Expose signing key from cloud policy stores

chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
 
+#include <stdint.h>
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
 #include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
 #include "chrome/browser/chromeos/settings/install_attributes.h"
 #include "chrome/test/base/scoped_testing_local_state.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chromeos/cryptohome/cryptohome_util.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/fake_cryptohome_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/policy/policy_constants.h"
 #include "components/policy/proto/device_management_backend.pb.h"
 #include "content/public/test/test_utils.h"
+#include "crypto/rsa_private_key.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace em = enterprise_management;
 
 namespace policy {
 
 namespace {
 
 void CopyLockResult(base::RunLoop* loop,
                     chromeos::InstallAttributes::LockResult* out,
@@ skipping 33 matching lines @@
         base::Bind(&CopyLockResult, &loop, &result));
     loop.Run();
     ASSERT_EQ(chromeos::InstallAttributes::LOCK_SUCCESS, result);
   }
 
   void ExpectFailure(CloudPolicyStore::Status expected_status) {
     EXPECT_EQ(expected_status, store_->status());
     EXPECT_TRUE(store_->is_initialized());
     EXPECT_FALSE(store_->has_policy());
     EXPECT_FALSE(store_->is_managed());
+    EXPECT_EQ(std::string(), store_->owning_domain());
+    EXPECT_EQ(std::string(), store_->public_key());
   }
 
   void ExpectSuccess() {
     EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
     EXPECT_TRUE(store_->is_initialized());
     EXPECT_TRUE(store_->has_policy());
     EXPECT_TRUE(store_->is_managed());
     EXPECT_TRUE(store_->policy());
     base::FundamentalValue expected(false);
     EXPECT_TRUE(
         base::Value::Equals(&expected,
                             store_->policy_map().GetValue(
                                 key::kDeviceMetricsReportingEnabled)));
+    EXPECT_EQ(PolicyBuilder::kFakeDomain, store_->owning_domain());
+    EXPECT_NE(std::string(), store_->public_key());
   }
 
   void PrepareExistingPolicy() {
     store_->Load();
     FlushDeviceSettings();
     ExpectSuccess();
 
     device_policy_.UnsetNewSigningKey();
     device_policy_.Build();
   }
 
   void PrepareNewSigningKey() {
     device_policy_.SetDefaultNewSigningKey();
     device_policy_.Build();
     owner_key_util_->SetPublicKeyFromPrivateKey(
         *device_policy_.GetNewSigningKey());
   }
 
   void ResetToNonEnterprise() {
     store_.reset();
     chromeos::cryptohome_util::InstallAttributesSet("enterprise.owned",
                                                     std::string());
     install_attributes_.reset(
         new chromeos::InstallAttributes(fake_cryptohome_client_));
     store_.reset(new DeviceCloudPolicyStoreChromeOS(
         &device_settings_service_, install_attributes_.get(),
         base::ThreadTaskRunnerHandle::Get()));
   }
 
+  static std::string ConvertPublicKeyToString(
+      const std::vector<uint8_t>& public_key) {
+    return std::string(reinterpret_cast<const char*>(public_key.data()),
+                       public_key.size());
+  }
+
+  std::string GetPolicyPublicKeyAsString() {

[emaxx, 2016/11/08 20:53:36]

I'd like to land a separate CL that would move these two operations (the public
key export as a string) straight into PolicyBuilder.
Just didn't want to bloat this CL with this too.

