Home | History | Annotate | Download | only in login 
      1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chrome/browser/chromeos/login/signed_settings.h"
      6 
      7 #include "base/file_util.h"
      8 #include "base/logging.h"
      9 #include "base/memory/scoped_temp_dir.h"
     10 #include "base/stringprintf.h"
     11 #include "chrome/browser/chromeos/cros/cros_library.h"
     12 #include "chrome/browser/chromeos/cros/mock_library_loader.h"
     13 #include "chrome/browser/chromeos/cros/mock_login_library.h"
     14 #include "chrome/browser/chromeos/cros_settings_names.h"
     15 #include "chrome/browser/chromeos/login/mock_owner_key_utils.h"
     16 #include "chrome/browser/chromeos/login/mock_ownership_service.h"
     17 #include "chrome/browser/chromeos/login/owner_manager_unittest.h"
     18 #include "chrome/browser/policy/proto/chrome_device_policy.pb.h"
     19 #include "chrome/browser/policy/proto/device_management_backend.pb.h"
     20 #include "chrome/test/thread_test_helper.h"
     21 #include "content/browser/browser_thread.h"
     22 #include "crypto/rsa_private_key.h"
     23 #include "testing/gmock/include/gmock/gmock.h"
     24 #include "testing/gtest/include/gtest/gtest.h"
     25 
     26 using ::testing::A;
     27 using ::testing::AnyNumber;
     28 using ::testing::InvokeArgument;
     29 using ::testing::Return;
     30 using ::testing::ReturnRef;
     31 using ::testing::SaveArg;
     32 using ::testing::StrEq;
     33 using ::testing::WithArg;
     34 using ::testing::_;
     35 using google::protobuf::RepeatedPtrField;
     36 
     37 namespace em = enterprise_management;
     38 namespace chromeos {
     39 
     40 namespace {
     41 template <class T>
     42 class DummyDelegate : public SignedSettings::Delegate<T> {
     43  public:
     44   explicit DummyDelegate(T to_expect)
     45       : expect_success_(false),
     46         expected_failure_(SignedSettings::SUCCESS),
     47         expected_(to_expect),
     48         run_(false) {}
     49   virtual ~DummyDelegate() { EXPECT_TRUE(run_); }
     50   virtual void OnSettingsOpCompleted(SignedSettings::ReturnCode code,
     51                                      T value) {
     52     run_ = true;
     53     if (expect_success_)
     54       compare_expected(value);
     55     EXPECT_EQ(expected_failure_, code);
     56   }
     57   virtual void expect_success() {
     58     expect_success_ = true;
     59     expected_failure_ = SignedSettings::SUCCESS;
     60   }
     61   virtual void expect_failure(SignedSettings::ReturnCode code) {
     62     expect_success_ = false;
     63     expected_failure_ = code;
     64   }
     65 
     66  protected:
     67   bool expect_success_;
     68   SignedSettings::ReturnCode expected_failure_;
     69   T expected_;
     70   bool run_;
     71   virtual void compare_expected(T to_compare) = 0;
     72 };
     73 
     74 template <class T>
     75 class NormalDelegate : public DummyDelegate<T> {
     76  public:
     77   explicit NormalDelegate(T to_expect) : DummyDelegate<T>(to_expect) {}
     78   virtual ~NormalDelegate() {}
     79  protected:
