network_configuration_updater_unittest.cc revision 1320f92c476a1ad9d19dba2a48c72b75566198e9
1// Copyright 2013 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "base/bind.h" 6#include "base/bind_helpers.h" 7#include "base/callback.h" 8#include "base/files/file_path.h" 9#include "base/memory/scoped_ptr.h" 10#include "base/run_loop.h" 11#include "base/values.h" 12#include "chrome/browser/chromeos/policy/device_network_configuration_updater.h" 13#include "chrome/browser/chromeos/policy/user_network_configuration_updater.h" 14#include "chrome/browser/chromeos/settings/cros_settings.h" 15#include "chrome/browser/chromeos/settings/device_settings_service.h" 16#include "chrome/browser/chromeos/settings/stub_cros_settings_provider.h" 17#include "chrome/test/base/testing_profile.h" 18#include "chromeos/network/fake_network_device_handler.h" 19#include "chromeos/network/mock_managed_network_configuration_handler.h" 20#include "chromeos/network/onc/onc_certificate_importer.h" 21#include "chromeos/network/onc/onc_test_utils.h" 22#include "chromeos/network/onc/onc_utils.h" 23#include "components/onc/onc_constants.h" 24#include "components/policy/core/common/external_data_fetcher.h" 25#include "components/policy/core/common/mock_configuration_policy_provider.h" 26#include "components/policy/core/common/policy_map.h" 27#include "components/policy/core/common/policy_service_impl.h" 28#include "components/user_manager/user.h" 29#include "components/user_manager/user_type.h" 30#include "content/public/test/test_browser_thread_bundle.h" 31#include "content/public/test/test_utils.h" 32#include "net/base/test_data_directory.h" 33#include "net/cert/x509_certificate.h" 34#include "net/test/cert_test_util.h" 35#include "policy/policy_constants.h" 36#include "testing/gmock/include/gmock/gmock.h" 37#include "testing/gtest/include/gtest/gtest.h" 38 39using testing::AnyNumber; 40using testing::AtLeast; 41using testing::Mock; 42using testing::Ne; 43using testing::Return; 44using testing::StrictMock; 45using testing::_; 46 47namespace policy { 48 49namespace { 50 51const char kFakeUserEmail[] = "fake email"; 52const char kFakeUsernameHash[] = "fake hash"; 53 54class FakeUser : public user_manager::User { 55 public: 56 FakeUser() : User(kFakeUserEmail) { 57 set_display_email(kFakeUserEmail); 58 set_username_hash(kFakeUsernameHash); 59 } 60 virtual ~FakeUser() {} 61 62 // User overrides 63 virtual user_manager::UserType GetType() const OVERRIDE { 64 return user_manager::USER_TYPE_REGULAR; 65 } 66 67 private: 68 DISALLOW_COPY_AND_ASSIGN(FakeUser); 69}; 70 71class FakeWebTrustedCertsObserver 72 : public UserNetworkConfigurationUpdater::WebTrustedCertsObserver { 73 public: 74 FakeWebTrustedCertsObserver() {} 75 76 virtual void OnTrustAnchorsChanged( 77 const net::CertificateList& trust_anchors) OVERRIDE { 78 trust_anchors_ = trust_anchors; 79 } 80 net::CertificateList trust_anchors_; 81 82 private: 83 DISALLOW_COPY_AND_ASSIGN(FakeWebTrustedCertsObserver); 84}; 85 86class FakeNetworkDeviceHandler : public chromeos::FakeNetworkDeviceHandler { 87 public: 88 FakeNetworkDeviceHandler() : allow_roaming_(false) {} 89 90 virtual void SetCellularAllowRoaming(bool allow_roaming) OVERRIDE { 91 allow_roaming_ = allow_roaming; 92 } 93 94 bool allow_roaming_; 95 96 private: 97 DISALLOW_COPY_AND_ASSIGN(FakeNetworkDeviceHandler); 98}; 99 100class FakeCertificateImporter : public chromeos::onc::CertificateImporter { 101 public: 102 FakeCertificateImporter() 