network_context.cc 118 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "services/network/network_context.h"
  5. #include <memory>
  6. #include <string>
  7. #include <tuple>
  8. #include <utility>
  9. #include "base/barrier_closure.h"
  10. #include "base/base64.h"
  11. #include "base/bind.h"
  12. #include "base/build_time.h"
  13. #include "base/command_line.h"
  14. #include "base/containers/unique_ptr_adapters.h"
  15. #include "base/dcheck_is_on.h"
  16. #include "base/feature_list.h"
  17. #include "base/logging.h"
  18. #include "base/memory/ptr_util.h"
  19. #include "base/memory/ref_counted.h"
  20. #include "base/metrics/histogram_functions.h"
  21. #include "base/strings/string_number_conversions.h"
  22. #include "base/strings/utf_string_conversions.h"
  23. #include "base/task/current_thread.h"
  24. #include "base/task/sequenced_task_runner.h"
  25. #include "base/task/task_traits.h"
  26. #include "base/task/thread_pool.h"
  27. #include "base/threading/thread_task_runner_handle.h"
  28. #include "base/time/time.h"
  29. #include "build/build_config.h"
  30. #include "build/chromecast_buildflags.h"
  31. #include "build/chromeos_buildflags.h"
  32. #include "components/cookie_config/cookie_store_util.h"
  33. #include "components/domain_reliability/features.h"
  34. #include "components/domain_reliability/monitor.h"
  35. #include "components/network_session_configurator/browser/network_session_configurator.h"
  36. #include "components/network_session_configurator/common/network_switches.h"
  37. #include "components/prefs/json_pref_store.h"
  38. #include "components/prefs/pref_registry_simple.h"
  39. #include "components/prefs/pref_service.h"
  40. #include "components/prefs/pref_service_factory.h"
  41. #include "components/url_matcher/url_matcher.h"
  42. #include "components/url_matcher/url_util.h"
  43. #include "crypto/sha2.h"
  44. #include "mojo/public/cpp/bindings/pending_receiver.h"
  45. #include "net/base/features.h"
  46. #include "net/base/isolation_info.h"
  47. #include "net/base/load_flags.h"
  48. #include "net/base/net_errors.h"
  49. #include "net/base/network_delegate.h"
  50. #include "net/base/network_isolation_key.h"
  51. #include "net/base/port_util.h"
  52. #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
  53. #include "net/cert/caching_cert_verifier.h"
  54. #include "net/cert/cert_verifier.h"
  55. #include "net/cert/coalescing_cert_verifier.h"
  56. #include "net/cert_net/cert_net_fetcher_url_request.h"
  57. #include "net/cookies/cookie_access_delegate.h"
  58. #include "net/cookies/cookie_monster.h"
  59. #include "net/cookies/first_party_set_metadata.h"
  60. #include "net/dns/host_cache.h"
  61. #include "net/dns/mapped_host_resolver.h"
  62. #include "net/extras/sqlite/sqlite_persistent_cookie_store.h"
  63. #include "net/http/http_auth.h"
  64. #include "net/http/http_auth_handler_factory.h"
  65. #include "net/http/http_auth_preferences.h"
  66. #include "net/http/http_auth_scheme.h"
  67. #include "net/http/http_cache.h"
  68. #include "net/http/http_network_session.h"
  69. #include "net/http/http_request_headers.h"
  70. #include "net/http/http_server_properties.h"
  71. #include "net/http/http_transaction_factory.h"
  72. #include "net/net_buildflags.h"
  73. #include "net/proxy_resolution/configured_proxy_resolution_service.h"
  74. #include "net/proxy_resolution/proxy_config.h"
  75. #include "net/traffic_annotation/network_traffic_annotation.h"
  76. #include "net/url_request/report_sender.h"
  77. #include "net/url_request/static_http_user_agent_settings.h"
  78. #include "net/url_request/url_request.h"
  79. #include "net/url_request/url_request_context.h"
  80. #include "net/url_request/url_request_context_builder.h"
  81. #include "services/network/brokered_client_socket_factory.h"
  82. #include "services/network/cookie_manager.h"
  83. #include "services/network/cors/cors_url_loader_factory.h"
  84. #include "services/network/disk_cache/mojo_backend_file_operations_factory.h"
  85. #include "services/network/host_resolver.h"
  86. #include "services/network/http_auth_cache_copier.h"
  87. #include "services/network/http_server_properties_pref_delegate.h"
  88. #include "services/network/ignore_errors_cert_verifier.h"
  89. #include "services/network/is_browser_initiated.h"
  90. #include "services/network/net_log_exporter.h"
  91. #include "services/network/network_service.h"
  92. #include "services/network/network_service_memory_cache.h"
  93. #include "services/network/network_service_network_delegate.h"
  94. #include "services/network/network_service_proxy_delegate.h"
  95. #include "services/network/proxy_config_service_mojo.h"
  96. #include "services/network/proxy_lookup_request.h"
  97. #include "services/network/proxy_resolving_socket_factory_mojo.h"
  98. #include "services/network/public/cpp/cert_verifier/mojo_cert_verifier.h"
  99. #include "services/network/public/cpp/content_security_policy/content_security_policy.h"
  100. #include "services/network/public/cpp/features.h"
  101. #include "services/network/public/cpp/network_switches.h"
  102. #include "services/network/public/cpp/parsed_headers.h"
  103. #include "services/network/public/mojom/network_context.mojom-forward.h"
  104. #include "services/network/public/mojom/network_context.mojom.h"
  105. #include "services/network/public/mojom/reporting_service.mojom.h"
  106. #include "services/network/public/mojom/trust_tokens.mojom-forward.h"
  107. #include "services/network/public/mojom/url_loader_factory.mojom.h"
  108. #include "services/network/resolve_host_request.h"
  109. #include "services/network/resource_scheduler/resource_scheduler_client.h"
  110. #include "services/network/restricted_cookie_manager.h"
  111. #include "services/network/session_cleanup_cookie_store.h"
  112. #include "services/network/ssl_config_service_mojo.h"
  113. #include "services/network/throttling/network_conditions.h"
  114. #include "services/network/throttling/throttling_controller.h"
  115. #include "services/network/throttling/throttling_network_transaction_factory.h"
  116. #include "services/network/trust_tokens/expiry_inspecting_record_expiry_delegate.h"
  117. #include "services/network/trust_tokens/in_memory_trust_token_persister.h"
  118. #include "services/network/trust_tokens/pending_trust_token_store.h"
  119. #include "services/network/trust_tokens/sqlite_trust_token_persister.h"
  120. #include "services/network/trust_tokens/suitable_trust_token_origin.h"
  121. #include "services/network/trust_tokens/trust_token_parameterization.h"
  122. #include "services/network/trust_tokens/trust_token_query_answerer.h"
  123. #include "services/network/trust_tokens/trust_token_store.h"
  124. #include "services/network/url_loader.h"
  125. #include "services/network/url_request_context_builder_mojo.h"
  126. #include "services/network/web_transport.h"
  127. #include "third_party/abseil-cpp/absl/types/optional.h"
  128. #include "url/gurl.h"
  129. #if BUILDFLAG(IS_CT_SUPPORTED)
  130. #include "components/certificate_transparency/chrome_ct_policy_enforcer.h"
  131. #include "components/certificate_transparency/chrome_require_ct_delegate.h"
  132. #include "components/certificate_transparency/ct_known_logs.h"
  133. #include "net/cert/cert_and_ct_verifier.h"
  134. #include "net/cert/ct_log_verifier.h"
  135. #include "net/cert/multi_log_ct_verifier.h"
  136. #include "services/network/ct_log_list_distributor.h"
  137. #include "services/network/expect_ct_reporter.h"
  138. #include "services/network/sct_auditing/sct_auditing_cache.h"
  139. #include "services/network/sct_auditing/sct_auditing_handler.h"
  140. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  141. #if BUILDFLAG(IS_CHROMEOS)
  142. #include "services/network/cert_verifier_with_trust_anchors.h"
  143. #endif // BUILDFLAG(IS_CHROMEOS)
  144. #if !BUILDFLAG(IS_IOS)
  145. #include "services/network/websocket_factory.h"
  146. #endif // !BUILDFLAG(IS_IOS)
  147. #if BUILDFLAG(ENABLE_REPORTING)
  148. #include "net/base/http_user_agent_settings.h"
  149. #include "net/extras/sqlite/sqlite_persistent_reporting_and_nel_store.h"
  150. #include "net/network_error_logging/network_error_logging_service.h"
  151. #include "net/reporting/reporting_browsing_data_remover.h"
  152. #include "net/reporting/reporting_policy.h"
  153. #include "net/reporting/reporting_service.h"
  154. #endif // BUILDFLAG(ENABLE_REPORTING)
  155. #if BUILDFLAG(ENABLE_MDNS)
  156. #include "services/network/mdns_responder.h"
  157. #endif // BUILDFLAG(ENABLE_MDNS)
  158. #if BUILDFLAG(IS_P2P_ENABLED)
  159. #include "services/network/p2p/socket_manager.h"
  160. #endif // BUILDFLAG(IS_P2P_ENABLED)
  161. #if BUILDFLAG(IS_ANDROID)
  162. #include "base/android/application_status_listener.h"
  163. #endif // BUILDFLAG(IS_ANDROID)
  164. namespace network {
  165. namespace {
  166. #if BUILDFLAG(IS_CT_SUPPORTED)
  167. // A Base-64 encoded DER certificate for use in test Expect-CT reports. The
  168. // contents of the certificate don't matter.
  169. const char kTestReportCert[] =
  170. "MIIDvzCCAqegAwIBAgIBAzANBgkqhkiG9w0BAQsFADBjMQswCQYDVQQGEwJVUzET"
  171. "MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEQMA4G"
  172. "A1UECgwHVGVzdCBDQTEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTE3MDYwNTE3"
  173. "MTA0NloXDTI3MDYwMzE3MTA0NlowYDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNh"
  174. "bGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEDAOBgNVBAoMB1Rlc3Qg"
  175. "Q0ExEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC"
  176. "AQoCggEBALS/0pcz5RNbd2W9cxp1KJtHWea3MOhGM21YW9ofCv/k5C3yHfiJ6GQu"
  177. "9sPN16OO1/fN59gOEMPnVtL85ebTTuL/gk0YY4ewo97a7wo3e6y1t0PO8gc53xTp"
  178. "w6RBPn5oRzSbe2HEGOYTzrO0puC6A+7k6+eq9G2+l1uqBpdQAdB4uNaSsOTiuUOI"
  179. "ta4UZH1ScNQFHAkl1eJPyaiC20Exw75EbwvU/b/B7tlivzuPtQDI0d9dShOtceRL"
  180. "X9HZckyD2JNAv2zNL2YOBNa5QygkySX9WXD+PfKpCk7Cm8TenldeXRYl5ni2REkp"
  181. "nfa/dPuF1g3xZVjyK9aPEEnIAC2I4i0CAwEAAaOBgDB+MAwGA1UdEwEB/wQCMAAw"
  182. "HQYDVR0OBBYEFODc4C8HiHQ6n9Mwo3GK+dal5aZTMB8GA1UdIwQYMBaAFJsmC4qY"
  183. "qbsduR8c4xpAM+2OF4irMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAP"
  184. "BgNVHREECDAGhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQB6FEQuUDRcC5jkX3aZ"
  185. "uuTeZEqMVL7JXgvgFqzXsPb8zIdmxr/tEDfwXx2qDf2Dpxts7Fq4vqUwimK4qV3K"
  186. "7heLnWV2+FBvV1eeSfZ7AQj+SURkdlyo42r41+t13QUf+Z0ftR9266LSWLKrukeI"
  187. "Mxk73hOkm/u8enhTd00dy/FN9dOFBFHseVMspWNxIkdRILgOmiyfQNRgxNYdOf0e"
  188. "EfELR8Hn6WjZ8wAbvO4p7RTrzu1c/RZ0M+NLkID56Brbl70GC2h5681LPwAOaZ7/"
  189. "mWQ5kekSyJjmLfF12b+h9RVAt5MrXZgk2vNujssgGf4nbWh4KZyQ6qrs778ZdDLm"
  190. "yfUn";
  191. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  192. net::CertVerifier* g_cert_verifier_for_testing = nullptr;
  193. // A CertVerifier that forwards all requests to |g_cert_verifier_for_testing|.
  194. // This is used to allow NetworkContexts to have their own
  195. // std::unique_ptr<net::CertVerifier> while forwarding calls to the shared
  196. // verifier.
  197. class WrappedTestingCertVerifier : public net::CertVerifier {
  198. public:
  199. ~WrappedTestingCertVerifier() override = default;
  200. // CertVerifier implementation
  201. int Verify(const RequestParams& params,
  202. net::CertVerifyResult* verify_result,
  203. net::CompletionOnceCallback callback,
  204. std::unique_ptr<Request>* out_req,
  205. const net::NetLogWithSource& net_log) override {
  206. verify_result->Reset();
  207. if (!g_cert_verifier_for_testing)
  208. return net::ERR_FAILED;
  209. return g_cert_verifier_for_testing->Verify(
  210. params, verify_result, std::move(callback), out_req, net_log);
  211. }
  212. void SetConfig(const Config& config) override {
  213. if (!g_cert_verifier_for_testing)
  214. return;
  215. g_cert_verifier_for_testing->SetConfig(config);
  216. }
  217. };
  218. // Predicate function to determine if the given |domain| matches the
  219. // |filter_type| and |filter_domains| from a |mojom::ClearDataFilter|.
  220. bool MatchesDomainFilter(mojom::ClearDataFilter_Type filter_type,
  221. std::set<std::string> filter_domains,
  222. const std::string& domain) {
  223. bool found_domain = filter_domains.find(domain) != filter_domains.end();
  224. return (filter_type == mojom::ClearDataFilter_Type::DELETE_MATCHES) ==
  225. found_domain;
  226. }
  227. // Returns a callback that checks if a domain matches the |filter|. |filter|
  228. // must contain no origins. A null filter matches everything.
  229. base::RepeatingCallback<bool(const std::string& host_name)> MakeDomainFilter(
  230. mojom::ClearDataFilter* filter) {
  231. if (!filter)
  232. return base::BindRepeating([](const std::string&) { return true; });
  233. DCHECK(filter->origins.empty())
  234. << "Origin filtering not allowed in a domain-only filter";
  235. std::set<std::string> filter_domains;
  236. filter_domains.insert(filter->domains.begin(), filter->domains.end());
  237. return base::BindRepeating(&MatchesDomainFilter, filter->type,
  238. std::move(filter_domains));
  239. }
  240. // Predicate function to determine if the given |origin| matches the
  241. // |filter_type|, |filter_domains| and |filter_origins| from a
  242. // |mojom::ClearDataFilter|.
  243. bool MatchesOriginFilter(mojom::ClearDataFilter_Type filter_type,
  244. std::set<std::string> filter_domains,
  245. std::set<url::Origin> filter_origins,
  246. const url::Origin& origin) {
  247. std::string url_registrable_domain =
  248. net::registry_controlled_domains::GetDomainAndRegistry(
  249. origin, net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
  250. bool found_domain =
  251. (filter_domains.find(url_registrable_domain != ""
  252. ? url_registrable_domain
  253. : origin.host()) != filter_domains.end());
  254. bool found_origin = (filter_origins.find(origin) != filter_origins.end());
  255. return (filter_type == mojom::ClearDataFilter_Type::DELETE_MATCHES) ==
  256. (found_domain || found_origin);
  257. }
  258. // Builds a generic Origin-matching predicate function based on |filter|. If
  259. // |filter| is null, creates an always-true predicate.
  260. base::RepeatingCallback<bool(const url::Origin&)> BuildOriginFilter(
  261. mojom::ClearDataFilterPtr filter) {
  262. if (!filter) {
  263. return base::BindRepeating([](const url::Origin&) { return true; });
  264. }
  265. std::set<std::string> filter_domains;
  266. filter_domains.insert(filter->domains.begin(), filter->domains.end());
  267. std::set<url::Origin> filter_origins;
  268. filter_origins.insert(filter->origins.begin(), filter->origins.end());
  269. return base::BindRepeating(&MatchesOriginFilter, filter->type,
  270. std::move(filter_domains),
  271. std::move(filter_origins));
  272. }
  273. #if BUILDFLAG(IS_ANDROID)
  274. class NetworkContextApplicationStatusListener
  275. : public base::android::ApplicationStatusListener {
  276. public:
  277. // base::android::ApplicationStatusListener implementation:
  278. void SetCallback(const ApplicationStateChangeCallback& callback) override {
  279. DCHECK(!callback_);
  280. DCHECK(callback);
  281. callback_ = callback;
  282. }
  283. void Notify(base::android::ApplicationState state) override {
  284. if (callback_)
  285. callback_.Run(state);
  286. }
  287. private:
  288. ApplicationStateChangeCallback callback_;
  289. };
  290. #endif // BUILDFLAG(IS_ANDROID)
  291. struct TestVerifyCertState {
  292. net::CertVerifyResult result;
  293. std::unique_ptr<net::CertVerifier::Request> request;
  294. };
  295. void TestVerifyCertCallback(
  296. std::unique_ptr<TestVerifyCertState> request,
  297. NetworkContext::VerifyCertificateForTestingCallback callback,
  298. int result) {
  299. std::move(callback).Run(result);
  300. }
  301. std::string HashesToBase64String(const net::HashValueVector& hashes) {
  302. std::string str;
  303. for (size_t i = 0; i != hashes.size(); ++i) {
  304. if (i != 0)
  305. str += ",";
  306. str += hashes[i].ToString();
  307. }
  308. return str;
  309. }
  310. #if BUILDFLAG(IS_CT_SUPPORTED)
  311. // SCTAuditingDelegate is an implementation of the delegate interface that is
  312. // aware of per-NetworkContext details (to allow the cache to notify the
  313. // associated NetworkContextClient of new reports, and to apply
  314. // per-NetworkContext enabled/disabled status for the auditing feature).
