chrome/browser/prefs/tracked/pref_hash_browsertest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <string>
   6
   7 #include "base/command_line.h"
   8 #include "base/files/file_path.h"
   9 #include "base/files/file_util.h"
  10 #include "base/json/json_file_value_serializer.h"
  11 #include "base/memory/scoped_ptr.h"
  12 #include "base/metrics/histogram_base.h"
  13 #include "base/metrics/histogram_samples.h"
  14 #include "base/metrics/statistics_recorder.h"
  15 #include "base/path_service.h"
  16 #include "base/prefs/pref_service.h"
  17 #include "base/prefs/scoped_user_pref_update.h"
  18 #include "base/strings/string_number_conversions.h"
  19 #include "base/strings/string_util.h"
  20 #include "base/values.h"
  21 #include "build/build_config.h"
  22 #include "chrome/browser/extensions/extension_browsertest.h"
  23 #include "chrome/browser/extensions/extension_service.h"
  24 #include "chrome/browser/prefs/chrome_pref_service_factory.h"
  25 #include "chrome/browser/prefs/profile_pref_store_manager.h"
  26 #include "chrome/browser/prefs/session_startup_pref.h"
  27 #include "chrome/browser/profiles/profile.h"
  28 #include "chrome/browser/ui/browser.h"
  29 #include "chrome/common/chrome_constants.h"
  30 #include "chrome/common/chrome_paths.h"
  31 #include "chrome/common/pref_names.h"
  32 #include "chrome/test/base/testing_profile.h"
  33 #include "components/search_engines/default_search_manager.h"
  34 #include "content/public/common/content_switches.h"
  35 #include "extensions/browser/pref_names.h"
  36 #include "extensions/common/extension.h"
  37
  38 #if defined(OS_CHROMEOS)
  39 #include "chromeos/chromeos_switches.h"
  40 #endif
  41
  42 namespace {
  43
  44 // Extension ID of chrome/test/data/extensions/good.crx
  45 const char kGoodCrxId[] = "ldnnhddmnhbkjipkidpdiheffobcpfmf";
  46
  47 // Explicit expectations from the caller of GetTrackedPrefHistogramCount(). This
  48 // enables detailed reporting of the culprit on failure.
  49 enum AllowedBuckets {
  50   // Allow no samples in any buckets.
  51   ALLOW_NONE = -1,
  52   // Any integer between BEGIN_ALLOW_SINGLE_BUCKET and END_ALLOW_SINGLE_BUCKET
  53   // indicates that only this specific bucket is allowed to have a sample.
  54   BEGIN_ALLOW_SINGLE_BUCKET = 0,
  55   END_ALLOW_SINGLE_BUCKET = 100,
  56   // Allow any buckets (no extra verifications performed).
  57   ALLOW_ANY
  58 };
  59
  60 // Returns the number of times |histogram_name| was reported so far; adding the
  61 // results of the first 100 buckets (there are only ~19 reporting IDs as of this
  62 // writing; varies depending on the platform). |allowed_buckets| hints at extra
  63 // requirements verified in this method (see AllowedBuckets for details).
  64 int GetTrackedPrefHistogramCount(const char* histogram_name,
  65                                  int allowed_buckets) {
  66   const base::HistogramBase* histogram =
  67       base::StatisticsRecorder::FindHistogram(histogram_name);
  68   if (!histogram)
  69     return 0;
  70
  71   scoped_ptr<base::HistogramSamples> samples(histogram->SnapshotSamples());
  72   int sum = 0;
  73   for (int i = 0; i < 100; ++i) {
  74     int count_for_id = samples->GetCount(i);
  75     EXPECT_GE(count_for_id, 0);
  76     sum += count_for_id;
  77
  78     if (allowed_buckets == ALLOW_NONE ||
  79         (allowed_buckets != ALLOW_ANY && i != allowed_buckets)) {
  80       EXPECT_EQ(0, count_for_id) << "Unexpected reporting_id: " << i;
  81     }
  82   }
  83   return sum;
  84 }
  85
  86 scoped_ptr<base::DictionaryValue> ReadPrefsDictionary(
  87     const base::FilePath& pref_file) {
  88   JSONFileValueDeserializer deserializer(pref_file);
  89   int error_code = JSONFileValueDeserializer::JSON_NO_ERROR;
  90   std::string error_str;
  91   scoped_ptr<base::Value> prefs(
  92       deserializer.Deserialize(&error_code, &error_str));
  93   if (!prefs || error_code != JSONFileValueDeserializer::JSON_NO_ERROR) {
  94     ADD_FAILURE() << "Error #" << error_code << ": " << error_str;
  95     return scoped_ptr<base::DictionaryValue>();
  96   }
  97   if (!prefs->IsType(base::Value::TYPE_DICTIONARY)) {
  98     ADD_FAILURE();
  99     return scoped_ptr<base::DictionaryValue>();
 100   }
 101   return scoped_ptr<base::DictionaryValue>(
 102       static_cast<base::DictionaryValue*>(prefs.release()));
 103 }
 104
 105 #define PREF_HASH_BROWSER_TEST(fixture, test_name)                          \
 106   IN_PROC_BROWSER_TEST_P(fixture, PRE_##test_name) {                        \
 107     SetupPreferences();                                                     \
 108   }                                                                         \
 109   IN_PROC_BROWSER_TEST_P(fixture, test_name) {                              \
 110     VerifyReactionToPrefAttack();                                           \
 111   }                                                                         \
 112   INSTANTIATE_TEST_CASE_P(                                                  \
 113       fixture##Instance,                                                    \
 114       fixture,                                                              \
 115       testing::Values(                                                      \
 116           chrome_prefs::internals::kSettingsEnforcementGroupNoEnforcement,  \
 117           chrome_prefs::internals::kSettingsEnforcementGroupEnforceAlways,  \
 118           chrome_prefs::internals::                                         \
 119               kSettingsEnforcementGroupEnforceAlwaysWithDSE,                \
 120           chrome_prefs::internals::                                         \
 121               kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE));
 122
 123 // A base fixture designed such that implementations do two things:
 124 //  1) Override all three pure-virtual methods below to setup, attack, and
 125 //     verify preferenes throughout the tests provided by this fixture.
