Adding a class which will can retrieve Compute Engine metadata

This class will be used to call APIs from within the Compute Engine
Instance as the default service account which is associated with the
Instance. This will allow us to retrieve an Instance identity token,
generate an access token to call CRD APIs, and to check the scopes
for that access token for troubleshooting purposes.

Note that this initial version of the class only calls the HTTP
endpoint as that is guaranteed to exist on all Instances, the HTTPS
endpoint will require some additional work and is only available
on shielded Instances.

Bug: 388603116
Change-Id: I98346d1ad4ba089265529b3f3f29c3dbd57d4b44
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6250418
Reviewed-by: Nicolas Ouellet-Payeur <nicolaso@chromium.org>
Commit-Queue: Joe Downing <joedow@chromium.org>
Reviewed-by: Yuwei Huang <yuweih@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1418961}

remoting/base/BUILD.gn

@@ -46,6 +46,8 @@ source_set("base") {
     "cloud_session_authz_service_client_factory.h",
     "compound_buffer.cc",
     "compound_buffer.h",
+    "compute_engine_service_client.cc",
+    "compute_engine_service_client.h",
     "constants.cc",
     "constants.h",
     "corp_auth_util.cc",

remoting/base/compute_engine_service_client.cc

@@ -0,0 +1,246 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/base/compute_engine_service_client.h"
+
+#include <memory>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include "base/strings/stringprintf.h"
+#include "net/base/load_flags.h"
+#include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "remoting/base/protobuf_http_status.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "services/network/public/cpp/simple_url_loader.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
+
+namespace remoting {
+
+namespace {
+
+// Compute Engine VM Instances always have an HTTP metadata server endpoint.
+// Shielded Instances also provide an HTTPS endpoint. For compatibility, we
+// use the HTTP endpoint for fail-fast decisions or to provide an identity token
+// but rely on our backend services to validate the token and metadata.
+// TODO: joedow - Add support for the HTTPS endpoint:
+// https://cloud.google.com/compute/docs/metadata/querying-metadata#query-https-mds
+constexpr char kHttpMetadataBaseUrl[] =
+    "http://metadata.google.internal/computeMetadata/v1/instance/"
+    "service-accounts/default/";
+
+constexpr size_t kMaxResponseSize = 4096;
+
+constexpr net::NetworkTrafficAnnotationTag kInstanceIdentityTrafficAnnotation =
+    net::DefineNetworkTrafficAnnotation(
+        "remoting_compute_engine_instance_identity_token",
+        R"(
+        semantics {
+          sender: "Chrome Remote Desktop"
+          description:
+            "Retrieves a Compute Engine VM Instance Identity token for use by "
+            "Chrome Remote Desktop."
+          trigger:
+            "The request is made when a Compute Engine VM Instance is "
+            "configured for remote acces via Chrome Remote Desktop. It is also "
+            "called when the host instance makes a backend service request as "
+            "the identity token is used to verify the origin of the request."
+          data: "Arbitrary payload data used to prevent replay attacks."
+          destination: GOOGLE_OWNED_SERVICE
+          internal {
+            contacts {
+              email: "chromoting-team@google.com"
+            }
+          }
+          user_data {
+            type: ARBITRARY_DATA
+          }
+          last_reviewed: "2025-02-08"
+        }
