chrome/browser/prefs/tracked/pref_hash_browsertest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <string>
   6
   7 #include "base/command_line.h"
   8 #include "base/files/file_path.h"
   9 #include "base/files/file_util.h"
  10 #include "base/json/json_file_value_serializer.h"
  11 #include "base/memory/scoped_ptr.h"
  12 #include "base/metrics/histogram_base.h"
  13 #include "base/metrics/histogram_samples.h"
  14 #include "base/metrics/statistics_recorder.h"
  15 #include "base/path_service.h"
  16 #include "base/prefs/pref_service.h"
  17 #include "base/prefs/scoped_user_pref_update.h"
  18 #include "base/strings/string_number_conversions.h"
  19 #include "base/strings/string_util.h"
  20 #include "base/values.h"
  21 #include "build/build_config.h"
  22 #include "chrome/browser/extensions/extension_browsertest.h"
  23 #include "chrome/browser/extensions/extension_service.h"
  24 #include "chrome/browser/prefs/chrome_pref_service_factory.h"
  25 #include "chrome/browser/prefs/profile_pref_store_manager.h"
  26 #include "chrome/browser/prefs/session_startup_pref.h"
  27 #include "chrome/browser/profiles/profile.h"
  28 #include "chrome/browser/ui/browser.h"
  29 #include "chrome/common/chrome_constants.h"
  30 #include "chrome/common/chrome_paths.h"
  31 #include "chrome/common/pref_names.h"
  32 #include "chrome/test/base/testing_profile.h"
  33 #include "components/search_engines/default_search_manager.h"
  34 #include "content/public/common/content_switches.h"
  35 #include "extensions/browser/pref_names.h"
  36 #include "extensions/common/extension.h"
  37
  38 #if defined(OS_CHROMEOS)
  39 #include "chromeos/chromeos_switches.h"
  40 #endif
  41
  42 namespace {
  43
  44 // Extension ID of chrome/test/data/extensions/good.crx
  45 const char kGoodCrxId[] = "ldnnhddmnhbkjipkidpdiheffobcpfmf";
  46
  47 // Explicit expectations from the caller of GetTrackedPrefHistogramCount(). This
  48 // enables detailed reporting of the culprit on failure.
  49 enum AllowedBuckets {
  50   // Allow no samples in any buckets.
  51   ALLOW_NONE = -1,
  52   // Any integer between BEGIN_ALLOW_SINGLE_BUCKET and END_ALLOW_SINGLE_BUCKET
  53   // indicates that only this specific bucket is allowed to have a sample.
  54   BEGIN_ALLOW_SINGLE_BUCKET = 0,
  55   END_ALLOW_SINGLE_BUCKET = 100,
  56   // Allow any buckets (no extra verifications performed).
  57   ALLOW_ANY
  58 };
  59
  60 // Returns the number of times |histogram_name| was reported so far; adding the
  61 // results of the first 100 buckets (there are only ~19 reporting IDs as of this
  62 // writing; varies depending on the platform). |allowed_buckets| hints at extra
  63 // requirements verified in this method (see AllowedBuckets for details).
  64 int GetTrackedPrefHistogramCount(const char* histogram_name,
  65                                  int allowed_buckets) {
  66   const base::HistogramBase* histogram =
  67       base::StatisticsRecorder::FindHistogram(histogram_name);
  68   if (!histogram)
  69     return 0;
  70
  71   scoped_ptr<base::HistogramSamples> samples(histogram->SnapshotSamples());
  72   int sum = 0;
  73   for (int i = 0; i < 100; ++i) {
  74     int count_for_id = samples->GetCount(i);
  75     EXPECT_GE(count_for_id, 0);
  76     sum += count_for_id;
  77
  78     if (allowed_buckets == ALLOW_NONE ||
  79         (allowed_buckets != ALLOW_ANY && i != allowed_buckets)) {
  80       EXPECT_EQ(0, count_for_id) << "Unexpected reporting_id: " << i;
  81     }
  82   }
  83   return sum;
  84 }
  85
  86 scoped_ptr<base::DictionaryValue> ReadPrefsDictionary(
  87     const base::FilePath& pref_file) {
  88   JSONFileValueDeserializer deserializer(pref_file);
  89   int error_code = JSONFileValueDeserializer::JSON_NO_ERROR;
  90   std::string error_str;
  91   scoped_ptr<base::Value> prefs(
  92       deserializer.Deserialize(&error_code, &error_str));
  93   if (!prefs || error_code != JSONFileValueDeserializer::JSON_NO_ERROR) {
  94     ADD_FAILURE() << "Error #" << error_code << ": " << error_str;
  95     return scoped_ptr<base::DictionaryValue>();
  96   }
  97   if (!prefs->IsType(base::Value::TYPE_DICTIONARY)) {
  98     ADD_FAILURE();
  99     return scoped_ptr<base::DictionaryValue>();
 100   }
 101   return scoped_ptr<base::DictionaryValue>(
 102       static_cast<base::DictionaryValue*>(prefs.release()));
 103 }
 104
 105 #define PREF_HASH_BROWSER_TEST(fixture, test_name)                          \
 106   IN_PROC_BROWSER_TEST_P(fixture, PRE_##test_name) {                        \
 107     SetupPreferences();                                                     \
 108   }                                                                         \
 109   IN_PROC_BROWSER_TEST_P(fixture, test_name) {                              \
 110     VerifyReactionToPrefAttack();                                           \
 111   }                                                                         \
 112   INSTANTIATE_TEST_CASE_P(                                                  \
 113       fixture##Instance,                                                    \
 114       fixture,                                                              \
 115       testing::Values(                                                      \
 116           chrome_prefs::internals::kSettingsEnforcementGroupNoEnforcement,  \
 117           chrome_prefs::internals::kSettingsEnforcementGroupEnforceAlways,  \
 118           chrome_prefs::internals::                                         \
 119               kSettingsEnforcementGroupEnforceAlwaysWithDSE,                \
 120           chrome_prefs::internals::                                         \
 121               kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE));
 122
 123 // A base fixture designed such that implementations do two things:
 124 //  1) Override all three pure-virtual methods below to setup, attack, and
 125 //     verify preferenes throughout the tests provided by this fixture.
