From: uazo Date: Thu, 16 Mar 2023 14:17:22 +0000 Subject: Partition HSTS cache by NAK License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html --- .../browser/ssl/https_upgrades_interceptor.cc | 1 + .../webui/net_internals/net_internals_ui.cc | 14 ++- .../core/browser/hsts_query.cc | 1 + .../web_package/signed_exchange_handler.cc | 7 +- .../web_package/signed_exchange_handler.h | 4 + .../web_package/signed_exchange_loader.cc | 3 +- .../web_package/signed_exchange_loader.h | 2 + .../signed_exchange_prefetch_handler.cc | 2 +- .../signed_exchange_request_handler.cc | 1 + .../Partition-HSTS-cache-by-NAK.inc | 1 + net/http/transport_security_state.cc | 103 ++++++++++++------ net/http/transport_security_state.h | 39 ++++--- net/quic/crypto/proof_verifier_chromium.cc | 5 +- net/quic/quic_chromium_client_session.cc | 2 +- net/socket/ssl_client_socket_impl.cc | 5 +- net/spdy/spdy_session.cc | 11 +- net/spdy/spdy_session.h | 3 +- .../url_request_context_builder.cc | 14 --- net/url_request/url_request_http_job.cc | 5 +- services/network/network_context.cc | 37 ++++--- services/network/network_context.h | 15 ++- .../public/mojom/network_context.mojom | 10 +- 22 files changed, 181 insertions(+), 104 deletions(-) create mode 100644 cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc diff --git a/chrome/browser/ssl/https_upgrades_interceptor.cc b/chrome/browser/ssl/https_upgrades_interceptor.cc --- a/chrome/browser/ssl/https_upgrades_interceptor.cc +++ b/chrome/browser/ssl/https_upgrades_interceptor.cc @@ -415,6 +415,7 @@ void HttpsUpgradesInterceptor::MaybeCreateLoader( CHECK(tentative_resource_request.trusted_params); network_context->IsHSTSActiveForHost( + tentative_resource_request.trusted_params->isolation_info.network_anonymization_key(), tentative_resource_request.url.GetHost(), tentative_resource_request.trusted_params->isolation_info .IsOutermostMainFrameRequest(), diff --git a/chrome/browser/ui/webui/net_internals/net_internals_ui.cc b/chrome/browser/ui/webui/net_internals/net_internals_ui.cc --- a/chrome/browser/ui/webui/net_internals/net_internals_ui.cc +++ b/chrome/browser/ui/webui/net_internals/net_internals_ui.cc @@ -393,7 +393,10 @@ void NetInternalsMessageHandler::OnDomainSecurityPolicyDelete( // There cannot be a unicode entry in the HSTS set. return; } + url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple( + "https", *domain, 443); GetNetworkContext()->DeleteDynamicDataForHost( + net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(), *domain, base::BindOnce(&IgnoreBoolCallback)); } @@ -403,7 +406,10 @@ void NetInternalsMessageHandler::OnHSTSQuery(const base::ListValue& list) { DCHECK(callback_id && domain); AllowJavascript(); + url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple( + "https", *domain, 443); GetNetworkContext()->GetHSTSState( + net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(), *domain, base::BindOnce(&NetInternalsMessageHandler::ResolveCallbackWithResult, weak_factory_.GetWeakPtr(), *callback_id)); @@ -429,8 +435,12 @@ void NetInternalsMessageHandler::OnHSTSAdd(const base::ListValue& list) { const bool sts_include_subdomains = list[1].GetBool(); base::Time expiry = base::Time::Now() + base::Days(1000); - GetNetworkContext()->AddHSTS(*domain, expiry, sts_include_subdomains, - base::DoNothing()); + url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple( + "https", *domain, 443); + GetNetworkContext()->AddHSTS( + net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(), + *domain, expiry, sts_include_subdomains, + base::DoNothing()); } void NetInternalsMessageHandler::OnFlushSocketPools( diff --git a/components/password_manager/core/browser/hsts_query.cc b/components/password_manager/core/browser/hsts_query.cc --- a/components/password_manager/core/browser/hsts_query.cc +++ b/components/password_manager/core/browser/hsts_query.cc @@ -63,6 +63,7 @@ void PostHSTSQueryForHostAndNetworkContext( // privacy leaks. Since our use is internal to the browser we don't need to // worry about leaking state so we can set true for is_top_level_nav. network_context->IsHSTSActiveForHost( + net::IsolationInfo::CreateForInternalRequest(origin).network_anonymization_key(), origin.host(), /*is_top_level_nav=*/true, mojo::WrapCallbackWithDropHandler( base::BindOnce(&HSTSCallbackHelper::ReportResult, callback_helper), diff --git a/content/browser/web_package/signed_exchange_handler.cc b/content/browser/web_package/signed_exchange_handler.cc --- a/content/browser/web_package/signed_exchange_handler.cc +++ b/content/browser/web_package/signed_exchange_handler.cc @@ -94,6 +94,7 @@ using VerifyCallback = void VerifyCert(const scoped_refptr& certificate, const GURL& url, + const net::NetworkAnonymizationKey& network_anonymization_key, const std::string& ocsp_result, const std::string& sct_list, FrameTreeNodeId frame_tree_node_id, @@ -115,7 +116,7 @@ void VerifyCert(const scoped_refptr& certificate, } network_context->VerifyCertForSignedExchange( - certificate, net::HostPortPair::FromURL(url), ocsp_result, sct_list, + certificate, net::HostPortPair::FromURL(url), network_anonymization_key, ocsp_result, sct_list, std::move(wrapped_callback)); } @@ -177,6 +178,7 @@ SignedExchangeHandler::SignedExchangeHandler( std::unique_ptr body, ExchangeHeadersCallback headers_callback, std::unique_ptr cert_fetcher_factory, + const net::NetworkAnonymizationKey& network_anonymization_key, std::optional outer_request_isolation_info, int load_flags, const net::IPEndPoint& remote_endpoint, @@ -190,6 +192,7 @@ SignedExchangeHandler::SignedExchangeHandler( source_(std::move(body)), cert_fetcher_factory_(std::move(cert_fetcher_factory)), devtools_proxy_(std::move(devtools_proxy)), + network_anonymization_key_(network_anonymization_key), outer_request_isolation_info_(std::move(outer_request_isolation_info)), load_flags_(load_flags), remote_endpoint_(remote_endpoint), @@ -529,7 +532,7 @@ void SignedExchangeHandler::OnCertReceived( // property, or const std::string& stapled_ocsp_response = unverified_cert_chain_->ocsp(); - VerifyCert(certificate, url, stapled_ocsp_response, sct_list_from_cert_cbor, + VerifyCert(certificate, url, network_anonymization_key_, stapled_ocsp_response, sct_list_from_cert_cbor, frame_tree_node_id_, base::BindOnce(&SignedExchangeHandler::OnVerifyCert, weak_factory_.GetWeakPtr())); diff --git a/content/browser/web_package/signed_exchange_handler.h b/content/browser/web_package/signed_exchange_handler.h --- a/content/browser/web_package/signed_exchange_handler.h +++ b/content/browser/web_package/signed_exchange_handler.h @@ -104,6 +104,7 @@ class CONTENT_EXPORT SignedExchangeHandler { std::unique_ptr body, ExchangeHeadersCallback headers_callback, std::unique_ptr cert_fetcher_factory, + const net::NetworkAnonymizationKey& network_anonymization_key, std::optional outer_request_isolation_info, int load_flags, const net::IPEndPoint& remote_endpoint, @@ -193,6 +194,9 @@ class CONTENT_EXPORT SignedExchangeHandler { // `cert_fetcher_` borrows reference from `devtools_proxy_`, so it needs to be // declared last, so that it is destroyed first. std::unique_ptr cert_fetcher_; + + const net::NetworkAnonymizationKey network_anonymization_key_; + // `outer_request_isolation_info_` will be set unless this corresponds to a // prefetch request. std::optional outer_request_isolation_info_; diff --git a/content/browser/web_package/signed_exchange_loader.cc b/content/browser/web_package/signed_exchange_loader.cc --- a/content/browser/web_package/signed_exchange_loader.cc +++ b/content/browser/web_package/signed_exchange_loader.cc @@ -77,6 +77,7 @@ SignedExchangeLoader::SignedExchangeLoader( std::unique_ptr reporter, scoped_refptr url_loader_factory, URLLoaderThrottlesGetter url_loader_throttles_getter, + const net::NetworkAnonymizationKey& network_anonymization_key, FrameTreeNodeId frame_tree_node_id, const std::string& accept_langs, bool keep_entry_for_prefetch_cache) @@ -154,7 +155,7 @@ SignedExchangeLoader::SignedExchangeLoader( std::move(outer_response_body)), base::BindOnce(&SignedExchangeLoader::OnHTTPExchangeFound, weak_factory_.GetWeakPtr()), - std::move(cert_fetcher_factory), + std::move(cert_fetcher_factory), network_anonymization_key, keep_entry_for_prefetch_cache ? std::nullopt : std::make_optional(outer_request_.trusted_params->isolation_info), diff --git a/content/browser/web_package/signed_exchange_loader.h b/content/browser/web_package/signed_exchange_loader.h --- a/content/browser/web_package/signed_exchange_loader.h +++ b/content/browser/web_package/signed_exchange_loader.h @@ -32,6 +32,7 @@ class URLLoaderThrottle; } // namespace blink namespace net { +class NetworkAnonymizationKey; class SourceStream; } // namespace net @@ -74,6 +75,7 @@ class CONTENT_EXPORT SignedExchangeLoader final std::unique_ptr reporter, scoped_refptr url_loader_factory, URLLoaderThrottlesGetter url_loader_throttles_getter, + const net::NetworkAnonymizationKey& network_anonymization_key, FrameTreeNodeId frame_tree_node_id, const std::string& accept_langs, bool keep_entry_for_prefetch_cache); diff --git a/content/browser/web_package/signed_exchange_prefetch_handler.cc b/content/browser/web_package/signed_exchange_prefetch_handler.cc --- a/content/browser/web_package/signed_exchange_prefetch_handler.cc +++ b/content/browser/web_package/signed_exchange_prefetch_handler.cc @@ -56,7 +56,7 @@ SignedExchangePrefetchHandler::SignedExchangePrefetchHandler( network::mojom::kURLLoadOptionNone, false /* should_redirect_to_fallback */, std::move(devtools_proxy), std::move(reporter), std::move(url_loader_factory), - loader_throttles_getter, frame_tree_node_id, accept_langs, + loader_throttles_getter, network_anonymization_key, frame_tree_node_id, accept_langs, keep_entry_for_prefetch_cache); } diff --git a/content/browser/web_package/signed_exchange_request_handler.cc b/content/browser/web_package/signed_exchange_request_handler.cc --- a/content/browser/web_package/signed_exchange_request_handler.cc +++ b/content/browser/web_package/signed_exchange_request_handler.cc @@ -116,6 +116,7 @@ bool SignedExchangeRequestHandler::MaybeCreateLoaderForResponse( std::move(client), url_loader->Unbind(), url_loader_options_, true /* should_redirect_to_fallback */, std::move(devtools_proxy), std::move(reporter), url_loader_factory_, url_loader_throttles_getter_, + network_anonymization_key, frame_tree_node_id_, accept_langs_, false /* keep_entry_for_prefetch_cache */); diff --git a/cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc b/cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc @@ -0,0 +1 @@ +SET_CROMITE_FEATURE_DISABLED(kHstsTopLevelNavigationsOnly); diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc --- a/net/http/transport_security_state.cc +++ b/net/http/transport_security_state.cc @@ -78,7 +78,7 @@ bool HashesIntersect(const absl::flat_hash_set& a, // Converts |hostname| from dotted form ("www.google.com") to the form // used in DNS: "\x03www\x06google\x03com", lowercases that, and returns // the result. -std::vector CanonicalizeHost(std::string_view host) { +std::vector CanonicalizeHostWithoutNak(std::string_view host) { // We cannot perform the operations as detailed in the spec here as `host` // has already undergone IDN processing before it reached us. Thus, we // lowercase the input (probably redudnant since most input here has been @@ -99,6 +99,29 @@ std::vector CanonicalizeHost(std::string_view host) { return std::move(new_host).value(); } +std::vector CanonicalizeHost(const NetworkAnonymizationKey& nak, + std::string_view host) { + std::vector hostname = CanonicalizeHostWithoutNak(host); + if (hostname.empty()) { + return hostname; + } + + // esclude