  315. class SCTAuditingDelegate : public net::SCTAuditingDelegate {
  316. public:
  317. explicit SCTAuditingDelegate(const base::WeakPtr<NetworkContext>& context);
  318. ~SCTAuditingDelegate() override;
  319. // net::SCTAuditingDelegate:
  320. void MaybeEnqueueReport(
  321. const net::HostPortPair& host_port_pair,
  322. const net::X509Certificate* validated_certificate_chain,
  323. const net::SignedCertificateTimestampAndStatusList&
  324. signed_certificate_timestamps) override;
  325. private:
  326. base::WeakPtr<NetworkContext> context_;
  327. };
  328. SCTAuditingDelegate::SCTAuditingDelegate(
  329. const base::WeakPtr<NetworkContext>& context)
  330. : context_(context) {}
  331. SCTAuditingDelegate::~SCTAuditingDelegate() = default;
  332. void SCTAuditingDelegate::MaybeEnqueueReport(
  333. const net::HostPortPair& host_port_pair,
  334. const net::X509Certificate* validated_certificate_chain,
  335. const net::SignedCertificateTimestampAndStatusList&
  336. signed_certificate_timestamps) {
  337. if (!context_)
  338. return;
  339. context_->MaybeEnqueueSCTReport(host_port_pair, validated_certificate_chain,
  340. signed_certificate_timestamps);
  341. }
  342. // Filters `log_list` for disqualified or Google-operated logs,
  343. // returning them as sorted vectors in `disqualified_logs` and
  344. // `operated_by_google_logs` suitable for use with a `CTPolicyEnforcer`.
  345. void GetCTPolicyConfigForCTLogInfo(
  346. const std::vector<mojom::CTLogInfoPtr>& log_list,
  347. std::vector<std::pair<std::string, base::Time>>* disqualified_logs,
  348. std::vector<std::string>* operated_by_google_logs,
  349. std::map<std::string, certificate_transparency::OperatorHistoryEntry>*
  350. operator_history) {
  351. for (const auto& log : log_list) {
  352. std::string log_id = crypto::SHA256HashString(log->public_key);
  353. if (log->operated_by_google || log->disqualified_at) {
  354. if (log->operated_by_google)
  355. operated_by_google_logs->push_back(log_id);
  356. if (log->disqualified_at) {
  357. disqualified_logs->emplace_back(log_id, log->disqualified_at.value());
  358. }
  359. }
  360. certificate_transparency::OperatorHistoryEntry entry;
  361. entry.current_operator_ = log->current_operator;
  362. for (const auto& previous_operator : log->previous_operators) {
  363. entry.previous_operators_.emplace_back(previous_operator->name,
  364. previous_operator->end_time);
  365. }
  366. (*operator_history)[log_id] = entry;
  367. }
  368. std::sort(std::begin(*operated_by_google_logs),
  369. std::end(*operated_by_google_logs));
  370. std::sort(std::begin(*disqualified_logs), std::end(*disqualified_logs));
  371. }
  372. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  373. // Obtains a full data file path from a NetworkContextFilePaths, a class member
  374. // pointer to the data file. If valid, then returns true and places the full
  375. // path into `full_path` otherwise returns false.
  376. bool GetFullDataFilePath(
  377. const mojom::NetworkContextFilePathsPtr& file_paths,
  378. absl::optional<base::FilePath> network::mojom::NetworkContextFilePaths::*
  379. field_name,
  380. base::FilePath& full_path) {
  381. if (!file_paths)
  382. return false;
  383. absl::optional<base::FilePath> relative_file_path =
  384. file_paths.get()->*field_name;
  385. if (!relative_file_path.has_value())
  386. return false;
  387. // Path to a data file should always be a plain filename.
  388. DCHECK_EQ(relative_file_path->BaseName(), *relative_file_path);
  389. full_path =
  390. file_paths->data_directory.path().Append(relative_file_path->value());
  391. return true;
  392. }
  393. } // namespace
  394. constexpr uint32_t NetworkContext::kMaxOutstandingRequestsPerProcess;
  395. NetworkContext::PendingCertVerify::PendingCertVerify() = default;
  396. NetworkContext::PendingCertVerify::~PendingCertVerify() = default;
  397. NetworkContext::NetworkContext(
  398. NetworkService* network_service,
  399. mojo::PendingReceiver<mojom::NetworkContext> receiver,
  400. mojom::NetworkContextParamsPtr params,
  401. OnConnectionCloseCallback on_connection_close_callback)
  402. : NetworkContext(base::PassKey<NetworkContext>(),
  403. network_service,
  404. std::move(receiver),
  405. std::move(params),
  406. std::move(on_connection_close_callback),
  407. OnURLRequestContextBuilderConfiguredCallback()) {}
  408. // net::NetworkDelegate that wraps
  409. NetworkContext::NetworkContext(
  410. base::PassKey<NetworkContext> pass_key,
  411. NetworkService* network_service,
  412. mojo::PendingReceiver<mojom::NetworkContext> receiver,
  413. mojom::NetworkContextParamsPtr params,
  414. OnConnectionCloseCallback on_connection_close_callback,
  415. OnURLRequestContextBuilderConfiguredCallback
  416. on_url_request_context_builder_configured)
  417. : network_service_(network_service),
  418. url_request_context_(nullptr),
  419. #if BUILDFLAG(ENABLE_REPORTING)
  420. is_observing_reporting_service_(false),
  421. #endif // BUILDFLAG(ENABLE_REPORTING)
  422. params_(std::move(params)),
  423. on_connection_close_callback_(std::move(on_connection_close_callback)),
  424. #if BUILDFLAG(IS_ANDROID)
  425. app_status_listener_(
  426. std::make_unique<NetworkContextApplicationStatusListener>()),
  427. #endif // BUILDFLAG(IS_ANDROID)
  428. receiver_(this, std::move(receiver)),
  429. first_party_sets_access_delegate_(
  430. std::move(params_->first_party_sets_access_delegate_receiver),
  431. std::move(params_->first_party_sets_access_delegate_params),
  432. network_service_->first_party_sets_manager()),
  433. cors_preflight_controller_(network_service),
  434. cors_non_wildcard_request_headers_support_(base::FeatureList::IsEnabled(
  435. features::kCorsNonWildcardRequestHeadersSupport)) {
  436. #if BUILDFLAG(IS_WIN) && DCHECK_IS_ON()
  437. if (params_->file_paths) {
  438. DCHECK(params_->win_permissions_set)
  439. << "Permissions not set on files. Network context should be created "
  440. "using CreateNetworkContextInNetworkService rather than directly on "
  441. "the network service.";
  442. }
  443. #endif // BUILDFLAG(IS_WIN) && DCHECK_IS_ON()
  444. #if BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  445. if (params_->file_paths) {
  446. EnsureMounted(&params_->file_paths->data_directory);
  447. }
  448. if (params_->http_cache_directory) {
  449. EnsureMounted(&*params_->http_cache_directory);
  450. }
  451. #endif // BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  452. mojo::PendingRemote<mojom::URLLoaderFactory>
  453. url_loader_factory_for_cert_net_fetcher;
  454. mojo::PendingReceiver<mojom::URLLoaderFactory>
  455. url_loader_factory_for_cert_net_fetcher_receiver =
  456. url_loader_factory_for_cert_net_fetcher
  457. .InitWithNewPipeAndPassReceiver();
  458. scoped_refptr<SessionCleanupCookieStore> session_cleanup_cookie_store =
  459. MakeSessionCleanupCookieStore();
  460. url_request_context_owner_ = MakeURLRequestContext(
  461. std::move(url_loader_factory_for_cert_net_fetcher),
  462. session_cleanup_cookie_store,
  463. std::move(on_url_request_context_builder_configured));
  464. url_request_context_ = url_request_context_owner_.url_request_context.get();
  465. cookie_manager_ = std::make_unique<CookieManager>(
  466. url_request_context_, &first_party_sets_access_delegate_,
  467. std::move(session_cleanup_cookie_store),
  468. std::move(params_->cookie_manager_params));
  469. network_service_->RegisterNetworkContext(this);
  470. // Only register for destruction if |this| will be wholly lifetime-managed
  471. // by the NetworkService. In the other constructors, lifetime is shared with
  472. // other consumers, and thus self-deletion is not safe and can result in
  473. // double-frees.
  474. receiver_.set_disconnect_handler(base::BindOnce(
  475. &NetworkContext::OnConnectionError, base::Unretained(this)));
  476. socket_factory_ = std::make_unique<SocketFactory>(
  477. url_request_context_->net_log(), url_request_context_);
  478. resource_scheduler_ = std::make_unique<ResourceScheduler>();
  479. if (base::FeatureList::IsEnabled(features::kNetworkServiceMemoryCache))
  480. memory_cache_ = std::make_unique<NetworkServiceMemoryCache>(this);
  481. if (params_->http_auth_static_network_context_params) {
  482. http_auth_merged_preferences_.SetAllowDefaultCredentials(
  483. params_->http_auth_static_network_context_params
  484. ->allow_default_credentials);
  485. }
  486. InitializeCorsParams();
  487. SetSplitAuthCacheByNetworkIsolationKey(
  488. params_->split_auth_cache_by_network_isolation_key);
  489. #if BUILDFLAG(IS_CT_SUPPORTED)
  490. if (params_->ct_policy)
  491. SetCTPolicy(std::move(params_->ct_policy));
  492. base::FilePath sct_auditing_path;
  493. if (base::FeatureList::IsEnabled(features::kSCTAuditingPersistReports)) {
  494. GetFullDataFilePath(params_->file_paths,
  495. &network::mojom::NetworkContextFilePaths::
  496. sct_auditing_pending_reports_file_name,
  497. sct_auditing_path);
  498. }
  499. sct_auditing_handler_ =
  500. std::make_unique<SCTAuditingHandler>(this, sct_auditing_path);
  501. sct_auditing_handler()->SetMode(params_->sct_auditing_mode);
  502. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  503. #if BUILDFLAG(IS_ANDROID)
  504. if (params_->cookie_manager)
  505. GetCookieManager(std::move(params_->cookie_manager));
  506. #endif // BUILDFLAG(IS_ANDROID)
  507. CreateURLLoaderFactoryForCertNetFetcher(
  508. std::move(url_loader_factory_for_cert_net_fetcher_receiver));
  509. SetBlockTrustTokens(params_->block_trust_tokens);
  510. if (params_ && params_->http_cache_file_operations_factory) {
  511. http_cache_file_operations_factory_ =
  512. base::MakeRefCounted<MojoBackendFileOperationsFactory>(
  513. std::move(params_->http_cache_file_operations_factory));
  514. }
  515. }
  516. NetworkContext::NetworkContext(
  517. NetworkService* network_service,
  518. mojo::PendingReceiver<mojom::NetworkContext> receiver,
  519. net::URLRequestContext* url_request_context,
  520. const std::vector<std::string>& cors_exempt_header_list)
  521. : network_service_(network_service),
  522. url_request_context_(url_request_context),
  523. #if BUILDFLAG(ENABLE_REPORTING)
  524. is_observing_reporting_service_(false),
  525. #endif // BUILDFLAG(ENABLE_REPORTING)
  526. #if BUILDFLAG(IS_ANDROID)
  527. app_status_listener_(
  528. std::make_unique<NetworkContextApplicationStatusListener>()),
  529. #endif // BUILDFLAG(IS_ANDROID)
  530. receiver_(this, std::move(receiver)),
  531. first_party_sets_access_delegate_(
  532. /*receiver=*/mojo::NullReceiver(),
  533. /*params=*/nullptr,
  534. /*manager=*/nullptr),
  535. cookie_manager_(std::make_unique<CookieManager>(
  536. url_request_context,
  537. nullptr,
  538. /*first_party_sets_access_delegate=*/nullptr,
  539. nullptr)),
  540. socket_factory_(
  541. std::make_unique<SocketFactory>(url_request_context_->net_log(),
  542. url_request_context)),
  543. cors_preflight_controller_(network_service) {
  544. // May be nullptr in tests.
  545. if (network_service_)
  546. network_service_->RegisterNetworkContext(this);
  547. resource_scheduler_ = std::make_unique<ResourceScheduler>();
  548. for (const auto& key : cors_exempt_header_list)
  549. cors_exempt_header_list_.insert(key);
  550. }
  551. NetworkContext::~NetworkContext() {
  552. // May be nullptr in tests.
  553. if (network_service_)
  554. network_service_->DeregisterNetworkContext(this);
  555. if (cert_net_fetcher_)
  556. cert_net_fetcher_->Shutdown();
  557. if (domain_reliability_monitor_)
  558. domain_reliability_monitor_->Shutdown();
  559. // Because of the order of declaration in the class,
  560. // domain_reliability_monitor_ will be destroyed before
  561. // |url_loader_factories_| which could own URLLoader's whose destructor call
  562. // back into this class and might use domain_reliability_monitor_. So we reset
  563. // |domain_reliability_monitor_| here explicitly, instead of changing the
  564. // order, because any work calling into |domain_reliability_monitor_| at
  565. // shutdown would be unnecessary as the reports would be thrown out.
  566. domain_reliability_monitor_.reset();
  567. if (url_request_context_ &&
  568. url_request_context_->transport_security_state()) {
  569. if (certificate_report_sender_) {
  570. // Destroy |certificate_report_sender_| before |url_request_context_|,
  571. // since the former has a reference to the latter.
  572. url_request_context_->transport_security_state()->SetReportSender(
  573. nullptr);
  574. certificate_report_sender_.reset();
  575. }
  576. #if BUILDFLAG(IS_CT_SUPPORTED)
  577. if (expect_ct_reporter_) {
  578. url_request_context_->transport_security_state()->SetExpectCTReporter(
  579. nullptr);
  580. expect_ct_reporter_.reset();
  581. }
  582. if (require_ct_delegate_) {
  583. url_request_context_->transport_security_state()->SetRequireCTDelegate(
  584. nullptr);
  585. }
  586. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  587. }
  588. #if BUILDFLAG(ENABLE_REPORTING)
  589. if (is_observing_reporting_service_) {
  590. DCHECK(url_request_context());
  591. // May be nullptr in tests.
  592. if (url_request_context()->reporting_service()) {
  593. url_request_context()->reporting_service()->RemoveReportingCacheObserver(
  594. this);
  595. }
  596. }
  597. #endif // BUILDFLAG(ENABLE_REPORTING)
  598. #if BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  599. if (!dismount_closures_.empty()) {
  600. // Dismount all mounted directories after a generous delay, so that
  601. // pending asynchronous IO tasks have a chance to complete before the
  602. // directory is unmounted.
  603. constexpr base::TimeDelta kDismountDelay = base::Minutes(5);
  604. for (auto& dismount_closure : dismount_closures_) {
  605. std::ignore = base::ThreadPool::PostDelayedTask(
  606. FROM_HERE, std::move(dismount_closure), kDismountDelay);
  607. }
  608. }
  609. #endif // BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  610. }
  611. // static
  612. std::unique_ptr<NetworkContext> NetworkContext::CreateForTesting(
  613. NetworkService* network_service,
  614. mojo::PendingReceiver<mojom::NetworkContext> receiver,
  615. mojom::NetworkContextParamsPtr params,
  616. OnURLRequestContextBuilderConfiguredCallback
  617. on_url_request_context_builder_configured) {
  618. return std::make_unique<NetworkContext>(
  619. base::PassKey<NetworkContext>(), network_service, std::move(receiver),
  620. std::move(params), OnConnectionCloseCallback(),
  621. std::move(on_url_request_context_builder_configured));
  622. }
  623. // static
  624. void NetworkContext::SetCertVerifierForTesting(
  625. net::CertVerifier* cert_verifier) {
  626. g_cert_verifier_for_testing = cert_verifier;
  627. }
  628. void NetworkContext::CreateURLLoaderFactory(
  629. mojo::PendingReceiver<mojom::URLLoaderFactory> receiver,
  630. mojom::URLLoaderFactoryParamsPtr params,
  631. scoped_refptr<ResourceSchedulerClient> resource_scheduler_client) {
  632. url_loader_factories_.emplace(std::make_unique<cors::CorsURLLoaderFactory>(
  633. this, std::move(params), std::move(resource_scheduler_client),
  634. std::move(receiver), &cors_origin_access_list_));
  635. }
  636. void NetworkContext::CreateURLLoaderFactoryForCertNetFetcher(
  637. mojo::PendingReceiver<mojom::URLLoaderFactory> factory_receiver) {
  638. // TODO(crbug.com/1087790): investigate changing these params.