 126 //  2) Instantiate their test via the PREF_HASH_BROWSER_TEST macro above.
 127 // Based on top of ExtensionBrowserTest to allow easy interaction with the
 128 // ExtensionService.
 129 class PrefHashBrowserTestBase
 130     : public ExtensionBrowserTest,
 131       public testing::WithParamInterface<std::string> {
 132  public:
 133   // List of potential protection levels for this test in strict increasing
 134   // order of protection levels.
 135   enum SettingsProtectionLevel {
 136     PROTECTION_DISABLED_ON_PLATFORM,
 137     PROTECTION_DISABLED_FOR_GROUP,
 138     PROTECTION_ENABLED_BASIC,
 139     PROTECTION_ENABLED_DSE,
 140     PROTECTION_ENABLED_EXTENSIONS,
 141     // Represents the strongest level (i.e. always equivalent to the last one in
 142     // terms of protection), leave this one last when adding new levels.
 143     PROTECTION_ENABLED_ALL
 144   };
 145
 146   PrefHashBrowserTestBase()
 147       : protection_level_(GetProtectionLevelFromTrialGroup(GetParam())) {
 148   }
 149
 150   void SetUpCommandLine(base::CommandLine* command_line) override {
 151     ExtensionBrowserTest::SetUpCommandLine(command_line);
 152     EXPECT_FALSE(command_line->HasSwitch(switches::kForceFieldTrials));
 153     command_line->AppendSwitchASCII(
 154         switches::kForceFieldTrials,
 155         std::string(chrome_prefs::internals::kSettingsEnforcementTrialName) +
 156             "/" + GetParam() + "/");
 157 #if defined(OS_CHROMEOS)
 158     command_line->AppendSwitch(
 159         chromeos::switches::kIgnoreUserProfileMappingForTests);
 160 #endif
 161   }
 162
 163   bool SetUpUserDataDirectory() override {
 164     // Do the normal setup in the PRE test and attack preferences in the main
 165     // test.
 166     if (IsPRETest())
 167       return ExtensionBrowserTest::SetUpUserDataDirectory();
 168
 169 #if defined(OS_CHROMEOS)
 170     // For some reason, the Preferences file does not exist in the location
 171     // below on Chrome OS. Since protection is disabled on Chrome OS, it's okay
 172     // to simply not attack preferences at all (and still assert that no
 173     // hardening related histogram kicked in in VerifyReactionToPrefAttack()).
 174     // TODO(gab): Figure out why there is no Preferences file in this location
 175     // on Chrome OS (and re-enable the section disabled for OS_CHROMEOS further
 176     // below).
 177     EXPECT_EQ(PROTECTION_DISABLED_ON_PLATFORM, protection_level_);
 178     return true;
 179 #endif
 180
 181     base::FilePath profile_dir;
 182     EXPECT_TRUE(PathService::Get(chrome::DIR_USER_DATA, &profile_dir));
 183     profile_dir = profile_dir.AppendASCII(TestingProfile::kTestUserProfileDir);
 184
 185     // Sanity check that old protected pref file is never present in modern
 186     // Chromes.
 187     EXPECT_FALSE(base::PathExists(
 188         profile_dir.Append(chrome::kProtectedPreferencesFilenameDeprecated)));
 189
 190     // Read the preferences from disk.
