chrome/browser/prefs/tracked/pref_hash_browsertest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <string>
   6
   7 #include "base/command_line.h"
   8 #include "base/file_util.h"
   9 #include "base/files/file_path.h"
  10 #include "base/json/json_file_value_serializer.h"
  11 #include "base/memory/scoped_ptr.h"
  12 #include "base/metrics/histogram_base.h"
  13 #include "base/metrics/histogram_samples.h"
  14 #include "base/metrics/statistics_recorder.h"
  15 #include "base/path_service.h"
  16 #include "base/prefs/pref_service.h"
  17 #include "base/prefs/scoped_user_pref_update.h"
  18 #include "base/strings/string_number_conversions.h"
  19 #include "base/strings/string_util.h"
  20 #include "base/values.h"
  21 #include "build/build_config.h"
  22 #include "chrome/browser/extensions/extension_browsertest.h"
  23 #include "chrome/browser/extensions/extension_service.h"
  24 #include "chrome/browser/prefs/chrome_pref_service_factory.h"
  25 #include "chrome/browser/prefs/profile_pref_store_manager.h"
  26 #include "chrome/browser/prefs/session_startup_pref.h"
  27 #include "chrome/browser/profiles/profile.h"
  28 #include "chrome/browser/ui/browser.h"
  29 #include "chrome/common/chrome_constants.h"
  30 #include "chrome/common/chrome_paths.h"
  31 #include "chrome/common/pref_names.h"
  32 #include "chrome/test/base/testing_profile.h"
  33 #include "components/search_engines/default_search_manager.h"
  34 #include "content/public/common/content_switches.h"
  35 #include "extensions/browser/pref_names.h"
  36 #include "extensions/common/extension.h"
  37
  38 #if defined(OS_CHROMEOS)
  39 #include "chromeos/chromeos_switches.h"
  40 #endif
  41
  42 namespace {
  43
  44 // Extension ID of chrome/test/data/extensions/good.crx
  45 const char kGoodCrxId[] = "ldnnhddmnhbkjipkidpdiheffobcpfmf";
  46
  47 // Explicit expectations from the caller of GetTrackedPrefHistogramCount(). This
  48 // enables detailed reporting of the culprit on failure.
  49 enum AllowedBuckets {
  50   // Allow no samples in any buckets.
  51   ALLOW_NONE = -1,
  52   // Any integer between BEGIN_ALLOW_SINGLE_BUCKET and END_ALLOW_SINGLE_BUCKET
  53   // indicates that only this specific bucket is allowed to have a sample.
  54   BEGIN_ALLOW_SINGLE_BUCKET = 0,
  55   END_ALLOW_SINGLE_BUCKET = 100,
  56   // Allow any buckets (no extra verifications performed).
  57   ALLOW_ANY
  58 };
  59
  60 // Returns the number of times |histogram_name| was reported so far; adding the
  61 // results of the first 100 buckets (there are only ~19 reporting IDs as of this
  62 // writing; varies depending on the platform). |allowed_buckets| hints at extra
  63 // requirements verified in this method (see AllowedBuckets for details).