 126 //  2) Instantiate their test via the PREF_HASH_BROWSER_TEST macro above.
 127 // Based on top of ExtensionBrowserTest to allow easy interaction with the
 128 // ExtensionService.
 129 class PrefHashBrowserTestBase
 130     : public ExtensionBrowserTest,
 131       public testing::WithParamInterface<std::string> {
 132  public:
 133   // List of potential protection levels for this test in strict increasing
 134   // order of protection levels.
 135   enum SettingsProtectionLevel {
 136     PROTECTION_DISABLED_ON_PLATFORM,
 137     PROTECTION_DISABLED_FOR_GROUP,
 138     PROTECTION_ENABLED_BASIC,
 139     PROTECTION_ENABLED_DSE,
 140     PROTECTION_ENABLED_EXTENSIONS,
 141     // Represents the strongest level (i.e. always equivalent to the last one in
 142     // terms of protection), leave this one last when adding new levels.
 143     PROTECTION_ENABLED_ALL
 144   };
 145
 146   PrefHashBrowserTestBase()
 147       : protection_level_(GetProtectionLevelFromTrialGroup(GetParam())) {
 148   }
 149
 150   void SetUpCommandLine(base::CommandLine* command_line) override {
 151     ExtensionBrowserTest::SetUpCommandLine(command_line);
 152     EXPECT_FALSE(command_line->HasSwitch(switches::kForceFieldTrials));
 153     command_line->AppendSwitchASCII(
 154         switches::kForceFieldTrials,
 155         std::string(chrome_prefs::internals::kSettingsEnforcementTrialName) +
 156             "/" + GetParam() + "/");
 157 #if defined(OS_CHROMEOS)
 158     command_line->AppendSwitch(
 159         chromeos::switches::kIgnoreUserProfileMappingForTests);
 160 #endif
 161   }
 162
 163   bool SetUpUserDataDirectory() override {
 164     // Do the normal setup in the PRE test and attack preferences in the main
 165     // test.
 166     if (IsPRETest())
 167       return ExtensionBrowserTest::SetUpUserDataDirectory();
 168
 169 #if defined(OS_CHROMEOS)
 170     // For some reason, the Preferences file does not exist in the location
 171     // below on Chrome OS. Since protection is disabled on Chrome OS, it's okay
 172     // to simply not attack preferences at all (and still assert that no
 173     // hardening related histogram kicked in in VerifyReactionToPrefAttack()).
 174     // TODO(gab): Figure out why there is no Preferences file in this location
 175     // on Chrome OS (and re-enable the section disabled for OS_CHROMEOS further
 176     // below).
 177     EXPECT_EQ(PROTECTION_DISABLED_ON_PLATFORM, protection_level_);
 178     return true;
 179 #endif
 180
 181     base::FilePath profile_dir;
 182     EXPECT_TRUE(PathService::Get(chrome::DIR_USER_DATA, &profile_dir));
 183     profile_dir = profile_dir.AppendASCII(TestingProfile::kTestUserProfileDir);
 184
 185     // Sanity check that old protected pref file is never present in modern
 186     // Chromes.
 187     EXPECT_FALSE(base::PathExists(
 188         profile_dir.Append(chrome::kProtectedPreferencesFilenameDeprecated)));
 189
 190     // Read the preferences from disk.
