src/chrome/browser/prefs/tracked/pref_hash_browsertest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <string>
   6
   7 #include "base/command_line.h"
   8 #include "base/files/file_path.h"
   9 #include "base/files/file_util.h"
  10 #include "base/json/json_file_value_serializer.h"
  11 #include "base/memory/scoped_ptr.h"
  12 #include "base/metrics/histogram_base.h"
  13 #include "base/metrics/histogram_samples.h"
  14 #include "base/metrics/statistics_recorder.h"
  15 #include "base/path_service.h"
  16 #include "base/prefs/pref_service.h"
  17 #include "base/prefs/scoped_user_pref_update.h"
  18 #include "base/strings/string_number_conversions.h"
  19 #include "base/strings/string_util.h"
  20 #include "base/values.h"
  21 #include "build/build_config.h"
  22 #include "chrome/browser/extensions/extension_browsertest.h"
  23 #include "chrome/browser/extensions/extension_service.h"
  24 #include "chrome/browser/prefs/chrome_pref_service_factory.h"
  25 #include "chrome/browser/prefs/profile_pref_store_manager.h"
  26 #include "chrome/browser/prefs/session_startup_pref.h"
  27 #include "chrome/browser/profiles/profile.h"
  28 #include "chrome/browser/ui/browser.h"
  29 #include "chrome/common/chrome_constants.h"
  30 #include "chrome/common/chrome_paths.h"
  31 #include "chrome/common/pref_names.h"
  32 #include "chrome/test/base/testing_profile.h"
  33 #include "components/search_engines/default_search_manager.h"
  34 #include "content/public/common/content_switches.h"
  35 #include "extensions/browser/pref_names.h"
  36 #include "extensions/common/extension.h"
  37
  38 #if defined(OS_CHROMEOS)
  39 #include "chromeos/chromeos_switches.h"
  40 #endif
  41
  42 namespace {
  43
  44 // Extension ID of chrome/test/data/extensions/good.crx
  45 const char kGoodCrxId[] = "ldnnhddmnhbkjipkidpdiheffobcpfmf";
  46
  47 // Explicit expectations from the caller of GetTrackedPrefHistogramCount(). This
  48 // enables detailed reporting of the culprit on failure.
  49 enum AllowedBuckets {
  50   // Allow no samples in any buckets.
  51   ALLOW_NONE = -1,
  52   // Any integer between BEGIN_ALLOW_SINGLE_BUCKET and END_ALLOW_SINGLE_BUCKET
  53   // indicates that only this specific bucket is allowed to have a sample.
  54   BEGIN_ALLOW_SINGLE_BUCKET = 0,
  55   END_ALLOW_SINGLE_BUCKET = 100,
  56   // Allow any buckets (no extra verifications performed).
  57   ALLOW_ANY
  58 };
  59
  60 // Returns the number of times |histogram_name| was reported so far; adding the
  61 // results of the first 100 buckets (there are only ~19 reporting IDs as of this
  62 // writing; varies depending on the platform). |allowed_buckets| hints at extra
  63 // requirements verified in this method (see AllowedBuckets for details).
  64 int GetTrackedPrefHistogramCount(const char* histogram_name,
  65                                  int allowed_buckets) {
  66   const base::HistogramBase* histogram =
  67       base::StatisticsRecorder::FindHistogram(histogram_name);
  68   if (!histogram)
  69     return 0;
  70
  71   scoped_ptr<base::HistogramSamples> samples(histogram->SnapshotSamples());
  72   int sum = 0;
  73   for (int i = 0; i < 100; ++i) {
  74     int count_for_id = samples->GetCount(i);
  75     EXPECT_GE(count_for_id, 0);
  76     sum += count_for_id;
  77
  78     if (allowed_buckets == ALLOW_NONE ||
  79         (allowed_buckets != ALLOW_ANY && i != allowed_buckets)) {
  80       EXPECT_EQ(0, count_for_id) << "Unexpected reporting_id: " << i;
  81     }
  82   }
  83   return sum;
  84 }
  85
  86 scoped_ptr<base::DictionaryValue> ReadPrefsDictionary(
  87     const base::FilePath& pref_file) {
  88   JSONFileValueSerializer serializer(pref_file);
  89   int error_code = JSONFileValueSerializer::JSON_NO_ERROR;
  90   std::string error_str;
  91   scoped_ptr<base::Value> prefs(
  92       serializer.Deserialize(&error_code, &error_str));
  93   if (!prefs || error_code != JSONFileValueSerializer::JSON_NO_ERROR) {
  94     ADD_FAILURE() << "Error #" << error_code << ": " << error_str;
  95     return scoped_ptr<base::DictionaryValue>();
  96   }
  97   if (!prefs->IsType(base::Value::TYPE_DICTIONARY)) {
  98     ADD_FAILURE();
  99     return scoped_ptr<base::DictionaryValue>();
 100   }
 101   return scoped_ptr<base::DictionaryValue>(
 102       static_cast<base::DictionaryValue*>(prefs.release()));
 103 }
 104
 105 #define PREF_HASH_BROWSER_TEST(fixture, test_name)                          \
 106   IN_PROC_BROWSER_TEST_P(fixture, PRE_##test_name) {                        \
 107     SetupPreferences();                                                     \
 108   }                                                                         \
 109   IN_PROC_BROWSER_TEST_P(fixture, test_name) {                              \
 110     VerifyReactionToPrefAttack();                                           \
 111   }                                                                         \
 112   INSTANTIATE_TEST_CASE_P(                                                  \
 113       fixture##Instance,                                                    \
 114       fixture,                                                              \
 115       testing::Values(                                                      \
 116           chrome_prefs::internals::kSettingsEnforcementGroupNoEnforcement,  \
 117           chrome_prefs::internals::kSettingsEnforcementGroupEnforceAlways,  \
 118           chrome_prefs::internals::                                         \
 119               kSettingsEnforcementGroupEnforceAlwaysWithDSE,                \
 120           chrome_prefs::internals::                                         \
 121               kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE));
 122
 123 // A base fixture designed such that implementations do two things:
 124 //  1) Override all three pure-virtual methods below to setup, attack, and
 125 //     verify preferenes throughout the tests provided by this fixture.
