Implement new-style CloudPolicyStore for Chrome OS device policy.

chrome/browser/policy/device_cloud_policy_store_chromeos_unittest.cc

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/device_cloud_policy_store_chromeos.h"
+
+#include <vector>
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop.h"
+#include "chrome/browser/chromeos/cros/mock_cryptohome_library.h"
+#include "chrome/browser/chromeos/settings/device_settings_service.h"
+#include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
+#include "chrome/browser/chromeos/settings/mock_owner_key_util.h"
+#include "chrome/browser/policy/enterprise_install_attributes.h"
+#include "chrome/browser/policy/policy_builder.h"
+#include "chrome/browser/policy/proto/chrome_device_policy.pb.h"
+#include "chromeos/dbus/mock_session_manager_client.h"
+#include "content/public/test/test_browser_thread.h"
+#include "policy/policy_constants.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace policy {
+
+class DeviceCloudPolicyStoreChromeOSTest : public testing::Test {
+ protected:
+  DeviceCloudPolicyStoreChromeOSTest()
+      : loop_(MessageLoop::TYPE_UI),
+        ui_thread_(content::BrowserThread::UI, &loop_),
+        file_thread_(content::BrowserThread::FILE, &loop_),
+        owner_key_util_(new chromeos::MockOwnerKeyUtil()),
+        cryptohome_library_(chromeos::CryptohomeLibrary::GetImpl(true)),
+        install_attributes_(
+            new EnterpriseInstallAttributes(cryptohome_library_.get())),
+        store_(new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
+                                                  install_attributes_.get())) {}
+
+  virtual void SetUp() OVERRIDE {
+    device_settings_service_.Initialize(&device_settings_test_helper_,
+                                        owner_key_util_);
+    ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS,
+              install_attributes_->LockDevice(PolicyBuilder::kFakeUsername,
+                                              DEVICE_MODE_ENTERPRISE,
+                                              PolicyBuilder::kFakeDeviceId));
+
+    policy_.payload().mutable_metrics_enabled()->set_metrics_enabled(true);
+    policy_.Build();
+
+    owner_key_util_->SetPublicKeyFromPrivateKey(policy_.signing_key());
+    device_settings_test_helper_.set_policy_blob(policy_.GetBlob());
+  }
+
+  void ExpectFailure(CloudPolicyStore::Status expected_status) {
+    EXPECT_EQ(expected_status, store_->status());
+    EXPECT_TRUE(store_->is_initialized());
+    EXPECT_FALSE(store_->has_policy());
+    EXPECT_FALSE(store_->is_managed());
+  }
+
+  void ExpectSuccess() {
+    EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+    EXPECT_TRUE(store_->is_initialized());
+    EXPECT_TRUE(store_->has_policy());
+    EXPECT_TRUE(store_->is_managed());
+    EXPECT_TRUE(store_->policy());
+    base::FundamentalValue expected(true);
+    EXPECT_TRUE(
+        base::Value::Equals(&expected,
+                            store_->policy_map().GetValue(
+                                key::kDeviceMetricsReportingEnabled)));
+  }
+
+  void PrepareExistingPolicy() {
+    store_->Load();
+    device_settings_test_helper_.Flush();
+    ExpectSuccess();
+
+    policy_.set_new_signing_key(scoped_ptr<crypto::RSAPrivateKey>());
+    policy_.Build();
+  }
+
+  void PrepareNewSigningKey() {
+    policy_.set_new_signing_key(PolicyBuilder::CreateTestNewSigningKey());
+    policy_.Build();
+    owner_key_util_->SetPublicKeyFromPrivateKey(policy_.new_signing_key());
+  }
+
+  void ResetToNonEnterprise() {
+    store_.reset();
+    cryptohome_library_->InstallAttributesSet("enterprise.owned",
+                                              std::string());
+    install_attributes_.reset(
+        new EnterpriseInstallAttributes(cryptohome_library_.get()));
+    store_.reset(new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
+                                                    install_attributes_.get()));
+  }
+
+  MessageLoop loop_;
+  content::TestBrowserThread ui_thread_;
+  content::TestBrowserThread file_thread_;
+
+  chromeos::DeviceSettingsTestHelper device_settings_test_helper_;
+  DevicePolicyBuilder policy_;
+
+  scoped_refptr<chromeos::MockOwnerKeyUtil> owner_key_util_;
+  chromeos::DeviceSettingsService device_settings_service_;
+  scoped_ptr<chromeos::CryptohomeLibrary> cryptohome_library_;
+  scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
+
+  scoped_ptr<DeviceCloudPolicyStoreChromeOS> store_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyStoreChromeOSTest);
+};
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNoKey) {
+  std::vector<uint8> empty_key;
+  owner_key_util_->SetPublicKey(empty_key);
+  store_->Load();
+  device_settings_test_helper_.Flush();
+  ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNoPolicy) {
+  device_settings_test_helper_.set_policy_blob(std::string());
+  store_->Load();
+  device_settings_test_helper_.Flush();
+  ExpectFailure(CloudPolicyStore::STATUS_LOAD_ERROR);
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadNotEnterprise) {
+  ResetToNonEnterprise();
+  store_->Load();
+  device_settings_test_helper_.Flush();
+  ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadSuccess) {
+  store_->Load();
+  device_settings_test_helper_.Flush();
+  ExpectSuccess();
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreSuccess) {
+  PrepareExistingPolicy();
+  store_->Store(policy_.policy());
+  device_settings_test_helper_.Flush();
+  ExpectSuccess();
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreNoSignature) {
+  PrepareExistingPolicy();
+  policy_.policy().clear_policy_data_signature();
+  store_->Store(policy_.policy());
+  device_settings_test_helper_.Flush();
+  EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
+  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
+            store_->validation_status());
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreBadSignature) {
+  PrepareExistingPolicy();
+  policy_.policy().set_policy_data_signature("invalid");
+  store_->Store(policy_.policy());
+  device_settings_test_helper_.Flush();
+  EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
+  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
+            store_->validation_status());
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreKeyRotation) {
+  PrepareExistingPolicy();
+  policy_.set_new_signing_key(PolicyBuilder::CreateTestNewSigningKey());
+  policy_.Build();
+  store_->Store(policy_.policy());
+  device_settings_test_helper_.FlushLoops();
+  device_settings_test_helper_.FlushStore();
+  owner_key_util_->SetPublicKeyFromPrivateKey(policy_.new_signing_key());
+  device_settings_service_.OwnerKeySet(true);
+  device_settings_test_helper_.Flush();
+  ExpectSuccess();
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicySuccess) {
+  PrepareNewSigningKey();
+  store_->InstallInitialPolicy(policy_.policy());
+  device_settings_test_helper_.Flush();
+  ExpectSuccess();
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoSignature) {
+  PrepareNewSigningKey();
+  policy_.policy().clear_policy_data_signature();
+  store_->InstallInitialPolicy(policy_.policy());
+  device_settings_test_helper_.Flush();
+  ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
+  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
+            store_->validation_status());
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoKey) {
+  PrepareNewSigningKey();
+  policy_.policy().clear_new_public_key();
+  store_->InstallInitialPolicy(policy_.policy());
+  device_settings_test_helper_.Flush();
+  ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
+  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
+            store_->validation_status());
+}
+
+TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNotEnterprise) {
+  PrepareNewSigningKey();
+  ResetToNonEnterprise();
+  store_->InstallInitialPolicy(policy_.policy());
+  device_settings_test_helper_.Flush();
+  ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
+}
+
+}  // namespace policy