  639. auto url_loader_factory_params = mojom::URLLoaderFactoryParams::New();
  640. url_loader_factory_params->is_trusted = true;
  641. url_loader_factory_params->process_id = mojom::kBrowserProcessId;
  642. url_loader_factory_params->automatically_assign_isolation_info = true;
  643. url_loader_factory_params->is_corb_enabled = false;
  644. CreateURLLoaderFactory(std::move(factory_receiver),
  645. std::move(url_loader_factory_params));
  646. }
  647. void NetworkContext::ActivateDohProbes() {
  648. DCHECK(url_request_context_->host_resolver());
  649. doh_probes_request_.reset();
  650. doh_probes_request_ =
  651. url_request_context_->host_resolver()->CreateDohProbeRequest();
  652. doh_probes_request_->Start();
  653. }
  654. void NetworkContext::SetClient(
  655. mojo::PendingRemote<mojom::NetworkContextClient> client) {
  656. client_.reset();
  657. client_.Bind(std::move(client));
  658. }
  659. void NetworkContext::CreateURLLoaderFactory(
  660. mojo::PendingReceiver<mojom::URLLoaderFactory> receiver,
  661. mojom::URLLoaderFactoryParamsPtr params) {
  662. scoped_refptr<ResourceSchedulerClient> resource_scheduler_client;
  663. if (!base::FeatureList::IsEnabled(features::kDisableResourceScheduler)) {
  664. resource_scheduler_client = base::MakeRefCounted<ResourceSchedulerClient>(
  665. current_resource_scheduler_client_id_,
  666. IsBrowserInitiated(params->process_id == mojom::kBrowserProcessId),
  667. resource_scheduler_.get(),
  668. url_request_context_->network_quality_estimator());
  669. current_resource_scheduler_client_id_.Increment();
  670. }
  671. CreateURLLoaderFactory(std::move(receiver), std::move(params),
  672. std::move(resource_scheduler_client));
  673. }
  674. void NetworkContext::ResetURLLoaderFactories() {
  675. // Move all factories to a temporary vector so ClearBindings() does not
  676. // invalidate the iterator if the factory gets deleted.
  677. std::vector<cors::CorsURLLoaderFactory*> factories;
  678. factories.reserve(url_loader_factories_.size());
  679. for (const auto& factory : url_loader_factories_)
  680. factories.push_back(factory.get());
  681. for (auto* factory : factories)
  682. factory->ClearBindings();
  683. }
  684. void NetworkContext::GetCookieManager(
  685. mojo::PendingReceiver<mojom::CookieManager> receiver) {
  686. cookie_manager_->AddReceiver(std::move(receiver));
  687. }
  688. void NetworkContext::GetRestrictedCookieManager(
  689. mojo::PendingReceiver<mojom::RestrictedCookieManager> receiver,
  690. mojom::RestrictedCookieManagerRole role,
  691. const url::Origin& origin,
  692. const net::IsolationInfo& isolation_info,
  693. mojo::PendingRemote<mojom::CookieAccessObserver> cookie_observer) {
  694. RestrictedCookieManager::ComputeFirstPartySetMetadata(
  695. origin, url_request_context_->cookie_store(), isolation_info,
  696. base::BindOnce(&NetworkContext::OnComputedFirstPartySetMetadata,
  697. weak_factory_.GetWeakPtr(), std::move(receiver), role,
  698. origin, isolation_info, std::move(cookie_observer)));
  699. }
  700. void NetworkContext::OnComputedFirstPartySetMetadata(
  701. mojo::PendingReceiver<mojom::RestrictedCookieManager> receiver,
  702. mojom::RestrictedCookieManagerRole role,
  703. const url::Origin& origin,
  704. const net::IsolationInfo& isolation_info,
  705. mojo::PendingRemote<mojom::CookieAccessObserver> cookie_observer,
  706. net::FirstPartySetMetadata first_party_set_metadata) {
  707. restricted_cookie_manager_receivers_.Add(
  708. std::make_unique<RestrictedCookieManager>(
  709. role, url_request_context_->cookie_store(),
  710. cookie_manager_->cookie_settings(), origin, isolation_info,
  711. std::move(cookie_observer),
  712. first_party_sets_access_delegate_.is_enabled(),
  713. std::move(first_party_set_metadata)),
  714. std::move(receiver));
  715. }
  716. void NetworkContext::GetTrustTokenQueryAnswerer(
  717. mojo::PendingReceiver<mojom::TrustTokenQueryAnswerer> receiver,
  718. const url::Origin& top_frame_origin) {
  719. // Only called when Trust Tokens is enabled, i.e. trust_token_store_ is
  720. // non-null.
  721. DCHECK(trust_token_store_);
  722. DCHECK(network_service_);
  723. absl::optional<SuitableTrustTokenOrigin> suitable_top_frame_origin =
  724. SuitableTrustTokenOrigin::Create(top_frame_origin);
  725. const SynchronousTrustTokenKeyCommitmentGetter* const key_commitment_getter =
  726. network_service_->trust_token_key_commitments();
  727. // It's safe to dereference |suitable_top_frame_origin| here as, during the
  728. // process of vending the TrustTokenQueryAnswerer, the browser ensures that
  729. // the requesting context's top frame origin is suitable for Trust Tokens.
  730. auto answerer = std::make_unique<TrustTokenQueryAnswerer>(
  731. std::move(*suitable_top_frame_origin), trust_token_store_.get(),
  732. key_commitment_getter);
  733. trust_token_query_answerers_.Add(std::move(answerer), std::move(receiver));
  734. }
  735. void NetworkContext::GetStoredTrustTokenCounts(
  736. GetStoredTrustTokenCountsCallback callback) {
  737. if (trust_token_store_) {
  738. auto get_trust_token_counts_from_store =
  739. [](NetworkContext::GetStoredTrustTokenCountsCallback callback,
  740. TrustTokenStore* trust_token_store) {
  741. std::vector<mojom::StoredTrustTokensForIssuerPtr> result;
  742. for (auto& issuer_count_pair :
  743. trust_token_store->GetStoredTrustTokenCounts()) {
  744. result.push_back(mojom::StoredTrustTokensForIssuer::New(
  745. std::move(issuer_count_pair.first), issuer_count_pair.second));
  746. }
  747. std::move(callback).Run(std::move(result));
  748. };
  749. trust_token_store_->ExecuteOrEnqueue(
  750. base::BindOnce(get_trust_token_counts_from_store, std::move(callback)));
  751. } else {
  752. // The Trust Tokens feature is disabled, return immediately with an empty
  753. // vector.
  754. std::move(callback).Run({});
  755. }
  756. }
  757. void NetworkContext::DeleteStoredTrustTokens(
  758. const url::Origin& issuer,
  759. DeleteStoredTrustTokensCallback callback) {
  760. if (!trust_token_store_) {
  761. std::move(callback).Run(
  762. mojom::DeleteStoredTrustTokensStatus::kFailureFeatureDisabled);
  763. return;
  764. }
  765. absl::optional<SuitableTrustTokenOrigin> suitable_issuer_origin =
  766. SuitableTrustTokenOrigin::Create(issuer);
  767. if (!suitable_issuer_origin) {
  768. std::move(callback).Run(
  769. mojom::DeleteStoredTrustTokensStatus::kFailureInvalidOrigin);
  770. return;
  771. }
  772. trust_token_store_->ExecuteOrEnqueue(base::BindOnce(
  773. [](SuitableTrustTokenOrigin issuer,
  774. DeleteStoredTrustTokensCallback callback, TrustTokenStore* store) {
  775. const bool did_delete_tokens = store->DeleteStoredTrustTokens(issuer);
  776. const auto status =
  777. did_delete_tokens
  778. ? mojom::DeleteStoredTrustTokensStatus::kSuccessTokensDeleted
  779. : mojom::DeleteStoredTrustTokensStatus::kSuccessNoTokensDeleted;
  780. std::move(callback).Run(status);
  781. },
  782. std::move(*suitable_issuer_origin), std::move(callback)));
  783. }
  784. void NetworkContext::SetBlockTrustTokens(bool block) {
  785. block_trust_tokens_ = block;
  786. }
  787. void NetworkContext::OnProxyLookupComplete(
  788. ProxyLookupRequest* proxy_lookup_request) {
  789. auto it = proxy_lookup_requests_.find(proxy_lookup_request);
  790. DCHECK(it != proxy_lookup_requests_.end());
  791. proxy_lookup_requests_.erase(it);
  792. }
  793. void NetworkContext::DisableQuic() {
  794. url_request_context_->http_transaction_factory()->GetSession()->DisableQuic();
  795. }
  796. void NetworkContext::DestroyURLLoaderFactory(
  797. cors::CorsURLLoaderFactory* url_loader_factory) {
  798. auto it = url_loader_factories_.find(url_loader_factory);
  799. DCHECK(it != url_loader_factories_.end());
  800. url_loader_factories_.erase(it);
  801. }
  802. void NetworkContext::Remove(WebTransport* transport) {
  803. auto it = web_transports_.find(transport);
  804. if (it != web_transports_.end()) {
  805. web_transports_.erase(it);
  806. }
  807. }
  808. void NetworkContext::LoaderCreated(uint32_t process_id) {
  809. loader_count_per_process_[process_id] += 1;
  810. }
  811. void NetworkContext::LoaderDestroyed(uint32_t process_id) {
  812. auto it = loader_count_per_process_.find(process_id);
  813. DCHECK(it != loader_count_per_process_.end());
  814. it->second -= 1;
  815. if (it->second == 0)
  816. loader_count_per_process_.erase(it);
  817. }
  818. bool NetworkContext::CanCreateLoader(uint32_t process_id) {
  819. auto it = loader_count_per_process_.find(process_id);
  820. uint32_t count = (it == loader_count_per_process_.end() ? 0 : it->second);
  821. return count < max_loaders_per_process_;
  822. }
  823. size_t NetworkContext::GetNumOutstandingResolveHostRequestsForTesting() const {
  824. size_t sum = 0;
  825. if (internal_host_resolver_)
  826. sum += internal_host_resolver_->GetNumOutstandingRequestsForTesting();
  827. for (const auto& host_resolver : host_resolvers_)
  828. sum += host_resolver.first->GetNumOutstandingRequestsForTesting();
  829. return sum;
  830. }
  831. bool NetworkContext::SkipReportingPermissionCheck() const {
  832. #if BUILDFLAG(ENABLE_REPORTING)
  833. return params_ && params_->skip_reporting_send_permission_check;
  834. #else
  835. return false;
  836. #endif // BUILDFLAG(ENABLE_REPORTING)
  837. }
  838. void NetworkContext::ClearTrustTokenData(mojom::ClearDataFilterPtr filter,
  839. base::OnceClosure done) {
  840. if (!trust_token_store_) {
  841. std::move(done).Run();
  842. return;
  843. }
  844. trust_token_store_->ExecuteOrEnqueue(base::BindOnce(
  845. [](mojom::ClearDataFilterPtr filter, base::OnceClosure done,
  846. TrustTokenStore* store) {
  847. std::ignore = store->ClearDataForFilter(std::move(filter));
  848. std::move(done).Run();
  849. },
  850. std::move(filter), std::move(done)));
  851. }
  852. void NetworkContext::ClearNetworkingHistoryBetween(
  853. base::Time start_time,
  854. base::Time end_time,
  855. base::OnceClosure completion_callback) {
  856. #if BUILDFLAG(IS_CT_SUPPORTED)
  857. auto barrier = base::BarrierClosure(3, std::move(completion_callback));
  858. sct_auditing_handler()->ClearPendingReports(barrier);
  859. #else
  860. auto barrier = base::BarrierClosure(2, std::move(completion_callback));
  861. #endif // BUIDLFLAG(IS_CT_SUPPORTED)
  862. url_request_context_->transport_security_state()->DeleteAllDynamicDataBetween(
  863. start_time, end_time, barrier);
  864. // TODO(mmenke): Neither of these methods waits until the changes have been
  865. // commited to disk. They probably should, as most similar methods net/
  866. // exposes do.
  867. // May not be set in all tests.
  868. if (network_qualities_pref_delegate_)
  869. network_qualities_pref_delegate_->ClearPrefs();
  870. url_request_context_->http_server_properties()->Clear(barrier);
  871. }
  872. void NetworkContext::ClearHttpCache(base::Time start_time,
  873. base::Time end_time,
  874. mojom::ClearDataFilterPtr filter,
  875. ClearHttpCacheCallback callback) {
  876. // It's safe to use Unretained below as the HttpCacheDataRemover is owned by
  877. // |this| and guarantees it won't call its callback if deleted.
  878. http_cache_data_removers_.push_back(HttpCacheDataRemover::CreateAndStart(
  879. url_request_context_, std::move(filter), start_time, end_time,
  880. base::BindOnce(&NetworkContext::OnHttpCacheCleared,
  881. base::Unretained(this), std::move(callback))));
  882. NetworkServiceMemoryCache* memory_cache = GetMemoryCache();
  883. if (memory_cache)
  884. memory_cache->Clear();
  885. }
  886. void NetworkContext::ComputeHttpCacheSize(
  887. base::Time start_time,
  888. base::Time end_time,
  889. ComputeHttpCacheSizeCallback callback) {
  890. // It's safe to use Unretained below as the HttpCacheDataCounter is owned by
  891. // |this| and guarantees it won't call its callback if deleted.
  892. http_cache_data_counters_.push_back(HttpCacheDataCounter::CreateAndStart(
  893. url_request_context_, start_time, end_time,
  894. base::BindOnce(&NetworkContext::OnHttpCacheSizeComputed,
  895. base::Unretained(this), std::move(callback))));
  896. }
  897. void NetworkContext::ClearHostCache(mojom::ClearDataFilterPtr filter,
  898. ClearHostCacheCallback callback) {
  899. net::HostCache* host_cache =
  900. url_request_context_->host_resolver()->GetHostCache();
  901. DCHECK(host_cache);
  902. host_cache->ClearForHosts(MakeDomainFilter(filter.get()));
  903. std::move(callback).Run();
  904. }
  905. void NetworkContext::ClearHttpAuthCache(base::Time start_time,
  906. base::Time end_time,
  907. ClearHttpAuthCacheCallback callback) {
  908. net::HttpNetworkSession* http_session =
  909. url_request_context_->http_transaction_factory()->GetSession();
  910. DCHECK(http_session);
  911. http_session->http_auth_cache()->ClearEntriesAddedBetween(start_time,
  912. end_time);
  913. // TODO(mmenke): Use another error code for this, as ERR_ABORTED has somewhat
  914. // magical handling with respect to navigations.
  915. http_session->CloseAllConnections(net::ERR_ABORTED, "Clearing auth cache");
  916. std::move(callback).Run();
  917. }
  918. void NetworkContext::ClearReportingCacheReports(
  919. mojom::ClearDataFilterPtr filter,
  920. ClearReportingCacheReportsCallback callback) {
  921. #if BUILDFLAG(ENABLE_REPORTING)
  922. net::ReportingService* reporting_service =
  923. url_request_context_->reporting_service();
  924. if (reporting_service) {
  925. if (filter) {
  926. reporting_service->RemoveBrowsingData(
  927. net::ReportingBrowsingDataRemover::DATA_TYPE_REPORTS,
  928. BuildOriginFilter(std::move(filter)));
  929. } else {
  930. reporting_service->RemoveAllBrowsingData(
  931. net::ReportingBrowsingDataRemover::DATA_TYPE_REPORTS);
  932. }
  933. }
  934. #endif // BUILDFLAG(ENABLE_REPORTING)
  935. std::move(callback).Run();
  936. }
  937. void NetworkContext::ClearReportingCacheClients(
  938. mojom::ClearDataFilterPtr filter,
  939. ClearReportingCacheClientsCallback callback) {
  940. #if BUILDFLAG(ENABLE_REPORTING)
  941. net::ReportingService* reporting_service =
  942. url_request_context_->reporting_service();
  943. if (reporting_service) {
  944. if (filter) {
  945. reporting_service->RemoveBrowsingData(
  946. net::ReportingBrowsingDataRemover::DATA_TYPE_CLIENTS,
  947. BuildOriginFilter(std::move(filter)));
  948. } else {
  949. reporting_service->RemoveAllBrowsingData(
  950. net::ReportingBrowsingDataRemover::DATA_TYPE_CLIENTS);
  951. }
  952. }
  953. #endif // BUILDFLAG(ENABLE_REPORTING)
  954. std::move(callback).Run();
  955. }
  956. void NetworkContext::ClearNetworkErrorLogging(
  957. mojom::ClearDataFilterPtr filter,
  958. ClearNetworkErrorLoggingCallback callback) {
  959. #if BUILDFLAG(ENABLE_REPORTING)
  960. net::NetworkErrorLoggingService* logging_service =
  961. url_request_context_->network_error_logging_service();
  962. if (logging_service) {
  963. if (filter) {
  964. logging_service->RemoveBrowsingData(BuildOriginFilter(std::move(filter)));
  965. } else {
  966. logging_service->RemoveAllBrowsingData();
  967. }
  968. }
  969. #endif // BUILDFLAG(ENABLE_REPORTING)
  970. std::move(callback).Run();
  971. }
  972. void NetworkContext::SetDocumentReportingEndpoints(
  973. const base::UnguessableToken& reporting_source,
  974. const url::Origin& origin,
  975. const net::IsolationInfo& isolation_info,
  976. const base::flat_map<std::string, std::string>& endpoints) {
  977. #if BUILDFLAG(ENABLE_REPORTING)
  978. DCHECK(!reporting_source.is_empty());
  979. DCHECK_EQ(net::IsolationInfo::RequestType::kOther,
  980. isolation_info.request_type());
  981. net::ReportingService* reporting_service =
  982. url_request_context()->reporting_service();
  983. if (reporting_service) {
  984. reporting_service->SetDocumentReportingEndpoints(reporting_source, origin,
  985. isolation_info, endpoints);
  986. }
  987. #endif // BUILDFLAG(ENABLE_REPORTING)
  988. }
  989. void NetworkContext::SendReportsAndRemoveSource(
  990. const base::UnguessableToken& reporting_source) {
  991. #if BUILDFLAG(ENABLE_REPORTING)
  992. DCHECK(!reporting_source.is_empty());
  993. net::ReportingService* reporting_service =
  994. url_request_context()->reporting_service();
  995. if (reporting_service)
  996. reporting_service->SendReportsAndRemoveSource(reporting_source);
  997. #endif // BUILDFLAG(ENABLE_REPORTING)
  998. }
  999. void NetworkContext::QueueReport(
  1000. const std::string& type,
  1001. const std::string& group,
  1002. const GURL& url,
  1003. const absl::optional<base::UnguessableToken>& reporting_source,
  1004. const net::NetworkIsolationKey& network_isolation_key,
  1005. const absl::optional<std::string>& user_agent,
  1006. base::Value::Dict body) {
  1007. #if BUILDFLAG(ENABLE_REPORTING)
  1008. // If |reporting_source| is provided, it must not be empty.