 126 //  2) Instantiate their test via the PREF_HASH_BROWSER_TEST macro above.
 127 // Based on top of ExtensionBrowserTest to allow easy interaction with the
 128 // ExtensionService.
 129 class PrefHashBrowserTestBase
 130     : public ExtensionBrowserTest,
 131       public testing::WithParamInterface<std::string> {
 132  public:
 133   // List of potential protection levels for this test in strict increasing
 134   // order of protection levels.
 135   enum SettingsProtectionLevel {
 136     PROTECTION_DISABLED_ON_PLATFORM,
 137     PROTECTION_DISABLED_FOR_GROUP,
 138     PROTECTION_ENABLED_BASIC,
 139     PROTECTION_ENABLED_DSE,
 140     PROTECTION_ENABLED_EXTENSIONS,
 141     // Represents the strongest level (i.e. always equivalent to the last one in
 142     // terms of protection), leave this one last when adding new levels.
 143     PROTECTION_ENABLED_ALL
 144   };
 145
 146   PrefHashBrowserTestBase()
 147       : protection_level_(GetProtectionLevelFromTrialGroup(GetParam())) {
 148   }
 149
 150   void SetUpCommandLine(CommandLine* command_line) override {
 151     ExtensionBrowserTest::SetUpCommandLine(command_line);
 152     EXPECT_FALSE(command_line->HasSwitch(switches::kForceFieldTrials));
 153     command_line->AppendSwitchASCII(
 154         switches::kForceFieldTrials,
 155         std::string(chrome_prefs::internals::kSettingsEnforcementTrialName) +
 156             "/" + GetParam() + "/");
 157 #if defined(OS_CHROMEOS)
 158     command_line->AppendSwitch(
 159         chromeos::switches::kIgnoreUserProfileMappingForTests);
 160 #endif
 161   }
 162
 163   bool SetUpUserDataDirectory() override {
 164     // Do the normal setup in the PRE test and attack preferences in the main
 165     // test.
 166     if (IsPRETest())
 167       return ExtensionBrowserTest::SetUpUserDataDirectory();
 168
 169 #if defined(OS_CHROMEOS)
 170     // For some reason, the Preferences file does not exist in the location
 171     // below on Chrome OS. Since protection is disabled on Chrome OS, it's okay
 172     // to simply not attack preferences at all (and still assert that no
 173     // hardening related histogram kicked in in VerifyReactionToPrefAttack()).
 174     // TODO(gab): Figure out why there is no Preferences file in this location
 175     // on Chrome OS (and re-enable the section disabled for OS_CHROMEOS further
 176     // below).
 177     EXPECT_EQ(PROTECTION_DISABLED_ON_PLATFORM, protection_level_);
 178     return true;
 179 #endif
 180
 181     base::FilePath profile_dir;
 182     EXPECT_TRUE(PathService::Get(chrome::DIR_USER_DATA, &profile_dir));
 183     profile_dir = profile_dir.AppendASCII(TestingProfile::kTestUserProfileDir);
 184
 185     // Sanity check that old protected pref file is never present in modern
 186     // Chromes.
 187     EXPECT_FALSE(base::PathExists(
 188         profile_dir.Append(chrome::kProtectedPreferencesFilenameDeprecated)));
 189
 190     // Read the preferences from disk.
