123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435 |
- // Copyright 2021 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include "components/policy/test_support/request_handler_for_policy.h"
- #include <utility>
- #include "components/policy/core/common/cloud/cloud_policy_constants.h"
- #include "components/policy/core/common/cloud/test/policy_builder.h"
- #include "components/policy/proto/cloud_policy.pb.h"
- #include "components/policy/proto/device_management_backend.pb.h"
- #include "components/policy/test_support/client_storage.h"
- #include "components/policy/test_support/embedded_policy_test_server_test_base.h"
- #include "components/policy/test_support/policy_storage.h"
- #include "net/http/http_status_code.h"
- #include "testing/gtest/include/gtest/gtest.h"
- namespace em = enterprise_management;
- namespace policy {
- namespace {
- constexpr char kDeviceId[] = "fake_device_id";
- constexpr char kDeviceToken[] = "fake_device_token";
- constexpr char kMachineName[] = "machine_name";
- constexpr char kPolicyInvalidationTopic[] = "policy_invalidation_topic";
- constexpr char kUsername[] = "user-for-policy@example.com";
- #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
- constexpr char kPublicAccountEntityId[] = "test_user";
- constexpr char kExtensionId[] = "extension_id";
- #endif // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
- } // namespace
- class RequestHandlerForPolicyTest : public EmbeddedPolicyTestServerTestBase {
- protected:
- RequestHandlerForPolicyTest() = default;
- ~RequestHandlerForPolicyTest() override = default;
- void SetUp() override {
- EmbeddedPolicyTestServerTestBase::SetUp();
- SetRequestTypeParam(dm_protocol::kValueRequestPolicy);
- SetAppType(dm_protocol::kValueAppType);
- SetDeviceIdParam(kDeviceId);
- SetDeviceType(dm_protocol::kValueDeviceType);
- }
- };
- TEST_F(RequestHandlerForPolicyTest, HandleRequest_NoDeviceToken) {
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_UNAUTHORIZED);
- }
- TEST_F(RequestHandlerForPolicyTest, HandleRequest_NoRegisteredClient) {
- SetDeviceTokenHeader(kDeviceToken);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_GONE);
- }
- TEST_F(RequestHandlerForPolicyTest, HandleRequest_UnmatchedDeviceId) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = "registered-device-token";
- client_info.device_id = kDeviceId;
- client_info.machine_name = kMachineName;
- client_storage()->RegisterClient(std::move(client_info));
- SetDeviceTokenHeader(kDeviceToken);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_GONE);
- }
- TEST_F(RequestHandlerForPolicyTest, HandleRequest_InvalidPolicyType) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.machine_name = kMachineName;
- client_storage()->RegisterClient(std::move(client_info));
- em::DeviceManagementRequest device_management_request;
- em::PolicyFetchRequest* fetch_request =
- device_management_request.mutable_policy_request()->add_requests();
- fetch_request->set_policy_type("invalid-policy-type");
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_BAD_REQUEST);
- }
- TEST_F(RequestHandlerForPolicyTest, HandleRequest_UnauthorizedPolicyType) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.machine_name = kMachineName;
- client_info.allowed_policy_types.insert(dm_protocol::kChromeDevicePolicyType);
- client_storage()->RegisterClient(std::move(client_info));
- em::DeviceManagementRequest device_management_request;
- em::PolicyFetchRequest* fetch_request =
- device_management_request.mutable_policy_request()->add_requests();
- fetch_request->set_policy_type(dm_protocol::kChromeRemoteCommandPolicyType);
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_BAD_REQUEST);
- }
- TEST_F(RequestHandlerForPolicyTest, HandleRequest_Success_NoSignedPolicies) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.machine_name = kMachineName;
- client_info.username = kUsername;
- client_info.allowed_policy_types.insert(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- client_storage()->RegisterClient(client_info);
- policy_storage()->set_policy_invalidation_topic(kPolicyInvalidationTopic);
- em::CloudPolicySettings settings;
- settings.mutable_savingbrowserhistorydisabled()
- ->mutable_policy_options()
- ->set_mode(em::PolicyOptions::MANDATORY);
- settings.mutable_savingbrowserhistorydisabled()->set_value(true);
- policy_storage()->SetPolicyPayload(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType,
- settings.SerializeAsString());
- em::DeviceManagementRequest device_management_request;
- em::PolicyFetchRequest* fetch_request =
- device_management_request.mutable_policy_request()->add_requests();
- fetch_request->set_policy_type(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
- ASSERT_TRUE(HasResponseBody());
- em::DeviceManagementResponse device_management_response =
- GetDeviceManagementResponse();
- ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
- em::PolicyData policy_data;
- policy_data.ParseFromString(
- device_management_response.policy_response().responses(0).policy_data());
- EXPECT_EQ(policy_data.policy_type(),