  1009. DCHECK(!(reporting_source.has_value() && reporting_source->is_empty()));
  1010. if (require_network_isolation_key_)
  1011. DCHECK(!network_isolation_key.IsEmpty());
  1012. // Get the ReportingService.
  1013. net::URLRequestContext* request_context = url_request_context();
  1014. net::ReportingService* reporting_service =
  1015. request_context->reporting_service();
  1016. // TODO(paulmeyer): Remove this once the network service ships everywhere.
  1017. if (!reporting_service) {
  1018. return;
  1019. }
  1020. std::string reported_user_agent = user_agent.value_or("");
  1021. if (reported_user_agent.empty() &&
  1022. request_context->http_user_agent_settings() != nullptr) {
  1023. reported_user_agent =
  1024. request_context->http_user_agent_settings()->GetUserAgent();
  1025. }
  1026. reporting_service->QueueReport(url, reporting_source, network_isolation_key,
  1027. reported_user_agent, group, type,
  1028. std::move(body), 0 /* depth */);
  1029. #endif // BUILDFLAG(ENABLE_REPORTING)
  1030. }
  1031. void NetworkContext::QueueSignedExchangeReport(
  1032. mojom::SignedExchangeReportPtr report,
  1033. const net::NetworkIsolationKey& network_isolation_key) {
  1034. #if BUILDFLAG(ENABLE_REPORTING)
  1035. if (require_network_isolation_key_)
  1036. DCHECK(!network_isolation_key.IsEmpty());
  1037. net::NetworkErrorLoggingService* logging_service =
  1038. url_request_context_->network_error_logging_service();
  1039. if (!logging_service)
  1040. return;
  1041. std::string user_agent;
  1042. if (url_request_context_->http_user_agent_settings() != nullptr) {
  1043. user_agent =
  1044. url_request_context_->http_user_agent_settings()->GetUserAgent();
  1045. }
  1046. net::NetworkErrorLoggingService::SignedExchangeReportDetails details;
  1047. details.network_isolation_key = network_isolation_key;
  1048. details.success = report->success;
  1049. details.type = std::move(report->type);
  1050. details.outer_url = std::move(report->outer_url);
  1051. details.inner_url = std::move(report->inner_url);
  1052. details.cert_url = std::move(report->cert_url);
  1053. details.referrer = std::move(report->referrer);
  1054. details.server_ip_address = std::move(report->server_ip_address);
  1055. details.protocol = std::move(report->protocol);
  1056. details.method = std::move(report->method);
  1057. details.status_code = report->status_code;
  1058. details.elapsed_time = report->elapsed_time;
  1059. details.user_agent = std::move(user_agent);
  1060. logging_service->QueueSignedExchangeReport(std::move(details));
  1061. #endif // BUILDFLAG(ENABLE_REPORTING)
  1062. }
  1063. #if BUILDFLAG(ENABLE_REPORTING)
  1064. void NetworkContext::AddReportingApiObserver(
  1065. mojo::PendingRemote<network::mojom::ReportingApiObserver> observer) {
  1066. if (url_request_context() && url_request_context()->reporting_service()) {
  1067. if (!is_observing_reporting_service_) {
  1068. is_observing_reporting_service_ = true;
  1069. url_request_context()->reporting_service()->AddReportingCacheObserver(
  1070. this);
  1071. reporting_api_observers_.set_disconnect_handler(
  1072. base::BindRepeating(&NetworkContext::OnReportingObserverDisconnect,
  1073. weak_factory_.GetWeakPtr()));
  1074. }
  1075. auto id = reporting_api_observers_.Add(std::move(observer));
  1076. auto service_reports =
  1077. url_request_context()->reporting_service()->GetReports();
  1078. for (const auto* service_report : service_reports) {
  1079. reporting_api_observers_.Get(id)->OnReportAdded(*service_report);
  1080. }
  1081. base::flat_map<url::Origin, std::vector<net::ReportingEndpoint>>
  1082. endpoints_by_origin = url_request_context()
  1083. ->reporting_service()
  1084. ->GetV1ReportingEndpointsByOrigin();
  1085. for (auto const& origin_and_endpoints : endpoints_by_origin) {
  1086. OnEndpointsUpdatedForOrigin(origin_and_endpoints.second);
  1087. }
  1088. }
  1089. }
  1090. void NetworkContext::OnReportAdded(const net::ReportingReport* service_report) {
  1091. for (const auto& observer : reporting_api_observers_) {
  1092. observer->OnReportAdded(*service_report);
  1093. }
  1094. }
  1095. void NetworkContext::OnEndpointsUpdatedForOrigin(
  1096. const std::vector<net::ReportingEndpoint>& endpoints) {
  1097. for (const auto& observer : reporting_api_observers_) {
  1098. observer->OnEndpointsUpdatedForOrigin(endpoints);
  1099. }
  1100. }
  1101. void NetworkContext::OnReportUpdated(
  1102. const net::ReportingReport* service_report) {
  1103. for (const auto& observer : reporting_api_observers_) {
  1104. observer->OnReportUpdated(*service_report);
  1105. }
  1106. }
  1107. void NetworkContext::OnReportingObserverDisconnect(
  1108. mojo::RemoteSetElementId /*mojo_id*/) {
  1109. if (!reporting_api_observers_.size()) {
  1110. DCHECK(url_request_context());
  1111. DCHECK(url_request_context()->reporting_service());
  1112. url_request_context()->reporting_service()->RemoveReportingCacheObserver(
  1113. this);
  1114. is_observing_reporting_service_ = false;
  1115. }
  1116. }
  1117. #endif // BUILDFLAG(ENABLE_REPORTING)
  1118. void NetworkContext::ClearDomainReliability(
  1119. mojom::ClearDataFilterPtr filter,
  1120. DomainReliabilityClearMode mode,
  1121. ClearDomainReliabilityCallback callback) {
  1122. if (domain_reliability_monitor_) {
  1123. domain_reliability::DomainReliabilityClearMode dr_mode;
  1124. if (mode ==
  1125. mojom::NetworkContext::DomainReliabilityClearMode::CLEAR_CONTEXTS) {
  1126. dr_mode = domain_reliability::CLEAR_CONTEXTS;
  1127. } else {
  1128. dr_mode = domain_reliability::CLEAR_BEACONS;
  1129. }
  1130. domain_reliability_monitor_->ClearBrowsingData(
  1131. dr_mode, BuildOriginFilter(std::move(filter)));
  1132. }
  1133. std::move(callback).Run();
  1134. }
  1135. void NetworkContext::CloseAllConnections(CloseAllConnectionsCallback callback) {
  1136. net::HttpNetworkSession* http_session =
  1137. url_request_context_->http_transaction_factory()->GetSession();
  1138. DCHECK(http_session);
  1139. // TODO(mmenke): Use another error code for this, as ERR_ABORTED has somewhat
  1140. // magical handling with respect to navigations.
  1141. http_session->CloseAllConnections(net::ERR_ABORTED,
  1142. "Embedder closing all connections");
  1143. std::move(callback).Run();
  1144. }
  1145. void NetworkContext::CloseIdleConnections(
  1146. CloseIdleConnectionsCallback callback) {
  1147. net::HttpNetworkSession* http_session =
  1148. url_request_context_->http_transaction_factory()->GetSession();
  1149. DCHECK(http_session);
  1150. http_session->CloseIdleConnections("Embedder closing idle connections");
  1151. std::move(callback).Run();
  1152. }
  1153. void NetworkContext::SetNetworkConditions(
  1154. const base::UnguessableToken& throttling_profile_id,
  1155. mojom::NetworkConditionsPtr conditions) {
  1156. std::unique_ptr<NetworkConditions> network_conditions;
  1157. if (conditions) {
  1158. network_conditions = std::make_unique<NetworkConditions>(
  1159. conditions->offline, conditions->latency.InMillisecondsF(),
  1160. conditions->download_throughput, conditions->upload_throughput);
  1161. }
  1162. ThrottlingController::SetConditions(throttling_profile_id,
  1163. std::move(network_conditions));
  1164. }
  1165. void NetworkContext::SetAcceptLanguage(const std::string& new_accept_language) {
  1166. // This may only be called on NetworkContexts created with the constructor
  1167. // that calls MakeURLRequestContext().
  1168. DCHECK(user_agent_settings_);
  1169. user_agent_settings_->set_accept_language(new_accept_language);
  1170. }
  1171. void NetworkContext::SetEnableReferrers(bool enable_referrers) {
  1172. // This may only be called on NetworkContexts created with the constructor
  1173. // that calls MakeURLRequestContext().
  1174. DCHECK(network_delegate_);
  1175. network_delegate_->set_enable_referrers(enable_referrers);
  1176. }
  1177. #if BUILDFLAG(IS_CHROMEOS)
  1178. void NetworkContext::UpdateAdditionalCertificates(
  1179. mojom::AdditionalCertificatesPtr additional_certificates) {
  1180. if (!cert_verifier_with_trust_anchors_) {
  1181. CHECK(g_cert_verifier_for_testing);
  1182. return;
  1183. }
  1184. if (!additional_certificates) {
  1185. cert_verifier_with_trust_anchors_->SetAdditionalCerts(
  1186. net::CertificateList(), net::CertificateList());
  1187. return;
  1188. }
  1189. cert_verifier_with_trust_anchors_->SetAdditionalCerts(
  1190. additional_certificates->trust_anchors,
  1191. additional_certificates->all_certificates);
  1192. }
  1193. #endif // BUILDFLAG(IS_CHROMEOS)
  1194. #if BUILDFLAG(IS_CT_SUPPORTED)
  1195. void NetworkContext::SetCTPolicy(mojom::CTPolicyPtr ct_policy) {
  1196. if (!require_ct_delegate_)
  1197. return;
  1198. require_ct_delegate_->UpdateCTPolicies(
  1199. ct_policy->required_hosts, ct_policy->excluded_hosts,
  1200. ct_policy->excluded_spkis, ct_policy->excluded_legacy_spkis);
  1201. }
  1202. void NetworkContext::AddExpectCT(
  1203. const std::string& domain,
  1204. base::Time expiry,
  1205. bool enforce,
  1206. const GURL& report_uri,
  1207. const net::NetworkIsolationKey& network_isolation_key,
  1208. AddExpectCTCallback callback) {
  1209. net::TransportSecurityState* transport_security_state =
  1210. url_request_context()->transport_security_state();
  1211. if (!transport_security_state) {
  1212. std::move(callback).Run(false);
  1213. return;
  1214. }
  1215. transport_security_state->AddExpectCT(domain, expiry, enforce, report_uri,
  1216. network_isolation_key);
  1217. std::move(callback).Run(true);
  1218. }
  1219. void NetworkContext::SetExpectCTTestReport(
  1220. const GURL& report_uri,
  1221. SetExpectCTTestReportCallback callback) {
  1222. std::string decoded_dummy_cert;
  1223. bool decoded = base::Base64Decode(kTestReportCert, &decoded_dummy_cert);
  1224. DCHECK(decoded);
  1225. scoped_refptr<net::X509Certificate> dummy_cert =
  1226. net::X509Certificate::CreateFromBytes(
  1227. base::as_bytes(base::make_span(decoded_dummy_cert)));
  1228. LazyCreateExpectCTReporter(url_request_context());
  1229. // We need to save |callback| into a queue because this implementation is
  1230. // relying on the success/failed observer methods of network::ExpectCTReporter
  1231. // which can be called at any time, and for other reasons. It's unlikely
  1232. // but it is possible that |callback| could be called for some other event
  1233. // other than the one initiated below when calling OnExpectCTFailed.
  1234. outstanding_set_expect_ct_callbacks_.push(std::move(callback));
  1235. // Send a test report with dummy data.
  1236. net::SignedCertificateTimestampAndStatusList dummy_sct_list;
  1237. expect_ct_reporter_->OnExpectCTFailed(
  1238. net::HostPortPair("expect-ct-report.test", 443), report_uri,
  1239. base::Time::Now(), dummy_cert.get(), dummy_cert.get(), dummy_sct_list,
  1240. // No need for a shared NetworkIsolationKey here, as this is test-only
  1241. // code and none
  1242. // of the tests that call it care about the NetworkIsolationKey.
  1243. net::NetworkIsolationKey::CreateTransient());
  1244. }
  1245. void NetworkContext::LazyCreateExpectCTReporter(
  1246. net::URLRequestContext* url_request_context) {
  1247. if (expect_ct_reporter_)
  1248. return;
  1249. // This instance owns owns and outlives expect_ct_reporter_, so safe to
  1250. // pass |this|.
  1251. expect_ct_reporter_ = std::make_unique<network::ExpectCTReporter>(
  1252. url_request_context,
  1253. base::BindRepeating(&NetworkContext::OnSetExpectCTTestReportSuccess,
  1254. base::Unretained(this)),
  1255. base::BindRepeating(&NetworkContext::OnSetExpectCTTestReportFailure,
  1256. base::Unretained(this)));
  1257. }
  1258. void NetworkContext::OnSetExpectCTTestReportSuccess() {
  1259. if (outstanding_set_expect_ct_callbacks_.empty())
  1260. return;
  1261. std::move(outstanding_set_expect_ct_callbacks_.front()).Run(true);
  1262. outstanding_set_expect_ct_callbacks_.pop();
  1263. }
  1264. void NetworkContext::OnSetExpectCTTestReportFailure() {
  1265. if (outstanding_set_expect_ct_callbacks_.empty())
  1266. return;
  1267. std::move(outstanding_set_expect_ct_callbacks_.front()).Run(false);
  1268. outstanding_set_expect_ct_callbacks_.pop();
  1269. }
  1270. int NetworkContext::CheckCTComplianceForSignedExchange(
  1271. net::CertVerifyResult& cert_verify_result,
  1272. const net::X509Certificate& certificate,
  1273. const net::HostPortPair& host_port_pair,
  1274. const net::NetworkIsolationKey& network_isolation_key) {
  1275. net::X509Certificate* verified_cert = cert_verify_result.verified_cert.get();
  1276. net::ct::SCTList verified_scts;
  1277. for (const auto& sct_and_status : cert_verify_result.scts) {
  1278. if (sct_and_status.status == net::ct::SCT_STATUS_OK)
  1279. verified_scts.push_back(sct_and_status.sct);
  1280. }
  1281. cert_verify_result.policy_compliance =
  1282. url_request_context_->ct_policy_enforcer()->CheckCompliance(
  1283. verified_cert, verified_scts,
  1284. net::NetLogWithSource::Make(
  1285. url_request_context_->net_log(),
  1286. net::NetLogSourceType::CERT_VERIFIER_JOB));
  1287. // TODO(https://crbug.com/803774): We should determine whether EV & SXG
  1288. // should be a thing (due to the online/offline signing difference)
  1289. if (cert_verify_result.cert_status & net::CERT_STATUS_IS_EV &&
  1290. cert_verify_result.policy_compliance !=
  1291. net::ct::CTPolicyCompliance::CT_POLICY_COMPLIES_VIA_SCTS &&
  1292. cert_verify_result.policy_compliance !=
  1293. net::ct::CTPolicyCompliance::CT_POLICY_BUILD_NOT_TIMELY) {
  1294. cert_verify_result.cert_status |= net::CERT_STATUS_CT_COMPLIANCE_FAILED;
  1295. cert_verify_result.cert_status &= ~net::CERT_STATUS_IS_EV;
  1296. }
  1297. net::TransportSecurityState::CTRequirementsStatus ct_requirement_status =
  1298. url_request_context_->transport_security_state()->CheckCTRequirements(
  1299. host_port_pair, cert_verify_result.is_issued_by_known_root,
  1300. cert_verify_result.public_key_hashes, verified_cert, &certificate,
  1301. cert_verify_result.scts,
  1302. net::TransportSecurityState::ENABLE_EXPECT_CT_REPORTS,
  1303. cert_verify_result.policy_compliance, network_isolation_key);
  1304. if (url_request_context_->sct_auditing_delegate()) {
  1305. url_request_context_->sct_auditing_delegate()->MaybeEnqueueReport(
  1306. host_port_pair, verified_cert, cert_verify_result.scts);
  1307. }
  1308. switch (ct_requirement_status) {
  1309. case net::TransportSecurityState::CT_REQUIREMENTS_NOT_MET:
  1310. return net::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED;
  1311. case net::TransportSecurityState::CT_REQUIREMENTS_MET:
  1312. return net::OK;
  1313. case net::TransportSecurityState::CT_NOT_REQUIRED:
  1314. // CT is not required if the certificate does not chain to a publicly
  1315. // trusted root certificate.
  1316. if (!cert_verify_result.is_issued_by_known_root)
  1317. return net::OK;
  1318. // For old certificates (issued before 2018-05-01),
  1319. // CheckCTRequirements() may return CT_NOT_REQUIRED, so we check the
  1320. // compliance status here.
  1321. // TODO(https://crbug.com/851778): Remove this condition once we require
  1322. // signing certificates to have CanSignHttpExchanges extension, because
  1323. // such certificates should be naturally after 2018-05-01.
  1324. if (cert_verify_result.policy_compliance ==
  1325. net::ct::CTPolicyCompliance::CT_POLICY_COMPLIES_VIA_SCTS ||
  1326. cert_verify_result.policy_compliance ==
  1327. net::ct::CTPolicyCompliance::CT_POLICY_BUILD_NOT_TIMELY) {
  1328. return net::OK;
  1329. }
  1330. // Require CT compliance, by overriding CT_NOT_REQUIRED and treat it as
  1331. // ERR_CERTIFICATE_TRANSPARENCY_REQUIRED.