opaque or transient nak + if (nak.IsEmpty() || nak.IsTransient()) + return std::vector(); + + std::string lowered_host = base::ToLowerASCII( + nak.ToDebugString() + " " + std::string(host)); + std::vector vector = + std::vector(lowered_host.begin(), lowered_host.end()); + if (vector.size() > 254) + return std::vector(); + + vector.emplace(vector.begin(), vector.size()); + vector.emplace(vector.end(), 0); + return vector; +} + // PreloadResult is the result of resolving a specific name in the preloaded // data. struct PreloadResult { @@ -177,7 +200,7 @@ bool DecodeHSTSPreload(std::string_view search_hostname, PreloadResult* out) { // Ensure that |search_hostname| is a valid hostname before // processing. - if (CanonicalizeHost(search_hostname).empty()) { + if (CanonicalizeHostWithoutNak(search_hostname).empty()) { return false; } // Normalize any trailing '.' used for DNS suffix searches. @@ -236,18 +259,19 @@ TransportSecurityState::TransportSecurityState( // Both HSTS and HPKP cause fatal SSL errors, so return true if a // host has either. -bool TransportSecurityState::ShouldSSLErrorsBeFatal(std::string_view host) { +bool TransportSecurityState::ShouldSSLErrorsBeFatal(const NetworkAnonymizationKey& nak, std::string_view host) { STSState unused_sts; PKPState unused_pkp; - return GetSTSState(host, &unused_sts) || GetPKPState(host, &unused_pkp); + return GetSTSState(nak, host, &unused_sts) || GetPKPState(nak, host, &unused_pkp); } base::DictValue TransportSecurityState::NetLogUpgradeToSSLParam( + const NetworkAnonymizationKey& nak, std::string_view host) { STSState sts_state; base::DictValue dict; dict.Set("host", host); - dict.Set("get_sts_state_result", GetSTSState(host, &sts_state)); + dict.Set("get_sts_state_result", GetSTSState(nak, host, &sts_state)); dict.Set("should_upgrade_to_ssl", sts_state.ShouldUpgradeToSSL()); dict.Set("host_found_in_hsts_bypass_list", hsts_host_bypass_list_.find(host) != hsts_host_bypass_list_.end()); @@ -255,12 +279,13 @@ base::DictValue TransportSecurityState::NetLogUpgradeToSSLParam( } SSLUpgradeDecision TransportSecurityState::GetSSLUpgradeDecision( + const NetworkAnonymizationKey& nak, std::string_view host, bool is_top_level_nav, const NetLogWithSource& net_log) { net_log.AddEvent( NetLogEventType::TRANSPORT_SECURITY_STATE_SHOULD_UPGRADE_TO_SSL, - [&] { return NetLogUpgradeToSSLParam(host); }); + [&] { return NetLogUpgradeToSSLParam(nak, host); }); // Only top level navigations should be upgraded when // kHstsTopLevelNavigationsOnly is enabled. @@ -271,7 +296,7 @@ SSLUpgradeDecision TransportSecurityState::GetSSLUpgradeDecision( STSState sts_state; // Check the dynamic list first (removing the entry if expired). - if (GetDynamicSTSState(host, &sts_state)) { + if (GetDynamicSTSState(nak, host, &sts_state)) { // [*.]localhost hosts now ignore Strict-Transport-Security response // headers, but an entry may have been stored before this restriction // was introduced (crbug.com/41251622). @@ -296,29 +321,31 @@ SSLUpgradeDecision TransportSecurityState::GetSSLUpgradeDecision( } bool TransportSecurityState::ShouldUpgradeToSSL( + const NetworkAnonymizationKey& nak, std::string_view host, bool is_top_level_nav, const NetLogWithSource& net_log) { - return GetSSLUpgradeDecision(host, is_top_level_nav, net_log) != + return GetSSLUpgradeDecision(nak, host, is_top_level_nav, net_log) != SSLUpgradeDecision::kNoUpgrade; } TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPins( std::string_view host, bool is_issued_by_known_root, - const std::vector& public_key_hashes) { + const std::vector& public_key_hashes, + const NetworkAnonymizationKey& network_anonymization_key) { // Perform pin validation only if the server actually has public key pins. - if (!HasPublicKeyPins(host)) { + if (!HasPublicKeyPins(network_anonymization_key, host)) { return PKPStatus::OK; } return CheckPublicKeyPinsImpl(host, is_issued_by_known_root, - public_key_hashes); + public_key_hashes, network_anonymization_key); } -bool TransportSecurityState::HasPublicKeyPins(std::string_view host) { +bool TransportSecurityState::HasPublicKeyPins(const NetworkAnonymizationKey& nak, std::string_view host) { PKPState pkp_state; - return GetPKPState(host, &pkp_state) && pkp_state.HasPublicKeyPins(); + return GetPKPState(nak, host, &pkp_state) && pkp_state.HasPublicKeyPins(); } ct::CTRequirementsStatus TransportSecurityState::CheckCTRequirements( @@ -378,12 +405,13 @@ void TransportSecurityState::UpdatePinList( } void TransportSecurityState::AddHSTSInternal( + const NetworkAnonymizationKey& nak, std::string_view host, TransportSecurityState::STSState::UpgradeMode upgrade_mode, base::Time expiry, bool include_subdomains) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); - const std::vector canonicalized_host = CanonicalizeHost(host); + const std::vector canonicalized_host = CanonicalizeHost(nak, host); if (canonicalized_host.empty()) return; @@ -407,13 +435,14 @@ void TransportSecurityState::AddHSTSInternal( DirtyNotify(); } -void TransportSecurityState::AddHPKPInternal(std::string_view host, +void TransportSecurityState::AddHPKPInternal(const NetworkAnonymizationKey& nak, + std::string_view host, base::Time last_observed, base::Time expiry, bool include_subdomains, const HashValueVector& hashes) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); - const std::vector canonicalized_host = CanonicalizeHost(host); + const std::vector canonicalized_host = CanonicalizeHost(nak, host); if (canonicalized_host.empty()) return; @@ -461,10 +490,10 @@ TransportSecurityState::PKPStatus TransportSecurityState::CheckPins( return PKPStatus::VIOLATED; } -bool TransportSecurityState::DeleteDynamicDataForHost(std::string_view host) { +bool TransportSecurityState::DeleteDynamicDataForHost(const NetworkAnonymizationKey& nak, std::string_view host) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); - const std::vector canonicalized_host = CanonicalizeHost(host); + const std::vector canonicalized_host = CanonicalizeHost(nak, host); if (canonicalized_host.empty()) return false; @@ -541,7 +570,8 @@ void TransportSecurityState::DirtyNotify() { delegate_->StateIsDirty(this); } -bool TransportSecurityState::AddHSTSHeader(std::string_view host, +bool TransportSecurityState::AddHSTSHeader(const NetworkAnonymizationKey& nak, + std::string_view host, std::string_view value) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); @@ -560,23 +590,25 @@ bool TransportSecurityState::AddHSTSHeader(std::string_view host, upgrade_mode = STSState::MODE_FORCE_HTTPS; } - AddHSTSInternal(host, upgrade_mode, now + max_age, include_subdomains); + AddHSTSInternal(nak, host, upgrade_mode, now + max_age, include_subdomains); return true; } -void TransportSecurityState::AddHSTS(std::string_view host, +void TransportSecurityState::AddHSTS(const NetworkAnonymizationKey& nak, + std::string_view host, base::Time expiry, bool include_subdomains) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); - AddHSTSInternal(host, STSState::MODE_FORCE_HTTPS, expiry, include_subdomains); + AddHSTSInternal(nak, host, STSState::MODE_FORCE_HTTPS, expiry, include_subdomains); } -void TransportSecurityState::AddHPKP(std::string_view host, +void TransportSecurityState::AddHPKP(const NetworkAnonymizationKey& nak, + std::string_view host, base::Time expiry, bool include_subdomains, const HashValueVector& hashes) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); - AddHPKPInternal(host, base::Time::Now(), expiry, include_subdomains, hashes); + AddHPKPInternal(nak, host, base::Time::Now(), expiry, include_subdomains, hashes); } size_t TransportSecurityState::num_sts_entries() const { @@ -601,9 +633,10 @@ TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPinsImpl( std::string_view host, bool is_issued_by_known_root, - const std::vector& hashes) { + const std::vector& hashes, + const NetworkAnonymizationKey& network_anonymization_key) { PKPState pkp_state; - bool found_state = GetPKPState(host, &pkp_state); + bool found_state = GetPKPState(network_anonymization_key, host, &pkp_state); // HasPublicKeyPins should have returned true in order for this method to have // been called. @@ -642,7 +675,7 @@ bool TransportSecurityState::GetStaticPKPState(std::string_view host, } // Ensure that |host| is a valid hostname before processing. - if (CanonicalizeHost(host).empty()) { + if (CanonicalizeHostWithoutNak(host).empty()) { return false; } // Normalize any trailing '.' used for DNS suffix searches. @@ -725,21 +758,21 @@ bool TransportSecurityState::GetStaticPKPState(std::string_view host, } } -bool TransportSecurityState::GetSTSState(std::string_view host, +bool TransportSecurityState::GetSTSState(const NetworkAnonymizationKey& nak, std::string_view host, STSState* result) { - return GetDynamicSTSState(host, result) || GetStaticSTSState(host, result); + return GetDynamicSTSState(nak, host, result) || GetStaticSTSState(host, result); } -bool TransportSecurityState::GetPKPState(std::string_view host, +bool TransportSecurityState::GetPKPState(const NetworkAnonymizationKey& nak, std::string_view host, PKPState* result) { - return GetDynamicPKPState(host, result) || GetStaticPKPState(host, result); + return GetDynamicPKPState(nak, host, result) || GetStaticPKPState(host, result); } -bool TransportSecurityState::GetDynamicSTSState(std::string_view host, +bool TransportSecurityState::GetDynamicSTSState(const NetworkAnonymizationKey& nak, std::string_view host, STSState* result) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); - const std::vector canonicalized_host = CanonicalizeHost(host); + const std::vector canonicalized_host = CanonicalizeHost(nak, host); if (canonicalized_host.empty()) return false; @@ -776,11 +809,11 @@ bool TransportSecurityState::GetDynamicSTSState(std::string_view host, return false; } -bool TransportSecurityState::GetDynamicPKPState(std::string_view host, +bool TransportSecurityState::GetDynamicPKPState(const NetworkAnonymizationKey& nak, std::string_view host, PKPState* result) { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); - const std::vector canonicalized_host = CanonicalizeHost(host); + const std::vector canonicalized_host = CanonicalizeHost(nak, host); if (canonicalized_host.empty()) return false; diff --git a/net/http/transport_security_state.h b/net/http/transport_security_state.h --- a/net/http/transport_security_state.h +++ b/net/http/transport_security_state.h @@ -247,6 +247,7 @@ class NET_EXPORT TransportSecurityState { // As ShouldUpgradeToSSL(), but also returns whether the decision came from // static or dynamic state, for metrics. SSLUpgradeDecision GetSSLUpgradeDecision( + const NetworkAnonymizationKey& nak, std::string_view host, bool is_top_level_nav, const NetLogWithSource& net_log = NetLogWithSource()); @@ -256,15 +257,16 @@ class NET_EXPORT TransportSecurityState { // primary public interface; direct access to STS and PKP states is best // left to tests. The caller needs to handle the optional pinning override // when is_issued_by_known_root is false. - bool ShouldSSLErrorsBeFatal(std::string_view host); - bool ShouldUpgradeToSSL(std::string_view host, + bool ShouldSSLErrorsBeFatal(const NetworkAnonymizationKey& nak, std::string_view host); + bool ShouldUpgradeToSSL(const NetworkAnonymizationKey& nak, std::string_view host, bool is_top_level_nav, const NetLogWithSource& net_log = NetLogWithSource()); PKPStatus CheckPublicKeyPins( std::string_view host, bool is_issued_by_known_root, - const std::vector& public_key_hashes); - bool HasPublicKeyPins(std::string_view host); + const std::vector& public_key_hashes, + const NetworkAnonymizationKey& nak); + bool HasPublicKeyPins(const