     80   virtual void compare_expected(T to_compare) {
     81     EXPECT_EQ(this->expected_, to_compare);  // without this-> this won't build.
     82   }
     83 };
     84 
     85 class ProtoDelegate : public DummyDelegate<const em::PolicyFetchResponse&> {
     86  public:
     87   explicit ProtoDelegate(const em::PolicyFetchResponse& e)
     88       : DummyDelegate<const em::PolicyFetchResponse&>(e) {
     89   }
     90   virtual ~ProtoDelegate() {}
     91  protected:
     92   virtual void compare_expected(const em::PolicyFetchResponse& to_compare) {
     93     std::string ex_string, comp_string;
     94     EXPECT_TRUE(expected_.SerializeToString(&ex_string));
     95     EXPECT_TRUE(to_compare.SerializeToString(&comp_string));
     96     EXPECT_EQ(ex_string, comp_string);
     97   }
     98 };
     99 
    100 }  // anonymous namespace
    101 
    102 class SignedSettingsTest : public ::testing::Test {
    103  public:
    104   SignedSettingsTest()
    105       : fake_email_("fakey (at) example.com"),
    106         fake_domain_("*@example.com"),
    107         fake_prop_(kAccountsPrefAllowGuest),
    108         fake_value_("false"),
    109         message_loop_(MessageLoop::TYPE_UI),
    110         ui_thread_(BrowserThread::UI, &message_loop_),
    111         file_thread_(BrowserThread::FILE),
    112         mock_(new MockKeyUtils),
    113         injector_(mock_) /* injector_ takes ownership of mock_ */ {
    114   }
    115 
    116   virtual ~SignedSettingsTest() {}
    117 
    118   virtual void SetUp() {
    119     file_thread_.Start();
    120   }
    121 
    122   virtual void TearDown() {
    123     OwnerKeyUtils::set_factory(NULL);
    124   }
    125 
    126   void mock_service(SignedSettings* s, MockOwnershipService* m) {
    127     s->set_service(m);
    128   }
    129 
    130   em::PolicyData BuildPolicyData(std::vector<std::string> whitelist) {
    131     em::PolicyData to_return;
    132     em::ChromeDeviceSettingsProto pol;
    133     em::GuestModeEnabledProto* allow = pol.mutable_guest_mode_enabled();
    134     allow->set_guest_mode_enabled(false);
    135     pol.mutable_device_proxy_settings()->set_proxy_mode("direct");
    136 
    137     if (!whitelist.empty()) {
    138       em::UserWhitelistProto* whitelist_proto = pol.mutable_user_whitelist();
    139       for (std::vector<std::string>::const_iterator it = whitelist.begin();
    140            it != whitelist.end();
    141            ++it) {
    142         whitelist_proto->add_user_whitelist(*it);
    143       }
    144     }
    145 
    146     to_return.set_policy_type(SignedSettings::kDevicePolicyType);
    147     to_return.set_policy_value(pol.SerializeAsString());
    148     return to_return;
    149   }
    150 
    151   void SetAllowNewUsers(bool desired, em::PolicyData* poldata) {
    152     em::ChromeDeviceSettingsProto pol;
    153     pol.ParseFromString(poldata->policy_value());
    154     em::AllowNewUsersProto* allow = pol.mutable_allow_new_users();
    155     allow->set_allow_new_users(desired);
    156     poldata->set_policy_value(pol.SerializeAsString());
    157   }
    158 
    159   bool CheckWhitelist(const std::string& email, const em::PolicyData& poldata) {
    160     if (!poldata.has_policy_value())
    161       return false;
    162     em::ChromeDeviceSettingsProto pol;
    163     pol.ParseFromString(poldata.policy_value());
    164     if (!pol.has_user_whitelist())
    165       return false;
    166 
    167     const RepeatedPtrField<std::string>& whitelist =
    168         pol.user_whitelist().user_whitelist();
    169     for (RepeatedPtrField<std::string>::const_iterator it = whitelist.begin();
    170          it != whitelist.end();
    171          ++it) {
    172       if (email == *it)
    173         return true;
    174     }
    175     return false;
    176   }
    177 
    178   void ExpectWhitelistOp(SignedSettings* s,
    179                          em::PolicyData* fake_pol,
    180                          em::PolicyData* out_pol) {
    181     mock_service(s, &m_);
    182     EXPECT_CALL(m_, StartSigningAttempt(_, _))
    183         .Times(1);
    184     EXPECT_CALL(m_, has_cached_policy())
    185         .WillOnce(Return(true));
    186     EXPECT_CALL(m_, cached_policy())
    187         .WillOnce(ReturnRef(*fake_pol));
    188     EXPECT_CALL(m_, set_cached_policy(A<const em::PolicyData&>()))
    189         .WillOnce(SaveArg<0>(out_pol));
    190   }
    191 
    192   void FailingStorePropertyOp(const OwnerManager::KeyOpCode return_code) {
    193     NormalDelegate<bool> d(false);
    194     scoped_refptr<SignedSettings> s(
    195         SignedSettings::CreateStorePropertyOp(fake_prop_, fake_value_, &d));
    196     d.expect_failure(SignedSettings::MapKeyOpCode(return_code));
    197 
    198     mock_service(s.get(), &m_);
    199     EXPECT_CALL(m_, StartSigningAttempt(_, _))
    200         .Times(1);
    201     EXPECT_CALL(m_, GetStatus(_))
    202         .WillOnce(Return(OwnershipService::OWNERSHIP_TAKEN));
    203     EXPECT_CALL(m_, has_cached_policy())
    204         .WillOnce(Return(true));
    205     em::PolicyData fake_pol;
    206     EXPECT_CALL(m_, cached_policy())
    207         .WillOnce(ReturnRef(fake_pol));
    208 
    209     s->Execute();
    210     s->OnKeyOpComplete(return_code, std::vector<uint8>());
    211     message_loop_.RunAllPending();
    212   }
    213 
    214   void FailingStorePolicyOp(const OwnerManager::KeyOpCode return_code) {
    215     NormalDelegate<bool> d(false);
    216     d.expect_failure(SignedSettings::MapKeyOpCode(return_code));
    217 
    218     em::PolicyFetchResponse fake_policy;
    219     fake_policy.set_policy_data(fake_prop_);
    220     std::string serialized;
    221     ASSERT_TRUE(fake_policy.SerializeToString(&serialized));
    222 
    223     scoped_refptr<SignedSettings> s(
    224         SignedSettings::CreateStorePolicyOp(&fake_policy, &d));
    225 
    226     mock_service(s.get(), &m_);
    227     EXPECT_CALL(m_, StartSigningAttempt(StrEq(fake_prop_), _))
    228         .Times(1);
    229 
    230     s->Execute();
    231     s->OnKeyOpComplete(return_code, std::vector<uint8>());
    232     message_loop_.RunAllPending();
    233   }
    234 
    235   MockLoginLibrary* MockLoginLib() {
    236     chromeos::CrosLibrary::TestApi* test_api =
    237         chromeos::CrosLibrary::Get()->GetTestApi();
    238 
    239     // Mocks, ownership transferred to CrosLibrary class on creation.