  64 int GetTrackedPrefHistogramCount(const char* histogram_name,
  65                                  int allowed_buckets) {
  66   const base::HistogramBase* histogram =
  67       base::StatisticsRecorder::FindHistogram(histogram_name);
  68   if (!histogram)
  69     return 0;
  70
  71   scoped_ptr<base::HistogramSamples> samples(histogram->SnapshotSamples());
  72   int sum = 0;
  73   for (int i = 0; i < 100; ++i) {
  74     int count_for_id = samples->GetCount(i);
  75     EXPECT_GE(count_for_id, 0);
  76     sum += count_for_id;
  77
  78     if (allowed_buckets == ALLOW_NONE ||
  79         (allowed_buckets != ALLOW_ANY && i != allowed_buckets)) {
  80       EXPECT_EQ(0, count_for_id) << "Unexpected reporting_id: " << i;
  81     }
  82   }
  83   return sum;
  84 }
  85
  86 scoped_ptr<base::DictionaryValue> ReadPrefsDictionary(
  87     const base::FilePath& pref_file) {
  88   JSONFileValueSerializer serializer(pref_file);
  89   int error_code = JSONFileValueSerializer::JSON_NO_ERROR;
  90   std::string error_str;
  91   scoped_ptr<base::Value> prefs(
  92       serializer.Deserialize(&error_code, &error_str));
  93   if (!prefs || error_code != JSONFileValueSerializer::JSON_NO_ERROR) {
  94     ADD_FAILURE() << "Error #" << error_code << ": " << error_str;
  95     return scoped_ptr<base::DictionaryValue>();
  96   }
  97   if (!prefs->IsType(base::Value::TYPE_DICTIONARY)) {
  98     ADD_FAILURE();
  99     return scoped_ptr<base::DictionaryValue>();
 100   }
 101   return scoped_ptr<base::DictionaryValue>(
 102       static_cast<base::DictionaryValue*>(prefs.release()));
 103 }
 104
 105 #define PREF_HASH_BROWSER_TEST(fixture, test_name)                          \
 106   IN_PROC_BROWSER_TEST_P(fixture, PRE_##test_name) {                        \
 107     SetupPreferences();                                                     \
 108   }                                                                         \
 109   IN_PROC_BROWSER_TEST_P(fixture, test_name) {                              \
 110     VerifyReactionToPrefAttack();                                           \
 111   }                                                                         \
 112   INSTANTIATE_TEST_CASE_P(                                                  \
 113       fixture##Instance,                                                    \
 114       fixture,                                                              \
 115       testing::Values(                                                      \
 116           chrome_prefs::internals::kSettingsEnforcementGroupNoEnforcement,  \
 117           chrome_prefs::internals::kSettingsEnforcementGroupEnforceAlways,  \
 118           chrome_prefs::internals::                                         \
 119               kSettingsEnforcementGroupEnforceAlwaysWithDSE,                \
 120           chrome_prefs::internals::                                         \
 121               kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE));
 122
 123 // A base fixture designed such that implementations do two things:
 124 //  1) Override all three pure-virtual methods below to setup, attack, and
 125 //     verify preferenes throughout the tests provided by this fixture.
 126 //  2) Instantiate their test via the PREF_HASH_BROWSER_TEST macro above.
 127 // Based on top of ExtensionBrowserTest to allow easy interaction with the
 128 // ExtensionService.
 129 class PrefHashBrowserTestBase
 130     : public ExtensionBrowserTest,
 131       public testing::WithParamInterface<std::string> {
 132  public:
 133   // List of potential protection levels for this test in strict increasing
 134   // order of protection levels.
 135   enum SettingsProtectionLevel {
 136     PROTECTION_DISABLED_ON_PLATFORM,
 137     PROTECTION_DISABLED_FOR_GROUP,
 138     PROTECTION_ENABLED_BASIC,
 139     PROTECTION_ENABLED_DSE,
 140     PROTECTION_ENABLED_EXTENSIONS,
 141     // Represents the strongest level (i.e. always equivalent to the last one in
 142     // terms of protection), leave this one last when adding new levels.
 143     PROTECTION_ENABLED_ALL
 144   };
 145
 146   PrefHashBrowserTestBase()
 147       : protection_level_(GetProtectionLevelFromTrialGroup(GetParam())) {
 148   }
 149
 150   virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
 151     ExtensionBrowserTest::SetUpCommandLine(command_line);
 152     EXPECT_FALSE(command_line->HasSwitch(switches::kForceFieldTrials));
 153     command_line->AppendSwitchASCII(
 154         switches::kForceFieldTrials,
 155         std::string(chrome_prefs::internals::kSettingsEnforcementTrialName) +
 156             "/" + GetParam() + "/");
 157 #if defined(OS_CHROMEOS)
 158     command_line->AppendSwitch(
 159         chromeos::switches::kIgnoreUserProfileMappingForTests);
 160 #endif
 161   }
 162
 163   virtual bool SetUpUserDataDirectory() OVERRIDE {
 164     // Do the normal setup in the PRE test and attack preferences in the main
 165     // test.
