1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
|
// Copyright 2018 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROME_BROWSER_ENTERPRISE_CONNECTORS_REPORTING_REALTIME_REPORTING_CLIENT_H_
#define CHROME_BROWSER_ENTERPRISE_CONNECTORS_REPORTING_REALTIME_REPORTING_CLIENT_H_
#include <memory>
#include <string>
#include "base/memory/raw_ptr.h"
#include "base/memory/weak_ptr.h"
#include "base/timer/timer.h"
#include "base/values.h"
#include "build/build_config.h"
#include "components/enterprise/common/proto/upload_request_response.pb.h"
#include "components/enterprise/connectors/core/common.h"
#include "components/enterprise/connectors/core/realtime_reporting_client_base.h"
#include "components/keyed_service/core/keyed_service.h"
#include "components/policy/core/common/cloud/cloud_policy_client.h"
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
#include "components/device_signals/core/browser/signals_types.h"
#endif
namespace content {
class BrowserContext;
}
namespace signin {
class IdentityManager;
}
#if BUILDFLAG(IS_CHROMEOS)
namespace user_manager {
class User;
}
#endif
namespace enterprise_connectors {
// An event router that observes Safe Browsing events and notifies listeners.
// The router also uploads events to the chrome reporting server side API. The
// browser-based reporting logics are in RealtimeReportingClientBase whereas
// profile-based reporting logics are implemented in this class.
class RealtimeReportingClient : public RealtimeReportingClientBase {
public:
explicit RealtimeReportingClient(content::BrowserContext* context);
RealtimeReportingClient(const RealtimeReportingClient&) = delete;
RealtimeReportingClient& operator=(const RealtimeReportingClient&) = delete;
~RealtimeReportingClient() override;
// RealtimeReportingClientBase overrides:
std::string GetProfileUserName() override;
base::WeakPtr<RealtimeReportingClientBase> AsWeakPtr() override;
std::optional<ReportingSettings> GetReportingSettings() override;
base::WeakPtr<RealtimeReportingClient> AsWeakPtrImpl() {
return weak_ptr_factory_.GetWeakPtr();
}
void SetBrowserCloudPolicyClientForTesting(policy::CloudPolicyClient* client);
void SetProfileCloudPolicyClientForTesting(policy::CloudPolicyClient* client);
void SetProfileUserNameForTesting(std::string username);
void SetIdentityManagerForTesting(signin::IdentityManager* identity_manager);
// policy::CloudPolicyClient::Observer overrides:
void OnClientError(policy::CloudPolicyClient* client) override;
// Report safe browsing event through real-time reporting channel, if enabled.
// Declared as virtual for tests.
virtual void ReportRealtimeEvent(const std::string& name,
const ReportingSettings& settings,
base::Value::Dict event);
base::Value::Dict ReportErrorDetails(
const policy::CloudPolicyClient::Result& upload_result);
// Report safe browsing events that have occurred in the past but has not yet
// been reported. This is currently used for browser crash events, which are
// polled at a fixed time interval. Declared as virtual for tests.
virtual void ReportPastEvent(const std::string& name,
const ReportingSettings& settings,
base::Value::Dict event,
const base::Time& time);
private:
// RealtimeReportingClientBase overrides (all overrides below):
std::string GetProfileIdentifier() override;
std::string GetBrowserClientId() override;
base::Value::Dict GetContext() override;
::chrome::cros::reporting::proto::UploadEventsRequest
CreateUploadEventsRequest() override;
bool ShouldIncludeDeviceInfo(bool per_profile) override;
void UploadCallbackDeprecated(
base::Value::Dict event_wrapper,
bool per_profile,
policy::CloudPolicyClient* client,
EnterpriseReportingEventType eventType,
policy::CloudPolicyClient::Result upload_result) override;
void UploadCallback(
::chrome::cros::reporting::proto::UploadEventsRequest request,
bool per_profile,
policy::CloudPolicyClient* client,
EnterpriseReportingEventType eventType,
policy::CloudPolicyClient::Result upload_result) override;
#if !BUILDFLAG(IS_CHROMEOS)
std::pair<std::string, policy::CloudPolicyClient*> InitProfileReportingClient(
const std::string& dm_token) override;
#endif
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
// DEPRECATED: Use MaybeCollectDeviceSignalsAndReportEvent(Event, ...).
void MaybeCollectDeviceSignalsAndReportEventDeprecated(
base::Value::Dict event,
policy::CloudPolicyClient* client,
std::string name,
const ReportingSettings& settings,
base::Time time) override;
// Add Crowdstrike signals to event report and upload it.
// DEPRECATED: Use PopulateSignalsAndReportEvent(Event, ...) instead.
void PopulateSignalsAndReportEventDeprecated(
base::Value::Dict event,
policy::CloudPolicyClient* client,
std::string name,
ReportingSettings settings,
content::BrowserContext* context,
base::Time time,
device_signals::SignalsAggregationResponse response);
void MaybeCollectDeviceSignalsAndReportEvent(
::chrome::cros::reporting::proto::Event event,
policy::CloudPolicyClient* client,
const ReportingSettings& settings) override;
// Add Crowdstrike signals to event report and upload it.
void PopulateSignalsAndReportEvent(
::chrome::cros::reporting::proto::Event event,
policy::CloudPolicyClient* client,
ReportingSettings settings,
device_signals::SignalsAggregationResponse response);
#endif
// Handle the availability of a cloud policy client.
void OnCloudPolicyClientAvailable(const std::string& policy_client_desc,
policy::CloudPolicyClient* client);
#if BUILDFLAG(IS_CHROMEOS)
// Return the Chrome OS user who is subject to reporting, or nullptr if
// the user cannot be deterined.
static const user_manager::User* GetChromeOSUser();
#endif
void RemoveDmTokenFromRejectedSet(const std::string& dm_token);
raw_ptr<content::BrowserContext> context_;
std::string username_;
base::WeakPtrFactory<RealtimeReportingClient> weak_ptr_factory_{this};
};
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
// Populate event dict with CrowdStrike signal values. If those signals are
// available in `response`, this function returns a Dict with the following
// fields added:
// "securityAgents" : [
// {
// "crowdstrike": {
// "agent_id": "agent-123",
// "customer_id": "customer-123"
// }
// }
// ]
// These must match proto specified in
// chrome/cros/reporting/api/proto/browser_events.proto
void AddCrowdstrikeSignalsToEvent(
base::Value::Dict& event,
const device_signals::SignalsAggregationResponse& response);
#endif
} // namespace enterprise_connectors
#endif // CHROME_BROWSER_ENTERPRISE_CONNECTORS_REPORTING_REALTIME_REPORTING_CLIENT_H_
|
