Home | History | Annotate | Download | only in src
      1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "sandbox/win/src/policy_engine_params.h"
      6 #include "sandbox/win/src/policy_engine_processor.h"
      7 #include "sandbox/win/src/policy_low_level.h"
      8 #include "testing/gtest/include/gtest/gtest.h"
      9 
     10 #define POLPARAMS_BEGIN(x) sandbox::ParameterSet x[] = {
     11 #define POLPARAM(p) sandbox::ParamPickerMake(p),
     12 #define POLPARAMS_END }
     13 
     14 namespace sandbox {
     15 
     16 bool SetupNtdllImports();
     17 
     18 // Testing that we allow opcode generation on valid string patterns.
     19 TEST(PolicyEngineTest, StringPatternsOK) {
     20   SetupNtdllImports();
     21   PolicyRule pr(ASK_BROKER);
     22   EXPECT_TRUE(pr.AddStringMatch(IF, 0, L"c:\\adobe\\ver??\\", CASE_SENSITIVE));
     23   EXPECT_TRUE(pr.AddStringMatch(IF, 0, L"*.tmp", CASE_SENSITIVE));
     24   EXPECT_TRUE(pr.AddStringMatch(IF, 0, L"c:\\*.doc", CASE_SENSITIVE));
     25   EXPECT_TRUE(pr.AddStringMatch(IF, 0, L"c:\\windows\\*", CASE_SENSITIVE));
     26   EXPECT_TRUE(pr.AddStringMatch(IF, 0, L"d:\\adobe\\acrobat.exe",
     27                                 CASE_SENSITIVE));
     28 }
     29 
     30 // Testing that we signal invalid string patterns.
     31 TEST(PolicyEngineTest, StringPatternsBAD) {
     32   SetupNtdllImports();
     33   PolicyRule pr(ASK_BROKER);
     34   EXPECT_FALSE(pr.AddStringMatch(IF, 0, L"one**two", CASE_SENSITIVE));
     35   EXPECT_FALSE(pr.AddStringMatch(IF, 0, L"**three", CASE_SENSITIVE));
     36   EXPECT_FALSE(pr.AddStringMatch(IF, 0, L"five?six*?seven", CASE_SENSITIVE));
     37   EXPECT_FALSE(pr.AddStringMatch(IF, 0, L"eight?*nine", CASE_SENSITIVE));
     38 }
     39 
     40 // Helper function to allocate space (on the heap) for policy.
     41 PolicyGlobal* MakePolicyMemory() {
     42   const size_t kTotalPolicySz = 4096*8;
     43   char* mem = new char[kTotalPolicySz];
     44   memset(mem, 0, kTotalPolicySz);
     45   PolicyGlobal* policy = reinterpret_cast<PolicyGlobal*>(mem);
     46   policy->data_size = kTotalPolicySz - sizeof(PolicyGlobal);
     47   return policy;
     48 }
     49 
     50 // The simplest test using LowLevelPolicy it should test a single opcode which
     51 // does a exact string comparison.
     52 TEST(PolicyEngineTest, SimpleStrMatch) {
     53   SetupNtdllImports();
     54   PolicyRule pr(ASK_BROKER);
     55   EXPECT_TRUE(pr.AddStringMatch(IF, 0, L"z:\\Directory\\domo.txt",
     56               CASE_INSENSITIVE));
     57 
     58   PolicyGlobal* policy = MakePolicyMemory();
     59   const uint32 kFakeService = 2;
     60 
     61   LowLevelPolicy policyGen(policy);
     62   EXPECT_TRUE(policyGen.AddRule(kFakeService, &pr));
     63   EXPECT_TRUE(policyGen.Done());
     64 
     65   wchar_t* filename = L"Z:\\Directory\\domo.txt";
     66 
     67   POLPARAMS_BEGIN(eval_params)
     68     POLPARAM(filename)                // Argument 0
     69   POLPARAMS_END;
     70 
     71   PolicyResult result;
     72   PolicyProcessor pol_ev(policy->entry[kFakeService]);
     73 
     74   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
     75   EXPECT_EQ(POLICY_MATCH, result);
     76   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
     77 
     78   filename = L"Z:\\Directory\\domo.txt.tmp";
     79   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
     80   EXPECT_EQ(NO_POLICY_MATCH, result);
     81 
     82   delete [] reinterpret_cast<char*>(policy);
     83 }
     84 
     85 TEST(PolicyEngineTest, SimpleIfNotStrMatch) {
     86   SetupNtdllImports();
     87   PolicyRule pr(ASK_BROKER);
     88   EXPECT_TRUE(pr.AddStringMatch(IF_NOT, 0, L"c:\\Microsoft\\",
     89                                 CASE_SENSITIVE));
     90 
     91   PolicyGlobal* policy = MakePolicyMemory();
     92   const uint32 kFakeService = 2;
     93   LowLevelPolicy policyGen(policy);
     94 
     95   EXPECT_TRUE(policyGen.AddRule(kFakeService, &pr));
     96   EXPECT_TRUE(policyGen.Done());
     97 
     98   wchar_t* filename = NULL;
     99   POLPARAMS_BEGIN(eval_params)
    100     POLPARAM(filename)                // Argument 0
    101   POLPARAMS_END;
    102 
    103   PolicyResult result;
    104   PolicyProcessor pol_ev(policy->entry[kFakeService]);
    105 
    106   filename = L"c:\\Microsoft\\";
    107   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    108   EXPECT_EQ(NO_POLICY_MATCH, result);
    109 
    110   filename = L"c:\\MicroNerd\\";
    111   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    112   EXPECT_EQ(POLICY_MATCH, result);
    113   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    114 
    115   filename = L"c:\\Microsoft\\domo.txt";
    116   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    117   EXPECT_EQ(POLICY_MATCH, result);
    118   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    119 
    120   delete [] reinterpret_cast<char*>(policy);
    121 }
    122 
    123 TEST(PolicyEngineTest, SimpleIfNotStrMatchWild1) {
    124   SetupNtdllImports();
    125   PolicyRule pr(ASK_BROKER);
    126   EXPECT_TRUE(pr.AddStringMatch(IF_NOT, 0, L"c:\\Microsoft\\*",
    127                                 CASE_SENSITIVE));
    128 
    129   PolicyGlobal* policy = MakePolicyMemory();
    130   const uint32 kFakeService = 3;
    131   LowLevelPolicy policyGen(policy);
    132 
    133   EXPECT_TRUE(policyGen.AddRule(kFakeService, &pr));
    134   EXPECT_TRUE(policyGen.Done());
    135 
    136   wchar_t* filename = NULL;
    137   POLPARAMS_BEGIN(eval_params)
    138     POLPARAM(filename)                // Argument 0
    139   POLPARAMS_END;
    140 
    141   PolicyResult result;
    142   PolicyProcessor pol_ev(policy->entry[kFakeService]);
    143 
    144   filename = L"c:\\Microsoft\\domo.txt";