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- EXPECT_EQ(policy_data.request_token(), client_info.device_token);
- EXPECT_EQ(policy_data.policy_value(),
- policy_storage()->GetPolicyPayload(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType));
- EXPECT_EQ(policy_data.machine_name(), client_info.machine_name);
- EXPECT_FALSE(policy_data.service_account_identity().empty());
- EXPECT_EQ(policy_data.device_id(), client_info.device_id);
- EXPECT_EQ(policy_data.username(), kUsername);
- EXPECT_EQ(policy_data.policy_invalidation_topic(), kPolicyInvalidationTopic);
- EXPECT_FALSE(policy_data.has_public_key_version());
- }
- TEST_F(RequestHandlerForPolicyTest,
- HandleRequest_Success_SignedPoliciesWithoutClientKey) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.username = kUsername;
- client_info.allowed_policy_types.insert(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- client_storage()->RegisterClient(client_info);
- em::CloudPolicySettings settings;
- settings.mutable_savingbrowserhistorydisabled()
- ->mutable_policy_options()
- ->set_mode(em::PolicyOptions::MANDATORY);
- settings.mutable_savingbrowserhistorydisabled()->set_value(true);
- policy_storage()->SetPolicyPayload(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType,
- settings.SerializeAsString());
- em::DeviceManagementRequest device_management_request;
- em::PolicyFetchRequest* fetch_request =
- device_management_request.mutable_policy_request()->add_requests();
- fetch_request->set_policy_type(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- fetch_request->set_signature_type(em::PolicyFetchRequest::SHA1_RSA);
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
- ASSERT_TRUE(HasResponseBody());
- em::DeviceManagementResponse device_management_response =
- GetDeviceManagementResponse();
- ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
- const em::PolicyFetchResponse& fetch_response =
- device_management_response.policy_response().responses(0);
- em::PolicyData policy_data;
- policy_data.ParseFromString(fetch_response.policy_data());
- EXPECT_EQ(policy_data.policy_type(),
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- EXPECT_EQ(policy_data.policy_value(),
- policy_storage()->GetPolicyPayload(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType));
- EXPECT_EQ(policy_data.public_key_version(),
- policy_storage()->signature_provider()->current_key_version());
- EXPECT_FALSE(fetch_response.policy_data_signature().empty());
- EXPECT_FALSE(fetch_response.new_public_key_verification_signature_deprecated()
- .empty());
- EXPECT_TRUE(fetch_response.new_public_key_signature().empty());
- }
- TEST_F(RequestHandlerForPolicyTest,
- HandleRequest_Success_SignedPoliciesWithClientKey) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.username = kUsername;
- client_info.allowed_policy_types.insert(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- client_storage()->RegisterClient(client_info);
- em::CloudPolicySettings settings;
- settings.mutable_savingbrowserhistorydisabled()
- ->mutable_policy_options()
- ->set_mode(em::PolicyOptions::MANDATORY);
- settings.mutable_savingbrowserhistorydisabled()->set_value(true);
- policy_storage()->SetPolicyPayload(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType,
- settings.SerializeAsString());
- em::DeviceManagementRequest device_management_request;
- em::PolicyFetchRequest* fetch_request =
- device_management_request.mutable_policy_request()->add_requests();
- fetch_request->set_policy_type(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- fetch_request->set_signature_type(em::PolicyFetchRequest::SHA1_RSA);
- // Sets client key to a key different than the current key in signature
- // provider (1), to force setting |new_public_key_signature| in the fetch
- // response.
- fetch_request->set_public_key_version(2);
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
- ASSERT_TRUE(HasResponseBody());
- em::DeviceManagementResponse device_management_response =
- GetDeviceManagementResponse();
- ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
- const em::PolicyFetchResponse& fetch_response =
- device_management_response.policy_response().responses(0);
- em::PolicyData policy_data;
- policy_data.ParseFromString(fetch_response.policy_data());
- EXPECT_EQ(policy_data.policy_type(),
- dm_protocol::kChromeMachineLevelUserCloudPolicyType);
- EXPECT_EQ(policy_data.policy_value(),
- policy_storage()->GetPolicyPayload(
- dm_protocol::kChromeMachineLevelUserCloudPolicyType));
- EXPECT_EQ(policy_data.public_key_version(),
- policy_storage()->signature_provider()->current_key_version());
- EXPECT_FALSE(fetch_response.policy_data_signature().empty());
- EXPECT_FALSE(fetch_response.new_public_key_verification_signature_deprecated()
- .empty());
- EXPECT_FALSE(fetch_response.new_public_key_signature().empty());
- }
- #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
- TEST_F(RequestHandlerForPolicyTest, HandleRequest_Success_ExtensionPolicies) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.username = kUsername;
- client_info.allowed_policy_types.insert(