  1332. return net::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED;
  1333. }
  1334. }
  1335. void NetworkContext::GetExpectCTState(
  1336. const std::string& domain,
  1337. const net::NetworkIsolationKey& network_isolation_key,
  1338. GetExpectCTStateCallback callback) {
  1339. base::Value::Dict result;
  1340. if (base::IsStringASCII(domain)) {
  1341. net::TransportSecurityState* transport_security_state =
  1342. url_request_context()->transport_security_state();
  1343. if (transport_security_state) {
  1344. net::TransportSecurityState::ExpectCTState dynamic_expect_ct_state;
  1345. bool found = transport_security_state->GetDynamicExpectCTState(
  1346. domain, network_isolation_key, &dynamic_expect_ct_state);
  1347. // TODO(estark): query static Expect-CT state as well.
  1348. if (found) {
  1349. result.Set("dynamic_expect_ct_domain", domain);
  1350. result.Set("dynamic_expect_ct_observed",
  1351. dynamic_expect_ct_state.last_observed.ToDoubleT());
  1352. result.Set("dynamic_expect_ct_expiry",
  1353. dynamic_expect_ct_state.expiry.ToDoubleT());
  1354. result.Set("dynamic_expect_ct_enforce",
  1355. dynamic_expect_ct_state.enforce);
  1356. result.Set("dynamic_expect_ct_report_uri",
  1357. dynamic_expect_ct_state.report_uri.spec());
  1358. }
  1359. result.Set("result", found);
  1360. } else {
  1361. result.Set("error", "no Expect-CT state active");
  1362. }
  1363. } else {
  1364. result.Set("error", "non-ASCII domain name");
  1365. }
  1366. std::move(callback).Run(std::move(result));
  1367. }
  1368. void NetworkContext::MaybeEnqueueSCTReport(
  1369. const net::HostPortPair& host_port_pair,
  1370. const net::X509Certificate* validated_certificate_chain,
  1371. const net::SignedCertificateTimestampAndStatusList&
  1372. signed_certificate_timestamps) {
  1373. sct_auditing_handler()->MaybeEnqueueReport(host_port_pair,
  1374. validated_certificate_chain,
  1375. signed_certificate_timestamps);
  1376. }
  1377. void NetworkContext::SetCTLogListAlwaysTimelyForTesting() {
  1378. if (!ct_policy_enforcer_)
  1379. return;
  1380. ct_policy_enforcer_->SetCTLogListAlwaysTimelyForTesting(true);
  1381. }
  1382. void NetworkContext::SetSCTAuditingMode(mojom::SCTAuditingMode mode) {
  1383. sct_auditing_handler()->SetMode(mode);
  1384. }
  1385. void NetworkContext::OnCTLogListUpdated(
  1386. const std::vector<network::mojom::CTLogInfoPtr>& log_list,
  1387. base::Time update_time) {
  1388. if (!ct_policy_enforcer_)
  1389. return;
  1390. std::vector<std::pair<std::string, base::Time>> disqualified_logs;
  1391. std::vector<std::string> operated_by_google_logs;
  1392. std::map<std::string, certificate_transparency::OperatorHistoryEntry>
  1393. log_operator_history;
  1394. GetCTPolicyConfigForCTLogInfo(log_list, &disqualified_logs,
  1395. &operated_by_google_logs,
  1396. &log_operator_history);
  1397. ct_policy_enforcer_->UpdateCTLogList(
  1398. update_time, std::move(disqualified_logs),
  1399. std::move(operated_by_google_logs), std::move(log_operator_history));
  1400. }
  1401. void NetworkContext::CanSendSCTAuditingReport(
  1402. base::OnceCallback<void(bool)> callback) {
  1403. // If the NetworkContextClient hasn't been set yet or has disconnected for
  1404. // some reason, just return `false`. (One case where this could occur is when
  1405. // restarting SCTAuditingReporter instances loaded form disk at startup -- see
  1406. // crbug.com/1347180 for more details on that case.)
  1407. if (!client_) {
  1408. std::move(callback).Run(false);
  1409. return;
  1410. }
  1411. client_->OnCanSendSCTAuditingReport(std::move(callback));
  1412. }
  1413. void NetworkContext::OnNewSCTAuditingReportSent() {
  1414. client_->OnNewSCTAuditingReportSent();
  1415. }
  1416. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  1417. void NetworkContext::CreateUDPSocket(
  1418. mojo::PendingReceiver<mojom::UDPSocket> receiver,
  1419. mojo::PendingRemote<mojom::UDPSocketListener> listener) {
  1420. socket_factory_->CreateUDPSocket(std::move(receiver), std::move(listener));
  1421. }
  1422. void NetworkContext::CreateTCPServerSocket(
  1423. const net::IPEndPoint& local_addr,
  1424. uint32_t backlog,
  1425. const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
  1426. mojo::PendingReceiver<mojom::TCPServerSocket> receiver,
  1427. CreateTCPServerSocketCallback callback) {
  1428. socket_factory_->CreateTCPServerSocket(
  1429. local_addr, backlog,
  1430. static_cast<net::NetworkTrafficAnnotationTag>(traffic_annotation),
  1431. std::move(receiver), std::move(callback));
  1432. }
  1433. void NetworkContext::CreateTCPConnectedSocket(
  1434. const absl::optional<net::IPEndPoint>& local_addr,
  1435. const net::AddressList& remote_addr_list,
  1436. mojom::TCPConnectedSocketOptionsPtr tcp_connected_socket_options,
  1437. const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
  1438. mojo::PendingReceiver<mojom::TCPConnectedSocket> receiver,
  1439. mojo::PendingRemote<mojom::SocketObserver> observer,
  1440. CreateTCPConnectedSocketCallback callback) {
  1441. socket_factory_->CreateTCPConnectedSocket(
  1442. local_addr, remote_addr_list, std::move(tcp_connected_socket_options),
  1443. static_cast<net::NetworkTrafficAnnotationTag>(traffic_annotation),
  1444. std::move(receiver), std::move(observer), std::move(callback));
  1445. }
  1446. void NetworkContext::CreateTCPBoundSocket(
  1447. const net::IPEndPoint& local_addr,
  1448. const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
  1449. mojo::PendingReceiver<mojom::TCPBoundSocket> receiver,
  1450. CreateTCPBoundSocketCallback callback) {
  1451. socket_factory_->CreateTCPBoundSocket(
  1452. local_addr,
  1453. static_cast<net::NetworkTrafficAnnotationTag>(traffic_annotation),
  1454. std::move(receiver), std::move(callback));
  1455. }
  1456. void NetworkContext::CreateProxyResolvingSocketFactory(
  1457. mojo::PendingReceiver<mojom::ProxyResolvingSocketFactory> receiver) {
  1458. proxy_resolving_socket_factories_.Add(
  1459. std::make_unique<ProxyResolvingSocketFactoryMojo>(url_request_context()),
  1460. std::move(receiver));
  1461. }
  1462. void NetworkContext::LookUpProxyForURL(
  1463. const GURL& url,
  1464. const net::NetworkIsolationKey& network_isolation_key,
  1465. mojo::PendingRemote<mojom::ProxyLookupClient> proxy_lookup_client) {
  1466. DCHECK(proxy_lookup_client);
  1467. std::unique_ptr<ProxyLookupRequest> proxy_lookup_request(
  1468. std::make_unique<ProxyLookupRequest>(std::move(proxy_lookup_client), this,
  1469. network_isolation_key));
  1470. ProxyLookupRequest* proxy_lookup_request_ptr = proxy_lookup_request.get();
  1471. proxy_lookup_requests_.insert(std::move(proxy_lookup_request));
  1472. proxy_lookup_request_ptr->Start(url);
  1473. }
  1474. void NetworkContext::ForceReloadProxyConfig(
  1475. ForceReloadProxyConfigCallback callback) {
  1476. net::ConfiguredProxyResolutionService* configured_proxy_resolution_service =
  1477. nullptr;
  1478. if (url_request_context()
  1479. ->proxy_resolution_service()
  1480. ->CastToConfiguredProxyResolutionService(
  1481. &configured_proxy_resolution_service)) {
  1482. configured_proxy_resolution_service->ForceReloadProxyConfig();
  1483. } else {
  1484. LOG(WARNING)
  1485. << "NetworkContext::ForceReloadProxyConfig() had no effect, as the "
  1486. "underlying ProxyResolutionService does not support that concept.";
  1487. }
  1488. std::move(callback).Run();
  1489. }
  1490. void NetworkContext::ClearBadProxiesCache(
  1491. ClearBadProxiesCacheCallback callback) {
  1492. url_request_context()->proxy_resolution_service()->ClearBadProxiesCache();
  1493. std::move(callback).Run();
  1494. }
  1495. void NetworkContext::CreateWebSocket(
  1496. const GURL& url,
  1497. const std::vector<std::string>& requested_protocols,
  1498. const net::SiteForCookies& site_for_cookies,
  1499. const net::IsolationInfo& isolation_info,
  1500. std::vector<mojom::HttpHeaderPtr> additional_headers,
  1501. int32_t process_id,
  1502. const url::Origin& origin,
  1503. uint32_t options,
  1504. const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
  1505. mojo::PendingRemote<mojom::WebSocketHandshakeClient> handshake_client,
  1506. mojo::PendingRemote<mojom::URLLoaderNetworkServiceObserver>
  1507. url_loader_network_observer,
  1508. mojo::PendingRemote<mojom::WebSocketAuthenticationHandler> auth_handler,
  1509. mojo::PendingRemote<mojom::TrustedHeaderClient> header_client,
  1510. const absl::optional<base::UnguessableToken>& throttling_profile_id) {
  1511. #if !BUILDFLAG(IS_IOS)
  1512. if (!websocket_factory_)
  1513. websocket_factory_ = std::make_unique<WebSocketFactory>(this);
  1514. DCHECK_GE(process_id, 0);
  1515. websocket_factory_->CreateWebSocket(
  1516. url, requested_protocols, site_for_cookies, isolation_info,
  1517. std::move(additional_headers), process_id, origin, options,
  1518. static_cast<net::NetworkTrafficAnnotationTag>(traffic_annotation),
  1519. std::move(handshake_client), std::move(url_loader_network_observer),
  1520. std::move(auth_handler), std::move(header_client), throttling_profile_id);
  1521. #endif // !BUILDFLAG(IS_IOS)
  1522. }
  1523. void NetworkContext::CreateWebTransport(
  1524. const GURL& url,
  1525. const url::Origin& origin,
  1526. const net::NetworkIsolationKey& key,
  1527. std::vector<mojom::WebTransportCertificateFingerprintPtr> fingerprints,
  1528. mojo::PendingRemote<mojom::WebTransportHandshakeClient>
  1529. pending_handshake_client) {
  1530. web_transports_.insert(
  1531. std::make_unique<WebTransport>(url, origin, key, fingerprints, this,
  1532. std::move(pending_handshake_client)));
  1533. }
  1534. void NetworkContext::CreateNetLogExporter(
  1535. mojo::PendingReceiver<mojom::NetLogExporter> receiver) {
  1536. net_log_exporter_receivers_.Add(std::make_unique<NetLogExporter>(this),
  1537. std::move(receiver));
  1538. }
  1539. void NetworkContext::ResolveHost(
  1540. const net::HostPortPair& host,
  1541. const net::NetworkIsolationKey& network_isolation_key,
  1542. mojom::ResolveHostParametersPtr optional_parameters,
  1543. mojo::PendingRemote<mojom::ResolveHostClient> response_client) {
  1544. if (!internal_host_resolver_) {
  1545. internal_host_resolver_ = std::make_unique<HostResolver>(
  1546. url_request_context_->host_resolver(), url_request_context_->net_log());
  1547. }
  1548. internal_host_resolver_->ResolveHost(host, network_isolation_key,
  1549. std::move(optional_parameters),
  1550. std::move(response_client));
  1551. }
  1552. void NetworkContext::CreateHostResolver(
  1553. const absl::optional<net::DnsConfigOverrides>& config_overrides,
  1554. mojo::PendingReceiver<mojom::HostResolver> receiver) {
  1555. net::HostResolver* internal_resolver = url_request_context_->host_resolver();
  1556. std::unique_ptr<net::HostResolver> private_internal_resolver;
  1557. if (config_overrides &&
  1558. config_overrides.value() != net::DnsConfigOverrides()) {
  1559. // If custom configuration is needed, create a separate internal resolver
  1560. // with the specified configuration overrides. Because we are using a non-
  1561. // standard resolver, disable the cache.
  1562. //
  1563. // TODO(crbug.com/846423): Consider allowing per-resolve overrides, so the
  1564. // same net::HostResolver with the same scheduler and cache can be used with
  1565. // different overrides. But since this is only used for special cases for
  1566. // now, much easier to create entirely separate net::HostResolver instances.
  1567. net::HostResolver::ManagerOptions options;
  1568. options.insecure_dns_client_enabled = true;
  1569. // Assume additional types are unnecessary for these special cases.
  1570. options.additional_types_via_insecure_dns_enabled = false;
  1571. options.dns_config_overrides = config_overrides.value();
  1572. private_internal_resolver =
  1573. network_service_->host_resolver_factory()->CreateStandaloneResolver(
  1574. url_request_context_->net_log(), std::move(options),
  1575. "" /* host_mapping_rules */, false /* enable_caching */);
  1576. private_internal_resolver->SetRequestContext(url_request_context_);
  1577. internal_resolver = private_internal_resolver.get();
  1578. }
  1579. host_resolvers_.emplace(
  1580. std::make_unique<HostResolver>(
  1581. std::move(receiver),
  1582. base::BindOnce(&NetworkContext::OnHostResolverShutdown,
  1583. base::Unretained(this)),
  1584. internal_resolver, url_request_context_->net_log()),
  1585. std::move(private_internal_resolver));
  1586. }
  1587. void NetworkContext::VerifyCertForSignedExchange(
  1588. const scoped_refptr<net::X509Certificate>& certificate,
  1589. const GURL& url,
  1590. const net::NetworkIsolationKey& network_isolation_key,
  1591. const std::string& ocsp_result,
  1592. const std::string& sct_list,
  1593. VerifyCertForSignedExchangeCallback callback) {
  1594. if (require_network_isolation_key_)
  1595. DCHECK(!network_isolation_key.IsEmpty());
  1596. uint64_t cert_verify_id = ++next_cert_verify_id_;