    240     MockLoginLibrary* mock_library;
    241     MockLibraryLoader* loader;
    242 
    243     loader = new MockLibraryLoader();
    244     ON_CALL(*loader, Load(_))
    245         .WillByDefault(Return(true));
    246     EXPECT_CALL(*loader, Load(_))
    247         .Times(AnyNumber());
    248 
    249     test_api->SetLibraryLoader(loader, true);
    250 
    251     mock_library = new MockLoginLibrary();
    252     test_api->SetLoginLibrary(mock_library, true);
    253     return mock_library;
    254   }
    255 
    256   void UnMockLoginLib() {
    257     // Prevent bogus gMock leak check from firing.
    258     chromeos::CrosLibrary::TestApi* test_api =
    259         chromeos::CrosLibrary::Get()->GetTestApi();
    260     test_api->SetLibraryLoader(NULL, false);
    261     test_api->SetLoginLibrary(NULL, false);
    262   }
    263 
    264   em::PolicyFetchResponse BuildProto(const std::string& data,
    265                                      const std::string& sig,
    266                                      std::string* out_serialized) {
    267     em::PolicyFetchResponse fake_policy;
    268     if (!data.empty())
    269       fake_policy.set_policy_data(data);
    270     if (!sig.empty())
    271       fake_policy.set_policy_data_signature(sig);
    272     EXPECT_TRUE(fake_policy.SerializeToString(out_serialized));
    273     return fake_policy;
    274   }
    275 
    276   void DoRetrieveProperty(const std::string& name,
    277                           const std::string& value,
    278                           em::PolicyData* fake_pol) {
    279     NormalDelegate<std::string> d(value);
    280     d.expect_success();
    281     scoped_refptr<SignedSettings> s(
    282         SignedSettings::CreateRetrievePropertyOp(name, &d));
    283     mock_service(s.get(), &m_);
    284     EXPECT_CALL(m_, GetStatus(_))
    285         .WillOnce(Return(OwnershipService::OWNERSHIP_TAKEN));
    286     EXPECT_CALL(m_, has_cached_policy())
    287         .WillOnce(Return(true));
    288 
    289     EXPECT_CALL(m_, cached_policy())
    290         .WillOnce(ReturnRef(*fake_pol));
    291 
    292     s->Execute();
    293     message_loop_.RunAllPending();
    294   }
    295 
    296   const std::string fake_email_;
    297   const std::string fake_domain_;
    298   const std::string fake_prop_;
    299   const std::string fake_value_;
    300   MockOwnershipService m_;
    301 
    302   ScopedTempDir tmpdir_;
    303   FilePath tmpfile_;
    304 
    305   MessageLoop message_loop_;
    306   BrowserThread ui_thread_;
    307   BrowserThread file_thread_;
    308 
    309   std::vector<uint8> fake_public_key_;
    310   scoped_ptr<crypto::RSAPrivateKey> fake_private_key_;
    311 
    312   MockKeyUtils* mock_;
    313   MockInjector injector_;
    314 
    315   ScopedStubCrosEnabler stub_cros_enabler_;
    316 };
    317 
    318 TEST_F(SignedSettingsTest, CheckWhitelist) {
    319   NormalDelegate<bool> d(true);
    320   d.expect_success();
    321   scoped_refptr<SignedSettings> s(
    322       SignedSettings::CreateCheckWhitelistOp(fake_email_, &d));
    323 
    324   mock_service(s.get(), &m_);
    325   EXPECT_CALL(m_, has_cached_policy())
    326       .WillOnce(Return(true));
    327 
    328   std::vector<std::string> whitelist(1, fake_email_);
    329   whitelist.push_back(fake_email_ + "m");
    330   em::PolicyData fake_pol = BuildPolicyData(whitelist);
    331   EXPECT_CALL(m_, cached_policy())
    332       .WillOnce(ReturnRef(fake_pol));
    333 
    334   s->Execute();
    335   message_loop_.RunAllPending();
    336 }
    337 
    338 TEST_F(SignedSettingsTest, CheckWhitelistWildcards) {
    339   NormalDelegate<bool> d(true);
    340   d.expect_success();
    341   scoped_refptr<SignedSettings> s(