103 : expected_onc_source_(::onc::ONC_SOURCE_UNKNOWN), call_count_(0) {} 104 virtual ~FakeCertificateImporter() {} 105 106 void SetTrustedCertificatesResult( 107 net::CertificateList onc_trusted_certificates) { 108 onc_trusted_certificates_ = onc_trusted_certificates; 109 } 110 111 void SetExpectedONCCertificates(const base::ListValue& certificates) { 112 expected_onc_certificates_.reset(certificates.DeepCopy()); 113 } 114 115 void SetExpectedONCSource(::onc::ONCSource source) { 116 expected_onc_source_ = source; 117 } 118 119 unsigned int GetAndResetImportCount() { 120 unsigned int count = call_count_; 121 call_count_ = 0; 122 return count; 123 } 124 125 virtual void ImportCertificates(const base::ListValue& certificates, 126 ::onc::ONCSource source, 127 const DoneCallback& done_callback) OVERRIDE { 128 if (expected_onc_source_ != ::onc::ONC_SOURCE_UNKNOWN) 129 EXPECT_EQ(expected_onc_source_, source); 130 if (expected_onc_certificates_) { 131 EXPECT_TRUE(chromeos::onc::test_utils::Equals( 132 expected_onc_certificates_.get(), &certificates)); 133 } 134 ++call_count_; 135 done_callback.Run(true, onc_trusted_certificates_); 136 } 137 138 private: 139 ::onc::ONCSource expected_onc_source_; 140 scoped_ptr<base::ListValue> expected_onc_certificates_; 141 net::CertificateList onc_trusted_certificates_; 142 unsigned int call_count_; 143 144 DISALLOW_COPY_AND_ASSIGN(FakeCertificateImporter); 145}; 146 147const char kFakeONC[] = 148 "{ \"NetworkConfigurations\": [" 149 " { \"GUID\": \"{485d6076-dd44-6b6d-69787465725f5040}\"," 150 " \"Type\": \"WiFi\"," 151 " \"Name\": \"My WiFi Network\"," 152 " \"WiFi\": {" 153 " \"SSID\": \"ssid-none\"," 154 " \"Security\": \"None\" }" 155 " }" 156 " ]," 157 " \"GlobalNetworkConfiguration\": {" 158 " \"AllowOnlyPolicyNetworksToAutoconnect\": true," 159 " }," 160 " \"Certificates\": [" 161 " { \"GUID\": \"{f998f760-272b-6939-4c2beffe428697ac}\"," 162 " \"PKCS12\": \"abc\"," 163 " \"Type\": \"Client\" }" 164 " ]," 165 " \"Type\": \"UnencryptedConfiguration\"" 166 "}"; 167 168std::string ValueToString(const base::Value& value) { 169 std::stringstream str; 170 str << value; 171 return str.str(); 172} 173 174void AppendAll(const base::ListValue& from, base::ListValue* to) { 175 for (base::ListValue::const_iterator it = from.begin(); it != from.end(); 176 ++it) { 177 to->Append((*it)->DeepCopy()); 178 } 179} 180 181// Matcher to match base::Value. 182MATCHER_P(IsEqualTo, 183 value, 184 std::string(negation ? "isn't" : "is") + " equal to " + 185 ValueToString(*value)) { 186 return value->Equals(&arg); 187} 188 189MATCHER(IsEmpty, std::string(negation ? "isn't" : "is") + " empty.") { 190 return arg.empty(); 191} 192 193ACTION_P(SetCertificateList, list) { 194 if (arg2) 195 *arg2 = list; 196 return true; 197} 198 199} // namespace 200 201class NetworkConfigurationUpdaterTest : public testing::Test { 202 protected: 203 NetworkConfigurationUpdaterTest() : certificate_importer_(NULL) {} 204 205 virtual void SetUp() OVERRIDE { 206 EXPECT_CALL(provider_, IsInitializationComplete(_)) 207 .WillRepeatedly(Return(false)); 208 provider_.Init(); 209 PolicyServiceImpl::Providers providers; 210 providers.push_back(&provider_); 211 policy_service_.reset(new PolicyServiceImpl(providers)); 212 213 scoped_ptr<base::DictionaryValue> fake_toplevel_onc = 214 chromeos::onc::ReadDictionaryFromJson(kFakeONC); 215 216 base::ListValue* network_configs = NULL; 217 fake_toplevel_onc->GetListWithoutPathExpansion( 