+        policy {
+          cookies_allowed: NO
+          setting:
+            "This request will not be sent if Chrome Remote Desktop is not "
+            "used within a Compute Engine VM Instance."
+          policy_exception_justification:
+            "Not implemented."
+        })");
+
+constexpr net::NetworkTrafficAnnotationTag kAccessTokenTrafficAnnotation =
+    net::DefineNetworkTrafficAnnotation(
+        "remoting_compute_engine_instance_access_token",
+        R"(
+        semantics {
+          sender: "Chrome Remote Desktop"
+          description:
+            "Retrieves an OAuth access token for the default service account "
+            "associated with the Compute Engine VM Instance."
+          trigger:
+            "The request is made when Chrome Remote Desktop is being run in a "
+            "Compute Engine Instance and needs to send a request to our API "
+            "using the default service account for the Compute Engine Instance."
+          data: "None"
+          destination: GOOGLE_OWNED_SERVICE
+          internal {
+            contacts {
+              email: "chromoting-team@google.com"
+            }
+          }
+          user_data {
+            type: NONE
+          }
+          last_reviewed: "2025-02-08"
+        }
+        policy {
+          cookies_allowed: NO
+          setting:
+            "This request will not be sent if Chrome Remote Desktop is not "
+            "used within a Compute Engine VM Instance."
+          policy_exception_justification:
+            "Not implemented."
+        })");
+
+constexpr net::NetworkTrafficAnnotationTag kAccessTokenScopesTrafficAnnotation =
+    net::DefineNetworkTrafficAnnotation(
+        "remoting_compute_engine_instance_access_token_scopes",
+        R"(
+        semantics {
+          sender: "Chrome Remote Desktop"
+          description:
+            "Retrieves the set of OAuth scopes included in access tokens which "
+            "are generated for the default service account associated with the "
+            "Compute Engine VM Instance."
+          trigger:
+            "The request is made when Chrome Remote Desktop is being run in a "
+            "Compute Engine Instance and needs to determine if the default "
+            "service account has been configured properly to access our API."
+          data: "None"
+          destination: GOOGLE_OWNED_SERVICE
+          internal {
+            contacts {
+              email: "chromoting-team@google.com"
+            }
+          }
+          user_data {
+            type: NONE
+          }
+          last_reviewed: "2025-02-08"
+        }
+        policy {
+          cookies_allowed: NO
+          setting:
+            "This request will not be sent if Chrome Remote Desktop is not "
+            "used within a Compute Engine VM Instance."
+          policy_exception_justification:
+            "Not implemented."
+        })");
+
+}  // namespace
+
+ComputeEngineServiceClient::ComputeEngineServiceClient(
+    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory)
+    : url_loader_factory_(url_loader_factory) {}
+
+ComputeEngineServiceClient::~ComputeEngineServiceClient() = default;
+
+void ComputeEngineServiceClient::GetInstanceIdentityToken(
+    std::string_view audience,
+    ResponseCallback callback) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  // Use 'format=full' to include project and instance details in the token.
+  ExecuteRequest(base::StringPrintf("%s/identity?audience=%s&format=full",
+                                    kHttpMetadataBaseUrl, audience),
