network_anonymization_key_unittest.cc 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333
  1. // Copyright 2022 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/base/network_anonymization_key.h"
  5. #include "base/test/scoped_feature_list.h"
  6. #include "base/unguessable_token.h"
  7. #include "base/values.h"
  8. #include "net/base/features.h"
  9. #include "net/base/schemeful_site.h"
  10. #include "testing/gtest/include/gtest/gtest.h"
  11. #include "third_party/abseil-cpp/absl/types/optional.h"
  12. #include "url/gurl.h"
  13. #include "url/url_util.h"
  14. namespace net {
  15. struct EnabledFeatureFlagsTestingParam {
  16. bool enableDoubleKeyNetworkAnonymizationKeyEnabled;
  17. bool enableCrossSiteFlagNetworkAnonymizationKey;
  18. };
  19. const EnabledFeatureFlagsTestingParam kFlagsParam[] = {
  20. {/*enableDoubleKeyNetworkAnonymizationKeyEnabled=*/false,
  21. /*enableCrossSiteFlagNetworkAnonymizationKey=*/false},
  22. {/*enableDoubleKeyNetworkAnonymizationKeyEnabled=*/false,
  23. /*enableCrossSiteFlagNetworkAnonymizationKey=*/true},
  24. {/*enableDoubleKeyNetworkAnonymizationKeyEnabled=*/true,
  25. /*enableCrossSiteFlagNetworkAnonymizationKey=*/false},
  26. {/*enableDoubleKeyNetworkAnonymizationKeyEnabled=*/true,
  27. /*enableCrossSiteFlagNetworkAnonymizationKe=y*/ true},
  28. };
  29. class NetworkAnonymizationKeyTest
  30. : public testing::Test,
  31. public testing::WithParamInterface<EnabledFeatureFlagsTestingParam> {
  32. public:
  33. void SetUp() override {
  34. std::vector<base::Feature> enabled_features = {};
  35. std::vector<base::Feature> disabled_features = {};
  36. if (IsDoubleKeyEnabled()) {
  37. enabled_features.push_back(
  38. net::features::kEnableDoubleKeyNetworkAnonymizationKey);
  39. } else {
  40. disabled_features.push_back(
  41. net::features::kEnableDoubleKeyNetworkAnonymizationKey);
  42. }
  43. if (IsCrossSiteFlagEnabled()) {
  44. enabled_features.push_back(
  45. net::features::kEnableCrossSiteFlagNetworkAnonymizationKey);
  46. } else {
  47. disabled_features.push_back(
  48. net::features::kEnableCrossSiteFlagNetworkAnonymizationKey);
  49. }
  50. scoped_feature_list_.InitWithFeatures(enabled_features, disabled_features);
  51. }
  52. bool IsDoubleKeyEnabled() {
  53. return GetParam().enableDoubleKeyNetworkAnonymizationKeyEnabled;
  54. }
  55. bool IsCrossSiteFlagEnabled() {
  56. return GetParam().enableCrossSiteFlagNetworkAnonymizationKey;
  57. }
  58. protected:
  59. const SchemefulSite kTestSiteA = SchemefulSite(GURL("http://a.test/"));
  60. const SchemefulSite kTestSiteB = SchemefulSite(GURL("http://b.test/"));
  61. const SchemefulSite kDataSite = SchemefulSite(GURL("data:foo"));
  62. const base::UnguessableToken kNonce = base::UnguessableToken::Create();
  63. private:
  64. base::test::ScopedFeatureList scoped_feature_list_;
  65. };
  66. INSTANTIATE_TEST_SUITE_P(
  67. All,
  68. NetworkAnonymizationKeyTest,
  69. /*kEnableDoubleKeyNetworkAnonymizationKey*/ testing::ValuesIn(kFlagsParam));
  70. TEST_P(NetworkAnonymizationKeyTest, IsDoubleKeyingEnabled) {
  71. if (IsDoubleKeyEnabled() || IsCrossSiteFlagEnabled()) {
  72. EXPECT_FALSE(NetworkAnonymizationKey::IsFrameSiteEnabled());
  73. } else {
  74. EXPECT_TRUE(NetworkAnonymizationKey::IsFrameSiteEnabled());
  75. }
  76. }
  77. TEST_P(NetworkAnonymizationKeyTest, IsDoubleKeySchemeEnabled) {
  78. // Double key scheme is enabled only when
  79. // `kEnableDoubleKeyNetworkAnonymizationKeyEnabled` is enabled but
  80. // `kEnableCrossSiteFlagNetworkAnonymizationKey` is not.