 191
 192     const base::FilePath unprotected_pref_file =
 193         profile_dir.Append(chrome::kPreferencesFilename);
 194     EXPECT_TRUE(base::PathExists(unprotected_pref_file));
 195
 196     const base::FilePath protected_pref_file =
 197         profile_dir.Append(chrome::kSecurePreferencesFilename);
 198     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 199               base::PathExists(protected_pref_file));
 200
 201     scoped_ptr<base::DictionaryValue> unprotected_preferences(
 202         ReadPrefsDictionary(unprotected_pref_file));
 203     if (!unprotected_preferences)
 204       return false;
 205
 206     scoped_ptr<base::DictionaryValue> protected_preferences;
 207     if (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM) {
 208       protected_preferences = ReadPrefsDictionary(protected_pref_file);
 209       if (!protected_preferences)
 210         return false;
 211     }
 212
 213     // Let the underlying test modify the preferences.
 214     AttackPreferencesOnDisk(unprotected_preferences.get(),
 215                             protected_preferences.get());
 216
 217     // Write the modified preferences back to disk.
 218
 219     JSONFileValueSerializer unprotected_prefs_serializer(unprotected_pref_file);
 220     EXPECT_TRUE(
 221         unprotected_prefs_serializer.Serialize(*unprotected_preferences));
 222
 223     if (protected_preferences) {
 224       JSONFileValueSerializer protected_prefs_serializer(protected_pref_file);
 225       EXPECT_TRUE(protected_prefs_serializer.Serialize(*protected_preferences));
 226     }
 227
 228     return true;
 229   }
 230
 231   // In the PRE_ test, find the number of tracked preferences that were
 232   // initialized and save it to a file to be read back in the main test and used
 233   // as the total number of tracked preferences.
 234   void SetUpOnMainThread() override {
 235     ExtensionBrowserTest::SetUpOnMainThread();
 236
 237     // File in which the PRE_ test will save the number of tracked preferences
 238     // on this platform.
 239     const char kNumTrackedPrefFilename[] = "NumTrackedPrefs";
 240
 241     base::FilePath num_tracked_prefs_file;
 242     ASSERT_TRUE(
 243         PathService::Get(chrome::DIR_USER_DATA, &num_tracked_prefs_file));
 244     num_tracked_prefs_file =
 245         num_tracked_prefs_file.AppendASCII(kNumTrackedPrefFilename);
 246
 247     if (IsPRETest()) {
 248       num_tracked_prefs_ = GetTrackedPrefHistogramCount(
 249           "Settings.TrackedPreferenceNullInitialized", ALLOW_ANY);
 250       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 251                 num_tracked_prefs_ > 0);
 252
 253       // Split tracked prefs are reported as Unchanged not as NullInitialized
 254       // when an empty dictionary is encountered on first run (this should only
 255       // hit for pref #5 in the current design).
 256       int num_split_tracked_prefs = GetTrackedPrefHistogramCount(
 257           "Settings.TrackedPreferenceUnchanged", BEGIN_ALLOW_SINGLE_BUCKET + 5);
 258       EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 259                 num_split_tracked_prefs);
 260
 261       num_tracked_prefs_ += num_split_tracked_prefs;
 262
 263       std::string num_tracked_prefs_str = base::IntToString(num_tracked_prefs_);
 264       EXPECT_EQ(static_cast<int>(num_tracked_prefs_str.size()),
 265                 base::WriteFile(num_tracked_prefs_file,
 266                                 num_tracked_prefs_str.c_str(),
 267                                 num_tracked_prefs_str.size()));
 268     } else {
 269       std::string num_tracked_prefs_str;
 270       EXPECT_TRUE(base::ReadFileToString(num_tracked_prefs_file,
 271                                          &num_tracked_prefs_str));
 272       EXPECT_TRUE(
 273           base::StringToInt(num_tracked_prefs_str, &num_tracked_prefs_));
 274     }
 275   }
 276
 277  protected:
 278   // Called from the PRE_ test's body. Overrides should use it to setup
 279   // preferences through Chrome.
 280   virtual void SetupPreferences() = 0;
 281
 282   // Called prior to the main test launching its browser. Overrides should use
 283   // it to attack preferences. |(un)protected_preferences| represent the state
 284   // on disk prior to launching the main test, they can be modified by this
 285   // method and modifications will be flushed back to disk before launching the
 286   // main test. |unprotected_preferences| is never NULL, |protected_preferences|
 287   // may be NULL if in PROTECTION_DISABLED_ON_PLATFORM mode.
 288   virtual void AttackPreferencesOnDisk(
 289       base::DictionaryValue* unprotected_preferences,
 290       base::DictionaryValue* protected_preferences) = 0;
 291
 292   // Called from the body of the main test. Overrides should use it to verify
 293   // that the browser had the desired reaction when faced when the attack
 294   // orchestrated in AttackPreferencesOnDisk().
 295   virtual void VerifyReactionToPrefAttack() = 0;
 296
 297   int num_tracked_prefs() const { return num_tracked_prefs_; }
 298
 299   const SettingsProtectionLevel protection_level_;
 300
 301  private:
 302   // Returns true if this is the PRE_ phase of the test.