 191
 192     const base::FilePath unprotected_pref_file =
 193         profile_dir.Append(chrome::kPreferencesFilename);
 194     EXPECT_TRUE(base::PathExists(unprotected_pref_file));
 195
 196     const base::FilePath protected_pref_file =
 197         profile_dir.Append(chrome::kSecurePreferencesFilename);
 198     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 199               base::PathExists(protected_pref_file));
 200
 201     scoped_ptr<base::DictionaryValue> unprotected_preferences(
 202         ReadPrefsDictionary(unprotected_pref_file));
 203     if (!unprotected_preferences)
 204       return false;
 205
 206     scoped_ptr<base::DictionaryValue> protected_preferences;
 207     if (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM) {
 208       protected_preferences = ReadPrefsDictionary(protected_pref_file);
 209       if (!protected_preferences)
 210         return false;
 211     }
 212
 213     // Let the underlying test modify the preferences.
 214     AttackPreferencesOnDisk(unprotected_preferences.get(),
 215                             protected_preferences.get());
 216
 217     // Write the modified preferences back to disk.
 218
 219     JSONFileValueSerializer unprotected_prefs_serializer(unprotected_pref_file);
 220     EXPECT_TRUE(
 221         unprotected_prefs_serializer.Serialize(*unprotected_preferences));
 222
 223     if (protected_preferences) {
 224       JSONFileValueSerializer protected_prefs_serializer(protected_pref_file);
 225       EXPECT_TRUE(protected_prefs_serializer.Serialize(*protected_preferences));
 226     }
 227
 228     return true;
 229   }
 230
 231   void SetUpInProcessBrowserTestFixture() override {
 232     ExtensionBrowserTest::SetUpInProcessBrowserTestFixture();
 233
 234     // Bots are on a domain, turn off the domain check for settings hardening in
 235     // order to be able to test all SettingsEnforcement groups.
 236     chrome_prefs::DisableDomainCheckForTesting();
 237   }
 238
 239   // In the PRE_ test, find the number of tracked preferences that were
 240   // initialized and save it to a file to be read back in the main test and used
 241   // as the total number of tracked preferences.
 242   void SetUpOnMainThread() override {
 243     ExtensionBrowserTest::SetUpOnMainThread();
 244
 245     // File in which the PRE_ test will save the number of tracked preferences
 246     // on this platform.
 247     const char kNumTrackedPrefFilename[] = "NumTrackedPrefs";
 248
 249     base::FilePath num_tracked_prefs_file;
 250     ASSERT_TRUE(
 251         PathService::Get(chrome::DIR_USER_DATA, &num_tracked_prefs_file));
 252     num_tracked_prefs_file =
 253         num_tracked_prefs_file.AppendASCII(kNumTrackedPrefFilename);
 254
 255     if (IsPRETest()) {
 256       num_tracked_prefs_ = GetTrackedPrefHistogramCount(
 257           "Settings.TrackedPreferenceNullInitialized", ALLOW_ANY);
 258       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 259                 num_tracked_prefs_ > 0);
 260
 261       // Split tracked prefs are reported as Unchanged not as NullInitialized
 262       // when an empty dictionary is encountered on first run (this should only
 263       // hit for pref #5 in the current design).
 264       int num_split_tracked_prefs = GetTrackedPrefHistogramCount(
 265           "Settings.TrackedPreferenceUnchanged", BEGIN_ALLOW_SINGLE_BUCKET + 5);
 266       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 267                 num_split_tracked_prefs);
 268
 269       num_tracked_prefs_ += num_split_tracked_prefs;
 270
 271       std::string num_tracked_prefs_str = base::IntToString(num_tracked_prefs_);
 272       EXPECT_EQ(static_cast<int>(num_tracked_prefs_str.size()),
 273                 base::WriteFile(num_tracked_prefs_file,
 274                                 num_tracked_prefs_str.c_str(),
 275                                 num_tracked_prefs_str.size()));
 276     } else {
 277       std::string num_tracked_prefs_str;
 278       EXPECT_TRUE(base::ReadFileToString(num_tracked_prefs_file,
 279                                          &num_tracked_prefs_str));
 280       EXPECT_TRUE(
 281           base::StringToInt(num_tracked_prefs_str, &num_tracked_prefs_));
 282     }
 283   }
 284
 285  protected:
 286   // Called from the PRE_ test's body. Overrides should use it to setup
 287   // preferences through Chrome.
 288   virtual void SetupPreferences() = 0;
 289
 290   // Called prior to the main test launching its browser. Overrides should use
 291   // it to attack preferences. |(un)protected_preferences| represent the state
 292   // on disk prior to launching the main test, they can be modified by this
 293   // method and modifications will be flushed back to disk before launching the
 294   // main test. |unprotected_preferences| is never NULL, |protected_preferences|
 295   // may be NULL if in PROTECTION_DISABLED_ON_PLATFORM mode.
