_policy_key_loader_chromeos.h"
#include "chromeos/cryptohome/cryptohome_parameters.h"
#include "chromeos/dbus/cryptohome/rpc.pb.h"
#include "chromeos/dbus/session_manager/session_manager_client.h"
#include "components/account_id/account_id.h"
#include "components/policy/core/common/cloud/cloud_policy_client.h"
#include "components/policy/core/common/cloud/cloud_policy_validator.h"
#include "third_party/cros_system_api/dbus/cryptohome/dbus-constants.h"
namespace base {
class SequencedTaskRunner;
}
namespace chromeos {
class CryptohomeClient;
}
namespace enterprise_management {
class CloudPolicySettings;
class PolicyData;
class PolicyFetchResponse;
} // namespace enterprise_management
namespace policy {
// Performs a policy fetch before actually mounting cryptohome. This is done in
// the following steps:
// (1) Mount the user's cryptohome to a temporary location.
// (2) Retrieve policy from there, along with the policy verification key.
// (3) Unmount the temporary cryptohome.
//
// And if cached policy was found:
// (4) Validate the cached policy.
// (5) Try to fetch fresh policy from DMServer.
// (6) Validate fresh policy.
//
// If steps (1)-(4) are successful, the cached policy will be used even if no
// fresh policy is available.
class PreSigninPolicyFetcher : public CloudPolicyClient::Observer {
public:
// The result of the pre-signin policy fetch.
enum class PolicyFetchResult {
// The policy could not be fetched, e.g. error in cryptohome/session_manager
// calls or it could not be validated.
ERROR,
// The user does not have policy.
NO_POLICY,
// The policy was successfully fetched. This could be a cached policy or a
// fresh policy.
SUCCESS,
};
using PolicyFetchResultCallback = base::OnceCallback<void(
PolicyFetchResult result,
std::unique_ptr<enterprise_management::CloudPolicySettings> policy_data)>;
PreSigninPolicyFetcher(chromeos::CryptohomeClient* cryptohome_client,
chromeos::SessionManagerClient* session_manager_client,
std::unique_ptr<CloudPolicyClient> cloud_policy_client,
bool is_active_directory_managed,
const AccountId& account_id,
const cryptohome::KeyDefinition& auth_key);
~PreSigninPolicyFetcher() override;
// Start the policy fetch procedure. |callback| will be invoked with the
// result.
void FetchPolicy(PolicyFetchResultCallback callback);
// Forces a policy fetch timeout.
// Returns true if the timer was running and a timeout was forced. If the
// timer was not running, returns false.
bool ForceTimeoutForTesting();
private:
using RetrievePolicyResponseType =
chromeos::SessionManagerClient::RetrievePolicyResponseType;
void OnMountTemporaryUserHome(base::Optional<cryptohome::BaseReply> reply);
void OnCachedPolicyRetrieved(
RetrievePolicyResponseType retrieve_policy_response,
const std::string& policy_blob);
void OnPolicyKeyLoaded(RetrievePolicyResponseType retrieve_policy_response,
const std::string& policy_blob);
void OnUnmountTemporaryUserHome(
RetrievePolicyResponseType retrieve_policy_response,
const std::string& policy_blob,
base::Optional<cryptohome::BaseReply> reply);
void OnCachedPolicyValidated(UserCloudPolicyValidator* validator);
// CloudPolicyClient::Observer:
void OnPolicyFetched(CloudPolicyClient* client) override;
void OnRegistrationStateChanged(CloudPolicyClient* client) override;
void OnClientError(CloudPolicyClient* client) override;
// Called by |policy_fetch_timeout_|.
void OnPolicyFetchTimeout();
void OnFetchedPolicyValidated(UserCloudPolicyValidator* validator);
// Invokes |callback_| with the passed result after cleaning up.
void NotifyCallback(
PolicyFetchResult result,
std::unique_ptr<enterprise_management::CloudPolicySettings>
policy_payload);
// Creates a validator which can be used to validate the cached policy.
std::unique_ptr<UserCloudPolicyValidator> CreateValidatorForCachedPolicy(
std::unique_ptr<enterprise_management::PolicyFetchResponse> policy);
// Creates a validator which can be used to validate the freshly fetched
// policy, based on the cached policy.
std::unique_ptr<UserCloudPolicyValidator> CreateValidatorForFetchedPolicy(
std::unique_ptr<enterprise_management::PolicyFetchResponse> policy);
chromeos::CryptohomeClient* const cryptohome_client_;
chromeos::SessionManagerClient* const session_manager_client_;
const std::unique_ptr<CloudPolicyClient> cloud_policy_client_;
const bool is_active_directory_managed_;
const AccountId account_id_;
const cryptohome::KeyDefinition auth_key_;
scoped_refptr<base::SequencedTaskRunner> task_runner_;
// Callback passed to FetchPolicy method.
PolicyFetchResultCallback callback_;
// |policy_data_| and |policy_payload_| will first hold the cached policy on
// successful load and validation, and will then be reset to hold fresh policy
// if download and validation of the fresh policy is successful.
std::unique_ptr<enterprise_management::PolicyData> policy_data_;
std::unique_ptr<enterprise_management::CloudPolicySettings> policy_payload_;
// A timer that puts a hard limit on the maximum time to wait for the fresh
// policy fetch.
base::OneShotTimer policy_fetch_timeout_;
// Used to load the policy key provided by session manager as a file.
std::unique_ptr<CachedPolicyKeyLoaderChromeOS> cached_policy_key_loader_;
base::WeakPtrFactory<PreSigninPolicyFetcher> weak_ptr_factory_{this};
DISALLOW_COPY_AND_ASSIGN(PreSigninPolicyFetcher);
};
} // namespace policy
#endif // CHROME_BROWSER_CHROMEOS_POLICY_PRE_SIGNIN_POLICY_FETCHER_H_
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment