PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
create-pull-request/patch-cdf415c
cromite/build/patches/Partition-HSTS-cache-by-NAK.patch
T
Carmelo Messina 0bf212cf9b Patches for v148
2026-05-19 10:48:25 +02:00

1060 lines
53 KiB
Diff
Raw Permalink Blame History

From: uazo <uazo@users.noreply.github.com>
Date: Thu, 16 Mar 2023 14:17:22 +0000
Subject: Partition HSTS cache by NAK
License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
---
.../browser/ssl/https_upgrades_interceptor.cc | 1 +
.../webui/net_internals/net_internals_ui.cc | 14 ++-
.../core/browser/hsts_query.cc | 1 +
.../web_package/signed_exchange_handler.cc | 7 +-
.../web_package/signed_exchange_handler.h | 4 +
.../web_package/signed_exchange_loader.cc | 3 +-
.../web_package/signed_exchange_loader.h | 2 +
.../signed_exchange_prefetch_handler.cc | 2 +-
.../signed_exchange_request_handler.cc | 1 +
.../Partition-HSTS-cache-by-NAK.inc | 1 +
net/http/transport_security_state.cc | 103 ++++++++++++------
net/http/transport_security_state.h | 39 ++++---
net/quic/crypto/proof_verifier_chromium.cc | 5 +-
net/quic/quic_chromium_client_session.cc | 2 +-
net/socket/ssl_client_socket_impl.cc | 5 +-
net/spdy/spdy_session.cc | 11 +-
net/spdy/spdy_session.h | 3 +-
.../url_request_context_builder.cc | 14 ---
net/url_request/url_request_http_job.cc | 5 +-
services/network/network_context.cc | 37 ++++---
services/network/network_context.h | 15 ++-
.../public/mojom/network_context.mojom | 10 +-
22 files changed, 181 insertions(+), 104 deletions(-)
create mode 100644 cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc
diff --git a/chrome/browser/ssl/https_upgrades_interceptor.cc b/chrome/browser/ssl/https_upgrades_interceptor.cc
--- a/chrome/browser/ssl/https_upgrades_interceptor.cc
+++ b/chrome/browser/ssl/https_upgrades_interceptor.cc
@@ -415,6 +415,7 @@ void HttpsUpgradesInterceptor::MaybeCreateLoader(
CHECK(tentative_resource_request.trusted_params);
network_context->IsHSTSActiveForHost(
+ tentative_resource_request.trusted_params->isolation_info.network_anonymization_key(),
tentative_resource_request.url.GetHost(),
tentative_resource_request.trusted_params->isolation_info
.IsOutermostMainFrameRequest(),
diff --git a/chrome/browser/ui/webui/net_internals/net_internals_ui.cc b/chrome/browser/ui/webui/net_internals/net_internals_ui.cc
--- a/chrome/browser/ui/webui/net_internals/net_internals_ui.cc
+++ b/chrome/browser/ui/webui/net_internals/net_internals_ui.cc
@@ -393,7 +393,10 @@ void NetInternalsMessageHandler::OnDomainSecurityPolicyDelete(
// There cannot be a unicode entry in the HSTS set.
return;
}
+ url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple(
+ "https", *domain, 443);
GetNetworkContext()->DeleteDynamicDataForHost(
+ net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(),
*domain, base::BindOnce(&IgnoreBoolCallback));
}
@@ -403,7 +406,10 @@ void NetInternalsMessageHandler::OnHSTSQuery(const base::ListValue& list) {
DCHECK(callback_id && domain);
AllowJavascript();
+ url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple(
+ "https", *domain, 443);
GetNetworkContext()->GetHSTSState(
+ net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(),
*domain,
base::BindOnce(&NetInternalsMessageHandler::ResolveCallbackWithResult,
weak_factory_.GetWeakPtr(), *callback_id));
@@ -429,8 +435,12 @@ void NetInternalsMessageHandler::OnHSTSAdd(const base::ListValue& list) {
const bool sts_include_subdomains = list[1].GetBool();
base::Time expiry = base::Time::Now() + base::Days(1000);
- GetNetworkContext()->AddHSTS(*domain, expiry, sts_include_subdomains,
- base::DoNothing());
+ url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple(
+ "https", *domain, 443);
+ GetNetworkContext()->AddHSTS(
+ net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(),
+ *domain, expiry, sts_include_subdomains,
+ base::DoNothing());
}
void NetInternalsMessageHandler::OnFlushSocketPools(
diff --git a/components/password_manager/core/browser/hsts_query.cc b/components/password_manager/core/browser/hsts_query.cc
--- a/components/password_manager/core/browser/hsts_query.cc
+++ b/components/password_manager/core/browser/hsts_query.cc
@@ -63,6 +63,7 @@ void PostHSTSQueryForHostAndNetworkContext(
// privacy leaks. Since our use is internal to the browser we don't need to
// worry about leaking state so we can set true for is_top_level_nav.