  1597. CHECK_NE(0u, next_cert_verify_id_); // The request ID should not wrap around.
  1598. auto pending_cert_verify = std::make_unique<PendingCertVerify>();
  1599. pending_cert_verify->callback = std::move(callback);
  1600. pending_cert_verify->result = std::make_unique<net::CertVerifyResult>();
  1601. pending_cert_verify->certificate = certificate;
  1602. pending_cert_verify->url = url;
  1603. pending_cert_verify->network_isolation_key = network_isolation_key;
  1604. pending_cert_verify->ocsp_result = ocsp_result;
  1605. pending_cert_verify->sct_list = sct_list;
  1606. net::CertVerifier* cert_verifier =
  1607. g_cert_verifier_for_testing ? g_cert_verifier_for_testing
  1608. : url_request_context_->cert_verifier();
  1609. int result = cert_verifier->Verify(
  1610. net::CertVerifier::RequestParams(certificate, url.host(),
  1611. 0 /* cert_verify_flags */, ocsp_result,
  1612. sct_list),
  1613. pending_cert_verify->result.get(),
  1614. base::BindOnce(&NetworkContext::OnVerifyCertForSignedExchangeComplete,
  1615. base::Unretained(this), cert_verify_id),
  1616. &pending_cert_verify->request,
  1617. net::NetLogWithSource::Make(url_request_context_->net_log(),
  1618. net::NetLogSourceType::CERT_VERIFIER_JOB));
  1619. cert_verifier_requests_[cert_verify_id] = std::move(pending_cert_verify);
  1620. if (result != net::ERR_IO_PENDING)
  1621. OnVerifyCertForSignedExchangeComplete(cert_verify_id, result);
  1622. }
  1623. void NetworkContext::NotifyExternalCacheHit(const GURL& url,
  1624. const std::string& http_method,
  1625. const net::NetworkIsolationKey& key,
  1626. bool is_subframe_document_resource,
  1627. bool include_credentials) {
  1628. net::HttpCache* cache =
  1629. url_request_context_->http_transaction_factory()->GetCache();
  1630. if (!cache)
  1631. return;
  1632. cache->OnExternalCacheHit(url, http_method, key,
  1633. is_subframe_document_resource, include_credentials);
  1634. }
  1635. void NetworkContext::SetCorsOriginAccessListsForOrigin(
  1636. const url::Origin& source_origin,
  1637. std::vector<mojom::CorsOriginPatternPtr> allow_patterns,
  1638. std::vector<mojom::CorsOriginPatternPtr> block_patterns,
  1639. SetCorsOriginAccessListsForOriginCallback callback) {
  1640. cors_origin_access_list_.SetAllowListForOrigin(source_origin, allow_patterns);
  1641. cors_origin_access_list_.SetBlockListForOrigin(source_origin, block_patterns);
  1642. std::move(callback).Run();
  1643. }
  1644. void NetworkContext::AddHSTS(const std::string& host,
  1645. base::Time expiry,
  1646. bool include_subdomains,
  1647. AddHSTSCallback callback) {
  1648. net::TransportSecurityState* state =
  1649. url_request_context_->transport_security_state();
  1650. state->AddHSTS(host, expiry, include_subdomains);
  1651. std::move(callback).Run();
  1652. }
  1653. void NetworkContext::IsHSTSActiveForHost(const std::string& host,
  1654. IsHSTSActiveForHostCallback callback) {
  1655. net::TransportSecurityState* security_state =
  1656. url_request_context_->transport_security_state();
  1657. if (!security_state) {
  1658. std::move(callback).Run(false);
  1659. return;
  1660. }
  1661. std::move(callback).Run(security_state->ShouldUpgradeToSSL(host));
  1662. }
  1663. void NetworkContext::GetHSTSState(const std::string& domain,
  1664. GetHSTSStateCallback callback) {
  1665. base::Value::Dict result;
  1666. if (base::IsStringASCII(domain)) {
  1667. net::TransportSecurityState* transport_security_state =
  1668. url_request_context()->transport_security_state();
  1669. if (transport_security_state) {
  1670. net::TransportSecurityState::STSState static_sts_state;
  1671. net::TransportSecurityState::PKPState static_pkp_state;
  1672. bool found_sts_static = transport_security_state->GetStaticSTSState(
  1673. domain, &static_sts_state);
  1674. bool found_pkp_static = transport_security_state->GetStaticPKPState(
  1675. domain, &static_pkp_state);
  1676. if (found_sts_static || found_pkp_static) {
  1677. result.Set("static_upgrade_mode",
  1678. static_cast<int>(static_sts_state.upgrade_mode));
  1679. result.Set("static_sts_include_subdomains",
  1680. static_sts_state.include_subdomains);
  1681. result.Set("static_sts_observed",
  1682. static_sts_state.last_observed.ToDoubleT());
  1683. result.Set("static_sts_expiry", static_sts_state.expiry.ToDoubleT());
  1684. result.Set("static_pkp_include_subdomains",
  1685. static_pkp_state.include_subdomains);
  1686. result.Set("static_pkp_observed",
  1687. static_pkp_state.last_observed.ToDoubleT());
  1688. result.Set("static_pkp_expiry", static_pkp_state.expiry.ToDoubleT());
  1689. result.Set("static_spki_hashes",
  1690. HashesToBase64String(static_pkp_state.spki_hashes));
  1691. result.Set("static_sts_domain", static_sts_state.domain);
  1692. result.Set("static_pkp_domain", static_pkp_state.domain);
  1693. }
  1694. net::TransportSecurityState::STSState dynamic_sts_state;
  1695. net::TransportSecurityState::PKPState dynamic_pkp_state;
  1696. bool found_sts_dynamic = transport_security_state->GetDynamicSTSState(
  1697. domain, &dynamic_sts_state);
  1698. bool found_pkp_dynamic = transport_security_state->GetDynamicPKPState(
  1699. domain, &dynamic_pkp_state);
  1700. if (found_sts_dynamic) {
  1701. result.Set("dynamic_upgrade_mode",
  1702. static_cast<int>(dynamic_sts_state.upgrade_mode));
  1703. result.Set("dynamic_sts_include_subdomains",
  1704. dynamic_sts_state.include_subdomains);
  1705. result.Set("dynamic_sts_observed",
  1706. dynamic_sts_state.last_observed.ToDoubleT());
  1707. result.Set("dynamic_sts_expiry", dynamic_sts_state.expiry.ToDoubleT());
  1708. result.Set("dynamic_sts_domain", dynamic_sts_state.domain);
  1709. }
  1710. if (found_pkp_dynamic) {
  1711. result.Set("dynamic_pkp_include_subdomains",
  1712. dynamic_pkp_state.include_subdomains);
  1713. result.Set("dynamic_pkp_observed",
  1714. dynamic_pkp_state.last_observed.ToDoubleT());
  1715. result.Set("dynamic_pkp_expiry", dynamic_pkp_state.expiry.ToDoubleT());
  1716. result.Set("dynamic_spki_hashes",
  1717. HashesToBase64String(dynamic_pkp_state.spki_hashes));
  1718. result.Set("dynamic_pkp_domain", dynamic_pkp_state.domain);
  1719. }
  1720. result.Set("result", found_sts_static || found_pkp_static ||
  1721. found_sts_dynamic || found_pkp_dynamic);
  1722. } else {
  1723. result.Set("error", "no TransportSecurityState active");
  1724. }
  1725. } else {
  1726. result.Set("error", "non-ASCII domain name");
  1727. }
  1728. std::move(callback).Run(std::move(result));
  1729. }
  1730. void NetworkContext::DeleteDynamicDataForHost(
  1731. const std::string& host,
  1732. DeleteDynamicDataForHostCallback callback) {
  1733. net::TransportSecurityState* transport_security_state =
  1734. url_request_context()->transport_security_state();
  1735. if (!transport_security_state) {
  1736. std::move(callback).Run(false);
  1737. return;
  1738. }
  1739. std::move(callback).Run(
  1740. transport_security_state->DeleteDynamicDataForHost(host));
  1741. }
  1742. void NetworkContext::EnableStaticKeyPinningForTesting(
  1743. EnableStaticKeyPinningForTestingCallback callback) {
  1744. net::TransportSecurityState* state =
  1745. url_request_context_->transport_security_state();
  1746. state->EnableStaticPinsForTesting();
  1747. state->SetPinningListAlwaysTimelyForTesting(true);
  1748. std::move(callback).Run();
  1749. }
  1750. void NetworkContext::VerifyCertificateForTesting(
  1751. const scoped_refptr<net::X509Certificate>& certificate,
  1752. const std::string& hostname,
  1753. const std::string& ocsp_response,
  1754. const std::string& sct_list,
  1755. VerifyCertificateForTestingCallback callback) {
  1756. net::CertVerifier* cert_verifier = url_request_context_->cert_verifier();
  1757. auto state = std::make_unique<TestVerifyCertState>();
  1758. auto* request = &state->request;
  1759. auto* result = &state->result;
  1760. cert_verifier->Verify(
  1761. net::CertVerifier::RequestParams(certificate.get(), hostname, 0,
  1762. ocsp_response, sct_list),
  1763. result,
  1764. base::BindOnce(TestVerifyCertCallback, std::move(state),
  1765. std::move(callback)),
  1766. request, net::NetLogWithSource());
  1767. }
  1768. void NetworkContext::PreconnectSockets(
  1769. uint32_t num_streams,
  1770. const GURL& original_url,
  1771. bool allow_credentials,
  1772. const net::NetworkIsolationKey& network_isolation_key) {
  1773. DCHECK(!require_network_isolation_key_ || !network_isolation_key.IsEmpty());
  1774. GURL url = GetHSTSRedirect(original_url);
  1775. // |PreconnectSockets| may receive arguments from the renderer, which is not
  1776. // guaranteed to validate them.
  1777. if (num_streams == 0)
  1778. return;
  1779. std::string user_agent;
  1780. if (url_request_context_->http_user_agent_settings()) {
  1781. user_agent =
  1782. url_request_context_->http_user_agent_settings()->GetUserAgent();
  1783. }
  1784. net::HttpRequestInfo request_info;
  1785. request_info.url = url;
  1786. request_info.method = net::HttpRequestHeaders::kGetMethod;
  1787. request_info.extra_headers.SetHeader(net::HttpRequestHeaders::kUserAgent,
  1788. user_agent);
  1789. if (allow_credentials) {
  1790. request_info.load_flags = net::LOAD_NORMAL;
  1791. request_info.privacy_mode = net::PRIVACY_MODE_DISABLED;
  1792. } else {
  1793. request_info.load_flags = net::LOAD_DO_NOT_SAVE_COOKIES;
  1794. request_info.privacy_mode = net::PRIVACY_MODE_ENABLED;
  1795. }
  1796. request_info.network_isolation_key = network_isolation_key;
  1797. net::HttpTransactionFactory* factory =
  1798. url_request_context_->http_transaction_factory();
  1799. net::HttpNetworkSession* session = factory->GetSession();
  1800. net::HttpStreamFactory* http_stream_factory = session->http_stream_factory();
  1801. http_stream_factory->PreconnectStreams(
  1802. base::saturated_cast<int32_t>(num_streams), request_info);
  1803. }
  1804. #if BUILDFLAG(IS_P2P_ENABLED)
  1805. void NetworkContext::CreateP2PSocketManager(
  1806. const net::NetworkIsolationKey& network_isolation_key,
  1807. mojo::PendingRemote<mojom::P2PTrustedSocketManagerClient> client,
  1808. mojo::PendingReceiver<mojom::P2PTrustedSocketManager>
  1809. trusted_socket_manager,
  1810. mojo::PendingReceiver<mojom::P2PSocketManager> socket_manager_receiver) {
  1811. std::unique_ptr<P2PSocketManager> socket_manager =
  1812. std::make_unique<P2PSocketManager>(
  1813. network_isolation_key, std::move(client),
  1814. std::move(trusted_socket_manager), std::move(socket_manager_receiver),
  1815. base::BindRepeating(&NetworkContext::DestroySocketManager,
  1816. base::Unretained(this)),
  1817. url_request_context_);
  1818. socket_managers_[socket_manager.get()] = std::move(socket_manager);
  1819. }
  1820. #endif // BUILDFLAG(IS_P2P_ENABLED)
  1821. void NetworkContext::CreateMdnsResponder(
  1822. mojo::PendingReceiver<mojom::MdnsResponder> responder_receiver) {
  1823. #if BUILDFLAG(ENABLE_MDNS)
  1824. if (!mdns_responder_manager_)
  1825. mdns_responder_manager_ = std::make_unique<MdnsResponderManager>();
  1826. mdns_responder_manager_->CreateMdnsResponder(std::move(responder_receiver));
  1827. #else
  1828. NOTREACHED();
  1829. #endif // BUILDFLAG(ENABLE_MDNS)
  1830. }
  1831. void NetworkContext::AddDomainReliabilityContextForTesting(
  1832. const url::Origin& origin,
  1833. const GURL& upload_url,
  1834. AddDomainReliabilityContextForTestingCallback callback) {
  1835. auto config = std::make_unique<domain_reliability::DomainReliabilityConfig>();
  1836. config->origin = origin;
  1837. config->include_subdomains = false;
  1838. config->collectors.push_back(std::make_unique<GURL>(upload_url));
  1839. config->success_sample_rate = 1.0;
  1840. config->failure_sample_rate = 1.0;
  1841. domain_reliability_monitor_->AddContextForTesting(std::move(config));
  1842. std::move(callback).Run();
  1843. }
  1844. void NetworkContext::ForceDomainReliabilityUploadsForTesting(
  1845. ForceDomainReliabilityUploadsForTestingCallback callback) {
  1846. domain_reliability_monitor_->ForceUploadsForTesting();
  1847. std::move(callback).Run();
  1848. }
  1849. void NetworkContext::SetSplitAuthCacheByNetworkIsolationKey(
  1850. bool split_auth_cache_by_network_isolation_key) {
  1851. url_request_context_->http_transaction_factory()
  1852. ->GetSession()
  1853. ->http_auth_cache()
  1854. ->SetKeyServerEntriesByNetworkIsolationKey(
  1855. split_auth_cache_by_network_isolation_key);
  1856. }
  1857. void NetworkContext::SaveHttpAuthCacheProxyEntries(
  1858. SaveHttpAuthCacheProxyEntriesCallback callback) {
  1859. net::HttpAuthCache* http_auth_cache =
  1860. url_request_context_->http_transaction_factory()
  1861. ->GetSession()
  1862. ->http_auth_cache();
  1863. base::UnguessableToken cache_key =
  1864. network_service_->http_auth_cache_copier()->SaveHttpAuthCache(
  1865. *http_auth_cache);
  1866. std::move(callback).Run(cache_key);
  1867. }
  1868. void NetworkContext::LoadHttpAuthCacheProxyEntries(
  1869. const base::UnguessableToken& cache_key,
  1870. LoadHttpAuthCacheProxyEntriesCallback callback) {
  1871. net::HttpAuthCache* http_auth_cache =
  1872. url_request_context_->http_transaction_factory()
  1873. ->GetSession()
  1874. ->http_auth_cache();
  1875. network_service_->http_auth_cache_copier()->LoadHttpAuthCache(
  1876. cache_key, http_auth_cache);
  1877. std::move(callback).Run();
  1878. }
  1879. void NetworkContext::AddAuthCacheEntry(
  1880. const net::AuthChallengeInfo& challenge,
  1881. const net::NetworkIsolationKey& network_isolation_key,
  1882. const net::AuthCredentials& credentials,
  1883. AddAuthCacheEntryCallback callback) {
  1884. net::HttpAuthCache* http_auth_cache =
  1885. url_request_context_->http_transaction_factory()
  1886. ->GetSession()
  1887. ->http_auth_cache();
  1888. http_auth_cache->Add(
  1889. challenge.challenger,
  1890. challenge.is_proxy ? net::HttpAuth::AUTH_PROXY
  1891. : net::HttpAuth::AUTH_SERVER,
  1892. challenge.realm, net::HttpAuth::StringToScheme(challenge.scheme),
  1893. network_isolation_key, challenge.challenge, credentials, challenge.path);
  1894. std::move(callback).Run();
  1895. }
  1896. void NetworkContext::SetCorsNonWildcardRequestHeadersSupport(bool value) {
  1897. if (!base::FeatureList::IsEnabled(
  1898. features::kCorsNonWildcardRequestHeadersSupport)) {
  1899. return;
  1900. }
  1901. cors_non_wildcard_request_headers_support_ =
  1902. cors::NonWildcardRequestHeadersSupport(value);
  1903. }
  1904. void NetworkContext::LookupServerBasicAuthCredentials(
  1905. const GURL& url,
  1906. const net::NetworkIsolationKey& network_isolation_key,
  1907. LookupServerBasicAuthCredentialsCallback callback) {
  1908. net::HttpAuthCache* http_auth_cache =
  1909. url_request_context_->http_transaction_factory()
  1910. ->GetSession()
  1911. ->http_auth_cache();
  1912. net::HttpAuthCache::Entry* entry = http_auth_cache->LookupByPath(
  1913. url::SchemeHostPort(url), net::HttpAuth::AUTH_SERVER,
  1914. network_isolation_key, url.path());
  1915. if (entry && entry->scheme() == net::HttpAuth::AUTH_SCHEME_BASIC)
  1916. std::move(callback).Run(entry->credentials());
  1917. else
  1918. std::move(callback).Run(absl::nullopt);
  1919. }
  1920. #if BUILDFLAG(IS_CHROMEOS_ASH)
  1921. void NetworkContext::LookupProxyAuthCredentials(
  1922. const net::ProxyServer& proxy_server,
  1923. const std::string& auth_scheme,
  1924. const std::string& realm,
  1925. LookupProxyAuthCredentialsCallback callback) {
  1926. net::HttpAuth::Scheme net_scheme =
  1927. net::HttpAuth::StringToScheme(base::ToLowerASCII(auth_scheme));
  1928. if (net_scheme == net::HttpAuth::Scheme::AUTH_SCHEME_MAX) {
  1929. std::move(callback).Run(absl::nullopt);
  1930. return;
  1931. }
  1932. net::HttpAuthCache* http_auth_cache =
  1933. url_request_context_->http_transaction_factory()
  1934. ->GetSession()
  1935. ->http_auth_cache();
  1936. // TODO(https://crbug.com/1103768): Mapping proxy addresses to URLs is a
  1937. // lossy conversion, shouldn't do this.
  1938. const char* scheme =
  1939. proxy_server.is_secure_http_like() ? "https://" : "http://";
  1940. url::SchemeHostPort scheme_host_port(
  1941. GURL(scheme + proxy_server.host_port_pair().ToString()));
  1942. if (!scheme_host_port.IsValid()) {
  1943. std::move(callback).Run(absl::nullopt);
  1944. return;
  1945. }
  1946. // Unlike server credentials, proxy credentials are not keyed on
  1947. // NetworkIsolationKey.