    145   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    146   EXPECT_EQ(NO_POLICY_MATCH, result);
    147 
    148   filename = L"c:\\MicroNerd\\domo.txt";
    149   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    150   EXPECT_EQ(POLICY_MATCH, result);
    151   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    152 
    153   delete [] reinterpret_cast<char*>(policy);
    154 }
    155 
    156 TEST(PolicyEngineTest, SimpleIfNotStrMatchWild2) {
    157   SetupNtdllImports();
    158   PolicyRule pr(ASK_BROKER);
    159   EXPECT_TRUE(pr.AddStringMatch(IF_NOT, 0, L"c:\\Microsoft\\*.txt",
    160                                 CASE_SENSITIVE));
    161 
    162   PolicyGlobal* policy = MakePolicyMemory();
    163   const uint32 kFakeService = 3;
    164   LowLevelPolicy policyGen(policy);
    165 
    166   EXPECT_TRUE(policyGen.AddRule(kFakeService, &pr));
    167   EXPECT_TRUE(policyGen.Done());
    168 
    169   wchar_t* filename = NULL;
    170   POLPARAMS_BEGIN(eval_params)
    171     POLPARAM(filename)                // Argument 0
    172   POLPARAMS_END;
    173 
    174   PolicyResult result;
    175   PolicyProcessor pol_ev(policy->entry[kFakeService]);
    176 
    177   filename = L"c:\\Microsoft\\domo.txt";
    178   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    179   EXPECT_EQ(NO_POLICY_MATCH, result);
    180 
    181   filename = L"c:\\MicroNerd\\domo.txt";
    182   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    183   EXPECT_EQ(POLICY_MATCH, result);
    184   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    185 
    186   filename = L"c:\\Microsoft\\domo.bmp";
    187   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    188   EXPECT_EQ(POLICY_MATCH, result);
    189   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    190 
    191   delete [] reinterpret_cast<char*>(policy);
    192 }
    193 
    194 TEST(PolicyEngineTest, IfNotStrMatchTwoRulesWild1) {
    195   SetupNtdllImports();
    196   PolicyRule pr(ASK_BROKER);
    197   EXPECT_TRUE(pr.AddStringMatch(IF_NOT, 0, L"c:\\Microsoft\\*",
    198                                 CASE_SENSITIVE));
    199   EXPECT_TRUE(pr.AddNumberMatch(IF, 1, 24, EQUAL));
    200 
    201   PolicyGlobal* policy = MakePolicyMemory();
    202   const uint32 kFakeService = 3;
    203   LowLevelPolicy policyGen(policy);
    204 
    205   EXPECT_TRUE(policyGen.AddRule(kFakeService, &pr));
    206   EXPECT_TRUE(policyGen.Done());
    207 
    208   wchar_t* filename = NULL;
    209   unsigned long access = 0;
    210   POLPARAMS_BEGIN(eval_params)
    211     POLPARAM(filename)                // Argument 0
    212     POLPARAM(access)                  // Argument 1
    213   POLPARAMS_END;
    214 
    215   PolicyResult result;
    216   PolicyProcessor pol_ev(policy->entry[kFakeService]);
    217 
    218   filename = L"c:\\Microsoft\\domo.txt";
    219   access = 24;
    220   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    221   EXPECT_EQ(NO_POLICY_MATCH, result);
    222 
    223   filename = L"c:\\Microsoft\\domo.txt";
    224   access = 42;
    225   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    226   EXPECT_EQ(NO_POLICY_MATCH, result);
    227 
    228   filename = L"c:\\MicroNerd\\domo.txt";
    229   access = 24;
    230   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    231   EXPECT_EQ(POLICY_MATCH, result);
    232   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    233 
    234   filename = L"c:\\Micronesia\\domo.txt";
    235   access = 42;