network_context->IsHSTSActiveForHost(
+ net::IsolationInfo::CreateForInternalRequest(origin).network_anonymization_key(),
origin.host(), /*is_top_level_nav=*/true,
mojo::WrapCallbackWithDropHandler(
base::BindOnce(&HSTSCallbackHelper::ReportResult, callback_helper),
diff --git a/content/browser/web_package/signed_exchange_handler.cc b/content/browser/web_package/signed_exchange_handler.cc
--- a/content/browser/web_package/signed_exchange_handler.cc
+++ b/content/browser/web_package/signed_exchange_handler.cc
@@ -94,6 +94,7 @@ using VerifyCallback =
void VerifyCert(const scoped_refptr<net::X509Certificate>& certificate,
const GURL& url,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
const std::string& ocsp_result,
const std::string& sct_list,
FrameTreeNodeId frame_tree_node_id,
@@ -115,7 +116,7 @@ void VerifyCert(const scoped_refptr<net::X509Certificate>& certificate,
}
network_context->VerifyCertForSignedExchange(
- certificate, net::HostPortPair::FromURL(url), ocsp_result, sct_list,
+ certificate, net::HostPortPair::FromURL(url), network_anonymization_key, ocsp_result, sct_list,
std::move(wrapped_callback));
}
@@ -177,6 +178,7 @@ SignedExchangeHandler::SignedExchangeHandler(
std::unique_ptr<net::SourceStream> body,
ExchangeHeadersCallback headers_callback,
std::unique_ptr<SignedExchangeCertFetcherFactory> cert_fetcher_factory,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
std::optional<net::IsolationInfo> outer_request_isolation_info,
int load_flags,
const net::IPEndPoint& remote_endpoint,
@@ -190,6 +192,7 @@ SignedExchangeHandler::SignedExchangeHandler(
source_(std::move(body)),
cert_fetcher_factory_(std::move(cert_fetcher_factory)),
devtools_proxy_(std::move(devtools_proxy)),
+ network_anonymization_key_(network_anonymization_key),
outer_request_isolation_info_(std::move(outer_request_isolation_info)),
load_flags_(load_flags),
remote_endpoint_(remote_endpoint),
@@ -529,7 +532,7 @@ void SignedExchangeHandler::OnCertReceived(
// property, or
const std::string& stapled_ocsp_response = unverified_cert_chain_->ocsp();
- VerifyCert(certificate, url, stapled_ocsp_response, sct_list_from_cert_cbor,
+ VerifyCert(certificate, url, network_anonymization_key_, stapled_ocsp_response, sct_list_from_cert_cbor,
frame_tree_node_id_,
base::BindOnce(&SignedExchangeHandler::OnVerifyCert,
weak_factory_.GetWeakPtr()));
diff --git a/content/browser/web_package/signed_exchange_handler.h b/content/browser/web_package/signed_exchange_handler.h
--- a/content/browser/web_package/signed_exchange_handler.h
+++ b/content/browser/web_package/signed_exchange_handler.h
@@ -104,6 +104,7 @@ class CONTENT_EXPORT SignedExchangeHandler {
std::unique_ptr<net::SourceStream> body,
ExchangeHeadersCallback headers_callback,
std::unique_ptr<SignedExchangeCertFetcherFactory> cert_fetcher_factory,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
std::optional<net::IsolationInfo> outer_request_isolation_info,
int load_flags,
const net::IPEndPoint& remote_endpoint,
@@ -193,6 +194,9 @@ class CONTENT_EXPORT SignedExchangeHandler {
// `cert_fetcher_` borrows reference from `devtools_proxy_`, so it needs to be
// declared last, so that it is destroyed first.
std::unique_ptr<SignedExchangeCertFetcher> cert_fetcher_;
+
+ const net::NetworkAnonymizationKey network_anonymization_key_;
+
// `outer_request_isolation_info_` will be set unless this corresponds to a
// prefetch request.
std::optional<net::IsolationInfo> outer_request_isolation_info_;
diff --git a/content/browser/web_package/signed_exchange_loader.cc b/content/browser/web_package/signed_exchange_loader.cc
--- a/content/browser/web_package/signed_exchange_loader.cc
+++ b/content/browser/web_package/signed_exchange_loader.cc
@@ -77,6 +77,7 @@ SignedExchangeLoader::SignedExchangeLoader(
std::unique_ptr<SignedExchangeReporter> reporter,
scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
URLLoaderThrottlesGetter url_loader_throttles_getter,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
FrameTreeNodeId frame_tree_node_id,
const std::string& accept_langs,
bool keep_entry_for_prefetch_cache)
@@ -154,7 +155,7 @@ SignedExchangeLoader::SignedExchangeLoader(
std::move(outer_response_body)),
base::BindOnce(&SignedExchangeLoader::OnHTTPExchangeFound,
weak_factory_.GetWeakPtr()),
- std::move(cert_fetcher_factory),
+ std::move(cert_fetcher_factory), network_anonymization_key,
keep_entry_for_prefetch_cache
? std::nullopt
: std::make_optional(outer_request_.trusted_params->isolation_info),
diff --git a/content/browser/web_package/signed_exchange_loader.h b/content/browser/web_package/signed_exchange_loader.h
--- a/content/browser/web_package/signed_exchange_loader.h
+++ b/content/browser/web_package/signed_exchange_loader.h
@@ -32,6 +32,7 @@ class URLLoaderThrottle;
} // namespace blink
namespace net {
+class NetworkAnonymizationKey;
class SourceStream;
} // namespace net
@@ -74,6 +75,7 @@ class CONTENT_EXPORT SignedExchangeLoader final
std::unique_ptr<SignedExchangeReporter> reporter,
scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
URLLoaderThrottlesGetter url_loader_throttles_getter,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
FrameTreeNodeId frame_tree_node_id,
const std::string& accept_langs,
bool keep_entry_for_prefetch_cache);
diff --git a/content/browser/web_package/signed_exchange_prefetch_handler.cc b/content/browser/web_package/signed_exchange_prefetch_handler.cc
--- a/content/browser/web_package/signed_exchange_prefetch_handler.cc
+++ b/content/browser/web_package/signed_exchange_prefetch_handler.cc
@@ -56,7 +56,7 @@ SignedExchangePrefetchHandler::SignedExchangePrefetchHandler(
network::mojom::kURLLoadOptionNone,
false /* should_redirect_to_fallback */, std::move(devtools_proxy),
std::move(reporter), std::move(url_loader_factory),
- loader_throttles_getter, frame_tree_node_id, accept_langs,
+ loader_throttles_getter, network_anonymization_key, frame_tree_node_id, accept_langs,
keep_entry_for_prefetch_cache);
}
diff --git a/content/browser/web_package/signed_exchange_request_handler.cc b/content/browser/web_package/signed_exchange_request_handler.cc
--- a/content/browser/web_package/signed_exchange_request_handler.cc
+++ b/content/browser/web_package/signed_exchange_request_handler.cc
@@ -116,6 +116,7 @@ bool SignedExchangeRequestHandler::MaybeCreateLoaderForResponse(
std::move(client), url_loader->Unbind(), url_loader_options_,
true /* should_redirect_to_fallback */, std::move(devtools_proxy),
std::move(reporter), url_loader_factory_, url_loader_throttles_getter_,
+ network_anonymization_key,
frame_tree_node_id_, accept_langs_,
false /* keep_entry_for_prefetch_cache */);
diff --git a/cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc b/cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/net/base/features_cc/Partition-HSTS-cache-by-NAK.inc
@@ -0,0 +1 @@
+SET_CROMITE_FEATURE_DISABLED(kHstsTopLevelNavigationsOnly);
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -78,7 +78,7 @@ bool HashesIntersect(const absl::flat_hash_set<SHA256HashValue>& a,
// Converts |hostname| from dotted form ("www.google.com") to the form
// used in DNS: "\x03www\x06google\x03com", lowercases that, and returns
// the result.