NetworkAnonymizationKey& nak, std::string_view host); // Returns CT_REQUIREMENTS_NOT_MET if a connection violates CT policy // requirements: that is, if a connection to |host|, using the validated @@ -350,7 +352,7 @@ class NET_EXPORT TransportSecurityState { // // If an entry is deleted, the new state will be persisted through // the Delegate (if any). - bool DeleteDynamicDataForHost(std::string_view host); + bool DeleteDynamicDataForHost(const NetworkAnonymizationKey& nak, std::string_view host); // Returns true and updates |*result| if |host| has dynamic or static // HSTS/HPKP (respectively) state. If multiple entries match |host|, dynamic @@ -360,8 +362,8 @@ class NET_EXPORT TransportSecurityState { // // Note that these methods are not const because they opportunistically remove // entries that have expired. - bool GetSTSState(std::string_view host, STSState* sts_result); - bool GetPKPState(std::string_view host, PKPState* pkp_result); + bool GetSTSState(const NetworkAnonymizationKey& nak, std::string_view host, STSState* sts_result); + bool GetPKPState(const NetworkAnonymizationKey& nak, std::string_view host, PKPState* pkp_result); // Returns true and updates |*result| iff |host| has static HSTS/HPKP // (respectively) state. If multiple entries match |host|, the most specific @@ -375,22 +377,24 @@ class NET_EXPORT TransportSecurityState { // // Note that these methods are not const because they opportunistically remove // entries that have expired. - bool GetDynamicSTSState(std::string_view host, STSState* result); - bool GetDynamicPKPState(std::string_view host, PKPState* result); + bool GetDynamicSTSState(const NetworkAnonymizationKey& nak, std::string_view host, STSState* result); + bool GetDynamicPKPState(const NetworkAnonymizationKey& nak, std::string_view host, PKPState* result); // Processes an HSTS header value from the host, adding entries to // dynamic state if necessary. - bool AddHSTSHeader(std::string_view host, std::string_view value); + bool AddHSTSHeader(const NetworkAnonymizationKey& nak, std::string_view host, std::string_view value); // Adds explicitly-specified data as if it was processed from an // HSTS header (used for net-internals and unit tests). - void AddHSTS(std::string_view host, + void AddHSTS(const NetworkAnonymizationKey& nak, + std::string_view host, base::Time expiry, bool include_subdomains); // Adds explicitly-specified data as if it was processed from an HPKP header. // Note: dynamic PKP data is not persisted. - void AddHPKP(std::string_view host, + void AddHPKP(const NetworkAnonymizationKey& nak, + std::string_view host, base::Time expiry, bool include_subdomains, const HashValueVector& hashes); @@ -432,7 +436,7 @@ class NET_EXPORT TransportSecurityState { typedef std::map STSStateMap; typedef std::map PKPStateMap; - base::DictValue NetLogUpgradeToSSLParam(std::string_view host); + base::DictValue NetLogUpgradeToSSLParam(const NetworkAnonymizationKey& nak, std::string_view host); // IsBuildTimely returns true if the current build is new enough ensure that // built in security information (i.e. HSTS preloading and pinning @@ -442,7 +446,8 @@ class NET_EXPORT TransportSecurityState { // Helper method for actually checking pins. PKPStatus CheckPublicKeyPinsImpl(std::string_view host, bool is_issued_by_known_root, - const std::vector& hashes); + const std::vector& hashes, + const NetworkAnonymizationKey& network_anonymization_key); // If a Delegate is present, notify it that the internal state has // changed. @@ -452,11 +457,13 @@ class NET_EXPORT TransportSecurityState { // any previous state for the |host|, including static entries. // // The new state for |host| is persisted using the Delegate (if any). - void AddHSTSInternal(std::string_view host, + void AddHSTSInternal(const NetworkAnonymizationKey& nak, + std::string_view host, STSState::UpgradeMode upgrade_mode, base::Time expiry, bool include_subdomains); - void AddHPKPInternal(std::string_view host, + void AddHPKPInternal(const NetworkAnonymizationKey& nak, + std::string_view host, base::Time last_observed, base::Time expiry, bool include_subdomains, diff --git a/net/quic/crypto/proof_verifier_chromium.cc b/net/quic/crypto/proof_verifier_chromium.cc --- a/net/quic/crypto/proof_verifier_chromium.cc +++ b/net/quic/crypto/proof_verifier_chromium.cc @@ -409,7 +409,8 @@ int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) { TransportSecurityState::PKPStatus pin_validity = transport_security_state_->CheckPublicKeyPins( hostname_, cert_verify_result.is_issued_by_known_root, - cert_verify_result.public_key_hashes); + cert_verify_result.public_key_hashes, + proof_verifier_->network_anonymization_key_); switch (pin_validity) { case TransportSecurityState::PKPStatus::VIOLATED: result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; @@ -434,7 +435,7 @@ int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) { verify_details_->is_fatal_cert_error = IsCertStatusError(cert_status) && result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED && - transport_security_state_->ShouldSSLErrorsBeFatal(hostname_); + transport_security_state_->ShouldSSLErrorsBeFatal(proof_verifier_->network_anonymization_key_, hostname_); if (result != OK) { std::string error_string = ErrorToString(result); diff --git a/net/quic/quic_chromium_client_session.cc b/net/quic/quic_chromium_client_session.cc --- a/net/quic/quic_chromium_client_session.cc +++ b/net/quic/quic_chromium_client_session.cc @@ -1563,7 +1563,7 @@ bool QuicChromiumClientSession::CanPool( return SpdySession::CanPool(transport_security_state_, ssl_info, *ssl_config_service_, session_key_.host(), - hostname); + hostname, session_key_.network_anonymization_key()); } bool QuicChromiumClientSession::ShouldCreateIncomingStream( diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc --- a/net/socket/ssl_client_socket_impl.cc +++ b/net/socket/ssl_client_socket_impl.cc @@ -1259,7 +1259,8 @@ ssl_verify_result_t SSLClientSocketImpl::HandleVerifyResult() { context_->transport_security_state()->CheckPublicKeyPins( host_and_port_.host(), server_cert_verify_result_.is_issued_by_known_root, - server_cert_verify_result_.public_key_hashes); + server_cert_verify_result_.public_key_hashes, + ssl_config_.network_anonymization_key); switch (pin_validity) { case TransportSecurityState::PKPStatus::VIOLATED: server_cert_verify_result_.cert_status |= @@ -1279,7 +1280,7 @@ ssl_verify_result_t SSLClientSocketImpl::HandleVerifyResult() { IsCertStatusError(server_cert_verify_result_.cert_status) && result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED && context_->transport_security_state()->ShouldSSLErrorsBeFatal( - host_and_port_.host()); + ssl_config_.network_anonymization_key, host_and_port_.host()); if (IsCertificateError(result)) { if (!GetECHNameOverride().empty()) { diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc --- a/net/spdy/spdy_session.cc +++ b/net/spdy/spdy_session.cc @@ -724,7 +724,8 @@ bool SpdySession::CanPool(TransportSecurityState* transport_security_state, const SSLInfo& ssl_info, const SSLConfigService& ssl_config_service, std::string_view old_hostname, - std::string_view new_hostname) { + std::string_view new_hostname, + const net::NetworkAnonymizationKey& network_anonymization_key) { // Pooling is prohibited if the server cert is not valid for the new domain, // and for connections on which client certs were sent. It is also prohibited // when channel ID was sent if the hosts are from different eTLDs+1. @@ -742,7 +743,7 @@ bool SpdySession::CanPool(TransportSecurityState* transport_security_state, if (transport_security_state->CheckPublicKeyPins( new_hostname, ssl_info.is_issued_by_known_root, - ssl_info.public_key_hashes) == + ssl_info.public_key_hashes, network_anonymization_key) == TransportSecurityState::PKPStatus::VIOLATED) { return false; } @@ -1007,7 +1008,8 @@ bool SpdySession::VerifyDomainAuthentication(std::string_view domain) const { return true; // This is not a secure session, so all domains are okay. return CanPool(transport_security_state_, ssl_info, *ssl_config_service_, - host_port_pair().host(), domain); + host_port_pair().host(), domain, + spdy_session_key_.network_anonymization_key()); } void SpdySession::EnqueueStreamWrite( @@ -3173,7 +3175,8 @@ void SpdySession::OnAltSvc( return; } if (!CanPool(transport_security_state_, ssl_info, *ssl_config_service_, - host_port_pair().host(), gurl.host())) { + host_port_pair().host(), gurl.host(), + spdy_session_key_.network_anonymization_key())) { return; } scheme_host_port = url::SchemeHostPort(gurl); diff --git a/net/spdy/spdy_session.h b/net/spdy/spdy_session.h --- a/net/spdy/spdy_session.h +++ b/net/spdy/spdy_session.h @@ -325,7 +325,8 @@ class NET_EXPORT SpdySession const SSLInfo& ssl_info, const SSLConfigService& ssl_config_service, std::string_view old_hostname, - std::string_view new_hostname); + std::string_view new_hostname, + const net::NetworkAnonymizationKey& network_anonymization_key); // Create a new SpdySession. // |spdy_session_key| is the host/port that this session connects to, privacy diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/url_request_context_builder.cc --- a/net/url_request/url_request_context_builder.cc +++ b/net/url_request/url_request_context_builder.cc @@ -406,20 +406,6 @@ std::unique_ptr URLRequestContextBuilder::Build() { context->set_transport_security_state( std::make_unique(hsts_policy_bypass_list_)); - if (!transport_security_persister_file_path_.empty()) { - // Use a low priority because saving this should not block anything - // user-visible. Block shutdown to ensure it does get persisted to disk, - // since it contains security-relevant information. - scoped_refptr task_runner( - base::ThreadPool::CreateSequencedTaskRunner( - {base::MayBlock(), base::TaskPriority::BEST_EFFORT, - base::TaskShutdownBehavior::BLOCK_SHUTDOWN})); - - context->set_transport_security_persister( - std::make_unique( - context->transport_security_state(), task_runner, - transport_security_persister_file_path_)); - } if (http_server_properties_) { context->set_http_server_properties(std::move(http_server_properties_)); diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc --- a/net/url_request/url_request_http_job.cc +++ b/net/url_request/url_request_http_job.cc @@ -373,6 +373,7 @@ std::unique_ptr URLRequestHttpJob::Create(URLRequest* request) { if (TransportSecurityState* hsts = request->context()->transport_security_state()) { upgrade_decision = hsts->GetSSLUpgradeDecision( + request->isolation_info().network_anonymization_key(), url.GetHost(), /*is_top_level_nav=*/ request->isolation_info().IsOutermostMainFrameRequest(), @@ -1234,7 +1235,7 @@ void URLRequestHttpJob::ProcessStrictTransportSecurityHeader() { std::optional value; if ((value = headers->EnumerateHeader(nullptr, "Strict-Transport-Security"))) { - security_state->AddHSTSHeader(request_info_.url.GetHost(), *value); + security_state->AddHSTSHeader(request_info_.network_anonymization_key, request_info_.url.GetHost(), *value); } } @@ -1314,7 +1315,7 @@ void URLRequestHttpJob::OnStartCompleted(int result) { TransportSecurityState* state = context->transport_security_state(); NotifySSLCertificateError( result, transaction_->GetResponseInfo()->ssl_info, - state->ShouldSSLErrorsBeFatal(request_info_.url.GetHost()) && + state->ShouldSSLErrorsBeFatal(request_->isolation_info().network_anonymization_key(), request_info_.url.GetHost()) && result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED); } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) { NotifyCertificateRequested( diff --git a/services/network/network_context.cc