    236   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    237   EXPECT_EQ(NO_POLICY_MATCH, result);
    238 
    239   delete [] reinterpret_cast<char*>(policy);
    240 }
    241 
    242 TEST(PolicyEngineTest, IfNotStrMatchTwoRulesWild2) {
    243   SetupNtdllImports();
    244   PolicyRule pr(ASK_BROKER);
    245   EXPECT_TRUE(pr.AddNumberMatch(IF, 1, 24, EQUAL));
    246   EXPECT_TRUE(pr.AddStringMatch(IF_NOT, 0, L"c:\\GoogleV?\\*.txt",
    247                                 CASE_SENSITIVE));
    248   EXPECT_TRUE(pr.AddNumberMatch(IF, 2, 66, EQUAL));
    249 
    250   PolicyGlobal* policy = MakePolicyMemory();
    251   const uint32 kFakeService = 3;
    252   LowLevelPolicy policyGen(policy);
    253 
    254   EXPECT_TRUE(policyGen.AddRule(kFakeService, &pr));
    255   EXPECT_TRUE(policyGen.Done());
    256 
    257   wchar_t* filename = NULL;
    258   unsigned long access = 0;
    259   unsigned long sharing = 66;
    260 
    261   POLPARAMS_BEGIN(eval_params)
    262     POLPARAM(filename)                // Argument 0
    263     POLPARAM(access)                  // Argument 1
    264     POLPARAM(sharing)                 // Argument 2
    265   POLPARAMS_END;
    266 
    267   PolicyResult result;
    268   PolicyProcessor pol_ev(policy->entry[kFakeService]);
    269 
    270   filename = L"c:\\GoogleV2\\domo.txt";
    271   access = 24;
    272   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    273   EXPECT_EQ(NO_POLICY_MATCH, result);
    274 
    275   filename = L"c:\\GoogleV2\\domo.bmp";
    276   access = 24;
    277   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    278   EXPECT_EQ(POLICY_MATCH, result);
    279   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    280 
    281   filename = L"c:\\GoogleV23\\domo.txt";
    282   access = 24;
    283   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    284   EXPECT_EQ(POLICY_MATCH, result);
    285   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    286 
    287 
    288   filename = L"c:\\GoogleV2\\domo.txt";
    289   access = 42;
    290   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    291   EXPECT_EQ(NO_POLICY_MATCH, result);
    292 
    293   filename = L"c:\\Google\\domo.txt";
    294   access = 24;
    295   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    296   EXPECT_EQ(POLICY_MATCH, result);
    297   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    298 
    299   filename = L"c:\\Micronesia\\domo.txt";
    300   access = 42;
    301   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    302   EXPECT_EQ(NO_POLICY_MATCH, result);
    303 
    304   filename = L"c:\\GoogleV2\\domo.bmp";
    305   access = 24;
    306   sharing = 0;
    307   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    308   EXPECT_EQ(NO_POLICY_MATCH, result);
    309 
    310   delete [] reinterpret_cast<char*>(policy);
    311 }
    312 
    313 // Testing one single rule in one single service. The service is made to
    314 // resemble NtCreateFile.
    315 TEST(PolicyEngineTest, OneRuleTest) {
    316   SetupNtdllImports();
    317   PolicyRule pr(ASK_BROKER);
    318   EXPECT_TRUE(pr.AddStringMatch(IF, 0, L"c:\\*Microsoft*\\*.txt",
    319                                 CASE_SENSITIVE));
    320   EXPECT_TRUE(pr.AddNumberMatch(IF_NOT, 1, CREATE_ALWAYS, EQUAL));
    321   EXPECT_TRUE(pr.AddNumberMatch(IF, 2, FILE_ATTRIBUTE_NORMAL, EQUAL));
    322 
    323   PolicyGlobal* policy = MakePolicyMemory();
    324 
    325   const uint32 kNtFakeCreateFile = 7;
    326 
    327   LowLevelPolicy policyGen(policy);