-std::vector<uint8_t> CanonicalizeHost(std::string_view host) {
+std::vector<uint8_t> CanonicalizeHostWithoutNak(std::string_view host) {
// We cannot perform the operations as detailed in the spec here as `host`
// has already undergone IDN processing before it reached us. Thus, we
// lowercase the input (probably redudnant since most input here has been
@@ -99,6 +99,29 @@ std::vector<uint8_t> CanonicalizeHost(std::string_view host) {
return std::move(new_host).value();
}
+std::vector<uint8_t> CanonicalizeHost(const NetworkAnonymizationKey& nak,
+ std::string_view host) {
+ std::vector<uint8_t> hostname = CanonicalizeHostWithoutNak(host);
+ if (hostname.empty()) {
+ return hostname;
+ }
+
+ // esclude opaque or transient nak
+ if (nak.IsEmpty() || nak.IsTransient())
+ return std::vector<uint8_t>();
+
+ std::string lowered_host = base::ToLowerASCII(
+ nak.ToDebugString() + " " + std::string(host));
+ std::vector<uint8_t> vector =
+ std::vector<uint8_t>(lowered_host.begin(), lowered_host.end());
+ if (vector.size() > 254)
+ return std::vector<uint8_t>();
+
+ vector.emplace(vector.begin(), vector.size());
+ vector.emplace(vector.end(), 0);
+ return vector;
+}
+
// PreloadResult is the result of resolving a specific name in the preloaded
// data.
struct PreloadResult {
@@ -177,7 +200,7 @@ bool DecodeHSTSPreload(std::string_view search_hostname, PreloadResult* out) {
// Ensure that |search_hostname| is a valid hostname before
// processing.
- if (CanonicalizeHost(search_hostname).empty()) {
+ if (CanonicalizeHostWithoutNak(search_hostname).empty()) {
return false;
}
// Normalize any trailing '.' used for DNS suffix searches.
@@ -236,18 +259,19 @@ TransportSecurityState::TransportSecurityState(
// Both HSTS and HPKP cause fatal SSL errors, so return true if a
// host has either.
-bool TransportSecurityState::ShouldSSLErrorsBeFatal(std::string_view host) {
+bool TransportSecurityState::ShouldSSLErrorsBeFatal(const NetworkAnonymizationKey& nak, std::string_view host) {
STSState unused_sts;
PKPState unused_pkp;
- return GetSTSState(host, &unused_sts) || GetPKPState(host, &unused_pkp);
+ return GetSTSState(nak, host, &unused_sts) || GetPKPState(nak, host, &unused_pkp);
}
base::DictValue TransportSecurityState::NetLogUpgradeToSSLParam(
+ const NetworkAnonymizationKey& nak,
std::string_view host) {
STSState sts_state;
base::DictValue dict;
dict.Set("host", host);
- dict.Set("get_sts_state_result", GetSTSState(host, &sts_state));
+ dict.Set("get_sts_state_result", GetSTSState(nak, host, &sts_state));
dict.Set("should_upgrade_to_ssl", sts_state.ShouldUpgradeToSSL());
dict.Set("host_found_in_hsts_bypass_list",
hsts_host_bypass_list_.find(host) != hsts_host_bypass_list_.end());
@@ -255,12 +279,13 @@ base::DictValue TransportSecurityState::NetLogUpgradeToSSLParam(
}
SSLUpgradeDecision TransportSecurityState::GetSSLUpgradeDecision(
+ const NetworkAnonymizationKey& nak,
std::string_view host,
bool is_top_level_nav,
const NetLogWithSource& net_log) {
net_log.AddEvent(
NetLogEventType::TRANSPORT_SECURITY_STATE_SHOULD_UPGRADE_TO_SSL,
- [&] { return NetLogUpgradeToSSLParam(host); });
+ [&] { return NetLogUpgradeToSSLParam(nak, host); });
// Only top level navigations should be upgraded when
// kHstsTopLevelNavigationsOnly is enabled.
@@ -271,7 +296,7 @@ SSLUpgradeDecision TransportSecurityState::GetSSLUpgradeDecision(
STSState sts_state;
// Check the dynamic list first (removing the entry if expired).
- if (GetDynamicSTSState(host, &sts_state)) {
+ if (GetDynamicSTSState(nak, host, &sts_state)) {
// [*.]localhost hosts now ignore Strict-Transport-Security response
// headers, but an entry may have been stored before this restriction
// was introduced (crbug.com/41251622).
@@ -296,29 +321,31 @@ SSLUpgradeDecision TransportSecurityState::GetSSLUpgradeDecision(
}
bool TransportSecurityState::ShouldUpgradeToSSL(
+ const NetworkAnonymizationKey& nak,
std::string_view host,
bool is_top_level_nav,
const NetLogWithSource& net_log) {
- return GetSSLUpgradeDecision(host, is_top_level_nav, net_log) !=
+ return GetSSLUpgradeDecision(nak, host, is_top_level_nav, net_log) !=
SSLUpgradeDecision::kNoUpgrade;
}
TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPins(
std::string_view host,
bool is_issued_by_known_root,
- const std::vector<SHA256HashValue>& public_key_hashes) {
+ const std::vector<SHA256HashValue>& public_key_hashes,
+ const NetworkAnonymizationKey& network_anonymization_key) {
// Perform pin validation only if the server actually has public key pins.