- dm_protocol::kChromeExtensionPolicyType);
- client_storage()->RegisterClient(client_info);
- em::CloudPolicySettings settings;
- settings.mutable_extensionsettings()->mutable_value()->assign(
- "extension-policy");
- policy_storage()->SetPolicyPayload(dm_protocol::kChromeExtensionPolicyType,
- kExtensionId,
- settings.SerializeAsString());
- em::DeviceManagementRequest device_management_request;
- device_management_request.mutable_policy_request()
- ->add_requests()
- ->set_policy_type(dm_protocol::kChromeExtensionPolicyType);
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
- ASSERT_TRUE(HasResponseBody());
- em::DeviceManagementResponse device_management_response =
- GetDeviceManagementResponse();
- ASSERT_EQ(device_management_response.policy_response().responses_size(), 1);
- const em::PolicyFetchResponse& fetch_response =
- device_management_response.policy_response().responses(0);
- em::PolicyData policy_data;
- policy_data.ParseFromString(fetch_response.policy_data());
- EXPECT_EQ(policy_data.policy_type(), dm_protocol::kChromeExtensionPolicyType);
- EXPECT_EQ(policy_data.policy_value(),
- policy_storage()->GetPolicyPayload(
- dm_protocol::kChromeExtensionPolicyType, kExtensionId));
- }
- TEST_F(RequestHandlerForPolicyTest,
- HandleRequest_ExtensionPoliciesWithMissingSigningKey) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.username = kUsername;
- client_info.allowed_policy_types.insert(
- dm_protocol::kChromeMachineLevelExtensionCloudPolicyType);
- client_storage()->RegisterClient(client_info);
- em::CloudPolicySettings settings;
- settings.mutable_extensionsettings()->mutable_value()->assign(
- "extension-policy");
- policy_storage()->SetPolicyPayload(
- dm_protocol::kChromeMachineLevelExtensionCloudPolicyType, kExtensionId,
- settings.SerializeAsString());
- policy_storage()->signature_provider()->set_current_key_version(-1);
- em::DeviceManagementRequest device_management_request;
- device_management_request.mutable_policy_request()
- ->add_requests()
- ->set_policy_type(
- dm_protocol::kChromeMachineLevelExtensionCloudPolicyType);
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_BAD_REQUEST);
- }
- TEST_F(RequestHandlerForPolicyTest,
- HandleRequest_ExtensionsInPublicAccounts_SetCorrectPolicyDataUsername) {
- ClientStorage::ClientInfo client_info;
- client_info.device_token = kDeviceToken;
- client_info.device_id = kDeviceId;
- client_info.username = kUsername;
- client_info.allowed_policy_types.insert(
- {dm_protocol::kChromeExtensionPolicyType,
- dm_protocol::kChromePublicAccountPolicyType});
- client_storage()->RegisterClient(client_info);
- em::CloudPolicySettings settings;
- settings.mutable_extensionsettings()->mutable_value()->assign(
- "extension-policy");
- policy_storage()->SetPolicyPayload(dm_protocol::kChromeExtensionPolicyType,
- kExtensionId,
- settings.SerializeAsString());
- std::vector<policy::SignatureProvider::SigningKey> universal_signing_keys;
- universal_signing_keys.push_back(policy::SignatureProvider::SigningKey(
- policy::PolicyBuilder::CreateTestSigningKey(),
- {{"*", policy::PolicyBuilder::GetTestSigningKeySignature()}}));
- policy_storage()->signature_provider()->set_signing_keys(
- std::move(universal_signing_keys));
- em::DeviceManagementRequest device_management_request;
- em::PolicyFetchRequest* extension_request =
- device_management_request.mutable_policy_request()->add_requests();
- extension_request->set_policy_type(dm_protocol::kChromeExtensionPolicyType);
- extension_request->set_signature_type(
- enterprise_management::PolicyFetchRequest::SHA1_RSA);
- em::PolicyFetchRequest* public_account_request =
- device_management_request.mutable_policy_request()->add_requests();
- public_account_request->set_policy_type(
- dm_protocol::kChromePublicAccountPolicyType);
- public_account_request->set_settings_entity_id(kPublicAccountEntityId);
- public_account_request->set_signature_type(
- enterprise_management::PolicyFetchRequest::SHA1_RSA);
- SetDeviceTokenHeader(kDeviceToken);
- SetPayload(device_management_request);
- StartRequestAndWait();
- EXPECT_EQ(GetResponseCode(), net::HTTP_OK);
- ASSERT_TRUE(HasResponseBody());
- em::DeviceManagementResponse device_management_response =
- GetDeviceManagementResponse();
- ASSERT_EQ(device_management_response.policy_response().responses_size(), 2);
- const em::PolicyFetchResponse& extension_fetch_response =
- device_management_response.policy_response().responses(0);
- em::PolicyData extension_policy_data;
- extension_policy_data.ParseFromString(extension_fetch_response.policy_data());
- EXPECT_EQ(extension_policy_data.username(), kPublicAccountEntityId);
- const em::PolicyFetchResponse& public_account_fetch_response =
- device_management_response.policy_response().responses(0);
- em::PolicyData public_account_policy_data;
- public_account_policy_data.ParseFromString(
- public_account_fetch_response.policy_data());
- EXPECT_EQ(public_account_policy_data.username(), kPublicAccountEntityId);
- }
- #endif // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
- } // namespace policy
|