| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "base/command_line.h" | |
| 6 #include "base/file_util.h" | |
| 7 #include "base/files/file_path.h" | |
| 8 #include "base/files/scoped_temp_dir.h" | |
| 9 #include "base/memory/scoped_ptr.h" | |
| 10 #include "base/path_service.h" | |
| 11 #include "base/prefs/pref_service.h" | |
| 12 #include "base/run_loop.h" | |
| 13 #include "base/stringprintf.h" | |
| 14 #include "chrome/browser/browser_process.h" | |
| 15 #include "chrome/browser/policy/browser_policy_connector.h" | |
| 16 #include "chrome/browser/policy/cloud_policy_client.h" | |
| 17 #include "chrome/browser/policy/cloud_policy_constants.h" | |
| 18 #include "chrome/browser/policy/mock_cloud_policy_client.h" | |
| 19 #include "chrome/browser/policy/policy_map.h" | |
| 20 #include "chrome/browser/policy/policy_service.h" | |
| 21 #include "chrome/browser/policy/proto/chrome_settings.pb.h" | |
| 22 #include "chrome/browser/policy/proto/cloud_policy.pb.h" | |
| 23 #include "chrome/browser/policy/test/local_policy_test_server.h" | |
| 24 #include "chrome/browser/policy/test_utils.h" | |
| 25 #include "chrome/browser/profiles/profile.h" | |
| 26 #include "chrome/browser/ui/browser.h" | |
| 27 #include "chrome/common/chrome_notification_types.h" | |
| 28 #include "chrome/common/chrome_switches.h" | |
| 29 #include "chrome/test/base/in_process_browser_test.h" | |
| 30 #include "content/public/browser/browser_thread.h" | |
| 31 #include "content/public/browser/notification_service.h" | |
| 32 #include "content/public/browser/notification_source.h" | |
| 33 #include "content/public/test/test_utils.h" | |
| 34 #include "googleurl/src/gurl.h" | |
| 35 #include "policy/policy_constants.h" | |
| 36 #include "testing/gmock/include/gmock/gmock.h" | |
| 37 #include "testing/gtest/include/gtest/gtest.h" | |
| 38 | |
| 39 #if defined(OS_CHROMEOS) | |
| 40 #include "chrome/browser/chromeos/login/user_manager.h" | |
| 41 #include "chrome/browser/policy/user_cloud_policy_manager_chromeos.h" | |
| 42 #include "chrome/common/chrome_paths.h" | |
| 43 #include "chromeos/dbus/mock_cryptohome_client.h" | |
| 44 #include "chromeos/dbus/mock_dbus_thread_manager.h" | |
| 45 #include "chromeos/dbus/mock_session_manager_client.h" | |
| 46 #else | |
| 47 #include "chrome/browser/policy/user_cloud_policy_manager.h" | |
| 48 #include "chrome/browser/policy/user_cloud_policy_manager_factory.h" | |
| 49 #include "chrome/browser/signin/signin_manager.h" | |
| 50 #include "chrome/browser/signin/signin_manager_factory.h" | |
| 51 #endif | |
| 52 | |
| 53 using testing::AnyNumber; | |
| 54 using testing::InvokeWithoutArgs; | |
| 55 using testing::Mock; | |
| 56 using testing::_; | |
| 57 | |
| 58 namespace em = enterprise_management; | |
| 59 | |
| 60 namespace policy { | |
| 61 | |
| 62 namespace { | |
| 63 | |
| 64 #if defined(OS_CHROMEOS) | |
| 65 | |
| 66 const char kSanitizedUsername[] = "0123456789ABCDEF0123456789ABCDEF01234567"; | |
| 67 | |
| 68 ACTION(GetSanitizedUsername) { | |
| 69 MessageLoop::current()->PostTask( | |
| 70 FROM_HERE, | |
| 71 base::Bind(arg1, chromeos::DBUS_METHOD_CALL_SUCCESS, kSanitizedUsername)); | |
| 72 } | |
| 73 | |
| 74 ACTION_P(RetrieveUserPolicy, storage) { | |
| 75 MessageLoop::current()->PostTask(FROM_HERE, base::Bind(arg0, *storage)); | |
| 76 } | |
| 77 | |
| 78 ACTION_P2(StoreUserPolicy, storage, user_policy_key_file) { | |
| 79 // The session_manager stores a copy of the policy key at | |
| 80 // /var/run/user_policy/$hash/policy.pub. Simulate that behavior here, so | |