 296   virtual void AttackPreferencesOnDisk(
 297       base::DictionaryValue* unprotected_preferences,
 298       base::DictionaryValue* protected_preferences) = 0;
 299
 300   // Called from the body of the main test. Overrides should use it to verify
 301   // that the browser had the desired reaction when faced when the attack
 302   // orchestrated in AttackPreferencesOnDisk().
 303   virtual void VerifyReactionToPrefAttack() = 0;
 304
 305   int num_tracked_prefs() const { return num_tracked_prefs_; }
 306
 307   const SettingsProtectionLevel protection_level_;
 308
 309  private:
 310   // Returns true if this is the PRE_ phase of the test.
 311   bool IsPRETest() {
 312     return StartsWithASCII(
 313         testing::UnitTest::GetInstance()->current_test_info()->name(),
 314         "PRE_",
 315         true /* case_sensitive */);
 316   }
 317
 318   SettingsProtectionLevel GetProtectionLevelFromTrialGroup(
 319       const std::string& trial_group) {
 320     if (!ProfilePrefStoreManager::kPlatformSupportsPreferenceTracking)
 321       return PROTECTION_DISABLED_ON_PLATFORM;
 322
 323 // Protection levels can't be adjusted via --force-fieldtrials in official
 324 // builds.
 325 #if defined(OFFICIAL_BUILD)
 326
 327 #if defined(OS_WIN)
 328     // The strongest mode is enforced on Windows in the absence of a field
 329     // trial.
 330     return PROTECTION_ENABLED_ALL;
 331 #else
 332     return PROTECTION_DISABLED_FOR_GROUP;
 333 #endif
 334
 335 #else  // defined(OFFICIAL_BUILD)
 336
 337     using namespace chrome_prefs::internals;
 338     if (trial_group == kSettingsEnforcementGroupNoEnforcement) {
 339       return PROTECTION_DISABLED_FOR_GROUP;
 340     } else if (trial_group == kSettingsEnforcementGroupEnforceAlways) {
 341       return PROTECTION_ENABLED_BASIC;
 342     } else if (trial_group == kSettingsEnforcementGroupEnforceAlwaysWithDSE) {
 343       return PROTECTION_ENABLED_DSE;
 344     } else if (trial_group ==
 345                kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE) {
 346       return PROTECTION_ENABLED_EXTENSIONS;
 347     } else {
 348       ADD_FAILURE();
 349       return static_cast<SettingsProtectionLevel>(-1);
 350     }
 351
 352 #endif  // defined(OFFICIAL_BUILD)
 353
 354   }
 355
 356   int num_tracked_prefs_;
 357 };
 358
 359 }  // namespace
 360
 361 // Verifies that nothing is reset when nothing is tampered with.
 362 // Also sanity checks that the expected preferences files are in place.
 363 class PrefHashBrowserTestUnchangedDefault : public PrefHashBrowserTestBase {
 364  public:
 365   void SetupPreferences() override {
 366     // Default Chrome setup.
 367   }
 368
 369   void AttackPreferencesOnDisk(
 370       base::DictionaryValue* unprotected_preferences,
 371       base::DictionaryValue* protected_preferences) override {
 372     // No attack.
 373   }
 374
 375   void VerifyReactionToPrefAttack() override {
 376     // Expect all prefs to be reported as Unchanged with no resets.
 377     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 378                   ? num_tracked_prefs() : 0,
 379               GetTrackedPrefHistogramCount(
 380                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 381     EXPECT_EQ(0,
 382               GetTrackedPrefHistogramCount(
 383                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 384     EXPECT_EQ(0,
 385               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 386                                            ALLOW_NONE));
 387
 388     // Nothing else should have triggered.
 389     EXPECT_EQ(0,
 390               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 391                                            ALLOW_NONE));
 392     EXPECT_EQ(0,
 393               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 394                                            ALLOW_NONE));
 395     EXPECT_EQ(0,
 396               GetTrackedPrefHistogramCount(
 397                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 398     EXPECT_EQ(0,
 399               GetTrackedPrefHistogramCount(
 400                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 401     EXPECT_EQ(0,
 402               GetTrackedPrefHistogramCount(
 403                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 404     EXPECT_EQ(
 405         0,
 406         GetTrackedPrefHistogramCount(
 407             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 408   }
 409 };
 410
 411 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedDefault, UnchangedDefault);
 412
 413 // Augments PrefHashBrowserTestUnchangedDefault to confirm that nothing is reset
 414 // when nothing is tampered with, even if Chrome itself wrote custom prefs in
 415 // its last run.
 416 class PrefHashBrowserTestUnchangedCustom
 417     : public PrefHashBrowserTestUnchangedDefault {
 418  public:
 419   void SetupPreferences() override {
 420     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 421
 422     InstallExtensionWithUIAutoConfirm(
 423         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 424   }
 425
 426   void VerifyReactionToPrefAttack() override {
 427     // Make sure the settings written in the last run stuck.
