| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "chrome/browser/chromeos/policy/network_configuration_updater.h" | |
| 6 | |
| 7 #include "base/command_line.h" | |
| 8 #include "base/file_util.h" | |
| 9 #include "base/files/file_path.h" | |
| 10 #include "base/memory/scoped_ptr.h" | |
| 11 #include "base/message_loop.h" | |
| 12 #include "base/run_loop.h" | |
| 13 #include "chrome/browser/chromeos/cros/mock_network_library.h" | |
| 14 #include "chrome/browser/policy/mock_configuration_policy_provider.h" | |
| 15 #include "chrome/browser/policy/policy_map.h" | |
| 16 #include "chrome/browser/policy/policy_service_impl.h" | |
| 17 #include "chrome/common/chrome_switches.h" | |
| 18 #include "chromeos/network/onc/onc_constants.h" | |
| 19 #include "chromeos/network/onc/onc_utils.h" | |
| 20 #include "content/public/test/test_browser_thread.h" | |
| 21 #include "content/public/test/test_utils.h" | |
| 22 #include "net/base/test_data_directory.h" | |
| 23 #include "net/cert/cert_trust_anchor_provider.h" | |
| 24 #include "net/cert/x509_certificate.h" | |
| 25 #include "net/test/cert_test_util.h" | |
| 26 #include "policy/policy_constants.h" | |
| 27 #include "testing/gmock/include/gmock/gmock.h" | |
| 28 #include "testing/gtest/include/gtest/gtest.h" | |
| 29 | |
| 30 using testing::AnyNumber; | |
| 31 using testing::Mock; | |
| 32 using testing::Ne; | |
| 33 using testing::Return; | |
| 34 using testing::_; | |
| 35 | |
| 36 namespace policy { | |
| 37 | |
| 38 namespace { | |
| 39 | |
| 40 const char kFakeONC[] = "{ \"GUID\": \"1234\" }"; | |
| 41 | |
| 42 ACTION_P(SetCertificateList, list) { | |
| 43 *arg3 = list; | |
| 44 return true; | |
| 45 } | |
| 46 | |
| 47 } // namespace | |
| 48 | |
| 49 class NetworkConfigurationUpdaterTest | |
| 50 : public testing::TestWithParam<const char*>{ | |
| 51 protected: | |
| 52 NetworkConfigurationUpdaterTest() | |
| 53 : ui_thread_(content::BrowserThread::UI, &loop_), | |
| 54 io_thread_(content::BrowserThread::IO, &loop_) {} | |
| 55 | |
| 56 virtual void SetUp() OVERRIDE { | |
| 57 EXPECT_CALL(provider_, IsInitializationComplete(_)) | |
| 58 .WillRepeatedly(Return(true)); | |
| 59 provider_.Init(); | |
| 60 PolicyServiceImpl::Providers providers; | |
| 61 providers.push_back(&provider_); | |
| 62 policy_service_.reset(new PolicyServiceImpl(providers)); | |
| 63 | |
| 64 CommandLine* command_line = CommandLine::ForCurrentProcess(); | |
| 65 command_line->AppendSwitch(switches::kEnableWebTrustCerts); | |
| 66 } | |
| 67 | |
| 68 virtual void TearDown() OVERRIDE { | |
| 69 provider_.Shutdown(); | |
| 70 content::RunAllPendingInMessageLoop(content::BrowserThread::IO); | |
| 71 } | |
| 72 | |
| 73 void UpdateProviderPolicy(const PolicyMap& policy) { | |
| 74 provider_.UpdateChromePolicy(policy); | |
| 75 base::RunLoop loop; | |
| 76 loop.RunUntilIdle(); | |
| 77 } | |
| 78 | |
| 79 // Maps configuration policy name to corresponding ONC source. | |
| 80 static chromeos::onc::ONCSource NameToONCSource( | |
| 81 const std::string& name) { | |
| 82 if (name == key::kDeviceOpenNetworkConfiguration) | |
| 83 return chromeos::onc::ONC_SOURCE_DEVICE_POLICY; | |
| 84 if (name == key::kOpenNetworkConfiguration) | |
| 85 return chromeos::onc::ONC_SOURCE_USER_POLICY; | |
| 86 return chromeos::onc::ONC_SOURCE_NONE; | |
| 87 } | |
| 88 | |
| 89 chromeos::MockNetworkLibrary network_library_; | |
| 90 MockConfigurationPolicyProvider provider_; | |
| 91 scoped_ptr<PolicyServiceImpl> policy_service_; | |