b/services/network/network_context.cc --- a/services/network/network_context.cc +++ b/services/network/network_context.cc @@ -2195,6 +2195,7 @@ void NetworkContext::CreateHostResolver( void NetworkContext::VerifyCertInternal( const scoped_refptr& certificate, const net::HostPortPair& host_port, + const net::NetworkAnonymizationKey& network_anonymization_key, const std::string& ocsp_result, const std::string& sct_list, CTVerificationMode ct_verification_mode, @@ -2206,6 +2207,7 @@ void NetworkContext::VerifyCertInternal( pending_cert_verify->result = std::make_unique(); pending_cert_verify->certificate = certificate; pending_cert_verify->host_port = host_port; + pending_cert_verify->network_anonymization_key = network_anonymization_key; net::CertVerifier* cert_verifier = g_cert_verifier_for_testing ? g_cert_verifier_for_testing : url_request_context_->cert_verifier(); @@ -2236,20 +2238,22 @@ void NetworkContext::VerifyCertInternal( void NetworkContext::VerifyCert( const scoped_refptr& certificate, const net::HostPortPair& host_port, + const net::NetworkAnonymizationKey& network_anonymization_key, const std::string& ocsp_result, const std::string& sct_list, VerifyCertCallback callback) { - VerifyCertInternal(certificate, host_port, ocsp_result, sct_list, + VerifyCertInternal(certificate, host_port, network_anonymization_key, ocsp_result, sct_list, CTVerificationMode::kTlsCertificate, std::move(callback)); } void NetworkContext::VerifyCertForSignedExchange( const scoped_refptr& certificate, const net::HostPortPair& host_port, + const net::NetworkAnonymizationKey& network_anonymization_key, const std::string& ocsp_result, const std::string& sct_list, VerifyCertCallback callback) { - VerifyCertInternal(certificate, host_port, ocsp_result, sct_list, + VerifyCertInternal(certificate, host_port, network_anonymization_key, ocsp_result, sct_list, CTVerificationMode::kSignedExchange, std::move(callback)); } @@ -2290,17 +2294,19 @@ void NetworkContext::SetCorsOriginAccessListsForOrigin( std::move(callback).Run(); } -void NetworkContext::AddHSTS(const std::string& host, +void NetworkContext::AddHSTS(const net::NetworkAnonymizationKey& nak, + const std::string& host, base::Time expiry, bool include_subdomains, AddHSTSCallback callback) { net::TransportSecurityState* state = url_request_context_->transport_security_state(); - state->AddHSTS(host, expiry, include_subdomains); + state->AddHSTS(nak, host, expiry, include_subdomains); std::move(callback).Run(); } -void NetworkContext::IsHSTSActiveForHost(const std::string& host, +void NetworkContext::IsHSTSActiveForHost(const net::NetworkAnonymizationKey& nak, + const std::string& host, bool is_top_level_nav, IsHSTSActiveForHostCallback callback) { net::TransportSecurityState* security_state = @@ -2312,10 +2318,10 @@ void NetworkContext::IsHSTSActiveForHost(const std::string& host, } std::move(callback).Run( - security_state->ShouldUpgradeToSSL(host, is_top_level_nav)); + security_state->ShouldUpgradeToSSL(nak, host, is_top_level_nav)); } -void NetworkContext::GetHSTSState(const std::string& domain, +void NetworkContext::GetHSTSState(const net::NetworkAnonymizationKey& nak, const std::string& domain, GetHSTSStateCallback callback) { base::DictValue result; @@ -2353,10 +2359,10 @@ void NetworkContext::GetHSTSState(const std::string& domain, net::TransportSecurityState::STSState dynamic_sts_state; net::TransportSecurityState::PKPState dynamic_pkp_state; bool found_sts_dynamic = transport_security_state->GetDynamicSTSState( - domain, &dynamic_sts_state); + nak, domain, &dynamic_sts_state); bool found_pkp_dynamic = transport_security_state->GetDynamicPKPState( - domain, &dynamic_pkp_state); + nak, domain, &dynamic_pkp_state); if (found_sts_dynamic) { result.Set("dynamic_upgrade_mode", static_cast(dynamic_sts_state.upgrade_mode)); @@ -2394,6 +2400,7 @@ void NetworkContext::GetHSTSState(const std::string& domain, } void NetworkContext::DeleteDynamicDataForHost( + const net::NetworkAnonymizationKey& nak, const std::string& host, DeleteDynamicDataForHostCallback callback) { net::TransportSecurityState* transport_security_state = @@ -2404,7 +2411,7 @@ void NetworkContext::DeleteDynamicDataForHost( } std::move(callback).Run( - transport_security_state->DeleteDynamicDataForHost(host)); + transport_security_state->DeleteDynamicDataForHost(nak, host)); } void NetworkContext::EnableStaticKeyPinningForTesting( @@ -2463,7 +2470,7 @@ void NetworkContext::PreconnectSockets( DCHECK(!require_network_anonymization_key_ || !network_anonymization_key.IsEmpty()); - GURL url = GetHSTSRedirectForPreconnect(original_url); + GURL url = GetHSTSRedirectForPreconnect(network_anonymization_key, original_url); // |PreconnectSockets| may receive arguments from the renderer, which is not // guaranteed to validate them. @@ -3316,7 +3323,9 @@ void NetworkContext::OnConnectionError() { } } -GURL NetworkContext::GetHSTSRedirectForPreconnect(const GURL& original_url) { +GURL NetworkContext::GetHSTSRedirectForPreconnect( + const net::NetworkAnonymizationKey& network_anonymization_key, + const GURL& original_url) { // TODO(lilyhoughton) This needs to be gotten rid of once explicit // construction with a URLRequestContext is no longer supported. @@ -3342,6 +3351,7 @@ GURL NetworkContext::GetHSTSRedirectForPreconnect(const GURL& original_url) { // top-level navigation so we need to disallow HSTS upgrades for every // preconnect. if (!url_request_context_->transport_security_state()->ShouldUpgradeToSSL( + network_anonymization_key, original_url.GetHost(), /*is_top_level_nav=*/false)) { RecordHSTSPreconnectUpgradeReason( HSTSRedirectUpgradeReason::kNotUpgradedNoHSTSPin); @@ -3403,7 +3413,8 @@ void NetworkContext::OnVerifyCertComplete(uint64_t cert_verify_id, int