 428     EXPECT_EQ("http://example.com",
 429               profile()->GetPrefs()->GetString(prefs::kHomePage));
 430
 431     EXPECT_TRUE(extension_service()->GetExtensionById(kGoodCrxId, false));
 432
 433     // Reaction should be identical to unattacked default prefs.
 434     PrefHashBrowserTestUnchangedDefault::VerifyReactionToPrefAttack();
 435   }
 436 };
 437
 438 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedCustom, UnchangedCustom);
 439
 440 // Verifies that cleared prefs are reported.
 441 class PrefHashBrowserTestClearedAtomic : public PrefHashBrowserTestBase {
 442  public:
 443   void SetupPreferences() override {
 444     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 445   }
 446
 447   void AttackPreferencesOnDisk(
 448       base::DictionaryValue* unprotected_preferences,
 449       base::DictionaryValue* protected_preferences) override {
 450     base::DictionaryValue* selected_prefs =
 451         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 452                                                       : unprotected_preferences;
 453     // |selected_prefs| should never be NULL under the protection level picking
 454     // it.
 455     EXPECT_TRUE(selected_prefs);
 456     EXPECT_TRUE(selected_prefs->Remove(prefs::kHomePage, NULL));
 457   }
 458
 459   void VerifyReactionToPrefAttack() override {
 460     // The clearance of homepage should have been noticed (as pref #2 being
 461     // cleared), but shouldn't have triggered a reset (as there is nothing we
 462     // can do when the pref is already gone).
 463     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 464               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 465                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 466     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 467                   ? num_tracked_prefs() - 1 : 0,
 468               GetTrackedPrefHistogramCount(
 469                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 470     EXPECT_EQ(0,
 471               GetTrackedPrefHistogramCount(
 472                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 473     EXPECT_EQ(0,
 474               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 475                                            ALLOW_NONE));
 476
 477     // Nothing else should have triggered.
 478     EXPECT_EQ(0,
 479               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 480                                            ALLOW_NONE));
 481     EXPECT_EQ(0,
 482               GetTrackedPrefHistogramCount(
 483                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 484     EXPECT_EQ(0,
 485               GetTrackedPrefHistogramCount(
 486                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 487     EXPECT_EQ(0,
 488               GetTrackedPrefHistogramCount(
 489                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 490     EXPECT_EQ(
 491         0,
 492         GetTrackedPrefHistogramCount(
 493             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 494   }
 495 };
 496
 497 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestClearedAtomic, ClearedAtomic);
 498
 499 // Verifies that clearing the MACs results in untrusted Initialized pings for
 500 // non-null protected prefs.
 501 class PrefHashBrowserTestUntrustedInitialized : public PrefHashBrowserTestBase {
 502  public:
 503   void SetupPreferences() override {
 504     // Explicitly set the DSE (it's otherwise NULL by default, preventing
 505     // thorough testing of the PROTECTION_ENABLED_DSE level).
 506     DefaultSearchManager default_search_manager(
 507         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 508     DefaultSearchManager::Source dse_source =
 509         static_cast<DefaultSearchManager::Source>(-1);
 510
 511     const TemplateURLData* default_template_url_data =
 512         default_search_manager.GetDefaultSearchEngine(&dse_source);
 513     EXPECT_EQ(DefaultSearchManager::FROM_FALLBACK, dse_source);
 514
 515     default_search_manager.SetUserSelectedDefaultSearchEngine(
 516         *default_template_url_data);
 517
 518     default_search_manager.GetDefaultSearchEngine(&dse_source);
 519     EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source);
 520
 521     // Also explicitly set an atomic pref that falls under
 522     // PROTECTION_ENABLED_BASIC.
 523     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 524                                       SessionStartupPref::URLS);
 525   }
 526
 527   void AttackPreferencesOnDisk(
 528       base::DictionaryValue* unprotected_preferences,
 529       base::DictionaryValue* protected_preferences) override {
 530     EXPECT_TRUE(unprotected_preferences->Remove("protection.macs", NULL));
 531     if (protected_preferences)
 532       EXPECT_TRUE(protected_preferences->Remove("protection.macs", NULL));
 533   }
 534
 535   void VerifyReactionToPrefAttack() override {
 536     // Preferences that are NULL by default will be NullInitialized.
 537     int num_null_values = GetTrackedPrefHistogramCount(
 538         "Settings.TrackedPreferenceNullInitialized", ALLOW_ANY);
 539     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 540               num_null_values > 0);
 541     if (num_null_values > 0) {
 542       // This test requires that at least 3 prefs be non-null (extensions, DSE,
 543       // and 1 atomic pref explictly set for this test above).
 544       EXPECT_GE(num_tracked_prefs() - num_null_values, 3);
 545     }
 546
 547     // Expect all non-null prefs to be reported as Initialized (with
 548     // accompanying resets or wanted resets based on the current protection
 549     // level).