| 92 MessageLoop loop_; | |
| 93 content::TestBrowserThread ui_thread_; | |
| 94 content::TestBrowserThread io_thread_; | |
| 95 }; | |
| 96 | |
| 97 TEST_P(NetworkConfigurationUpdaterTest, InitialUpdates) { | |
| 98 PolicyMap policy; | |
| 99 policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, | |
| 100 Value::CreateStringValue(kFakeONC)); | |
| 101 UpdateProviderPolicy(policy); | |
| 102 | |
| 103 EXPECT_CALL(network_library_, AddNetworkProfileObserver(_)); | |
| 104 | |
| 105 // Initially, only the device policy is applied. The user policy is only | |
| 106 // applied after the user profile was initialized. | |
| 107 const char* device_onc = GetParam() == key::kDeviceOpenNetworkConfiguration ? | |
| 108 kFakeONC : chromeos::onc::kEmptyUnencryptedConfiguration; | |
| 109 EXPECT_CALL(network_library_, LoadOncNetworks( | |
| 110 device_onc, "", chromeos::onc::ONC_SOURCE_DEVICE_POLICY, _)); | |
| 111 | |
| 112 { | |
| 113 NetworkConfigurationUpdater updater(policy_service_.get(), | |
| 114 &network_library_); | |
| 115 Mock::VerifyAndClearExpectations(&network_library_); | |
| 116 | |
| 117 // After the user policy is initialized, we always push both policies to the | |
| 118 // NetworkLibrary. | |
| 119 EXPECT_CALL(network_library_, LoadOncNetworks( | |
| 120 kFakeONC, "", NameToONCSource(GetParam()), _)); | |
| 121 EXPECT_CALL(network_library_, LoadOncNetworks( | |
| 122 chromeos::onc::kEmptyUnencryptedConfiguration, | |
| 123 "", | |
| 124 Ne(NameToONCSource(GetParam())), | |
| 125 _)); | |
| 126 | |
| 127 EXPECT_CALL(network_library_, RemoveNetworkProfileObserver(_)); | |
| 128 | |
| 129 updater.OnUserPolicyInitialized(); | |
| 130 } | |
| 131 Mock::VerifyAndClearExpectations(&network_library_); | |
| 132 } | |
| 133 | |
| 134 TEST_P(NetworkConfigurationUpdaterTest, AllowTrustedCertificatesFromPolicy) { | |
| 135 { | |
| 136 EXPECT_CALL(network_library_, AddNetworkProfileObserver(_)); | |
| 137 | |
| 138 const net::CertificateList empty_cert_list; | |
| 139 | |
| 140 const net::CertificateList cert_list = | |
| 141 net::CreateCertificateListFromFile(net::GetTestCertsDirectory(), | |
| 142 "ok_cert.pem", | |
| 143 net::X509Certificate::FORMAT_AUTO); | |
| 144 ASSERT_EQ(1u, cert_list.size()); | |
| 145 | |
| 146 EXPECT_CALL(network_library_, LoadOncNetworks(_, _, _, _)) | |
| 147 .WillRepeatedly(SetCertificateList(empty_cert_list)); | |
| 148 NetworkConfigurationUpdater updater(policy_service_.get(), | |
| 149 &network_library_); | |
| 150 net::CertTrustAnchorProvider* trust_provider = | |
| 151 updater.GetCertTrustAnchorProvider(); | |
| 152 ASSERT_TRUE(trust_provider); | |
| 153 // The initial list of trust anchors is empty. | |
| 154 content::RunAllPendingInMessageLoop(content::BrowserThread::IO); | |
| 155 EXPECT_TRUE(trust_provider->GetAdditionalTrustAnchors().empty()); | |
| 156 | |
| 157 // Initially, certificates imported from policy don't have trust flags. | |
| 158 updater.OnUserPolicyInitialized(); | |
| 159 content::RunAllPendingInMessageLoop(content::BrowserThread::IO); | |
| 160 Mock::VerifyAndClearExpectations(&network_library_); | |
| 161 EXPECT_TRUE(trust_provider->GetAdditionalTrustAnchors().empty()); | |
| 162 | |
| 163 // Certificates with the "Web" trust flag set should be forwarded to the | |
| 164 // trust provider. | |
| 165 EXPECT_CALL(network_library_, LoadOncNetworks(_, _, _, _)) | |
| 166 .WillRepeatedly(SetCertificateList(empty_cert_list)); | |
| 167 chromeos::onc::ONCSource current_source = NameToONCSource(GetParam()); | |