result) { url_request_context_->transport_security_state()->CheckPublicKeyPins( pending_cert_verify->host_port.host(), pending_cert_verify->result->is_issued_by_known_root, - pending_cert_verify->result->public_key_hashes); + pending_cert_verify->result->public_key_hashes, + pending_cert_verify->network_anonymization_key); switch (pin_validity) { case net::TransportSecurityState::PKPStatus::VIOLATED: pending_cert_verify->result->cert_status |= diff --git a/services/network/network_context.h b/services/network/network_context.h --- a/services/network/network_context.h +++ b/services/network/network_context.h @@ -429,12 +429,14 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext mojo::PendingReceiver receiver) override; void VerifyCert(const scoped_refptr& certificate, const net::HostPortPair& host_port, + const net::NetworkAnonymizationKey& network_anonymization_key, const std::string& ocsp_result, const std::string& sct_list, VerifyCertCallback callback) override; void VerifyCertForSignedExchange( const scoped_refptr& certificate, const net::HostPortPair& host_port, + const net::NetworkAnonymizationKey& network_anonymization_key, const std::string& ocsp_result, const std::string& sct_list, VerifyCertCallback callback) override; @@ -443,16 +445,18 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext const std::string& hostname, const scoped_refptr& tls_certificate, Verify2QwacCertBindingCallback callback) override; - void AddHSTS(const std::string& host, + void AddHSTS(const net::NetworkAnonymizationKey& nak, + const std::string& host, base::Time expiry, bool include_subdomains, AddHSTSCallback callback) override; - void IsHSTSActiveForHost(const std::string& host, + void IsHSTSActiveForHost(const net::NetworkAnonymizationKey& nak, const std::string& host, bool is_top_level_nav, IsHSTSActiveForHostCallback callback) override; - void GetHSTSState(const std::string& domain, + void GetHSTSState(const net::NetworkAnonymizationKey& nak, const std::string& domain, GetHSTSStateCallback callback) override; void DeleteDynamicDataForHost( + const net::NetworkAnonymizationKey& nak, const std::string& host, DeleteDynamicDataForHostCallback callback) override; void SetCorsOriginAccessListsForOrigin( @@ -826,7 +830,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext mojo::PendingRemote cookie_observer, net::FirstPartySetMetadata first_party_set_metadata); - GURL GetHSTSRedirectForPreconnect(const GURL& original_url); + GURL GetHSTSRedirectForPreconnect(const net::NetworkAnonymizationKey& network_anonymization_key, + const GURL& original_url); #if BUILDFLAG(IS_P2P_ENABLED) void DestroySocketManager(P2PSocketManager* socket_manager); @@ -838,6 +843,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext void VerifyCertInternal( const scoped_refptr& certificate, const net::HostPortPair& host_port, + const net::NetworkAnonymizationKey& network_anonymization_key, const std::string& ocsp_result, const std::string& sct_list, CTVerificationMode ct_verification_mode, @@ -1027,6 +1033,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext VerifyCertCallback callback; scoped_refptr certificate; net::HostPortPair host_port; + net::NetworkAnonymizationKey network_anonymization_key; }; std::map> cert_verifier_requests_; diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom --- a/services/network/public/mojom/network_context.mojom +++ b/services/network/public/mojom/network_context.mojom @@ -1583,6 +1583,7 @@ interface NetworkContext { // Checks the given certificate against the CertVerifier and CTVerifier. VerifyCert(X509Certificate certificate, HostPortPair host_port, + NetworkAnonymizationKey network_anonymization_key, string ocsp_response, string sct_list) => (int32 error_code, CertVerifyResult cv_result, bool pkp_bypassed); @@ -1591,6 +1592,7 @@ interface NetworkContext { // This implementation is specific for use by Signed Exchange. VerifyCertForSignedExchange(X509Certificate certificate, HostPortPair host_port, + NetworkAnonymizationKey network_anonymization_key, string ocsp_response, string sct_list) => (int32 error_code, CertVerifyResult cv_result, bool pkp_bypassed); @@ -1604,18 +1606,18 @@ interface NetworkContext { // Adds explicitly-specified data as if it was processed from an // HSTS header. Used by tests and implementation of chrome://net-internals. - AddHSTS(string host, mojo_base.mojom.Time expiry, bool include_subdomains) + AddHSTS(NetworkAnonymizationKey nak, string host, mojo_base.mojom.Time expiry, bool include_subdomains) => (); // Returns true if it is known that `host` has requested to always be // accessed via HTTPS. `is_top_level_nav` indicates whether or not the query // for the HSTS state is being made by a top-level/primary/outermost frame // navigation request. - IsHSTSActiveForHost(string host, bool is_top_level_nav) => (bool result); + IsHSTSActiveForHost(NetworkAnonymizationKey nak, string host, bool is_top_level_nav) => (bool result); // Retrieve values from the HSTS state from the associated contexts // transport security state. - GetHSTSState(string domain) => (mojo_base.mojom.DictionaryValue state); + GetHSTSState(NetworkAnonymizationKey nak, string domain) => (mojo_base.mojom.DictionaryValue state); // Sets allowed and blocked origins respectively for the URLLoaderFactory // consumers to access beyond the same-origin policy. The list is managed per @@ -1634,7 +1636,7 @@ interface NetworkContext { // Deletes any dynamic data stored for |host| from the transport // security state. Returns true iff an entry was deleted. // See net::TransportSecurityState::DeleteDynamicDataForHost for more detail. - DeleteDynamicDataForHost(string host) => (bool result); + DeleteDynamicDataForHost(NetworkAnonymizationKey nak, string host) => (bool result); // Sets whether the HTTP auth cache will be split the NetworkAnonymizationKey. // Only affects server (not proxy) credentials. Whenever the effective value --