diff --git a/build/patches/00Internal-firewall.patch b/build/patches/00Internal-firewall.patch index 03f9fa0b..a12bda67 100644 --- a/build/patches/00Internal-firewall.patch +++ b/build/patches/00Internal-firewall.patch @@ -27,14 +27,15 @@ in services/firewall/tools/rules.xml services/firewall/tools/codegen.py | 82 ++++ services/firewall/tools/decode_template.py | 85 ++++ services/firewall/tools/gen_builders.py | 65 +++ - services/firewall/tools/rules.xml | 78 +++ + services/firewall/tools/rules.xml | 81 ++++ services/firewall/tools/rules_model.py | 35 ++ + services/network/network_context.cc | 73 +++ .../network/public/cpp/simple_url_loader.cc | 18 + .../network/public/cpp/simple_url_loader.h | 3 + .../loader/fetch/url_loader/url_loader.cc | 145 +++++- .../scripts/auditor/auditor.py | 1 + .../scripts/auditor/util.py | 1 + - 27 files changed, 1424 insertions(+), 16 deletions(-) + 28 files changed, 1500 insertions(+), 16 deletions(-) create mode 100644 services/firewall/public/BUILD.gn create mode 100644 services/firewall/public/firewall_features.cc create mode 100644 services/firewall/public/firewall_features.h @@ -71,7 +72,7 @@ diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc #include "services/media_session/public/cpp/features.h" #include "services/network/public/cpp/features.h" #include "services/network/public/cpp/network_switches.h" -@@ -7858,6 +7859,11 @@ const FeatureEntry kFeatureEntries[] = { +@@ -7854,6 +7855,11 @@ const FeatureEntry kFeatureEntries[] = { FEATURE_VALUE_TYPE(page_info::kPageInfoHideSiteSettings)}, #endif // !BUILDFLAG(IS_ANDROID) @@ -683,9 +684,8 @@ new file mode 100644 + + + -+ ++ + -+ + + + @@ -699,12 +699,12 @@ new file mode 100644 + + + -+ ++ + + + + -+ ++ + + + @@ -716,7 +716,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -727,7 +727,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -770,19 +770,16 @@ new file mode 100644 + + + -+ + + + + + + -+ + + + + -+ + + + @@ -809,11 +806,8 @@ new file mode 100644 + + + -+ ++ + -+ -+ -+ + + + @@ -830,7 +824,6 @@ new file mode 100644 + + + -+ + + + @@ -846,7 +839,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -864,9 +857,9 @@ new file mode 100644 + + + -+ ++ + -+ ++ + + + @@ -886,7 +879,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -894,7 +887,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -903,7 +896,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -933,7 +926,6 @@ new file mode 100644 + + + -+ + + + @@ -942,16 +934,16 @@ new file mode 100644 + + + ++ + + + + + -+ -+ -+ -+ -+ ++ ++ ++ ++ + + + @@ -973,7 +965,6 @@ new file mode 100644 + + + -+ + + + @@ -982,8 +973,7 @@ new file mode 100644 + + + -+ -+ ++ + + + @@ -991,25 +981,22 @@ new file mode 100644 + + + -+ + + + + -+ -+ -+ ++ ++ ++ + -+ + + + + + + -+ + -+ ++ + + + @@ -1024,8 +1011,10 @@ new file mode 100644 + + + -+ -+ ++ ++ ++ ++ + + + @@ -1033,10 +1022,9 @@ new file mode 100644 + + + -+ + + -+ ++ + + + @@ -1054,21 +1042,34 @@ new file mode 100644 + + + -+ ++ + + -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ + diff --git a/services/firewall/tools/builders_template.py b/services/firewall/tools/builders_template.py new file mode 100644 @@ -1398,7 +1399,7 @@ diff --git a/services/firewall/tools/rules.xml b/services/firewall/tools/rules.x