 191
 192     const base::FilePath unprotected_pref_file =
 193         profile_dir.Append(chrome::kPreferencesFilename);
 194     EXPECT_TRUE(base::PathExists(unprotected_pref_file));
 195
 196     const base::FilePath protected_pref_file =
 197         profile_dir.Append(chrome::kSecurePreferencesFilename);
 198     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 199               base::PathExists(protected_pref_file));
 200
 201     scoped_ptr<base::DictionaryValue> unprotected_preferences(
 202         ReadPrefsDictionary(unprotected_pref_file));
 203     if (!unprotected_preferences)
 204       return false;
 205
 206     scoped_ptr<base::DictionaryValue> protected_preferences;
 207     if (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM) {
 208       protected_preferences = ReadPrefsDictionary(protected_pref_file);
 209       if (!protected_preferences)
 210         return false;
 211     }
 212
 213     // Let the underlying test modify the preferences.
 214     AttackPreferencesOnDisk(unprotected_preferences.get(),
 215                             protected_preferences.get());
 216
 217     // Write the modified preferences back to disk.
 218
 219     JSONFileValueSerializer unprotected_prefs_serializer(unprotected_pref_file);
 220     EXPECT_TRUE(
 221         unprotected_prefs_serializer.Serialize(*unprotected_preferences));
 222
 223     if (protected_preferences) {
 224       JSONFileValueSerializer protected_prefs_serializer(protected_pref_file);
 225       EXPECT_TRUE(protected_prefs_serializer.Serialize(*protected_preferences));
 226     }
 227
 228     return true;
 229   }
 230
 231   void SetUpInProcessBrowserTestFixture() override {
 232     ExtensionBrowserTest::SetUpInProcessBrowserTestFixture();
 233
 234     // Bots are on a domain, turn off the domain check for settings hardening in
 235     // order to be able to test all SettingsEnforcement groups.
 236     chrome_prefs::DisableDomainCheckForTesting();
 237   }
 238
 239   // In the PRE_ test, find the number of tracked preferences that were
 240   // initialized and save it to a file to be read back in the main test and used
 241   // as the total number of tracked preferences.
 242   void SetUpOnMainThread() override {
 243     ExtensionBrowserTest::SetUpOnMainThread();
 244
 245     // File in which the PRE_ test will save the number of tracked preferences
 246     // on this platform.
 247     const char kNumTrackedPrefFilename[] = "NumTrackedPrefs";
 248
 249     base::FilePath num_tracked_prefs_file;
 250     ASSERT_TRUE(
 251         PathService::Get(chrome::DIR_USER_DATA, &num_tracked_prefs_file));
 252     num_tracked_prefs_file =
 253         num_tracked_prefs_file.AppendASCII(kNumTrackedPrefFilename);
 254
 255     if (IsPRETest()) {
 256       num_tracked_prefs_ = GetTrackedPrefHistogramCount(
 257           "Settings.TrackedPreferenceNullInitialized", ALLOW_ANY);
 258       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 259                 num_tracked_prefs_ > 0);
 260
 261       // Split tracked prefs are reported as Unchanged not as NullInitialized
 262       // when an empty dictionary is encountered on first run (this should only
 263       // hit for pref #5 in the current design).
 264       int num_split_tracked_prefs = GetTrackedPrefHistogramCount(
 265           "Settings.TrackedPreferenceUnchanged", BEGIN_ALLOW_SINGLE_BUCKET + 5);
 266       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 267                 num_split_tracked_prefs);
 268
 269       num_tracked_prefs_ += num_split_tracked_prefs;
 270
 271       std::string num_tracked_prefs_str = base::IntToString(num_tracked_prefs_);
 272       EXPECT_EQ(static_cast<int>(num_tracked_prefs_str.size()),
 273                 base::WriteFile(num_tracked_prefs_file,
 274                                 num_tracked_prefs_str.c_str(),
 275                                 num_tracked_prefs_str.size()));
 276     } else {
 277       std::string num_tracked_prefs_str;
 278       EXPECT_TRUE(base::ReadFileToString(num_tracked_prefs_file,
 279                                          &num_tracked_prefs_str));
 280       EXPECT_TRUE(
 281           base::StringToInt(num_tracked_prefs_str, &num_tracked_prefs_));
 282     }
 283   }
 284
 285  protected:
 286   // Called from the PRE_ test's body. Overrides should use it to setup
 287   // preferences through Chrome.
 288   virtual void SetupPreferences() = 0;
 289
 290   // Called prior to the main test launching its browser. Overrides should use
 291   // it to attack preferences. |(un)protected_preferences| represent the state
 292   // on disk prior to launching the main test, they can be modified by this
 293   // method and modifications will be flushed back to disk before launching the
 294   // main test. |unprotected_preferences| is never NULL, |protected_preferences|
 295   // may be NULL if in PROTECTION_DISABLED_ON_PLATFORM mode.