    342       SignedSettings::CreateCheckWhitelistOp(fake_email_, &d));
    343 
    344   mock_service(s.get(), &m_);
    345   EXPECT_CALL(m_, has_cached_policy())
    346       .WillOnce(Return(true));
    347 
    348   std::vector<std::string> whitelist(1, fake_domain_);
    349   whitelist.push_back(fake_email_ + "m");
    350   em::PolicyData fake_pol = BuildPolicyData(whitelist);
    351   EXPECT_CALL(m_, cached_policy())
    352       .WillOnce(ReturnRef(fake_pol))
    353       .WillOnce(ReturnRef(fake_pol));
    354 
    355   s->Execute();
    356   message_loop_.RunAllPending();
    357 }
    358 
    359 TEST_F(SignedSettingsTest, CheckWhitelistNotFound) {
    360   NormalDelegate<bool> d(true);
    361   scoped_refptr<SignedSettings> s(
    362       SignedSettings::CreateCheckWhitelistOp(fake_email_, &d));
    363   d.expect_failure(SignedSettings::NOT_FOUND);
    364 
    365   mock_service(s.get(), &m_);
    366   EXPECT_CALL(m_, has_cached_policy())
    367       .WillOnce(Return(true));
    368 
    369   std::vector<std::string> whitelist(1, fake_email_ + "m");
    370   em::PolicyData fake_pol = BuildPolicyData(whitelist);
    371   EXPECT_CALL(m_, cached_policy())
    372       .WillOnce(ReturnRef(fake_pol))
    373       .WillOnce(ReturnRef(fake_pol));
    374 
    375   s->Execute();
    376   message_loop_.RunAllPending();
    377 }
    378 
    379 TEST_F(SignedSettingsTest, Whitelist) {
    380   NormalDelegate<bool> d(true);
    381   d.expect_success();
    382   scoped_refptr<SignedSettings> s(
    383       SignedSettings::CreateWhitelistOp(fake_email_, true, &d));
    384   em::PolicyData in_pol = BuildPolicyData(std::vector<std::string>());
    385   em::PolicyData out_pol;
    386   ExpectWhitelistOp(s.get(), &in_pol, &out_pol);
    387 
    388   s->Execute();
    389   s->OnKeyOpComplete(OwnerManager::SUCCESS, std::vector<uint8>());
    390   message_loop_.RunAllPending();
    391 
    392   ASSERT_TRUE(CheckWhitelist(fake_email_, out_pol));
    393 }
    394 
    395 TEST_F(SignedSettingsTest, AddToExistingWhitelist) {
    396   NormalDelegate<bool> d(true);
    397   d.expect_success();
    398   scoped_refptr<SignedSettings> s(
    399       SignedSettings::CreateWhitelistOp(fake_email_, true, &d));
    400   em::PolicyData in_pol =
    401       BuildPolicyData(std::vector<std::string>(1, fake_domain_));
    402   em::PolicyData out_pol;
    403   ExpectWhitelistOp(s.get(), &in_pol, &out_pol);
    404 
    405   s->Execute();
    406   s->OnKeyOpComplete(OwnerManager::SUCCESS, std::vector<uint8>());
    407   message_loop_.RunAllPending();
    408 
    409   ASSERT_TRUE(CheckWhitelist(fake_email_, out_pol));
    410 }
    411 
    412 TEST_F(SignedSettingsTest, Unwhitelist) {
    413   NormalDelegate<bool> d(true);
    414   d.expect_success();
    415   scoped_refptr<SignedSettings> s(
    416       SignedSettings::CreateWhitelistOp(fake_email_, false, &d));
    417   em::PolicyData in_pol =
    418       BuildPolicyData(std::vector<std::string>(1, fake_email_));
    419   em::PolicyData out_pol;
    420   ExpectWhitelistOp(s.get(), &in_pol, &out_pol);
    421 
    422   s->Execute();
    423   s->OnKeyOpComplete(OwnerManager::SUCCESS, std::vector<uint8>());
    424   message_loop_.RunAllPending();
    425 
    426   ASSERT_FALSE(CheckWhitelist(fake_email_, out_pol));
    427 }
    428 
    429 TEST_F(SignedSettingsTest, RemoveFromExistingWhitelist) {
    430   NormalDelegate<bool> d(true);
    431   d.expect_success();
    432   scoped_refptr<SignedSettings> s(
    433       SignedSettings::CreateWhitelistOp(fake_email_, false, &d));
    434   std::vector<std::string> whitelist(1, fake_domain_);
    435   whitelist.push_back(fake_email_);
    436   whitelist.push_back(fake_email_ + "m");
    437   em::PolicyData in_pol = BuildPolicyData(whitelist);