| 81 // that the policy signature can be validated. | |
| 82 em::PolicyFetchResponse policy; | |
| 83 ASSERT_TRUE(policy.ParseFromString(arg0)); | |
| 84 if (policy.has_new_public_key()) { | |
| 85 ASSERT_TRUE(file_util::CreateDirectory(user_policy_key_file.DirName())); | |
| 86 int result = file_util::WriteFile( | |
| 87 user_policy_key_file, | |
| 88 policy.new_public_key().data(), | |
| 89 policy.new_public_key().size()); | |
| 90 ASSERT_EQ(static_cast<int>(policy.new_public_key().size()), result); | |
| 91 } | |
| 92 | |
| 93 *storage = arg0; | |
| 94 MessageLoop::current()->PostTask(FROM_HERE, base::Bind(arg1, true)); | |
| 95 } | |
| 96 | |
| 97 #endif | |
| 98 | |
| 99 const char* GetTestUser() { | |
| 100 #if defined(OS_CHROMEOS) | |
| 101 return chromeos::UserManager::kStubUser; | |
| 102 #else | |
| 103 return "user@example.com"; | |
| 104 #endif | |
| 105 } | |
| 106 | |
| 107 std::string GetEmptyPolicy() { | |
| 108 const char kEmptyPolicy[] = | |
| 109 "{" | |
| 110 " \"%s\": {" | |
| 111 " \"mandatory\": {}," | |
| 112 " \"recommended\": {}" | |
| 113 " }," | |
| 114 " \"managed_users\": [ \"*\" ]," | |
| 115 " \"policy_user\": \"%s\"," | |
| 116 " \"current_key_index\": 0" | |
| 117 "}"; | |
| 118 | |
| 119 return base::StringPrintf( | |
| 120 kEmptyPolicy, dm_protocol::kChromeUserPolicyType, GetTestUser()); | |
| 121 } | |
| 122 | |
| 123 std::string GetTestPolicy(int key_version) { | |
| 124 const char kTestPolicy[] = | |
| 125 "{" | |
| 126 " \"%s\": {" | |
| 127 " \"mandatory\": {" | |
| 128 " \"ShowHomeButton\": true," | |
| 129 " \"MaxConnectionsPerProxy\": 42," | |
| 130 " \"URLBlacklist\": [ \"dev.chromium.org\", \"youtube.com\" ]" | |
| 131 " }," | |
| 132 " \"recommended\": {" | |
| 133 " \"HomepageLocation\": \"google.com\"" | |
| 134 " }" | |
| 135 " }," | |
| 136 " \"managed_users\": [ \"*\" ]," | |
| 137 " \"policy_user\": \"%s\"," | |
| 138 " \"current_key_index\": %d" | |
| 139 "}"; | |
| 140 | |
| 141 return base::StringPrintf(kTestPolicy, | |
| 142 dm_protocol::kChromeUserPolicyType, | |
| 143 GetTestUser(), | |
| 144 key_version); | |
| 145 } | |
| 146 | |
| 147 void GetExpectedTestPolicy(PolicyMap* expected) { | |
| 148 expected->Set(key::kShowHomeButton, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, | |
| 149 base::Value::CreateBooleanValue(true)); | |
| 150 expected->Set(key::kMaxConnectionsPerProxy, POLICY_LEVEL_MANDATORY, | |
| 151 POLICY_SCOPE_USER, base::Value::CreateIntegerValue(42)); | |
| 152 base::ListValue list; | |
| 153 list.AppendString("dev.chromium.org"); | |
| 154 list.AppendString("youtube.com"); | |
| 155 expected->Set( | |
| 156 key::kURLBlacklist, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, | |
| 157 list.DeepCopy()); | |
| 158 expected->Set( | |
| 159 key::kHomepageLocation, POLICY_LEVEL_RECOMMENDED, | |
| 160 POLICY_SCOPE_USER, base::Value::CreateStringValue("google.com")); | |
| 161 } | |
| 162 | |
| 163 } // namespace | |
| 164 | |
| 165 // Tests the cloud policy stack(s). | |
| 166 class CloudPolicyTest : public InProcessBrowserTest { | |
| 167 protected: | |
| 168 CloudPolicyTest() {} | |
| 169 virtual ~CloudPolicyTest() {} | |
| 170 | |
| 171 virtual void SetUpInProcessBrowserTestFixture() OVERRIDE { | |
| 172 ASSERT_TRUE(temp_dir_.CreateUniqueTempDir()); | |
| 173 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetEmptyPolicy())); | |
| 174 | |
| 175 test_server_.reset(new LocalPolicyTestServer(policy_file_path())); | |
| 176 ASSERT_TRUE(test_server_->Start()); | |
| 177 | |