 166     if (IsPRETest())
 167       return ExtensionBrowserTest::SetUpUserDataDirectory();
 168
 169 #if defined(OS_CHROMEOS)
 170     // For some reason, the Preferences file does not exist in the location
 171     // below on Chrome OS. Since protection is disabled on Chrome OS, it's okay
 172     // to simply not attack preferences at all (and still assert that no
 173     // hardening related histogram kicked in in VerifyReactionToPrefAttack()).
 174     // TODO(gab): Figure out why there is no Preferences file in this location
 175     // on Chrome OS (and re-enable the section disabled for OS_CHROMEOS further
 176     // below).
 177     EXPECT_EQ(PROTECTION_DISABLED_ON_PLATFORM, protection_level_);
 178     return true;
 179 #endif
 180
 181     base::FilePath profile_dir;
 182     EXPECT_TRUE(PathService::Get(chrome::DIR_USER_DATA, &profile_dir));
 183     profile_dir = profile_dir.AppendASCII(TestingProfile::kTestUserProfileDir);
 184
 185     // Sanity check that old protected pref file is never present in modern
 186     // Chromes.
 187     EXPECT_FALSE(base::PathExists(
 188         profile_dir.Append(chrome::kProtectedPreferencesFilenameDeprecated)));
 189
 190     // Read the preferences from disk.
 191
 192     const base::FilePath unprotected_pref_file =
 193         profile_dir.Append(chrome::kPreferencesFilename);
 194     EXPECT_TRUE(base::PathExists(unprotected_pref_file));
 195
 196     const base::FilePath protected_pref_file =
 197         profile_dir.Append(chrome::kSecurePreferencesFilename);
 198     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 199               base::PathExists(protected_pref_file));
 200
 201     scoped_ptr<base::DictionaryValue> unprotected_preferences(
 202         ReadPrefsDictionary(unprotected_pref_file));
 203     if (!unprotected_preferences)
 204       return false;
 205
 206     scoped_ptr<base::DictionaryValue> protected_preferences;
 207     if (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM) {
 208       protected_preferences = ReadPrefsDictionary(protected_pref_file);
 209       if (!protected_preferences)
 210         return false;
 211     }
 212
 213     // Let the underlying test modify the preferences.
 214     AttackPreferencesOnDisk(unprotected_preferences.get(),
 215                             protected_preferences.get());
 216
 217     // Write the modified preferences back to disk.
 218
 219     JSONFileValueSerializer unprotected_prefs_serializer(unprotected_pref_file);
 220     EXPECT_TRUE(
 221         unprotected_prefs_serializer.Serialize(*unprotected_preferences));
 222
 223     if (protected_preferences) {
 224       JSONFileValueSerializer protected_prefs_serializer(protected_pref_file);
 225       EXPECT_TRUE(protected_prefs_serializer.Serialize(*protected_preferences));
 226     }
 227
 228     return true;
 229   }
 230
 231   virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
 232     ExtensionBrowserTest::SetUpInProcessBrowserTestFixture();
 233
 234     // Bots are on a domain, turn off the domain check for settings hardening in
 235     // order to be able to test all SettingsEnforcement groups.
 236     chrome_prefs::DisableDelaysAndDomainCheckForTesting();
 237   }
 238
 239   // In the PRE_ test, find the number of tracked preferences that were
 240   // initialized and save it to a file to be read back in the main test and used
 241   // as the total number of tracked preferences.
 242   virtual void SetUpOnMainThread() OVERRIDE {
 243     ExtensionBrowserTest::SetUpOnMainThread();
 244
 245     // File in which the PRE_ test will save the number of tracked preferences
 246     // on this platform.
 247     const char kNumTrackedPrefFilename[] = "NumTrackedPrefs";
 248
 249     base::FilePath num_tracked_prefs_file;
 250     ASSERT_TRUE(
 251         PathService::Get(chrome::DIR_USER_DATA, &num_tracked_prefs_file));
 252     num_tracked_prefs_file =
 253         num_tracked_prefs_file.AppendASCII(kNumTrackedPrefFilename);
 254
 255     if (IsPRETest()) {
 256       num_tracked_prefs_ = GetTrackedPrefHistogramCount(
 257           "Settings.TrackedPreferenceTrustedInitialized", ALLOW_ANY);
 258       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 259                 num_tracked_prefs_ > 0);
 260
 261       // Split tracked prefs are reported as Unchanged not as TrustedInitialized
 262       // when an empty dictionary is encountered on first run (this should only
 263       // hit for pref #5 in the current design).
