Changeset 199039 in webkit

Timestamp:

Apr 4, 2016, 9:12:48 PM (11 years ago)

Author:

Brent Fulgham

Message:

Block plaintext WebSocket requests to domains under HSTS.
​https://bugs.webkit.org/show_bug.cgi?id=156049
<rdar://problem/13820000>

Patch by John Wilander <​wilander@apple.com> on 2016-04-04
Reviewed by Brent Fulgham.

No new tests because the way TLS is setup for layout tests doesn't allow the server to set HSTS for 127.0.0.1 nor localhost. This is tracked in <rdar://problem/25467825>.

• Modules/websockets/WebSocketChannel.cpp:

(WebCore::WebSocketChannel::connect):

• Now sends usesEphemeralSession to SocketStreamHandle::create.

• platform/network/cf/SocketStreamHandle.h:

(WebCore::SocketStreamHandle::create):

• Added parameter usesEphemeralSession which it passes on to the SocketStreamHandle constructor.

• platform/network/cf/SocketStreamHandleCFNet.cpp:

(WebCore::SocketStreamHandle::SocketStreamHandle):

• Now blocks plaintext WebSocket connections for domains under HSTS if not in an ephemeral session.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/websockets/WebSocketChannel.cpp (modified) (1 diff)
• platform/network/cf/SocketStreamHandle.h (modified) (2 diffs)
• platform/network/cf/SocketStreamHandleCFNet.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-04-04  John Wilander  <wilander@apple.com>
+
+        Block plaintext WebSocket requests to domains under HSTS.
+        https://bugs.webkit.org/show_bug.cgi?id=156049
+        <rdar://problem/13820000>
+
+        Reviewed by Brent Fulgham.
+
+        No new tests because the way TLS is setup for layout tests doesn't allow the server to set HSTS for 127.0.0.1 nor localhost. This is tracked in <rdar://problem/25467825>.
+
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+            - Now sends usesEphemeralSession to SocketStreamHandle::create.
+        * platform/network/cf/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::create):
+            - Added parameter usesEphemeralSession which it passes on to the SocketStreamHandle constructor.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+            - Now blocks plaintext WebSocket connections for domains under HSTS if not in an ephemeral session.
+
 2016-04-04  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp

@@ -110 +110 @@
         if (NetworkingContext* networkingContext = frame->loader().networkingContext()) {
             ref();
-            m_handle = SocketStreamHandle::create(m_handshake->url(), this, *networkingContext);
+            Page* page = frame->page();
+            m_handle = SocketStreamHandle::create(m_handshake->url(), this, *networkingContext, (page ? page->usesEphemeralSession() : false));
         }
     }

trunk/Source/WebCore/platform/network/cf/SocketStreamHandle.h

@@ -50 +50 @@
 class SocketStreamHandle : public ThreadSafeRefCounted<SocketStreamHandle>, public SocketStreamHandleBase, public AuthenticationClient {
 public:
-    static PassRefPtr<SocketStreamHandle> create(const URL& url, SocketStreamHandleClient* client, NetworkingContext& networkingContext) { return adoptRef(new SocketStreamHandle(url, client, networkingContext)); }
+    static PassRefPtr<SocketStreamHandle> create(const URL& url, SocketStreamHandleClient* client, NetworkingContext& networkingContext, bool usesEphemeralSession) { return adoptRef(new SocketStreamHandle(url, client, networkingContext, usesEphemeralSession)); }
 
     virtual ~SocketStreamHandle();
@@ -61 +61 @@
     virtual void platformClose();
 
-    SocketStreamHandle(const URL&, SocketStreamHandleClient*, NetworkingContext&);
+    SocketStreamHandle(const URL&, SocketStreamHandleClient*, NetworkingContext&, bool usesEphemeralSession);
     void createStreams();
     void scheduleStreams();

trunk/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp

@@ -61 +61 @@
 #endif
 
+#if PLATFORM(COCOA)
+#import <CFNetworkSPI.h>
+#endif
+
 namespace WebCore {
 
-SocketStreamHandle::SocketStreamHandle(const URL& url, SocketStreamHandleClient* client, NetworkingContext& networkingContext)
+SocketStreamHandle::SocketStreamHandle(const URL& url, SocketStreamHandleClient* client, NetworkingContext& networkingContext, bool usesEphemeralSession)
     : SocketStreamHandleBase(url, client)
     , m_connectingSubstate(New)
@@ -76 +80 @@
     URL httpsURL(URL(), "https://" + m_url.host());
     m_httpsURL = httpsURL.createCFURL();
+
+#if PLATFORM(COCOA)
+    // Don't check for HSTS violation for ephemeral sessions since
+    // HSTS state should not transfer between regular and private browsing.
+    if (url.protocolIs("ws")
+        && !usesEphemeralSession
+        && _CFNetworkIsKnownHSTSHostWithSession(m_httpsURL.get(), nullptr)) {
+        m_client->didFailSocketStream(this, SocketStreamError(0, m_url.string(), "WebSocket connection failed because it violates HTTP Strict Transport Security."));
+        return;
+    }
+#endif
 
     createStreams();