1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
6
7#include <string>
8#include <vector>
9
10#include "base/basictypes.h"
11#include "base/compiler_specific.h"
12#include "base/memory/scoped_ptr.h"
13#include "base/message_loop/message_loop_proxy.h"
14#include "base/run_loop.h"
15#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
16#include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
17#include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
18#include "chrome/test/base/scoped_testing_local_state.h"
19#include "chrome/test/base/testing_browser_process.h"
20#include "chromeos/cryptohome/cryptohome_util.h"
21#include "chromeos/dbus/dbus_thread_manager.h"
22#include "chromeos/dbus/fake_cryptohome_client.h"
23#include "content/public/test/test_utils.h"
24#include "policy/policy_constants.h"
25#include "testing/gtest/include/gtest/gtest.h"
26
27namespace policy {
28
29namespace {
30
31void CopyLockResult(base::RunLoop* loop,
32                    EnterpriseInstallAttributes::LockResult* out,
33                    EnterpriseInstallAttributes::LockResult result) {
34  *out = result;
35  loop->Quit();
36}
37
38}  // namespace
39
40class DeviceCloudPolicyStoreChromeOSTest
41    : public chromeos::DeviceSettingsTestBase {
42 protected:
43  DeviceCloudPolicyStoreChromeOSTest()
44      : local_state_(TestingBrowserProcess::GetGlobal()),
45        fake_cryptohome_client_(new chromeos::FakeCryptohomeClient()),
46        install_attributes_(
47            new EnterpriseInstallAttributes(fake_cryptohome_client_)),
48        store_(new DeviceCloudPolicyStoreChromeOS(
49            &device_settings_service_,
50            install_attributes_.get(),
51            base::MessageLoopProxy::current())) {
52  }
53
54  virtual void SetUp() OVERRIDE {
55    DeviceSettingsTestBase::SetUp();
56
57    dbus_setter_->SetCryptohomeClient(
58        scoped_ptr<chromeos::CryptohomeClient>(fake_cryptohome_client_));
59
60    base::RunLoop loop;
61    EnterpriseInstallAttributes::LockResult result;
62    install_attributes_->LockDevice(
63        PolicyBuilder::kFakeUsername,
64        DEVICE_MODE_ENTERPRISE,
65        PolicyBuilder::kFakeDeviceId,
66        base::Bind(&CopyLockResult, &loop, &result));
67    loop.Run();
68    ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
69  }
70
71  void ExpectFailure(CloudPolicyStore::Status expected_status) {
72    EXPECT_EQ(expected_status, store_->status());
73    EXPECT_TRUE(store_->is_initialized());
74    EXPECT_FALSE(store_->has_policy());
75    EXPECT_FALSE(store_->is_managed());
76  }
77
78  void ExpectSuccess() {
79    EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
80    EXPECT_TRUE(store_->is_initialized());
81    EXPECT_TRUE(store_->has_policy());
82    EXPECT_TRUE(store_->is_managed());
83    EXPECT_TRUE(store_->policy());
84    base::FundamentalValue expected(false);
85    EXPECT_TRUE(
86        base::Value::Equals(&expected,
87                            store_->policy_map().GetValue(
88                                key::kDeviceMetricsReportingEnabled)));
89  }
90
91  void PrepareExistingPolicy() {
92    store_->Load();
93    FlushDeviceSettings();
94    ExpectSuccess();
95
96    device_policy_.UnsetNewSigningKey();
97    device_policy_.Build();
98  }
99
100  void PrepareNewSigningKey() {
101    device_policy_.SetDefaultNewSigningKey();
102    device_policy_.Build();
103    owner_key_util_->SetPublicKeyFromPrivateKey(
104        *device_policy_.GetNewSigningKey());
105  }
106
107  void ResetToNonEnterprise() {
108    store_.reset();
109    chromeos::cryptohome_util::InstallAttributesSet("enterprise.owned",
110                                                    std::string());
111    install_attributes_.reset(
112        new EnterpriseInstallAttributes(fake_cryptohome_client_));
113    store_.reset(
114        new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
115                                           install_attributes_.get(),
116                                           base::MessageLoopProxy::current()));
117  }
118
119  ScopedTestingLocalState local_state_;
120  chromeos::FakeCryptohomeClient* fake_cryptohome_client_;
121  scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
122
123  scoped_ptr<DeviceCloudPolicyStoreChromeOS> store_;
124
125 private:
126  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyStoreChromeOSTest);
127};
128
129TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNoKey) {
130  owner_key_util_->Clear();
131  store_->Load();
132  FlushDeviceSettings();
133  ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
134}
135
136TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNoPolicy) {
137  device_settings_test_helper_.set_policy_blob(std::string());
138  store_->Load();
139  FlushDeviceSettings();
140  ExpectFailure(CloudPolicyStore::STATUS_LOAD_ERROR);
141}
142
143TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNotEnterprise) {
144  ResetToNonEnterprise();
145  store_->Load();
146  FlushDeviceSettings();
147  ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