 264       int num_split_tracked_prefs = GetTrackedPrefHistogramCount(
 265           "Settings.TrackedPreferenceUnchanged", BEGIN_ALLOW_SINGLE_BUCKET + 5);
 266       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 267                 num_split_tracked_prefs);
 268
 269       num_tracked_prefs_ += num_split_tracked_prefs;
 270
 271       std::string num_tracked_prefs_str = base::IntToString(num_tracked_prefs_);
 272       EXPECT_EQ(static_cast<int>(num_tracked_prefs_str.size()),
 273                 base::WriteFile(num_tracked_prefs_file,
 274                                 num_tracked_prefs_str.c_str(),
 275                                 num_tracked_prefs_str.size()));
 276     } else {
 277       std::string num_tracked_prefs_str;
 278       EXPECT_TRUE(base::ReadFileToString(num_tracked_prefs_file,
 279                                          &num_tracked_prefs_str));
 280       EXPECT_TRUE(
 281           base::StringToInt(num_tracked_prefs_str, &num_tracked_prefs_));
 282     }
 283   }
 284
 285  protected:
 286   // Called from the PRE_ test's body. Overrides should use it to setup
 287   // preferences through Chrome.
 288   virtual void SetupPreferences() = 0;
 289
 290   // Called prior to the main test launching its browser. Overrides should use
 291   // it to attack preferences. |(un)protected_preferences| represent the state
 292   // on disk prior to launching the main test, they can be modified by this
 293   // method and modifications will be flushed back to disk before launching the
 294   // main test. |unprotected_preferences| is never NULL, |protected_preferences|
 295   // may be NULL if in PROTECTION_DISABLED_ON_PLATFORM mode.
 296   virtual void AttackPreferencesOnDisk(
 297       base::DictionaryValue* unprotected_preferences,
 298       base::DictionaryValue* protected_preferences) = 0;
 299
 300   // Called from the body of the main test. Overrides should use it to verify
 301   // that the browser had the desired reaction when faced when the attack
 302   // orchestrated in AttackPreferencesOnDisk().
 303   virtual void VerifyReactionToPrefAttack() = 0;
 304
 305   int num_tracked_prefs() const { return num_tracked_prefs_; }
 306
 307   const SettingsProtectionLevel protection_level_;
 308
 309  private:
 310   // Returns true if this is the PRE_ phase of the test.
 311   bool IsPRETest() {
 312     return StartsWithASCII(
 313         testing::UnitTest::GetInstance()->current_test_info()->name(),
 314         "PRE_",
 315         true /* case_sensitive */);
 316   }
 317
 318   SettingsProtectionLevel GetProtectionLevelFromTrialGroup(
 319       const std::string& trial_group) {
 320     if (!ProfilePrefStoreManager::kPlatformSupportsPreferenceTracking)
 321       return PROTECTION_DISABLED_ON_PLATFORM;
 322
 323 // Protection levels can't be adjusted via --force-fieldtrials in official
 324 // builds.
 325 #if defined(OFFICIAL_BUILD)
 326 #if defined(OS_WIN)
 327     // The strongest mode is enforced on Windows in the absence of a field
 328     // trial.
 329     return PROTECTION_ENABLED_ALL;
 330 #else
 331     return PROTECTION_DISABLED_FOR_GROUP;
 332 #endif
 333 #endif
 334
 335     using namespace chrome_prefs::internals;
 336     if (trial_group == kSettingsEnforcementGroupNoEnforcement) {
 337       return PROTECTION_DISABLED_FOR_GROUP;
 338     } else if (trial_group == kSettingsEnforcementGroupEnforceAlways) {
 339       return PROTECTION_ENABLED_BASIC;
 340     } else if (trial_group == kSettingsEnforcementGroupEnforceAlwaysWithDSE) {
 341       return PROTECTION_ENABLED_DSE;
 342     } else if (trial_group ==
 343                kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE) {
 344       return PROTECTION_ENABLED_EXTENSIONS;
 345     } else {
 346       ADD_FAILURE();
 347       return static_cast<SettingsProtectionLevel>(-1);
 348     }
 349   }
 350
 351   int num_tracked_prefs_;
 352 };
 353
 354 }  // namespace
 355
 356 // Verifies that nothing is reset when nothing is tampered with.