218 onc::toplevel_config::kNetworkConfigurations, &network_configs); 219 AppendAll(*network_configs, &fake_network_configs_); 220 221 base::DictionaryValue* global_config = NULL; 222 fake_toplevel_onc->GetDictionaryWithoutPathExpansion( 223 onc::toplevel_config::kGlobalNetworkConfiguration, &global_config); 224 fake_global_network_config_.MergeDictionary(global_config); 225 226 base::ListValue* certs = NULL; 227 fake_toplevel_onc->GetListWithoutPathExpansion( 228 onc::toplevel_config::kCertificates, &certs); 229 AppendAll(*certs, &fake_certificates_); 230 231 certificate_importer_ = new FakeCertificateImporter; 232 certificate_importer_owned_.reset(certificate_importer_); 233 } 234 235 virtual void TearDown() OVERRIDE { 236 network_configuration_updater_.reset(); 237 provider_.Shutdown(); 238 base::RunLoop().RunUntilIdle(); 239 } 240 241 void MarkPolicyProviderInitialized() { 242 Mock::VerifyAndClearExpectations(&provider_); 243 EXPECT_CALL(provider_, IsInitializationComplete(_)) 244 .WillRepeatedly(Return(true)); 245 provider_.SetAutoRefresh(); 246 provider_.RefreshPolicies(); 247 base::RunLoop().RunUntilIdle(); 248 } 249 250 void UpdateProviderPolicy(const PolicyMap& policy) { 251 provider_.UpdateChromePolicy(policy); 252 base::RunLoop().RunUntilIdle(); 253 } 254 255 UserNetworkConfigurationUpdater* 256 CreateNetworkConfigurationUpdaterForUserPolicy( 257 bool allow_trusted_certs_from_policy, 258 bool set_cert_importer) { 259 UserNetworkConfigurationUpdater* updater = 260 UserNetworkConfigurationUpdater::CreateForUserPolicy( 261 &profile_, 262 allow_trusted_certs_from_policy, 263 fake_user_, 264 policy_service_.get(), 265 &network_config_handler_).release(); 266 if (set_cert_importer) { 267 EXPECT_TRUE(certificate_importer_owned_); 268 updater->SetCertificateImporterForTest( 269 certificate_importer_owned_.Pass()); 270 } 271 network_configuration_updater_.reset(updater); 272 return updater; 273 } 274 275 void CreateNetworkConfigurationUpdaterForDevicePolicy() { 276 network_configuration_updater_ = 277 DeviceNetworkConfigurationUpdater::CreateForDevicePolicy( 278 policy_service_.get(), 279 &network_config_handler_, 280 &network_device_handler_, 281 chromeos::CrosSettings::Get()); 282 } 283 284 base::ListValue fake_network_configs_; 285 base::DictionaryValue fake_global_network_config_; 286 base::ListValue fake_certificates_; 287 StrictMock<chromeos::MockManagedNetworkConfigurationHandler> 288 network_config_handler_; 289 FakeNetworkDeviceHandler network_device_handler_; 290 291 // Not used directly. Required for CrosSettings. 292 chromeos::ScopedTestDeviceSettingsService scoped_device_settings_service_; 293 chromeos::ScopedTestCrosSettings scoped_cros_settings_; 294 295 // Ownership of certificate_importer_owned_ is passed to the 296 // NetworkConfigurationUpdater. When that happens, |certificate_importer_| 297 // continues to point to that instance but |certificate_importer_owned_| is 298 // released. 299 FakeCertificateImporter* certificate_importer_; 300 scoped_ptr<chromeos::onc::CertificateImporter> certificate_importer_owned_; 301 302 StrictMock<MockConfigurationPolicyProvider> provider_; 303 scoped_ptr<PolicyServiceImpl> policy_service_; 304 FakeUser fake_user_; 305 306 TestingProfile profile_; 307 308 scoped_ptr<NetworkConfigurationUpdater> network_configuration_updater_; 309 content::TestBrowserThreadBundle thread_bundle_; 310}; 311 312TEST_F(NetworkConfigurationUpdaterTest, CellularAllowRoaming) { 313 // Ignore network config updates. 