chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
   6
   7 #include <string>
   8 #include <vector>
   9
  10 #include "base/basictypes.h"
  11 #include "base/compiler_specific.h"
  12 #include "base/memory/scoped_ptr.h"
  13 #include "base/message_loop/message_loop_proxy.h"
  14 #include "base/run_loop.h"
  15 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
  16 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
  17 #include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
  18 #include "chrome/test/base/scoped_testing_local_state.h"
  19 #include "chrome/test/base/testing_browser_process.h"
  20 #include "chromeos/cryptohome/cryptohome_util.h"
  21 #include "chromeos/dbus/dbus_thread_manager.h"
  22 #include "chromeos/dbus/fake_cryptohome_client.h"
  23 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
  24 #include "content/public/test/test_utils.h"
  25 #include "policy/policy_constants.h"
  26 #include "policy/proto/device_management_backend.pb.h"
  27 #include "testing/gtest/include/gtest/gtest.h"
  28
  29 namespace em = enterprise_management;
  30
  31 namespace policy {
  32
  33 namespace {
  34
  35 void CopyLockResult(base::RunLoop* loop,
  36                     EnterpriseInstallAttributes::LockResult* out,
  37                     EnterpriseInstallAttributes::LockResult result) {
  38   *out = result;
  39   loop->Quit();
  40 }
  41
  42 }  // namespace
  43
  44 class DeviceCloudPolicyStoreChromeOSTest
  45     : public chromeos::DeviceSettingsTestBase {
  46  protected:
  47   DeviceCloudPolicyStoreChromeOSTest()
  48       : local_state_(TestingBrowserProcess::GetGlobal()),
  49         fake_cryptohome_client_(new chromeos::FakeCryptohomeClient()),
  50         install_attributes_(
  51             new EnterpriseInstallAttributes(fake_cryptohome_client_)),
  52         store_(new DeviceCloudPolicyStoreChromeOS(
  53             &device_settings_service_,
  54             install_attributes_.get(),
  55             base::MessageLoopProxy::current())) {
  56   }
  57
  58   void SetUp() override {
  59     DeviceSettingsTestBase::SetUp();
  60
  61     dbus_setter_->SetCryptohomeClient(
  62         scoped_ptr<chromeos::CryptohomeClient>(fake_cryptohome_client_));
  63
  64     base::RunLoop loop;
  65     EnterpriseInstallAttributes::LockResult result;
  66     install_attributes_->LockDevice(
  67         PolicyBuilder::kFakeUsername,
  68         DEVICE_MODE_ENTERPRISE,
  69         PolicyBuilder::kFakeDeviceId,
  70         base::Bind(&CopyLockResult, &loop, &result));
  71     loop.Run();
  72     ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
  73   }
  74
  75   void SetManagementModeAndLoad(em::PolicyData::ManagementMode mode) {
  76     device_policy_.policy_data().set_management_mode(mode);
  77     device_policy_.Build();
  78     device_settings_test_helper_.set_policy_blob(device_policy_.GetBlob());
  79     device_settings_service_.Load();
  80     FlushDeviceSettings();
  81     EXPECT_EQ(chromeos::DeviceSettingsService::STORE_SUCCESS,
  82               device_settings_service_.status());
  83   }
  84
  85   void ExpectFailure(CloudPolicyStore::Status expected_status) {
  86     EXPECT_EQ(expected_status, store_->status());
  87     EXPECT_TRUE(store_->is_initialized());
  88     EXPECT_FALSE(store_->has_policy());
  89     EXPECT_FALSE(store_->is_managed());
  90   }
  91
  92   void ExpectSuccessWithManagementMode(ManagementMode mode) {
  93     EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
  94     EXPECT_TRUE(store_->is_initialized());
  95     EXPECT_TRUE(store_->has_policy());
  96     EXPECT_TRUE(store_->is_managed());
  97     EXPECT_TRUE(store_->policy());
  98     EXPECT_TRUE(store_->policy_map().empty());
  99     if (store_->policy())
 100       EXPECT_EQ(mode, GetManagementMode(*store_->policy()));
 101   }
 102
 103   void ExpectSuccess() {
 104     EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
 105     EXPECT_TRUE(store_->is_initialized());
 106     EXPECT_TRUE(store_->has_policy());
 107     EXPECT_TRUE(store_->is_managed());
 108     EXPECT_TRUE(store_->policy());
 109     base::FundamentalValue expected(false);
 110     EXPECT_TRUE(
 111         base::Value::Equals(&expected,
 112                             store_->policy_map().GetValue(
 113                                 key::kDeviceMetricsReportingEnabled)));
 114   }
 115
 116   void PrepareExistingPolicy() {
 117     store_->Load();
 118     FlushDeviceSettings();
 119     ExpectSuccess();
 120
 121     device_policy_.UnsetNewSigningKey();
 122     device_policy_.Build();
 123   }
 124
 125   void PrepareNewSigningKey() {
 126     device_policy_.SetDefaultNewSigningKey();
 127     device_policy_.Build();
 128     owner_key_util_->SetPublicKeyFromPrivateKey(
 129         *device_policy_.GetNewSigningKey());
 130   }
 131
 132   void ResetToNonEnterprise() {
 133     store_.reset();
 134     chromeos::cryptohome_util::InstallAttributesSet("enterprise.owned",
 135                                                     std::string());
 136     install_attributes_.reset(
 137         new EnterpriseInstallAttributes(fake_cryptohome_client_));
 138     store_.reset(
 139         new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
 140                                            install_attributes_.get(),
 141                                            base::MessageLoopProxy::current()));
 142   }
 143
 144   ScopedTestingLocalState local_state_;
 145   chromeos::FakeCryptohomeClient* fake_cryptohome_client_;
 146   scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
 147
 148   scoped_ptr<DeviceCloudPolicyStoreChromeOS> store_;
 149
 150  private:
 151   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyStoreChromeOSTest);
 152 };
 153
 154 TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNoKey) {
 155   owner_key_util_->Clear();
 156   store_->Load();
 157   FlushDeviceSettings();
 158   ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
 159 }
 160
 161 TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNoPolicy) {
 162   device_settings_test_helper_.set_policy_blob(std::string());
 163   store_->Load();
 164   FlushDeviceSettings();
 165   ExpectFailure(CloudPolicyStore::STATUS_LOAD_ERROR);
 166 }
 167
 168 TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNotEnterprise) {
 169   ResetToNonEnterprise();
 170   store_->Load();
 171   FlushDeviceSettings();
 172   ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
 173 }
 174
 175 TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadSuccess) {
 176   store_->Load();
 177   FlushDeviceSettings();
 178   ExpectSuccess();
 179 }
 180
 181 TEST_F(DeviceCloudPolicyStoreChromeOSTest, UpdateFromServiceOnConsumerDevices) {
 182   ResetToNonEnterprise();
 183
 184   SetManagementModeAndLoad(em::PolicyData::CONSUMER_MANAGED);
 185   ExpectSuccessWithManagementMode(MANAGEMENT_MODE_CONSUMER_MANAGED);
 186
 187   // Unenroll from consumer management.
