request_handler_for_policy_unittest.cc 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "components/policy/test_support/request_handler_for_policy.h"
  5. #include <utility>
  6. #include "components/policy/core/common/cloud/cloud_policy_constants.h"
  7. #include "components/policy/core/common/cloud/test/policy_builder.h"
  8. #include "components/policy/proto/cloud_policy.pb.h"
  9. #include "components/policy/proto/device_management_backend.pb.h"
  10. #include "components/policy/test_support/client_storage.h"
  11. #include "components/policy/test_support/embedded_policy_test_server_test_base.h"
  12. #include "components/policy/test_support/policy_storage.h"
  13. #include "net/http/http_status_code.h"
  14. #include "testing/gtest/include/gtest/gtest.h"
  15. namespace em = enterprise_management;
  16. namespace policy {
  17. namespace {
  18. constexpr char kDeviceId[] = "fake_device_id";
  19. constexpr char kDeviceToken[] = "fake_device_token";
  20. constexpr char kMachineName[] = "machine_name";
  21. constexpr char kPolicyInvalidationTopic[] = "policy_invalidation_topic";
  22. constexpr char kUsername[] = "user-for-policy@example.com";
  23. #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
  24. constexpr char kPublicAccountEntityId[] = "test_user";
  25. constexpr char kExtensionId[] = "extension_id";
  26. #endif // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
  27. } // namespace
  28. class RequestHandlerForPolicyTest : public EmbeddedPolicyTestServerTestBase {
  29. protected:
  30. RequestHandlerForPolicyTest() = default;
  31. ~RequestHandlerForPolicyTest() override = default;
  32. void SetUp() override {
  33. EmbeddedPolicyTestServerTestBase::SetUp();
  34. SetRequestTypeParam(dm_protocol::kValueRequestPolicy);
  35. SetAppType(dm_protocol::kValueAppType);
  36. SetDeviceIdParam(kDeviceId);
  37. SetDeviceType(dm_protocol::kValueDeviceType);
  38. }
  39. };
  40. TEST_F(RequestHandlerForPolicyTest, HandleRequest_NoDeviceToken) {
  41. StartRequestAndWait();
  42. EXPECT_EQ(GetResponseCode(), net::HTTP_UNAUTHORIZED);
  43. }
  44. TEST_F(RequestHandlerForPolicyTest, HandleRequest_NoRegisteredClient) {
  45. SetDeviceTokenHeader(kDeviceToken);
  46. StartRequestAndWait();
  47. EXPECT_EQ(GetResponseCode(), net::HTTP_GONE);
  48. }
  49. TEST_F(RequestHandlerForPolicyTest, HandleRequest_UnmatchedDeviceId) {
  50. ClientStorage::ClientInfo client_info;
  51. client_info.device_token = "registered-device-token";
  52. client_info.device_id = kDeviceId;
  53. client_info.machine_name = kMachineName;
  54. client_storage()->RegisterClient(std::move(client_info));
  55. SetDeviceTokenHeader(kDeviceToken);
  56. StartRequestAndWait();
  57. EXPECT_EQ(GetResponseCode(), net::HTTP_GONE);
  58. }
  59. TEST_F(RequestHandlerForPolicyTest, HandleRequest_InvalidPolicyType) {
  60. ClientStorage::ClientInfo client_info;
  61. client_info.device_token = kDeviceToken;
  62. client_info.device_id = kDeviceId;
  63. client_info.machine_name = kMachineName;
  64. client_storage()->RegisterClient(std::move(client_info));
  65. em::DeviceManagementRequest device_management_request;
  66. em::PolicyFetchRequest* fetch_request =
  67. device_management_request.mutable_policy_request()->add_requests();
  68. fetch_request->set_policy_type("invalid-policy-type");
  69. SetDeviceTokenHeader(kDeviceToken);
  70. SetPayload(device_management_request);
  71. StartRequestAndWait();
  72. EXPECT_EQ(GetResponseCode(), net::HTTP_BAD_REQUEST);
  73. }
