Home | History | Annotate | Download | only in cloud 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "base/callback.h"
      6 #include "base/command_line.h"
      7 #include "base/files/file_path.h"
      8 #include "base/files/file_util.h"
      9 #include "base/files/scoped_temp_dir.h"
     10 #include "base/memory/scoped_ptr.h"
     11 #include "base/path_service.h"
     12 #include "base/prefs/pref_service.h"
     13 #include "base/run_loop.h"
     14 #include "base/strings/stringprintf.h"
     15 #include "base/time/time.h"
     16 #include "chrome/browser/browser_process.h"
     17 #include "chrome/browser/chrome_notification_types.h"
     18 #include "chrome/browser/invalidation/fake_invalidation_service.h"
     19 #include "chrome/browser/invalidation/profile_invalidation_provider_factory.h"
     20 #include "chrome/browser/policy/profile_policy_connector.h"
     21 #include "chrome/browser/policy/profile_policy_connector_factory.h"
     22 #include "chrome/browser/policy/test/local_policy_test_server.h"
     23 #include "chrome/browser/profiles/profile.h"
     24 #include "chrome/browser/ui/browser.h"
     25 #include "chrome/test/base/in_process_browser_test.h"
     26 #include "components/invalidation/invalidation.h"
     27 #include "components/invalidation/invalidation_service.h"
     28 #include "components/invalidation/profile_invalidation_provider.h"
     29 #include "components/keyed_service/core/keyed_service.h"
     30 #include "components/policy/core/browser/browser_policy_connector.h"
     31 #include "components/policy/core/common/cloud/cloud_policy_client.h"
     32 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
     33 #include "components/policy/core/common/cloud/mock_cloud_policy_client.h"
     34 #include "components/policy/core/common/external_data_fetcher.h"
     35 #include "components/policy/core/common/policy_map.h"
     36 #include "components/policy/core/common/policy_service.h"
     37 #include "components/policy/core/common/policy_switches.h"
     38 #include "components/policy/core/common/policy_test_utils.h"
     39 #include "content/public/browser/notification_service.h"
     40 #include "content/public/browser/notification_source.h"
     41 #include "content/public/test/test_utils.h"
     42 #include "net/url_request/url_request_context_getter.h"
     43 #include "policy/policy_constants.h"
     44 #include "policy/proto/chrome_settings.pb.h"
     45 #include "policy/proto/cloud_policy.pb.h"
     46 #include "testing/gmock/include/gmock/gmock.h"
     47 #include "testing/gtest/include/gtest/gtest.h"
     48 #include "url/gurl.h"
     49 
     50 #if defined(OS_CHROMEOS)
     51 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h"
     52 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.h"
     53 #include "chromeos/chromeos_paths.h"
     54 #include "chromeos/dbus/cryptohome_client.h"
     55 #include "chromeos/login/user_names.h"
     56 #else
     57 #include "chrome/browser/policy/cloud/user_cloud_policy_manager_factory.h"
     58 #include "chrome/browser/signin/signin_manager_factory.h"
     59 #include "components/policy/core/common/cloud/user_cloud_policy_manager.h"
     60 #include "components/signin/core/browser/signin_manager.h"
     61 #endif
     62 
     63 using testing::AnyNumber;
     64 using testing::InvokeWithoutArgs;
     65 using testing::Mock;
     66 using testing::Return;
     67 using testing::_;
     68 
     69 namespace content {
     70 class BrowserContext;
     71 }
     72 
     73 namespace em = enterprise_management;
     74 
     75 namespace policy {
     76 
     77 namespace {
     78 
     79 KeyedService* BuildFakeProfileInvalidationProvider(
     80     content::BrowserContext* context) {
     81   return new invalidation::ProfileInvalidationProvider(
     82       scoped_ptr<invalidation::InvalidationService>(
     83           new invalidation::FakeInvalidationService));
     84 }
     85 
     86 const char* GetTestUser() {
     87 #if defined(OS_CHROMEOS)
     88   return chromeos::login::kStubUser;
     89 #else
     90   return "user (at) example.com";
     91 #endif
     92 }
     93 
