chrome_elf/create_file/chrome_create_file_unittest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome_elf/create_file/chrome_create_file.h"
   6
   7 #include <windows.h>
   8
   9 #include <bitset>
  10 #include <string>
  11
  12 #include "base/base_paths_win.h"
  13 #include "base/files/file_path.h"
  14 #include "base/files/file_util.h"
  15 #include "base/files/scoped_temp_dir.h"
  16 #include "base/path_service.h"
  17 #include "base/threading/platform_thread.h"
  18 #include "base/win/iat_patch_function.h"
  19 #include "base/win/scoped_handle.h"
  20 #include "base/win/windows_version.h"
  21 #include "chrome_elf/chrome_elf_constants.h"
  22 #include "chrome_elf/ntdll_cache.h"
  23 #include "sandbox/win/src/interception_internal.h"
  24 #include "sandbox/win/src/nt_internals.h"
  25 #include "testing/gtest/include/gtest/gtest.h"
  26 #include "testing/platform_test.h"
  27
  28
  29 namespace {
  30
  31 // Test fixtures -------------------------------------------------------------
  32
  33 class ChromeCreateFileTest : public PlatformTest {
  34  protected:
  35   struct NtCreateFileParams {
  36     ACCESS_MASK desired_access;
  37     OBJECT_ATTRIBUTES object_attributes;
  38     PLARGE_INTEGER allocation_size;
  39     ULONG file_attributes;
  40     ULONG share_access;
  41     ULONG create_disposition;
  42     ULONG create_options;
  43     PVOID ea_buffer;
  44     ULONG ea_length;
  45   };
  46
  47   enum CallPath {
  48     ELF,
  49     KERNEL
  50   };
  51
  52   template<CallPath path>
  53   static NTSTATUS WINAPI FakeNtCreateFile(
  54       PHANDLE file_handle,
  55       ACCESS_MASK desired_access,
  56       POBJECT_ATTRIBUTES object_attributes,
  57       PIO_STATUS_BLOCK io_status_block,
  58       PLARGE_INTEGER allocation_size,
  59       ULONG file_attributes,
  60       ULONG share_access,
  61       ULONG create_disposition,
  62       ULONG create_options,
  63       PVOID ea_buffer,
  64       ULONG ea_length) {
  65     return self_->HandleCreateFileCall(file_handle,
  66         desired_access,
  67         object_attributes,
  68         io_status_block,
  69         allocation_size,
  70         file_attributes,
  71         share_access,
  72         create_disposition,
  73         create_options,
  74         ea_buffer,
  75         ea_length,
  76         path);
  77   }
  78
  79   void SetUp() override {
  80     original_thread_ = base::PlatformThread::CurrentId();
  81     InitCache();
  82     PlatformTest::SetUp();
  83
  84     base::FilePath user_data_dir;
  85     PathService::Get(base::DIR_LOCAL_APP_DATA, &user_data_dir);
  86     ASSERT_TRUE(temp_dir_.CreateUniqueTempDirUnderPath(user_data_dir));
  87     ASSERT_TRUE(temp_dir2_.CreateUniqueTempDir());
  88     self_ = this;
  89   }
  90
  91   void UnsetThunkStorage() {
  92     DWORD old_protect = 0;
  93     EXPECT_TRUE(::VirtualProtect(&g_nt_thunk_storage,
  94                                  sizeof(g_nt_thunk_storage),
  95                                  PAGE_EXECUTE_READWRITE,
  96                                  &old_protect));
  97     memset(&g_nt_thunk_storage, 0, sizeof(g_nt_thunk_storage));
  98
  99     EXPECT_TRUE(::VirtualProtect(&g_nt_thunk_storage,
 100                                  sizeof(g_nt_thunk_storage),
 101                                  PAGE_EXECUTE_READ,
 102                                  &old_protect));
 103   }
 104
 105   void RedirectNtCreateFileCalls() {
 106     UnsetThunkStorage();
 107     old_func_ptr_ =
 108         reinterpret_cast<NtCreateFileFunction>(g_ntdll_lookup["NtCreateFile"]);
 109
 110     // KernelBase.dll only exists for Win7 and later, prior to that, kernel32
 111     // imports from ntdll directly.
