Expose signing key from cloud policy stores

chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h"
 
 #include <stdint.h>
 
 #include <memory>
+#include <string>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/location.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "chromeos/dbus/mock_cryptohome_client.h"
 #include "chromeos/dbus/mock_session_manager_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/policy/core/common/cloud/mock_cloud_policy_store.h"
 #include "components/policy/core/common/cloud/policy_builder.h"
 #include "components/policy/core/common/policy_types.h"
 #include "components/policy/policy_constants.h"
 #include "components/policy/proto/cloud_policy.pb.h"
 #include "components/policy/proto/device_management_local.pb.h"
+#include "crypto/rsa_private_key.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace em = enterprise_management;
 
 using testing::AllOf;
 using testing::AnyNumber;
 using testing::Eq;
 using testing::Mock;
 using testing::Property;
@@ skipping 25 matching lines @@
         .Times(AnyNumber())
         .WillRepeatedly(SendSanitizedUsername(
             chromeos::DBUS_METHOD_CALL_SUCCESS, kSanitizedUsername));
 
     ASSERT_TRUE(tmp_dir_.CreateUniqueTempDir());
     store_.reset(new UserCloudPolicyStoreChromeOS(
         &cryptohome_client_, &session_manager_client_, loop_.task_runner(),
         account_id_, user_policy_dir(), token_file(), policy_file()));
     store_->AddObserver(&observer_);
 
+    CHECK_EQ(PolicyBuilder::kFakeDomain, store_->owning_domain());
+
     // Install the initial public key, so that by default the validation of
     // the stored/loaded policy blob succeeds.
     std::vector<uint8_t> public_key;
     ASSERT_TRUE(policy_.GetSigningKey()->ExportPublicKey(&public_key));
     StoreUserPolicyKey(public_key);
 
     policy_.payload().mutable_homepagelocation()->set_value(kDefaultHomepage);
     policy_.Build();
   }
 
@@ skipping 105 matching lines @@
     VerifyPolicyMap(new_value);
     EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
   }
 
   void VerifyStoreHasValidationError() {
     EXPECT_FALSE(store_->policy());
     EXPECT_TRUE(store_->policy_map().empty());
     EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
   }
 
+  static std::string ConvertPublicKeyToString(
+      const std::vector<uint8_t>& public_key) {
+    return std::string(reinterpret_cast<const char*>(public_key.data()),
+                       public_key.size());
+  }
+
+  std::string GetPolicyPublicKeyAsString() {
+    std::vector<uint8_t> public_key;
+    EXPECT_TRUE(policy_.GetSigningKey()->ExportPublicKey(&public_key));
+    return ConvertPublicKeyToString(public_key);
+  }
+
+  std::string GetPolicyNewPublicKeyAsString() {
+    std::vector<uint8_t> new_public_key;
+    EXPECT_TRUE(policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
+    return ConvertPublicKeyToString(new_public_key);
+  }
+
   base::FilePath user_policy_dir() {
     return tmp_dir_.GetPath().AppendASCII("var_run_user_policy");
   }
 
   base::FilePath user_policy_key_file() {
     return user_policy_dir().AppendASCII(kSanitizedUsername)
                             .AppendASCII("policy.pub");
   }
 
   base::FilePath token_file() {
@@ skipping 24 matching lines @@
 TEST_F(UserCloudPolicyStoreChromeOSTest, InitialStore) {
   // Start without any public key to trigger the initial key checks.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   std::vector<uint8_t> new_public_key;
   ASSERT_TRUE(policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
   ASSERT_NO_FATAL_FAILURE(
       PerformStorePolicy(&new_public_key, NULL, kDefaultHomepage));
+  EXPECT_EQ(ConvertPublicKeyToString(new_public_key), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, InitialStoreValidationFail) {
   // Start without any public key to trigger the initial key checks.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   // Make the policy blob contain a new public key.
   policy_.SetDefaultSigningKey();
   policy_.Build();
   *policy_.policy().mutable_new_public_key_verification_signature_deprecated() =
       "garbage";
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, InitialStoreMissingSignatureFailure) {
   // Start without any public key to trigger the initial key checks.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   // Make the policy blob contain a new public key.
   policy_.SetDefaultSigningKey();
   policy_.Build();
   policy_.policy().clear_new_public_key_verification_signature_deprecated();
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithExistingKey) {
   ASSERT_NO_FATAL_FAILURE(
       PerformStorePolicy(NULL, NULL, kDefaultHomepage));
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithRotation) {
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   std::vector<uint8_t> new_public_key;
   ASSERT_TRUE(policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
   ASSERT_NO_FATAL_FAILURE(
       PerformStorePolicy(&new_public_key, NULL, kDefaultHomepage));
+  EXPECT_EQ(ConvertPublicKeyToString(new_public_key), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest,
        StoreWithRotationMissingSignatureError) {
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   policy_.policy().clear_new_public_key_verification_signature_deprecated();
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithRotationValidationError) {
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   *policy_.policy().mutable_new_public_key_verification_signature_deprecated() =
       "garbage";
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreFail) {
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .WillOnce(SaveArg<2>(&store_callback));
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   ASSERT_FALSE(store_callback.is_null());
 