  81. if (IsDoubleKeyEnabled() && !IsCrossSiteFlagEnabled()) {
  82. EXPECT_TRUE(NetworkAnonymizationKey::IsDoubleKeySchemeEnabled());
  83. } else {
  84. EXPECT_FALSE(NetworkAnonymizationKey::IsDoubleKeySchemeEnabled());
  85. }
  86. }
  87. TEST_P(NetworkAnonymizationKeyTest, IsCrossSiteFlagSchemeEnabled) {
  88. // Double key with cross site flag scheme is enabled whenever
  89. // `kEnableCrossSiteFlagNetworkAnonymizationKey` is enabled
  90. // regardless of the value of
  91. // `kEnableDoubleKeyNetworkAnonymizationKeyEnabled`.
  92. if (IsCrossSiteFlagEnabled()) {
  93. EXPECT_TRUE(NetworkAnonymizationKey::IsCrossSiteFlagSchemeEnabled());
  94. } else {
  95. EXPECT_FALSE(NetworkAnonymizationKey::IsCrossSiteFlagSchemeEnabled());
  96. }
  97. }
  98. TEST_P(NetworkAnonymizationKeyTest, IsEmpty) {
  99. NetworkAnonymizationKey empty_key;
  100. NetworkAnonymizationKey populated_key(/*top_frame_site=*/kTestSiteA,
  101. /*frame_site=*/kTestSiteB,
  102. /*is_cross_site=*/false,
  103. /*nonce=*/absl::nullopt);
  104. EXPECT_TRUE(empty_key.IsEmpty());
  105. EXPECT_FALSE(populated_key.IsEmpty());
  106. }
  107. TEST_P(NetworkAnonymizationKeyTest, IsTransient) {
  108. NetworkAnonymizationKey empty_key;
  109. NetworkAnonymizationKey populated_key(/*top_frame_site=*/kTestSiteA,
  110. /*frame_site=*/kTestSiteB,
  111. /*is_cross_site=*/false,
  112. /*nonce=*/absl::nullopt);
  113. NetworkAnonymizationKey data_top_frame_key(/*top_frame_site=*/kDataSite,
  114. /*frame_site=*/kTestSiteB,
  115. /*is_cross_site=*/false,
  116. /*nonce=*/absl::nullopt);
  117. NetworkAnonymizationKey populated_key_with_nonce(
  118. /*top_frame_site=*/kTestSiteA, /*frame_site=*/kTestSiteB,
  119. /*is_cross_site*/ false, base::UnguessableToken::Create());
  120. NetworkAnonymizationKey data_frame_key(/*top_frame_site=*/kTestSiteA,
  121. /*frame_site=*/kDataSite,
  122. /*is_cross_site=*/false,
  123. /*nonce=*/absl::nullopt);
  124. NetworkAnonymizationKey populated_double_key(/*top_frame_site=*/kTestSiteA,
  125. /*frame_site=*/absl::nullopt,
  126. /*is_cross_site=*/false,
  127. /*nonce=*/absl::nullopt);
  128. EXPECT_TRUE(empty_key.IsTransient());
  129. EXPECT_FALSE(populated_key.IsTransient());
  130. EXPECT_TRUE(data_top_frame_key.IsTransient());
  131. EXPECT_TRUE(data_top_frame_key.IsTransient());
  132. EXPECT_TRUE(populated_key_with_nonce.IsTransient());
  133. if (IsDoubleKeyEnabled() || IsCrossSiteFlagEnabled()) {
  134. EXPECT_FALSE(data_frame_key.IsTransient());
  135. EXPECT_FALSE(populated_double_key.IsTransient());
  136. } else {
  137. EXPECT_TRUE(data_frame_key.IsTransient());
  138. EXPECT_TRUE(populated_double_key.IsTransient());
  139. }
  140. }
  141. TEST_P(NetworkAnonymizationKeyTest, IsFullyPopulated) {
  142. NetworkAnonymizationKey empty_key;
  143. NetworkAnonymizationKey populated_key(/*top_frame_site=*/kTestSiteA,
  144. /*frame_site=*/kTestSiteB,
  145. /*is_cross_site=*/false,
  146. /*nonce=*/absl::nullopt);
  147. NetworkAnonymizationKey empty_frame_site_key(/*top_frame_site=*/kTestSiteA,
  148. /*frame_site=*/absl::nullopt,
  149. /*is_cross_site=*/false,
  150. /*nonce=*/absl::nullopt);
  151. NetworkAnonymizationKey empty_cross_site_flag_key(
  152. /*top_frame_site=*/kTestSiteA,
  153. /*frame_site=*/kTestSiteB,
  154. /*is_cross_site=*/absl::nullopt,
  155. /*nonce=*/absl::nullopt);
  156. EXPECT_TRUE(populated_key.IsFullyPopulated());
  157. EXPECT_FALSE(empty_key.IsFullyPopulated());
  158. if (IsDoubleKeyEnabled() || IsCrossSiteFlagEnabled()) {
  159. EXPECT_TRUE(empty_frame_site_key.IsFullyPopulated());
  160. } else {
  161. EXPECT_FALSE(empty_frame_site_key.IsFullyPopulated());
  162. }
  163. // is_cross_site is required when
  164. // `kEnableCrossSiteFlagNetworkAnonymizationKey` is enabled.