     94 std::string GetEmptyPolicy() {
     95   const char kEmptyPolicy[] =
     96       "{"
     97       "  \"%s\": {"
     98       "    \"mandatory\": {},"
     99       "    \"recommended\": {}"
    100       "  },"
    101       "  \"managed_users\": [ \"*\" ],"
    102       "  \"policy_user\": \"%s\","
    103       "  \"current_key_index\": 0"
    104       "}";
    105 
    106   return base::StringPrintf(
    107       kEmptyPolicy, dm_protocol::kChromeUserPolicyType, GetTestUser());
    108 }
    109 
    110 std::string GetTestPolicy(const char* homepage, int key_version) {
    111   const char kTestPolicy[] =
    112       "{"
    113       "  \"%s\": {"
    114       "    \"mandatory\": {"
    115       "      \"ShowHomeButton\": true,"
    116       "      \"RestoreOnStartup\": 4,"
    117       "      \"URLBlacklist\": [ \"dev.chromium.org\", \"youtube.com\" ],"
    118       "      \"MaxInvalidationFetchDelay\": 1000"
    119       "    },"
    120       "    \"recommended\": {"
    121       "      \"HomepageLocation\": \"%s\""
    122       "    }"
    123       "  },"
    124       "  \"managed_users\": [ \"*\" ],"
    125       "  \"policy_user\": \"%s\","
    126       "  \"current_key_index\": %d,"
    127       "  \"invalidation_source\": 16,"
    128       "  \"invalidation_name\": \"test_policy\""
    129       "}";
    130 
    131   return base::StringPrintf(kTestPolicy,
    132                             dm_protocol::kChromeUserPolicyType,
    133                             homepage,
    134                             GetTestUser(),
    135                             key_version);
    136 }
    137 
    138 void GetExpectedDefaultPolicy(PolicyMap* policy_map) {
    139 #if defined(OS_CHROMEOS)
    140   policy_map->Set(key::kChromeOsMultiProfileUserBehavior,
    141                   POLICY_LEVEL_MANDATORY,
    142                   POLICY_SCOPE_USER,
    143                   new base::StringValue("primary-only"),
    144                   NULL);
    145   policy_map->Set(key::kEasyUnlockAllowed,
    146                   POLICY_LEVEL_MANDATORY,
    147                   POLICY_SCOPE_USER,
    148                   new base::FundamentalValue(false),
    149                   NULL);
    150 #endif
    151 }
    152 
    153 void GetExpectedTestPolicy(PolicyMap* expected, const char* homepage) {
    154   expected->Set(key::kShowHomeButton,
    155                 POLICY_LEVEL_MANDATORY,
    156                 POLICY_SCOPE_USER,
    157                 new base::FundamentalValue(true),
    158                 NULL);
    159   expected->Set(key::kRestoreOnStartup,
    160                 POLICY_LEVEL_MANDATORY,
    161                 POLICY_SCOPE_USER,
    162                 new base::FundamentalValue(4),
    163                 NULL);
    164   base::ListValue list;
    165   list.AppendString("dev.chromium.org");
    166   list.AppendString("youtube.com");
    167   expected->Set(
    168       key::kURLBlacklist, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
    169       list.DeepCopy(), NULL);
    170   expected->Set(key::kMaxInvalidationFetchDelay,
    171                 POLICY_LEVEL_MANDATORY,
    172                 POLICY_SCOPE_USER,
    173                 new base::FundamentalValue(1000),
    174                 NULL);
    175   expected->Set(key::kHomepageLocation,
    176                 POLICY_LEVEL_RECOMMENDED,
    177                 POLICY_SCOPE_USER,
    178                 new base::StringValue(homepage),
    179                 NULL);
    180 #if defined(OS_CHROMEOS)
    181   expected->Set(key::kChromeOsMultiProfileUserBehavior,
    182                 POLICY_LEVEL_MANDATORY,
    183                 POLICY_SCOPE_USER,
    184                 new base::StringValue("primary-only"),
    185                 NULL);
    186   expected->Set(key::kEasyUnlockAllowed,
    187                 POLICY_LEVEL_MANDATORY,
    188                 POLICY_SCOPE_USER,
    189                 new base::FundamentalValue(false),
    190                 NULL);
    191 #endif
    192 }
    193 
    194 }  // namespace
    195 
    196 // Tests the cloud policy stack(s).