    438   em::PolicyData out_pol;
    439   ExpectWhitelistOp(s.get(), &in_pol, &out_pol);
    440 
    441   s->Execute();
    442   s->OnKeyOpComplete(OwnerManager::SUCCESS, std::vector<uint8>());
    443   message_loop_.RunAllPending();
    444 
    445   ASSERT_FALSE(CheckWhitelist(fake_email_, out_pol));
    446 }
    447 
    448 TEST_F(SignedSettingsTest, StoreProperty) {
    449   NormalDelegate<bool> d(true);
    450   d.expect_success();
    451   scoped_refptr<SignedSettings> s(
    452       SignedSettings::CreateStorePropertyOp(fake_prop_, fake_value_, &d));
    453 
    454   mock_service(s.get(), &m_);
    455   EXPECT_CALL(m_, StartSigningAttempt(_, _))
    456       .Times(1);
    457   EXPECT_CALL(m_, GetStatus(_))
    458       .WillOnce(Return(OwnershipService::OWNERSHIP_TAKEN));
    459   EXPECT_CALL(m_, has_cached_policy())
    460       .WillOnce(Return(true));
    461   em::PolicyData in_pol =
    462       BuildPolicyData(std::vector<std::string>(1, fake_email_));
    463   EXPECT_CALL(m_, cached_policy())
    464       .WillOnce(ReturnRef(in_pol));
    465   em::PolicyData out_pol;
    466   EXPECT_CALL(m_, set_cached_policy(A<const em::PolicyData&>()))
    467       .WillOnce(SaveArg<0>(&out_pol));
    468 
    469   s->Execute();
    470   s->OnKeyOpComplete(OwnerManager::SUCCESS, std::vector<uint8>());
    471   message_loop_.RunAllPending();
    472 
    473   ASSERT_TRUE(out_pol.has_policy_value());
    474   em::ChromeDeviceSettingsProto pol;
    475   pol.ParseFromString(out_pol.policy_value());
    476   ASSERT_TRUE(pol.has_guest_mode_enabled());
    477   ASSERT_TRUE(pol.guest_mode_enabled().has_guest_mode_enabled());
    478   ASSERT_FALSE(pol.guest_mode_enabled().guest_mode_enabled());
    479 }
    480 
    481 TEST_F(SignedSettingsTest, StorePropertyNoKey) {
    482   FailingStorePropertyOp(OwnerManager::KEY_UNAVAILABLE);
    483 }
    484 
    485 TEST_F(SignedSettingsTest, StorePropertyFailed) {
    486   FailingStorePropertyOp(OwnerManager::OPERATION_FAILED);
    487 }
    488 
    489 TEST_F(SignedSettingsTest, RetrieveProperty) {
    490   em::PolicyData fake_pol = BuildPolicyData(std::vector<std::string>());
    491   DoRetrieveProperty(fake_prop_, fake_value_, &fake_pol);
    492 }
    493 
    494 TEST_F(SignedSettingsTest, RetrieveOwnerProperty) {
    495   em::PolicyData fake_pol = BuildPolicyData(std::vector<std::string>());
    496   fake_pol.set_username(fake_email_);
    497   DoRetrieveProperty(kDeviceOwner, fake_email_, &fake_pol);
    498 }
    499 
    500 TEST_F(SignedSettingsTest, ExplicitlyAllowNewUsers) {
    501   em::PolicyData fake_pol = BuildPolicyData(std::vector<std::string>());
    502   SetAllowNewUsers(true, &fake_pol);
    503   DoRetrieveProperty(kAccountsPrefAllowNewUser, "true", &fake_pol);
    504 }
    505 
    506 TEST_F(SignedSettingsTest, ExplicitlyDisallowNewUsers) {
    507   std::vector<std::string> whitelist(1, fake_email_ + "m");
    508   em::PolicyData fake_pol = BuildPolicyData(whitelist);
    509   SetAllowNewUsers(false, &fake_pol);
    510   DoRetrieveProperty(kAccountsPrefAllowNewUser, "false", &fake_pol);
    511 }
    512 
    513 TEST_F(SignedSettingsTest, ImplicitlyDisallowNewUsers) {
    514   std::vector<std::string> whitelist(1, fake_email_ + "m");
    515   em::PolicyData fake_pol = BuildPolicyData(whitelist);
    516   DoRetrieveProperty(kAccountsPrefAllowNewUser, "false", &fake_pol);
    517 }
    518 
    519 TEST_F(SignedSettingsTest, AccidentallyDisallowNewUsers) {
    520   em::PolicyData fake_pol = BuildPolicyData(std::vector<std::string>());
    521   SetAllowNewUsers(false, &fake_pol);
    522   DoRetrieveProperty(kAccountsPrefAllowNewUser, "true", &fake_pol);
    523 }
    524 
    525 TEST_F(SignedSettingsTest, RetrievePropertyNotFound) {