 357 // Also sanity checks that the expected preferences files are in place.
 358 class PrefHashBrowserTestUnchangedDefault : public PrefHashBrowserTestBase {
 359  public:
 360   virtual void SetupPreferences() OVERRIDE {
 361     // Default Chrome setup.
 362   }
 363
 364   virtual void AttackPreferencesOnDisk(
 365       base::DictionaryValue* unprotected_preferences,
 366       base::DictionaryValue* protected_preferences) OVERRIDE {
 367     // No attack.
 368   }
 369
 370   virtual void VerifyReactionToPrefAttack() OVERRIDE {
 371     // Expect all prefs to be reported as Unchanged with no resets.
 372     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 373                   ? num_tracked_prefs() : 0,
 374               GetTrackedPrefHistogramCount(
 375                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 376     EXPECT_EQ(0,
 377               GetTrackedPrefHistogramCount(
 378                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 379     EXPECT_EQ(0,
 380               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 381                                            ALLOW_NONE));
 382
 383     // Nothing else should have triggered.
 384     EXPECT_EQ(0,
 385               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 386                                            ALLOW_NONE));
 387     EXPECT_EQ(0,
 388               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 389                                            ALLOW_NONE));
 390     EXPECT_EQ(0,
 391               GetTrackedPrefHistogramCount(
 392                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 393     EXPECT_EQ(0,
 394               GetTrackedPrefHistogramCount(
 395                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 396     EXPECT_EQ(
 397         0,
 398         GetTrackedPrefHistogramCount(
 399             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 400   }
 401 };
 402
 403 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedDefault, UnchangedDefault);
 404
 405 // Augments PrefHashBrowserTestUnchangedDefault to confirm that nothing is reset
 406 // when nothing is tampered with, even if Chrome itself wrote custom prefs in
 407 // its last run.
 408 class PrefHashBrowserTestUnchangedCustom
 409     : public PrefHashBrowserTestUnchangedDefault {
 410  public:
 411   virtual void SetupPreferences() OVERRIDE {
 412     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 413
 414     InstallExtensionWithUIAutoConfirm(
 415         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 416   }
 417
 418   virtual void VerifyReactionToPrefAttack() OVERRIDE {
 419     // Make sure the settings written in the last run stuck.
 420     EXPECT_EQ("http://example.com",
 421               profile()->GetPrefs()->GetString(prefs::kHomePage));
 422
 423     EXPECT_TRUE(extension_service()->GetExtensionById(kGoodCrxId, false));
 424
 425     // Reaction should be identical to unattacked default prefs.
 426     PrefHashBrowserTestUnchangedDefault::VerifyReactionToPrefAttack();
 427   }
 428 };
 429
 430 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedCustom, UnchangedCustom);
 431
 432 // Verifies that cleared prefs are reported.
 433 class PrefHashBrowserTestClearedAtomic : public PrefHashBrowserTestBase {
 434  public:
 435   virtual void SetupPreferences() OVERRIDE {
 436     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 437   }
 438
 439   virtual void AttackPreferencesOnDisk(
 440       base::DictionaryValue* unprotected_preferences,
 441       base::DictionaryValue* protected_preferences) OVERRIDE {
 442     base::DictionaryValue* selected_prefs =
 443         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 444                                                       : unprotected_preferences;
 445     // |selected_prefs| should never be NULL under the protection level picking
 446     // it.
 447     EXPECT_TRUE(selected_prefs);
 448     EXPECT_TRUE(selected_prefs->Remove(prefs::kHomePage, NULL));
 449   }
 450
 451   virtual void VerifyReactionToPrefAttack() OVERRIDE {
 452     // The clearance of homepage should have been noticed (as pref #2 being
 453     // cleared), but shouldn't have triggered a reset (as there is nothing we
 454     // can do when the pref is already gone).