 296   virtual void AttackPreferencesOnDisk(
 297       base::DictionaryValue* unprotected_preferences,
 298       base::DictionaryValue* protected_preferences) = 0;
 299
 300   // Called from the body of the main test. Overrides should use it to verify
 301   // that the browser had the desired reaction when faced when the attack
 302   // orchestrated in AttackPreferencesOnDisk().
 303   virtual void VerifyReactionToPrefAttack() = 0;
 304
 305   int num_tracked_prefs() const { return num_tracked_prefs_; }
 306
 307   const SettingsProtectionLevel protection_level_;
 308
 309  private:
 310   // Returns true if this is the PRE_ phase of the test.
 311   bool IsPRETest() {
 312     return base::StartsWith(
 313         testing::UnitTest::GetInstance()->current_test_info()->name(), "PRE_",
 314         base::CompareCase::SENSITIVE);
 315   }
 316
 317   SettingsProtectionLevel GetProtectionLevelFromTrialGroup(
 318       const std::string& trial_group) {
 319     if (!ProfilePrefStoreManager::kPlatformSupportsPreferenceTracking)
 320       return PROTECTION_DISABLED_ON_PLATFORM;
 321
 322 // Protection levels can't be adjusted via --force-fieldtrials in official
 323 // builds.
 324 #if defined(OFFICIAL_BUILD)
 325
 326 #if defined(OS_WIN)
 327     // The strongest mode is enforced on Windows in the absence of a field
 328     // trial.
 329     return PROTECTION_ENABLED_ALL;
 330 #else
 331     return PROTECTION_DISABLED_FOR_GROUP;
 332 #endif
 333
 334 #else  // defined(OFFICIAL_BUILD)
 335
 336     using namespace chrome_prefs::internals;
 337     if (trial_group == kSettingsEnforcementGroupNoEnforcement) {
 338       return PROTECTION_DISABLED_FOR_GROUP;
 339     } else if (trial_group == kSettingsEnforcementGroupEnforceAlways) {
 340       return PROTECTION_ENABLED_BASIC;
 341     } else if (trial_group == kSettingsEnforcementGroupEnforceAlwaysWithDSE) {
 342       return PROTECTION_ENABLED_DSE;
 343     } else if (trial_group ==
 344                kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE) {
 345       return PROTECTION_ENABLED_EXTENSIONS;
 346     } else {
 347       ADD_FAILURE();
 348       return static_cast<SettingsProtectionLevel>(-1);
 349     }
 350
 351 #endif  // defined(OFFICIAL_BUILD)
 352
 353   }
 354
 355   int num_tracked_prefs_;
 356 };
 357
 358 }  // namespace
 359
 360 // Verifies that nothing is reset when nothing is tampered with.
 361 // Also sanity checks that the expected preferences files are in place.
 362 class PrefHashBrowserTestUnchangedDefault : public PrefHashBrowserTestBase {
 363  public:
 364   void SetupPreferences() override {
 365     // Default Chrome setup.
 366   }
 367
 368   void AttackPreferencesOnDisk(
 369       base::DictionaryValue* unprotected_preferences,
 370       base::DictionaryValue* protected_preferences) override {
 371     // No attack.
 372   }
 373
 374   void VerifyReactionToPrefAttack() override {
 375     // Expect all prefs to be reported as Unchanged with no resets.
 376     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 377                   ? num_tracked_prefs() : 0,
 378               GetTrackedPrefHistogramCount(
 379                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 380     EXPECT_EQ(0,
 381               GetTrackedPrefHistogramCount(
 382                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 383     EXPECT_EQ(0,
 384               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 385                                            ALLOW_NONE));
 386
 387     // Nothing else should have triggered.
 388     EXPECT_EQ(0,
 389               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 390                                            ALLOW_NONE));
 391     EXPECT_EQ(0,
 392               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 393                                            ALLOW_NONE));
 394     EXPECT_EQ(0,
 395               GetTrackedPrefHistogramCount(
 396                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 397     EXPECT_EQ(0,
 398               GetTrackedPrefHistogramCount(
 399                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 400     EXPECT_EQ(0,
 401               GetTrackedPrefHistogramCount(
 402                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 403     EXPECT_EQ(
 404         0,
 405         GetTrackedPrefHistogramCount(
 406             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 407   }
 408 };
 409
 410 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedDefault, UnchangedDefault);
 411
 412 // Augments PrefHashBrowserTestUnchangedDefault to confirm that nothing is reset
 413 // when nothing is tampered with, even if Chrome itself wrote custom prefs in
 414 // its last run.
 415 class PrefHashBrowserTestUnchangedCustom
 416     : public PrefHashBrowserTestUnchangedDefault {
 417  public:
 418   void SetupPreferences() override {
 419     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 420
 421     InstallExtensionWithUIAutoConfirm(
 422         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 423   }
 424
 425   void VerifyReactionToPrefAttack() override {
 426     // Make sure the settings written in the last run stuck.
