Device registration using an enrollment certificate from the PCA.

chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
 
 #include <stdint.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 15 matching lines @@
 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
 #include "chrome/browser/chromeos/settings/device_settings_service.h"
 #include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
 #include "chrome/browser/prefs/browser_prefs.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chrome/test/base/testing_profile.h"
+#include "chromeos/attestation/mock_attestation_flow.h"
+#include "chromeos/cryptohome/async_method_caller.h"
 #include "chromeos/cryptohome/system_salt_getter.h"
 #include "chromeos/dbus/dbus_client_implementation_type.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/fake_cryptohome_client.h"
 #include "chromeos/dbus/fake_session_manager_client.h"
 #include "chromeos/system/fake_statistics_provider.h"
 #include "chromeos/system/statistics_provider.h"
 #include "components/policy/core/common/cloud/cloud_policy_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/policy/core/common/cloud/cloud_policy_core.h"
 #include "components/policy/core/common/cloud/mock_device_management_service.h"
 #include "components/policy/core/common/external_data_fetcher.h"
 #include "components/policy/core/common/policy_types.h"
 #include "components/policy/core/common/schema_registry.h"
 #include "components/policy/policy_constants.h"
 #include "components/policy/proto/device_management_backend.pb.h"
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/testing_pref_service.h"
 #include "google_apis/gaia/gaia_oauth_client.h"
 #include "net/url_request/test_url_fetcher_factory.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using testing::AnyNumber;
 using testing::AtMost;
 using testing::DoAll;
+using testing::Invoke;
 using testing::Mock;
 using testing::Return;
 using testing::SaveArg;
 using testing::SetArgumentPointee;
+using testing::StrictMock;
+using testing::WithArgs;
 using testing::_;
 
 namespace em = enterprise_management;
 
 namespace policy {
 namespace {
 
 void CopyLockResult(base::RunLoop* loop,
                     EnterpriseInstallAttributes::LockResult* out,
                     EnterpriseInstallAttributes::LockResult result) {
   *out = result;
   loop->Quit();
 }
 
+void CertCallbackSuccess(
+    const chromeos::attestation::AttestationFlow::CertificateCallback&
+        callback) {
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE, base::Bind(callback, true, "fake_cert"));
+}
+
 class TestingDeviceCloudPolicyManagerChromeOS
     : public DeviceCloudPolicyManagerChromeOS {
  public:
   TestingDeviceCloudPolicyManagerChromeOS(
       std::unique_ptr<DeviceCloudPolicyStoreChromeOS> store,
       const scoped_refptr<base::SequencedTaskRunner>& task_runner,
       ServerBackedStateKeysBroker* state_keys_broker)
       : DeviceCloudPolicyManagerChromeOS(std::move(store),
                                          task_runner,
                                          state_keys_broker) {}
@@ skipping 14 matching lines @@
     state_keys.push_back("1");
     state_keys.push_back("2");
     state_keys.push_back("3");
     fake_session_manager_client_.set_server_backed_state_keys(state_keys);
   }
 
   ~DeviceCloudPolicyManagerChromeOSTest() override {
     chromeos::system::StatisticsProvider::SetTestProvider(NULL);
   }
 
+  virtual bool ShouldRegisterWitCert() const { return false; }
+
   void SetUp() override {
     DeviceSettingsTestBase::SetUp();
-
     dbus_setter_->SetCryptohomeClient(
         std::unique_ptr<chromeos::CryptohomeClient>(fake_cryptohome_client_));
+    chromeos::DBusThreadManager::Get()->GetCryptohomeClient();
+    cryptohome::AsyncMethodCaller::Initialize();
 
     install_attributes_.reset(
         new EnterpriseInstallAttributes(fake_cryptohome_client_));
     store_ = new DeviceCloudPolicyStoreChromeOS(
         &device_settings_service_, install_attributes_.get(),
         base::ThreadTaskRunnerHandle::Get());
     manager_.reset(new TestingDeviceCloudPolicyManagerChromeOS(
         base::WrapUnique(store_), base::ThreadTaskRunnerHandle::Get(),
         &state_keys_broker_));
 
@@ skipping 12 matching lines @@
     chromeos::SystemSaltGetter::Initialize();
     chromeos::DeviceOAuth2TokenServiceFactory::Initialize();
     url_fetcher_response_code_ = 200;
     url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
                                    "\"expires_in\":1234,"
                                    "\"refresh_token\":\"refreshToken4Test\"}";
 