  74. TEST_F(RequestHandlerForPolicyTest, HandleRequest_UnauthorizedPolicyType) {
  75. ClientStorage::ClientInfo client_info;
  76. client_info.device_token = kDeviceToken;
  77. client_info.device_id = kDeviceId;
  78. client_info.machine_name = kMachineName;
  79. client_info.allowed_policy_types.insert(dm_protocol::kChromeDevicePolicyType);
  80. client_storage()->RegisterClient(std::move(client_info));
  81. em::DeviceManagementRequest device_management_request;
  82. em::PolicyFetchRequest* fetch_request =
  83. device_management_request.mutable_policy_request()->add_requests();
  84. fetch_request->set_policy_type(dm_protocol::kChromeRemoteCommandPolicyType);
  85. SetDeviceTokenHeader(kDeviceToken);
  86. SetPayload(device_management_request);
  87. StartRequestAndWait();
  88. EXPECT_EQ(GetResponseCode(), net::HTTP_BAD_REQUEST);
  89. }
  90. TEST_F(RequestHandlerForPolicyTest, HandleRequest_Success_NoSignedPolicies) {
  91. ClientStorage::ClientInfo client_info;
  92. client_info.device_token = kDeviceToken;
  93. client_info.device_id = kDeviceId;
  94. client_info.machine_name = kMachineName;
  95. client_info.username = kUsername;
  96. client_info.allowed_policy_types.insert(
  97. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  98. client_storage()->RegisterClient(client_info);
  99. policy_storage()->set_policy_invalidation_topic(kPolicyInvalidationTopic);
  100. em::CloudPolicySettings settings;
  101. settings.mutable_savingbrowserhistorydisabled()
  102. ->mutable_policy_options()
  103. ->set_mode(em::PolicyOptions::MANDATORY);
  104. settings.mutable_savingbrowserhistorydisabled()->set_value(true);
  105. policy_storage()->SetPolicyPayload(
  106. dm_protocol::kChromeMachineLevelUserCloudPolicyType,
  107. settings.SerializeAsString());
  108. em::DeviceManagementRequest device_management_request;
  109. em::PolicyFetchRequest* fetch_request =
  110. device_management_request.mutable_policy_request()->add_requests();
  111. fetch_request->set_policy_type(
  112. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  113. SetDeviceTokenHeader(kDeviceToken);
  114. SetPayload(device_management_request);
  115. StartRequestAndWait();
  116. EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
  117. ASSERT_TRUE(HasResponseBody());
  118. em::DeviceManagementResponse device_management_response =
  119. GetDeviceManagementResponse();
  120. ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
  121. em::PolicyData policy_data;
  122. policy_data.ParseFromString(
  123. device_management_response.policy_response().responses(0).policy_data());
  124. EXPECT_EQ(policy_data.policy_type(),
  125. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  126. EXPECT_EQ(policy_data.request_token(), client_info.device_token);
  127. EXPECT_EQ(policy_data.policy_value(),
  128. policy_storage()->GetPolicyPayload(
  129. dm_protocol::kChromeMachineLevelUserCloudPolicyType));
  130. EXPECT_EQ(policy_data.machine_name(), client_info.machine_name);
  131. EXPECT_FALSE(policy_data.service_account_identity().empty());
  132. EXPECT_EQ(policy_data.device_id(), client_info.device_id);
  133. EXPECT_EQ(policy_data.username(), kUsername);
  134. EXPECT_EQ(policy_data.policy_invalidation_topic(), kPolicyInvalidationTopic);
  135. EXPECT_FALSE(policy_data.has_public_key_version());
  136. }
  137. TEST_F(RequestHandlerForPolicyTest,
  138. HandleRequest_Success_SignedPoliciesWithoutClientKey) {
  139. ClientStorage::ClientInfo client_info;
  140. client_info.device_token = kDeviceToken;
  141. client_info.device_id = kDeviceId;
