chrome/browser/chromeos/attestation/attestation_policy_observer.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/attestation/attestation_policy_observer.h"
   6
   7 #include <string>
   8
   9 #include "base/bind.h"
  10 #include "base/callback.h"
  11 #include "base/location.h"
  12 #include "base/time/time.h"
  13 #include "chrome/browser/chrome_notification_types.h"
  14 #include "chrome/browser/chromeos/attestation/attestation_ca_client.h"
  15 #include "chrome/browser/chromeos/attestation/attestation_key_payload.pb.h"
  16 #include "chrome/browser/chromeos/settings/cros_settings.h"
  17 #include "chromeos/attestation/attestation_flow.h"
  18 #include "chromeos/cryptohome/async_method_caller.h"
  19 #include "chromeos/dbus/cryptohome_client.h"
  20 #include "chromeos/dbus/dbus_method_call_status.h"
  21 #include "chromeos/dbus/dbus_thread_manager.h"
  22 #include "components/policy/core/common/cloud/cloud_policy_client.h"
  23 #include "components/policy/core/common/cloud/cloud_policy_manager.h"
  24 #include "content/public/browser/browser_thread.h"
  25 #include "content/public/browser/notification_details.h"
  26 #include "net/cert/x509_certificate.h"
  27
  28 namespace {
  29
  30 // The number of days before a certificate expires during which it is
  31 // considered 'expiring soon' and replacement is initiated.  The Chrome OS CA
  32 // issues certificates with an expiry of at least two years.  This value has
  33 // been set large enough so that the majority of users will have gone through
  34 // a full sign-in during the period.
  35 const int kExpiryThresholdInDays = 30;
  36 const int kRetryDelay = 5;  // Seconds.
  37 const int kRetryLimit = 100;
  38
  39 // A dbus callback which handles a boolean result.
  40 //
  41 // Parameters
  42 //   on_true - Called when status=success and value=true.
  43 //   on_false - Called when status=success and value=false.
  44 //   status - The dbus operation status.
  45 //   value - The value returned by the dbus operation.
  46 void DBusBoolRedirectCallback(const base::Closure& on_true,
  47                               const base::Closure& on_false,
  48                               const base::Closure& on_failure,
  49                               const tracked_objects::Location& from_here,
  50                               chromeos::DBusMethodCallStatus status,
  51                               bool value) {
  52   if (status != chromeos::DBUS_METHOD_CALL_SUCCESS) {
  53     LOG(ERROR) << "Cryptohome DBus method failed: " << from_here.ToString()
  54                << " - " << status;
  55     if (!on_failure.is_null())
  56       on_failure.Run();
  57     return;
  58   }
  59   const base::Closure& task = value ? on_true : on_false;
  60   if (!task.is_null())
  61     task.Run();
  62 }
  63
  64 // A dbus callback which handles a string result.
  65 //
  66 // Parameters
  67 //   on_success - Called when status=success and result=true.
  68 //   status - The dbus operation status.
  69 //   result - The result returned by the dbus operation.
  70 //   data - The data returned by the dbus operation.
  71 void DBusStringCallback(
  72     const base::Callback<void(const std::string&)> on_success,
  73     const base::Closure& on_failure,
  74     const tracked_objects::Location& from_here,
  75     chromeos::DBusMethodCallStatus status,
  76     bool result,
  77     const std::string& data) {
  78   if (status != chromeos::DBUS_METHOD_CALL_SUCCESS || !result) {
  79     LOG(ERROR) << "Cryptohome DBus method failed: " << from_here.ToString()
  80                << " - " << status << " - " << result;
  81     if (!on_failure.is_null())
  82       on_failure.Run();
  83     return;
  84   }
  85   on_success.Run(data);
  86 }
  87
  88 }  // namespace
  89
  90 namespace chromeos {
  91 namespace attestation {
  92
  93 AttestationPolicyObserver::AttestationPolicyObserver(
  94     policy::CloudPolicyClient* policy_client)
  95     : cros_settings_(CrosSettings::Get()),
  96       policy_client_(policy_client),
  97       cryptohome_client_(NULL),
  98       attestation_flow_(NULL),
  99       num_retries_(0),
 100       retry_delay_(kRetryDelay),
 101       weak_factory_(this) {
 102   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 103   attestation_subscription_ = cros_settings_->AddSettingsObserver(
 104       kDeviceAttestationEnabled,
 105       base::Bind(&AttestationPolicyObserver::AttestationSettingChanged,
 106                  base::Unretained(this)));
 107   Start();
 108 }
 109
 110 AttestationPolicyObserver::AttestationPolicyObserver(
 111     policy::CloudPolicyClient* policy_client,
 112     CryptohomeClient* cryptohome_client,
 113     AttestationFlow* attestation_flow)
 114     : cros_settings_(CrosSettings::Get()),
 115       policy_client_(policy_client),
 116       cryptohome_client_(cryptohome_client),
 117       attestation_flow_(attestation_flow),
 118       num_retries_(0),
 119       retry_delay_(kRetryDelay),
 120       weak_factory_(this) {
 121   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 122   attestation_subscription_ = cros_settings_->AddSettingsObserver(
 123       kDeviceAttestationEnabled,
 124       base::Bind(&AttestationPolicyObserver::AttestationSettingChanged,
 125                  base::Unretained(this)));
 126   Start();
 127 }
 128
 129 AttestationPolicyObserver::~AttestationPolicyObserver() {
 130   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 131 }
 132
 133 void AttestationPolicyObserver::AttestationSettingChanged() {
 134   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
 135   num_retries_ = 0;
 136   Start();
 137 }
 138
 139 void AttestationPolicyObserver::Start() {
 140   // If attestation is not enabled, there is nothing to do.