    328   EXPECT_TRUE(policyGen.AddRule(kNtFakeCreateFile, &pr));
    329   EXPECT_TRUE(policyGen.Done());
    330 
    331   wchar_t* filename = L"c:\\Documents and Settings\\Microsoft\\BLAH.txt";
    332   unsigned long creation_mode = OPEN_EXISTING;
    333   unsigned long flags = FILE_ATTRIBUTE_NORMAL;
    334   void* security_descriptor = NULL;
    335 
    336   POLPARAMS_BEGIN(eval_params)
    337     POLPARAM(filename)                // Argument 0
    338     POLPARAM(creation_mode)           // Argument 1
    339     POLPARAM(flags)                   // Argument 2
    340     POLPARAM(security_descriptor)
    341   POLPARAMS_END;
    342 
    343   PolicyResult result;
    344   PolicyProcessor pol_ev(policy->entry[kNtFakeCreateFile]);
    345 
    346   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    347   EXPECT_EQ(POLICY_MATCH, result);
    348   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    349 
    350   creation_mode = CREATE_ALWAYS;
    351   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    352   EXPECT_EQ(NO_POLICY_MATCH, result);
    353 
    354   creation_mode = OPEN_EXISTING;
    355   filename = L"c:\\Other\\Path\\Microsoft\\Another file.txt";
    356   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    357   EXPECT_EQ(POLICY_MATCH, result);
    358   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    359 
    360   filename = L"c:\\Other\\Path\\Microsoft\\Another file.txt.tmp";
    361   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    362   EXPECT_EQ(NO_POLICY_MATCH, result);
    363 
    364   flags = FILE_ATTRIBUTE_DEVICE;
    365   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    366   EXPECT_EQ(NO_POLICY_MATCH, result);
    367 
    368   filename = L"c:\\Other\\Macrosoft\\Another file.txt";
    369   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    370   EXPECT_EQ(NO_POLICY_MATCH, result);
    371 
    372   filename = L"c:\\Microsoft\\1.txt";
    373   flags = FILE_ATTRIBUTE_NORMAL;
    374   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    375   EXPECT_EQ(POLICY_MATCH, result);
    376   EXPECT_EQ(ASK_BROKER, pol_ev.GetAction());
    377 
    378   filename = L"c:\\Microsoft\\1.ttt";
    379   result = pol_ev.Evaluate(kShortEval, eval_params, _countof(eval_params));
    380   EXPECT_EQ(NO_POLICY_MATCH, result);
    381 
    382   delete [] reinterpret_cast<char*>(policy);
    383 }
    384 
    385 // Testing 3 rules in 3 services. Two of the services resemble File services.
    386 TEST(PolicyEngineTest, ThreeRulesTest) {
    387   SetupNtdllImports();
    388   PolicyRule pr_pipe(FAKE_SUCCESS);
    389   EXPECT_TRUE(pr_pipe.AddStringMatch(IF, 0, L"\\\\/?/?\\Pipe\\Chrome.*",
    390                                      CASE_INSENSITIVE));
    391   EXPECT_TRUE(pr_pipe.AddNumberMatch(IF, 1, OPEN_EXISTING, EQUAL));
    392   EXPECT_TRUE(pr_pipe.AddNumberMatch(IF, 2, FILE_ATTRIBUTE_NORMAL, EQUAL));
    393 
    394   size_t opc1 = pr_pipe.GetOpcodeCount();
    395   EXPECT_EQ(3, opc1);
    396 
    397   PolicyRule pr_dump(ASK_BROKER);
    398   EXPECT_TRUE(pr_dump.AddStringMatch(IF, 0, L"\\\\/?/?\\*\\Crash Reports\\*",
    399                                      CASE_INSENSITIVE));
    400   EXPECT_TRUE(pr_dump.AddNumberMatch(IF, 1, CREATE_ALWAYS, EQUAL));
    401   EXPECT_TRUE(pr_dump.AddNumberMatch(IF, 2, FILE_ATTRIBUTE_NORMAL, EQUAL));
    402 
    403   size_t opc2 = pr_dump.GetOpcodeCount();
    404   EXPECT_EQ(4, opc2);
    405 
    406   PolicyRule pr_winexe(SIGNAL_ALARM);