    526   NormalDelegate<std::string> d(fake_value_);
    527   d.expect_failure(SignedSettings::NOT_FOUND);
    528   scoped_refptr<SignedSettings> s(
    529       SignedSettings::CreateRetrievePropertyOp("unknown_prop", &d));
    530   mock_service(s.get(), &m_);
    531   EXPECT_CALL(m_, GetStatus(_))
    532       .WillOnce(Return(OwnershipService::OWNERSHIP_TAKEN));
    533   EXPECT_CALL(m_, has_cached_policy())
    534       .WillOnce(Return(true));
    535 
    536   em::PolicyData fake_pol = BuildPolicyData(std::vector<std::string>());
    537   EXPECT_CALL(m_, cached_policy())
    538       .WillOnce(ReturnRef(fake_pol));
    539 
    540   s->Execute();
    541   message_loop_.RunAllPending();
    542 }
    543 
    544 ACTION_P(Retrieve, s) { (*arg0)((void*)arg1, s.c_str(), s.length()); }
    545 ACTION_P(FinishKeyOp, s) { arg2->OnKeyOpComplete(OwnerManager::SUCCESS, s); }
    546 
    547 TEST_F(SignedSettingsTest, RetrievePolicyToRetrieveProperty) {
    548   NormalDelegate<std::string> d(fake_value_);
    549   d.expect_success();
    550   scoped_refptr<SignedSettings> s(
    551       SignedSettings::CreateRetrievePropertyOp(fake_prop_, &d));
    552 
    553   em::PolicyData fake_pol = BuildPolicyData(std::vector<std::string>());
    554   std::string data = fake_pol.SerializeAsString();
    555   std::string signed_serialized;
    556   em::PolicyFetchResponse signed_policy = BuildProto(data,
    557                                                      fake_value_,
    558                                                      &signed_serialized);
    559   MockLoginLibrary* lib = MockLoginLib();
    560   EXPECT_CALL(*lib, RequestRetrievePolicy(_, _))
    561       .WillOnce(Retrieve(signed_serialized))
    562       .RetiresOnSaturation();
    563 
    564   mock_service(s.get(), &m_);
    565 
    566   EXPECT_CALL(m_, GetStatus(_))
    567       .WillOnce(Return(OwnershipService::OWNERSHIP_TAKEN))
    568       .WillOnce(Return(OwnershipService::OWNERSHIP_TAKEN));
    569   EXPECT_CALL(m_, has_cached_policy())
    570       .WillOnce(Return(false))
    571       .WillOnce(Return(true));
    572   em::PolicyData out_pol;
    573   EXPECT_CALL(m_, set_cached_policy(A<const em::PolicyData&>()))
    574       .WillOnce(SaveArg<0>(&out_pol));
    575   EXPECT_CALL(m_, cached_policy())
    576       .WillOnce(ReturnRef(out_pol));
    577 
    578   std::vector<uint8> fake_sig(fake_value_.c_str(),
    579                               fake_value_.c_str() + fake_value_.length());
    580   EXPECT_CALL(m_, StartVerifyAttempt(data, fake_sig, _))
    581       .WillOnce(FinishKeyOp(fake_sig))
    582       .RetiresOnSaturation();
    583 
    584   s->Execute();
    585   message_loop_.RunAllPending();
    586   UnMockLoginLib();
    587 }
    588 
    589 TEST_F(SignedSettingsTest, SignAndStorePolicy) {
    590   NormalDelegate<bool> d(true);
    591   d.expect_success();
    592 
    593   em::PolicyData in_pol = BuildPolicyData(std::vector<std::string>());
    594   std::string data_serialized = in_pol.SerializeAsString();
    595   std::string serialized;
    596   em::PolicyFetchResponse fake_policy = BuildProto(data_serialized,
    597                                                    std::string(),
    598                                                    &serialized);
    599   scoped_refptr<SignedSettings> s(
    600       SignedSettings::CreateStorePolicyOp(&fake_policy, &d));
    601 
    602   mock_service(s.get(), &m_);
    603   EXPECT_CALL(m_, StartSigningAttempt(StrEq(data_serialized), _))
    604       .Times(1);
    605   em::PolicyData out_pol;
    606   EXPECT_CALL(m_, set_cached_policy(A<const em::PolicyData&>()))
    607       .WillOnce(SaveArg<0>(&out_pol));
    608 
    609   // Ask for signature over unsigned policy.