| 168 EXPECT_CALL(network_library_, LoadOncNetworks(_, _, current_source, _)) | |
| 169 .WillRepeatedly(SetCertificateList(cert_list)); | |
| 170 updater.set_allow_trusted_certificates_from_policy(true); | |
| 171 // Trigger a policy update. | |
| 172 PolicyMap policy; | |
| 173 policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, | |
| 174 base::Value::CreateStringValue(kFakeONC)); | |
| 175 UpdateProviderPolicy(policy); | |
| 176 Mock::VerifyAndClearExpectations(&network_library_); | |
| 177 | |
| 178 // Certificates are only provided as trust anchors if they come from user | |
| 179 // policy. | |
| 180 size_t expected_certs = 0u; | |
| 181 if (GetParam() == key::kOpenNetworkConfiguration) | |
| 182 expected_certs = 1u; | |
| 183 EXPECT_EQ(expected_certs, | |
| 184 trust_provider->GetAdditionalTrustAnchors().size()); | |
| 185 | |
| 186 EXPECT_CALL(network_library_, RemoveNetworkProfileObserver(_)); | |
| 187 } | |
| 188 Mock::VerifyAndClearExpectations(&network_library_); | |
| 189 } | |
| 190 | |
| 191 TEST_P(NetworkConfigurationUpdaterTest, PolicyChange) { | |
| 192 { | |
| 193 EXPECT_CALL(network_library_, AddNetworkProfileObserver(_)); | |
| 194 | |
| 195 // Ignore the initial updates. | |
| 196 EXPECT_CALL(network_library_, LoadOncNetworks(_, _, _, _)) | |
| 197 .Times(AnyNumber()); | |
| 198 NetworkConfigurationUpdater updater(policy_service_.get(), | |
| 199 &network_library_); | |
| 200 updater.OnUserPolicyInitialized(); | |
| 201 Mock::VerifyAndClearExpectations(&network_library_); | |
| 202 | |
| 203 // We should update if policy changes. | |
| 204 EXPECT_CALL(network_library_, LoadOncNetworks( | |
| 205 kFakeONC, "", NameToONCSource(GetParam()), _)); | |
| 206 | |
| 207 // In the current implementation, we always apply both policies. | |
| 208 EXPECT_CALL(network_library_, LoadOncNetworks( | |
| 209 chromeos::onc::kEmptyUnencryptedConfiguration, | |
| 210 "", | |
| 211 Ne(NameToONCSource(GetParam())), | |
| 212 _)); | |
| 213 | |
| 214 PolicyMap policy; | |
| 215 policy.Set(GetParam(), POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, | |
| 216 Value::CreateStringValue(kFakeONC)); | |
| 217 UpdateProviderPolicy(policy); | |
| 218 Mock::VerifyAndClearExpectations(&network_library_); | |
| 219 | |
| 220 // Another update is expected if the policy goes away. In the current | |
| 221 // implementation, we always apply both policies. | |
| 222 EXPECT_CALL(network_library_, LoadOncNetworks( | |
| 223 chromeos::onc::kEmptyUnencryptedConfiguration, "", | |
| 224 chromeos::onc::ONC_SOURCE_DEVICE_POLICY, _)); | |
| 225 | |
| 226 EXPECT_CALL(network_library_, LoadOncNetworks( | |
| 227 chromeos::onc::kEmptyUnencryptedConfiguration, "", | |
| 228 chromeos::onc::ONC_SOURCE_USER_POLICY, _)); | |
| 229 | |
| 230 EXPECT_CALL(network_library_, RemoveNetworkProfileObserver(_)); | |
| 231 | |
| 232 policy.Erase(GetParam()); | |
| 233 UpdateProviderPolicy(policy); | |
| 234 } | |
| 235 Mock::VerifyAndClearExpectations(&network_library_); | |
| 236 } | |
| 237 | |
| 238 INSTANTIATE_TEST_CASE_P( | |
| 239 NetworkConfigurationUpdaterTestInstance, | |
| 240 NetworkConfigurationUpdaterTest, | |
| 241 testing::Values(key::kDeviceOpenNetworkConfiguration, | |
| 242 key::kOpenNetworkConfiguration)); | |
| 243 | |
| 244 } // namespace policy | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 12676017:
Adding policy support to the new network configuration stack. (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src