314 EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _)).Times(AtLeast(1)); 315 316 // Setup the DataRoaming device setting. 317 chromeos::CrosSettings* cros_settings = chromeos::CrosSettings::Get(); 318 chromeos::CrosSettingsProvider* device_settings_provider = 319 cros_settings->GetProvider(chromeos::kSignedDataRoamingEnabled); 320 cros_settings->RemoveSettingsProvider(device_settings_provider); 321 delete device_settings_provider; 322 chromeos::StubCrosSettingsProvider* stub_settings_provider = 323 new chromeos::StubCrosSettingsProvider; 324 cros_settings->AddSettingsProvider(stub_settings_provider); 325 326 chromeos::CrosSettings::Get()->Set(chromeos::kSignedDataRoamingEnabled, 327 base::FundamentalValue(false)); 328 EXPECT_FALSE(network_device_handler_.allow_roaming_); 329 330 CreateNetworkConfigurationUpdaterForDevicePolicy(); 331 MarkPolicyProviderInitialized(); 332 chromeos::CrosSettings::Get()->Set(chromeos::kSignedDataRoamingEnabled, 333 base::FundamentalValue(true)); 334 EXPECT_TRUE(network_device_handler_.allow_roaming_); 335 336 chromeos::CrosSettings::Get()->Set(chromeos::kSignedDataRoamingEnabled, 337 base::FundamentalValue(false)); 338 EXPECT_FALSE(network_device_handler_.allow_roaming_); 339} 340 341TEST_F(NetworkConfigurationUpdaterTest, PolicyIsValidatedAndRepaired) { 342 scoped_ptr<base::DictionaryValue> onc_repaired = 343 chromeos::onc::test_utils::ReadTestDictionary( 344 "repaired_toplevel_partially_invalid.onc"); 345 346 base::ListValue* network_configs_repaired = NULL; 347 onc_repaired->GetListWithoutPathExpansion( 348 onc::toplevel_config::kNetworkConfigurations, &network_configs_repaired); 349 ASSERT_TRUE(network_configs_repaired); 350 351 base::DictionaryValue* global_config_repaired = NULL; 352 onc_repaired->GetDictionaryWithoutPathExpansion( 353 onc::toplevel_config::kGlobalNetworkConfiguration, 354 &global_config_repaired); 355 ASSERT_TRUE(global_config_repaired); 356 357 std::string onc_policy = 358 chromeos::onc::test_utils::ReadTestData("toplevel_partially_invalid.onc"); 359 PolicyMap policy; 360 policy.Set(key::kOpenNetworkConfiguration, 361 POLICY_LEVEL_MANDATORY, 362 POLICY_SCOPE_USER, 363 new base::StringValue(onc_policy), 364 NULL); 365 UpdateProviderPolicy(policy); 366 367 EXPECT_CALL(network_config_handler_, 368 SetPolicy(onc::ONC_SOURCE_USER_POLICY, 369 _, 370 IsEqualTo(network_configs_repaired), 371 IsEqualTo(global_config_repaired))); 372 certificate_importer_->SetExpectedONCSource(onc::ONC_SOURCE_USER_POLICY); 373 374 CreateNetworkConfigurationUpdaterForUserPolicy( 375 false /* do not allow trusted certs from policy */, 376 true /* set certificate importer */); 377 MarkPolicyProviderInitialized(); 378 EXPECT_EQ(1u, certificate_importer_->GetAndResetImportCount()); 379} 380 381TEST_F(NetworkConfigurationUpdaterTest, 382 DoNotAllowTrustedCertificatesFromPolicy) { 383 net::CertificateList cert_list; 384 cert_list = 385 net::CreateCertificateListFromFile(net::GetTestCertsDirectory(), 386 "ok_cert.pem", 387 net::X509Certificate::FORMAT_AUTO); 388 ASSERT_EQ(1u, cert_list.size()); 389 390 EXPECT_CALL(network_config_handler_, 391 SetPolicy(onc::ONC_SOURCE_USER_POLICY, _, _, _)); 392 certificate_importer_->SetTrustedCertificatesResult(cert_list); 393 394 UserNetworkConfigurationUpdater* updater = 395 CreateNetworkConfigurationUpdaterForUserPolicy( 396 false /* do not allow trusted certs from policy */, 397 true /* set certificate importer */); 398 MarkPolicyProviderInitialized(); 399 400 // Certificates with the "Web" trust flag set should not be forwarded to 401 // observers. 