diff --git a/build/patches/Internal-firewall.patch b/build/patches/Internal-firewall.patch
index 3b94ebac..24dd4df3 100644
--- a/build/patches/Internal-firewall.patch
+++ b/build/patches/Internal-firewall.patch
@@ -20,26 +20,26 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
net/url_request/url_request_http_job.cc | 15 +
net/url_request/url_request_http_job.h | 3 +
services/firewall/public/BUILD.gn | 70 +++
- services/firewall/public/firewall_features.cc | 28 ++
+ services/firewall/public/firewall_features.cc | 28 +
services/firewall/public/firewall_features.h | 31 ++
services/firewall/public/firewall_service.cc | 46 ++
- services/firewall/public/firewall_service.h | 57 +++
+ services/firewall/public/firewall_service.h | 57 ++
services/firewall/tools/annotation_model.py | 49 ++
- services/firewall/tools/annotations.xml | 466 ++++++++++++++++++
+ services/firewall/tools/annotations.xml | 489 ++++++++++++++++++
services/firewall/tools/builders_template.py | 72 +++
services/firewall/tools/codegen.py | 82 +++
- services/firewall/tools/decode_template.py | 85 ++++
+ services/firewall/tools/decode_template.py | 85 +++
services/firewall/tools/gen_builders.py | 65 +++
- services/firewall/tools/rules.xml | 87 ++++
+ services/firewall/tools/rules.xml | 92 ++++
services/firewall/tools/rules_model.py | 35 ++
services/network/network_context.cc | 73 +++
.../network/public/cpp/simple_url_loader.cc | 18 +
.../network/public/cpp/simple_url_loader.h | 3 +
- .../platform/loader/fetch/fetch_utils.cc | 195 +++++++-
+ .../platform/loader/fetch/fetch_utils.cc | 216 +++++++-
.../loader/fetch/url_loader/url_loader.cc | 4 +-
.../scripts/auditor/auditor.py | 1 +
.../scripts/auditor/util.py | 1 +
- 30 files changed, 1575 insertions(+), 22 deletions(-)
+ 30 files changed, 1624 insertions(+), 22 deletions(-)
create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Internal-firewall.inc
create mode 100644 services/firewall/public/BUILD.gn
create mode 100644 services/firewall/public/firewall_features.cc
@@ -628,7 +628,7 @@ diff --git a/services/firewall/tools/annotations.xml b/services/firewall/tools/a
new file mode 100644
--- /dev/null
+++ b/services/firewall/tools/annotations.xml
-@@ -0,0 +1,466 @@
+@@ -0,0 +1,489 @@
+
+
+
+
+
+
-+
++
+
+
+
@@ -663,8 +664,8 @@ new file mode 100644
+
+
+
-+
-+
++
++
+
+
+
@@ -679,7 +680,6 @@ new file mode 100644
+
+
+
-+
+
+
+
@@ -688,7 +688,7 @@ new file mode 100644
+
+
+
-+
++
+
+
+
@@ -696,9 +696,9 @@ new file mode 100644
+
+
+
-+
++
+
-+
++
+
+
+
@@ -709,7 +709,6 @@ new file mode 100644
+
+
+
-+
+
+
+
@@ -719,7 +718,7 @@ new file mode 100644
+
+
+
-+
++
+
+
+
@@ -763,13 +762,12 @@ new file mode 100644
+
+
+
-+
+
+
+
+
-+
-+
++
++
+
+
+
@@ -798,16 +796,14 @@ new file mode 100644
+
+
+
-+
++
+
-+
-+
+
+
+
+
+
-+
++
+
+
+
@@ -840,7 +836,7 @@ new file mode 100644
+
+
+
-+
++
+
+
+
@@ -926,7 +922,7 @@ new file mode 100644
+
+
+
-+
++
+
+
+
@@ -935,9 +931,7 @@ new file mode 100644
+
+
+
-+
+
-+
+
+
+
@@ -961,7 +955,6 @@ new file mode 100644
+
+
+
-+
+
+
+
@@ -971,7 +964,7 @@ new file mode 100644
+
+
+
-+
++
+
+
+
@@ -979,7 +972,6 @@ new file mode 100644
+
+
+
-+
+
+
+
@@ -987,10 +979,8 @@ new file mode 100644
+
+
+
-+
+
+
-+
+
+
+