 303   bool IsPRETest() {
 304     return StartsWithASCII(
 305         testing::UnitTest::GetInstance()->current_test_info()->name(),
 306         "PRE_",
 307         true /* case_sensitive */);
 308   }
 309
 310   SettingsProtectionLevel GetProtectionLevelFromTrialGroup(
 311       const std::string& trial_group) {
 312     if (!ProfilePrefStoreManager::kPlatformSupportsPreferenceTracking)
 313       return PROTECTION_DISABLED_ON_PLATFORM;
 314
 315 // Protection levels can't be adjusted via --force-fieldtrials in official
 316 // builds.
 317 #if defined(OFFICIAL_BUILD)
 318
 319 #if defined(OS_WIN)
 320     // The strongest mode is enforced on Windows in the absence of a field
 321     // trial.
 322     return PROTECTION_ENABLED_ALL;
 323 #else
 324     return PROTECTION_DISABLED_FOR_GROUP;
 325 #endif
 326
 327 #else  // defined(OFFICIAL_BUILD)
 328
 329     using namespace chrome_prefs::internals;
 330     if (trial_group == kSettingsEnforcementGroupNoEnforcement) {
 331       return PROTECTION_DISABLED_FOR_GROUP;
 332     } else if (trial_group == kSettingsEnforcementGroupEnforceAlways) {
 333       return PROTECTION_ENABLED_BASIC;
 334     } else if (trial_group == kSettingsEnforcementGroupEnforceAlwaysWithDSE) {
 335       return PROTECTION_ENABLED_DSE;
 336     } else if (trial_group ==
 337                kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE) {
 338       return PROTECTION_ENABLED_EXTENSIONS;
 339     } else {
 340       ADD_FAILURE();
 341       return static_cast<SettingsProtectionLevel>(-1);
 342     }
 343
 344 #endif  // defined(OFFICIAL_BUILD)
 345
 346   }
 347
 348   int num_tracked_prefs_;
 349 };
 350
 351 }  // namespace
 352
 353 // Verifies that nothing is reset when nothing is tampered with.
 354 // Also sanity checks that the expected preferences files are in place.
 355 class PrefHashBrowserTestUnchangedDefault : public PrefHashBrowserTestBase {
 356  public:
 357   void SetupPreferences() override {
 358     // Default Chrome setup.
 359   }
 360
 361   void AttackPreferencesOnDisk(
 362       base::DictionaryValue* unprotected_preferences,
 363       base::DictionaryValue* protected_preferences) override {
 364     // No attack.
 365   }
 366
 367   void VerifyReactionToPrefAttack() override {
 368     // Expect all prefs to be reported as Unchanged with no resets.
 369     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 370                   ? num_tracked_prefs() : 0,
 371               GetTrackedPrefHistogramCount(
 372                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 373     EXPECT_EQ(0,
 374               GetTrackedPrefHistogramCount(
 375                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 376     EXPECT_EQ(0,
 377               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 378                                            ALLOW_NONE));
 379
 380     // Nothing else should have triggered.
 381     EXPECT_EQ(0,
 382               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 383                                            ALLOW_NONE));
 384     EXPECT_EQ(0,
 385               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 386                                            ALLOW_NONE));
 387     EXPECT_EQ(0,
 388               GetTrackedPrefHistogramCount(
 389                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 390     EXPECT_EQ(0,
 391               GetTrackedPrefHistogramCount(
 392                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 393     EXPECT_EQ(0,
 394               GetTrackedPrefHistogramCount(
 395                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 396     EXPECT_EQ(
 397         0,
 398         GetTrackedPrefHistogramCount(
 399             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 400   }
 401 };
 402
 403 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedDefault, UnchangedDefault);
 404
 405 // Augments PrefHashBrowserTestUnchangedDefault to confirm that nothing is reset
 406 // when nothing is tampered with, even if Chrome itself wrote custom prefs in
 407 // its last run.
 408 class PrefHashBrowserTestUnchangedCustom
 409     : public PrefHashBrowserTestUnchangedDefault {
 410  public:
 411   void SetupPreferences() override {
 412     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 413
 414     InstallExtensionWithUIAutoConfirm(
 415         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 416   }
 417
 418   void VerifyReactionToPrefAttack() override {
 419     // Make sure the settings written in the last run stuck.
 420     EXPECT_EQ("http://example.com",
 421               profile()->GetPrefs()->GetString(prefs::kHomePage));
 422
 423     EXPECT_TRUE(extension_service()->GetExtensionById(kGoodCrxId, false));
 424
 425     // Reaction should be identical to unattacked default prefs.
 426     PrefHashBrowserTestUnchangedDefault::VerifyReactionToPrefAttack();
 427   }
 428 };
 429
 430 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedCustom, UnchangedCustom);
 431
 432 // Verifies that cleared prefs are reported.