148}
149
150TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadSuccess) {
151  store_->Load();
152  FlushDeviceSettings();
153  ExpectSuccess();
154}
155
156TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreSuccess) {
157  PrepareExistingPolicy();
158  store_->Store(device_policy_.policy());
159  FlushDeviceSettings();
160  ExpectSuccess();
161}
162
163TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreNoSignature) {
164  PrepareExistingPolicy();
165  device_policy_.policy().clear_policy_data_signature();
166  store_->Store(device_policy_.policy());
167  FlushDeviceSettings();
168  EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
169  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
170            store_->validation_status());
171}
172
173TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreBadSignature) {
174  PrepareExistingPolicy();
175  device_policy_.policy().set_policy_data_signature("invalid");
176  store_->Store(device_policy_.policy());
177  FlushDeviceSettings();
178  EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
179  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
180            store_->validation_status());
181}
182
183TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreKeyRotation) {
184  PrepareExistingPolicy();
185  device_policy_.SetDefaultNewSigningKey();
186  device_policy_.Build();
187  store_->Store(device_policy_.policy());
188  content::RunAllBlockingPoolTasksUntilIdle();
189  device_settings_test_helper_.FlushStore();
190  owner_key_util_->SetPublicKeyFromPrivateKey(
191      *device_policy_.GetNewSigningKey());
192  ReloadDeviceSettings();
193  ExpectSuccess();
194}
195
196TEST_F(DeviceCloudPolicyStoreChromeOSTest,
197       StoreKeyRotationVerificationFailure) {
198  PrepareExistingPolicy();
199  device_policy_.SetDefaultNewSigningKey();
200  device_policy_.Build();
201  *device_policy_.policy().mutable_new_public_key_verification_signature() =
202      "garbage";
203  store_->Store(device_policy_.policy());
204  FlushDeviceSettings();
205  EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
206  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
207            store_->validation_status());
208}
209
210TEST_F(DeviceCloudPolicyStoreChromeOSTest,
211       StoreKeyRotationMissingSignatureFailure) {
212  PrepareExistingPolicy();
213  device_policy_.SetDefaultNewSigningKey();
214  device_policy_.Build();
215  device_policy_.policy().clear_new_public_key_verification_signature();
216  store_->Store(device_policy_.policy());
217  FlushDeviceSettings();
218  EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
219  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
220            store_->validation_status());
221}
222
223TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicySuccess) {
224  PrepareNewSigningKey();
225  store_->InstallInitialPolicy(device_policy_.policy());
226  FlushDeviceSettings();
227  ExpectSuccess();
228}
229
230TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoSignature) {
231  PrepareNewSigningKey();
232  device_policy_.policy().clear_policy_data_signature();
233  store_->InstallInitialPolicy(device_policy_.policy());
234  FlushDeviceSettings();
235  ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
236  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
237            store_->validation_status());
238}
239
240TEST_F(DeviceCloudPolicyStoreChromeOSTest,
241       InstallInitialPolicyVerificationFailure) {
242  PrepareNewSigningKey();
243  *device_policy_.policy().mutable_new_public_key_verification_signature() =
244      "garbage";
245  store_->InstallInitialPolicy(device_policy_.policy());
246  FlushDeviceSettings();
247  ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
248  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
249            store_->validation_status());
250}
251
252TEST_F(DeviceCloudPolicyStoreChromeOSTest,
253       InstallInitialPolicyMissingSignatureFailure) {
254  PrepareNewSigningKey();
255  device_policy_.policy().clear_new_public_key_verification_signature();
256  store_->InstallInitialPolicy(device_policy_.policy());
257  FlushDeviceSettings();
258  ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
259  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
260            store_->validation_status());
261}
262
263TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoKey) {
264  PrepareNewSigningKey();
265  device_policy_.policy().clear_new_public_key();
266  store_->InstallInitialPolicy(device_policy_.policy());
267  FlushDeviceSettings();
268  ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
269  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
270            store_->validation_status());
271}
272
273TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNotEnterprise) {
274  PrepareNewSigningKey();
275  ResetToNonEnterprise();
276  store_->InstallInitialPolicy(device_policy_.policy());
277  FlushDeviceSettings();
278  ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
279}
280
281}  // namespace policy
282