@@ -1010,8 +1000,8 @@ new file mode 100644
+
+
+
-+
-+
++
++
+
+
+
@@ -1027,7 +1017,6 @@ new file mode 100644
+
+
+
-+
+
+
+
@@ -1043,57 +1032,91 @@ new file mode 100644
+
+
+
-+
++
+
-+
++
+
+
+
-+
+
+
+
+
+
+
-+
-+
++
++
+
+
+
+
-+
+
+
-+
-+
-+
++
++
++
+
+
+
-+
+
+
+
-+
++
+
+
-+
-+
-+
-+
-+
-+
-+
-+
-+
-+
-+
-+
-+
-+
-+
-+
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
++
+
diff --git a/services/firewall/tools/builders_template.py b/services/firewall/tools/builders_template.py
new file mode 100644
@@ -1423,7 +1446,7 @@ diff --git a/services/firewall/tools/rules.xml b/services/firewall/tools/rules.x
new file mode 100644
--- /dev/null
+++ b/services/firewall/tools/rules.xml
-@@ -0,0 +1,87 @@
+@@ -0,0 +1,92 @@
+
+
+
+
++
++
++
+
+
+
-+
+
++
++
++
+
+
+
@@ -1734,7 +1762,7 @@ diff --git a/services/network/public/cpp/simple_url_loader.h b/services/network/
diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc b/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc
--- a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc
-@@ -97,31 +97,200 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag(
+@@ -97,31 +97,221 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag(
case network::mojom::RequestDestination::kIframe:
case network::mojom::RequestDestination::kFrame:
case network::mojom::RequestDestination::kFencedframe:
@@ -1877,12 +1905,33 @@ diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc b/t
+ "Not implemented. Without these requests, Chrome will be unable "
+ "to load any webpage."
+ })");
++
++ case network::mojom::RequestDestination::kSpeculationRules:
++ return net::DefineNetworkTrafficAnnotation("blink_resource_speculation_rules", R"(
++ semantics {
++ sender: "Blink Resource Loader"
++ description:
++ "Blink-initiated request, which includes all resources for "
++ "normal page loads, chrome URLs, and downloads."
++ trigger:
++ "The user navigates to a URL or downloads a file. Also when a "
++ "webpage, ServiceWorker, or chrome:// uses any network communication."
++ data: "Anything the initiator wants to send."
++ destination: OTHER
++ }
++ policy {
++ cookies_allowed: YES
++ cookies_store: "user"
++ setting: "These requests cannot be disabled in settings."
++ policy_exception_justification:
++ "Not implemented. Without these requests, Chrome will be unable "
++ "to load any webpage."
++ })");
+
case network::mojom::RequestDestination::kEmpty:
case network::mojom::RequestDestination::kAudio:
- case network::mojom::RequestDestination::kAudioWorklet:
case network::mojom::RequestDestination::kFont:
-+ case network::mojom::RequestDestination::kSpeculationRules:
case network::mojom::RequestDestination::kImage:
- case network::mojom::RequestDestination::kJson:
- case network::mojom::RequestDestination::kManifest:
@@ -1947,7 +1996,7 @@ diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc b/t
semantics {
sender: "Blink Resource Loader"
description:
-@@ -145,7 +314,7 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag(
+@@ -145,7 +335,7 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag(
case network::mojom::RequestDestination::kEmbed:
case network::mojom::RequestDestination::kObject:
return net::DefineNetworkTrafficAnnotation(