 550     EXPECT_EQ(num_tracked_prefs() - num_null_values,
 551               GetTrackedPrefHistogramCount(
 552                   "Settings.TrackedPreferenceInitialized", ALLOW_ANY));
 553
 554     int num_protected_prefs = 0;
 555     // A switch statement falling through each protection level in decreasing
 556     // levels of protection to add expectations for each level which augments
 557     // the previous one.
 558     switch (protection_level_) {
 559       case PROTECTION_ENABLED_ALL:
 560         // Falls through.
 561       case PROTECTION_ENABLED_EXTENSIONS:
 562         ++num_protected_prefs;
 563         // Falls through.
 564       case PROTECTION_ENABLED_DSE:
 565         ++num_protected_prefs;
 566         // Falls through.
 567       case PROTECTION_ENABLED_BASIC:
 568         num_protected_prefs += num_tracked_prefs() - num_null_values - 2;
 569         // Falls through.
 570       case PROTECTION_DISABLED_FOR_GROUP:
 571         // No protection. Falls through.
 572       case PROTECTION_DISABLED_ON_PLATFORM:
 573         // No protection.
 574         break;
 575     }
 576
 577     EXPECT_EQ(num_tracked_prefs() - num_null_values - num_protected_prefs,
 578               GetTrackedPrefHistogramCount(
 579                   "Settings.TrackedPreferenceWantedReset", ALLOW_ANY));
 580     EXPECT_EQ(num_protected_prefs,
 581               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 582                                            ALLOW_ANY));
 583
 584     // Explicitly verify the result of reported resets.
 585
 586     DefaultSearchManager default_search_manager(
 587         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 588     DefaultSearchManager::Source dse_source =
 589         static_cast<DefaultSearchManager::Source>(-1);
 590     default_search_manager.GetDefaultSearchEngine(&dse_source);
 591     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_DSE
 592                   ? DefaultSearchManager::FROM_USER
 593                   : DefaultSearchManager::FROM_FALLBACK,
 594               dse_source);
 595
 596     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_BASIC,
 597               profile()->GetPrefs()->GetInteger(prefs::kRestoreOnStartup) ==
 598                   SessionStartupPref::URLS);
 599
 600     // Nothing else should have triggered.
 601     EXPECT_EQ(0,
 602               GetTrackedPrefHistogramCount(
 603                   "Settings.TrackedPreferenceUnchanged", ALLOW_NONE));
 604     EXPECT_EQ(0,
 605               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 606                                            ALLOW_NONE));
 607     EXPECT_EQ(0,
 608               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 609                                            ALLOW_NONE));
 610     EXPECT_EQ(
 611         0,
 612         GetTrackedPrefHistogramCount(
 613             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 614   }
 615 };
 616
 617 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedInitialized,
 618                        UntrustedInitialized);
 619
 620 // Verifies that changing an atomic pref results in it being reported (and reset
 621 // if the protection level allows it).
 622 class PrefHashBrowserTestChangedAtomic : public PrefHashBrowserTestBase {
 623  public:
 624   void SetupPreferences() override {
 625     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 626                                       SessionStartupPref::URLS);
 627
 628     ListPrefUpdate update(profile()->GetPrefs(),
 629                           prefs::kURLsToRestoreOnStartup);
 630     update->AppendString("http://example.com");
 631   }
 632
 633   void AttackPreferencesOnDisk(
 634       base::DictionaryValue* unprotected_preferences,
 635       base::DictionaryValue* protected_preferences) override {
 636     base::DictionaryValue* selected_prefs =
 637         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 638                                                       : unprotected_preferences;
 639     // |selected_prefs| should never be NULL under the protection level picking
 640     // it.
 641     EXPECT_TRUE(selected_prefs);
 642     base::ListValue* startup_urls;
 643     EXPECT_TRUE(
 644         selected_prefs->GetList(prefs::kURLsToRestoreOnStartup, &startup_urls));
 645     EXPECT_TRUE(startup_urls);
 646     EXPECT_EQ(1U, startup_urls->GetSize());
 647     startup_urls->AppendString("http://example.org");
 648   }
 649
 650   void VerifyReactionToPrefAttack() override {
 651     // Expect a single Changed event for tracked pref #4 (startup URLs).
 652     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 653               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 654                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 655     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 656                   ? num_tracked_prefs() - 1 : 0,
 657               GetTrackedPrefHistogramCount(
 658                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 659
 660     EXPECT_EQ(
 661         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 662          protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0,
 663         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 664                                      BEGIN_ALLOW_SINGLE_BUCKET + 4));
 665     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 1 : 0,
 666               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 667                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 668
 669 // TODO(gab): This doesn't work on OS_CHROMEOS because we fail to attack
 670 // Preferences.
 671 #if !defined(OS_CHROMEOS)
 672     // Explicitly verify the result of reported resets.