    407   EXPECT_TRUE(pr_winexe.AddStringMatch(IF, 0, L"\\\\/?/?\\C:\\Windows\\*.exe",
    408                                        CASE_INSENSITIVE));
    409   EXPECT_TRUE(pr_winexe.AddNumberMatch(IF, 2, FILE_ATTRIBUTE_NORMAL, EQUAL));
    410 
    411   size_t opc3 = pr_winexe.GetOpcodeCount();
    412   EXPECT_EQ(3, opc3);
    413 
    414   PolicyRule pr_adobe(GIVE_CACHED);
    415   EXPECT_TRUE(pr_adobe.AddStringMatch(IF, 0, L"c:\\adobe\\ver?.?\\",
    416                                       CASE_SENSITIVE));
    417   EXPECT_TRUE(pr_adobe.AddNumberMatch(IF, 2, FILE_ATTRIBUTE_NORMAL, EQUAL));
    418 
    419   size_t opc4 = pr_adobe.GetOpcodeCount();
    420   EXPECT_EQ(4, opc4);
    421 
    422   PolicyRule pr_none(GIVE_FIRST);
    423   EXPECT_TRUE(pr_none.AddNumberMatch(IF, 2, FILE_ATTRIBUTE_READONLY, AND));
    424   EXPECT_TRUE(pr_none.AddNumberMatch(IF, 2, FILE_ATTRIBUTE_SYSTEM, AND));
    425 
    426   size_t opc5 = pr_none.GetOpcodeCount();
    427   EXPECT_EQ(2, opc5);
    428 
    429   PolicyGlobal* policy = MakePolicyMemory();
    430 
    431   const uint32 kNtFakeNone       = 4;
    432   const uint32 kNtFakeCreateFile = 5;
    433   const uint32 kNtFakeOpenFile   = 6;
    434 
    435   LowLevelPolicy policyGen(policy);
    436   EXPECT_TRUE(policyGen.AddRule(kNtFakeCreateFile, &pr_pipe));
    437   EXPECT_TRUE(policyGen.AddRule(kNtFakeCreateFile, &pr_dump));
    438   EXPECT_TRUE(policyGen.AddRule(kNtFakeCreateFile, &pr_winexe));
    439 
    440   EXPECT_TRUE(policyGen.AddRule(kNtFakeOpenFile, &pr_adobe));
    441   EXPECT_TRUE(policyGen.AddRule(kNtFakeOpenFile, &pr_pipe));
    442 
    443   EXPECT_TRUE(policyGen.AddRule(kNtFakeNone, &pr_none));
    444 
    445   EXPECT_TRUE(policyGen.Done());
    446 
    447   // Inspect the policy structure manually.
    448   EXPECT_TRUE(NULL == policy->entry[0]);
    449   EXPECT_TRUE(NULL == policy->entry[1]);
    450   EXPECT_TRUE(NULL == policy->entry[2]);
    451   EXPECT_TRUE(NULL == policy->entry[3]);
    452   EXPECT_TRUE(NULL != policy->entry[4]);  // kNtFakeNone.
    453   EXPECT_TRUE(NULL != policy->entry[5]);  // kNtFakeCreateFile.
    454   EXPECT_TRUE(NULL != policy->entry[6]);  // kNtFakeOpenFile.
    455   EXPECT_TRUE(NULL == policy->entry[7]);
    456 
    457   // The total per service opcode counts now must take in account one
    458   // extra opcode (action opcode) per rule.
    459   ++opc1;
    460   ++opc2;
    461   ++opc3;
    462   ++opc4;
    463   ++opc5;
    464 
    465   size_t tc1 = policy->entry[kNtFakeNone]->opcode_count;
    466   size_t tc2 = policy->entry[kNtFakeCreateFile]->opcode_count;
    467   size_t tc3 = policy->entry[kNtFakeOpenFile]->opcode_count;
    468 
    469   EXPECT_EQ(opc5, tc1);
    470   EXPECT_EQ((opc1 + opc2 + opc3), tc2);
    471   EXPECT_EQ((opc1 + opc4), tc3);
    472 
    473   // Check the type of the first and last opcode of each service.
    474 
    475   EXPECT_EQ(OP_ULONG_AND_MATCH, policy->entry[kNtFakeNone]->opcodes[0].GetID());
    476   EXPECT_EQ(OP_ACTION, policy->entry[kNtFakeNone]->opcodes[tc1-1].GetID());
    477   EXPECT_EQ(OP_WSTRING_MATCH,
    478             policy->entry[kNtFakeCreateFile]->opcodes[0].GetID());
    479   EXPECT_EQ(OP_ACTION,
    480             policy->entry[kNtFakeCreateFile]->opcodes[tc2-1].GetID());
    481   EXPECT_EQ(OP_WSTRING_MATCH,
    482             policy->entry[kNtFakeOpenFile]->opcodes[0].GetID());
    483   EXPECT_EQ(OP_ACTION, policy->entry[kNtFakeOpenFile]->opcodes[tc3-1].GetID());
    484 
    485   // Test the policy evaluation.