 427     EXPECT_EQ("http://example.com",
 428               profile()->GetPrefs()->GetString(prefs::kHomePage));
 429
 430     EXPECT_TRUE(extension_service()->GetExtensionById(kGoodCrxId, false));
 431
 432     // Reaction should be identical to unattacked default prefs.
 433     PrefHashBrowserTestUnchangedDefault::VerifyReactionToPrefAttack();
 434   }
 435 };
 436
 437 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedCustom, UnchangedCustom);
 438
 439 // Verifies that cleared prefs are reported.
 440 class PrefHashBrowserTestClearedAtomic : public PrefHashBrowserTestBase {
 441  public:
 442   void SetupPreferences() override {
 443     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 444   }
 445
 446   void AttackPreferencesOnDisk(
 447       base::DictionaryValue* unprotected_preferences,
 448       base::DictionaryValue* protected_preferences) override {
 449     base::DictionaryValue* selected_prefs =
 450         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 451                                                       : unprotected_preferences;
 452     // |selected_prefs| should never be NULL under the protection level picking
 453     // it.
 454     EXPECT_TRUE(selected_prefs);
 455     EXPECT_TRUE(selected_prefs->Remove(prefs::kHomePage, NULL));
 456   }
 457
 458   void VerifyReactionToPrefAttack() override {
 459     // The clearance of homepage should have been noticed (as pref #2 being
 460     // cleared), but shouldn't have triggered a reset (as there is nothing we
 461     // can do when the pref is already gone).
 462     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 463               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 464                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 465     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 466                   ? num_tracked_prefs() - 1 : 0,
 467               GetTrackedPrefHistogramCount(
 468                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 469     EXPECT_EQ(0,
 470               GetTrackedPrefHistogramCount(
 471                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 472     EXPECT_EQ(0,
 473               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 474                                            ALLOW_NONE));
 475
 476     // Nothing else should have triggered.
 477     EXPECT_EQ(0,
 478               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 479                                            ALLOW_NONE));
 480     EXPECT_EQ(0,
 481               GetTrackedPrefHistogramCount(
 482                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 483     EXPECT_EQ(0,
 484               GetTrackedPrefHistogramCount(
 485                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 486     EXPECT_EQ(0,
 487               GetTrackedPrefHistogramCount(
 488                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 489     EXPECT_EQ(
 490         0,
 491         GetTrackedPrefHistogramCount(
 492             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 493   }
 494 };
 495
 496 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestClearedAtomic, ClearedAtomic);
 497
 498 // Verifies that clearing the MACs results in untrusted Initialized pings for
 499 // non-null protected prefs.
 500 class PrefHashBrowserTestUntrustedInitialized : public PrefHashBrowserTestBase {
 501  public:
 502   void SetupPreferences() override {
 503     // Explicitly set the DSE (it's otherwise NULL by default, preventing
 504     // thorough testing of the PROTECTION_ENABLED_DSE level).
 505     DefaultSearchManager default_search_manager(
 506         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 507     DefaultSearchManager::Source dse_source =
 508         static_cast<DefaultSearchManager::Source>(-1);
 509
 510     const TemplateURLData* default_template_url_data =
 511         default_search_manager.GetDefaultSearchEngine(&dse_source);
 512     EXPECT_EQ(DefaultSearchManager::FROM_FALLBACK, dse_source);
 513
 514     default_search_manager.SetUserSelectedDefaultSearchEngine(
 515         *default_template_url_data);
 516
 517     default_search_manager.GetDefaultSearchEngine(&dse_source);
 518     EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source);
 519
 520     // Also explicitly set an atomic pref that falls under
 521     // PROTECTION_ENABLED_BASIC.
 522     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 523                                       SessionStartupPref::URLS);
 524   }
 525
 526   void AttackPreferencesOnDisk(
 527       base::DictionaryValue* unprotected_preferences,
 528       base::DictionaryValue* protected_preferences) override {
 529     EXPECT_TRUE(unprotected_preferences->Remove("protection.macs", NULL));
 530     if (protected_preferences)
 531       EXPECT_TRUE(protected_preferences->Remove("protection.macs", NULL));
 532   }
 533
 534   void VerifyReactionToPrefAttack() override {
 535     // Preferences that are NULL by default will be NullInitialized.
 536     int num_null_values = GetTrackedPrefHistogramCount(
 537         "Settings.TrackedPreferenceNullInitialized", ALLOW_ANY);
 538     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 539               num_null_values > 0);
 540     if (num_null_values > 0) {
 541       // This test requires that at least 3 prefs be non-null (extensions, DSE,
 542       // and 1 atomic pref explictly set for this test above).
 543       EXPECT_GE(num_tracked_prefs() - num_null_values, 3);
 544     }
 545
 546     // Expect all non-null prefs to be reported as Initialized (with
 547     // accompanying resets or wanted resets based on the current protection
 548     // level).
