1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
// Copyright 2013 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/policy/networking/device_network_configuration_updater_ash.h"
#include "ash/constants/ash_features.h"
#include "ash/constants/ash_switches.h"
#include "base/command_line.h"
#include "base/containers/flat_map.h"
#include "base/feature_list.h"
#include "base/functional/bind.h"
#include "base/functional/callback_helpers.h"
#include "chrome/browser/ash/policy/core/browser_policy_connector_ash.h"
#include "chrome/browser/browser_process.h"
#include "chrome/browser/browser_process_platform_part.h"
#include "chromeos/ash/components/install_attributes/install_attributes.h"
#include "chromeos/ash/components/network/managed_network_configuration_handler.h"
#include "chromeos/ash/components/network/network_device_handler.h"
#include "chromeos/ash/components/settings/cros_settings.h"
#include "chromeos/ash/components/settings/cros_settings_names.h"
#include "chromeos/ash/components/settings/cros_settings_provider.h"
#include "chromeos/ash/components/system/statistics_provider.h"
#include "chromeos/components/onc/onc_parsed_certificates.h"
#include "chromeos/components/onc/onc_utils.h"
#include "components/policy/policy_constants.h"
#include "content/public/browser/browser_thread.h"
#include "net/cert/x509_certificate.h"
namespace policy {
namespace {
std::string GetDeviceAssetID() {
return g_browser_process->platform_part()
->browser_policy_connector_ash()
->GetDeviceAssetID();
}
} // namespace
DeviceNetworkConfigurationUpdaterAsh::~DeviceNetworkConfigurationUpdaterAsh() =
default;
// static
std::unique_ptr<DeviceNetworkConfigurationUpdaterAsh>
DeviceNetworkConfigurationUpdaterAsh::CreateForDevicePolicy(
PolicyService* policy_service,
ash::ManagedNetworkConfigurationHandler* network_config_handler,
ash::NetworkDeviceHandler* network_device_handler,
ash::CrosSettings* cros_settings,
const DeviceNetworkConfigurationUpdaterAsh::DeviceAssetIDFetcher&
device_asset_id_fetcher) {
std::unique_ptr<DeviceNetworkConfigurationUpdaterAsh> updater(
new DeviceNetworkConfigurationUpdaterAsh(
policy_service, network_config_handler, network_device_handler,
cros_settings, device_asset_id_fetcher));
updater->Init();
return updater;
}
DeviceNetworkConfigurationUpdaterAsh::DeviceNetworkConfigurationUpdaterAsh(
PolicyService* policy_service,
ash::ManagedNetworkConfigurationHandler* network_config_handler,
ash::NetworkDeviceHandler* network_device_handler,
ash::CrosSettings* cros_settings,
const DeviceNetworkConfigurationUpdaterAsh::DeviceAssetIDFetcher&
device_asset_id_fetcher)
: NetworkConfigurationUpdater(onc::ONC_SOURCE_DEVICE_POLICY,
key::kDeviceOpenNetworkConfiguration,
policy_service),
network_config_handler_(network_config_handler),
network_device_handler_(network_device_handler),
cros_settings_(cros_settings),
device_asset_id_fetcher_(device_asset_id_fetcher) {
DCHECK(network_device_handler_);
data_roaming_setting_subscription_ = cros_settings->AddSettingsObserver(
ash::kSignedDataRoamingEnabled,
base::BindRepeating(
&DeviceNetworkConfigurationUpdaterAsh::OnDataRoamingSettingChanged,
base::Unretained(this)));
if (device_asset_id_fetcher_.is_null())
device_asset_id_fetcher_ = base::BindRepeating(&GetDeviceAssetID);
}
void DeviceNetworkConfigurationUpdaterAsh::Init() {
NetworkConfigurationUpdater::Init();
// The highest authority regarding whether cellular data roaming should be
// allowed is the Device Policy. If there is no Device Policy, then
// data roaming should be allowed if this is a Cellular First device.
if (!ash::InstallAttributes::Get()->IsEnterpriseManaged() &&
ash::switches::IsCellularFirstDevice()) {
network_device_handler_->SetCellularPolicyAllowRoaming(
/*policy_allow_roaming=*/true);
} else {
// Apply the roaming setting initially.
OnDataRoamingSettingChanged();
}
// Set up MAC address randomization if we are not enterprise managed.
network_device_handler_->SetMACAddressRandomizationEnabled(
!ash::InstallAttributes::Get()->IsEnterpriseManaged());
}
void DeviceNetworkConfigurationUpdaterAsh::ImportClientCertificates() {
LOG(WARNING)
<< "Importing client certificates from device policy is not implemented.";
}
void DeviceNetworkConfigurationUpdaterAsh::ApplyNetworkPolicy(
const base::Value::List& network_configs_onc,
const base::Value::Dict& global_network_config) {
// Ensure this is runnng on the UI thead because we're accessing global data
// to populate the substitutions.
DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
// Expand device-specific placeholders. Note: It is OK that if the serial
// number or Asset ID are empty, the placeholders will be expanded to an empty
// string. This is to be consistent with user policy identity string
// expansions.
base::flat_map<std::string, std::string> substitutions;
substitutions[::onc::substitutes::kDeviceSerialNumber] = std::string(
ash::system::StatisticsProvider::GetInstance()->GetMachineID().value_or(
""));
substitutions[::onc::substitutes::kDeviceAssetId] =
device_asset_id_fetcher_.Run();
network_config_handler_->SetProfileWideVariableExpansions(
/*userhash=*/std::string(), std::move(substitutions));
network_config_handler_->SetPolicy(onc_source_, /*userhash=*/std::string(),
network_configs_onc,
global_network_config);
}
void DeviceNetworkConfigurationUpdaterAsh::OnDataRoamingSettingChanged() {
ash::CrosSettingsProvider::TrustedStatus trusted_status =
cros_settings_->PrepareTrustedValues(base::BindOnce(
&DeviceNetworkConfigurationUpdaterAsh::OnDataRoamingSettingChanged,
weak_factory_.GetWeakPtr()));
if (trusted_status == ash::CrosSettingsProvider::TEMPORARILY_UNTRUSTED) {
// Return, this function will be called again later by
// PrepareTrustedValues.
return;
}
bool data_roaming_setting = false;
if (trusted_status == ash::CrosSettingsProvider::TRUSTED) {
if (!cros_settings_->GetBoolean(ash::kSignedDataRoamingEnabled,
&data_roaming_setting)) {
LOG(ERROR) << "Couldn't get device setting "
<< ash::kSignedDataRoamingEnabled;
data_roaming_setting = false;
}
} else {
DCHECK_EQ(trusted_status, ash::CrosSettingsProvider::PERMANENTLY_UNTRUSTED);
// Roaming is disabled as we can't determine the correct setting.
}
// Roaming is disabled by policy only when the device is both enterprise
// managed and the value of |data_roaming_setting| is |false|.
const bool policy_allow_roaming =
ash::InstallAttributes::Get()->IsEnterpriseManaged()
? data_roaming_setting
: true;
network_device_handler_->SetCellularPolicyAllowRoaming(policy_allow_roaming);
}
} // namespace policy
|