 455     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 456               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 457                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 458     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 459                   ? num_tracked_prefs() - 1 : 0,
 460               GetTrackedPrefHistogramCount(
 461                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 462     EXPECT_EQ(0,
 463               GetTrackedPrefHistogramCount(
 464                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 465     EXPECT_EQ(0,
 466               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 467                                            ALLOW_NONE));
 468
 469     // Nothing else should have triggered.
 470     EXPECT_EQ(0,
 471               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 472                                            ALLOW_NONE));
 473     EXPECT_EQ(0,
 474               GetTrackedPrefHistogramCount(
 475                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 476     EXPECT_EQ(0,
 477               GetTrackedPrefHistogramCount(
 478                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 479     EXPECT_EQ(
 480         0,
 481         GetTrackedPrefHistogramCount(
 482             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 483   }
 484 };
 485
 486 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestClearedAtomic, ClearedAtomic);
 487
 488 // Verifies that clearing the MACs results in untrusted Initialized pings for
 489 // non-null protected prefs.
 490 class PrefHashBrowserTestUntrustedInitialized : public PrefHashBrowserTestBase {
 491  public:
 492   virtual void SetupPreferences() OVERRIDE {
 493     // Explicitly set the DSE (it's otherwise NULL by default, preventing
 494     // thorough testing of the PROTECTION_ENABLED_DSE level).
 495     DefaultSearchManager default_search_manager(
 496         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 497     DefaultSearchManager::Source dse_source =
 498         static_cast<DefaultSearchManager::Source>(-1);
 499
 500     const TemplateURLData* default_template_url_data =
 501         default_search_manager.GetDefaultSearchEngine(&dse_source);
 502     EXPECT_EQ(DefaultSearchManager::FROM_FALLBACK, dse_source);
 503
 504     default_search_manager.SetUserSelectedDefaultSearchEngine(
 505         *default_template_url_data);
 506
 507     default_search_manager.GetDefaultSearchEngine(&dse_source);
 508     EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source);
 509
 510     // Also explicitly set an atomic pref that falls under
 511     // PROTECTION_ENABLED_BASIC.
 512     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 513                                       SessionStartupPref::URLS);
 514   }
 515
 516   virtual void AttackPreferencesOnDisk(
 517       base::DictionaryValue* unprotected_preferences,
 518       base::DictionaryValue* protected_preferences) OVERRIDE {
 519     EXPECT_TRUE(unprotected_preferences->Remove("protection.macs", NULL));
 520     if (protected_preferences)
 521       EXPECT_TRUE(protected_preferences->Remove("protection.macs", NULL));
 522   }
 523
 524   virtual void VerifyReactionToPrefAttack() OVERRIDE {
 525     // Preferences that are NULL by default will be TrustedInitialized.
 526     int num_null_values = GetTrackedPrefHistogramCount(
 527         "Settings.TrackedPreferenceTrustedInitialized", ALLOW_ANY);
 528     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 529               num_null_values > 0);
 530     if (num_null_values > 0) {
 531       // This test requires that at least 3 prefs be non-null (extensions, DSE,
 532       // and 1 atomic pref explictly set for this test above).
 533       EXPECT_LT(num_null_values, num_tracked_prefs() - 3);
 534     }
 535
 536     // Expect all non-null prefs to be reported as Initialized (with
 537     // accompanying resets or wanted resets based on the current protection
 538     // level).
 539     EXPECT_EQ(num_tracked_prefs() - num_null_values,
 540               GetTrackedPrefHistogramCount(
 541                   "Settings.TrackedPreferenceInitialized", ALLOW_ANY));
 542
 543     int num_protected_prefs = 0;
 544     // A switch statement falling through each protection level in decreasing
 545     // levels of protection to add expectations for each level which augments
 546     // the previous one.
 547     switch (protection_level_) {
 548       case PROTECTION_ENABLED_ALL:
 549         // Falls through.
 550       case PROTECTION_ENABLED_EXTENSIONS:
 551         ++num_protected_prefs;
 552         // Falls through.
 553       case PROTECTION_ENABLED_DSE:
 554         ++num_protected_prefs;
 555         // Falls through.
 556       case PROTECTION_ENABLED_BASIC:
 557         num_protected_prefs += num_tracked_prefs() - num_null_values - 2;
 558         // Falls through.