    197 class CloudPolicyTest : public InProcessBrowserTest,
    198                         public PolicyService::Observer {
    199  protected:
    200   CloudPolicyTest() {}
    201   virtual ~CloudPolicyTest() {}
    202 
    203   virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
    204     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
    205     ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetEmptyPolicy()));
    206 
    207     test_server_.reset(new LocalPolicyTestServer(policy_file_path()));
    208     ASSERT_TRUE(test_server_->Start());
    209 
    210     std::string url = test_server_->GetServiceURL().spec();
    211 
    212     CommandLine* command_line = CommandLine::ForCurrentProcess();
    213     command_line->AppendSwitchASCII(switches::kDeviceManagementUrl, url);
    214 
    215     invalidation::ProfileInvalidationProviderFactory::GetInstance()->
    216         RegisterTestingFactory(BuildFakeProfileInvalidationProvider);
    217   }
    218 
    219   virtual void SetUpOnMainThread() OVERRIDE {
    220     ASSERT_TRUE(PolicyServiceIsEmpty(g_browser_process->policy_service()))
    221         << "Pre-existing policies in this machine will make this test fail.";
    222 
    223     BrowserPolicyConnector* connector =
    224         g_browser_process->browser_policy_connector();
    225     connector->ScheduleServiceInitialization(0);
    226 
    227 #if defined(OS_CHROMEOS)
    228     UserCloudPolicyManagerChromeOS* policy_manager =
    229         UserCloudPolicyManagerFactoryChromeOS::GetForProfile(
    230             browser()->profile());
    231     ASSERT_TRUE(policy_manager);
    232 #else
    233     // Mock a signed-in user. This is used by the UserCloudPolicyStore to pass
    234     // the username to the UserCloudPolicyValidator.
    235     SigninManager* signin_manager =
    236         SigninManagerFactory::GetForProfile(browser()->profile());
    237     ASSERT_TRUE(signin_manager);
    238     signin_manager->SetAuthenticatedUsername(GetTestUser());
    239 
    240     UserCloudPolicyManager* policy_manager =
    241         UserCloudPolicyManagerFactory::GetForBrowserContext(
    242             browser()->profile());
    243     ASSERT_TRUE(policy_manager);
    244     policy_manager->Connect(
    245         g_browser_process->local_state(),
    246         g_browser_process->system_request_context(),
    247         UserCloudPolicyManager::CreateCloudPolicyClient(
    248             connector->device_management_service(),
    249             g_browser_process->system_request_context()).Pass());
    250 #endif  // defined(OS_CHROMEOS)
    251 
    252     ASSERT_TRUE(policy_manager->core()->client());
    253     base::RunLoop run_loop;
    254     MockCloudPolicyClientObserver observer;
    255     EXPECT_CALL(observer, OnRegistrationStateChanged(_)).WillOnce(
    256         InvokeWithoutArgs(&run_loop, &base::RunLoop::Quit));
    257     policy_manager->core()->client()->AddObserver(&observer);
    258 
    259     // Give a bogus OAuth token to the |policy_manager|. This should make its
    260     // CloudPolicyClient fetch the DMToken.
    261     ASSERT_FALSE(policy_manager->core()->client()->is_registered());
    262     em::DeviceRegisterRequest::Type registration_type =
    263 #if defined(OS_CHROMEOS)
    264         em::DeviceRegisterRequest::USER;
    265 #else
    266         em::DeviceRegisterRequest::BROWSER;
    267 #endif
    268     policy_manager->core()->client()->Register(
    269         registration_type, "bogus", std::string(), false, std::string(),
    270         std::string());
    271     run_loop.Run();
    272     Mock::VerifyAndClearExpectations(&observer);
    273     policy_manager->core()->client()->RemoveObserver(&observer);
    274     EXPECT_TRUE(policy_manager->core()->client()->is_registered());
    275 
    276 #if defined(OS_CHROMEOS)
    277     // Get the path to the user policy key file.