+                 kInstanceIdentityTrafficAnnotation, std::move(callback));
+}
+
+void ComputeEngineServiceClient::GetServiceAccountAccessToken(
+    ResponseCallback callback) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  ExecuteRequest(base::StringPrintf("%s/token", kHttpMetadataBaseUrl),
+                 kAccessTokenTrafficAnnotation, std::move(callback));
+}
+
+void ComputeEngineServiceClient::GetServiceAccountScopes(
+    ResponseCallback callback) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  ExecuteRequest(base::StringPrintf("%s/scopes", kHttpMetadataBaseUrl),
+                 kAccessTokenScopesTrafficAnnotation, std::move(callback));
+}
+
+void ComputeEngineServiceClient::CancelPendingRequests() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  weak_ptr_factory_.InvalidateWeakPtrs();
+  url_loader_.reset();
+}
+
+void ComputeEngineServiceClient::ExecuteRequest(
+    std::string_view url,
+    const net::NetworkTrafficAnnotationTag& network_annotation,
+    ResponseCallback callback) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  // TODO: joedow - Update to handle concurrent requests when needed.
+  CHECK(!url_loader_);
+
+  auto resource_request = std::make_unique<network::ResourceRequest>();
+  resource_request->url = GURL(url);
+  resource_request->load_flags =
+      net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE;
+  resource_request->credentials_mode = network::mojom::CredentialsMode::kOmit;
+  resource_request->method = net::HttpRequestHeaders::kGetMethod;
+  // All Compute Engine Metadata requests must set this header.
+  resource_request->headers.SetHeader("Metadata-Flavor", "Google");
+
+  url_loader_ = network::SimpleURLLoader::Create(std::move(resource_request),
+                                                 network_annotation);
+  url_loader_->SetTimeoutDuration(base::Seconds(60));
+  url_loader_->SetAllowHttpErrorResults(false);
+  url_loader_->SetRetryOptions(
+      3, network::SimpleURLLoader::RETRY_ON_5XX |
+             network::SimpleURLLoader::RETRY_ON_NETWORK_CHANGE);
+
+  url_loader_->DownloadToString(
+      url_loader_factory_.get(),
+      base::BindOnce(&ComputeEngineServiceClient::OnRequestComplete,
+                     weak_ptr_factory_.GetWeakPtr(), std::move(callback)),
+      kMaxResponseSize);
+}
+
+void ComputeEngineServiceClient::OnRequestComplete(
+    ResponseCallback callback,
+    std::optional<std::string> response_body) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  net::Error net_error = static_cast<net::Error>(url_loader_->NetError());
+  ProtobufHttpStatus http_status = ProtobufHttpStatus::OK();
+  if (net_error != net::Error::OK &&
+      net_error != net::Error::ERR_HTTP_RESPONSE_CODE_FAILURE) {
+    http_status = ProtobufHttpStatus(net_error);
+  } else if (!url_loader_->ResponseInfo() ||
+             !url_loader_->ResponseInfo()->headers ||
+             url_loader_->ResponseInfo()->headers->response_code() <= 0) {
+    http_status = ProtobufHttpStatus(
+        ProtobufHttpStatus::Code::INTERNAL,
+        "Failed to get HTTP status from the response header.");
+  } else {
+    http_status = ProtobufHttpStatus(static_cast<net::HttpStatusCode>(
+        url_loader_->ResponseInfo()->headers->response_code()));
+  }
+
+  if (!http_status.ok()) {
+    LOG(ERROR) << "Compute Engine API request failed. Code: "
+               << static_cast<int32_t>(http_status.error_code())
+               << ", Message: " << http_status.error_message();
+  }
+
+  std::move(callback).Run(http_status, std::move(response_body));
+}
+
+}  // namespace remoting