  142. client_info.username = kUsername;
  143. client_info.allowed_policy_types.insert(
  144. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  145. client_storage()->RegisterClient(client_info);
  146. em::CloudPolicySettings settings;
  147. settings.mutable_savingbrowserhistorydisabled()
  148. ->mutable_policy_options()
  149. ->set_mode(em::PolicyOptions::MANDATORY);
  150. settings.mutable_savingbrowserhistorydisabled()->set_value(true);
  151. policy_storage()->SetPolicyPayload(
  152. dm_protocol::kChromeMachineLevelUserCloudPolicyType,
  153. settings.SerializeAsString());
  154. em::DeviceManagementRequest device_management_request;
  155. em::PolicyFetchRequest* fetch_request =
  156. device_management_request.mutable_policy_request()->add_requests();
  157. fetch_request->set_policy_type(
  158. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  159. fetch_request->set_signature_type(em::PolicyFetchRequest::SHA1_RSA);
  160. SetDeviceTokenHeader(kDeviceToken);
  161. SetPayload(device_management_request);
  162. StartRequestAndWait();
  163. EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
  164. ASSERT_TRUE(HasResponseBody());
  165. em::DeviceManagementResponse device_management_response =
  166. GetDeviceManagementResponse();
  167. ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
  168. const em::PolicyFetchResponse& fetch_response =
  169. device_management_response.policy_response().responses(0);
  170. em::PolicyData policy_data;
  171. policy_data.ParseFromString(fetch_response.policy_data());
  172. EXPECT_EQ(policy_data.policy_type(),
  173. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  174. EXPECT_EQ(policy_data.policy_value(),
  175. policy_storage()->GetPolicyPayload(
  176. dm_protocol::kChromeMachineLevelUserCloudPolicyType));
  177. EXPECT_EQ(policy_data.public_key_version(),
  178. policy_storage()->signature_provider()->current_key_version());
  179. EXPECT_FALSE(fetch_response.policy_data_signature().empty());
  180. EXPECT_FALSE(fetch_response.new_public_key_verification_signature_deprecated()
  181. .empty());
  182. EXPECT_TRUE(fetch_response.new_public_key_signature().empty());
  183. }
  184. TEST_F(RequestHandlerForPolicyTest,
  185. HandleRequest_Success_SignedPoliciesWithClientKey) {
  186. ClientStorage::ClientInfo client_info;
  187. client_info.device_token = kDeviceToken;
  188. client_info.device_id = kDeviceId;
  189. client_info.username = kUsername;
  190. client_info.allowed_policy_types.insert(
  191. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  192. client_storage()->RegisterClient(client_info);
  193. em::CloudPolicySettings settings;
  194. settings.mutable_savingbrowserhistorydisabled()
  195. ->mutable_policy_options()
  196. ->set_mode(em::PolicyOptions::MANDATORY);
  197. settings.mutable_savingbrowserhistorydisabled()->set_value(true);
  198. policy_storage()->SetPolicyPayload(
  199. dm_protocol::kChromeMachineLevelUserCloudPolicyType,
  200. settings.SerializeAsString());
  201. em::DeviceManagementRequest device_management_request;
  202. em::PolicyFetchRequest* fetch_request =
  203. device_management_request.mutable_policy_request()->add_requests();
  204. fetch_request->set_policy_type(
  205. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  206. fetch_request->set_signature_type(em::PolicyFetchRequest::SHA1_RSA);
  207. // Sets client key to a key different than the current key in signature
  208. // provider (1), to force setting |new_public_key_signature| in the fetch
  209. // response.