 112     if (base::win::GetVersion() < base::win::VERSION_WIN7) {
 113       patcher_.Patch(L"kernel32.dll", "ntdll.dll", "NtCreateFile",
 114           reinterpret_cast<void(*)()>(&FakeNtCreateFile<KERNEL>));
 115     } else {
 116       patcher_.Patch(L"kernelbase.dll", "ntdll.dll", "NtCreateFile",
 117           reinterpret_cast<void(*)()>(&FakeNtCreateFile<KERNEL>));
 118     }
 119
 120     g_ntdll_lookup["NtCreateFile"] = reinterpret_cast<void(*)()>(
 121         &ChromeCreateFileTest::FakeNtCreateFile<ELF>);
 122   }
 123
 124   void ResetNtCreateFileCalls() {
 125     g_ntdll_lookup["NtCreateFile"] = reinterpret_cast<void*>(old_func_ptr_);
 126     patcher_.Unpatch();
 127   }
 128
 129   NTSTATUS HandleCreateFileCall(PHANDLE file_handle,
 130       ACCESS_MASK desired_access,
 131       POBJECT_ATTRIBUTES object_attributes,
 132       PIO_STATUS_BLOCK io_status_block,
 133       PLARGE_INTEGER allocation_size,
 134       ULONG file_attributes,
 135       ULONG share_access,
 136       ULONG create_disposition,
 137       ULONG create_options,
 138       PVOID ea_buffer,
 139       ULONG ea_length,
 140       CallPath call_path) {
 141     if (original_thread_ == base::PlatformThread::CurrentId()) {
 142       SetParams(desired_access,
 143           object_attributes,
 144           allocation_size,
 145           file_attributes,
 146           share_access,
 147           create_disposition,
 148           create_options,
 149           ea_buffer,
 150           ea_length,
 151           call_path == ELF ? &elf_params_ : &kernel_params_);
 152     }
 153
 154     // Forward the call to the real NTCreateFile.
 155     return old_func_ptr_(file_handle,
 156         desired_access,
 157         object_attributes,
 158         io_status_block,
 159         allocation_size,
 160         file_attributes,
 161         share_access,
 162         create_disposition,
 163         create_options,
 164         ea_buffer,
 165         ea_length);
 166   }
 167
 168   void SetParams(ACCESS_MASK desired_access,
 169       POBJECT_ATTRIBUTES object_attributes,
 170       PLARGE_INTEGER allocation_size,
 171       ULONG file_attributes,
 172       ULONG share_access,
 173       ULONG create_disposition,
 174       ULONG create_options,
 175       PVOID ea_buffer,
 176       ULONG ea_length,
 177       NtCreateFileParams* params) {
 178     params->desired_access = desired_access;
 179     params->object_attributes.Length = object_attributes->Length;
 180     params->object_attributes.ObjectName = object_attributes->ObjectName;
 181     params->object_attributes.RootDirectory = object_attributes->RootDirectory;
 182     params->object_attributes.Attributes = object_attributes->Attributes;
 183     params->object_attributes.SecurityDescriptor =
 184         object_attributes->SecurityDescriptor;
 185     params->object_attributes.SecurityQualityOfService =
 186         object_attributes->SecurityQualityOfService;
 187     params->allocation_size = allocation_size;
 188     params->file_attributes = file_attributes;
 189     params->share_access = share_access;
 190     params->create_disposition = create_disposition;
 191     params->create_options = create_options;
 192     params->ea_buffer = ea_buffer;
 193     params->ea_length = ea_length;
 194   }
 195
 196   void CheckParams() {
 197     std::bitset<32> elf((int) elf_params_.desired_access);
 198     std::bitset<32> ker((int) kernel_params_.desired_access);
 199
 200     EXPECT_EQ(kernel_params_.desired_access, elf_params_.desired_access)
 201         << elf << "\n" << ker;
 202     EXPECT_EQ(kernel_params_.object_attributes.Length,
 203               elf_params_.object_attributes.Length);
 204     EXPECT_EQ(kernel_params_.object_attributes.RootDirectory,
 205               elf_params_.object_attributes.RootDirectory);
 206     EXPECT_EQ(kernel_params_.object_attributes.Attributes,
 207               elf_params_.object_attributes.Attributes);
