1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
|
// Copyright (c) 2013 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROME_BROWSER_POLICY_CLOUD_COMPONENT_CLOUD_POLICY_STORE_H_
#define CHROME_BROWSER_POLICY_CLOUD_COMPONENT_CLOUD_POLICY_STORE_H_
#include <map>
#include <string>
#include "base/basictypes.h"
#include "base/memory/scoped_ptr.h"
#include "base/threading/non_thread_safe.h"
#include "chrome/browser/policy/cloud/resource_cache.h"
#include "components/policy/core/common/policy_bundle.h"
#include "components/policy/core/common/policy_namespace.h"
namespace enterprise_management {
class ExternalPolicyData;
class PolicyData;
class PolicyFetchResponse;
}
namespace policy {
// Validates protobufs for external policy data, validates the data itself, and
// caches both locally.
class ComponentCloudPolicyStore : public base::NonThreadSafe {
public:
class Delegate {
public:
virtual ~Delegate();
// Invoked whenever the policies served by policy() have changed, except
// for the initial Load().
virtual void OnComponentCloudPolicyStoreUpdated() = 0;
};
// Both the |delegate| and the |cache| must outlive this object.
ComponentCloudPolicyStore(Delegate* delegate,
ResourceCache* cache);
~ComponentCloudPolicyStore();
// Helper that returns true for PolicyDomains that can be managed by this
// store.
static bool SupportsDomain(PolicyDomain domain);
// Returns true if |domain| can be managed by this store; in that case, the
// dm_protocol policy type that corresponds to |domain| is stored in
// |policy_type|. Otherwise returns false.
static bool GetPolicyType(PolicyDomain domain, std::string* policy_type);
// Returns true if |policy_type| corresponds to a policy domain that can be
// managed by this store; in that case, the domain constants is assigned to
// |domain|. Otherwise returns false.
static bool GetPolicyDomain(const std::string& policy_type,
PolicyDomain* domain);
// The current list of policies.
const PolicyBundle& policy() const { return policy_bundle_; }
// The cached hash for namespace |ns|, or the empty string if |ns| is not
// cached.
const std::string& GetCachedHash(const PolicyNamespace& ns) const;
// |username| and |dm_token| are used to validate the cached data, and data
// stored later.
// All ValidatePolicy() requests without credentials fail.
void SetCredentials(const std::string& username,
const std::string& dm_token);
// Loads and validates all the currently cached protobufs and policy data.
// This is performed synchronously, and policy() will return the cached
// policies after this call.
void Load();
// Stores the protobuf and |data| for namespace |ns|. The protobuf is passed
// serialized in |serialized_policy_proto|, and must have been validated
// before.
// The |data| is validated during this call, and its secure hash must match
// |secure_hash|.
// Returns false if |data| failed validation, otherwise returns true and the
// data was stored in the cache.
bool Store(const PolicyNamespace& ns,
const std::string& serialized_policy_proto,
const std::string& secure_hash,
const std::string& data);
// Deletes the storage of namespace |ns| and stops serving its policies.
void Delete(const PolicyNamespace& ns);
// Deletes the storage of all components of |domain| that pass then given
// |filter|, and stops serving their policies.
void Purge(PolicyDomain domain,
const ResourceCache::SubkeyFilter& filter);
// Deletes the storage of every component.
void Clear();
// Validates |proto| and returns the corresponding policy namespace in |ns|,
// and the parsed ExternalPolicyData in |payload|.
// If |proto| validates successfully then its |payload| can be trusted, and
// the data referenced there can be downloaded. A |proto| must be validated
// before attempting to download the data, and before storing both.
bool ValidatePolicy(
scoped_ptr<enterprise_management::PolicyFetchResponse> proto,
PolicyNamespace* ns,
enterprise_management::ExternalPolicyData* payload);
private:
// Helper for ValidatePolicy(), that's also used to validate protobufs
// loaded from the disk cache.
bool ValidateProto(
scoped_ptr<enterprise_management::PolicyFetchResponse> proto,
const std::string& policy_type,
const std::string& settings_entity_id,
enterprise_management::ExternalPolicyData* payload,
enterprise_management::PolicyData* policy_data);
// Validates the JSON policy serialized in |data|, and verifies its hash
// with |secure_hash|. Returns true on success, and in that case stores the
// parsed policies in |policy|.
bool ValidateData(const std::string& data,
const std::string& secure_hash,
PolicyMap* policy);
// Parses the JSON policy in |data| into |policy|, and returns true if the
// parse was successful.
bool ParsePolicy(const std::string& data, PolicyMap* policy);
Delegate* delegate_;
ResourceCache* cache_;
std::string username_;
std::string dm_token_;
PolicyBundle policy_bundle_;
std::map<PolicyNamespace, std::string> cached_hashes_;
DISALLOW_COPY_AND_ASSIGN(ComponentCloudPolicyStore);
};
} // namespace policy
#endif // CHROME_BROWSER_POLICY_CLOUD_COMPONENT_CLOUD_POLICY_STORE_H_
|