     AllowUninterestingRemoteCommandFetches();
   }
 
+  StrictMock<chromeos::attestation::MockAttestationFlow>*
+  CreateAttestationFlow() {
+    StrictMock<chromeos::attestation::MockAttestationFlow>* mock =
+        new StrictMock<chromeos::attestation::MockAttestationFlow>();
+    if (ShouldRegisterWitCert()) {
+      EXPECT_CALL(*mock, GetCertificate(_, _, _, _, _))
+          .WillOnce(WithArgs<4>(Invoke(CertCallbackSuccess)));
+    }
+    return mock;
+  }
+
   void TearDown() override {
+    cryptohome::AsyncMethodCaller::Shutdown();
+
     manager_->RemoveDeviceCloudPolicyManagerObserver(this);
     manager_->Shutdown();
     if (initializer_)
       initializer_->Shutdown();
     DeviceSettingsTestBase::TearDown();
 
     chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
     chromeos::SystemSaltGetter::Shutdown();
     TestingBrowserProcess::GetGlobal()->SetLocalState(NULL);
   }
 
   void LockDevice() {
     base::RunLoop loop;
     EnterpriseInstallAttributes::LockResult result;
     install_attributes_->LockDevice(
         PolicyBuilder::kFakeUsername,
         DEVICE_MODE_ENTERPRISE,
         PolicyBuilder::kFakeDeviceId,
         base::Bind(&CopyLockResult, &loop, &result));
     loop.Run();
     ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
   }
 
   void ConnectManager() {
+    std::unique_ptr<chromeos::attestation::AttestationFlow> unique_flow(
+        CreateAttestationFlow());
     manager_->Initialize(&local_state_);
     manager_->AddDeviceCloudPolicyManagerObserver(this);
     initializer_.reset(new DeviceCloudPolicyInitializer(
         &local_state_, &device_management_service_,
         base::ThreadTaskRunnerHandle::Get(), install_attributes_.get(),
-        &state_keys_broker_, store_, manager_.get(), nullptr, nullptr));
+        &state_keys_broker_, store_, manager_.get(),
+        cryptohome::AsyncMethodCaller::GetInstance(), std::move(unique_flow)));
     initializer_->Init();
   }
 
   void VerifyPolicyPopulated() {
     PolicyBundle bundle;
     bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
         .Set(key::kDeviceMetricsReportingEnabled, POLICY_LEVEL_MANDATORY,
              POLICY_SCOPE_MACHINE, POLICY_SOURCE_CLOUD,
              base::MakeUnique<base::FundamentalValue>(false), nullptr);
     EXPECT_TRUE(manager_->policies().Equals(bundle));
@@ skipping 28 matching lines @@
   chromeos::ScopedTestCrosSettings test_cros_settings_;
   chromeos::system::ScopedFakeStatisticsProvider fake_statistics_provider_;
   chromeos::FakeSessionManagerClient fake_session_manager_client_;
   chromeos::FakeCryptohomeClient* fake_cryptohome_client_;
   ServerBackedStateKeysBroker state_keys_broker_;
 
   DeviceCloudPolicyStoreChromeOS* store_;
   SchemaRegistry schema_registry_;
   std::unique_ptr<TestingDeviceCloudPolicyManagerChromeOS> manager_;
   std::unique_ptr<DeviceCloudPolicyInitializer> initializer_;
-
  private:
   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSTest);
 };
 
 TEST_F(DeviceCloudPolicyManagerChromeOSTest, FreshDevice) {
   owner_key_util_->Clear();
   FlushDeviceSettings();
   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 
   manager_->Initialize(&local_state_);
@@ skipping 180 matching lines @@
     EXPECT_EQ(EnrollmentStatus::STATUS_SUCCESS, status_.status());
     ASSERT_TRUE(manager_->core()->client());
     EXPECT_TRUE(manager_->core()->client()->is_registered());
     EXPECT_EQ(DEVICE_MODE_ENTERPRISE, install_attributes_->GetMode());
     EXPECT_TRUE(store_->has_policy());
     EXPECT_TRUE(store_->is_managed());
     VerifyPolicyPopulated();
   }
 
   void RunTest() {
+    const bool with_cert = ShouldRegisterWitCert();
     // Trigger enrollment.
     MockDeviceManagementJob* register_job = NULL;
-    EXPECT_CALL(device_management_service_,
-                CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION, _))
+    EXPECT_CALL(
+        device_management_service_,
+        CreateJob(with_cert
+                      ? DeviceManagementRequestJob::TYPE_CERT_BASED_REGISTRATION
+                      : DeviceManagementRequestJob::TYPE_REGISTRATION,
+                  _))
         .Times(AtMost(1))
         .WillOnce(device_management_service_.CreateAsyncJob(&register_job));
     EXPECT_CALL(device_management_service_,
-                StartJob(dm_protocol::kValueRequestRegister, _, _, _, _, _))
+                StartJob(with_cert ? dm_protocol::kValueRequestCertBasedRegister
+                                   : dm_protocol::kValueRequestRegister,
+                         _, _, _, _, _))
         .Times(AtMost(1))
         .WillOnce(
             DoAll(SaveArg<4>(&client_id_), SaveArg<5>(&register_request_)));
     DeviceCloudPolicyInitializer::AllowedDeviceModes modes;
     modes[DEVICE_MODE_ENTERPRISE] = true;
 
     chromeos::OwnerSettingsServiceChromeOS* owner_settings_service =
         chromeos::OwnerSettingsServiceChromeOSFactory::GetForBrowserContext(
             profile_.get());
     ASSERT_TRUE(owner_settings_service);
 
