error_classification_unittest.cc 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311
  1. // Copyright 2015 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "components/ssl_errors/error_classification.h"
  5. #include <memory>
  6. #include "base/bind.h"
  7. #include "base/files/file_path.h"
  8. #include "base/strings/string_split.h"
  9. #include "base/test/metrics/histogram_tester.h"
  10. #include "base/test/simple_test_clock.h"
  11. #include "base/test/simple_test_tick_clock.h"
  12. #include "base/test/task_environment.h"
  13. #include "base/time/default_clock.h"
  14. #include "base/time/default_tick_clock.h"
  15. #include "components/network_time/network_time_test_utils.h"
  16. #include "components/network_time/network_time_tracker.h"
  17. #include "components/prefs/testing_pref_service.h"
  18. #include "net/base/net_errors.h"
  19. #include "net/cert/x509_certificate.h"
  20. #include "net/test/cert_test_util.h"
  21. #include "net/test/embedded_test_server/embedded_test_server.h"
  22. #include "net/test/embedded_test_server/http_response.h"
  23. #include "net/test/test_certificate_data.h"
  24. #include "net/test/test_data_directory.h"
  25. #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
  26. #include "services/network/test/test_shared_url_loader_factory.h"
  27. #include "services/network/test/test_url_loader_factory.h"
  28. #include "testing/gmock/include/gmock/gmock.h"
  29. #include "testing/gtest/include/gtest/gtest.h"
  30. #include "url/gurl.h"
  31. using testing::ElementsAre;
  32. namespace {
  33. const char kSslErrorCauseHistogram[] = "interstitial.ssl.cause.overridable";
  34. } // namespace
  35. class SSLErrorClassificationTest : public ::testing::Test {
  36. public:
  37. SSLErrorClassificationTest()
  38. : field_trial_test_(new network_time::FieldTrialTest()) {}
  39. network_time::FieldTrialTest* field_trial_test() {
  40. return field_trial_test_.get();
  41. }
  42. protected:
  43. network::TestURLLoaderFactory test_url_loader_factory_;
  44. private:
  45. std::unique_ptr<network_time::FieldTrialTest> field_trial_test_;
  46. };
  47. TEST_F(SSLErrorClassificationTest, TestNameMismatch) {
  48. scoped_refptr<net::X509Certificate> example_cert = net::ImportCertFromFile(
  49. net::GetTestCertsDirectory(), "subjectAltName_www_example_com.pem");
  50. ASSERT_TRUE(example_cert);
  51. std::vector<std::string> dns_names_example;
  52. example_cert->GetSubjectAltName(&dns_names_example, nullptr);
  53. ASSERT_THAT(dns_names_example, ElementsAre("www.example.com"));
  54. std::vector<std::string> hostname_tokens_example =
  55. ssl_errors::Tokenize(dns_names_example[0]);
  56. ASSERT_THAT(hostname_tokens_example, ElementsAre("www", "example", "com"));
  57. std::vector<std::vector<std::string>> dns_name_tokens_example;
  58. dns_name_tokens_example.push_back(hostname_tokens_example);
  59. ASSERT_EQ(1u, dns_name_tokens_example.size()); // [["www","example","com"]]
  60. ASSERT_THAT(dns_name_tokens_example[0], ElementsAre("www", "example", "com"));
  61. {
  62. GURL origin("https://example.com");
  63. std::string www_host;
  64. std::vector<std::string> host_name_tokens = base::SplitString(
  65. origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  66. EXPECT_TRUE(
  67. ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
  68. EXPECT_EQ("www.example.com", www_host);
  69. EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
  70. dns_name_tokens_example));
  71. EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
  72. host_name_tokens));
  73. EXPECT_FALSE(ssl_errors::IsSubDomainOutsideWildcard(origin, *example_cert));
  74. EXPECT_FALSE(
  75. ssl_errors::IsCertLikelyFromMultiTenantHosting(origin, *example_cert));
  76. EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
  77. }
  78. {
  79. GURL origin("https://foo.blah.example.com");
  80. std::string www_host;
  81. std::vector<std::string> host_name_tokens = base::SplitString(
  82. origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  83. EXPECT_FALSE(
  84. ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
  85. EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
  86. dns_name_tokens_example));
  87. EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
  88. host_name_tokens));
  89. EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
  90. }
  91. {
  92. GURL origin("https://foo.www.example.com");
  93. std::string www_host;
  94. std::vector<std::string> host_name_tokens = base::SplitString(
  95. origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  96. EXPECT_FALSE(
  97. ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
  98. EXPECT_TRUE(ssl_errors::NameUnderAnyNames(host_name_tokens,
  99. dns_name_tokens_example));
  100. EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
  101. host_name_tokens));
  102. EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
  103. }
  104. {
  105. GURL origin("https://www.example.com.foo");
  106. std::string www_host;
  107. std::vector<std::string> host_name_tokens = base::SplitString(
  108. origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  109. EXPECT_FALSE(
  110. ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
  111. EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
  112. dns_name_tokens_example));
  113. EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
  114. host_name_tokens));
  115. EXPECT_FALSE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
  116. }
  117. {
  118. GURL origin("https://www.fooexample.com.");
  119. std::string www_host;
  120. std::vector<std::string> host_name_tokens = base::SplitString(
  121. origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  122. EXPECT_FALSE(
  123. ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
  124. EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
  125. dns_name_tokens_example));
  126. EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
  127. host_name_tokens));
  128. EXPECT_FALSE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
  129. }
  130. // Ensure that a certificate with no SubjectAltName does not fall back to
  131. // the Subject CN when evaluating hostnames.
