src/chrome/browser/extensions/api/enterprise_platform_keys/enterprise_platform_keys_apitest_nss.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <cryptohi.h>
   6
   7 #include "base/macros.h"
   8 #include "base/strings/stringprintf.h"
   9 #include "chrome/browser/chrome_notification_types.h"
  10 #include "chrome/browser/chromeos/policy/user_network_configuration_updater.h"
  11 #include "chrome/browser/extensions/extension_apitest.h"
  12 #include "chrome/browser/net/nss_context.h"
  13 #include "chrome/browser/net/url_request_mock_util.h"
  14 #include "components/policy/core/browser/browser_policy_connector.h"
  15 #include "components/policy/core/common/mock_configuration_policy_provider.h"
  16 #include "components/policy/core/common/policy_map.h"
  17 #include "content/public/browser/notification_service.h"
  18 #include "content/public/common/content_switches.h"
  19 #include "content/public/test/test_utils.h"
  20 #include "content/public/test/test_utils.h"
  21 #include "content/test/net/url_request_mock_http_job.h"
  22 #include "crypto/nss_util.h"
  23 #include "net/base/net_errors.h"
  24 #include "net/cert/nss_cert_database.h"
  25 #include "policy/policy_constants.h"
  26 #include "testing/gmock/include/gmock/gmock.h"
  27
  28 namespace {
  29
  30 // The test extension has a certificate referencing this private key.
  31 //
  32 // openssl genrsa > privkey.pem
  33 // openssl pkcs8 -inform pem -in privkey.pem -topk8
  34 //   -outform der -out privkey8.der -nocrypt
  35 // xxd -i privkey8.der
  36 const unsigned char privateKeyPkcs8[] = {
  37     0x30, 0x82, 0x01, 0x55, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a,
  38     0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82,
  39     0x01, 0x3f, 0x30, 0x82, 0x01, 0x3b, 0x02, 0x01, 0x00, 0x02, 0x41, 0x00,
  40     0xc7, 0xc1, 0x4d, 0xd5, 0xdc, 0x3a, 0x2e, 0x1f, 0x42, 0x30, 0x3d, 0x21,
  41     0x1e, 0xa2, 0x1f, 0x60, 0xcb, 0x71, 0x11, 0x53, 0xb0, 0x75, 0xa0, 0x62,
  42     0xfe, 0x5e, 0x0a, 0xde, 0xb0, 0x0f, 0x48, 0x97, 0x5e, 0x42, 0xa7, 0x3a,
  43     0xd1, 0xca, 0x4c, 0xe3, 0xdb, 0x5f, 0x31, 0xc2, 0x99, 0x08, 0x89, 0xcd,
  44     0x6d, 0x20, 0xaa, 0x75, 0xe6, 0x2b, 0x98, 0xd2, 0xf3, 0x7b, 0x4b, 0xe5,
  45     0x9b, 0xfe, 0xe2, 0x6d, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x40, 0x4a,
  46     0xf5, 0x76, 0x10, 0xe7, 0xb8, 0x89, 0x70, 0x3f, 0x75, 0x3c, 0xab, 0x3e,
  47     0x04, 0x96, 0x83, 0xcb, 0x34, 0x1d, 0xcd, 0x6a, 0xed, 0x69, 0x07, 0x5c,
  48     0xee, 0xcb, 0x63, 0x6f, 0x6b, 0xfc, 0xcf, 0xee, 0xa2, 0xc4, 0x67, 0x05,
  49     0x68, 0x4d, 0x21, 0x7e, 0x3e, 0xde, 0x74, 0x72, 0xf8, 0x04, 0x35, 0x66,
  50     0x1e, 0x6b, 0x1d, 0xef, 0x77, 0xf7, 0x33, 0xf0, 0x35, 0xcf, 0x35, 0x6e,
  51     0x53, 0x3f, 0x9d, 0x02, 0x21, 0x00, 0xee, 0x48, 0x67, 0x1b, 0x24, 0x6e,
  52     0x3d, 0x7b, 0xa0, 0xc3, 0xee, 0x8a, 0x2e, 0xc7, 0xd0, 0xa1, 0xdb, 0x25,
  53     0x31, 0x12, 0x99, 0x43, 0x06, 0x3c, 0xb0, 0x80, 0x35, 0x2b, 0xf4, 0xc5,
  54     0xa2, 0xd3, 0x02, 0x21, 0x00, 0xd6, 0x9b, 0x8b, 0x75, 0x91, 0x52, 0xd4,
  55     0xf0, 0x76, 0xcf, 0xa2, 0xbe, 0xa6, 0xaf, 0x72, 0x6c, 0x52, 0xf9, 0xc9,