 549     EXPECT_EQ(num_tracked_prefs() - num_null_values,
 550               GetTrackedPrefHistogramCount(
 551                   "Settings.TrackedPreferenceInitialized", ALLOW_ANY));
 552
 553     int num_protected_prefs = 0;
 554     // A switch statement falling through each protection level in decreasing
 555     // levels of protection to add expectations for each level which augments
 556     // the previous one.
 557     switch (protection_level_) {
 558       case PROTECTION_ENABLED_ALL:
 559         // Falls through.
 560       case PROTECTION_ENABLED_EXTENSIONS:
 561         ++num_protected_prefs;
 562         // Falls through.
 563       case PROTECTION_ENABLED_DSE:
 564         ++num_protected_prefs;
 565         // Falls through.
 566       case PROTECTION_ENABLED_BASIC:
 567         num_protected_prefs += num_tracked_prefs() - num_null_values - 2;
 568         // Falls through.
 569       case PROTECTION_DISABLED_FOR_GROUP:
 570         // No protection. Falls through.
 571       case PROTECTION_DISABLED_ON_PLATFORM:
 572         // No protection.
 573         break;
 574     }
 575
 576     EXPECT_EQ(num_tracked_prefs() - num_null_values - num_protected_prefs,
 577               GetTrackedPrefHistogramCount(
 578                   "Settings.TrackedPreferenceWantedReset", ALLOW_ANY));
 579     EXPECT_EQ(num_protected_prefs,
 580               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 581                                            ALLOW_ANY));
 582
 583     // Explicitly verify the result of reported resets.
 584
 585     DefaultSearchManager default_search_manager(
 586         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 587     DefaultSearchManager::Source dse_source =
 588         static_cast<DefaultSearchManager::Source>(-1);
 589     default_search_manager.GetDefaultSearchEngine(&dse_source);
 590     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_DSE
 591                   ? DefaultSearchManager::FROM_USER
 592                   : DefaultSearchManager::FROM_FALLBACK,
 593               dse_source);
 594
 595     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_BASIC,
 596               profile()->GetPrefs()->GetInteger(prefs::kRestoreOnStartup) ==
 597                   SessionStartupPref::URLS);
 598
 599     // Nothing else should have triggered.
 600     EXPECT_EQ(0,
 601               GetTrackedPrefHistogramCount(
 602                   "Settings.TrackedPreferenceUnchanged", ALLOW_NONE));
 603     EXPECT_EQ(0,
 604               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 605                                            ALLOW_NONE));
 606     EXPECT_EQ(0,
 607               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 608                                            ALLOW_NONE));
 609     EXPECT_EQ(
 610         0,
 611         GetTrackedPrefHistogramCount(
 612             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 613   }
 614 };
 615
 616 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedInitialized,
 617                        UntrustedInitialized);
 618
 619 // Verifies that changing an atomic pref results in it being reported (and reset
 620 // if the protection level allows it).
 621 class PrefHashBrowserTestChangedAtomic : public PrefHashBrowserTestBase {
 622  public:
 623   void SetupPreferences() override {
 624     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 625                                       SessionStartupPref::URLS);
 626
 627     ListPrefUpdate update(profile()->GetPrefs(),
 628                           prefs::kURLsToRestoreOnStartup);
 629     update->AppendString("http://example.com");
 630   }
 631
 632   void AttackPreferencesOnDisk(
 633       base::DictionaryValue* unprotected_preferences,
 634       base::DictionaryValue* protected_preferences) override {
 635     base::DictionaryValue* selected_prefs =
 636         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 637                                                       : unprotected_preferences;
 638     // |selected_prefs| should never be NULL under the protection level picking
 639     // it.
 640     EXPECT_TRUE(selected_prefs);
 641     base::ListValue* startup_urls;
 642     EXPECT_TRUE(
 643         selected_prefs->GetList(prefs::kURLsToRestoreOnStartup, &startup_urls));
 644     EXPECT_TRUE(startup_urls);
 645     EXPECT_EQ(1U, startup_urls->GetSize());
 646     startup_urls->AppendString("http://example.org");
 647   }
 648
 649   void VerifyReactionToPrefAttack() override {
 650     // Expect a single Changed event for tracked pref #4 (startup URLs).
 651     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 652               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 653                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 654     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 655                   ? num_tracked_prefs() - 1 : 0,
 656               GetTrackedPrefHistogramCount(
 657                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 658
 659     EXPECT_EQ(
 660         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 661          protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0,
 662         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 663                                      BEGIN_ALLOW_SINGLE_BUCKET + 4));
 664     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 1 : 0,
 665               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 666                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 667
 668 // TODO(gab): This doesn't work on OS_CHROMEOS because we fail to attack
 669 // Preferences.
 670 #if !defined(OS_CHROMEOS)
 671     // Explicitly verify the result of reported resets.