 188   SetManagementModeAndLoad(em::PolicyData::LOCAL_OWNER);
 189   ExpectSuccessWithManagementMode(MANAGEMENT_MODE_LOCAL_OWNER);
 190 }
 191
 192 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreSuccess) {
 193   PrepareExistingPolicy();
 194   store_->Store(device_policy_.policy());
 195   FlushDeviceSettings();
 196   ExpectSuccess();
 197 }
 198
 199 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreNoSignature) {
 200   PrepareExistingPolicy();
 201   device_policy_.policy().clear_policy_data_signature();
 202   store_->Store(device_policy_.policy());
 203   FlushDeviceSettings();
 204   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
 205   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
 206             store_->validation_status());
 207 }
 208
 209 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreBadSignature) {
 210   PrepareExistingPolicy();
 211   device_policy_.policy().set_policy_data_signature("invalid");
 212   store_->Store(device_policy_.policy());
 213   FlushDeviceSettings();
 214   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
 215   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
 216             store_->validation_status());
 217 }
 218
 219 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreKeyRotation) {
 220   PrepareExistingPolicy();
 221   device_policy_.SetDefaultNewSigningKey();
 222   device_policy_.Build();
 223   store_->Store(device_policy_.policy());
 224   content::RunAllBlockingPoolTasksUntilIdle();
 225   device_settings_test_helper_.FlushStore();
 226   owner_key_util_->SetPublicKeyFromPrivateKey(
 227       *device_policy_.GetNewSigningKey());
 228   ReloadDeviceSettings();
 229   ExpectSuccess();
 230 }
 231
 232 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
 233        StoreKeyRotationVerificationFailure) {
 234   PrepareExistingPolicy();
 235   device_policy_.SetDefaultNewSigningKey();
 236   device_policy_.Build();
 237   *device_policy_.policy().mutable_new_public_key_verification_signature() =
 238       "garbage";
 239   store_->Store(device_policy_.policy());
 240   FlushDeviceSettings();
 241   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
 242   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
 243             store_->validation_status());
 244 }
 245
 246 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
 247        StoreKeyRotationMissingSignatureFailure) {
 248   PrepareExistingPolicy();
 249   device_policy_.SetDefaultNewSigningKey();
 250   device_policy_.Build();
 251   device_policy_.policy().clear_new_public_key_verification_signature();
 252   store_->Store(device_policy_.policy());
 253   FlushDeviceSettings();
 254   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
 255   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
 256             store_->validation_status());
 257 }
 258
 259 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicySuccess) {
 260   PrepareNewSigningKey();
 261   store_->InstallInitialPolicy(device_policy_.policy());
 262   FlushDeviceSettings();
 263   ExpectSuccess();
 264 }
 265
 266 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoSignature) {
 267   PrepareNewSigningKey();
 268   device_policy_.policy().clear_policy_data_signature();
 269   store_->InstallInitialPolicy(device_policy_.policy());
 270   FlushDeviceSettings();
 271   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
 272   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
 273             store_->validation_status());
 274 }
 275
 276 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
 277        InstallInitialPolicyVerificationFailure) {
 278   PrepareNewSigningKey();
 279   *device_policy_.policy().mutable_new_public_key_verification_signature() =
 280       "garbage";
 281   store_->InstallInitialPolicy(device_policy_.policy());
 282   FlushDeviceSettings();
 283   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
 284   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
 285             store_->validation_status());
 286 }
 287
 288 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
 289        InstallInitialPolicyMissingSignatureFailure) {
 290   PrepareNewSigningKey();
 291   device_policy_.policy().clear_new_public_key_verification_signature();
 292   store_->InstallInitialPolicy(device_policy_.policy());
 293   FlushDeviceSettings();
 294   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
 295   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
 296             store_->validation_status());
 297 }
 298
 299 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoKey) {
 300   PrepareNewSigningKey();
 301   device_policy_.policy().clear_new_public_key();
 302   store_->InstallInitialPolicy(device_policy_.policy());
 303   FlushDeviceSettings();
 304   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
 305   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
 306             store_->validation_status());
 307 }
 308
 309 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNotEnterprise) {
 310   PrepareNewSigningKey();
 311   ResetToNonEnterprise();
 312   store_->InstallInitialPolicy(device_policy_.policy());
 313   FlushDeviceSettings();
 314   ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
 315 }
 316
 317 }  // namespace policy