  165. if (IsCrossSiteFlagEnabled()) {
  166. EXPECT_FALSE(empty_cross_site_flag_key.IsFullyPopulated());
  167. } else {
  168. EXPECT_TRUE(empty_cross_site_flag_key.IsFullyPopulated());
  169. }
  170. }
  171. TEST_P(NetworkAnonymizationKeyTest, Getters) {
  172. NetworkAnonymizationKey key(/*top_frame_site=*/kTestSiteA,
  173. /*frame_site=*/kTestSiteB,
  174. /*is_cross_site=*/true, kNonce);
  175. EXPECT_EQ(key.GetTopFrameSite(), kTestSiteA);
  176. EXPECT_EQ(key.GetNonce(), kNonce);
  177. // frame_site should be empty if any double key scheme is enabled. This
  178. // includes when `kEnableCrossSiteFlagNetworkAnonymizationKey` or
  179. // `kEnableDoubleKeyNetworkAnonymizationKey` are enabled.
  180. if (IsDoubleKeyEnabled() || IsCrossSiteFlagEnabled()) {
  181. EXPECT_EQ(key.GetFrameSite(), absl::nullopt);
  182. } else {
  183. EXPECT_EQ(key.GetFrameSite(), kTestSiteB);
  184. }
  185. // is_cross_site should only be true when
  186. // `kEnableCrossSiteFlagNetworkAnonymizationKey` is enabled.
  187. if (IsCrossSiteFlagEnabled()) {
  188. EXPECT_TRUE(key.GetIsCrossSite());
  189. } else {
  190. EXPECT_DEATH_IF_SUPPORTED(key.GetIsCrossSite(), "");
  191. }
  192. }
  193. TEST_P(NetworkAnonymizationKeyTest, ToDebugString) {
  194. NetworkAnonymizationKey key(/*top_frame_site=*/kTestSiteA,
  195. /*frame_site=*/kTestSiteB,
  196. /*is_cross_site=*/true, kNonce);
  197. NetworkAnonymizationKey empty_key;
  198. if (IsDoubleKeyEnabled() && !IsCrossSiteFlagEnabled()) {
  199. // When double key scheme is enabled, the `is_cross_site` flag is always
  200. // forced to false.
  201. std::string double_key_expected_string_value = kTestSiteA.GetDebugString() +
  202. " null" + " (with nonce " +
  203. kNonce.ToString() + ")";
  204. EXPECT_EQ(key.ToDebugString(), double_key_expected_string_value);
  205. EXPECT_EQ(empty_key.ToDebugString(), "null null");
  206. } else if (IsCrossSiteFlagEnabled()) {
  207. // When double key + cross site flag scheme is enabled frame site is null,
  208. // but `is_cross_site` holds the value the key is created with.
  209. std::string double_key_with_cross_site_flag_expected_string_value =
  210. kTestSiteA.GetDebugString() + " null" + " cross_site (with nonce " +
  211. kNonce.ToString() + ")";
  212. EXPECT_EQ(key.ToDebugString(),
  213. double_key_with_cross_site_flag_expected_string_value);
  214. // is_cross_site_ must be populated if
  215. // `kEnableCrossSiteFlagNetworkAnonymizationKey` is enabled.
  216. EXPECT_DEATH_IF_SUPPORTED(empty_key.ToDebugString(), "");
  217. } else {
  218. // When neither `kEnableDoubleKeyNetworkAnonymizationKey` or
  219. // `kEnableCrossSiteFlagNetworkAnonymizationKey` is enabled,
  220. // the NAK is a triple key and the `is_cross_site` flag is always forced
  221. // to false.