 673     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 0U : 2U,
 674               profile()
 675                   ->GetPrefs()
 676                   ->GetList(prefs::kURLsToRestoreOnStartup)
 677                   ->GetSize());
 678 #endif
 679
 680     // Nothing else should have triggered.
 681     EXPECT_EQ(0,
 682               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 683                                            ALLOW_NONE));
 684     EXPECT_EQ(0,
 685               GetTrackedPrefHistogramCount(
 686                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 687     EXPECT_EQ(0,
 688               GetTrackedPrefHistogramCount(
 689                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 690     EXPECT_EQ(0,
 691               GetTrackedPrefHistogramCount(
 692                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 693     EXPECT_EQ(
 694         0,
 695         GetTrackedPrefHistogramCount(
 696             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 697   }
 698 };
 699
 700 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedAtomic, ChangedAtomic);
 701
 702 // Verifies that changing or adding an entry in a split pref results in both
 703 // items being reported (and remove if the protection level allows it).
 704 class PrefHashBrowserTestChangedSplitPref : public PrefHashBrowserTestBase {
 705  public:
 706   void SetupPreferences() override {
 707     InstallExtensionWithUIAutoConfirm(
 708         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 709   }
 710
 711   void AttackPreferencesOnDisk(
 712       base::DictionaryValue* unprotected_preferences,
 713       base::DictionaryValue* protected_preferences) override {
 714     base::DictionaryValue* selected_prefs =
 715         protection_level_ >= PROTECTION_ENABLED_EXTENSIONS
 716             ? protected_preferences
 717             : unprotected_preferences;
 718     // |selected_prefs| should never be NULL under the protection level picking
 719     // it.
 720     EXPECT_TRUE(selected_prefs);
 721     base::DictionaryValue* extensions_dict;
 722     EXPECT_TRUE(selected_prefs->GetDictionary(
 723         extensions::pref_names::kExtensions, &extensions_dict));
 724     EXPECT_TRUE(extensions_dict);
 725
 726     // Tamper with any installed setting for good.crx
 727     base::DictionaryValue* good_crx_dict;
 728     EXPECT_TRUE(extensions_dict->GetDictionary(kGoodCrxId, &good_crx_dict));
 729     int good_crx_state;
 730     EXPECT_TRUE(good_crx_dict->GetInteger("state", &good_crx_state));
 731     EXPECT_EQ(extensions::Extension::ENABLED, good_crx_state);
 732     good_crx_dict->SetInteger("state", extensions::Extension::DISABLED);
 733
 734     // Drop a fake extension (for the purpose of this test, dropped settings
 735     // don't need to be valid extension settings).
 736     base::DictionaryValue* fake_extension = new base::DictionaryValue;
 737     fake_extension->SetString("name", "foo");
 738     extensions_dict->Set(std::string(32, 'a'), fake_extension);
 739   }
 740
 741   void VerifyReactionToPrefAttack() override {
 742     // Expect a single split pref changed report with a count of 2 for tracked
 743     // pref #5 (extensions).
 744     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 745               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 746                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 747     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 748               GetTrackedPrefHistogramCount(
 749                   "Settings.TrackedSplitPreferenceChanged.extensions.settings",
 750                   BEGIN_ALLOW_SINGLE_BUCKET + 2));
 751
 752     // Everything else should have remained unchanged.
 753     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 754                   ? num_tracked_prefs() - 1 : 0,
 755               GetTrackedPrefHistogramCount(
 756                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 757
 758     EXPECT_EQ(
 759         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 760          protection_level_ < PROTECTION_ENABLED_EXTENSIONS) ? 1 : 0,
 761         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 762                                      BEGIN_ALLOW_SINGLE_BUCKET + 5));
 763     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_EXTENSIONS ? 1 : 0,
 764               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 765                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 766
 767     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_EXTENSIONS,
 768               extension_service()->GetExtensionById(kGoodCrxId, true) != NULL);
 769
 770     // Nothing else should have triggered.
 771     EXPECT_EQ(0,
 772               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 773                                            ALLOW_NONE));
 774     EXPECT_EQ(0,
 775               GetTrackedPrefHistogramCount(
 776                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 777     EXPECT_EQ(0,
 778               GetTrackedPrefHistogramCount(
 779                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 780     EXPECT_EQ(0,
 781               GetTrackedPrefHistogramCount(
 782                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 783     EXPECT_EQ(
 784         0,
 785         GetTrackedPrefHistogramCount(
 786             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 787   }
 788 };
 789
 790 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedSplitPref, ChangedSplitPref);
 791
 792 // Verifies that adding a value to unprotected preferences for a key which is
 793 // still using the default (i.e. has no value stored in protected preferences)
 794 // doesn't allow that value to slip in with no valid MAC (regression test for
 795 // http://crbug.com/414554)
 796 class PrefHashBrowserTestUntrustedAdditionToPrefs
 797     : public PrefHashBrowserTestBase {
 798  public:
 799   void SetupPreferences() override {
 800     // Ensure there is no user-selected value for kRestoreOnStartup.