- if (!HasPublicKeyPins(host)) {
+ if (!HasPublicKeyPins(network_anonymization_key, host)) {
return PKPStatus::OK;
}
return CheckPublicKeyPinsImpl(host, is_issued_by_known_root,
- public_key_hashes);
+ public_key_hashes, network_anonymization_key);
}
-bool TransportSecurityState::HasPublicKeyPins(std::string_view host) {
+bool TransportSecurityState::HasPublicKeyPins(const NetworkAnonymizationKey& nak, std::string_view host) {
PKPState pkp_state;
- return GetPKPState(host, &pkp_state) && pkp_state.HasPublicKeyPins();
+ return GetPKPState(nak, host, &pkp_state) && pkp_state.HasPublicKeyPins();
}
ct::CTRequirementsStatus TransportSecurityState::CheckCTRequirements(
@@ -378,12 +405,13 @@ void TransportSecurityState::UpdatePinList(
}
void TransportSecurityState::AddHSTSInternal(
+ const NetworkAnonymizationKey& nak,
std::string_view host,
TransportSecurityState::STSState::UpgradeMode upgrade_mode,
base::Time expiry,
bool include_subdomains) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
- const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+ const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
if (canonicalized_host.empty())
return;
@@ -407,13 +435,14 @@ void TransportSecurityState::AddHSTSInternal(
DirtyNotify();
}
-void TransportSecurityState::AddHPKPInternal(std::string_view host,
+void TransportSecurityState::AddHPKPInternal(const NetworkAnonymizationKey& nak,
+ std::string_view host,
base::Time last_observed,
base::Time expiry,
bool include_subdomains,
const HashValueVector& hashes) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
- const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+ const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
if (canonicalized_host.empty())
return;
@@ -461,10 +490,10 @@ TransportSecurityState::PKPStatus TransportSecurityState::CheckPins(
return PKPStatus::VIOLATED;
}
-bool TransportSecurityState::DeleteDynamicDataForHost(std::string_view host) {
+bool TransportSecurityState::DeleteDynamicDataForHost(const NetworkAnonymizationKey& nak, std::string_view host) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
- const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+ const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
if (canonicalized_host.empty())
return false;
@@ -541,7 +570,8 @@ void TransportSecurityState::DirtyNotify() {
delegate_->StateIsDirty(this);
}
-bool TransportSecurityState::AddHSTSHeader(std::string_view host,
+bool TransportSecurityState::AddHSTSHeader(const NetworkAnonymizationKey& nak,
+ std::string_view host,
std::string_view value) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
@@ -560,23 +590,25 @@ bool TransportSecurityState::AddHSTSHeader(std::string_view host,
upgrade_mode = STSState::MODE_FORCE_HTTPS;
}
- AddHSTSInternal(host, upgrade_mode, now + max_age, include_subdomains);
+ AddHSTSInternal(nak, host, upgrade_mode, now + max_age, include_subdomains);
return true;
}
-void TransportSecurityState::AddHSTS(std::string_view host,
+void TransportSecurityState::AddHSTS(const NetworkAnonymizationKey& nak,
+ std::string_view host,
base::Time expiry,
bool include_subdomains) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
- AddHSTSInternal(host, STSState::MODE_FORCE_HTTPS, expiry, include_subdomains);
+ AddHSTSInternal(nak, host, STSState::MODE_FORCE_HTTPS, expiry, include_subdomains);
}
-void TransportSecurityState::AddHPKP(std::string_view host,
+void TransportSecurityState::AddHPKP(const NetworkAnonymizationKey& nak,
+ std::string_view host,
base::Time expiry,
bool include_subdomains,
const HashValueVector& hashes) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
- AddHPKPInternal(host, base::Time::Now(), expiry, include_subdomains, hashes);
+ AddHPKPInternal(nak, host, base::Time::Now(), expiry, include_subdomains, hashes);
}
size_t TransportSecurityState::num_sts_entries() const {
@@ -601,9 +633,10 @@ TransportSecurityState::PKPStatus
TransportSecurityState::CheckPublicKeyPinsImpl(
std::string_view host,
bool is_issued_by_known_root,
- const std::vector<SHA256HashValue>& hashes) {
+ const std::vector<SHA256HashValue>& hashes,
+ const NetworkAnonymizationKey& network_anonymization_key) {
PKPState pkp_state;
- bool found_state = GetPKPState(host, &pkp_state);
+ bool found_state = GetPKPState(network_anonymization_key, host, &pkp_state);
// HasPublicKeyPins should have returned true in order for this method to have
// been called.
@@ -642,7 +675,7 @@ bool TransportSecurityState::GetStaticPKPState(std::string_view host,
}
// Ensure that |host| is a valid hostname before processing.
- if (CanonicalizeHost(host).empty()) {
+ if (CanonicalizeHostWithoutNak(host).empty()) {
return false;
}
// Normalize any trailing '.' used for DNS suffix searches.
@@ -725,21 +758,21 @@ bool TransportSecurityState::GetStaticPKPState(std::string_view host,
}
}
-bool TransportSecurityState::GetSTSState(std::string_view host,
+bool TransportSecurityState::GetSTSState(const NetworkAnonymizationKey& nak, std::string_view host,
STSState* result) {
- return GetDynamicSTSState(host, result) || GetStaticSTSState(host, result);
+ return GetDynamicSTSState(nak, host, result) || GetStaticSTSState(host, result);
}
-bool TransportSecurityState::GetPKPState(std::string_view host,
+bool TransportSecurityState::GetPKPState(const NetworkAnonymizationKey& nak, std::string_view host,
PKPState* result) {
- return GetDynamicPKPState(host, result) || GetStaticPKPState(host, result);
+ return GetDynamicPKPState(nak, host, result) || GetStaticPKPState(host, result);
}
-bool TransportSecurityState::GetDynamicSTSState(std::string_view host,
+bool TransportSecurityState::GetDynamicSTSState(const NetworkAnonymizationKey& nak, std::string_view host,
STSState* result) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
- const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+ const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
if (canonicalized_host.empty())
return false;
@@ -776,11 +809,11 @@ bool TransportSecurityState::GetDynamicSTSState(std::string_view host,
return false;
}
-bool TransportSecurityState::GetDynamicPKPState(std::string_view host,
+bool TransportSecurityState::GetDynamicPKPState(const NetworkAnonymizationKey& nak, std::string_view host,
PKPState* result) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
- const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+ const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
if (canonicalized_host.empty())
return false;
diff --git a/net/http/transport_security_state.h b/net/http/transport_security_state.h
--- a/net/http/transport_security_state.h
+++ b/net/http/transport_security_state.h
@@ -247,6 +247,7 @@ class NET_EXPORT TransportSecurityState {
// As ShouldUpgradeToSSL(), but also returns whether the decision came from
// static or dynamic state, for metrics.
SSLUpgradeDecision GetSSLUpgradeDecision(
+ const NetworkAnonymizationKey& nak,
std::string_view host,
bool is_top_level_nav,
const NetLogWithSource& net_log = NetLogWithSource());
@@ -256,15 +257,16 @@ class NET_EXPORT TransportSecurityState {
// primary public interface; direct access to STS and PKP states is best
// left to tests. The caller needs to handle the optional pinning override
// when is_issued_by_known_root is false.