remoting/base/compute_engine_service_client.h

@@ -0,0 +1,96 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_BASE_COMPUTE_ENGINE_SERVICE_CLIENT_H_
+#define REMOTING_BASE_COMPUTE_ENGINE_SERVICE_CLIENT_H_
+
+#include <memory>
+#include <optional>
+#include <string>
+#include <string_view>
+
+#include "base/functional/callback_forward.h"
+#include "base/memory/scoped_refptr.h"
+#include "base/memory/weak_ptr.h"
+#include "base/threading/thread_checker.h"
+#include "base/values.h"
+#include "net/http/http_status_code.h"
+#include "remoting/base/protobuf_http_status.h"
+
+namespace net {
+struct NetworkTrafficAnnotationTag;
+}  // namespace net
+
+namespace network {
+class SimpleURLLoader;
+class SharedURLLoaderFactory;
+}  // namespace network
+
+namespace remoting {
+
+// A service client that communicates with the Compute Engine API. Note that the
+// methods must be called from code running within a GCE VM Instance as the API
+// does not exist in other contexts.
+class ComputeEngineServiceClient {
+ public:
+  // Use an alias for ProtobufHttpStatus since this class does not use protobuf
+  // but the ProtobufHttpStatus class is useful for transforming errors.
+  // TODO: joedow - Rename ProtobufHttpStatus to be generic so it can be used
+  // in any HTTP request class.
+  using HttpStatusCode = ProtobufHttpStatus;
+  // TODO: joedow - Remove the second arg when ProtobufHttpStatus is updated for
+  // use outside of the Protobuf* classes since that struct already has a
+  // |response_body| field.
+  using ResponseCallback =
+      base::OnceCallback<void(HttpStatusCode, std::optional<std::string>)>;
+
+  explicit ComputeEngineServiceClient(
+      scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory);
+
+  ComputeEngineServiceClient(const ComputeEngineServiceClient&) = delete;
+  ComputeEngineServiceClient& operator=(const ComputeEngineServiceClient&) =
+      delete;
+
+  ~ComputeEngineServiceClient();
+
+  // Must be called from code running within a Compute Engine Instance.
+  // Uses the default service account associated with the Instance.
+  // More information on this request can be found at:
+  // https://cloud.google.com/compute/docs/instances/verifying-instance-identity
+  void GetInstanceIdentityToken(std::string_view audience,
+                                ResponseCallback callback);
+
+  // Must be called from code running within a Compute Engine Instance.
+  // Retrieves an OAuth access token for the default service account associated
+  // with the Compute Engine Instance.
+  void GetServiceAccountAccessToken(ResponseCallback callback);
+
+  // Must be called from code running within a Compute Engine Instance.
+  // Retrieves the set of OAuth scopes present in access tokens generated for
+  // the default service account associated with the Compute Engine Instance.
+  void GetServiceAccountScopes(ResponseCallback callback);
+
+  void CancelPendingRequests();
+
+ private:
+  void ExecuteRequest(
+      std::string_view url,
+      const net::NetworkTrafficAnnotationTag& network_annotation,
+      ResponseCallback callback);
+
+  void OnRequestComplete(ResponseCallback callback,
+                         std::optional<std::string> response_body);
+
+  // |url_loader_| is non-null when a request is in-flight.
+  std::unique_ptr<network::SimpleURLLoader> url_loader_;
+  scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
+
+  THREAD_CHECKER(thread_checker_);
+
+  base::WeakPtrFactory<ComputeEngineServiceClient> weak_ptr_factory_{this};
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_BASE_COMPUTE_ENGINE_SERVICE_CLIENT_H_

tools/traffic_annotation/summary/annotations.xml

@@ -504,4 +504,7 @@ Refer to README.md for content description and update process.
  <item id="microsoft_files_page_handler" added_in_milestone="134" content_hash_code="0550fd5d" os_list="linux,windows,chromeos" file_path="chrome/browser/new_tab_page/modules/file_suggestion/microsoft_files_page_handler.cc" />
  <item id="outlook_calendar_event_attachment" added_in_milestone="134" content_hash_code="07ede3aa" os_list="linux,windows,chromeos" file_path="chrome/browser/new_tab_page/modules/v2/calendar/outlook_calendar_page_handler.cc" />
  <item id="ip_protection_service_get_issuer_token" added_in_milestone="134" content_hash_code="018c8314" os_list="linux,windows,android,chromeos" file_path="components/ip_protection/common/ip_protection_issuer_token_direct_fetcher.cc" />
+ <item id="remoting_compute_engine_instance_identity_token" added_in_milestone="135" content_hash_code="01ae9bd2" os_list="linux,windows,chromeos,android" file_path="remoting/base/compute_engine_service_client.cc" />
+ <item id="remoting_compute_engine_instance_access_token" added_in_milestone="135" content_hash_code="0117134b" os_list="linux,windows,chromeos,android" file_path="remoting/base/compute_engine_service_client.cc" />
+ <item id="remoting_compute_engine_instance_access_token_scopes" added_in_milestone="135" content_hash_code="023331d4" os_list="linux,windows,chromeos,android" file_path="remoting/base/compute_engine_service_client.cc" />
 </annotations>

tools/traffic_annotation/summary/grouping.xml

@@ -366,6 +366,9 @@ after discussions on the right group.
       <annotation id="microsoft_files_page_handler"/>
       <annotation id="outlook_calendar_event_attachment"/>
       <annotation id="ip_protection_service_get_issuer_token"/>
+      <annotation id="remoting_compute_engine_instance_identity_token"/>
+      <annotation id="remoting_compute_engine_instance_access_token"/>
+      <annotation id="remoting_compute_engine_instance_access_token_scopes"/>
     </sender>
   </group>
   <group name="Admin Features" hidden="true">