| 178 std::string url = test_server_->GetServiceURL().spec(); | |
| 179 | |
| 180 CommandLine* command_line = CommandLine::ForCurrentProcess(); | |
| 181 command_line->AppendSwitchASCII(switches::kDeviceManagementUrl, url); | |
| 182 | |
| 183 #if defined(OS_CHROMEOS) | |
| 184 PathService::Override(chrome::DIR_USER_POLICY_KEYS, user_policy_key_dir()); | |
| 185 | |
| 186 mock_dbus_thread_manager_ = new chromeos::MockDBusThreadManager(); | |
| 187 chromeos::DBusThreadManager::InitializeForTesting( | |
| 188 mock_dbus_thread_manager_); | |
| 189 EXPECT_CALL(*mock_dbus_thread_manager_->mock_cryptohome_client(), | |
| 190 GetSanitizedUsername(_, _)) | |
| 191 .WillRepeatedly(GetSanitizedUsername()); | |
| 192 EXPECT_CALL(*mock_dbus_thread_manager_->mock_session_manager_client(), | |
| 193 StoreUserPolicy(_, _)) | |
| 194 .WillRepeatedly(StoreUserPolicy(&session_manager_user_policy_, | |
| 195 user_policy_key_file())); | |
| 196 EXPECT_CALL(*mock_dbus_thread_manager_->mock_session_manager_client(), | |
| 197 RetrieveUserPolicy(_)) | |
| 198 .WillRepeatedly(RetrieveUserPolicy(&session_manager_user_policy_)); | |
| 199 #endif | |
| 200 } | |
| 201 | |
| 202 virtual void SetUpOnMainThread() OVERRIDE { | |
| 203 ASSERT_TRUE(PolicyServiceIsEmpty(g_browser_process->policy_service())) | |
| 204 << "Pre-existing policies in this machine will make this test fail."; | |
| 205 | |
| 206 BrowserPolicyConnector* connector = | |
| 207 g_browser_process->browser_policy_connector(); | |
| 208 connector->ScheduleServiceInitialization(0); | |
| 209 | |
| 210 #if defined(OS_CHROMEOS) | |
| 211 UserCloudPolicyManagerChromeOS* policy_manager = | |
| 212 connector->GetUserCloudPolicyManager(); | |
| 213 ASSERT_TRUE(policy_manager); | |
| 214 #else | |
| 215 // Mock a signed-in user. This is used by the UserCloudPolicyStore to pass | |
| 216 // the username to the UserCloudPolicyValidator. | |
| 217 SigninManager* signin_manager = | |
| 218 SigninManagerFactory::GetForProfile(browser()->profile()); | |
| 219 ASSERT_TRUE(signin_manager); | |
| 220 signin_manager->SetAuthenticatedUsername(GetTestUser()); | |
| 221 | |
| 222 UserCloudPolicyManager* policy_manager = | |
| 223 UserCloudPolicyManagerFactory::GetForProfile(browser()->profile()); | |
| 224 ASSERT_TRUE(policy_manager); | |
| 225 policy_manager->Connect(g_browser_process->local_state(), | |
| 226 UserCloudPolicyManager::CreateCloudPolicyClient( | |
| 227 connector->device_management_service()).Pass()); | |
| 228 #endif // defined(OS_CHROMEOS) | |
| 229 | |
| 230 ASSERT_TRUE(policy_manager->core()->client()); | |
| 231 base::RunLoop run_loop; | |
| 232 MockCloudPolicyClientObserver observer; | |
| 233 EXPECT_CALL(observer, OnRegistrationStateChanged(_)).WillOnce( | |
| 234 InvokeWithoutArgs(&run_loop, &base::RunLoop::Quit)); | |
| 235 policy_manager->core()->client()->AddObserver(&observer); | |
| 236 | |
| 237 // Give a bogus OAuth token to the |policy_manager|. This should make its | |
| 238 // CloudPolicyClient fetch the DMToken. | |
| 239 policy_manager->RegisterClient("bogus"); | |
| 240 run_loop.Run(); | |
| 241 Mock::VerifyAndClearExpectations(&observer); | |
| 242 policy_manager->core()->client()->RemoveObserver(&observer); | |
| 243 } | |
| 244 | |
| 245 #if defined(OS_CHROMEOS) | |
| 246 base::FilePath user_policy_key_dir() { | |
| 247 return temp_dir_.path().AppendASCII("user_policy"); | |
| 248 } | |
| 249 | |
| 250 base::FilePath user_policy_key_file() { | |
| 251 return user_policy_key_dir().AppendASCII(kSanitizedUsername) | |
| 252 .AppendASCII("policy.pub"); | |