    486 
    487   wchar_t* filename = L"";
    488   unsigned long creation_mode = OPEN_EXISTING;
    489   unsigned long flags = FILE_ATTRIBUTE_NORMAL;
    490   void* security_descriptor = NULL;
    491 
    492   POLPARAMS_BEGIN(params)
    493     POLPARAM(filename)                // Argument 0
    494     POLPARAM(creation_mode)           // Argument 1
    495     POLPARAM(flags)                   // Argument 2
    496     POLPARAM(security_descriptor)
    497   POLPARAMS_END;
    498 
    499   PolicyResult result;
    500   PolicyProcessor eval_CreateFile(policy->entry[kNtFakeCreateFile]);
    501   PolicyProcessor eval_OpenFile(policy->entry[kNtFakeOpenFile]);
    502   PolicyProcessor eval_None(policy->entry[kNtFakeNone]);
    503 
    504   result = eval_CreateFile.Evaluate(kShortEval, params, _countof(params));
    505   EXPECT_EQ(NO_POLICY_MATCH, result);
    506   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    507   EXPECT_EQ(NO_POLICY_MATCH, result);
    508   result = eval_None.Evaluate(kShortEval, params, _countof(params));
    509   EXPECT_EQ(NO_POLICY_MATCH, result);
    510 
    511   filename = L"\\\\??\\c:\\Windows\\System32\\calc.exe";
    512   flags = FILE_ATTRIBUTE_SYSTEM;
    513   result = eval_CreateFile.Evaluate(kShortEval, params, _countof(params));
    514   EXPECT_EQ(NO_POLICY_MATCH, result);
    515   result = eval_None.Evaluate(kShortEval, params, _countof(params));
    516   EXPECT_EQ(NO_POLICY_MATCH, result);
    517   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    518   EXPECT_EQ(NO_POLICY_MATCH, result);
    519 
    520   flags += FILE_ATTRIBUTE_READONLY;
    521   result = eval_CreateFile.Evaluate(kShortEval, params, _countof(params));
    522   EXPECT_EQ(NO_POLICY_MATCH, result);
    523   result = eval_None.Evaluate(kShortEval, params, _countof(params));
    524   EXPECT_EQ(POLICY_MATCH, result);
    525   EXPECT_EQ(GIVE_FIRST, eval_None.GetAction());
    526   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    527   EXPECT_EQ(NO_POLICY_MATCH, result);
    528 
    529   flags = FILE_ATTRIBUTE_NORMAL;
    530   result = eval_CreateFile.Evaluate(kShortEval, params, _countof(params));
    531   EXPECT_EQ(POLICY_MATCH, result);
    532   EXPECT_EQ(SIGNAL_ALARM, eval_CreateFile.GetAction());
    533   result = eval_None.Evaluate(kShortEval, params, _countof(params));
    534   EXPECT_EQ(NO_POLICY_MATCH, result);
    535   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    536   EXPECT_EQ(NO_POLICY_MATCH, result);
    537 
    538   filename = L"c:\\adobe\\ver3.2\\temp";
    539   result = eval_CreateFile.Evaluate(kShortEval, params, _countof(params));
    540   EXPECT_EQ(NO_POLICY_MATCH, result);
    541   result = eval_None.Evaluate(kShortEval, params, _countof(params));
    542   EXPECT_EQ(NO_POLICY_MATCH, result);
    543   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    544   EXPECT_EQ(POLICY_MATCH, result);
    545   EXPECT_EQ(GIVE_CACHED, eval_OpenFile.GetAction());
    546 
    547   filename = L"c:\\adobe\\ver3.22\\temp";
    548   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    549   EXPECT_EQ(NO_POLICY_MATCH, result);