new file mode 100644 --- /dev/null +++ b/services/firewall/tools/rules.xml -@@ -0,0 +1,78 @@ +@@ -0,0 +1,81 @@ + + + + ++ ++ ++ + + + @@ -1517,6 +1521,131 @@ new file mode 100644 + ]) + +RULES_XML_TYPE = models.DocumentType(_RULES_CONFIGURATION_TYPE) +diff --git a/services/network/network_context.cc b/services/network/network_context.cc +--- a/services/network/network_context.cc ++++ b/services/network/network_context.cc +@@ -86,6 +86,7 @@ + #include "net/url_request/url_request.h" + #include "net/url_request/url_request_context.h" + #include "net/url_request/url_request_context_builder.h" ++#include "services/firewall/public/firewall_service.h" + #include "services/network/brokered_client_socket_factory.h" + #include "services/network/cookie_manager.h" + #include "services/network/cors/cors_url_loader_factory.h" +@@ -1525,6 +1526,9 @@ void NetworkContext::OnNewSCTAuditingReportSent() { + void NetworkContext::CreateUDPSocket( + mojo::PendingReceiver receiver, + mojo::PendingRemote listener) { ++ if (base::FeatureList::IsEnabled(firewall::features::kEnableFirewall)) { ++ LOG(INFO) << "---LOGGING CreateUDPSocket"; ++ } + socket_factory_->CreateUDPSocket(std::move(receiver), std::move(listener)); + } + +@@ -1537,6 +1541,17 @@ void NetworkContext::CreateRestrictedUDPSocket( + mojo::PendingRemote listener, + CreateRestrictedUDPSocketCallback callback) { + // SimpleHostResolver is transitively owned by |this|. ++ if (base::FeatureList::IsEnabled(firewall::features::kEnableFirewall)) { ++ auto firewall_service = std::make_unique(nullptr); ++ //if (firewall_service->IsAllowed(traffic_annotation.unique_id_hash_code)) { ++ auto entry = firewall_service->GetEntry(traffic_annotation.unique_id_hash_code); ++ LOG(INFO) << "---LOGGING CreateRestrictedUDPSocket: " ++ << (entry.has_value() ? entry->name : "no-name") ++ << "(" << traffic_annotation.unique_id_hash_code << ")" ++ << " addr: " << addr.ToString() ++ << " path: " << (entry.has_value() ? entry->path : "no-path"); ++ //} ++ } + socket_factory_->CreateRestrictedUDPSocket( + addr, mode, traffic_annotation, std::move(params), std::move(receiver), + std::move(listener), SimpleHostResolver::Create(this), +@@ -1549,6 +1564,17 @@ void NetworkContext::CreateTCPServerSocket( + const net::MutableNetworkTrafficAnnotationTag& traffic_annotation, + mojo::PendingReceiver receiver, + CreateTCPServerSocketCallback callback) { ++ if (base::FeatureList::IsEnabled(firewall::features::kEnableFirewall)) { ++ auto firewall_service = std::make_unique(nullptr); ++ //if (firewall_service->IsAllowed(traffic_annotation.unique_id_hash_code)) { ++ auto entry = firewall_service->GetEntry(traffic_annotation.unique_id_hash_code); ++ LOG(INFO) << "---LOGGING CreateTCPServerSocket: " ++ << (entry.has_value() ? entry->name : "no-name") ++ << "(" << traffic_annotation.unique_id_hash_code << ")" ++ << " local_addr: " << local_addr.ToString() ++ << " path: " << (entry.has_value() ? entry->path : "no-path"); ++ //} ++ } + socket_factory_->CreateTCPServerSocket( + local_addr, std::move(options), + static_cast(traffic_annotation), +@@ -1563,6 +1589,21 @@ void NetworkContext::CreateTCPConnectedSocket( + mojo::PendingReceiver receiver, + mojo::PendingRemote