  1948. net::HttpAuthCache::Entry* entry =
  1949. http_auth_cache->Lookup(scheme_host_port, net::HttpAuth::AUTH_PROXY,
  1950. realm, net_scheme, net::NetworkIsolationKey());
  1951. if (entry)
  1952. std::move(callback).Run(entry->credentials());
  1953. else
  1954. std::move(callback).Run(absl::nullopt);
  1955. }
  1956. #endif // BUILDFLAG(IS_CHROMEOS_ASH)
  1957. const net::HttpAuthPreferences* NetworkContext::GetHttpAuthPreferences() const {
  1958. return &http_auth_merged_preferences_;
  1959. }
  1960. NetworkServiceMemoryCache* NetworkContext::GetMemoryCache() {
  1961. return memory_cache_.get();
  1962. }
  1963. size_t NetworkContext::NumOpenWebTransports() const {
  1964. return std::count_if(web_transports_.begin(), web_transports_.end(),
  1965. [](const std::unique_ptr<WebTransport>& transport) {
  1966. return !transport->torn_down();
  1967. });
  1968. }
  1969. void NetworkContext::OnHttpAuthDynamicParamsChanged(
  1970. const mojom::HttpAuthDynamicParams*
  1971. http_auth_dynamic_network_service_params) {
  1972. http_auth_merged_preferences_.SetServerAllowlist(
  1973. http_auth_dynamic_network_service_params->server_allowlist);
  1974. http_auth_merged_preferences_.SetDelegateAllowlist(
  1975. http_auth_dynamic_network_service_params->delegate_allowlist);
  1976. http_auth_merged_preferences_.set_delegate_by_kdc_policy(
  1977. http_auth_dynamic_network_service_params->delegate_by_kdc_policy);
  1978. http_auth_merged_preferences_.set_negotiate_disable_cname_lookup(
  1979. http_auth_dynamic_network_service_params->negotiate_disable_cname_lookup);
  1980. http_auth_merged_preferences_.set_negotiate_enable_port(
  1981. http_auth_dynamic_network_service_params->enable_negotiate_port);
  1982. http_auth_merged_preferences_.set_basic_over_http_enabled(
  1983. http_auth_dynamic_network_service_params->basic_over_http_enabled);
  1984. #if BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA)
  1985. http_auth_merged_preferences_.set_ntlm_v2_enabled(
  1986. http_auth_dynamic_network_service_params->ntlm_v2_enabled);
  1987. #endif // BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA)
  1988. #if BUILDFLAG(IS_ANDROID)
  1989. http_auth_merged_preferences_.set_auth_android_negotiate_account_type(
  1990. http_auth_dynamic_network_service_params->android_negotiate_account_type);
  1991. #endif // BUILDFLAG(IS_ANDROID)
  1992. #if BUILDFLAG(IS_CHROMEOS)
  1993. http_auth_merged_preferences_.set_allow_gssapi_library_load(
  1994. http_auth_dynamic_network_service_params->allow_gssapi_library_load);
  1995. #endif // BUILDFLAG(IS_CHROMEOS)
  1996. if (http_auth_dynamic_network_service_params->allowed_schemes.has_value()) {
  1997. http_auth_merged_preferences_.set_allowed_schemes(std::set<std::string>(
  1998. http_auth_dynamic_network_service_params->allowed_schemes->begin(),
  1999. http_auth_dynamic_network_service_params->allowed_schemes->end()));
  2000. } else {
  2001. http_auth_merged_preferences_.set_allowed_schemes(absl::nullopt);
  2002. }
  2003. url_matcher_ = std::make_unique<url_matcher::URLMatcher>();
  2004. url_matcher::util::AddAllowFilters(url_matcher_.get(),
  2005. http_auth_dynamic_network_service_params
  2006. ->patterns_allowed_to_use_all_schemes);
  2007. http_auth_merged_preferences_.set_http_auth_scheme_filter(
  2008. base::BindRepeating(&NetworkContext::IsAllowedToUseAllHttpAuthSchemes,
  2009. base::Unretained(this)));
  2010. }
  2011. URLRequestContextOwner NetworkContext::MakeURLRequestContext(
  2012. mojo::PendingRemote<mojom::URLLoaderFactory>
  2013. url_loader_factory_for_cert_net_fetcher,
  2014. scoped_refptr<SessionCleanupCookieStore> session_cleanup_cookie_store,
  2015. OnURLRequestContextBuilderConfiguredCallback
  2016. on_url_request_context_builder_configured) {
  2017. URLRequestContextBuilderMojo builder;
  2018. const base::CommandLine* command_line =
  2019. base::CommandLine::ForCurrentProcess();
  2020. std::unique_ptr<net::CertVerifier> cert_verifier;
  2021. if (g_cert_verifier_for_testing) {
  2022. cert_verifier = std::make_unique<WrappedTestingCertVerifier>();
  2023. } else {
  2024. DCHECK(params_->cert_verifier_params);
  2025. // base::Unretained() is safe below because |this| will own
  2026. // |cert_verifier|.
  2027. // TODO(https://crbug.com/1085233): this cert verifier should deal with
  2028. // disconnections if the CertVerifierService is run outside of the browser
  2029. // process.
  2030. cert_verifier = std::make_unique<cert_verifier::MojoCertVerifier>(
  2031. std::move(params_->cert_verifier_params->cert_verifier_service),
  2032. std::move(url_loader_factory_for_cert_net_fetcher),
  2033. base::BindRepeating(
  2034. &NetworkContext::CreateURLLoaderFactoryForCertNetFetcher,
  2035. base::Unretained(this)));
  2036. #if BUILDFLAG(IS_CT_SUPPORTED)
  2037. std::vector<scoped_refptr<const net::CTLogVerifier>> ct_logs;
  2038. for (const auto& log : network_service_->log_list()) {
  2039. scoped_refptr<const net::CTLogVerifier> log_verifier =
  2040. net::CTLogVerifier::Create(log->public_key, log->name);
  2041. if (!log_verifier) {
  2042. // TODO: Signal bad configuration (such as bad key).
  2043. continue;
  2044. }
  2045. ct_logs.push_back(std::move(log_verifier));
  2046. }
  2047. auto ct_verifier = std::make_unique<net::MultiLogCTVerifier>(
  2048. network_service_->ct_log_list_distributor());
  2049. ct_verifier->SetLogs(ct_logs);
  2050. cert_verifier = std::make_unique<net::CertAndCTVerifier>(
  2051. std::move(cert_verifier), std::move(ct_verifier));
  2052. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  2053. // Whether the cert verifier is remote or in-process, we should wrap it in
  2054. // caching and coalescing layers to avoid extra verifications and IPCs.
  2055. cert_verifier = std::make_unique<net::CachingCertVerifier>(
  2056. std::make_unique<net::CoalescingCertVerifier>(
  2057. std::move(cert_verifier)));
  2058. #if BUILDFLAG(IS_CHROMEOS)
  2059. cert_verifier_with_trust_anchors_ =
  2060. new CertVerifierWithTrustAnchors(base::BindRepeating(
  2061. &NetworkContext::TrustAnchorUsed, base::Unretained(this)));
  2062. UpdateAdditionalCertificates(
  2063. std::move(params_->initial_additional_certificates));
  2064. cert_verifier_with_trust_anchors_->InitializeOnIOThread(
  2065. std::move(cert_verifier));
  2066. cert_verifier = base::WrapUnique(cert_verifier_with_trust_anchors_.get());
  2067. #endif // BUILDFLAG(IS_CHROMEOS)
  2068. }
  2069. builder.SetCertVerifier(IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
  2070. *command_line, nullptr, std::move(cert_verifier)));
  2071. #if BUILDFLAG(IS_CT_SUPPORTED)
  2072. if (params_->enforce_chrome_ct_policy) {
  2073. std::vector<std::pair<std::string, base::Time>> disqualified_logs;
  2074. std::vector<std::string> operated_by_google_logs;
  2075. std::map<std::string, certificate_transparency::OperatorHistoryEntry>
  2076. log_operator_history;
  2077. GetCTPolicyConfigForCTLogInfo(network_service_->log_list(),
  2078. &disqualified_logs, &operated_by_google_logs,
  2079. &log_operator_history);
  2080. auto ct_policy_enforcer =
  2081. std::make_unique<certificate_transparency::ChromeCTPolicyEnforcer>(
  2082. network_service_->ct_log_list_update_time(),
  2083. std::move(disqualified_logs), std::move(operated_by_google_logs),
  2084. std::move(log_operator_history));
  2085. ct_policy_enforcer_ = ct_policy_enforcer.get();
  2086. builder.set_ct_policy_enforcer(std::move(ct_policy_enforcer));
  2087. }
  2088. builder.set_sct_auditing_delegate(
  2089. std::make_unique<SCTAuditingDelegate>(weak_factory_.GetWeakPtr()));
  2090. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  2091. std::unique_ptr<NetworkServiceNetworkDelegate> network_delegate =
  2092. std::make_unique<NetworkServiceNetworkDelegate>(
  2093. params_->enable_referrers,
  2094. params_->validate_referrer_policy_on_initial_request,
  2095. std::move(params_->proxy_error_client), this);
  2096. network_delegate_ = network_delegate.get();
  2097. builder.set_network_delegate(std::move(network_delegate));
  2098. if (params_->initial_custom_proxy_config ||
  2099. params_->custom_proxy_config_client_receiver) {
  2100. std::unique_ptr<NetworkServiceProxyDelegate> proxy_delegate =
  2101. std::make_unique<NetworkServiceProxyDelegate>(
  2102. std::move(params_->initial_custom_proxy_config),
  2103. std::move(params_->custom_proxy_config_client_receiver),
  2104. std::move(params_->custom_proxy_connection_observer_remote));
  2105. proxy_delegate_ = proxy_delegate.get();
  2106. builder.set_proxy_delegate(std::move(proxy_delegate));
  2107. }
  2108. net::NetLog* net_log = nullptr;
  2109. if (network_service_) {
  2110. net_log = network_service_->net_log();
  2111. builder.set_net_log(net_log);
  2112. builder.set_host_resolver_manager(
  2113. network_service_->host_resolver_manager());
  2114. builder.set_host_resolver_factory(
  2115. network_service_->host_resolver_factory());
  2116. builder.SetHttpAuthHandlerFactory(
  2117. network_service_->CreateHttpAuthHandlerFactory(this));
  2118. builder.set_network_quality_estimator(
  2119. network_service_->network_quality_estimator());
  2120. }
  2121. if (session_cleanup_cookie_store) {
  2122. std::unique_ptr<net::CookieMonster> cookie_store =
  2123. std::make_unique<net::CookieMonster>(
  2124. session_cleanup_cookie_store.get(), net_log,
  2125. first_party_sets_access_delegate_.is_enabled());
  2126. if (params_->persist_session_cookies)
  2127. cookie_store->SetPersistSessionCookies(true);
  2128. builder.SetCookieStore(std::move(cookie_store));
  2129. }
  2130. if (base::FeatureList::IsEnabled(features::kTrustTokens)) {
  2131. trust_token_store_ = std::make_unique<PendingTrustTokenStore>();
  2132. base::FilePath trust_token_path;
  2133. if (GetFullDataFilePath(
  2134. params_->file_paths,
  2135. &network::mojom::NetworkContextFilePaths::trust_token_database_name,
  2136. trust_token_path)) {
  2137. SQLiteTrustTokenPersister::CreateForFilePath(
  2138. base::ThreadPool::CreateSequencedTaskRunner(
  2139. {base::MayBlock(), kTrustTokenDatabaseTaskPriority,
  2140. base::TaskShutdownBehavior::BLOCK_SHUTDOWN}),
  2141. trust_token_path, kTrustTokenWriteBufferingWindow,
  2142. base::BindOnce(&NetworkContext::FinishConstructingTrustTokenStore,
  2143. weak_factory_.GetWeakPtr()));
  2144. } else {
  2145. trust_token_store_->OnStoreReady(std::make_unique<TrustTokenStore>(
  2146. std::make_unique<InMemoryTrustTokenPersister>(),
  2147. std::make_unique<ExpiryInspectingRecordExpiryDelegate>(
  2148. network_service()->trust_token_key_commitments())));
  2149. }
  2150. }
  2151. std::unique_ptr<net::StaticHttpUserAgentSettings> user_agent_settings =
  2152. std::make_unique<net::StaticHttpUserAgentSettings>(
  2153. params_->accept_language, params_->user_agent);
  2154. // Borrow an alias for future use before giving the builder ownership.
  2155. user_agent_settings_ = user_agent_settings.get();
  2156. builder.set_http_user_agent_settings(std::move(user_agent_settings));
  2157. builder.set_enable_brotli(params_->enable_brotli);
  2158. if (params_->proxy_resolver_factory) {
  2159. builder.SetMojoProxyResolverFactory(
  2160. std::move(params_->proxy_resolver_factory));
  2161. }
  2162. #if BUILDFLAG(IS_WIN)
  2163. if (params_->windows_system_proxy_resolver) {
  2164. builder.SetMojoWindowsSystemProxyResolver(
  2165. std::move(params_->windows_system_proxy_resolver));
  2166. }
  2167. #endif // BUILDFLAG(IS_WIN)
  2168. #if BUILDFLAG(IS_CHROMEOS_ASH)
  2169. if (params_->dhcp_wpad_url_client) {
  2170. builder.SetDhcpWpadUrlClient(std::move(params_->dhcp_wpad_url_client));
  2171. }
  2172. #endif // BUILDFLAG(IS_CHROMEOS_ASH)
  2173. if (!params_->http_cache_enabled) {
  2174. builder.DisableHttpCache();
  2175. } else {
  2176. net::URLRequestContextBuilder::HttpCacheParams cache_params;
  2177. cache_params.max_size = params_->http_cache_max_size;
  2178. if (!params_->http_cache_directory) {
  2179. cache_params.type =
  2180. net::URLRequestContextBuilder::HttpCacheParams::IN_MEMORY;
  2181. } else {
  2182. cache_params.path = params_->http_cache_directory->path();
  2183. cache_params.type = network_session_configurator::ChooseCacheType();
  2184. if (params_->http_cache_file_operations_factory) {
  2185. cache_params.file_operations_factory =
  2186. base::MakeRefCounted<MojoBackendFileOperationsFactory>(
  2187. std::move(params_->http_cache_file_operations_factory));
  2188. }
  2189. }
  2190. cache_params.reset_cache = params_->reset_http_cache_backend;
  2191. #if BUILDFLAG(IS_ANDROID)
  2192. cache_params.app_status_listener = app_status_listener();
  2193. #endif // BUILDFLAG(IS_ANDROID)
  2194. builder.EnableHttpCache(cache_params);
  2195. }
  2196. std::unique_ptr<SSLConfigServiceMojo> ssl_config_service =
  2197. std::make_unique<SSLConfigServiceMojo>(
  2198. std::move(params_->initial_ssl_config),
  2199. std::move(params_->ssl_config_client_receiver),
  2200. network_service_->crl_set_distributor());
  2201. SSLConfigServiceMojo* ssl_config_service_raw = ssl_config_service.get();
  2202. builder.set_ssl_config_service(std::move(ssl_config_service));
  2203. if (!params_->initial_proxy_config &&
  2204. !params_->proxy_config_client_receiver.is_valid()) {
  2205. params_->initial_proxy_config =
  2206. net::ProxyConfigWithAnnotation::CreateDirect();
  2207. }
  2208. builder.set_proxy_config_service(std::make_unique<ProxyConfigServiceMojo>(
  2209. std::move(params_->proxy_config_client_receiver),
  2210. std::move(params_->initial_proxy_config),
  2211. std::move(params_->proxy_config_poller_client)));
  2212. builder.set_pac_quick_check_enabled(params_->pac_quick_check_enabled);
  2213. std::unique_ptr<PrefService> pref_service;
  2214. base::FilePath http_server_properties_file_name;
  2215. if (GetFullDataFilePath(params_->file_paths,
  2216. &network::mojom::NetworkContextFilePaths::
  2217. http_server_properties_file_name,
  2218. http_server_properties_file_name)) {
  2219. scoped_refptr<JsonPrefStore> json_pref_store(new JsonPrefStore(
  2220. http_server_properties_file_name, nullptr,
  2221. base::ThreadPool::CreateSequencedTaskRunner(
  2222. {base::MayBlock(), base::TaskShutdownBehavior::BLOCK_SHUTDOWN,
  2223. base::TaskPriority::BEST_EFFORT})));
  2224. PrefServiceFactory pref_service_factory;
  2225. pref_service_factory.set_user_prefs(json_pref_store);
  2226. pref_service_factory.set_async(true);
  2227. scoped_refptr<PrefRegistrySimple> pref_registry(new PrefRegistrySimple());
  2228. HttpServerPropertiesPrefDelegate::RegisterPrefs(pref_registry.get());
  2229. NetworkQualitiesPrefDelegate::RegisterPrefs(pref_registry.get());
  2230. pref_service = pref_service_factory.Create(pref_registry.get());
  2231. builder.SetHttpServerProperties(std::make_unique<net::HttpServerProperties>(
  2232. std::make_unique<HttpServerPropertiesPrefDelegate>(pref_service.get()),
  2233. net_log));
  2234. network_qualities_pref_delegate_ =
  2235. std::make_unique<NetworkQualitiesPrefDelegate>(
  2236. pref_service.get(), network_service_->network_quality_estimator());
  2237. }
  2238. base::FilePath transport_security_persister_file_name;
  2239. if (GetFullDataFilePath(params_->file_paths,
  2240. &network::mojom::NetworkContextFilePaths::
  2241. transport_security_persister_file_name,
  2242. transport_security_persister_file_name)) {
  2243. builder.set_transport_security_persister_file_path(
  2244. transport_security_persister_file_name);
  2245. }
  2246. builder.set_hsts_policy_bypass_list(params_->hsts_policy_bypass_list);
  2247. #if BUILDFLAG(ENABLE_REPORTING)
  2248. bool reporting_enabled = base::FeatureList::IsEnabled(features::kReporting);
  2249. if (reporting_enabled) {
  2250. auto reporting_policy = net::ReportingPolicy::Create();
  2251. if (params_->reporting_delivery_interval) {
  2252. reporting_policy->delivery_interval =
  2253. *params_->reporting_delivery_interval;
  2254. reporting_policy->endpoint_backoff_policy.initial_delay_ms =
  2255. params_->reporting_delivery_interval->InMilliseconds();
  2256. }
  2257. builder.set_reporting_policy(std::move(reporting_policy));
  2258. } else {
  2259. builder.set_reporting_policy(nullptr);
  2260. }
  2261. bool nel_enabled =
  2262. base::FeatureList::IsEnabled(features::kNetworkErrorLogging);
  2263. builder.set_network_error_logging_enabled(nel_enabled);
  2264. base::FilePath reporting_and_nel_store_database_name;
  2265. if (GetFullDataFilePath(params_->file_paths,
  2266. &network::mojom::NetworkContextFilePaths::
  2267. reporting_and_nel_store_database_name,
  2268. reporting_and_nel_store_database_name) &&
  2269. (reporting_enabled || nel_enabled)) {
  2270. scoped_refptr<base::SequencedTaskRunner> client_task_runner =
  2271. base::ThreadTaskRunnerHandle::Get();
  2272. scoped_refptr<base::SequencedTaskRunner> background_task_runner =
  2273. base::ThreadPool::CreateSequencedTaskRunner(
  2274. {base::MayBlock(),
  2275. net::GetReportingAndNelStoreBackgroundSequencePriority(),
  2276. base::TaskShutdownBehavior::BLOCK_SHUTDOWN});
  2277. std::unique_ptr<net::SQLitePersistentReportingAndNelStore> sqlite_store(
  2278. new net::SQLitePersistentReportingAndNelStore(
  2279. reporting_and_nel_store_database_name, client_task_runner,
  2280. background_task_runner));
  2281. builder.set_persistent_reporting_and_nel_store(std::move(sqlite_store));
  2282. } else {
  2283. builder.set_persistent_reporting_and_nel_store(nullptr);
  2284. }
  2285. #endif // BUILDFLAG(ENABLE_REPORTING)
  2286. net::HttpNetworkSessionParams session_params;
  2287. bool is_quic_force_disabled = false;
  2288. if (network_service_ && network_service_->quic_disabled())
  2289. is_quic_force_disabled = true;
  2290. auto quic_context = std::make_unique<net::QuicContext>();
  2291. network_session_configurator::ParseCommandLineAndFieldTrials(
  2292. *base::CommandLine::ForCurrentProcess(), is_quic_force_disabled,
  2293. params_->quic_user_agent_id, &session_params, quic_context->params());
  2294. session_params.disable_idle_sockets_close_on_memory_pressure =
  2295. params_->disable_idle_sockets_close_on_memory_pressure;
  2296. if (network_service_) {
  2297. session_params.key_auth_cache_server_entries_by_network_isolation_key =
  2298. network_service_->split_auth_cache_by_network_isolation_key();
  2299. }
  2300. session_params.key_auth_cache_server_entries_by_network_isolation_key =
  2301. base::FeatureList::IsEnabled(
  2302. features::kSplitAuthCacheByNetworkIsolationKey);
  2303. builder.set_http_network_session_params(session_params);
  2304. builder.set_quic_context(std::move(quic_context));
  2305. builder.SetCreateHttpTransactionFactoryCallback(
  2306. base::BindOnce([](net::HttpNetworkSession* session)
  2307. -> std::unique_ptr<net::HttpTransactionFactory> {
  2308. return std::make_unique<ThrottlingNetworkTransactionFactory>(session);
  2309. }));
  2310. builder.set_host_mapping_rules(
  2311. command_line->GetSwitchValueASCII(switches::kHostResolverRules));
  2312. builder.set_first_party_sets_enabled(
  2313. first_party_sets_access_delegate_.is_enabled());
  2314. if (params_->socket_broker) {
  2315. builder.set_client_socket_factory(
  2316. std::make_unique<BrokeredClientSocketFactory>(
  2317. std::move(params_->socket_broker)));
  2318. }
  2319. // If `require_network_isolation_key_` is true, but the features that can
  2320. // trigger another URLRequest are not set to respect NetworkIsolationKeys,
  2321. // the URLRequests that they create might not have a NIK, so only set the
  2322. // corresponding value in the URLRequestContext to true at the URLRequest
  2323. // layer if all those features are set to respect NIK.