   // Let the store operation complete.
   ExpectError(CloudPolicyStore::STATUS_STORE_ERROR);
   store_callback.Run(false);
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_STORE_ERROR, store_->status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreValidationError) {
   policy_.policy_data().clear_policy_type();
   policy_.Build();
 
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithoutPolicyKey) {
   // Make the dbus call to cryptohome fail.
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
   EXPECT_CALL(cryptohome_client_, GetSanitizedUsername(cryptohome_id_, _))
       .Times(AnyNumber())
       .WillRepeatedly(SendSanitizedUsername(chromeos::DBUS_METHOD_CALL_FAILURE,
                                             std::string()));
 
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());

[emaxx, 2016/11/08 20:53:36]

There's a tricky semantics here, and I'm not sure whether it's reasonable.
Short explanation:
In this test the public_key_ member got cleared due to the failed session
manager operation. Meanwhile, in several tests above and below the public_key_
was kept after attempts to store invalid policy. So the difference was caused by
the point of the failure: in a pre-validation or during the session manager
operation.
Thiemo, WDYT?

 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithInvalidSignature) {
   // Break the signature.
   policy_.policy().mutable_policy_data_signature()->append("garbage");
 
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, Load) {
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   Mock::VerifyAndClearExpectations(&observer_);
 
   // Verify that the policy has been loaded.
   ASSERT_TRUE(store_->policy());
   EXPECT_EQ(policy_.policy_data().SerializeAsString(),
             store_->policy()->SerializeAsString());
   VerifyPolicyMap(kDefaultHomepage);
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadNoPolicy) {
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(""));
   Mock::VerifyAndClearExpectations(&observer_);
 
   // Verify no policy has been installed.
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadInvalidPolicy) {
   ExpectError(CloudPolicyStore::STATUS_PARSE_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad("invalid"));
 
   // Verify no policy has been installed.
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_PARSE_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadValidationError) {
   policy_.policy_data().clear_policy_type();
   policy_.Build();
 
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   VerifyStoreHasValidationError();
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());

[emaxx, 2016/11/08 20:53:36]

Here's another tricky case.
Here the policy was not loaded (because it's invalid), but the public key was
loaded and exposed. Meanwhile in the two previous tests the key was not exposed
(because it's loaded by UserCloudPolicyStoreChromeOS only _after_ querying
session manager).

 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadNoKey) {
   // The loaded policy can't be verified without the public key.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   VerifyStoreHasValidationError();
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadInvalidSignature) {
   // Break the signature.
   policy_.policy().mutable_policy_data_signature()->append("garbage");
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   VerifyStoreHasValidationError();
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, MigrationFull) {
   std::string data;
 
   em::DeviceCredentials credentials;
   credentials.set_device_token(kLegacyToken);
   credentials.set_device_id(kLegacyDeviceId);
   ASSERT_TRUE(credentials.SerializeToString(&data));
   ASSERT_NE(-1, base::WriteFile(token_file(), data.c_str(), data.size()));
@@ skipping 127 matching lines @@
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
 
   // The policy should become available without having to spin any loops.
   ASSERT_TRUE(store_->policy());
   EXPECT_EQ(policy_.policy_data().SerializeAsString(),
             store_->policy()->SerializeAsString());
   VerifyPolicyMap(kDefaultHomepage);
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyNoPolicy) {
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return(""));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyInvalidBlob) {
   EXPECT_CALL(observer_, OnStoreError(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return("le blob"));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_PARSE_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyDBusFailure) {
   EXPECT_CALL(observer_, OnStoreError(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return(policy_.GetBlob()));
   EXPECT_CALL(cryptohome_client_, BlockingGetSanitizedUsername(cryptohome_id_))
       .WillOnce(Return(""));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_LOAD_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyNoUserPolicyKey) {
   EXPECT_CALL(observer_, OnStoreError(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return(policy_.GetBlob()));
   EXPECT_CALL(cryptohome_client_, BlockingGetSanitizedUsername(cryptohome_id_))
       .WillOnce(Return("wrong@example.com"));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 }  // namespace
 
 }  // namespace policy