| 253 } | |
| 254 #endif | |
| 255 | |
| 256 void SetServerPolicy(const std::string& policy) { | |
| 257 int result = file_util::WriteFile(policy_file_path(), policy.data(), | |
| 258 policy.size()); | |
| 259 ASSERT_EQ(static_cast<int>(policy.size()), result); | |
| 260 } | |
| 261 | |
| 262 base::FilePath policy_file_path() const { | |
| 263 return temp_dir_.path().AppendASCII("policy.json"); | |
| 264 } | |
| 265 | |
| 266 base::ScopedTempDir temp_dir_; | |
| 267 scoped_ptr<LocalPolicyTestServer> test_server_; | |
| 268 | |
| 269 #if defined(OS_CHROMEOS) | |
| 270 std::string session_manager_user_policy_; | |
| 271 chromeos::MockDBusThreadManager* mock_dbus_thread_manager_; | |
| 272 #endif | |
| 273 }; | |
| 274 | |
| 275 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, FetchPolicy) { | |
| 276 PolicyService* policy_service = browser()->profile()->GetPolicyService(); | |
| 277 { | |
| 278 base::RunLoop run_loop; | |
| 279 // This does the initial fetch and stores the initial key. | |
| 280 policy_service->RefreshPolicies(run_loop.QuitClosure()); | |
| 281 run_loop.Run(); | |
| 282 } | |
| 283 | |
| 284 PolicyMap empty; | |
| 285 EXPECT_TRUE(empty.Equals(policy_service->GetPolicies( | |
| 286 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); | |
| 287 | |
| 288 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy(0))); | |
| 289 PolicyMap expected; | |
| 290 GetExpectedTestPolicy(&expected); | |
| 291 { | |
| 292 base::RunLoop run_loop; | |
| 293 // This fetches the new policies, using the same key. | |
| 294 policy_service->RefreshPolicies(run_loop.QuitClosure()); | |
| 295 run_loop.Run(); | |
| 296 } | |
| 297 EXPECT_TRUE(expected.Equals(policy_service->GetPolicies( | |
| 298 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); | |
| 299 } | |
| 300 | |
| 301 #if defined(OS_CHROMEOS) | |
| 302 IN_PROC_BROWSER_TEST_F(CloudPolicyTest, FetchPolicyWithRotatedKey) { | |
| 303 PolicyService* policy_service = browser()->profile()->GetPolicyService(); | |
| 304 { | |
| 305 base::RunLoop run_loop; | |
| 306 // This does the initial fetch and stores the initial key. | |
| 307 policy_service->RefreshPolicies(run_loop.QuitClosure()); | |
| 308 run_loop.Run(); | |
| 309 } | |
| 310 | |
| 311 // Read the initial key. | |
| 312 std::string initial_key; | |
| 313 ASSERT_TRUE( | |
| 314 file_util::ReadFileToString(user_policy_key_file(), &initial_key)); | |
| 315 | |
| 316 PolicyMap empty; | |
| 317 EXPECT_TRUE(empty.Equals(policy_service->GetPolicies( | |
| 318 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); | |
| 319 | |
| 320 // Set the new policies and a new key at the server. | |
| 321 ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetTestPolicy(1))); | |
| 322 PolicyMap expected; | |
| 323 GetExpectedTestPolicy(&expected); | |
| 324 { | |
| 325 base::RunLoop run_loop; | |
| 326 // This fetches the new policies and does a key rotation. | |
| 327 policy_service->RefreshPolicies(run_loop.QuitClosure()); | |
| 328 run_loop.Run(); | |
| 329 } | |
| 330 EXPECT_TRUE(expected.Equals(policy_service->GetPolicies( | |
| 331 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); | |
| 332 | |
| 333 // Verify that the key was rotated. | |
| 334 std::string rotated_key; | |
| 335 ASSERT_TRUE( | |
| 336 file_util::ReadFileToString(user_policy_key_file(), &rotated_key)); | |
| 337 EXPECT_NE(rotated_key, initial_key); | |
| 338 | |
| 339 // Another refresh using the same key won't rotate it again. | |
| 340 { | |
| 341 base::RunLoop run_loop; | |
