1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "base/callback.h" 6 #include "base/command_line.h" 7 #include "base/files/file_path.h" 8 #include "base/files/file_util.h" 9 #include "base/files/scoped_temp_dir.h" 10 #include "base/memory/scoped_ptr.h" 11 #include "base/path_service.h" 12 #include "base/prefs/pref_service.h" 13 #include "base/run_loop.h" 14 #include "base/strings/stringprintf.h" 15 #include "base/time/time.h" 16 #include "chrome/browser/browser_process.h" 17 #include "chrome/browser/chrome_notification_types.h" 18 #include "chrome/browser/invalidation/fake_invalidation_service.h" 19 #include "chrome/browser/invalidation/profile_invalidation_provider_factory.h" 20 #include "chrome/browser/policy/profile_policy_connector.h" 21 #include "chrome/browser/policy/profile_policy_connector_factory.h" 22 #include "chrome/browser/policy/test/local_policy_test_server.h" 23 #include "chrome/browser/profiles/profile.h" 24 #include "chrome/browser/ui/browser.h" 25 #include "chrome/test/base/in_process_browser_test.h" 26 #include "components/invalidation/invalidation.h" 27 #include "components/invalidation/invalidation_service.h" 28 #include "components/invalidation/profile_invalidation_provider.h" 29 #include "components/keyed_service/core/keyed_service.h" 30 #include "components/policy/core/browser/browser_policy_connector.h" 31 #include "components/policy/core/common/cloud/cloud_policy_client.h" 32 #include "components/policy/core/common/cloud/cloud_policy_constants.h" 33 #include "components/policy/core/common/cloud/mock_cloud_policy_client.h" 34 #include "components/policy/core/common/external_data_fetcher.h" 35 #include "components/policy/core/common/policy_map.h" 36 #include "components/policy/core/common/policy_service.h" 37 #include "components/policy/core/common/policy_switches.h" 38 #include "components/policy/core/common/policy_test_utils.h" 39 #include "content/public/browser/notification_service.h" 40 #include "content/public/browser/notification_source.h" 41 #include "content/public/test/test_utils.h" 42 #include "net/url_request/url_request_context_getter.h" 43 #include "policy/policy_constants.h" 44 #include "policy/proto/chrome_settings.pb.h" 45 #include "policy/proto/cloud_policy.pb.h" 46 #include "testing/gmock/include/gmock/gmock.h" 47 #include "testing/gtest/include/gtest/gtest.h" 48 #include "url/gurl.h" 49 50 #if defined(OS_CHROMEOS) 51 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h" 52 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.h" 53 #include "chromeos/chromeos_paths.h" 54 #include "chromeos/dbus/cryptohome_client.h" 55 #include "chromeos/login/user_names.h" 56 #else 57 #include "chrome/browser/policy/cloud/user_cloud_policy_manager_factory.h" 58 #include "chrome/browser/signin/signin_manager_factory.h" 59 #include "components/policy/core/common/cloud/user_cloud_policy_manager.h" 60 #include "components/signin/core/browser/signin_manager.h" 61 #endif 62 63 using testing::AnyNumber; 64 using testing::InvokeWithoutArgs; 65 using testing::Mock; 66 using testing::Return; 67 using testing::_; 68 69 namespace content { 70 class BrowserContext; 71 } 72 73 namespace em = enterprise_management; 74 75 namespace policy { 76 77 namespace { 78 79 KeyedService* BuildFakeProfileInvalidationProvider( 80 content::BrowserContext* context) { 81 return new invalidation::ProfileInvalidationProvider( 82 scoped_ptr<invalidation::InvalidationService>( 83 new invalidation::FakeInvalidationService)); 84 } 85 86 const char* GetTestUser() { 87 #if defined(OS_CHROMEOS) 88 return chromeos::login::kStubUser; 89 #else 90 return "user (at) example.com"; 91 #endif 92 } 93 94 std::string GetEmptyPolicy() { 