 141   bool enabled = false;
 142   if (!cros_settings_->GetBoolean(kDeviceAttestationEnabled, &enabled) ||
 143       !enabled)
 144     return;
 145
 146   // We expect a registered CloudPolicyClient.
 147   if (!policy_client_->is_registered()) {
 148     LOG(ERROR) << "AttestationPolicyObserver: Invalid CloudPolicyClient.";
 149     return;
 150   }
 151
 152   if (!cryptohome_client_)
 153     cryptohome_client_ = DBusThreadManager::Get()->GetCryptohomeClient();
 154
 155   if (!attestation_flow_) {
 156     scoped_ptr<ServerProxy> attestation_ca_client(new AttestationCAClient());
 157     default_attestation_flow_.reset(new AttestationFlow(
 158         cryptohome::AsyncMethodCaller::GetInstance(),
 159         cryptohome_client_,
 160         attestation_ca_client.Pass()));
 161     attestation_flow_ = default_attestation_flow_.get();
 162   }
 163
 164   // Start a dbus call to check if an Enterprise Machine Key already exists.
 165   base::Closure on_does_exist =
 166       base::Bind(&AttestationPolicyObserver::GetExistingCertificate,
 167                  weak_factory_.GetWeakPtr());
 168   base::Closure on_does_not_exist =
 169       base::Bind(&AttestationPolicyObserver::GetNewCertificate,
 170                  weak_factory_.GetWeakPtr());
 171   cryptohome_client_->TpmAttestationDoesKeyExist(
 172       KEY_DEVICE,
 173       std::string(),  // Not used.
 174       kEnterpriseMachineKey,
 175       base::Bind(DBusBoolRedirectCallback,
 176                  on_does_exist,
 177                  on_does_not_exist,
 178                  base::Bind(&AttestationPolicyObserver::Reschedule,
 179                             weak_factory_.GetWeakPtr()),
 180                  FROM_HERE));
 181 }
 182
 183 void AttestationPolicyObserver::GetNewCertificate() {
 184   // We can reuse the dbus callback handler logic.
 185   attestation_flow_->GetCertificate(
 186       PROFILE_ENTERPRISE_MACHINE_CERTIFICATE,
 187       std::string(),  // Not used.
 188       std::string(),  // Not used.
 189       true,  // Force a new key to be generated.
 190       base::Bind(DBusStringCallback,
 191                  base::Bind(&AttestationPolicyObserver::UploadCertificate,
 192                             weak_factory_.GetWeakPtr()),
 193                  base::Bind(&AttestationPolicyObserver::Reschedule,
 194                             weak_factory_.GetWeakPtr()),
 195                  FROM_HERE,
 196                  DBUS_METHOD_CALL_SUCCESS));
 197 }
 198
 199 void AttestationPolicyObserver::GetExistingCertificate() {
 200   cryptohome_client_->TpmAttestationGetCertificate(
 201       KEY_DEVICE,
 202       std::string(),  // Not used.