observer, + CreateTCPConnectedSocketCallback callback) { ++ if (base::FeatureList::IsEnabled(firewall::features::kEnableFirewall)) { ++ auto firewall_service = std::make_unique(nullptr); ++ //if (firewall_service->IsAllowed(traffic_annotation.unique_id_hash_code)) { ++ auto entry = firewall_service->GetEntry(traffic_annotation.unique_id_hash_code); ++ LOG(INFO) << "---LOGGING CreateTCPConnectedSocket: " ++ << (entry.has_value() ? entry->name : "no-name") ++ << "(" << traffic_annotation.unique_id_hash_code << ")" ++ << " addr: " << remote_addr_list.front().ToString() ++ << " path: " << (entry.has_value() ? entry->path : "no-path"); ++ // std::move(callback) ++ // .Run(net::ERR_FAILED, absl::nullopt, absl::nullopt, ++ // mojo::ScopedDataPipeConsumerHandle(), ++ // mojo::ScopedDataPipeProducerHandle()); ++ //} ++ } + socket_factory_->CreateTCPConnectedSocket( + local_addr, remote_addr_list, std::move(tcp_connected_socket_options), + static_cast(traffic_annotation), +@@ -1574,6 +1615,20 @@ void NetworkContext::CreateTCPBoundSocket( + const net::MutableNetworkTrafficAnnotationTag& traffic_annotation, + mojo::PendingReceiver receiver, + CreateTCPBoundSocketCallback callback) { ++ if (base::FeatureList::IsEnabled(firewall::features::kEnableFirewall)) { ++ auto firewall_service = std::make_unique(nullptr); ++ //if (firewall_service->IsAllowed(traffic_annotation.unique_id_hash_code)) { ++ auto entry = firewall_service->GetEntry(traffic_annotation.unique_id_hash_code); ++ LOG(INFO) << "---LOGGING CreateTCPBoundSocket: " ++ << (entry.has_value() ? entry->name : "no-name") ++ << "(" << traffic_annotation.unique_id_hash_code << ")" ++ << " path: " << (entry.has_value() ? entry->path : "no-path"); ++ // std::move(callback) ++ // .Run(net::ERR_FAILED, absl::nullopt, absl::nullopt, ++ // mojo::ScopedDataPipeConsumerHandle(), ++ // mojo::ScopedDataPipeProducerHandle()); ++ //} ++ } + socket_factory_->CreateTCPBoundSocket( + local_addr, + static_cast(traffic_annotation), +@@ -1639,6 +1694,24 @@ void NetworkContext::CreateWebSocket( + mojo::PendingRemote auth_handler, + mojo::PendingRemote header_client, + const absl::optional& throttling_profile_id) { ++ if (base::FeatureList::IsEnabled(firewall::features::kEnableFirewall)) { ++ auto firewall_service = std::make_unique(nullptr); ++ if (!firewall_service->IsAllowed(traffic_annotation.unique_id_hash_code)) { ++ auto entry = firewall_service->GetEntry(traffic_annotation.unique_id_hash_code); ++ LOG(INFO) << "---ABORTED CreateWebSocket: " ++ << (entry.has_value() ? entry->name : "no-name") ++ << "(" << traffic_annotation.unique_id_hash_code << ")" ++ << " url " << url ++ << " path: " << (entry.has_value() ? entry->path : "no-path"); ++ ++ mojo::Remote handshake_client_remote( ++ std::move(handshake_client)); ++ handshake_client_remote->OnFailure("Insufficient resources", ++ net::ERR_INSUFFICIENT_RESOURCES, -1); ++ handshake_client_remote.reset(); ++ return; ++ } ++ } + #if !BUILDFLAG(IS_IOS) + if (!websocket_factory_) + websocket_factory_ = std::make_unique(this); diff --git a/services/network/public/cpp/simple_url_loader.cc b/services/network/public/cpp/simple_url_loader.cc --- a/services/network/public/cpp/simple_url_loader.cc +++ b/services/network/public/cpp/simple_url_loader.cc