    278     base::FilePath user_policy_key_dir;
    279     ASSERT_TRUE(
    280         PathService::Get(chromeos::DIR_USER_POLICY_KEYS, &user_policy_key_dir));
    281     std::string sanitized_username =
    282         chromeos::CryptohomeClient::GetStubSanitizedUsername(GetTestUser());
    283     user_policy_key_file_ = user_policy_key_dir.AppendASCII(sanitized_username)
    284                                                .AppendASCII("policy.pub");
    285 #endif
    286   }
    287 
    288   PolicyService* GetPolicyService() {
    289     ProfilePolicyConnector* profile_connector =
    290         ProfilePolicyConnectorFactory::GetForProfile(browser()->profile());
    291     return profile_connector->policy_service();
    292   }
    293 
    294   invalidation::FakeInvalidationService* GetInvalidationService() {
    295     return static_cast<invalidation::FakeInvalidationService*>(
    296         static_cast<invalidation::ProfileInvalidationProvider*>(
    297             invalidation::ProfileInvalidationProviderFactory::GetInstance()->
    298                 GetForProfile(browser()->profile()))->GetInvalidationService());
    299   }
    300 
    301   void SetServerPolicy(const std::string& policy) {
    302     int result = base::WriteFile(policy_file_path(), policy.data(),
    303                                  policy.size());
    304     ASSERT_EQ(static_cast<int>(policy.size()), result);
    305   }
    306 
    307   base::FilePath policy_file_path() const {
    308     return temp_dir_.path().AppendASCII("policy.json");
    309   }
    310 
    311   virtual void OnPolicyUpdated(const PolicyNamespace& ns,
    312                                const PolicyMap& previous,
    313                                const PolicyMap& current) OVERRIDE {
    314     if (!on_policy_updated_.is_null()) {
    315       on_policy_updated_.Run();
    316       on_policy_updated_.Reset();
    317     }
    318   }
    319 
    320   virtual void OnPolicyServiceInitialized(PolicyDomain domain) OVERRIDE {}
    321 
    322   base::ScopedTempDir temp_dir_;
    323   scoped_ptr<LocalPolicyTestServer> test_server_;
    324   base::FilePath user_policy_key_file_;
    325   base::Closure on_policy_updated_;
    326 };
    327 
    328 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, FetchPolicy) {
    329   PolicyService* policy_service = GetPolicyService();
    330   {
    331     base::RunLoop run_loop;
    332     // This does the initial fetch and stores the initial key.
    333     policy_service->RefreshPolicies(run_loop.QuitClosure());
    334     run_loop.Run();
    335   }
    336 
    337   PolicyMap default_policy;
    338   GetExpectedDefaultPolicy(&default_policy);
    339   EXPECT_TRUE(default_policy.Equals(policy_service->GetPolicies(
    340       PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))));
    341 
    342   ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("google.com", 0)));
    343   PolicyMap expected;
    344   GetExpectedTestPolicy(&expected, "google.com");
    345   {
    346     base::RunLoop run_loop;
    347     // This fetches the new policies, using the same key.
    348     policy_service->RefreshPolicies(run_loop.QuitClosure());
    349     run_loop.Run();
    350   }
    351   EXPECT_TRUE(expected.Equals(policy_service->GetPolicies(
    352       PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))));
    353 }
    354 
    355 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, InvalidatePolicy) {
    356   PolicyService* policy_service = GetPolicyService();
    357   policy_service->AddObserver(POLICY_DOMAIN_CHROME, this);
    358 
    359   // Perform the initial fetch.
    360   ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("google.com", 0)));
    361   {
    362     base::RunLoop run_loop;
    363     policy_service->RefreshPolicies(run_loop.QuitClosure());
    364     run_loop.Run();
    365   }
    366 
    367   // Update the homepage in the policy and trigger an invalidation.
    368   ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("youtube.com", 0)));
    369   base::TimeDelta now =
    370       base::Time::NowFromSystemTime() - base::Time::UnixEpoch();
    371   GetInvalidationService()->EmitInvalidationForTest(
    372       syncer::Invalidation::Init(
    373           invalidation::ObjectId(16, "test_policy"),
    374           now.InMicroseconds() /* version */,
    375           "payload"));
    376   {
    377     base::RunLoop run_loop;
    378     on_policy_updated_ = run_loop.QuitClosure();
    379     run_loop.Run();
    380   }
    381 
    382   // Check that the updated policy was fetched.
    383   PolicyMap expected;
    384   GetExpectedTestPolicy(&expected, "youtube.com");
    385   EXPECT_TRUE(expected.Equals(policy_service->GetPolicies(
    386       PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))));
    387 
    388   policy_service->RemoveObserver(POLICY_DOMAIN_CHROME, this);
    389 }
    390 
    391 #if defined(OS_CHROMEOS)
    392 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, FetchPolicyWithRotatedKey) {
    393   PolicyService* policy_service = GetPolicyService();
    394   {
    395     base::RunLoop run_loop;
    396     // This does the initial fetch and stores the initial key.
    397     policy_service->RefreshPolicies(run_loop.QuitClosure());
    398     run_loop.Run();
    399   }
    400 
    401   // Read the initial key.
    402   std::string initial_key;
    403   ASSERT_TRUE(base::ReadFileToString(user_policy_key_file_, &initial_key));
    404 
    405   PolicyMap default_policy;
    406   GetExpectedDefaultPolicy(&default_policy);
    407   EXPECT_TRUE(default_policy.Equals(policy_service->GetPolicies(
    408       PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))));
    409 
    410   // Set the new policies and a new key at the server.