 801     EXPECT_FALSE(
 802         profile()->GetPrefs()->GetUserPrefValue(prefs::kRestoreOnStartup));
 803   }
 804
 805   void AttackPreferencesOnDisk(
 806       base::DictionaryValue* unprotected_preferences,
 807       base::DictionaryValue* protected_preferences) override {
 808     unprotected_preferences->SetInteger(prefs::kRestoreOnStartup,
 809                                         SessionStartupPref::LAST);
 810   }
 811
 812   void VerifyReactionToPrefAttack() override {
 813     // Expect a single Changed event for tracked pref #3 (kRestoreOnStartup) if
 814     // not protecting; if protection is enabled the change should be a no-op.
 815     int changed_expected =
 816         protection_level_ == PROTECTION_DISABLED_FOR_GROUP ? 1 : 0;
 817     EXPECT_EQ(
 818         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 819          protection_level_ < PROTECTION_ENABLED_BASIC) ? changed_expected : 0,
 820         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 821                                      BEGIN_ALLOW_SINGLE_BUCKET + 3));
 822     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 823                   ? num_tracked_prefs() - changed_expected : 0,
 824               GetTrackedPrefHistogramCount(
 825                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 826
 827     EXPECT_EQ(
 828         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 829          protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0,
 830         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 831                                      BEGIN_ALLOW_SINGLE_BUCKET + 3));
 832     EXPECT_EQ(0,
 833               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 834                                            ALLOW_NONE));
 835
 836     // Nothing else should have triggered.
 837     EXPECT_EQ(0,
 838               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 839                                            ALLOW_NONE));
 840     EXPECT_EQ(0,
 841               GetTrackedPrefHistogramCount(
 842                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 843     EXPECT_EQ(0,
 844               GetTrackedPrefHistogramCount(
 845                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 846     EXPECT_EQ(0,
 847               GetTrackedPrefHistogramCount(
 848                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 849     EXPECT_EQ(
 850         0,
 851         GetTrackedPrefHistogramCount(
 852             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 853   }
 854 };
 855
 856 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefs,
 857                        UntrustedAdditionToPrefs);
 858
 859 // Verifies that adding a value to unprotected preferences while wiping a
 860 // user-selected value from protected preferences doesn't allow that value to
 861 // slip in with no valid MAC (regression test for http://crbug.com/414554).
 862 class PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe
 863     : public PrefHashBrowserTestBase {
 864  public:
 865   void SetupPreferences() override {
 866     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 867   }
 868
 869   void AttackPreferencesOnDisk(
 870       base::DictionaryValue* unprotected_preferences,
 871       base::DictionaryValue* protected_preferences) override {
 872     // Set or change the value in Preferences to the attacker's choice.
 873     unprotected_preferences->SetString(prefs::kHomePage, "http://example.net");
 874     // Clear the value in Secure Preferences, if any.
 875     if (protected_preferences)
 876       protected_preferences->Remove(prefs::kHomePage, NULL);
 877   }
 878
 879   void VerifyReactionToPrefAttack() override {
 880     // Expect a single Changed event for tracked pref #2 (kHomePage) if
 881     // not protecting; if protection is enabled the change should be a Cleared.
 882     int changed_expected =
 883         protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 884         protection_level_ < PROTECTION_ENABLED_BASIC
 885         ? 1 : 0;
 886     int cleared_expected =
 887         protection_level_ >= PROTECTION_ENABLED_BASIC
 888         ? 1 : 0;
 889     EXPECT_EQ(changed_expected,
 890               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 891                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 892     EXPECT_EQ(cleared_expected,
 893               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 894                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 895     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 896                   ? num_tracked_prefs() - changed_expected - cleared_expected
 897                   : 0,
 898               GetTrackedPrefHistogramCount(
 899                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 900
 901     EXPECT_EQ(
 902         changed_expected,
 903         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 904                                      BEGIN_ALLOW_SINGLE_BUCKET + 2));
 905     EXPECT_EQ(0,
 906               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 907                                            ALLOW_NONE));
 908
 909     // Nothing else should have triggered.
 910     EXPECT_EQ(0,
 911               GetTrackedPrefHistogramCount(
 912                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 913     EXPECT_EQ(0,
 914               GetTrackedPrefHistogramCount(
 915                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 916     EXPECT_EQ(0,
 917               GetTrackedPrefHistogramCount(
 918                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 919     EXPECT_EQ(
 920         0,
 921         GetTrackedPrefHistogramCount(
 922             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 923   }
 924 };
 925
 926 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe,
 927                        UntrustedAdditionToPrefsAfterWipe);