  210. fetch_request->set_public_key_version(2);
  211. SetDeviceTokenHeader(kDeviceToken);
  212. SetPayload(device_management_request);
  213. StartRequestAndWait();
  214. EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
  215. ASSERT_TRUE(HasResponseBody());
  216. em::DeviceManagementResponse device_management_response =
  217. GetDeviceManagementResponse();
  218. ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
  219. const em::PolicyFetchResponse& fetch_response =
  220. device_management_response.policy_response().responses(0);
  221. em::PolicyData policy_data;
  222. policy_data.ParseFromString(fetch_response.policy_data());
  223. EXPECT_EQ(policy_data.policy_type(),
  224. dm_protocol::kChromeMachineLevelUserCloudPolicyType);
  225. EXPECT_EQ(policy_data.policy_value(),
  226. policy_storage()->GetPolicyPayload(
  227. dm_protocol::kChromeMachineLevelUserCloudPolicyType));
  228. EXPECT_EQ(policy_data.public_key_version(),
  229. policy_storage()->signature_provider()->current_key_version());
  230. EXPECT_FALSE(fetch_response.policy_data_signature().empty());
  231. EXPECT_FALSE(fetch_response.new_public_key_verification_signature_deprecated()
  232. .empty());
  233. EXPECT_FALSE(fetch_response.new_public_key_signature().empty());
  234. }
  235. #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
  236. TEST_F(RequestHandlerForPolicyTest, HandleRequest_Success_ExtensionPolicies) {
  237. ClientStorage::ClientInfo client_info;
  238. client_info.device_token = kDeviceToken;
  239. client_info.device_id = kDeviceId;
  240. client_info.username = kUsername;
  241. client_info.allowed_policy_types.insert(
  242. dm_protocol::kChromeExtensionPolicyType);
  243. client_storage()->RegisterClient(client_info);
  244. em::CloudPolicySettings settings;
  245. settings.mutable_extensionsettings()->mutable_value()->assign(
  246. "extension-policy");
  247. policy_storage()->SetPolicyPayload(dm_protocol::kChromeExtensionPolicyType,
  248. kExtensionId,
  249. settings.SerializeAsString());
  250. em::DeviceManagementRequest device_management_request;
  251. device_management_request.mutable_policy_request()
  252. ->add_requests()
  253. ->set_policy_type(dm_protocol::kChromeExtensionPolicyType);
  254. SetDeviceTokenHeader(kDeviceToken);
  255. SetPayload(device_management_request);
  256. StartRequestAndWait();
  257. EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
  258. ASSERT_TRUE(HasResponseBody());
  259. em::DeviceManagementResponse device_management_response =
  260. GetDeviceManagementResponse();
  261. ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
  262. const em::PolicyFetchResponse& fetch_response =
  263. device_management_response.policy_response().responses(0);
  264. em::PolicyData policy_data;
  265. policy_data.ParseFromString(fetch_response.policy_data());
  266. EXPECT_EQ(policy_data.policy_type(), dm_protocol::kChromeExtensionPolicyType);
  267. EXPECT_EQ(policy_data.policy_value(),
  268. policy_storage()->GetPolicyPayload(
  269. dm_protocol::kChromeExtensionPolicyType, kExtensionId));
  270. }
  271. TEST_F(RequestHandlerForPolicyTest,
  272. HandleRequest_ExtensionPoliciesWithMissingSigningKey) {
  273. ClientStorage::ClientInfo client_info;
  274. client_info.device_token = kDeviceToken;
  275. client_info.device_id = kDeviceId;
  276. client_info.username = kUsername;
  277. client_info.allowed_policy_types.insert(
  278. dm_protocol::kChromeMachineLevelExtensionCloudPolicyType);
  279. client_storage()->RegisterClient(client_info);
  280. em::CloudPolicySettings settings;
  281. settings.mutable_extensionsettings()->mutable_value()->assign(
  282. "extension-policy");
  283. policy_storage()->SetPolicyPayload(
  284. dm_protocol::kChromeMachineLevelExtensionCloudPolicyType, kExtensionId,