402 FakeWebTrustedCertsObserver observer; 403 updater->AddTrustedCertsObserver(&observer); 404 405 base::RunLoop().RunUntilIdle(); 406 407 net::CertificateList trust_anchors; 408 updater->GetWebTrustedCertificates(&trust_anchors); 409 EXPECT_TRUE(trust_anchors.empty()); 410 411 EXPECT_TRUE(observer.trust_anchors_.empty()); 412 updater->RemoveTrustedCertsObserver(&observer); 413} 414 415TEST_F(NetworkConfigurationUpdaterTest, 416 AllowTrustedCertificatesFromPolicyInitially) { 417 // Ignore network configuration changes. 418 EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _)) 419 .Times(AnyNumber()); 420 421 net::CertificateList cert_list; 422 cert_list = 423 net::CreateCertificateListFromFile(net::GetTestCertsDirectory(), 424 "ok_cert.pem", 425 net::X509Certificate::FORMAT_AUTO); 426 ASSERT_EQ(1u, cert_list.size()); 427 428 certificate_importer_->SetExpectedONCSource(onc::ONC_SOURCE_USER_POLICY); 429 certificate_importer_->SetTrustedCertificatesResult(cert_list); 430 431 UserNetworkConfigurationUpdater* updater = 432 CreateNetworkConfigurationUpdaterForUserPolicy( 433 true /* allow trusted certs from policy */, 434 true /* set certificate importer */); 435 MarkPolicyProviderInitialized(); 436 437 base::RunLoop().RunUntilIdle(); 438 439 // Certificates with the "Web" trust flag set will be returned. 440 net::CertificateList trust_anchors; 441 updater->GetWebTrustedCertificates(&trust_anchors); 442 EXPECT_EQ(1u, trust_anchors.size()); 443} 444 445TEST_F(NetworkConfigurationUpdaterTest, 446 AllowTrustedCertificatesFromPolicyOnUpdate) { 447 // Ignore network configuration changes. 448 EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _)) 449 .Times(AnyNumber()); 450 451 // Start with an empty certificate list. 452 UserNetworkConfigurationUpdater* updater = 453 CreateNetworkConfigurationUpdaterForUserPolicy( 454 true /* allow trusted certs from policy */, 455 true /* set certificate importer */); 456 MarkPolicyProviderInitialized(); 457 458 FakeWebTrustedCertsObserver observer; 459 updater->AddTrustedCertsObserver(&observer); 460 461 base::RunLoop().RunUntilIdle(); 462 463 // Verify that the returned certificate list is empty. 464 { 465 net::CertificateList trust_anchors; 466 updater->GetWebTrustedCertificates(&trust_anchors); 467 EXPECT_TRUE(trust_anchors.empty()); 468 } 469 EXPECT_TRUE(observer.trust_anchors_.empty()); 470 471 // Now use a non-empty certificate list to test the observer notification. 472 net::CertificateList cert_list; 473 cert_list = 474 net::CreateCertificateListFromFile(net::GetTestCertsDirectory(), 475 "ok_cert.pem", 476 net::X509Certificate::FORMAT_AUTO); 477 ASSERT_EQ(1u, cert_list.size()); 478 certificate_importer_->SetTrustedCertificatesResult(cert_list); 479 480 // Change to any non-empty policy, so that updates are triggered. The actual 481 // content of the policy is irrelevant. 482 PolicyMap policy; 483 policy.Set(key::kOpenNetworkConfiguration, 484 POLICY_LEVEL_MANDATORY, 485 POLICY_SCOPE_USER, 486 new base::StringValue(kFakeONC), 487 NULL); 488 UpdateProviderPolicy(policy); 489 base::RunLoop().RunUntilIdle(); 490 491 // Certificates with the "Web" trust flag set will be returned and forwarded 492 // to observers. 