| 342 policy_service->RefreshPolicies(run_loop.QuitClosure()); | |
| 343 run_loop.Run(); | |
| 344 } | |
| 345 EXPECT_TRUE(expected.Equals(policy_service->GetPolicies( | |
| 346 PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())))); | |
| 347 std::string current_key; | |
| 348 ASSERT_TRUE( | |
| 349 file_util::ReadFileToString(user_policy_key_file(), ¤t_key)); | |
| 350 EXPECT_EQ(rotated_key, current_key); | |
| 351 } | |
| 352 #endif | |
| 353 | |
| 354 TEST(CloudPolicyProtoTest, VerifyProtobufEquivalence) { | |
| 355 // There are 2 protobufs that can be used for user cloud policy: | |
| 356 // cloud_policy.proto and chrome_settings.proto. chrome_settings.proto is the | |
| 357 // version used by the server, but generates one proto message per policy; to | |
| 358 // save binary size on the client, the other version shares proto messages for | |
| 359 // policies of the same type. They generate the same bytes on the wire though, | |
| 360 // so they are compatible. This test verifies that that stays true. | |
| 361 | |
| 362 // Build a ChromeSettingsProto message with one policy of each supported type. | |
| 363 em::ChromeSettingsProto chrome_settings; | |
| 364 chrome_settings.mutable_homepagelocation()->set_homepagelocation( | |
| 365 "chromium.org"); | |
| 366 chrome_settings.mutable_showhomebutton()->set_showhomebutton(true); | |
| 367 chrome_settings.mutable_policyrefreshrate()->set_policyrefreshrate(100); | |
| 368 em::StringList* list = | |
| 369 chrome_settings.mutable_disabledschemes()->mutable_disabledschemes(); | |
| 370 list->add_entries("ftp"); | |
| 371 list->add_entries("mailto"); | |
| 372 // Try explicitly setting a policy mode too. | |
| 373 chrome_settings.mutable_disablespdy()->set_disablespdy(false); | |
| 374 chrome_settings.mutable_disablespdy()->mutable_policy_options()->set_mode( | |
| 375 em::PolicyOptions::MANDATORY); | |
| 376 chrome_settings.mutable_syncdisabled()->set_syncdisabled(true); | |
| 377 chrome_settings.mutable_syncdisabled()->mutable_policy_options()->set_mode( | |
| 378 em::PolicyOptions::RECOMMENDED); | |
| 379 | |
| 380 // Build an equivalent CloudPolicySettings message. | |
| 381 em::CloudPolicySettings cloud_policy; | |
| 382 cloud_policy.mutable_homepagelocation()->set_value("chromium.org"); | |
| 383 cloud_policy.mutable_showhomebutton()->set_value(true); | |
| 384 cloud_policy.mutable_policyrefreshrate()->set_value(100); | |
| 385 list = cloud_policy.mutable_disabledschemes()->mutable_value(); | |
| 386 list->add_entries("ftp"); | |
| 387 list->add_entries("mailto"); | |
| 388 cloud_policy.mutable_disablespdy()->set_value(false); | |
| 389 cloud_policy.mutable_disablespdy()->mutable_policy_options()->set_mode( | |
| 390 em::PolicyOptions::MANDATORY); | |
| 391 cloud_policy.mutable_syncdisabled()->set_value(true); | |
| 392 cloud_policy.mutable_syncdisabled()->mutable_policy_options()->set_mode( | |
| 393 em::PolicyOptions::RECOMMENDED); | |
| 394 | |
| 395 // They should now serialize to the same bytes. | |
| 396 std::string chrome_settings_serialized; | |
| 397 std::string cloud_policy_serialized; | |
| 398 ASSERT_TRUE(chrome_settings.SerializeToString(&chrome_settings_serialized)); | |
| 399 ASSERT_TRUE(cloud_policy.SerializeToString(&cloud_policy_serialized)); | |
| 400 EXPECT_EQ(chrome_settings_serialized, cloud_policy_serialized); | |
| 401 } | |
| 402 | |
| 403 } // namespace policy | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 12189011:
Split up chrome/browser/policy subdirectory (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src