- bool ShouldSSLErrorsBeFatal(std::string_view host);
- bool ShouldUpgradeToSSL(std::string_view host,
+ bool ShouldSSLErrorsBeFatal(const NetworkAnonymizationKey& nak, std::string_view host);
+ bool ShouldUpgradeToSSL(const NetworkAnonymizationKey& nak, std::string_view host,
bool is_top_level_nav,
const NetLogWithSource& net_log = NetLogWithSource());
PKPStatus CheckPublicKeyPins(
std::string_view host,
bool is_issued_by_known_root,
- const std::vector<SHA256HashValue>& public_key_hashes);
- bool HasPublicKeyPins(std::string_view host);
+ const std::vector<SHA256HashValue>& public_key_hashes,
+ const NetworkAnonymizationKey& nak);
+ bool HasPublicKeyPins(const NetworkAnonymizationKey& nak, std::string_view host);
// Returns CT_REQUIREMENTS_NOT_MET if a connection violates CT policy
// requirements: that is, if a connection to |host|, using the validated
@@ -350,7 +352,7 @@ class NET_EXPORT TransportSecurityState {
//
// If an entry is deleted, the new state will be persisted through
// the Delegate (if any).
- bool DeleteDynamicDataForHost(std::string_view host);
+ bool DeleteDynamicDataForHost(const NetworkAnonymizationKey& nak, std::string_view host);
// Returns true and updates |*result| if |host| has dynamic or static
// HSTS/HPKP (respectively) state. If multiple entries match |host|, dynamic
@@ -360,8 +362,8 @@ class NET_EXPORT TransportSecurityState {
//
// Note that these methods are not const because they opportunistically remove
// entries that have expired.
- bool GetSTSState(std::string_view host, STSState* sts_result);
- bool GetPKPState(std::string_view host, PKPState* pkp_result);
+ bool GetSTSState(const NetworkAnonymizationKey& nak, std::string_view host, STSState* sts_result);
+ bool GetPKPState(const NetworkAnonymizationKey& nak, std::string_view host, PKPState* pkp_result);
// Returns true and updates |*result| iff |host| has static HSTS/HPKP
// (respectively) state. If multiple entries match |host|, the most specific
@@ -375,22 +377,24 @@ class NET_EXPORT TransportSecurityState {
//
// Note that these methods are not const because they opportunistically remove
// entries that have expired.
- bool GetDynamicSTSState(std::string_view host, STSState* result);
- bool GetDynamicPKPState(std::string_view host, PKPState* result);
+ bool GetDynamicSTSState(const NetworkAnonymizationKey& nak, std::string_view host, STSState* result);
+ bool GetDynamicPKPState(const NetworkAnonymizationKey& nak, std::string_view host, PKPState* result);
// Processes an HSTS header value from the host, adding entries to
// dynamic state if necessary.
- bool AddHSTSHeader(std::string_view host, std::string_view value);
+ bool AddHSTSHeader(const NetworkAnonymizationKey& nak, std::string_view host, std::string_view value);
// Adds explicitly-specified data as if it was processed from an
// HSTS header (used for net-internals and unit tests).
- void AddHSTS(std::string_view host,
+ void AddHSTS(const NetworkAnonymizationKey& nak,
+ std::string_view host,
base::Time expiry,
bool include_subdomains);
// Adds explicitly-specified data as if it was processed from an HPKP header.
// Note: dynamic PKP data is not persisted.
- void AddHPKP(std::string_view host,
+ void AddHPKP(const NetworkAnonymizationKey& nak,
+ std::string_view host,
base::Time expiry,
bool include_subdomains,
const HashValueVector& hashes);
@@ -432,7 +436,7 @@ class NET_EXPORT TransportSecurityState {
typedef std::map<HashedHost, STSState> STSStateMap;
typedef std::map<HashedHost, PKPState> PKPStateMap;
- base::DictValue NetLogUpgradeToSSLParam(std::string_view host);
+ base::DictValue NetLogUpgradeToSSLParam(const NetworkAnonymizationKey& nak, std::string_view host);
// IsBuildTimely returns true if the current build is new enough ensure that
// built in security information (i.e. HSTS preloading and pinning
@@ -442,7 +446,8 @@ class NET_EXPORT TransportSecurityState {
// Helper method for actually checking pins.
PKPStatus CheckPublicKeyPinsImpl(std::string_view host,
bool is_issued_by_known_root,
- const std::vector<SHA256HashValue>& hashes);
+ const std::vector<SHA256HashValue>& hashes,
+ const NetworkAnonymizationKey& network_anonymization_key);
// If a Delegate is present, notify it that the internal state has
// changed.
@@ -452,11 +457,13 @@ class NET_EXPORT TransportSecurityState {
// any previous state for the |host|, including static entries.
//
// The new state for |host| is persisted using the Delegate (if any).