493 { 494 net::CertificateList trust_anchors; 495 updater->GetWebTrustedCertificates(&trust_anchors); 496 EXPECT_EQ(1u, trust_anchors.size()); 497 } 498 EXPECT_EQ(1u, observer.trust_anchors_.size()); 499 500 updater->RemoveTrustedCertsObserver(&observer); 501} 502 503TEST_F(NetworkConfigurationUpdaterTest, 504 DontImportCertificateBeforeCertificateImporterSet) { 505 PolicyMap policy; 506 policy.Set(key::kOpenNetworkConfiguration, POLICY_LEVEL_MANDATORY, 507 POLICY_SCOPE_USER, new base::StringValue(kFakeONC), NULL); 508 UpdateProviderPolicy(policy); 509 510 EXPECT_CALL(network_config_handler_, 511 SetPolicy(onc::ONC_SOURCE_USER_POLICY, 512 kFakeUsernameHash, 513 IsEqualTo(&fake_network_configs_), 514 IsEqualTo(&fake_global_network_config_))); 515 516 UserNetworkConfigurationUpdater* updater = 517 CreateNetworkConfigurationUpdaterForUserPolicy( 518 true /* allow trusted certs from policy */, 519 false /* do not set certificate importer */); 520 MarkPolicyProviderInitialized(); 521 522 Mock::VerifyAndClearExpectations(&network_config_handler_); 523 EXPECT_EQ(0u, certificate_importer_->GetAndResetImportCount()); 524 525 certificate_importer_->SetExpectedONCCertificates(fake_certificates_); 526 certificate_importer_->SetExpectedONCSource(onc::ONC_SOURCE_USER_POLICY); 527 528 ASSERT_TRUE(certificate_importer_owned_); 529 updater->SetCertificateImporterForTest(certificate_importer_owned_.Pass()); 530 EXPECT_EQ(1u, certificate_importer_->GetAndResetImportCount()); 531} 532 533class NetworkConfigurationUpdaterTestWithParam 534 : public NetworkConfigurationUpdaterTest, 535 public testing::WithParamInterface<const char*> { 536 protected: 537 // Returns the currently tested ONC source. 538 onc::ONCSource CurrentONCSource() { 539 if (GetParam() == key::kOpenNetworkConfiguration) 540 return onc::ONC_SOURCE_USER_POLICY; 541 DCHECK(GetParam() == key::kDeviceOpenNetworkConfiguration); 542 return onc::ONC_SOURCE_DEVICE_POLICY; 543 } 544 545 // Returns the expected username hash to push policies to 546 // ManagedNetworkConfigurationHandler. 547 std::string ExpectedUsernameHash() { 548 if (GetParam() == key::kOpenNetworkConfiguration) 549 return kFakeUsernameHash; 550 return std::string(); 551 } 552 553 size_t ExpectedImportCertificatesCallCount() { 554 if (GetParam() == key::kOpenNetworkConfiguration) 555 return 1u; 556 return 0u; 557 } 558 559 void CreateNetworkConfigurationUpdater() { 560 if (GetParam() == key::kOpenNetworkConfiguration) { 561 CreateNetworkConfigurationUpdaterForUserPolicy( 562 false /* do not allow trusted certs from policy */, 563 true /* set certificate importer */); 564 } else { 565 CreateNetworkConfigurationUpdaterForDevicePolicy(); 566 } 567 } 568}; 569 570TEST_P(NetworkConfigurationUpdaterTestWithParam, InitialUpdates) { 571 PolicyMap policy; 572 policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, 573 new base::StringValue(kFakeONC), NULL); 574 UpdateProviderPolicy(policy); 575 576 EXPECT_CALL(network_config_handler_, 577 SetPolicy(CurrentONCSource(), 578 ExpectedUsernameHash(), 579 IsEqualTo(&fake_network_configs_), 580 IsEqualTo(&fake_global_network_config_))); 581 certificate_importer_->SetExpectedONCCertificates(fake_certificates_); 582 certificate_importer_->SetExpectedONCSource(CurrentONCSource()); 583 584 CreateNetworkConfigurationUpdater(); 585 MarkPolicyProviderInitialized(); 586 EXPECT_EQ(ExpectedImportCertificatesCallCount(), 587 certificate_importer_->GetAndResetImportCount()); 588} 589 590TEST_P(NetworkConfigurationUpdaterTestWithParam, 591 PolicyNotSetBeforePolicyProviderInitialized) { 592 