95 const char kEmptyPolicy[] = 96 "{" 97 " \"%s\": {" 98 " \"mandatory\": {}," 99 " \"recommended\": {}" 100 " }," 101 " \"managed_users\": [ \"*\" ]," 102 " \"policy_user\": \"%s\"," 103 " \"current_key_index\": 0" 104 "}"; 105 106 return base::StringPrintf( 107 kEmptyPolicy, dm_protocol::kChromeUserPolicyType, GetTestUser()); 108 } 109 110 std::string GetTestPolicy(const char* homepage, int key_version) { 111 const char kTestPolicy[] = 112 "{" 113 " \"%s\": {" 114 " \"mandatory\": {" 115 " \"ShowHomeButton\": true," 116 " \"RestoreOnStartup\": 4," 117 " \"URLBlacklist\": [ \"dev.chromium.org\", \"youtube.com\" ]," 118 " \"MaxInvalidationFetchDelay\": 1000" 119 " }," 120 " \"recommended\": {" 121 " \"HomepageLocation\": \"%s\"" 122 " }" 123 " }," 124 " \"managed_users\": [ \"*\" ]," 125 " \"policy_user\": \"%s\"," 126 " \"current_key_index\": %d," 127 " \"invalidation_source\": 16," 128 " \"invalidation_name\": \"test_policy\"" 129 "}"; 130 131 return base::StringPrintf(kTestPolicy, 132 dm_protocol::kChromeUserPolicyType, 133 homepage, 134 GetTestUser(), 135 key_version); 136 } 137 138 void GetExpectedDefaultPolicy(PolicyMap* policy_map) { 139 #if defined(OS_CHROMEOS) 140 policy_map->Set(key::kChromeOsMultiProfileUserBehavior, 141 POLICY_LEVEL_MANDATORY, 142 POLICY_SCOPE_USER, 143 new base::StringValue("primary-only"), 144 NULL); 145 policy_map->Set(key::kEasyUnlockAllowed, 146 POLICY_LEVEL_MANDATORY, 147 POLICY_SCOPE_USER, 148 new base::FundamentalValue(false), 149 NULL); 150 #endif 151 } 152 153 void GetExpectedTestPolicy(PolicyMap* expected, const char* homepage) { 154 expected->Set(key::kShowHomeButton, 155 POLICY_LEVEL_MANDATORY, 156 POLICY_SCOPE_USER, 157 new base::FundamentalValue(true), 158 NULL); 159 expected->Set(key::kRestoreOnStartup, 160 POLICY_LEVEL_MANDATORY, 161 POLICY_SCOPE_USER, 162 new base::FundamentalValue(4), 163 NULL); 164 base::ListValue list; 165 list.AppendString("dev.chromium.org"); 166 list.AppendString("youtube.com"); 167 expected->Set( 168 key::kURLBlacklist, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, 169 list.DeepCopy(), NULL); 170 expected->Set(key::kMaxInvalidationFetchDelay, 171 POLICY_LEVEL_MANDATORY, 172 POLICY_SCOPE_USER, 173 new base::FundamentalValue(1000), 174 NULL); 175 expected->Set(key::kHomepageLocation, 176 POLICY_LEVEL_RECOMMENDED, 177 POLICY_SCOPE_USER, 178 new base::StringValue(homepage), 179 NULL); 180 #if defined(OS_CHROMEOS) 181 expected->Set(key::kChromeOsMultiProfileUserBehavior, 182 POLICY_LEVEL_MANDATORY, 183 POLICY_SCOPE_USER, 184 new base::StringValue("primary-only"), 185 NULL); 186 expected->Set(key::kEasyUnlockAllowed, 187 POLICY_LEVEL_MANDATORY, 188 POLICY_SCOPE_USER, 189 new base::FundamentalValue(false), 190 NULL); 191 #endif 192 } 193 194 } // namespace 195 196 // Tests the cloud policy stack(s). 197 class CloudPolicyTest : public InProcessBrowserTest, 198 public PolicyService::Observer { 199 protected: 200 CloudPolicyTest() {} 201 virtual ~CloudPolicyTest() {} 202 203 virtual void SetUpInProcessBrowserTestFixture() OVERRIDE { 204 ASSERT_TRUE(temp_dir_.CreateUniqueTempDir()); 205 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetEmptyPolicy())); 206 207 test_server_.reset(new LocalPolicyTestServer(policy_file_path())); 208 ASSERT_TRUE(test_server_->Start()); 209 210 std::string url = test_server_->GetServiceURL().spec(); 211 212 CommandLine* command_line = CommandLine::ForCurrentProcess(); 213 command_line->AppendSwitchASCII(switches::kDeviceManagementUrl, url); 214 215 invalidation::ProfileInvalidationProviderFactory::GetInstance()-> 216 RegisterTestingFactory(BuildFakeProfileInvalidationProvider); 217 } 218 219 virtual void