  222. std::string key_expected_string_value =
  223. kTestSiteA.GetDebugString() + " " + kTestSiteB.GetDebugString() +
  224. " (with nonce " + kNonce.ToString() + ")";
  225. EXPECT_EQ(key.ToDebugString(), key_expected_string_value);
  226. EXPECT_EQ(empty_key.ToDebugString(), "null null");
  227. }
  228. }
  229. TEST_P(NetworkAnonymizationKeyTest, Equality) {
  230. NetworkAnonymizationKey key(/*top_frame_site=*/kTestSiteA,
  231. /*frame_site=*/kTestSiteB,
  232. /*is_cross_site=*/false, kNonce);
  233. NetworkAnonymizationKey key_duplicate(/*top_frame_site=*/kTestSiteA,
  234. /*frame_site=*/kTestSiteB,
  235. /*is_cross_site=*/false, kNonce);
  236. EXPECT_TRUE(key == key_duplicate);
  237. EXPECT_FALSE(key != key_duplicate);
  238. EXPECT_FALSE(key < key_duplicate);
  239. NetworkAnonymizationKey key_cross_site(/*top_frame_site=*/kTestSiteA,
  240. /*frame_site=*/kTestSiteB,
  241. /*is_cross_site=*/true, kNonce);
  242. // The `is_cross_site` flag only changes the NAK when
  243. // `kEnableCrossSiteFlagNetworkAnonymizationKey` is enabled.
  244. if (IsCrossSiteFlagEnabled()) {
  245. EXPECT_FALSE(key == key_cross_site);
  246. EXPECT_TRUE(key != key_cross_site);
  247. EXPECT_TRUE(key < key_cross_site);
  248. } else {
  249. EXPECT_TRUE(key == key_cross_site);
  250. EXPECT_FALSE(key != key_cross_site);
  251. EXPECT_FALSE(key < key_cross_site);
  252. }
  253. NetworkAnonymizationKey key_no_nonce(/*top_frame_site=*/kTestSiteA,
  254. /*frame_site=*/kTestSiteB,
  255. /*is_cross_site=*/false,
  256. /*nonce=*/absl::nullopt);
  257. EXPECT_FALSE(key == key_no_nonce);
  258. EXPECT_TRUE(key != key_no_nonce);
  259. EXPECT_FALSE(key < key_no_nonce);
  260. NetworkAnonymizationKey key_different_nonce(
  261. /*top_frame_site=*/kTestSiteA,
  262. /*frame_site=*/kTestSiteB,
  263. /*is_cross_site=*/false,
  264. /*nonce=*/base::UnguessableToken::Create());
  265. EXPECT_FALSE(key == key_different_nonce);
  266. EXPECT_TRUE(key != key_different_nonce);
  267. NetworkAnonymizationKey key_different_frame_site(
  268. /*top_frame_site=*/kTestSiteA, /*frame_site=*/kTestSiteA,
  269. /*is_cross_site=*/false, kNonce);
  270. if (IsDoubleKeyEnabled() || IsCrossSiteFlagEnabled()) {
  271. EXPECT_TRUE(key == key_different_frame_site);
  272. EXPECT_FALSE(key != key_different_frame_site);
  273. } else {
  274. EXPECT_FALSE(key == key_different_frame_site);
  275. EXPECT_TRUE(key != key_different_frame_site);
  276. }
  277. EXPECT_FALSE(key < key_different_frame_site);
  278. NetworkAnonymizationKey key_different_top_level_site(
  279. /*top_frame_site=*/kTestSiteB, /*frame_site=*/kTestSiteB,
  280. /*is_cross_site=*/false, kNonce);
  281. EXPECT_FALSE(key == key_different_top_level_site);
  282. EXPECT_TRUE(key != key_different_top_level_site);
  283. EXPECT_TRUE(key < key_different_top_level_site);
  284. NetworkAnonymizationKey empty_key;
  285. NetworkAnonymizationKey empty_key_duplicate;
  286. EXPECT_TRUE(empty_key == empty_key_duplicate);
  287. EXPECT_FALSE(empty_key != empty_key_duplicate);
  288. EXPECT_FALSE(empty_key < empty_key_duplicate);
  289. EXPECT_FALSE(empty_key == key);
  290. EXPECT_TRUE(empty_key != key);
  291. EXPECT_TRUE(empty_key < key);
  292. }
  293. } // namespace net