  56     0x0e, 0xea, 0x4a, 0x4c, 0xd2, 0xdf, 0x25, 0x70, 0xc6, 0x66, 0x35, 0x9d,
  57     0xbf, 0x02, 0x21, 0x00, 0xe8, 0x9e, 0x40, 0x21, 0xcc, 0x37, 0xde, 0xc7,
  58     0xd1, 0x13, 0x55, 0xcd, 0x0a, 0x8c, 0x40, 0xcd, 0xb1, 0xed, 0xa5, 0xf1,
  59     0x7d, 0x33, 0x64, 0x64, 0x5c, 0xfe, 0x5c, 0x6a, 0x34, 0x03, 0xb8, 0xc7,
  60     0x02, 0x20, 0x17, 0xe1, 0xb5, 0x52, 0x3e, 0xfa, 0xc5, 0xc1, 0x80, 0xa7,
  61     0x38, 0x88, 0x18, 0xca, 0x7b, 0x64, 0x3c, 0x93, 0x99, 0x61, 0x34, 0x87,
  62     0x52, 0x27, 0x41, 0x37, 0xcc, 0x65, 0xf7, 0xa7, 0xcd, 0xc7, 0x02, 0x21,
  63     0x00, 0x8a, 0x17, 0x7f, 0xf9, 0x45, 0xf3, 0xfd, 0xf7, 0x96, 0x62, 0xf3,
  64     0x7a, 0x09, 0xfb, 0xe9, 0x9e, 0xc7, 0x7a, 0x1f, 0x53, 0x1a, 0xb8, 0xd5,
  65     0x88, 0x9d, 0xd4, 0x79, 0x57, 0x88, 0x68, 0x72, 0x6f};
  66
  67 const base::FilePath::CharType kTestExtensionDir[] =
  68     FILE_PATH_LITERAL("extensions/api_test/enterprise_platform_keys");
  69 const base::FilePath::CharType kUpdateManifestFileName[] =
  70     FILE_PATH_LITERAL("update_manifest.xml");
  71
  72 // The managed_storage extension has a key defined in its manifest, so that
  73 // its extension ID is well-known and the policy system can push policies for
  74 // the extension.
  75 const char kTestExtensionID[] = "aecpbnckhoppanpmefllkdkohionpmig";
  76
  77 void DidGetCertDatabase(base::RunLoop* loop, net::NSSCertDatabase* cert_db) {
  78   // In order to use a prepared certificate, import a private key at first for
  79   // which the Javscript test will import the certificate.
  80   SECItem pki_der = {
  81       siBuffer,
  82       // NSS requires non-const data even though it is just for input.
  83       const_cast<unsigned char*>((const unsigned char*)privateKeyPkcs8),
  84       arraysize(privateKeyPkcs8)};
  85
  86   crypto::ScopedPK11Slot private_slot(cert_db->GetPrivateSlot());
  87   SECKEYPrivateKey* seckey_private_key = NULL;
  88   ASSERT_EQ(SECSuccess,
  89             PK11_ImportDERPrivateKeyInfoAndReturnKey(private_slot.get(),
  90                                                      &pki_der,
  91                                                      NULL,    // nickname
  92                                                      NULL,    // publicValue
  93                                                      true,    // isPerm
  94                                                      true,    // isPrivate
  95                                                      KU_ALL,  // usage
  96                                                      &seckey_private_key,
  97                                                      NULL));
  98   loop->Quit();
  99 }
 100
 101 class EnterprisePlatformKeysTest : public ExtensionApiTest {
 102  public:
 103   virtual void SetUp() {
 104     policy::UserNetworkConfigurationUpdater::
 105         SetSkipCertificateImporterCreationForTest(true /*skip*/);
 106     ExtensionApiTest::SetUp();
 107   }
 108
 109   virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
 110     ExtensionApiTest::SetUpCommandLine(command_line);
 111
 112     // Enable the WebCrypto API.