SetUpOnMainThread() OVERRIDE { 220 ASSERT_TRUE(PolicyServiceIsEmpty(g_browser_process->policy_service())) 221 << "Pre-existing policies in this machine will make this test fail."; 222 223 BrowserPolicyConnector* connector = 224 g_browser_process->browser_policy_connector(); 225 connector->ScheduleServiceInitialization(0); 226 227 #if defined(OS_CHROMEOS) 228 UserCloudPolicyManagerChromeOS* policy_manager = 229 UserCloudPolicyManagerFactoryChromeOS::GetForProfile( 230 browser()->profile()); 231 ASSERT_TRUE(policy_manager); 232 #else 233 // Mock a signed-in user. This is used by the UserCloudPolicyStore to pass 234 // the username to the UserCloudPolicyValidator. 235 SigninManager* signin_manager = 236 SigninManagerFactory::GetForProfile(browser()->profile()); 237 ASSERT_TRUE(signin_manager); 238 signin_manager->SetAuthenticatedUsername(GetTestUser()); 239 240 UserCloudPolicyManager* policy_manager = 241 UserCloudPolicyManagerFactory::GetForBrowserContext( 242 browser()->profile()); 243 ASSERT_TRUE(policy_manager); 244 policy_manager->Connect( 245 g_browser_process->local_state(), 246 g_browser_process->system_request_context(), 247 UserCloudPolicyManager::CreateCloudPolicyClient( 248 connector->device_management_service(), 249 g_browser_process->system_request_context()).Pass()); 250 #endif // defined(OS_CHROMEOS) 251 252 ASSERT_TRUE(policy_manager->core()->client()); 253 base::RunLoop run_loop; 254 MockCloudPolicyClientObserver observer; 255 EXPECT_CALL(observer, OnRegistrationStateChanged(_)).WillOnce( 256 InvokeWithoutArgs(&run_loop, &base::RunLoop::Quit)); 257 policy_manager->core()->client()->AddObserver(&observer); 258 259 // Give a bogus OAuth token to the |policy_manager|. This should make its 260 // CloudPolicyClient fetch the DMToken. 261 ASSERT_FALSE(policy_manager->core()->client()->is_registered()); 262 em::DeviceRegisterRequest::Type registration_type = 263 #if defined(OS_CHROMEOS) 264 em::DeviceRegisterRequest::USER; 265 #else 266 em::DeviceRegisterRequest::BROWSER; 267 #endif 268 policy_manager->core()->client()->Register( 269 registration_type, "bogus", std::string(), false, std::string(), 270 std::string()); 271 run_loop.Run(); 272 Mock::VerifyAndClearExpectations(&observer); 273 policy_manager->core()->client()->RemoveObserver(&observer); 274 EXPECT_TRUE(policy_manager->core()->client()->is_registered()); 275 276 #if defined(OS_CHROMEOS) 277 // Get the path to the user policy key file. 278 base::FilePath user_policy_key_dir; 279 ASSERT_TRUE( 280 PathService::Get(chromeos::DIR_USER_POLICY_KEYS, &user_policy_key_dir)); 281 std::string sanitized_username = 282 chromeos::CryptohomeClient::GetStubSanitizedUsername(GetTestUser()); 283 user_policy_key_file_ = user_policy_key_dir.AppendASCII(sanitized_username) 284 .AppendASCII("policy.pub"); 285 #endif 286 } 287 288 PolicyService* GetPolicyService() { 289 ProfilePolicyConnector* profile_connector = 290 ProfilePolicyConnectorFactory::GetForProfile(browser()->profile()); 291 return profile_connector->policy_service(); 292 } 293 294 invalidation::FakeInvalidationService* GetInvalidationService() { 295 return static_cast<invalidation::FakeInvalidationService*>( 296 static_cast<invalidation::ProfileInvalidationProvider*>( 297 invalidation::ProfileInvalidationProviderFactory::GetInstance()-> 298 GetForProfile(browser()->profile()))->GetInvalidationService()); 299 } 300 301 void SetServerPolicy(const std::string& policy) { 302 int result = base::WriteFile(policy_file_path(), policy.data(), 303 policy.size()); 304 ASSERT_EQ(static_cast<int>(policy.size()), result); 305 } 306 307 base::FilePath policy_file_path() const { 308 return temp_dir_.path().AppendASCII("policy.json"); 