  285. settings.SerializeAsString());
  286. policy_storage()->signature_provider()->set_current_key_version(-1);
  287. em::DeviceManagementRequest device_management_request;
  288. device_management_request.mutable_policy_request()
  289. ->add_requests()
  290. ->set_policy_type(
  291. dm_protocol::kChromeMachineLevelExtensionCloudPolicyType);
  292. SetDeviceTokenHeader(kDeviceToken);
  293. SetPayload(device_management_request);
  294. StartRequestAndWait();
  295. EXPECT_EQ(GetResponseCode(), net::HTTP_BAD_REQUEST);
  296. }
  297. TEST_F(RequestHandlerForPolicyTest,
  298. HandleRequest_ExtensionsInPublicAccounts_SetCorrectPolicyDataUsername) {
  299. ClientStorage::ClientInfo client_info;
  300. client_info.device_token = kDeviceToken;
  301. client_info.device_id = kDeviceId;
  302. client_info.username = kUsername;
  303. client_info.allowed_policy_types.insert(
  304. {dm_protocol::kChromeExtensionPolicyType,
  305. dm_protocol::kChromePublicAccountPolicyType});
  306. client_storage()->RegisterClient(client_info);
  307. em::CloudPolicySettings settings;
  308. settings.mutable_extensionsettings()->mutable_value()->assign(
  309. "extension-policy");
  310. policy_storage()->SetPolicyPayload(dm_protocol::kChromeExtensionPolicyType,
  311. kExtensionId,
  312. settings.SerializeAsString());
  313. std::vector<policy::SignatureProvider::SigningKey> universal_signing_keys;
  314. universal_signing_keys.push_back(policy::SignatureProvider::SigningKey(
  315. policy::PolicyBuilder::CreateTestSigningKey(),
  316. {{"*", policy::PolicyBuilder::GetTestSigningKeySignature()}}));
  317. policy_storage()->signature_provider()->set_signing_keys(
  318. std::move(universal_signing_keys));
  319. em::DeviceManagementRequest device_management_request;
  320. em::PolicyFetchRequest* extension_request =
  321. device_management_request.mutable_policy_request()->add_requests();
  322. extension_request->set_policy_type(dm_protocol::kChromeExtensionPolicyType);
  323. extension_request->set_signature_type(
  324. enterprise_management::PolicyFetchRequest::SHA1_RSA);
  325. em::PolicyFetchRequest* public_account_request =
  326. device_management_request.mutable_policy_request()->add_requests();
  327. public_account_request->set_policy_type(
  328. dm_protocol::kChromePublicAccountPolicyType);
  329. public_account_request->set_settings_entity_id(kPublicAccountEntityId);
  330. public_account_request->set_signature_type(
  331. enterprise_management::PolicyFetchRequest::SHA1_RSA);
  332. SetDeviceTokenHeader(kDeviceToken);
  333. SetPayload(device_management_request);
  334. StartRequestAndWait();
  335. EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
  336. ASSERT_TRUE(HasResponseBody());
  337. em::DeviceManagementResponse device_management_response =
  338. GetDeviceManagementResponse();
  339. ASSERT_EQ(device_management_response.policy_response().responses_size(), 2);
  340. const em::PolicyFetchResponse& extension_fetch_response =
  341. device_management_response.policy_response().responses(0);
  342. em::PolicyData extension_policy_data;
  343. extension_policy_data.ParseFromString(extension_fetch_response.policy_data());
  344. EXPECT_EQ(extension_policy_data.username(), kPublicAccountEntityId);
  345. const em::PolicyFetchResponse& public_account_fetch_response =
  346. device_management_response.policy_response().responses(0);
  347. em::PolicyData public_account_policy_data;
  348. public_account_policy_data.ParseFromString(
  349. public_account_fetch_response.policy_data());
  350. EXPECT_EQ(public_account_policy_data.username(), kPublicAccountEntityId);
  351. }
  352. #endif // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
  353. } // namespace policy