 672     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 0U : 2U,
 673               profile()
 674                   ->GetPrefs()
 675                   ->GetList(prefs::kURLsToRestoreOnStartup)
 676                   ->GetSize());
 677 #endif
 678
 679     // Nothing else should have triggered.
 680     EXPECT_EQ(0,
 681               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 682                                            ALLOW_NONE));
 683     EXPECT_EQ(0,
 684               GetTrackedPrefHistogramCount(
 685                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 686     EXPECT_EQ(0,
 687               GetTrackedPrefHistogramCount(
 688                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 689     EXPECT_EQ(0,
 690               GetTrackedPrefHistogramCount(
 691                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 692     EXPECT_EQ(
 693         0,
 694         GetTrackedPrefHistogramCount(
 695             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 696   }
 697 };
 698
 699 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedAtomic, ChangedAtomic);
 700
 701 // Verifies that changing or adding an entry in a split pref results in both
 702 // items being reported (and remove if the protection level allows it).
 703 class PrefHashBrowserTestChangedSplitPref : public PrefHashBrowserTestBase {
 704  public:
 705   void SetupPreferences() override {
 706     InstallExtensionWithUIAutoConfirm(
 707         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 708   }
 709
 710   void AttackPreferencesOnDisk(
 711       base::DictionaryValue* unprotected_preferences,
 712       base::DictionaryValue* protected_preferences) override {
 713     base::DictionaryValue* selected_prefs =
 714         protection_level_ >= PROTECTION_ENABLED_EXTENSIONS
 715             ? protected_preferences
 716             : unprotected_preferences;
 717     // |selected_prefs| should never be NULL under the protection level picking
 718     // it.
 719     EXPECT_TRUE(selected_prefs);
 720     base::DictionaryValue* extensions_dict;
 721     EXPECT_TRUE(selected_prefs->GetDictionary(
 722         extensions::pref_names::kExtensions, &extensions_dict));
 723     EXPECT_TRUE(extensions_dict);
 724
 725     // Tamper with any installed setting for good.crx
 726     base::DictionaryValue* good_crx_dict;
 727     EXPECT_TRUE(extensions_dict->GetDictionary(kGoodCrxId, &good_crx_dict));
 728     int good_crx_state;
 729     EXPECT_TRUE(good_crx_dict->GetInteger("state", &good_crx_state));
 730     EXPECT_EQ(extensions::Extension::ENABLED, good_crx_state);
 731     good_crx_dict->SetInteger("state", extensions::Extension::DISABLED);
 732
 733     // Drop a fake extension (for the purpose of this test, dropped settings
 734     // don't need to be valid extension settings).
 735     base::DictionaryValue* fake_extension = new base::DictionaryValue;
 736     fake_extension->SetString("name", "foo");
 737     extensions_dict->Set(std::string(32, 'a'), fake_extension);
 738   }
 739
 740   void VerifyReactionToPrefAttack() override {
 741     // Expect a single split pref changed report with a count of 2 for tracked
 742     // pref #5 (extensions).
 743     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 744               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 745                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 746     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 747               GetTrackedPrefHistogramCount(
 748                   "Settings.TrackedSplitPreferenceChanged.extensions.settings",
 749                   BEGIN_ALLOW_SINGLE_BUCKET + 2));
 750
 751     // Everything else should have remained unchanged.
 752     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 753                   ? num_tracked_prefs() - 1 : 0,
 754               GetTrackedPrefHistogramCount(
 755                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 756
 757     EXPECT_EQ(
 758         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 759          protection_level_ < PROTECTION_ENABLED_EXTENSIONS) ? 1 : 0,
 760         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 761                                      BEGIN_ALLOW_SINGLE_BUCKET + 5));
 762     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_EXTENSIONS ? 1 : 0,
 763               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 764                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 765
 766     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_EXTENSIONS,
 767               extension_service()->GetExtensionById(kGoodCrxId, true) != NULL);
 768
 769     // Nothing else should have triggered.
 770     EXPECT_EQ(0,
 771               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 772                                            ALLOW_NONE));
 773     EXPECT_EQ(0,
 774               GetTrackedPrefHistogramCount(
 775                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 776     EXPECT_EQ(0,
 777               GetTrackedPrefHistogramCount(
 778                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 779     EXPECT_EQ(0,
 780               GetTrackedPrefHistogramCount(
 781                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 782     EXPECT_EQ(
 783         0,
 784         GetTrackedPrefHistogramCount(
 785             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 786   }
 787 };
 788
 789 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedSplitPref, ChangedSplitPref);
 790
 791 // Verifies that adding a value to unprotected preferences for a key which is
 792 // still using the default (i.e. has no value stored in protected preferences)
 793 // doesn't allow that value to slip in with no valid MAC (regression test for
 794 // http://crbug.com/414554)
 795 class PrefHashBrowserTestUntrustedAdditionToPrefs
 796     : public PrefHashBrowserTestBase {
 797  public:
 798   void SetupPreferences() override {
 799     // Ensure there is no user-selected value for kRestoreOnStartup.