 208     EXPECT_EQ(kernel_params_.object_attributes.SecurityDescriptor,
 209               elf_params_.object_attributes.SecurityDescriptor);
 210     EXPECT_EQ(kernel_params_.allocation_size, elf_params_.allocation_size);
 211     EXPECT_EQ(kernel_params_.file_attributes, elf_params_.file_attributes);
 212     EXPECT_EQ(kernel_params_.share_access, elf_params_.share_access);
 213     EXPECT_EQ(kernel_params_.create_disposition,
 214               elf_params_.create_disposition);
 215     EXPECT_EQ(kernel_params_.create_options, elf_params_.create_options);
 216     EXPECT_EQ(kernel_params_.ea_buffer, elf_params_.ea_buffer);
 217     EXPECT_EQ(kernel_params_.ea_length, elf_params_.ea_length);
 218   }
 219
 220   void DoWriteCheck(const base::FilePath& path, DWORD flag, bool is_system) {
 221     base::win::ScopedHandle file_handle;
 222     const char kTestData[] = "0123456789";
 223     int buffer_size = sizeof(kTestData) - 1;
 224     DWORD bytes_written;
 225
 226     if (is_system) {
 227       file_handle.Set(::CreateFileW(path.value().c_str(),
 228                                     GENERIC_WRITE,
 229                                     FILE_SHARE_READ,
 230                                     NULL,
 231                                     CREATE_ALWAYS,
 232                                     FILE_ATTRIBUTE_NORMAL | flag,
 233                                     NULL));
 234     } else {
 235       file_handle.Set(CreateFileNTDLL(path.value().c_str(),
 236                                       GENERIC_WRITE,
 237                                       FILE_SHARE_READ,
 238                                       NULL,
 239                                       CREATE_ALWAYS,
 240                                       FILE_ATTRIBUTE_NORMAL | flag,
 241                                       NULL));
 242     }
 243
 244
 245     EXPECT_TRUE(file_handle.IsValid());
 246     ::WriteFile(file_handle.Get(), kTestData, buffer_size, &bytes_written,
 247                 NULL);
 248     EXPECT_EQ(buffer_size, bytes_written);
 249   }
 250
 251   void DoReadCheck(const base::FilePath& path, DWORD flag, bool is_system) {
 252     base::win::ScopedHandle file_handle;
 253     const char kTestData[] = "0123456789";
 254     int buffer_size = sizeof(kTestData) - 1;
 255     DWORD bytes_read;
 256     char read_buffer[10];
 257
 258     if (is_system) {
 259       file_handle.Set(::CreateFileW(path.value().c_str(),
 260                                     GENERIC_READ,
 261                                     0,
 262                                     NULL,
 263                                     OPEN_ALWAYS,
 264                                     FILE_ATTRIBUTE_NORMAL | flag,
 265                                     NULL));
 266     } else {
 267       file_handle.Set(CreateFileNTDLL(path.value().c_str(),
 268                                       GENERIC_READ,
 269                                       0,
 270                                       NULL,
 271                                       OPEN_ALWAYS,
 272                                       FILE_ATTRIBUTE_NORMAL | flag,
 273                                       NULL));
 274     }
 275
 276     EXPECT_TRUE(file_handle.IsValid());
 277     ::ReadFile(file_handle.Get(), read_buffer, buffer_size, &bytes_read, NULL);
 278     EXPECT_EQ(buffer_size, bytes_read);
 279     EXPECT_EQ(0, memcmp(kTestData, read_buffer, bytes_read));
 280   }
 281
 282   void RunChecks(DWORD flag, bool check_reads) {
 283     // Make sure we can write to this file handle when called via the system.
 284     base::FilePath junk_path_1 = temp_dir_.path().Append(L"junk_1.txt");
 285     base::FilePath junk_path_2 = temp_dir_.path().Append(L"junk_2.txt");
 286     DoWriteCheck(junk_path_1, flag, true);
 287     DoWriteCheck(junk_path_2, flag, false);
 288     CheckParams();
 289
 290     if (check_reads) {
 291       // Make sure we can read from this file handle when called via the system.