 559       case PROTECTION_DISABLED_FOR_GROUP:
 560         // No protection. Falls through.
 561       case PROTECTION_DISABLED_ON_PLATFORM:
 562         // No protection.
 563         break;
 564     }
 565
 566     EXPECT_EQ(num_tracked_prefs() - num_null_values - num_protected_prefs,
 567               GetTrackedPrefHistogramCount(
 568                   "Settings.TrackedPreferenceWantedReset", ALLOW_ANY));
 569     EXPECT_EQ(num_protected_prefs,
 570               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 571                                            ALLOW_ANY));
 572
 573     // Explicitly verify the result of reported resets.
 574
 575     DefaultSearchManager default_search_manager(
 576         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 577     DefaultSearchManager::Source dse_source =
 578         static_cast<DefaultSearchManager::Source>(-1);
 579     default_search_manager.GetDefaultSearchEngine(&dse_source);
 580     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_DSE
 581                   ? DefaultSearchManager::FROM_USER
 582                   : DefaultSearchManager::FROM_FALLBACK,
 583               dse_source);
 584
 585     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_BASIC,
 586               profile()->GetPrefs()->GetInteger(prefs::kRestoreOnStartup) ==
 587                   SessionStartupPref::URLS);
 588
 589     // Nothing else should have triggered.
 590     EXPECT_EQ(0,
 591               GetTrackedPrefHistogramCount(
 592                   "Settings.TrackedPreferenceUnchanged", ALLOW_NONE));
 593     EXPECT_EQ(0,
 594               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 595                                            ALLOW_NONE));
 596     EXPECT_EQ(0,
 597               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 598                                            ALLOW_NONE));
 599     EXPECT_EQ(
 600         0,
 601         GetTrackedPrefHistogramCount(
 602             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 603   }
 604 };
 605
 606 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedInitialized,
 607                        UntrustedInitialized);
 608
 609 // Verifies that changing an atomic pref results in it being reported (and reset
 610 // if the protection level allows it).
 611 class PrefHashBrowserTestChangedAtomic : public PrefHashBrowserTestBase {
 612  public:
 613   virtual void SetupPreferences() OVERRIDE {
 614     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 615                                       SessionStartupPref::URLS);
 616
 617     ListPrefUpdate update(profile()->GetPrefs(),
 618                           prefs::kURLsToRestoreOnStartup);
 619     update->AppendString("http://example.com");
 620   }
 621
 622   virtual void AttackPreferencesOnDisk(
 623       base::DictionaryValue* unprotected_preferences,
 624       base::DictionaryValue* protected_preferences) OVERRIDE {
 625     base::DictionaryValue* selected_prefs =
 626         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 627                                                       : unprotected_preferences;
 628     // |selected_prefs| should never be NULL under the protection level picking
 629     // it.
 630     EXPECT_TRUE(selected_prefs);
 631     base::ListValue* startup_urls;
 632     EXPECT_TRUE(
 633         selected_prefs->GetList(prefs::kURLsToRestoreOnStartup, &startup_urls));
 634     EXPECT_TRUE(startup_urls);
 635     EXPECT_EQ(1U, startup_urls->GetSize());
 636     startup_urls->AppendString("http://example.org");
 637   }
 638
 639   virtual void VerifyReactionToPrefAttack() OVERRIDE {
 640     // Expect a single Changed event for tracked pref #4 (startup URLs).
 641     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 642               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 643                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 644     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 645                   ? num_tracked_prefs() - 1 : 0,
 646               GetTrackedPrefHistogramCount(
 647                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 648
 649     EXPECT_EQ(
 650         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 651          protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0,
 652         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 653                                      BEGIN_ALLOW_SINGLE_BUCKET + 4));
 654     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 1 : 0,
 655               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 656                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 657
 658 // TODO(gab): This doesn't work on OS_CHROMEOS because we fail to attack
 659 // Preferences.
 660 #if !defined(OS_CHROMEOS)
 661     // Explicitly verify the result of reported resets.
 662     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 0U : 2U,
 663               profile()
 664                   ->GetPrefs()
 665                   ->GetList(prefs::kURLsToRestoreOnStartup)
 666                   ->GetSize());
 667 #endif
 668
 669     // Nothing else should have triggered.