 800     EXPECT_FALSE(
 801         profile()->GetPrefs()->GetUserPrefValue(prefs::kRestoreOnStartup));
 802   }
 803
 804   void AttackPreferencesOnDisk(
 805       base::DictionaryValue* unprotected_preferences,
 806       base::DictionaryValue* protected_preferences) override {
 807     unprotected_preferences->SetInteger(prefs::kRestoreOnStartup,
 808                                         SessionStartupPref::LAST);
 809   }
 810
 811   void VerifyReactionToPrefAttack() override {
 812     // Expect a single Changed event for tracked pref #3 (kRestoreOnStartup) if
 813     // not protecting; if protection is enabled the change should be a no-op.
 814     int changed_expected =
 815         protection_level_ == PROTECTION_DISABLED_FOR_GROUP ? 1 : 0;
 816     EXPECT_EQ(
 817         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 818          protection_level_ < PROTECTION_ENABLED_BASIC) ? changed_expected : 0,
 819         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 820                                      BEGIN_ALLOW_SINGLE_BUCKET + 3));
 821     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 822                   ? num_tracked_prefs() - changed_expected : 0,
 823               GetTrackedPrefHistogramCount(
 824                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 825
 826     EXPECT_EQ(
 827         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 828          protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0,
 829         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 830                                      BEGIN_ALLOW_SINGLE_BUCKET + 3));
 831     EXPECT_EQ(0,
 832               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 833                                            ALLOW_NONE));
 834
 835     // Nothing else should have triggered.
 836     EXPECT_EQ(0,
 837               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 838                                            ALLOW_NONE));
 839     EXPECT_EQ(0,
 840               GetTrackedPrefHistogramCount(
 841                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 842     EXPECT_EQ(0,
 843               GetTrackedPrefHistogramCount(
 844                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 845     EXPECT_EQ(0,
 846               GetTrackedPrefHistogramCount(
 847                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 848     EXPECT_EQ(
 849         0,
 850         GetTrackedPrefHistogramCount(
 851             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 852   }
 853 };
 854
 855 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefs,
 856                        UntrustedAdditionToPrefs);
 857
 858 // Verifies that adding a value to unprotected preferences while wiping a
 859 // user-selected value from protected preferences doesn't allow that value to
 860 // slip in with no valid MAC (regression test for http://crbug.com/414554).
 861 class PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe
 862     : public PrefHashBrowserTestBase {
 863  public:
 864   void SetupPreferences() override {
 865     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 866   }
 867
 868   void AttackPreferencesOnDisk(
 869       base::DictionaryValue* unprotected_preferences,
 870       base::DictionaryValue* protected_preferences) override {
 871     // Set or change the value in Preferences to the attacker's choice.
 872     unprotected_preferences->SetString(prefs::kHomePage, "http://example.net");
 873     // Clear the value in Secure Preferences, if any.
 874     if (protected_preferences)
 875       protected_preferences->Remove(prefs::kHomePage, NULL);
 876   }
 877
 878   void VerifyReactionToPrefAttack() override {
 879     // Expect a single Changed event for tracked pref #2 (kHomePage) if
 880     // not protecting; if protection is enabled the change should be a Cleared.
 881     int changed_expected =
 882         protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 883         protection_level_ < PROTECTION_ENABLED_BASIC
 884         ? 1 : 0;
 885     int cleared_expected =
 886         protection_level_ >= PROTECTION_ENABLED_BASIC
 887         ? 1 : 0;
 888     EXPECT_EQ(changed_expected,
 889               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 890                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 891     EXPECT_EQ(cleared_expected,
 892               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 893                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 894     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 895                   ? num_tracked_prefs() - changed_expected - cleared_expected
 896                   : 0,
 897               GetTrackedPrefHistogramCount(
 898                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 899
 900     EXPECT_EQ(
 901         changed_expected,
 902         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 903                                      BEGIN_ALLOW_SINGLE_BUCKET + 2));
 904     EXPECT_EQ(0,
 905               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 906                                            ALLOW_NONE));
 907
 908     // Nothing else should have triggered.
 909     EXPECT_EQ(0,
 910               GetTrackedPrefHistogramCount(
 911                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 912     EXPECT_EQ(0,
 913               GetTrackedPrefHistogramCount(
 914                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 915     EXPECT_EQ(0,
 916               GetTrackedPrefHistogramCount(
 917                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 918     EXPECT_EQ(
 919         0,
 920         GetTrackedPrefHistogramCount(
 921             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 922   }
 923 };
 924
 925 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe,
 926                        UntrustedAdditionToPrefsAfterWipe);