     EnrollmentConfig enrollment_config;
-    enrollment_config.mode = EnrollmentConfig::MODE_MANUAL;
+    enrollment_config.auth_mechanism =
+        EnrollmentConfig::AUTH_MECHANISM_BEST_AVAILABLE;
+    enrollment_config.mode = with_cert ? EnrollmentConfig::MODE_ATTESTATION
+                                       : EnrollmentConfig::MODE_MANUAL;
+    std::string token = with_cert ? "" : "auth token";
     initializer_->StartEnrollment(
-        &device_management_service_, enrollment_config, "auth token", modes,
+        &device_management_service_, enrollment_config, token, modes,
         base::Bind(&DeviceCloudPolicyManagerChromeOSEnrollmentTest::Done,
                    base::Unretained(this)));
     base::RunLoop().RunUntilIdle();
     Mock::VerifyAndClearExpectations(&device_management_service_);
     AllowUninterestingRemoteCommandFetches();
 
     if (done_)
       return;
 
     // Process registration.
@@ skipping 107 matching lines @@
   em::DeviceManagementRequest register_request_;
   std::string client_id_;
   EnrollmentStatus status_;
 
   bool done_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSEnrollmentTest);
 };
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
-  RunTest();
-  ExpectSuccessfulEnrollment();
-}
-
+// TODO(drcrash): Handle cert-based tests (http://crbug.com/641447).
 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Reenrollment) {
   LockDevice();
-
   RunTest();
   ExpectSuccessfulEnrollment();
   EXPECT_TRUE(register_request_.register_request().reregister());
   EXPECT_EQ(PolicyBuilder::kFakeDeviceId, client_id_);
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RegistrationFailed) {
+class ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest
+    : public DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+      public testing::WithParamInterface<bool> {
+ protected:
+  bool ShouldRegisterWitCert() const override { return GetParam(); }
+};
+
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
+  RunTest();
+  ExpectSuccessfulEnrollment();
+}
+
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       RegistrationFailed) {
   register_status_ = DM_STATUS_REQUEST_FAILED;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_REGISTRATION_FAILED);
   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotAuthCodeFetchFailed) {
   robot_auth_fetch_status_ = DM_STATUS_REQUEST_FAILED;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_AUTH_FETCH_FAILED);
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotRefreshTokenFetchResponseCodeFailed) {
   url_fetcher_response_code_ = 400;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
   EXPECT_EQ(400, status_.http_status());
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotRefreshTokenFetchResponseStringFailed) {
   url_fetcher_response_string_ = "invalid response json";
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotRefreshEncryptionFailed) {
   // The encryption lib is a noop for tests, but empty results from encryption
   // is an error, so we simulate an encryption error by returning an empty
   // refresh token.
   url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
                                  "\"expires_in\":1234,"
                                  "\"refresh_token\":\"\"}";
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, PolicyFetchFailed) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       PolicyFetchFailed) {
   policy_fetch_status_ = DM_STATUS_REQUEST_FAILED;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_POLICY_FETCH_FAILED);
   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, ValidationFailed) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       ValidationFailed) {
   device_policy_.policy().set_policy_data_signature("bad");
   policy_fetch_response_.clear_policy_response();
   policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
       device_policy_.policy());
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_VALIDATION_FAILED);
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
             status_.validation_status());
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, StoreError) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       StoreError) {
   store_result_ = false;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
   EXPECT_EQ(CloudPolicyStore::STATUS_STORE_ERROR,
             status_.store_status());
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
   loaded_blob_.clear();
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
   EXPECT_EQ(CloudPolicyStore::STATUS_LOAD_ERROR,
             status_.store_status());
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, UnregisterSucceeds) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       UnregisterSucceeds) {
   // Enroll first.
   RunTest();
   ExpectSuccessfulEnrollment();
 
   // Set up mock objects for the upcoming unregistration job.
   em::DeviceManagementResponse response;
   response.mutable_unregister_response();
   EXPECT_CALL(device_management_service_,
               CreateJob(DeviceManagementRequestJob::TYPE_UNREGISTRATION, _))
       .WillOnce(device_management_service_.SucceedJob(response));
   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _));
   EXPECT_CALL(*this, OnUnregistered(true));
 
   // Start unregistering.
   manager_->Unregister(base::Bind(
       &DeviceCloudPolicyManagerChromeOSEnrollmentTest::OnUnregistered,
       base::Unretained(this)));
 }
 
-TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, UnregisterFails) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       UnregisterFails) {
   // Enroll first.
   RunTest();
   ExpectSuccessfulEnrollment();
 
   // Set up mock objects for the upcoming unregistration job.
   EXPECT_CALL(device_management_service_,
               CreateJob(DeviceManagementRequestJob::TYPE_UNREGISTRATION, _))
       .WillOnce(device_management_service_.FailJob(DM_STATUS_REQUEST_FAILED));
   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _));
   EXPECT_CALL(*this, OnUnregistered(false));
@@ skipping 14 matching lines @@
   }
 };
 
 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentBlankSystemSaltTest,
        RobotRefreshSaveFailed) {
   // Without the system salt, the robot token can't be stored.
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 }
 
+INSTANTIATE_TEST_CASE_P(
+    Cert,
+    ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+    ::testing::Values(false, true));
+
 }  // namespace
 }  // namespace policy