  132. {
  133. scoped_refptr<net::X509Certificate> google_cert =
  134. net::X509Certificate::CreateFromBytes(google_der);
  135. ASSERT_TRUE(google_cert);
  136. GURL origin("https://google.com");
  137. base::HistogramTester histograms;
  138. ssl_errors::RecordUMAStatistics(true, base::Time::NowFromSystemTime(),
  139. origin, net::ERR_CERT_COMMON_NAME_INVALID,
  140. *google_cert);
  141. // Verify that we recorded only NO_SUBJECT_ALT_NAME and no other causes.
  142. histograms.ExpectUniqueSample(kSslErrorCauseHistogram,
  143. ssl_errors::NO_SUBJECT_ALT_NAME, 1);
  144. }
  145. {
  146. scoped_refptr<net::X509Certificate> webkit_cert =
  147. net::X509Certificate::CreateFromBytes(webkit_der);
  148. ASSERT_TRUE(webkit_cert);
  149. std::vector<std::string> dns_names_webkit;
  150. webkit_cert->GetSubjectAltName(&dns_names_webkit, nullptr);
  151. ASSERT_THAT(dns_names_webkit, ElementsAre("*.webkit.org", "webkit.org"));
  152. std::vector<std::string> hostname_tokens_webkit_0 =
  153. ssl_errors::Tokenize(dns_names_webkit[0]);
  154. ASSERT_THAT(hostname_tokens_webkit_0, ElementsAre("*", "webkit", "org"));
  155. std::vector<std::string> hostname_tokens_webkit_1 =
  156. ssl_errors::Tokenize(dns_names_webkit[1]);
  157. ASSERT_THAT(hostname_tokens_webkit_1, ElementsAre("webkit", "org"));
  158. std::vector<std::vector<std::string>> dns_name_tokens_webkit;
  159. dns_name_tokens_webkit.push_back(hostname_tokens_webkit_0);
  160. dns_name_tokens_webkit.push_back(hostname_tokens_webkit_1);
  161. ASSERT_EQ(2u, dns_name_tokens_webkit.size());
  162. GURL origin("https://a.b.webkit.org");
  163. std::string www_host;
  164. std::vector<std::string> host_name_tokens = base::SplitString(
  165. origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  166. EXPECT_FALSE(
  167. ssl_errors::GetWWWSubDomainMatch(origin, dns_names_webkit, &www_host));
  168. EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
  169. dns_name_tokens_webkit));
  170. EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_webkit,
  171. host_name_tokens));
  172. EXPECT_TRUE(ssl_errors::IsSubDomainOutsideWildcard(origin, *webkit_cert));
  173. EXPECT_FALSE(
  174. ssl_errors::IsCertLikelyFromMultiTenantHosting(origin, *webkit_cert));
  175. EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *webkit_cert));
  176. }
  177. }
  178. TEST_F(SSLErrorClassificationTest, TestHostNameHasKnownTLD) {
  179. EXPECT_TRUE(ssl_errors::HostNameHasKnownTLD("www.google.com"));
  180. EXPECT_TRUE(ssl_errors::HostNameHasKnownTLD("b.appspot.com"));
  181. EXPECT_FALSE(ssl_errors::HostNameHasKnownTLD("a.private"));
  182. }
  183. TEST_F(SSLErrorClassificationTest, TestPrivateURL) {
  184. EXPECT_FALSE(ssl_errors::IsHostnameNonUniqueOrDotless("www.foogoogle.com."));
  185. EXPECT_TRUE(ssl_errors::IsHostnameNonUniqueOrDotless("go"));
  186. EXPECT_TRUE(ssl_errors::IsHostnameNonUniqueOrDotless("172.17.108.108"));
  187. EXPECT_TRUE(ssl_errors::IsHostnameNonUniqueOrDotless("foo.blah"));
  188. }
  189. TEST_F(SSLErrorClassificationTest, LevenshteinDistance) {
  190. EXPECT_EQ(0u, ssl_errors::GetLevenshteinDistance("banana", "banana"));
  191. EXPECT_EQ(2u, ssl_errors::GetLevenshteinDistance("ab", "ba"));
  192. EXPECT_EQ(2u, ssl_errors::GetLevenshteinDistance("ba", "ab"));
  193. EXPECT_EQ(2u, ssl_errors::GetLevenshteinDistance("ananas", "banana"));
  194. EXPECT_EQ(2u, ssl_errors::GetLevenshteinDistance("banana", "ananas"));
  195. EXPECT_EQ(2u, ssl_errors::GetLevenshteinDistance("unclear", "nuclear"));
  196. EXPECT_EQ(2u, ssl_errors::GetLevenshteinDistance("nuclear", "unclear"));
  197. EXPECT_EQ(3u, ssl_errors::GetLevenshteinDistance("chrome", "chromium"));