PolicyMap policy; 593 policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, 594 new base::StringValue(kFakeONC), NULL); 595 UpdateProviderPolicy(policy); 596 597 CreateNetworkConfigurationUpdater(); 598 599 Mock::VerifyAndClearExpectations(&network_config_handler_); 600 EXPECT_EQ(0u, certificate_importer_->GetAndResetImportCount()); 601 602 EXPECT_CALL(network_config_handler_, 603 SetPolicy(CurrentONCSource(), 604 ExpectedUsernameHash(), 605 IsEqualTo(&fake_network_configs_), 606 IsEqualTo(&fake_global_network_config_))); 607 certificate_importer_->SetExpectedONCSource(CurrentONCSource()); 608 certificate_importer_->SetExpectedONCCertificates(fake_certificates_); 609 610 MarkPolicyProviderInitialized(); 611 EXPECT_EQ(ExpectedImportCertificatesCallCount(), 612 certificate_importer_->GetAndResetImportCount()); 613} 614 615TEST_P(NetworkConfigurationUpdaterTestWithParam, 616 PolicyAppliedImmediatelyIfProvidersInitialized) { 617 MarkPolicyProviderInitialized(); 618 619 PolicyMap policy; 620 policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, 621 new base::StringValue(kFakeONC), NULL); 622 UpdateProviderPolicy(policy); 623 624 EXPECT_CALL(network_config_handler_, 625 SetPolicy(CurrentONCSource(), 626 ExpectedUsernameHash(), 627 IsEqualTo(&fake_network_configs_), 628 IsEqualTo(&fake_global_network_config_))); 629 certificate_importer_->SetExpectedONCSource(CurrentONCSource()); 630 certificate_importer_->SetExpectedONCCertificates(fake_certificates_); 631 632 CreateNetworkConfigurationUpdater(); 633 634 EXPECT_EQ(ExpectedImportCertificatesCallCount(), 635 certificate_importer_->GetAndResetImportCount()); 636} 637 638TEST_P(NetworkConfigurationUpdaterTestWithParam, PolicyChange) { 639 // Ignore the initial updates. 640 EXPECT_CALL(network_config_handler_, SetPolicy(_, _, _, _)).Times(AtLeast(1)); 641 642 CreateNetworkConfigurationUpdater(); 643 MarkPolicyProviderInitialized(); 644 645 Mock::VerifyAndClearExpectations(&network_config_handler_); 646 EXPECT_LE(ExpectedImportCertificatesCallCount(), 647 certificate_importer_->GetAndResetImportCount()); 648 649 // The Updater should update if policy changes. 650 EXPECT_CALL(network_config_handler_, 651 SetPolicy(CurrentONCSource(), 652 _, 653 IsEqualTo(&fake_network_configs_), 654 IsEqualTo(&fake_global_network_config_))); 655 certificate_importer_->SetExpectedONCSource(CurrentONCSource()); 656 certificate_importer_->SetExpectedONCCertificates(fake_certificates_); 657 658 PolicyMap policy; 659 policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, 660 new base::StringValue(kFakeONC), NULL); 661 UpdateProviderPolicy(policy); 662 Mock::VerifyAndClearExpectations(&network_config_handler_); 663 EXPECT_EQ(ExpectedImportCertificatesCallCount(), 664 certificate_importer_->GetAndResetImportCount()); 665 666 // Another update is expected if the policy goes away. 667 EXPECT_CALL(network_config_handler_, 668 SetPolicy(CurrentONCSource(), _, IsEmpty(), IsEmpty())); 669 certificate_importer_->SetExpectedONCCertificates(base::ListValue()); 670 671 policy.Erase(GetParam()); 672 UpdateProviderPolicy(policy); 673 EXPECT_EQ(ExpectedImportCertificatesCallCount(), 674 certificate_importer_->GetAndResetImportCount()); 675} 676 677INSTANTIATE_TEST_CASE_P(NetworkConfigurationUpdaterTestWithParamInstance, 678 NetworkConfigurationUpdaterTestWithParam, 679 testing::Values(key::kDeviceOpenNetworkConfiguration, 680 key::kOpenNetworkConfiguration)); 681 682} // namespace policy 683