    610   s->Execute();
    611   message_loop_.RunAllPending();
    612 
    613   // Fake out a successful signing.
    614   std::string signed_serialized;
    615   em::PolicyFetchResponse signed_policy = BuildProto(data_serialized,
    616                                                      fake_value_,
    617                                                      &signed_serialized);
    618   std::vector<uint8> fake_sig(fake_value_.c_str(),
    619                               fake_value_.c_str() + fake_value_.length());
    620 
    621   MockLoginLibrary* lib = MockLoginLib();
    622   EXPECT_CALL(*lib, RequestStorePolicy(StrEq(signed_serialized), _, s.get()))
    623       .WillOnce(InvokeArgument<1>(static_cast<void*>(s.get()), true))
    624       .RetiresOnSaturation();
    625   s->OnKeyOpComplete(OwnerManager::SUCCESS, fake_sig);
    626   message_loop_.RunAllPending();
    627   UnMockLoginLib();
    628 }
    629 
    630 TEST_F(SignedSettingsTest, StoreSignedPolicy) {
    631   NormalDelegate<bool> d(true);
    632   d.expect_success();
    633 
    634   em::PolicyData in_pol = BuildPolicyData(std::vector<std::string>());
    635   std::string serialized = in_pol.SerializeAsString();
    636   std::string signed_serialized;
    637   em::PolicyFetchResponse signed_policy = BuildProto(serialized,
    638                                                      fake_value_,
    639                                                      &signed_serialized);
    640   scoped_refptr<SignedSettings> s(
    641       SignedSettings::CreateStorePolicyOp(&signed_policy, &d));
    642   MockLoginLibrary* lib = MockLoginLib();
    643   EXPECT_CALL(*lib, RequestStorePolicy(StrEq(signed_serialized), _, s.get()))
    644       .WillOnce(InvokeArgument<1>(static_cast<void*>(s.get()), true))
    645       .RetiresOnSaturation();
    646 
    647   mock_service(s.get(), &m_);
    648   em::PolicyData out_pol;
    649   EXPECT_CALL(m_, set_cached_policy(A<const em::PolicyData&>()))
    650       .WillOnce(SaveArg<0>(&out_pol));
    651 
    652   s->Execute();
    653   message_loop_.RunAllPending();
    654   UnMockLoginLib();
    655 }
    656 
    657 TEST_F(SignedSettingsTest, StorePolicyNoKey) {
    658   FailingStorePolicyOp(OwnerManager::KEY_UNAVAILABLE);
    659 }
    660 
    661 TEST_F(SignedSettingsTest, StorePolicyFailed) {
    662   FailingStorePolicyOp(OwnerManager::OPERATION_FAILED);
    663 }
    664 
    665 TEST_F(SignedSettingsTest, StorePolicyNoPolicyData) {
    666   NormalDelegate<bool> d(false);
    667   d.expect_failure(SignedSettings::OPERATION_FAILED);
    668 
    669   std::string serialized;
    670   em::PolicyFetchResponse fake_policy = BuildProto(std::string(),
    671                                                    std::string(),
    672                                                    &serialized);
    673   scoped_refptr<SignedSettings> s(
    674       SignedSettings::CreateStorePolicyOp(&fake_policy, &d));
    675 
    676   s->Execute();
    677   message_loop_.RunAllPending();
    678 }
    679 
    680 TEST_F(SignedSettingsTest, RetrievePolicy) {
    681   em::PolicyData in_pol = BuildPolicyData(std::vector<std::string>());
    682   std::string serialized = in_pol.SerializeAsString();
    683   std::string signed_serialized;
    684   em::PolicyFetchResponse signed_policy = BuildProto(serialized,
    685                                                      fake_value_,
    686                                                      &signed_serialized);
    687   ProtoDelegate d(signed_policy);
    688   d.expect_success();
    689   scoped_refptr<SignedSettings> s(SignedSettings::CreateRetrievePolicyOp(&d));
    690 
    691   MockLoginLibrary* lib = MockLoginLib();
    692   EXPECT_CALL(*lib, RequestRetrievePolicy(_, s.get()))
    693       .WillOnce(InvokeArgument<0>(static_cast<void*>(s.get()),
    694                                   signed_serialized.c_str(),
    695                                   signed_serialized.length()))
    696       .RetiresOnSaturation();
    697 
    698   mock_service(s.get(), &m_);
    699   std::vector<uint8> fake_sig(fake_value_.c_str(),
    700                               fake_value_.c_str() + fake_value_.length());
    701   EXPECT_CALL(m_, StartVerifyAttempt(serialized, fake_sig, _))