- void AddHSTSInternal(std::string_view host,
+ void AddHSTSInternal(const NetworkAnonymizationKey& nak,
+ std::string_view host,
STSState::UpgradeMode upgrade_mode,
base::Time expiry,
bool include_subdomains);
- void AddHPKPInternal(std::string_view host,
+ void AddHPKPInternal(const NetworkAnonymizationKey& nak,
+ std::string_view host,
base::Time last_observed,
base::Time expiry,
bool include_subdomains,
diff --git a/net/quic/crypto/proof_verifier_chromium.cc b/net/quic/crypto/proof_verifier_chromium.cc
--- a/net/quic/crypto/proof_verifier_chromium.cc
+++ b/net/quic/crypto/proof_verifier_chromium.cc
@@ -409,7 +409,8 @@ int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) {
TransportSecurityState::PKPStatus pin_validity =
transport_security_state_->CheckPublicKeyPins(
hostname_, cert_verify_result.is_issued_by_known_root,
- cert_verify_result.public_key_hashes);
+ cert_verify_result.public_key_hashes,
+ proof_verifier_->network_anonymization_key_);
switch (pin_validity) {
case TransportSecurityState::PKPStatus::VIOLATED:
result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
@@ -434,7 +435,7 @@ int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) {
verify_details_->is_fatal_cert_error =
IsCertStatusError(cert_status) &&
result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED &&
- transport_security_state_->ShouldSSLErrorsBeFatal(hostname_);
+ transport_security_state_->ShouldSSLErrorsBeFatal(proof_verifier_->network_anonymization_key_, hostname_);
if (result != OK) {
std::string error_string = ErrorToString(result);
diff --git a/net/quic/quic_chromium_client_session.cc b/net/quic/quic_chromium_client_session.cc
--- a/net/quic/quic_chromium_client_session.cc
+++ b/net/quic/quic_chromium_client_session.cc
@@ -1563,7 +1563,7 @@ bool QuicChromiumClientSession::CanPool(
return SpdySession::CanPool(transport_security_state_, ssl_info,
*ssl_config_service_, session_key_.host(),
- hostname);
+ hostname, session_key_.network_anonymization_key());
}
bool QuicChromiumClientSession::ShouldCreateIncomingStream(
diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
@@ -1259,7 +1259,8 @@ ssl_verify_result_t SSLClientSocketImpl::HandleVerifyResult() {
context_->transport_security_state()->CheckPublicKeyPins(
host_and_port_.host(),
server_cert_verify_result_.is_issued_by_known_root,
- server_cert_verify_result_.public_key_hashes);
+ server_cert_verify_result_.public_key_hashes,
+ ssl_config_.network_anonymization_key);
switch (pin_validity) {
case TransportSecurityState::PKPStatus::VIOLATED:
server_cert_verify_result_.cert_status |=
@@ -1279,7 +1280,7 @@ ssl_verify_result_t SSLClientSocketImpl::HandleVerifyResult() {
IsCertStatusError(server_cert_verify_result_.cert_status) &&
result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED &&
context_->transport_security_state()->ShouldSSLErrorsBeFatal(
- host_and_port_.host());
+ ssl_config_.network_anonymization_key, host_and_port_.host());
if (IsCertificateError(result)) {
if (!GetECHNameOverride().empty()) {
diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -724,7 +724,8 @@ bool SpdySession::CanPool(TransportSecurityState* transport_security_state,
const SSLInfo& ssl_info,
const SSLConfigService& ssl_config_service,
std::string_view old_hostname,
- std::string_view new_hostname) {
+ std::string_view new_hostname,
+ const net::NetworkAnonymizationKey& network_anonymization_key) {
// Pooling is prohibited if the server cert is not valid for the new domain,
// and for connections on which client certs were sent. It is also prohibited
// when channel ID was sent if the hosts are from different eTLDs+1.
@@ -742,7 +743,7 @@ bool SpdySession::CanPool(TransportSecurityState* transport_security_state,
if (transport_security_state->CheckPublicKeyPins(
new_hostname, ssl_info.is_issued_by_known_root,
- ssl_info.public_key_hashes) ==
+ ssl_info.public_key_hashes, network_anonymization_key) ==
TransportSecurityState::PKPStatus::VIOLATED) {
return false;
}
@@ -1007,7 +1008,8 @@ bool SpdySession::VerifyDomainAuthentication(std::string_view domain) const {
return true; // This is not a secure session, so all domains are okay.
return CanPool(transport_security_state_, ssl_info, *ssl_config_service_,
- host_port_pair().host(), domain);
+ host_port_pair().host(), domain,
+ spdy_session_key_.network_anonymization_key());
}
void SpdySession::EnqueueStreamWrite(
@@ -3173,7 +3175,8 @@ void SpdySession::OnAltSvc(
return;
}
if (!CanPool(transport_security_state_, ssl_info, *ssl_config_service_,
- host_port_pair().host(), gurl.host())) {
+ host_port_pair().host(), gurl.host(),
+ spdy_session_key_.network_anonymization_key())) {
return;
}
scheme_host_port = url::SchemeHostPort(gurl);
diff --git a/net/spdy/spdy_session.h b/net/spdy/spdy_session.h
--- a/net/spdy/spdy_session.h
+++ b/net/spdy/spdy_session.h
@@ -325,7 +325,8 @@ class NET_EXPORT SpdySession
const SSLInfo& ssl_info,
const SSLConfigService& ssl_config_service,
std::string_view old_hostname,
- std::string_view new_hostname);
+ std::string_view new_hostname,
+ const net::NetworkAnonymizationKey& network_anonymization_key);
// Create a new SpdySession.
// |spdy_session_key| is the host/port that this session connects to, privacy
diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/url_request_context_builder.cc
--- a/net/url_request/url_request_context_builder.cc
+++ b/net/url_request/url_request_context_builder.cc
@@ -406,20 +406,6 @@ std::unique_ptr<URLRequestContext> URLRequestContextBuilder::Build() {
context->set_transport_security_state(
std::make_unique<TransportSecurityState>(hsts_policy_bypass_list_));
- if (!transport_security_persister_file_path_.empty()) {
- // Use a low priority because saving this should not block anything
- // user-visible. Block shutdown to ensure it does get persisted to disk,
- // since it contains security-relevant information.
- scoped_refptr<base::SequencedTaskRunner> task_runner(
- base::ThreadPool::CreateSequencedTaskRunner(
- {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
- base::TaskShutdownBehavior::BLOCK_SHUTDOWN}));
-
- context->set_transport_security_persister(
- std::make_unique<TransportSecurityPersister>(
- context->transport_security_state(), task_runner,
- transport_security_persister_file_path_));
- }
if (http_server_properties_) {
context->set_http_server_properties(std::move(http_server_properties_));
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -373,6 +373,7 @@ std::unique_ptr<URLRequestJob> URLRequestHttpJob::Create(URLRequest* request) {
if (TransportSecurityState* hsts =