 433 class PrefHashBrowserTestClearedAtomic : public PrefHashBrowserTestBase {
 434  public:
 435   void SetupPreferences() override {
 436     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 437   }
 438
 439   void AttackPreferencesOnDisk(
 440       base::DictionaryValue* unprotected_preferences,
 441       base::DictionaryValue* protected_preferences) override {
 442     base::DictionaryValue* selected_prefs =
 443         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 444                                                       : unprotected_preferences;
 445     // |selected_prefs| should never be NULL under the protection level picking
 446     // it.
 447     EXPECT_TRUE(selected_prefs);
 448     EXPECT_TRUE(selected_prefs->Remove(prefs::kHomePage, NULL));
 449   }
 450
 451   void VerifyReactionToPrefAttack() override {
 452     // The clearance of homepage should have been noticed (as pref #2 being
 453     // cleared), but shouldn't have triggered a reset (as there is nothing we
 454     // can do when the pref is already gone).
 455     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 456               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 457                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 458     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 459                   ? num_tracked_prefs() - 1 : 0,
 460               GetTrackedPrefHistogramCount(
 461                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 462     EXPECT_EQ(0,
 463               GetTrackedPrefHistogramCount(
 464                   "Settings.TrackedPreferenceWantedReset", ALLOW_NONE));
 465     EXPECT_EQ(0,
 466               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 467                                            ALLOW_NONE));
 468
 469     // Nothing else should have triggered.
 470     EXPECT_EQ(0,
 471               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 472                                            ALLOW_NONE));
 473     EXPECT_EQ(0,
 474               GetTrackedPrefHistogramCount(
 475                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 476     EXPECT_EQ(0,
 477               GetTrackedPrefHistogramCount(
 478                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 479     EXPECT_EQ(0,
 480               GetTrackedPrefHistogramCount(
 481                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 482     EXPECT_EQ(
 483         0,
 484         GetTrackedPrefHistogramCount(
 485             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 486   }
 487 };
 488
 489 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestClearedAtomic, ClearedAtomic);
 490
 491 // Verifies that clearing the MACs results in untrusted Initialized pings for
 492 // non-null protected prefs.
 493 class PrefHashBrowserTestUntrustedInitialized : public PrefHashBrowserTestBase {
 494  public:
 495   void SetupPreferences() override {
 496     // Explicitly set the DSE (it's otherwise NULL by default, preventing
 497     // thorough testing of the PROTECTION_ENABLED_DSE level).
 498     DefaultSearchManager default_search_manager(
 499         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 500     DefaultSearchManager::Source dse_source =
 501         static_cast<DefaultSearchManager::Source>(-1);
 502
 503     const TemplateURLData* default_template_url_data =
 504         default_search_manager.GetDefaultSearchEngine(&dse_source);
 505     EXPECT_EQ(DefaultSearchManager::FROM_FALLBACK, dse_source);
 506
 507     default_search_manager.SetUserSelectedDefaultSearchEngine(
 508         *default_template_url_data);
 509
 510     default_search_manager.GetDefaultSearchEngine(&dse_source);
 511     EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source);
 512
 513     // Also explicitly set an atomic pref that falls under
 514     // PROTECTION_ENABLED_BASIC.
 515     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 516                                       SessionStartupPref::URLS);
 517   }
 518
 519   void AttackPreferencesOnDisk(
 520       base::DictionaryValue* unprotected_preferences,
 521       base::DictionaryValue* protected_preferences) override {
 522     EXPECT_TRUE(unprotected_preferences->Remove("protection.macs", NULL));
 523     if (protected_preferences)
 524       EXPECT_TRUE(protected_preferences->Remove("protection.macs", NULL));
 525   }
 526
 527   void VerifyReactionToPrefAttack() override {
 528     // Preferences that are NULL by default will be NullInitialized.
 529     int num_null_values = GetTrackedPrefHistogramCount(
 530         "Settings.TrackedPreferenceNullInitialized", ALLOW_ANY);
 531     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
 532               num_null_values > 0);
 533     if (num_null_values > 0) {
 534       // This test requires that at least 3 prefs be non-null (extensions, DSE,
 535       // and 1 atomic pref explictly set for this test above).
 536       EXPECT_GE(num_tracked_prefs() - num_null_values, 3);
 537     }
 538
 539     // Expect all non-null prefs to be reported as Initialized (with
 540     // accompanying resets or wanted resets based on the current protection
 541     // level).
 542     EXPECT_EQ(num_tracked_prefs() - num_null_values,
 543               GetTrackedPrefHistogramCount(
 544                   "Settings.TrackedPreferenceInitialized", ALLOW_ANY));
 545
 546     int num_protected_prefs = 0;
 547     // A switch statement falling through each protection level in decreasing
 548     // levels of protection to add expectations for each level which augments
 549     // the previous one.
 550     switch (protection_level_) {
 551       case PROTECTION_ENABLED_ALL:
 552         // Falls through.