    702       .Times(1);
    703   em::PolicyData out_pol;
    704   EXPECT_CALL(m_, set_cached_policy(A<const em::PolicyData&>()))
    705       .WillOnce(SaveArg<0>(&out_pol));
    706 
    707   s->Execute();
    708   message_loop_.RunAllPending();
    709   UnMockLoginLib();
    710 
    711   s->OnKeyOpComplete(OwnerManager::SUCCESS, std::vector<uint8>());
    712   message_loop_.RunAllPending();
    713 }
    714 
    715 TEST_F(SignedSettingsTest, RetrieveNullPolicy) {
    716   em::PolicyFetchResponse policy;
    717   ProtoDelegate d(policy);
    718   d.expect_failure(SignedSettings::NOT_FOUND);
    719   scoped_refptr<SignedSettings> s(SignedSettings::CreateRetrievePolicyOp(&d));
    720 
    721   MockLoginLibrary* lib = MockLoginLib();
    722   EXPECT_CALL(*lib, RequestRetrievePolicy(_, s.get()))
    723       .WillOnce(InvokeArgument<0>(static_cast<void*>(s.get()),
    724                                   static_cast<const char*>(NULL),
    725                                   0))
    726       .RetiresOnSaturation();
    727 
    728   s->Execute();
    729   message_loop_.RunAllPending();
    730   UnMockLoginLib();
    731 }
    732 
    733 TEST_F(SignedSettingsTest, RetrieveEmptyPolicy) {
    734   std::string serialized;
    735   em::PolicyFetchResponse policy = BuildProto("", "", &serialized);
    736   ProtoDelegate d(policy);
    737   d.expect_failure(SignedSettings::NOT_FOUND);
    738   scoped_refptr<SignedSettings> s(SignedSettings::CreateRetrievePolicyOp(&d));
    739 
    740   MockLoginLibrary* lib = MockLoginLib();
    741   EXPECT_CALL(*lib, RequestRetrievePolicy(_, s.get()))
    742       .WillOnce(InvokeArgument<0>(static_cast<void*>(s.get()), "", 0))
    743       .RetiresOnSaturation();
    744 
    745   s->Execute();
    746   message_loop_.RunAllPending();
    747   UnMockLoginLib();
    748 }
    749 
    750 TEST_F(SignedSettingsTest, RetrieveUnsignedPolicy) {
    751   std::string serialized;
    752   em::PolicyFetchResponse policy = BuildProto(fake_prop_,
    753                                               std::string(),
    754                                               &serialized);
    755   ProtoDelegate d(policy);
    756   d.expect_failure(SignedSettings::BAD_SIGNATURE);
    757   scoped_refptr<SignedSettings> s(SignedSettings::CreateRetrievePolicyOp(&d));
    758 
    759   MockLoginLibrary* lib = MockLoginLib();
    760   EXPECT_CALL(*lib, RequestRetrievePolicy(_, s.get()))
    761       .WillOnce(InvokeArgument<0>(static_cast<void*>(s.get()),
    762                                   serialized.c_str(),
    763                                   serialized.length()))
    764       .RetiresOnSaturation();
    765 
    766   s->Execute();
    767   message_loop_.RunAllPending();
    768   UnMockLoginLib();
    769 }
    770 
    771 TEST_F(SignedSettingsTest, RetrieveMalsignedPolicy) {
    772   std::string signed_serialized;
    773   em::PolicyFetchResponse signed_policy = BuildProto(fake_prop_,
    774                                                      fake_value_,
    775                                                      &signed_serialized);
    776   ProtoDelegate d(signed_policy);
    777   d.expect_failure(SignedSettings::BAD_SIGNATURE);
    778   scoped_refptr<SignedSettings> s(SignedSettings::CreateRetrievePolicyOp(&d));
    779 
    780   MockLoginLibrary* lib = MockLoginLib();
    781   EXPECT_CALL(*lib, RequestRetrievePolicy(_, s.get()))
    782       .WillOnce(InvokeArgument<0>(static_cast<void*>(s.get()),
    783                                   signed_serialized.c_str(),
    784                                   signed_serialized.length()))
    785       .RetiresOnSaturation();
    786 
    787   mock_service(s.get(), &m_);
    788   std::vector<uint8> fake_sig(fake_value_.c_str(),
    789                               fake_value_.c_str() + fake_value_.length());
    790   EXPECT_CALL(m_, StartVerifyAttempt(fake_prop_, fake_sig, _))
    791       .Times(1);
    792 
    793   s->Execute();
    794   message_loop_.RunAllPending();
    795   UnMockLoginLib();
    796 
    797   s->OnKeyOpComplete(OwnerManager::OPERATION_FAILED, std::vector<uint8>());
    798   message_loop_.RunAllPending();
    799 }
    800 
    801 }  // namespace chromeos
    802