 113     command_line->AppendSwitch(
 114         switches::kEnableExperimentalWebPlatformFeatures);
 115   }
 116
 117   virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
 118     ExtensionApiTest::SetUpInProcessBrowserTestFixture();
 119
 120     EXPECT_CALL(policy_provider_, IsInitializationComplete(testing::_))
 121         .WillRepeatedly(testing::Return(true));
 122     policy_provider_.SetAutoRefresh();
 123     policy::BrowserPolicyConnector::SetPolicyProviderForTesting(
 124         &policy_provider_);
 125   }
 126
 127   virtual void SetUpOnMainThread() OVERRIDE {
 128     ExtensionApiTest::SetUpOnMainThread();
 129
 130     // Enable the URLRequestMock, which is required for force-installing the
 131     // test extension through policy.
 132     content::BrowserThread::PostTask(
 133         content::BrowserThread::IO,
 134         FROM_HERE,
 135         base::Bind(chrome_browser_net::SetUrlRequestMocksEnabled, true));
 136
 137     {
 138       base::RunLoop loop;
 139       content::BrowserThread::PostTask(
 140           content::BrowserThread::IO,
 141           FROM_HERE,
 142           base::Bind(&EnterprisePlatformKeysTest::SetupTestNSSDBOnIOThread,
 143                      base::Unretained(this),
 144                      &loop));
 145       loop.Run();
 146     }
 147
 148     {
 149       base::RunLoop loop;
 150       GetNSSCertDatabaseForProfile(browser()->profile(),
 151                                    base::Bind(&DidGetCertDatabase, &loop));
 152       loop.Run();
 153     }
 154
 155     SetPolicy();
 156   }
 157
 158   virtual void CleanUpOnMainThread() OVERRIDE {
 159     base::RunLoop loop;
 160     content::BrowserThread::PostTask(
 161         content::BrowserThread::IO,
 162         FROM_HERE,
 163         base::Bind(&EnterprisePlatformKeysTest::DeleteTestNSSDBOnIOThread,
 164                    base::Unretained(this),
 165                    &loop));
 166     loop.Run();
 167     ExtensionApiTest::CleanUpOnMainThread();
 168   }
 169
 170  private:
 171   void SetupTestNSSDBOnIOThread(base::RunLoop* loop) {
 172     test_nssdb_.reset(new crypto::ScopedTestNSSDB);
 173     content::BrowserThread::PostTask(
 174         content::BrowserThread::UI, FROM_HERE, loop->QuitClosure());
 175   }
 176
 177   void DeleteTestNSSDBOnIOThread(base::RunLoop* loop) {
 178     test_nssdb_.reset();
 179     content::BrowserThread::PostTask(
 180         content::BrowserThread::UI, FROM_HERE, loop->QuitClosure());
 181   }
 182
 183   void SetPolicy() {
 184     // Extensions that are force-installed come from an update URL, which
 185     // defaults to the webstore. Use a mock URL for this test with an update
 186     // manifest that includes the crx file of the test extension.
 187     base::FilePath update_manifest_path =
 188         base::FilePath(kTestExtensionDir).Append(kUpdateManifestFileName);
 189     GURL update_manifest_url(
 190         content::URLRequestMockHTTPJob::GetMockUrl(update_manifest_path));
 191
 192     scoped_ptr<base::ListValue> forcelist(new base::ListValue);
 193     forcelist->AppendString(base::StringPrintf(
 194         "%s;%s", kTestExtensionID, update_manifest_url.spec().c_str()));
 195
 196     policy::PolicyMap policy;
 197     policy.Set(policy::key::kExtensionInstallForcelist,
 198                policy::POLICY_LEVEL_MANDATORY,
 199                policy::POLICY_SCOPE_MACHINE,
 200                forcelist.release(),
 201                NULL);
 202
 203     // Set the policy and wait until the extension is installed.
 204     content::WindowedNotificationObserver observer(
 205         chrome::NOTIFICATION_EXTENSION_INSTALLED_DEPRECATED,
 206         content::NotificationService::AllSources());
 207     policy_provider_.UpdateChromePolicy(policy);
 208     observer.Wait();
 209   }
 210
 211   scoped_ptr<crypto::ScopedTestNSSDB> test_nssdb_;
 212   policy::MockConfigurationPolicyProvider policy_provider_;
 213 };
 214
 215 }  // namespace
 216
 217 IN_PROC_BROWSER_TEST_F(EnterprisePlatformKeysTest, Basic) {
 218   ASSERT_TRUE(RunExtensionSubtest(
 219       "",
 220       base::StringPrintf("chrome-extension://%s/basic.html", kTestExtensionID)))
 221       << message_;
 222 }