309 } 310 311 virtual void OnPolicyUpdated(const PolicyNamespace& ns, 312 const PolicyMap& previous, 313 const PolicyMap& current) OVERRIDE { 314 if (!on_policy_updated_.is_null()) { 315 on_policy_updated_.Run(); 316 on_policy_updated_.Reset(); 317 } 318 } 319 320 virtual void OnPolicyServiceInitialized(PolicyDomain domain) OVERRIDE {} 321 322 base::ScopedTempDir temp_dir_; 323 scoped_ptr<LocalPolicyTestServer> test_server_; 324 base::FilePath user_policy_key_file_; 325 base::Closure on_policy_updated_; 326 }; 327 328 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, FetchPolicy) { 329 PolicyService* policy_service = GetPolicyService(); 330 { 331 base::RunLoop run_loop; 332 // This does the initial fetch and stores the initial key. 333 policy_service->RefreshPolicies(run_loop.QuitClosure()); 334 run_loop.Run(); 335 } 336 337 PolicyMap default_policy; 338 GetExpectedDefaultPolicy(&default_policy); 339 EXPECT_TRUE(default_policy.Equals(policy_service->GetPolicies( 340 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); 341 342 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("google.com", 0))); 343 PolicyMap expected; 344 GetExpectedTestPolicy(&expected, "google.com"); 345 { 346 base::RunLoop run_loop; 347 // This fetches the new policies, using the same key. 348 policy_service->RefreshPolicies(run_loop.QuitClosure()); 349 run_loop.Run(); 350 } 351 EXPECT_TRUE(expected.Equals(policy_service->GetPolicies( 352 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); 353 } 354 355 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, InvalidatePolicy) { 356 PolicyService* policy_service = GetPolicyService(); 357 policy_service->AddObserver(POLICY_DOMAIN_CHROME, this); 358 359 // Perform the initial fetch. 360 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("google.com", 0))); 361 { 362 base::RunLoop run_loop; 363 policy_service->RefreshPolicies(run_loop.QuitClosure()); 364 run_loop.Run(); 365 } 366 367 // Update the homepage in the policy and trigger an invalidation. 368 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("youtube.com", 0))); 369 base::TimeDelta now = 370 base::Time::NowFromSystemTime() - base::Time::UnixEpoch(); 371 GetInvalidationService()->EmitInvalidationForTest( 372 syncer::Invalidation::Init( 373 invalidation::ObjectId(16, "test_policy"), 374 now.InMicroseconds() /* version */, 375 "payload")); 376 { 377 base::RunLoop run_loop; 378 on_policy_updated_ = run_loop.QuitClosure(); 379 run_loop.Run(); 380 } 381 382 // Check that the updated policy was fetched. 383 PolicyMap expected; 384 GetExpectedTestPolicy(&expected, "youtube.com"); 385 EXPECT_TRUE(expected.Equals(policy_service->GetPolicies( 386 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); 387 388 policy_service->RemoveObserver(POLICY_DOMAIN_CHROME, this); 389 } 390 391 #if defined(OS_CHROMEOS) 392 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, FetchPolicyWithRotatedKey) { 393 PolicyService* policy_service = GetPolicyService(); 394 { 395 base::RunLoop run_loop; 396 // This does the initial fetch and stores the initial key. 397 policy_service->RefreshPolicies(run_loop.QuitClosure()); 398 run_loop.Run(); 399 } 400 401 // Read the initial key. 402 std::string initial_key; 403 ASSERT_TRUE(base::ReadFileToString(user_policy_key_file_, &initial_key)); 404 405 PolicyMap default_policy; 406 GetExpectedDefaultPolicy(&default_policy); 407 EXPECT_TRUE(default_policy.Equals(policy_service->GetPolicies( 408 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); 409 410 // Set the new policies and a new key at the server. 