    550 
    551   filename = L"\\\\??\\c:\\some path\\other path\\crash reports\\some path";
    552   creation_mode = CREATE_ALWAYS;
    553   result = eval_CreateFile.Evaluate(kShortEval, params, _countof(params));
    554   EXPECT_EQ(POLICY_MATCH, result);
    555   EXPECT_EQ(ASK_BROKER, eval_CreateFile.GetAction());
    556   result = eval_None.Evaluate(kShortEval, params, _countof(params));
    557   EXPECT_EQ(NO_POLICY_MATCH, result);
    558   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    559   EXPECT_EQ(NO_POLICY_MATCH, result);
    560 
    561   filename = L"\\\\??\\Pipe\\Chrome.12345";
    562   creation_mode = OPEN_EXISTING;
    563   result = eval_CreateFile.Evaluate(kShortEval, params, _countof(params));
    564   EXPECT_EQ(POLICY_MATCH, result);
    565   EXPECT_EQ(FAKE_SUCCESS, eval_CreateFile.GetAction());
    566   result = eval_None.Evaluate(kShortEval, params, _countof(params));
    567   EXPECT_EQ(NO_POLICY_MATCH, result);
    568   result = eval_OpenFile.Evaluate(kShortEval, params, _countof(params));
    569   EXPECT_EQ(POLICY_MATCH, result);
    570   EXPECT_EQ(FAKE_SUCCESS, eval_OpenFile.GetAction());
    571 
    572   delete [] reinterpret_cast<char*>(policy);
    573 }
    574 
    575 TEST(PolicyEngineTest, PolicyRuleCopyConstructorTwoStrings) {
    576   SetupNtdllImports();
    577   // Both pr_orig and pr_copy should allow hello.* but not *.txt files.
    578   PolicyRule pr_orig(ASK_BROKER);
    579   EXPECT_TRUE(pr_orig.AddStringMatch(IF, 0, L"hello.*", CASE_SENSITIVE));
    580 
    581   PolicyRule pr_copy(pr_orig);
    582   EXPECT_TRUE(pr_orig.AddStringMatch(IF_NOT, 0, L"*.txt", CASE_SENSITIVE));
    583   EXPECT_TRUE(pr_copy.AddStringMatch(IF_NOT, 0, L"*.txt", CASE_SENSITIVE));
    584 
    585   PolicyGlobal* policy = MakePolicyMemory();
    586   LowLevelPolicy policyGen(policy);
    587   EXPECT_TRUE(policyGen.AddRule(1, &pr_orig));
    588   EXPECT_TRUE(policyGen.AddRule(2, &pr_copy));
    589   EXPECT_TRUE(policyGen.Done());
    590 
    591   wchar_t* name = NULL;
    592   POLPARAMS_BEGIN(eval_params)
    593     POLPARAM(name)
    594   POLPARAMS_END;
    595 
    596   PolicyResult result;
    597   PolicyProcessor pol_ev_orig(policy->entry[1]);
    598   name = L"domo.txt";
    599   result = pol_ev_orig.Evaluate(kShortEval, eval_params, _countof(eval_params));
    600   EXPECT_EQ(NO_POLICY_MATCH, result);
    601 
    602   name = L"hello.bmp";
    603   result = pol_ev_orig.Evaluate(kShortEval, eval_params, _countof(eval_params));
    604   EXPECT_EQ(POLICY_MATCH, result);
    605   EXPECT_EQ(ASK_BROKER, pol_ev_orig.GetAction());
    606 
    607   PolicyProcessor pol_ev_copy(policy->entry[2]);
    608   name = L"domo.txt";
    609   result = pol_ev_copy.Evaluate(kShortEval, eval_params, _countof(eval_params));
    610   EXPECT_EQ(NO_POLICY_MATCH, result);
    611 
    612   name = L"hello.bmp";
    613   result = pol_ev_copy.Evaluate(kShortEval, eval_params, _countof(eval_params));
    614   EXPECT_EQ(POLICY_MATCH, result);
    615   EXPECT_EQ(ASK_BROKER, pol_ev_copy.GetAction());
    616 }
    617 }  // namespace sandbox
    618