request->context()->transport_security_state()) {
upgrade_decision = hsts->GetSSLUpgradeDecision(
+ request->isolation_info().network_anonymization_key(),
url.GetHost(),
/*is_top_level_nav=*/
request->isolation_info().IsOutermostMainFrameRequest(),
@@ -1234,7 +1235,7 @@ void URLRequestHttpJob::ProcessStrictTransportSecurityHeader() {
std::optional<std::string_view> value;
if ((value =
headers->EnumerateHeader(nullptr, "Strict-Transport-Security"))) {
- security_state->AddHSTSHeader(request_info_.url.GetHost(), *value);
+ security_state->AddHSTSHeader(request_info_.network_anonymization_key, request_info_.url.GetHost(), *value);
}
}
@@ -1314,7 +1315,7 @@ void URLRequestHttpJob::OnStartCompleted(int result) {
TransportSecurityState* state = context->transport_security_state();
NotifySSLCertificateError(
result, transaction_->GetResponseInfo()->ssl_info,
- state->ShouldSSLErrorsBeFatal(request_info_.url.GetHost()) &&
+ state->ShouldSSLErrorsBeFatal(request_->isolation_info().network_anonymization_key(), request_info_.url.GetHost()) &&
result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED);
} else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
NotifyCertificateRequested(
diff --git a/services/network/network_context.cc b/services/network/network_context.cc
--- a/services/network/network_context.cc
+++ b/services/network/network_context.cc
@@ -2195,6 +2195,7 @@ void NetworkContext::CreateHostResolver(
void NetworkContext::VerifyCertInternal(
const scoped_refptr<net::X509Certificate>& certificate,
const net::HostPortPair& host_port,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
const std::string& ocsp_result,
const std::string& sct_list,
CTVerificationMode ct_verification_mode,
@@ -2206,6 +2207,7 @@ void NetworkContext::VerifyCertInternal(
pending_cert_verify->result = std::make_unique<net::CertVerifyResult>();
pending_cert_verify->certificate = certificate;
pending_cert_verify->host_port = host_port;
+ pending_cert_verify->network_anonymization_key = network_anonymization_key;
net::CertVerifier* cert_verifier =
g_cert_verifier_for_testing ? g_cert_verifier_for_testing
: url_request_context_->cert_verifier();
@@ -2236,20 +2238,22 @@ void NetworkContext::VerifyCertInternal(
void NetworkContext::VerifyCert(
const scoped_refptr<net::X509Certificate>& certificate,
const net::HostPortPair& host_port,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
const std::string& ocsp_result,
const std::string& sct_list,
VerifyCertCallback callback) {
- VerifyCertInternal(certificate, host_port, ocsp_result, sct_list,
+ VerifyCertInternal(certificate, host_port, network_anonymization_key, ocsp_result, sct_list,
CTVerificationMode::kTlsCertificate, std::move(callback));
}
void NetworkContext::VerifyCertForSignedExchange(
const scoped_refptr<net::X509Certificate>& certificate,
const net::HostPortPair& host_port,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
const std::string& ocsp_result,
const std::string& sct_list,
VerifyCertCallback callback) {
- VerifyCertInternal(certificate, host_port, ocsp_result, sct_list,
+ VerifyCertInternal(certificate, host_port, network_anonymization_key, ocsp_result, sct_list,
CTVerificationMode::kSignedExchange, std::move(callback));
}
@@ -2290,17 +2294,19 @@ void NetworkContext::SetCorsOriginAccessListsForOrigin(
std::move(callback).Run();
}
-void NetworkContext::AddHSTS(const std::string& host,
+void NetworkContext::AddHSTS(const net::NetworkAnonymizationKey& nak,
+ const std::string& host,
base::Time expiry,
bool include_subdomains,
AddHSTSCallback callback) {
net::TransportSecurityState* state =
url_request_context_->transport_security_state();
- state->AddHSTS(host, expiry, include_subdomains);
+ state->AddHSTS(nak, host, expiry, include_subdomains);
std::move(callback).Run();
}
-void NetworkContext::IsHSTSActiveForHost(const std::string& host,
+void NetworkContext::IsHSTSActiveForHost(const net::NetworkAnonymizationKey& nak,
+ const std::string& host,
bool is_top_level_nav,
IsHSTSActiveForHostCallback callback) {
net::TransportSecurityState* security_state =
@@ -2312,10 +2318,10 @@ void NetworkContext::IsHSTSActiveForHost(const std::string& host,
}
std::move(callback).Run(
- security_state->ShouldUpgradeToSSL(host, is_top_level_nav));
+ security_state->ShouldUpgradeToSSL(nak, host, is_top_level_nav));
}
-void NetworkContext::GetHSTSState(const std::string& domain,
+void NetworkContext::GetHSTSState(const net::NetworkAnonymizationKey& nak, const std::string& domain,
GetHSTSStateCallback callback) {
base::DictValue result;
@@ -2353,10 +2359,10 @@ void NetworkContext::GetHSTSState(const std::string& domain,
net::TransportSecurityState::STSState dynamic_sts_state;
net::TransportSecurityState::PKPState dynamic_pkp_state;
bool found_sts_dynamic = transport_security_state->GetDynamicSTSState(
- domain, &dynamic_sts_state);
+ nak, domain, &dynamic_sts_state);
bool found_pkp_dynamic = transport_security_state->GetDynamicPKPState(
- domain, &dynamic_pkp_state);
+ nak, domain, &dynamic_pkp_state);
if (found_sts_dynamic) {
result.Set("dynamic_upgrade_mode",
static_cast<int>(dynamic_sts_state.upgrade_mode));
@@ -2394,6 +2400,7 @@ void NetworkContext::GetHSTSState(const std::string& domain,
}
void NetworkContext::DeleteDynamicDataForHost(
+ const net::NetworkAnonymizationKey& nak,
const std::string& host,
DeleteDynamicDataForHostCallback callback) {
net::TransportSecurityState* transport_security_state =
@@ -2404,7 +2411,7 @@ void NetworkContext::DeleteDynamicDataForHost(
}
std::move(callback).Run(
- transport_security_state->DeleteDynamicDataForHost(host));
+ transport_security_state->DeleteDynamicDataForHost(nak, host));
}
void NetworkContext::EnableStaticKeyPinningForTesting(
@@ -2463,7 +2470,7 @@ void NetworkContext::PreconnectSockets(
DCHECK(!require_network_anonymization_key_ ||
!network_anonymization_key.IsEmpty());
- GURL url = GetHSTSRedirectForPreconnect(original_url);
+ GURL url = GetHSTSRedirectForPreconnect(network_anonymization_key, original_url);
// |PreconnectSockets| may receive arguments from the renderer, which is not
// guaranteed to validate them.
@@ -3316,7 +3323,9 @@ void NetworkContext::OnConnectionError() {
}
}
-GURL NetworkContext::GetHSTSRedirectForPreconnect(const GURL& original_url) {
+GURL NetworkContext::GetHSTSRedirectForPreconnect(
+ const net::NetworkAnonymizationKey& network_anonymization_key,
+ const GURL& original_url) {
// TODO(lilyhoughton) This needs to be gotten rid of once explicit
// construction with a URLRequestContext is no longer supported.