411 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy("google.com", 1))); 412 PolicyMap expected; 413 GetExpectedTestPolicy(&expected, "google.com"); 414 { 415 base::RunLoop run_loop; 416 // This fetches the new policies and does a key rotation. 417 policy_service->RefreshPolicies(run_loop.QuitClosure()); 418 run_loop.Run(); 419 } 420 EXPECT_TRUE(expected.Equals(policy_service->GetPolicies( 421 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); 422 423 // Verify that the key was rotated. 424 std::string rotated_key; 425 ASSERT_TRUE(base::ReadFileToString(user_policy_key_file_, &rotated_key)); 426 EXPECT_NE(rotated_key, initial_key); 427 428 // Another refresh using the same key won't rotate it again. 429 { 430 base::RunLoop run_loop; 431 policy_service->RefreshPolicies(run_loop.QuitClosure()); 432 run_loop.Run(); 433 } 434 EXPECT_TRUE(expected.Equals(policy_service->GetPolicies( 435 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); 436 std::string current_key; 437 ASSERT_TRUE(base::ReadFileToString(user_policy_key_file_, ¤t_key)); 438 EXPECT_EQ(rotated_key, current_key); 439 } 440 #endif 441 442 TEST(CloudPolicyProtoTest, VerifyProtobufEquivalence) { 443 // There are 2 protobufs that can be used for user cloud policy: 444 // cloud_policy.proto and chrome_settings.proto. chrome_settings.proto is the 445 // version used by the server, but generates one proto message per policy; to 446 // save binary size on the client, the other version shares proto messages for 447 // policies of the same type. They generate the same bytes on the wire though, 448 // so they are compatible. This test verifies that that stays true. 449 450 // Build a ChromeSettingsProto message with one policy of each supported type. 451 em::ChromeSettingsProto chrome_settings; 452 chrome_settings.mutable_homepagelocation()->set_homepagelocation( 453 "chromium.org"); 454 chrome_settings.mutable_showhomebutton()->set_showhomebutton(true); 455 chrome_settings.mutable_restoreonstartup()->set_restoreonstartup(4); 456 em::StringList* list = 457 chrome_settings.mutable_disabledschemes()->mutable_disabledschemes(); 458 list->add_entries("ftp"); 459 list->add_entries("mailto"); 460 // Try explicitly setting a policy mode too. 461 chrome_settings.mutable_disablespdy()->set_disablespdy(false); 462 chrome_settings.mutable_disablespdy()->mutable_policy_options()->set_mode( 463 em::PolicyOptions::MANDATORY); 464 chrome_settings.mutable_syncdisabled()->set_syncdisabled(true); 465 chrome_settings.mutable_syncdisabled()->mutable_policy_options()->set_mode( 466 em::PolicyOptions::RECOMMENDED); 467 468 // Build an equivalent CloudPolicySettings message. 469 em::CloudPolicySettings cloud_policy; 470 cloud_policy.mutable_homepagelocation()->set_value("chromium.org"); 471 cloud_policy.mutable_showhomebutton()->set_value(true); 472 cloud_policy.mutable_restoreonstartup()->set_value(4); 473 list = cloud_policy.mutable_disabledschemes()->mutable_value(); 474 list->add_entries("ftp"); 475 list->add_entries("mailto"); 476 cloud_policy.mutable_disablespdy()->set_value(false); 477 cloud_policy.mutable_disablespdy()->mutable_policy_options()->set_mode( 478 em::PolicyOptions::MANDATORY); 479 cloud_policy.mutable_syncdisabled()->set_value(true); 480 cloud_policy.mutable_syncdisabled()->mutable_policy_options()->set_mode( 481 em::PolicyOptions::RECOMMENDED); 482 483 // They should now serialize to the same bytes. 484 std::string chrome_settings_serialized; 485 std::string cloud_policy_serialized; 486 ASSERT_TRUE(chrome_settings.SerializeToString(&chrome_settings_serialized)); 487 ASSERT_TRUE(cloud_policy.SerializeToString(&cloud_policy_serialized)); 488 EXPECT_EQ(chrome_settings_serialized, cloud_policy_serialized); 489 } 490 491 } // namespace policy 492