    411   ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("google.com", 1)));
    412   PolicyMap expected;
    413   GetExpectedTestPolicy(&expected, "google.com");
    414   {
    415     base::RunLoop run_loop;
    416     // This fetches the new policies and does a key rotation.
    417     policy_service->RefreshPolicies(run_loop.QuitClosure());
    418     run_loop.Run();
    419   }
    420   EXPECT_TRUE(expected.Equals(policy_service->GetPolicies(
    421       PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))));
    422 
    423   // Verify that the key was rotated.
    424   std::string rotated_key;
    425   ASSERT_TRUE(base::ReadFileToString(user_policy_key_file_, &rotated_key));
    426   EXPECT_NE(rotated_key, initial_key);
    427 
    428   // Another refresh using the same key won't rotate it again.
    429   {
    430     base::RunLoop run_loop;
    431     policy_service->RefreshPolicies(run_loop.QuitClosure());
    432     run_loop.Run();
    433   }
    434   EXPECT_TRUE(expected.Equals(policy_service->GetPolicies(
    435       PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))));
    436   std::string current_key;
    437   ASSERT_TRUE(base::ReadFileToString(user_policy_key_file_, &current_key));
    438   EXPECT_EQ(rotated_key, current_key);
    439 }
    440 #endif
    441 
    442 TEST(CloudPolicyProtoTest, VerifyProtobufEquivalence) {
    443   // There are 2 protobufs that can be used for user cloud policy:
    444   // cloud_policy.proto and chrome_settings.proto. chrome_settings.proto is the
    445   // version used by the server, but generates one proto message per policy; to
    446   // save binary size on the client, the other version shares proto messages for
    447   // policies of the same type. They generate the same bytes on the wire though,
    448   // so they are compatible. This test verifies that that stays true.
    449 
    450   // Build a ChromeSettingsProto message with one policy of each supported type.
    451   em::ChromeSettingsProto chrome_settings;
    452   chrome_settings.mutable_homepagelocation()->set_homepagelocation(
    453       "chromium.org");
    454   chrome_settings.mutable_showhomebutton()->set_showhomebutton(true);
    455   chrome_settings.mutable_restoreonstartup()->set_restoreonstartup(4);
    456   em::StringList* list =
    457       chrome_settings.mutable_disabledschemes()->mutable_disabledschemes();
    458   list->add_entries("ftp");
    459   list->add_entries("mailto");
    460   // Try explicitly setting a policy mode too.
    461   chrome_settings.mutable_disablespdy()->set_disablespdy(false);
    462   chrome_settings.mutable_disablespdy()->mutable_policy_options()->set_mode(
    463       em::PolicyOptions::MANDATORY);
    464   chrome_settings.mutable_syncdisabled()->set_syncdisabled(true);
    465   chrome_settings.mutable_syncdisabled()->mutable_policy_options()->set_mode(
    466       em::PolicyOptions::RECOMMENDED);
    467 
    468   // Build an equivalent CloudPolicySettings message.
    469   em::CloudPolicySettings cloud_policy;
    470   cloud_policy.mutable_homepagelocation()->set_value("chromium.org");
    471   cloud_policy.mutable_showhomebutton()->set_value(true);
    472   cloud_policy.mutable_restoreonstartup()->set_value(4);
    473   list = cloud_policy.mutable_disabledschemes()->mutable_value();
    474   list->add_entries("ftp");
    475   list->add_entries("mailto");
    476   cloud_policy.mutable_disablespdy()->set_value(false);
    477   cloud_policy.mutable_disablespdy()->mutable_policy_options()->set_mode(
    478       em::PolicyOptions::MANDATORY);
    479   cloud_policy.mutable_syncdisabled()->set_value(true);
    480   cloud_policy.mutable_syncdisabled()->mutable_policy_options()->set_mode(
    481       em::PolicyOptions::RECOMMENDED);
    482 
    483   // They should now serialize to the same bytes.
    484   std::string chrome_settings_serialized;
    485   std::string cloud_policy_serialized;
    486   ASSERT_TRUE(chrome_settings.SerializeToString(&chrome_settings_serialized));
    487   ASSERT_TRUE(cloud_policy.SerializeToString(&cloud_policy_serialized));
    488   EXPECT_EQ(chrome_settings_serialized, cloud_policy_serialized);
    489 }
    490 
    491 }  // namespace policy
    492