 553       case PROTECTION_ENABLED_EXTENSIONS:
 554         ++num_protected_prefs;
 555         // Falls through.
 556       case PROTECTION_ENABLED_DSE:
 557         ++num_protected_prefs;
 558         // Falls through.
 559       case PROTECTION_ENABLED_BASIC:
 560         num_protected_prefs += num_tracked_prefs() - num_null_values - 2;
 561         // Falls through.
 562       case PROTECTION_DISABLED_FOR_GROUP:
 563         // No protection. Falls through.
 564       case PROTECTION_DISABLED_ON_PLATFORM:
 565         // No protection.
 566         break;
 567     }
 568
 569     EXPECT_EQ(num_tracked_prefs() - num_null_values - num_protected_prefs,
 570               GetTrackedPrefHistogramCount(
 571                   "Settings.TrackedPreferenceWantedReset", ALLOW_ANY));
 572     EXPECT_EQ(num_protected_prefs,
 573               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 574                                            ALLOW_ANY));
 575
 576     // Explicitly verify the result of reported resets.
 577
 578     DefaultSearchManager default_search_manager(
 579         profile()->GetPrefs(), DefaultSearchManager::ObserverCallback());
 580     DefaultSearchManager::Source dse_source =
 581         static_cast<DefaultSearchManager::Source>(-1);
 582     default_search_manager.GetDefaultSearchEngine(&dse_source);
 583     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_DSE
 584                   ? DefaultSearchManager::FROM_USER
 585                   : DefaultSearchManager::FROM_FALLBACK,
 586               dse_source);
 587
 588     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_BASIC,
 589               profile()->GetPrefs()->GetInteger(prefs::kRestoreOnStartup) ==
 590                   SessionStartupPref::URLS);
 591
 592     // Nothing else should have triggered.
 593     EXPECT_EQ(0,
 594               GetTrackedPrefHistogramCount(
 595                   "Settings.TrackedPreferenceUnchanged", ALLOW_NONE));
 596     EXPECT_EQ(0,
 597               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 598                                            ALLOW_NONE));
 599     EXPECT_EQ(0,
 600               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 601                                            ALLOW_NONE));
 602     EXPECT_EQ(
 603         0,
 604         GetTrackedPrefHistogramCount(
 605             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 606   }
 607 };
 608
 609 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedInitialized,
 610                        UntrustedInitialized);
 611
 612 // Verifies that changing an atomic pref results in it being reported (and reset
 613 // if the protection level allows it).
 614 class PrefHashBrowserTestChangedAtomic : public PrefHashBrowserTestBase {
 615  public:
 616   void SetupPreferences() override {
 617     profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
 618                                       SessionStartupPref::URLS);
 619
 620     ListPrefUpdate update(profile()->GetPrefs(),
 621                           prefs::kURLsToRestoreOnStartup);
 622     update->AppendString("http://example.com");
 623   }
 624
 625   void AttackPreferencesOnDisk(
 626       base::DictionaryValue* unprotected_preferences,
 627       base::DictionaryValue* protected_preferences) override {
 628     base::DictionaryValue* selected_prefs =
 629         protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
 630                                                       : unprotected_preferences;
 631     // |selected_prefs| should never be NULL under the protection level picking
 632     // it.
 633     EXPECT_TRUE(selected_prefs);
 634     base::ListValue* startup_urls;
 635     EXPECT_TRUE(
 636         selected_prefs->GetList(prefs::kURLsToRestoreOnStartup, &startup_urls));
 637     EXPECT_TRUE(startup_urls);
 638     EXPECT_EQ(1U, startup_urls->GetSize());
 639     startup_urls->AppendString("http://example.org");
 640   }
 641
 642   void VerifyReactionToPrefAttack() override {
 643     // Expect a single Changed event for tracked pref #4 (startup URLs).
 644     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 645               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 646                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 647     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 648                   ? num_tracked_prefs() - 1 : 0,
 649               GetTrackedPrefHistogramCount(
 650                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 651
 652     EXPECT_EQ(
 653         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 654          protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0,
 655         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 656                                      BEGIN_ALLOW_SINGLE_BUCKET + 4));
 657     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 1 : 0,
 658               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 659                                            BEGIN_ALLOW_SINGLE_BUCKET + 4));
 660
 661 // TODO(gab): This doesn't work on OS_CHROMEOS because we fail to attack
 662 // Preferences.
 663 #if !defined(OS_CHROMEOS)
 664     // Explicitly verify the result of reported resets.
 665     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 0U : 2U,
 666               profile()
 667                   ->GetPrefs()
 668                   ->GetList(prefs::kURLsToRestoreOnStartup)
 669                   ->GetSize());
 670 #endif
 671
 672     // Nothing else should have triggered.