+    std::vector<uint8_t> public_key;
+    EXPECT_TRUE(device_policy_.GetSigningKey()->ExportPublicKey(&public_key));
+    return ConvertPublicKeyToString(public_key);
+  }
+
+  std::string GetPolicyNewPublicKeyAsString() {
+    std::vector<uint8_t> new_public_key;
+    EXPECT_TRUE(
+        device_policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
+    return ConvertPublicKeyToString(new_public_key);
+  }
+
   ScopedTestingLocalState local_state_;
   chromeos::FakeCryptohomeClient* fake_cryptohome_client_;
   std::unique_ptr<chromeos::InstallAttributes> install_attributes_;
 
   std::unique_ptr<DeviceCloudPolicyStoreChromeOS> store_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyStoreChromeOSTest);
 };
 
@@ skipping 15 matching lines @@
   ResetToNonEnterprise();
   store_->Load();
   FlushDeviceSettings();
   ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, LoadSuccess) {
   store_->Load();
   FlushDeviceSettings();
   ExpectSuccess();
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreSuccess) {
   PrepareExistingPolicy();
   store_->Store(device_policy_.policy());
   FlushDeviceSettings();
   ExpectSuccess();
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreNoSignature) {
   PrepareExistingPolicy();
   device_policy_.policy().clear_policy_data_signature();
   store_->Store(device_policy_.policy());
   FlushDeviceSettings();
   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreBadSignature) {
   PrepareExistingPolicy();
   device_policy_.policy().set_policy_data_signature("invalid");
   store_->Store(device_policy_.policy());
   FlushDeviceSettings();
   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, StoreKeyRotation) {
   PrepareExistingPolicy();
   device_policy_.SetDefaultNewSigningKey();
   device_policy_.Build();
   store_->Store(device_policy_.policy());
   content::RunAllBlockingPoolTasksUntilIdle();
   device_settings_test_helper_.FlushStore();
   owner_key_util_->SetPublicKeyFromPrivateKey(
       *device_policy_.GetNewSigningKey());
   ReloadDeviceSettings();
   ExpectSuccess();
+  EXPECT_EQ(GetPolicyNewPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
        StoreKeyRotationVerificationFailure) {
   PrepareExistingPolicy();
   device_policy_.SetDefaultNewSigningKey();
   device_policy_.Build();
   *device_policy_.policy()
        .mutable_new_public_key_verification_signature_deprecated() = "garbage";
   store_->Store(device_policy_.policy());
   FlushDeviceSettings();
   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
        StoreKeyRotationMissingSignatureFailure) {
   PrepareExistingPolicy();
   device_policy_.SetDefaultNewSigningKey();
   device_policy_.Build();
   device_policy_.policy()
       .clear_new_public_key_verification_signature_deprecated();
   store_->Store(device_policy_.policy());
   FlushDeviceSettings();
   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicySuccess) {
   PrepareNewSigningKey();
   store_->InstallInitialPolicy(device_policy_.policy());
   FlushDeviceSettings();
   ExpectSuccess();
+  EXPECT_EQ(GetPolicyNewPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoSignature) {
   PrepareNewSigningKey();
   device_policy_.policy().clear_policy_data_signature();
   store_->InstallInitialPolicy(device_policy_.policy());
   FlushDeviceSettings();
   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
        InstallInitialPolicyVerificationFailure) {
   PrepareNewSigningKey();
   *device_policy_.policy()
        .mutable_new_public_key_verification_signature_deprecated() = "garbage";
   store_->InstallInitialPolicy(device_policy_.policy());
   FlushDeviceSettings();
   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest,
        InstallInitialPolicyMissingSignatureFailure) {
   PrepareNewSigningKey();
   device_policy_.policy()
       .clear_new_public_key_verification_signature_deprecated();
   store_->InstallInitialPolicy(device_policy_.policy());
   FlushDeviceSettings();
   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNoKey) {
   PrepareNewSigningKey();
   device_policy_.policy().clear_new_public_key();
   store_->InstallInitialPolicy(device_policy_.policy());
   FlushDeviceSettings();
   ExpectFailure(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
             store_->validation_status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(DeviceCloudPolicyStoreChromeOSTest, InstallInitialPolicyNotEnterprise) {
   PrepareNewSigningKey();
   ResetToNonEnterprise();
   store_->InstallInitialPolicy(device_policy_.policy());
   FlushDeviceSettings();
   ExpectFailure(CloudPolicyStore::STATUS_BAD_STATE);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 }  // namespace policy