 670     EXPECT_EQ(0,
 671               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 672                                            ALLOW_NONE));
 673     EXPECT_EQ(0,
 674               GetTrackedPrefHistogramCount(
 675                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 676     EXPECT_EQ(0,
 677               GetTrackedPrefHistogramCount(
 678                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 679     EXPECT_EQ(
 680         0,
 681         GetTrackedPrefHistogramCount(
 682             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 683   }
 684 };
 685
 686 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedAtomic, ChangedAtomic);
 687
 688 // Verifies that changing or adding an entry in a split pref results in both
 689 // items being reported (and remove if the protection level allows it).
 690 class PrefHashBrowserTestChangedSplitPref : public PrefHashBrowserTestBase {
 691  public:
 692   virtual void SetupPreferences() OVERRIDE {
 693     InstallExtensionWithUIAutoConfirm(
 694         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 695   }
 696
 697   virtual void AttackPreferencesOnDisk(
 698       base::DictionaryValue* unprotected_preferences,
 699       base::DictionaryValue* protected_preferences) OVERRIDE {
 700     base::DictionaryValue* selected_prefs =
 701         protection_level_ >= PROTECTION_ENABLED_EXTENSIONS
 702             ? protected_preferences
 703             : unprotected_preferences;
 704     // |selected_prefs| should never be NULL under the protection level picking
 705     // it.
 706     EXPECT_TRUE(selected_prefs);
 707     base::DictionaryValue* extensions_dict;
 708     EXPECT_TRUE(selected_prefs->GetDictionary(
 709         extensions::pref_names::kExtensions, &extensions_dict));
 710     EXPECT_TRUE(extensions_dict);
 711
 712     // Tamper with any installed setting for good.crx
 713     base::DictionaryValue* good_crx_dict;
 714     EXPECT_TRUE(extensions_dict->GetDictionary(kGoodCrxId, &good_crx_dict));
 715     int good_crx_state;
 716     EXPECT_TRUE(good_crx_dict->GetInteger("state", &good_crx_state));
 717     EXPECT_EQ(extensions::Extension::ENABLED, good_crx_state);
 718     good_crx_dict->SetInteger("state", extensions::Extension::DISABLED);
 719
 720     // Drop a fake extension (for the purpose of this test, dropped settings
 721     // don't need to be valid extension settings).
 722     base::DictionaryValue* fake_extension = new base::DictionaryValue;
 723     fake_extension->SetString("name", "foo");
 724     extensions_dict->Set(std::string(32, 'a'), fake_extension);
 725   }
 726
 727   virtual void VerifyReactionToPrefAttack() OVERRIDE {
 728     // Expect a single split pref changed report with a count of 2 for tracked
 729     // pref #5 (extensions).
 730     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 731               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 732                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 733     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 734               GetTrackedPrefHistogramCount(
 735                   "Settings.TrackedSplitPreferenceChanged.extensions.settings",
 736                   BEGIN_ALLOW_SINGLE_BUCKET + 2));
 737
 738     // Everything else should have remained unchanged.
 739     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 740                   ? num_tracked_prefs() - 1 : 0,
 741               GetTrackedPrefHistogramCount(
 742                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 743
 744     EXPECT_EQ(
 745         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 746          protection_level_ < PROTECTION_ENABLED_EXTENSIONS) ? 1 : 0,
 747         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 748                                      BEGIN_ALLOW_SINGLE_BUCKET + 5));
 749     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_EXTENSIONS ? 1 : 0,
 750               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 751                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 752
 753     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_EXTENSIONS,
 754               extension_service()->GetExtensionById(kGoodCrxId, true) != NULL);
 755
 756     // Nothing else should have triggered.
 757     EXPECT_EQ(0,
 758               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 759                                            ALLOW_NONE));
 760     EXPECT_EQ(0,
 761               GetTrackedPrefHistogramCount(
 762                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 763     EXPECT_EQ(0,
 764               GetTrackedPrefHistogramCount(
 765                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 766     EXPECT_EQ(
 767         0,
 768         GetTrackedPrefHistogramCount(
 769             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 770   }
 771 };
 772
 773 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedSplitPref, ChangedSplitPref);