@@ -3342,6 +3351,7 @@ GURL NetworkContext::GetHSTSRedirectForPreconnect(const GURL& original_url) {
// top-level navigation so we need to disallow HSTS upgrades for every
// preconnect.
if (!url_request_context_->transport_security_state()->ShouldUpgradeToSSL(
+ network_anonymization_key,
original_url.GetHost(), /*is_top_level_nav=*/false)) {
RecordHSTSPreconnectUpgradeReason(
HSTSRedirectUpgradeReason::kNotUpgradedNoHSTSPin);
@@ -3403,7 +3413,8 @@ void NetworkContext::OnVerifyCertComplete(uint64_t cert_verify_id, int result) {
url_request_context_->transport_security_state()->CheckPublicKeyPins(
pending_cert_verify->host_port.host(),
pending_cert_verify->result->is_issued_by_known_root,
- pending_cert_verify->result->public_key_hashes);
+ pending_cert_verify->result->public_key_hashes,
+ pending_cert_verify->network_anonymization_key);
switch (pin_validity) {
case net::TransportSecurityState::PKPStatus::VIOLATED:
pending_cert_verify->result->cert_status |=
diff --git a/services/network/network_context.h b/services/network/network_context.h
--- a/services/network/network_context.h
+++ b/services/network/network_context.h
@@ -429,12 +429,14 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
mojo::PendingReceiver<mojom::HostResolver> receiver) override;
void VerifyCert(const scoped_refptr<net::X509Certificate>& certificate,
const net::HostPortPair& host_port,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
const std::string& ocsp_result,
const std::string& sct_list,
VerifyCertCallback callback) override;
void VerifyCertForSignedExchange(
const scoped_refptr<net::X509Certificate>& certificate,
const net::HostPortPair& host_port,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
const std::string& ocsp_result,
const std::string& sct_list,
VerifyCertCallback callback) override;
@@ -443,16 +445,18 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
const std::string& hostname,
const scoped_refptr<net::X509Certificate>& tls_certificate,
Verify2QwacCertBindingCallback callback) override;
- void AddHSTS(const std::string& host,
+ void AddHSTS(const net::NetworkAnonymizationKey& nak,
+ const std::string& host,
base::Time expiry,
bool include_subdomains,
AddHSTSCallback callback) override;
- void IsHSTSActiveForHost(const std::string& host,
+ void IsHSTSActiveForHost(const net::NetworkAnonymizationKey& nak, const std::string& host,
bool is_top_level_nav,
IsHSTSActiveForHostCallback callback) override;
- void GetHSTSState(const std::string& domain,
+ void GetHSTSState(const net::NetworkAnonymizationKey& nak, const std::string& domain,
GetHSTSStateCallback callback) override;
void DeleteDynamicDataForHost(
+ const net::NetworkAnonymizationKey& nak,
const std::string& host,
DeleteDynamicDataForHostCallback callback) override;
void SetCorsOriginAccessListsForOrigin(
@@ -826,7 +830,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
mojo::PendingRemote<mojom::CookieAccessObserver> cookie_observer,
net::FirstPartySetMetadata first_party_set_metadata);
- GURL GetHSTSRedirectForPreconnect(const GURL& original_url);
+ GURL GetHSTSRedirectForPreconnect(const net::NetworkAnonymizationKey& network_anonymization_key,
+ const GURL& original_url);
#if BUILDFLAG(IS_P2P_ENABLED)
void DestroySocketManager(P2PSocketManager* socket_manager);
@@ -838,6 +843,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
void VerifyCertInternal(
const scoped_refptr<net::X509Certificate>& certificate,
const net::HostPortPair& host_port,
+ const net::NetworkAnonymizationKey& network_anonymization_key,
const std::string& ocsp_result,
const std::string& sct_list,
CTVerificationMode ct_verification_mode,
@@ -1027,6 +1033,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
VerifyCertCallback callback;
scoped_refptr<net::X509Certificate> certificate;
net::HostPortPair host_port;
+ net::NetworkAnonymizationKey network_anonymization_key;
};
std::map<uint64_t, std::unique_ptr<PendingCertVerify>>
cert_verifier_requests_;
diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
--- a/services/network/public/mojom/network_context.mojom
+++ b/services/network/public/mojom/network_context.mojom
@@ -1583,6 +1583,7 @@ interface NetworkContext {
// Checks the given certificate against the CertVerifier and CTVerifier.
VerifyCert(X509Certificate certificate,
HostPortPair host_port,
+ NetworkAnonymizationKey network_anonymization_key,
string ocsp_response,
string sct_list)
=> (int32 error_code, CertVerifyResult cv_result, bool pkp_bypassed);
@@ -1591,6 +1592,7 @@ interface NetworkContext {
// This implementation is specific for use by Signed Exchange.
VerifyCertForSignedExchange(X509Certificate certificate,
HostPortPair host_port,
+ NetworkAnonymizationKey network_anonymization_key,
string ocsp_response,
string sct_list)
=> (int32 error_code, CertVerifyResult cv_result, bool pkp_bypassed);
@@ -1604,18 +1606,18 @@ interface NetworkContext {
// Adds explicitly-specified data as if it was processed from an
// HSTS header. Used by tests and implementation of chrome://net-internals.
- AddHSTS(string host, mojo_base.mojom.Time expiry, bool include_subdomains)
+ AddHSTS(NetworkAnonymizationKey nak, string host, mojo_base.mojom.Time expiry, bool include_subdomains)
=> ();
// Returns true if it is known that `host` has requested to always be
// accessed via HTTPS. `is_top_level_nav` indicates whether or not the query
// for the HSTS state is being made by a top-level/primary/outermost frame
// navigation request.
- IsHSTSActiveForHost(string host, bool is_top_level_nav) => (bool result);
+ IsHSTSActiveForHost(NetworkAnonymizationKey nak, string host, bool is_top_level_nav) => (bool result);
// Retrieve values from the HSTS state from the associated contexts
// transport security state.
- GetHSTSState(string domain) => (mojo_base.mojom.DictionaryValue state);
+ GetHSTSState(NetworkAnonymizationKey nak, string domain) => (mojo_base.mojom.DictionaryValue state);
// Sets allowed and blocked origins respectively for the URLLoaderFactory
// consumers to access beyond the same-origin policy. The list is managed per
@@ -1634,7 +1636,7 @@ interface NetworkContext {
// Deletes any dynamic data stored for |host| from the transport
// security state. Returns true iff an entry was deleted.
// See net::TransportSecurityState::DeleteDynamicDataForHost for more detail.
- DeleteDynamicDataForHost(string host) => (bool result);
+ DeleteDynamicDataForHost(NetworkAnonymizationKey nak, string host) => (bool result);
// Sets whether the HTTP auth cache will be split the NetworkAnonymizationKey.
// Only affects server (not proxy) credentials. Whenever the effective value
--
Reference in New Issue View Git Blame Copy Permalink