 292       DoReadCheck(junk_path_1, flag, true);
 293       DoReadCheck(junk_path_2, flag, false);
 294       CheckParams();
 295     }
 296     base::DeleteFile(junk_path_1, false);
 297     base::DeleteFile(junk_path_2, false);
 298
 299   }
 300
 301   static ChromeCreateFileTest* self_;
 302
 303   NtCreateFileFunction old_func_ptr_;
 304   base::ScopedTempDir temp_dir_;
 305   base::ScopedTempDir temp_dir2_;
 306   base::win::IATPatchFunction patcher_;
 307   NtCreateFileParams kernel_params_;
 308   NtCreateFileParams elf_params_;
 309   base::PlatformThreadId original_thread_;
 310 };
 311
 312 ChromeCreateFileTest* ChromeCreateFileTest::self_ = NULL;
 313
 314 // Tests ---------------------------------------------------------------------
 315 TEST_F(ChromeCreateFileTest, CheckParams_FILE_ATTRIBUTE_NORMAL) {
 316   RedirectNtCreateFileCalls();
 317   RunChecks(FILE_ATTRIBUTE_NORMAL, true);
 318   ResetNtCreateFileCalls();
 319 }
 320
 321 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_WRITE_THROUGH) {
 322   RedirectNtCreateFileCalls();
 323   RunChecks(FILE_FLAG_WRITE_THROUGH, true);
 324   ResetNtCreateFileCalls();
 325 }
 326
 327 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_RANDOM_ACCESS) {
 328   RedirectNtCreateFileCalls();
 329   RunChecks(FILE_FLAG_RANDOM_ACCESS, true);
 330   ResetNtCreateFileCalls();
 331 }
 332
 333 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_SEQUENTIAL_SCAN) {
 334   RedirectNtCreateFileCalls();
 335   RunChecks(FILE_FLAG_SEQUENTIAL_SCAN, true);
 336   ResetNtCreateFileCalls();
 337 }
 338
 339 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_DELETE_ON_CLOSE) {
 340   RedirectNtCreateFileCalls();
 341   RunChecks(FILE_FLAG_DELETE_ON_CLOSE, false);
 342   ResetNtCreateFileCalls();
 343 }
 344
 345 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_BACKUP_SEMANTICS) {
 346   RedirectNtCreateFileCalls();
 347   RunChecks(FILE_FLAG_BACKUP_SEMANTICS, true);
 348   ResetNtCreateFileCalls();
 349 }
 350
 351 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_OPEN_REPARSE_POINT) {
 352   RedirectNtCreateFileCalls();
 353   RunChecks(FILE_FLAG_OPEN_REPARSE_POINT, true);
 354   ResetNtCreateFileCalls();
 355 }
 356
 357 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_OPEN_NO_RECALL) {
 358   RedirectNtCreateFileCalls();
 359   RunChecks(FILE_FLAG_OPEN_NO_RECALL, true);
 360   ResetNtCreateFileCalls();
 361 }
 362
 363 TEST_F(ChromeCreateFileTest, BypassTest) {
 364   std::wstring UNC_filepath_file(L"\\\\.\\some_file.txt");
 365
 366   base::FilePath local_path;
 367   PathService::Get(base::DIR_LOCAL_APP_DATA, &local_path);
 368
 369   base::FilePath local_prefs_path = local_path.Append(kAppDataDirName).Append(
 370       kUserDataDirName).Append(L"default\\Preferences");
 371   base::FilePath local_state_path = local_path.Append(kAppDataDirName).Append(
 372       kUserDataDirName).Append(L"ninja\\Local State");
 373   base::FilePath local_junk_path = local_path.Append(kAppDataDirName).Append(
 374       kUserDataDirName).Append(L"default\\Junk");
 375
 376   base::FilePath desktop_path;
 377   PathService::Get(base::DIR_USER_DESKTOP, &desktop_path);
 378   base::FilePath desktop_junk_path =
 379       desktop_path.Append(L"Downloads\\junk.txt");
 380   base::FilePath desktop_prefs_path =
 381       desktop_path.Append(L"Downloads\\Preferences");
 382
 383   // Don't redirect UNC files.
 384   EXPECT_FALSE(ShouldBypass(UNC_filepath_file.c_str()));
 385
 386   // Don't redirect if file is not in UserData directory.
 387   EXPECT_FALSE(ShouldBypass(desktop_junk_path.value().c_str()));
 388   EXPECT_FALSE(ShouldBypass(desktop_prefs_path.value().c_str()));
 389
 390   // Only redirect "Preferences" and "Local State" files.
 391   EXPECT_TRUE(ShouldBypass(local_prefs_path.value().c_str()));
 392   EXPECT_TRUE(ShouldBypass(local_state_path.value().c_str()));
 393   EXPECT_FALSE(ShouldBypass(local_junk_path.value().c_str()));
 394 }
 395
 396 TEST_F(ChromeCreateFileTest, ReadWriteFromNtDll) {
 397   UnsetThunkStorage();
 398   base::FilePath file_name = temp_dir_.path().Append(L"some_file.txt");
 399   DoWriteCheck(file_name, FILE_ATTRIBUTE_NORMAL, false);
 400   DoReadCheck(file_name, FILE_ATTRIBUTE_NORMAL, false);
 401 }
 402
 403 TEST_F(ChromeCreateFileTest, ReadWriteFromThunk) {
 404   base::FilePath file_name = temp_dir_.path().Append(L"some_file.txt");
 405   DoWriteCheck(file_name, FILE_ATTRIBUTE_NORMAL, false);
 406   DoReadCheck(file_name, FILE_ATTRIBUTE_NORMAL, false);
 407 }
 408
 409 }  // namespace