 203       kEnterpriseMachineKey,
 204       base::Bind(DBusStringCallback,
 205                  base::Bind(&AttestationPolicyObserver::CheckCertificateExpiry,
 206                             weak_factory_.GetWeakPtr()),
 207                  base::Bind(&AttestationPolicyObserver::Reschedule,
 208                             weak_factory_.GetWeakPtr()),
 209                  FROM_HERE));
 210 }
 211
 212 void AttestationPolicyObserver::CheckCertificateExpiry(
 213     const std::string& certificate) {
 214   scoped_refptr<net::X509Certificate> x509(
 215       net::X509Certificate::CreateFromBytes(certificate.data(),
 216                                             certificate.length()));
 217   if (!x509.get() || x509->valid_expiry().is_null()) {
 218     LOG(WARNING) << "Failed to parse certificate, cannot check expiry.";
 219   } else {
 220     const base::TimeDelta threshold =
 221         base::TimeDelta::FromDays(kExpiryThresholdInDays);
 222     if ((base::Time::Now() + threshold) > x509->valid_expiry()) {
 223       // The certificate has expired or will soon, replace it.
 224       GetNewCertificate();
 225       return;
 226     }
 227   }
 228
 229   // Get the payload and check if the certificate has already been uploaded.
 230   GetKeyPayload(base::Bind(&AttestationPolicyObserver::CheckIfUploaded,
 231                            weak_factory_.GetWeakPtr(),
 232                            certificate));
 233 }
 234
 235 void AttestationPolicyObserver::UploadCertificate(
 236     const std::string& certificate) {
 237   policy_client_->UploadCertificate(
 238       certificate,
 239       base::Bind(&AttestationPolicyObserver::OnUploadComplete,
 240                  weak_factory_.GetWeakPtr()));
 241 }
 242
 243 void AttestationPolicyObserver::CheckIfUploaded(
 244     const std::string& certificate,
 245     const std::string& key_payload) {
 246   AttestationKeyPayload payload_pb;
 247   if (!key_payload.empty() &&
 248       payload_pb.ParseFromString(key_payload) &&
 249       payload_pb.is_certificate_uploaded()) {
 250     // Already uploaded... nothing more to do.
 251     return;
 252   }
 253   UploadCertificate(certificate);
 254 }
 255
 256 void AttestationPolicyObserver::GetKeyPayload(
 257     base::Callback<void(const std::string&)> callback) {
 258   cryptohome_client_->TpmAttestationGetKeyPayload(
 259       KEY_DEVICE,
 260       std::string(),  // Not used.
 261       kEnterpriseMachineKey,
 262       base::Bind(DBusStringCallback,
 263                  callback,
 264                  base::Bind(&AttestationPolicyObserver::Reschedule,
 265                             weak_factory_.GetWeakPtr()),
 266                  FROM_HERE));
 267 }
 268
 269 void AttestationPolicyObserver::OnUploadComplete(bool status) {
 270   if (!status)
 271     return;
 272   VLOG(1) << "Enterprise Machine Certificate uploaded to DMServer.";
 273   GetKeyPayload(base::Bind(&AttestationPolicyObserver::MarkAsUploaded,
 274                            weak_factory_.GetWeakPtr()));
 275 }
 276
 277 void AttestationPolicyObserver::MarkAsUploaded(const std::string& key_payload) {
 278   AttestationKeyPayload payload_pb;
 279   if (!key_payload.empty())
 280     payload_pb.ParseFromString(key_payload);
 281   payload_pb.set_is_certificate_uploaded(true);
 282   std::string new_payload;
 283   if (!payload_pb.SerializeToString(&new_payload)) {
 284     LOG(WARNING) << "Failed to serialize key payload.";
 285     return;
 286   }
 287   cryptohome_client_->TpmAttestationSetKeyPayload(
 288       KEY_DEVICE,
 289       std::string(),  // Not used.
 290       kEnterpriseMachineKey,
 291       new_payload,
 292       base::Bind(DBusBoolRedirectCallback,
 293                  base::Closure(),
 294                  base::Closure(),
 295                  base::Closure(),
 296                  FROM_HERE));
 297 }
 298
 299 void AttestationPolicyObserver::Reschedule() {
 300   if (++num_retries_ < kRetryLimit) {
 301     content::BrowserThread::PostDelayedTask(
 302         content::BrowserThread::UI, FROM_HERE,
 303         base::Bind(&AttestationPolicyObserver::Start,
 304                    weak_factory_.GetWeakPtr()),
 305         base::TimeDelta::FromSeconds(retry_delay_));
 306   } else {
 307     LOG(WARNING) << "AttestationPolicyObserver: Retry limit exceeded.";
 308   }
 309 }
 310
 311 }  // namespace attestation
 312 }  // namespace chromeos