  198. EXPECT_EQ(3u, ssl_errors::GetLevenshteinDistance("chromium", "chrome"));
  199. EXPECT_EQ(4u, ssl_errors::GetLevenshteinDistance("", "abcd"));
  200. EXPECT_EQ(4u, ssl_errors::GetLevenshteinDistance("abcd", ""));
  201. EXPECT_EQ(4u, ssl_errors::GetLevenshteinDistance("xxx", "xxxxxxx"));
  202. EXPECT_EQ(4u, ssl_errors::GetLevenshteinDistance("xxxxxxx", "xxx"));
  203. EXPECT_EQ(7u, ssl_errors::GetLevenshteinDistance("yyy", "xxxxxxx"));
  204. EXPECT_EQ(7u, ssl_errors::GetLevenshteinDistance("xxxxxxx", "yyy"));
  205. }
  206. TEST_F(SSLErrorClassificationTest, GetClockState) {
  207. // This test aims to obtain all possible return values of
  208. // |GetClockState|.
  209. TestingPrefServiceSimple pref_service;
  210. network_time::NetworkTimeTracker::RegisterPrefs(pref_service.registry());
  211. network_time::NetworkTimeTracker network_time_tracker(
  212. std::make_unique<base::DefaultClock>(),
  213. std::make_unique<base::DefaultTickClock>(), &pref_service,
  214. base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
  215. &test_url_loader_factory_));
  216. ssl_errors::SetBuildTimeForTesting(base::Time::Now());
  217. EXPECT_EQ(
  218. ssl_errors::ClockState::CLOCK_STATE_UNKNOWN,
  219. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  220. ssl_errors::SetBuildTimeForTesting(base::Time::Now() - base::Days(367));
  221. EXPECT_EQ(
  222. ssl_errors::ClockState::CLOCK_STATE_FUTURE,
  223. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  224. ssl_errors::SetBuildTimeForTesting(base::Time::Now() + base::Days(3));
  225. EXPECT_EQ(
  226. ssl_errors::ClockState::CLOCK_STATE_PAST,
  227. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  228. // Intentionally leave the build time alone. It should be ignored
  229. // in favor of network time.
  230. network_time_tracker.UpdateNetworkTime(
  231. base::Time::Now() + base::Hours(1),
  232. base::Seconds(1), // resolution
  233. base::Milliseconds(250), // latency
  234. base::TimeTicks::Now()); // posting time
  235. EXPECT_EQ(
  236. ssl_errors::ClockState::CLOCK_STATE_PAST,
  237. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  238. network_time_tracker.UpdateNetworkTime(
  239. base::Time::Now() - base::Hours(1),
  240. base::Seconds(1), // resolution
  241. base::Milliseconds(250), // latency
  242. base::TimeTicks::Now()); // posting time
  243. EXPECT_EQ(
  244. ssl_errors::ClockState::CLOCK_STATE_FUTURE,
  245. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  246. network_time_tracker.UpdateNetworkTime(
  247. base::Time::Now(),
  248. base::Seconds(1), // resolution
  249. base::Milliseconds(250), // latency
  250. base::TimeTicks::Now()); // posting time
  251. EXPECT_EQ(
  252. ssl_errors::ClockState::CLOCK_STATE_OK,
  253. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  254. // Now clear the network time. The build time should reassert
  255. // itself.
  256. network_time_tracker.UpdateNetworkTime(
  257. base::Time(),
  258. base::Seconds(1), // resolution
  259. base::Milliseconds(250), // latency
  260. base::TimeTicks::Now()); // posting time
  261. ssl_errors::SetBuildTimeForTesting(base::Time::Now() + base::Days(3));
  262. EXPECT_EQ(
  263. ssl_errors::ClockState::CLOCK_STATE_PAST,
  264. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  265. // Now set the build time to something reasonable. We should be
  266. // back to the know-nothing state.
  267. ssl_errors::SetBuildTimeForTesting(base::Time::Now());
  268. EXPECT_EQ(
  269. ssl_errors::ClockState::CLOCK_STATE_UNKNOWN,
  270. ssl_errors::GetClockState(base::Time::Now(), &network_time_tracker));
  271. }