 673     EXPECT_EQ(0,
 674               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 675                                            ALLOW_NONE));
 676     EXPECT_EQ(0,
 677               GetTrackedPrefHistogramCount(
 678                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 679     EXPECT_EQ(0,
 680               GetTrackedPrefHistogramCount(
 681                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 682     EXPECT_EQ(0,
 683               GetTrackedPrefHistogramCount(
 684                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 685     EXPECT_EQ(
 686         0,
 687         GetTrackedPrefHistogramCount(
 688             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 689   }
 690 };
 691
 692 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedAtomic, ChangedAtomic);
 693
 694 // Verifies that changing or adding an entry in a split pref results in both
 695 // items being reported (and remove if the protection level allows it).
 696 class PrefHashBrowserTestChangedSplitPref : public PrefHashBrowserTestBase {
 697  public:
 698   void SetupPreferences() override {
 699     InstallExtensionWithUIAutoConfirm(
 700         test_data_dir_.AppendASCII("good.crx"), 1, browser());
 701   }
 702
 703   void AttackPreferencesOnDisk(
 704       base::DictionaryValue* unprotected_preferences,
 705       base::DictionaryValue* protected_preferences) override {
 706     base::DictionaryValue* selected_prefs =
 707         protection_level_ >= PROTECTION_ENABLED_EXTENSIONS
 708             ? protected_preferences
 709             : unprotected_preferences;
 710     // |selected_prefs| should never be NULL under the protection level picking
 711     // it.
 712     EXPECT_TRUE(selected_prefs);
 713     base::DictionaryValue* extensions_dict;
 714     EXPECT_TRUE(selected_prefs->GetDictionary(
 715         extensions::pref_names::kExtensions, &extensions_dict));
 716     EXPECT_TRUE(extensions_dict);
 717
 718     // Tamper with any installed setting for good.crx
 719     base::DictionaryValue* good_crx_dict;
 720     EXPECT_TRUE(extensions_dict->GetDictionary(kGoodCrxId, &good_crx_dict));
 721     int good_crx_state;
 722     EXPECT_TRUE(good_crx_dict->GetInteger("state", &good_crx_state));
 723     EXPECT_EQ(extensions::Extension::ENABLED, good_crx_state);
 724     good_crx_dict->SetInteger("state", extensions::Extension::DISABLED);
 725
 726     // Drop a fake extension (for the purpose of this test, dropped settings
 727     // don't need to be valid extension settings).
 728     base::DictionaryValue* fake_extension = new base::DictionaryValue;
 729     fake_extension->SetString("name", "foo");
 730     extensions_dict->Set(std::string(32, 'a'), fake_extension);
 731   }
 732
 733   void VerifyReactionToPrefAttack() override {
 734     // Expect a single split pref changed report with a count of 2 for tracked
 735     // pref #5 (extensions).
 736     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 737               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 738                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 739     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
 740               GetTrackedPrefHistogramCount(
 741                   "Settings.TrackedSplitPreferenceChanged.extensions.settings",
 742                   BEGIN_ALLOW_SINGLE_BUCKET + 2));
 743
 744     // Everything else should have remained unchanged.
 745     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 746                   ? num_tracked_prefs() - 1 : 0,
 747               GetTrackedPrefHistogramCount(
 748                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 749
 750     EXPECT_EQ(
 751         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 752          protection_level_ < PROTECTION_ENABLED_EXTENSIONS) ? 1 : 0,
 753         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 754                                      BEGIN_ALLOW_SINGLE_BUCKET + 5));
 755     EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_EXTENSIONS ? 1 : 0,
 756               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 757                                            BEGIN_ALLOW_SINGLE_BUCKET + 5));
 758
 759     EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_EXTENSIONS,
 760               extension_service()->GetExtensionById(kGoodCrxId, true) != NULL);
 761
 762     // Nothing else should have triggered.
 763     EXPECT_EQ(0,
 764               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 765                                            ALLOW_NONE));
 766     EXPECT_EQ(0,
 767               GetTrackedPrefHistogramCount(
 768                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 769     EXPECT_EQ(0,
 770               GetTrackedPrefHistogramCount(
 771                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 772     EXPECT_EQ(0,
 773               GetTrackedPrefHistogramCount(
 774                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 775     EXPECT_EQ(
 776         0,
 777         GetTrackedPrefHistogramCount(
 778             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 779   }
 780 };
 781
 782 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedSplitPref, ChangedSplitPref);
 783
 784 // Verifies that adding a value to unprotected preferences for a key which is
 785 // still using the default (i.e. has no value stored in protected preferences)
 786 // doesn't allow that value to slip in with no valid MAC (regression test for
 787 // http://crbug.com/414554)
 788 class PrefHashBrowserTestUntrustedAdditionToPrefs
 789     : public PrefHashBrowserTestBase {
 790  public:
 791   void SetupPreferences() override {
 792     // Ensure there is no user-selected value for kRestoreOnStartup.