  2324. if (require_network_isolation_key_ &&
  2325. base::FeatureList::IsEnabled(
  2326. net::features::kPartitionConnectionsByNetworkIsolationKey) &&
  2327. base::FeatureList::IsEnabled(
  2328. net::features::kPartitionExpectCTStateByNetworkIsolationKey) &&
  2329. base::FeatureList::IsEnabled(
  2330. net::features::kPartitionHttpServerPropertiesByNetworkIsolationKey) &&
  2331. base::FeatureList::IsEnabled(
  2332. net::features::kPartitionNelAndReportingByNetworkIsolationKey) &&
  2333. base::FeatureList::IsEnabled(
  2334. net::features::kPartitionSSLSessionsByNetworkIsolationKey) &&
  2335. base::FeatureList::IsEnabled(
  2336. domain_reliability::features::
  2337. kPartitionDomainReliabilityByNetworkIsolationKey)) {
  2338. builder.set_require_network_isolation_key(true);
  2339. }
  2340. #if BUILDFLAG(IS_ANDROID)
  2341. builder.set_check_cleartext_permitted(params_->check_clear_text_permitted);
  2342. #endif // BUILDFLAG(IS_ANDROID)
  2343. if (on_url_request_context_builder_configured) {
  2344. std::move(on_url_request_context_builder_configured).Run(&builder);
  2345. }
  2346. auto result =
  2347. URLRequestContextOwner(std::move(pref_service), builder.Build());
  2348. require_network_isolation_key_ = params_->require_network_isolation_key;
  2349. // Subscribe the CertVerifier to configuration changes that are exposed via
  2350. // the mojom::SSLConfig, but which are not part of the
  2351. // net::SSLConfig[Service] interfaces.
  2352. ssl_config_service_raw->SetCertVerifierForConfiguring(
  2353. result.url_request_context->cert_verifier());
  2354. // Attach some things to the URLRequestContextBuilder's
  2355. // TransportSecurityState. Since no requests have been made yet, safe to do
  2356. // this even after the call to Build().
  2357. if (params_->enable_certificate_reporting) {
  2358. net::NetworkTrafficAnnotationTag traffic_annotation =
  2359. net::DefineNetworkTrafficAnnotation("domain_security_policy", R"(
  2360. semantics {
  2361. sender: "Domain Security Policy"
  2362. description:
  2363. "Websites can opt in to have Chrome send reports to them when "
  2364. "Chrome observes connections to that website that do not meet "
  2365. "stricter security policies, such as with HTTP Public Key Pinning. "
  2366. "Websites can use this feature to discover misconfigurations that "
  2367. "prevent them from complying with stricter security policies that "
  2368. "they\'ve opted in to."
  2369. trigger:
  2370. "Chrome observes that a user is loading a resource from a website "
  2371. "that has opted in for security policy reports, and the connection "
  2372. "does not meet the required security policies."
  2373. data:
  2374. "The time of the request, the hostname and port being requested, "
  2375. "the certificate chain, and sometimes certificate revocation "
  2376. "information included on the connection."
  2377. destination: OTHER
  2378. }
  2379. policy {
  2380. cookies_allowed: NO
  2381. setting: "This feature cannot be disabled by settings."
  2382. policy_exception_justification:
  2383. "Not implemented, this is a feature that websites can opt into and "
  2384. "thus there is no Chrome-wide policy to disable it."
  2385. })");
  2386. certificate_report_sender_ = std::make_unique<net::ReportSender>(
  2387. result.url_request_context.get(), traffic_annotation);
  2388. result.url_request_context->transport_security_state()->SetReportSender(
  2389. certificate_report_sender_.get());
  2390. }
  2391. if (network_service_->pins_list_updated()) {
  2392. result.url_request_context->transport_security_state()->UpdatePinList(
  2393. network_service_->pinsets(), network_service_->host_pins(),
  2394. network_service_->pins_list_update_time());
  2395. }
  2396. #if BUILDFLAG(IS_CT_SUPPORTED)
  2397. if (params_->enable_expect_ct_reporting) {
  2398. LazyCreateExpectCTReporter(result.url_request_context.get());
  2399. result.url_request_context->transport_security_state()->SetExpectCTReporter(
  2400. expect_ct_reporter_.get());
  2401. }
  2402. if (params_->enforce_chrome_ct_policy) {
  2403. require_ct_delegate_ =
  2404. std::make_unique<certificate_transparency::ChromeRequireCTDelegate>();
  2405. result.url_request_context->transport_security_state()
  2406. ->SetRequireCTDelegate(require_ct_delegate_.get());
  2407. }
  2408. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  2409. if (params_->enable_domain_reliability) {
  2410. domain_reliability_monitor_ =
  2411. std::make_unique<domain_reliability::DomainReliabilityMonitor>(
  2412. result.url_request_context.get(),
  2413. params_->domain_reliability_upload_reporter,
  2414. base::BindRepeating(&NetworkContext::CanUploadDomainReliability,
  2415. base::Unretained(this)));
  2416. domain_reliability_monitor_->AddBakedInConfigs();
  2417. domain_reliability_monitor_->SetDiscardUploads(
  2418. params_->discard_domain_reliablity_uploads);
  2419. }
  2420. if (proxy_delegate_) {
  2421. proxy_delegate_->SetProxyResolutionService(
  2422. result.url_request_context->proxy_resolution_service());
  2423. }
  2424. if (cert_net_fetcher_)
  2425. cert_net_fetcher_->SetURLRequestContext(result.url_request_context.get());
  2426. return result;
  2427. }
  2428. scoped_refptr<SessionCleanupCookieStore>
  2429. NetworkContext::MakeSessionCleanupCookieStore() const {
  2430. base::FilePath cookie_path;
  2431. if (!GetFullDataFilePath(
  2432. params_->file_paths,
  2433. &network::mojom::NetworkContextFilePaths::cookie_database_name,
  2434. cookie_path)) {
  2435. DCHECK(!params_->restore_old_session_cookies);
  2436. DCHECK(!params_->persist_session_cookies);
  2437. return nullptr;
  2438. }
  2439. scoped_refptr<base::SequencedTaskRunner> client_task_runner =
  2440. base::ThreadTaskRunnerHandle::Get();
  2441. scoped_refptr<base::SequencedTaskRunner> background_task_runner =
  2442. base::ThreadPool::CreateSequencedTaskRunner(
  2443. {base::MayBlock(), net::GetCookieStoreBackgroundSequencePriority(),
  2444. base::TaskShutdownBehavior::BLOCK_SHUTDOWN});
  2445. net::CookieCryptoDelegate* crypto_delegate = nullptr;
  2446. if (params_->enable_encrypted_cookies) {
  2447. crypto_delegate = cookie_config::GetCookieCryptoDelegate();
  2448. }
  2449. scoped_refptr<net::SQLitePersistentCookieStore> sqlite_store(
  2450. new net::SQLitePersistentCookieStore(
  2451. cookie_path, client_task_runner, background_task_runner,
  2452. params_->restore_old_session_cookies, crypto_delegate));
  2453. return base::MakeRefCounted<SessionCleanupCookieStore>(sqlite_store);
  2454. }
  2455. void NetworkContext::OnHttpCacheCleared(ClearHttpCacheCallback callback,
  2456. HttpCacheDataRemover* remover) {
  2457. bool removed = false;
  2458. for (auto iter = http_cache_data_removers_.begin();
  2459. iter != http_cache_data_removers_.end(); ++iter) {
  2460. if (iter->get() == remover) {
  2461. removed = true;
  2462. http_cache_data_removers_.erase(iter);
  2463. break;
  2464. }
  2465. }
  2466. DCHECK(removed);
  2467. std::move(callback).Run();
  2468. }
  2469. void NetworkContext::OnHostResolverShutdown(HostResolver* resolver) {
  2470. auto found_resolver = host_resolvers_.find(resolver);
  2471. DCHECK(found_resolver != host_resolvers_.end());
  2472. host_resolvers_.erase(found_resolver);
  2473. }
  2474. void NetworkContext::OnHttpCacheSizeComputed(
  2475. ComputeHttpCacheSizeCallback callback,
  2476. HttpCacheDataCounter* counter,
  2477. bool is_upper_limit,
  2478. int64_t result_or_error) {
  2479. EraseIf(http_cache_data_counters_, base::MatchesUniquePtr(counter));
  2480. std::move(callback).Run(is_upper_limit, result_or_error);
  2481. }
  2482. void NetworkContext::OnConnectionError() {
  2483. // If owned by the network service, this call will delete |this|.
  2484. if (on_connection_close_callback_)
  2485. std::move(on_connection_close_callback_).Run(this);
  2486. }
  2487. GURL NetworkContext::GetHSTSRedirect(const GURL& original_url) {
  2488. // TODO(lilyhoughton) This needs to be gotten rid of once explicit
  2489. // construction with a URLRequestContext is no longer supported.
  2490. if (!url_request_context_->transport_security_state() ||
  2491. !original_url.SchemeIs("http") ||
  2492. !url_request_context_->transport_security_state()->ShouldUpgradeToSSL(
  2493. original_url.host())) {
  2494. return original_url;
  2495. }
  2496. GURL::Replacements replacements;
  2497. replacements.SetSchemeStr("https");
  2498. return original_url.ReplaceComponents(replacements);
  2499. }
  2500. #if BUILDFLAG(IS_P2P_ENABLED)
  2501. void NetworkContext::DestroySocketManager(P2PSocketManager* socket_manager) {
  2502. auto iter = socket_managers_.find(socket_manager);
  2503. DCHECK(iter != socket_managers_.end());
  2504. socket_managers_.erase(iter);
  2505. }
  2506. #endif // BUILDFLAG(IS_P2P_ENABLED)
  2507. void NetworkContext::CanUploadDomainReliability(
  2508. const url::Origin& origin,
  2509. base::OnceCallback<void(bool)> callback) {
  2510. client_->OnCanSendDomainReliabilityUpload(
  2511. origin,
  2512. base::BindOnce([](base::OnceCallback<void(bool)> callback,
  2513. bool allowed) { std::move(callback).Run(allowed); },
  2514. std::move(callback)));
  2515. }
  2516. void NetworkContext::OnVerifyCertForSignedExchangeComplete(
  2517. uint64_t cert_verify_id,
  2518. int result) {
  2519. auto iter = cert_verifier_requests_.find(cert_verify_id);
  2520. DCHECK(iter != cert_verifier_requests_.end());
  2521. auto pending_cert_verify = std::move(iter->second);
  2522. cert_verifier_requests_.erase(iter);
  2523. bool pkp_bypassed = false;
  2524. std::string pinning_failure_log;
  2525. if (result == net::OK) {
  2526. #if BUILDFLAG(IS_CT_SUPPORTED)
  2527. int ct_result = CheckCTComplianceForSignedExchange(
  2528. *pending_cert_verify->result, *pending_cert_verify->certificate,
  2529. net::HostPortPair::FromURL(pending_cert_verify->url),
  2530. pending_cert_verify->network_isolation_key);
  2531. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  2532. net::TransportSecurityState::PKPStatus pin_validity =
  2533. url_request_context_->transport_security_state()->CheckPublicKeyPins(
  2534. net::HostPortPair::FromURL(pending_cert_verify->url),
  2535. pending_cert_verify->result->is_issued_by_known_root,
  2536. pending_cert_verify->result->public_key_hashes,
  2537. pending_cert_verify->certificate.get(),
  2538. pending_cert_verify->result->verified_cert.get(),
  2539. net::TransportSecurityState::ENABLE_PIN_REPORTS,
  2540. pending_cert_verify->network_isolation_key, &pinning_failure_log);
  2541. switch (pin_validity) {
  2542. case net::TransportSecurityState::PKPStatus::VIOLATED:
  2543. pending_cert_verify->result->cert_status |=
  2544. net::CERT_STATUS_PINNED_KEY_MISSING;
  2545. result = net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
  2546. break;
  2547. case net::TransportSecurityState::PKPStatus::BYPASSED:
  2548. pkp_bypassed = true;
  2549. [[fallthrough]];
  2550. case net::TransportSecurityState::PKPStatus::OK:
  2551. // Do nothing.
  2552. break;
  2553. }
  2554. #if BUILDFLAG(IS_CT_SUPPORTED)
  2555. if (result != net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN &&
  2556. ct_result != net::OK)
  2557. result = ct_result;
  2558. #endif // BUILDFLAG(IS_CT_SUPPORTED)
  2559. }
  2560. std::move(pending_cert_verify->callback)
  2561. .Run(result, *pending_cert_verify->result.get(), pkp_bypassed,
  2562. pinning_failure_log);
  2563. }
  2564. #if BUILDFLAG(IS_CHROMEOS)
  2565. void NetworkContext::TrustAnchorUsed() {
  2566. client_->OnTrustAnchorUsed();
  2567. }
  2568. #endif // BUILDFLAG(IS_CHROMEOS)
  2569. #if BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  2570. void NetworkContext::EnsureMounted(network::TransferableDirectory* directory) {
  2571. if (directory->NeedsMount()) {
  2572. dismount_closures_.push_back(directory->Mount());
  2573. }
  2574. }
  2575. #endif // BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  2576. void NetworkContext::InitializeCorsParams() {
  2577. for (const auto& pattern : params_->cors_origin_access_list) {
  2578. cors_origin_access_list_.SetAllowListForOrigin(pattern->source_origin,
  2579. pattern->allow_patterns);
  2580. cors_origin_access_list_.SetBlockListForOrigin(pattern->source_origin,
  2581. pattern->block_patterns);
  2582. }
  2583. for (const auto& key : params_->cors_exempt_header_list)
  2584. cors_exempt_header_list_.insert(key);
  2585. }
  2586. void NetworkContext::FinishConstructingTrustTokenStore(
  2587. std::unique_ptr<SQLiteTrustTokenPersister> persister) {
  2588. trust_token_store_->OnStoreReady(std::make_unique<TrustTokenStore>(
  2589. std::move(persister),
  2590. std::make_unique<ExpiryInspectingRecordExpiryDelegate>(
  2591. network_service()->trust_token_key_commitments())));
  2592. }
  2593. bool NetworkContext::IsAllowedToUseAllHttpAuthSchemes(
  2594. const url::SchemeHostPort& scheme_host_port) {
  2595. DCHECK(url_matcher_);
  2596. return !url_matcher_->MatchURL(scheme_host_port.GetURL()).empty();
  2597. }
  2598. void NetworkContext::CreateTrustedUrlLoaderFactoryForNetworkService(
  2599. mojo::PendingReceiver<mojom::URLLoaderFactory>
  2600. url_loader_factory_pending_receiver) {
  2601. auto url_loader_factory_params = mojom::URLLoaderFactoryParams::New();
  2602. url_loader_factory_params->is_trusted = true;
  2603. url_loader_factory_params->process_id = network::mojom::kBrowserProcessId;
  2604. CreateURLLoaderFactory(std::move(url_loader_factory_pending_receiver),
  2605. std::move(url_loader_factory_params));
  2606. }
  2607. } // namespace network