 793     EXPECT_FALSE(
 794         profile()->GetPrefs()->GetUserPrefValue(prefs::kRestoreOnStartup));
 795   }
 796
 797   void AttackPreferencesOnDisk(
 798       base::DictionaryValue* unprotected_preferences,
 799       base::DictionaryValue* protected_preferences) override {
 800     unprotected_preferences->SetInteger(prefs::kRestoreOnStartup,
 801                                         SessionStartupPref::LAST);
 802   }
 803
 804   void VerifyReactionToPrefAttack() override {
 805     // Expect a single Changed event for tracked pref #3 (kRestoreOnStartup) if
 806     // not protecting; if protection is enabled the change should be a no-op.
 807     int changed_expected =
 808         protection_level_ == PROTECTION_DISABLED_FOR_GROUP ? 1 : 0;
 809     EXPECT_EQ(
 810         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 811          protection_level_ < PROTECTION_ENABLED_BASIC) ? changed_expected : 0,
 812         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 813                                      BEGIN_ALLOW_SINGLE_BUCKET + 3));
 814     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 815                   ? num_tracked_prefs() - changed_expected : 0,
 816               GetTrackedPrefHistogramCount(
 817                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 818
 819     EXPECT_EQ(
 820         (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 821          protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0,
 822         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 823                                      BEGIN_ALLOW_SINGLE_BUCKET + 3));
 824     EXPECT_EQ(0,
 825               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 826                                            ALLOW_NONE));
 827
 828     // Nothing else should have triggered.
 829     EXPECT_EQ(0,
 830               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 831                                            ALLOW_NONE));
 832     EXPECT_EQ(0,
 833               GetTrackedPrefHistogramCount(
 834                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 835     EXPECT_EQ(0,
 836               GetTrackedPrefHistogramCount(
 837                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 838     EXPECT_EQ(0,
 839               GetTrackedPrefHistogramCount(
 840                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 841     EXPECT_EQ(
 842         0,
 843         GetTrackedPrefHistogramCount(
 844             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 845   }
 846 };
 847
 848 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefs,
 849                        UntrustedAdditionToPrefs);
 850
 851 // Verifies that adding a value to unprotected preferences while wiping a
 852 // user-selected value from protected preferences doesn't allow that value to
 853 // slip in with no valid MAC (regression test for http://crbug.com/414554).
 854 class PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe
 855     : public PrefHashBrowserTestBase {
 856  public:
 857   void SetupPreferences() override {
 858     profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
 859   }
 860
 861   void AttackPreferencesOnDisk(
 862       base::DictionaryValue* unprotected_preferences,
 863       base::DictionaryValue* protected_preferences) override {
 864     // Set or change the value in Preferences to the attacker's choice.
 865     unprotected_preferences->SetString(prefs::kHomePage, "http://example.net");
 866     // Clear the value in Secure Preferences, if any.
 867     if (protected_preferences)
 868       protected_preferences->Remove(prefs::kHomePage, NULL);
 869   }
 870
 871   void VerifyReactionToPrefAttack() override {
 872     // Expect a single Changed event for tracked pref #2 (kHomePage) if
 873     // not protecting; if protection is enabled the change should be a Cleared.
 874     int changed_expected =
 875         protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
 876         protection_level_ < PROTECTION_ENABLED_BASIC
 877         ? 1 : 0;
 878     int cleared_expected =
 879         protection_level_ >= PROTECTION_ENABLED_BASIC
 880         ? 1 : 0;
 881     EXPECT_EQ(changed_expected,
 882               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged",
 883                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 884     EXPECT_EQ(cleared_expected,
 885               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared",
 886                                            BEGIN_ALLOW_SINGLE_BUCKET + 2));
 887     EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
 888                   ? num_tracked_prefs() - changed_expected - cleared_expected
 889                   : 0,
 890               GetTrackedPrefHistogramCount(
 891                   "Settings.TrackedPreferenceUnchanged", ALLOW_ANY));
 892
 893     EXPECT_EQ(
 894         changed_expected,
 895         GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset",
 896                                      BEGIN_ALLOW_SINGLE_BUCKET + 2));
 897     EXPECT_EQ(0,
 898               GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset",
 899                                            ALLOW_NONE));
 900
 901     // Nothing else should have triggered.
 902     EXPECT_EQ(0,
 903               GetTrackedPrefHistogramCount(
 904                   "Settings.TrackedPreferenceInitialized", ALLOW_NONE));
 905     EXPECT_EQ(0,
 906               GetTrackedPrefHistogramCount(
 907                   "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE));
 908     EXPECT_EQ(0,
 909               GetTrackedPrefHistogramCount(
 910                   "Settings.TrackedPreferenceNullInitialized", ALLOW_NONE));
 911     EXPECT_EQ(
 912         0,
 913         GetTrackedPrefHistogramCount(
 914             "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE));
 915   }
 916 };
 917
 918 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe,
 919                        UntrustedAdditionToPrefsAfterWipe);