Changeset 249001 in webkit

Timestamp:

Aug 22, 2019, 4:05:12 AM (7 years ago)

Author:

youenn@apple.com

Message:

Add a WebsiteDataStore delegate to handle AuthenticationChallenge that do not come from pages
​https://bugs.webkit.org/show_bug.cgi?id=196870

Reviewed by Alex Christensen.

Source/WebKit:

Make NetworkProcess provide the session ID for any authentication challenge.
In case there is no associated page for the authentication challenge or this is related to a service worker,
ask the website data store to take a decision.
Add website data store delegate to allow applications to make the decision.
Restrict using the delegate to server trust evaluation only.

Make ping loads reuse the same mechanism.

Covered by service worker tests and updated beacon test.

• NetworkProcess/NetworkCORSPreflightChecker.cpp:

(WebKit::NetworkCORSPreflightChecker::didReceiveChallenge):

• NetworkProcess/NetworkDataTask.cpp:

(WebKit::NetworkDataTask::sessionID const):

• NetworkProcess/NetworkDataTask.h:
• NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::didReceiveChallenge):

• NetworkProcess/NetworkLoadChecker.h:

(WebKit::NetworkLoadChecker::networkProcess):

• NetworkProcess/PingLoad.cpp:

(WebKit::PingLoad::didReceiveChallenge):

• Shared/Authentication/AuthenticationManager.cpp:

(WebKit::AuthenticationManager::didReceiveAuthenticationChallenge):

• Shared/Authentication/AuthenticationManager.h:
• Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.h: Copied from Tools/WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.h.
• Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.mm: Copied from Source/WebKit/Shared/Authentication/cocoa/ClientCertificateAuthenticationXPCConstants.h.

(WebKit::toAuthenticationChallengeDisposition):

• SourcesCocoa.txt:
• UIProcess/API/Cocoa/WKWebsiteDataStore.mm:

(WebsiteDataStoreClient::WebsiteDataStoreClient):

• UIProcess/API/Cocoa/_WKWebsiteDataStoreDelegate.h:
• UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::NavigationClient::didReceiveAuthenticationChallenge):

• UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::didReceiveAuthenticationChallenge):

• UIProcess/Network/NetworkProcessProxy.h:
• UIProcess/Network/NetworkProcessProxy.messages.in:
• UIProcess/ServiceWorkerProcessProxy.cpp:
• UIProcess/ServiceWorkerProcessProxy.h:
• UIProcess/WebPageProxy.cpp:
• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::isServiceWorkerPageID const):

• UIProcess/WebProcessPool.h:
• UIProcess/WebsiteData/WebsiteDataStoreClient.h:

(WebKit::WebsiteDataStoreClient::didReceiveAuthenticationChallenge):

• WebKit.xcodeproj/project.pbxproj:

Tools:

Implement the new delegate by respecting the value set by testRunner.setAllowsAnySSLCertificate
Accept any server certificate by default.

• WebKitTestRunner/TestController.cpp:
• WebKitTestRunner/cocoa/TestControllerCocoa.mm:

(WTR::TestController::cocoaResetStateToConsistentValues):
(WTR::TestController::setAllowsAnySSLCertificate):

• WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.h:
• WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.mm:

(-[TestWebsiteDataStoreDelegate didReceiveAuthenticationChallenge:completionHandler:]):
(-[TestWebsiteDataStoreDelegate setAllowAnySSLCertificate:]):

LayoutTests:

Add tests to validate that the delegate decision is respected for beacons and service worker loads.

• http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight-expected.txt:
• http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight.html:
• http/wpt/beacon/resources/beacon-preflight.py:

(main):

• http/wpt/service-workers/resources/lengthy-pass.py:

(main):

• http/wpt/service-workers/server-trust-evaluation.https-expected.txt: Added.
• http/wpt/service-workers/server-trust-evaluation.https.html: Added.
• http/wpt/service-workers/server-trust-worker.js: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight-expected.txt (modified) (1 diff)
• LayoutTests/http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight.html (modified) (2 diffs)
• LayoutTests/http/wpt/beacon/resources/beacon-preflight.py (modified) (1 diff)
• LayoutTests/http/wpt/service-workers/resources/lengthy-pass.py (modified) (1 diff)
• LayoutTests/http/wpt/service-workers/server-trust-evaluation.https-expected.txt (added)
• LayoutTests/http/wpt/service-workers/server-trust-evaluation.https.html (added)
• LayoutTests/http/wpt/service-workers/server-trust-worker.js (added)
• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp (modified) (1 diff)
• Source/WebKit/NetworkProcess/NetworkDataTask.cpp (modified) (1 diff)
• Source/WebKit/NetworkProcess/NetworkDataTask.h (modified) (2 diffs)
• Source/WebKit/NetworkProcess/NetworkLoad.cpp (modified) (1 diff)
• Source/WebKit/NetworkProcess/NetworkLoadChecker.h (modified) (1 diff)
• Source/WebKit/NetworkProcess/PingLoad.cpp (modified) (1 diff)
• Source/WebKit/Shared/Authentication/AuthenticationManager.cpp (modified) (2 diffs)
• Source/WebKit/Shared/Authentication/AuthenticationManager.h (modified) (1 diff)
• Source/WebKit/Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.h (copied) (copied from trunk/Tools/WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.h ) (2 diffs)
• Source/WebKit/Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.mm (copied) (copied from trunk/Source/WebKit/UIProcess/WebsiteData/WebsiteDataStoreClient.h ) (2 diffs)
• Source/WebKit/SourcesCocoa.txt (modified) (1 diff)
• Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm (modified) (4 diffs)
• Source/WebKit/UIProcess/API/Cocoa/_WKWebsiteDataStoreDelegate.h (modified) (1 diff)
• Source/WebKit/UIProcess/Cocoa/NavigationState.mm (modified) (3 diffs)
• Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp (modified) (2 diffs)
• Source/WebKit/UIProcess/Network/NetworkProcessProxy.h (modified) (1 diff)
• Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in (modified) (1 diff)
• Source/WebKit/UIProcess/ServiceWorkerProcessProxy.cpp (modified) (1 diff)
• Source/WebKit/UIProcess/ServiceWorkerProcessProxy.h (modified) (1 diff)
• Source/WebKit/UIProcess/WebPageProxy.cpp (modified) (1 diff)
• Source/WebKit/UIProcess/WebProcessPool.cpp (modified) (1 diff)
• Source/WebKit/UIProcess/WebProcessPool.h (modified) (1 diff)
• Source/WebKit/UIProcess/WebsiteData/WebsiteDataStoreClient.h (modified) (2 diffs)
• Source/WebKit/WebKit.xcodeproj/project.pbxproj (modified) (2 diffs)
• Tools/ChangeLog (modified) (1 diff)
• Tools/WebKitTestRunner/TestController.cpp (modified) (3 diffs)
• Tools/WebKitTestRunner/TestController.h (modified) (1 diff)
• Tools/WebKitTestRunner/cocoa/TestControllerCocoa.mm (modified) (2 diffs)
• Tools/WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.h (modified) (1 diff)
• Tools/WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.mm (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-08-22  Youenn Fablet  <youenn@apple.com>
+
+        Add a WebsiteDataStore delegate to handle AuthenticationChallenge that do not come from pages
+        https://bugs.webkit.org/show_bug.cgi?id=196870
+
+        Reviewed by Alex Christensen.
+
+        Add tests to validate that the delegate decision is respected for beacons and service worker loads.
+
+        * http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight-expected.txt:
+        * http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight.html:
+        * http/wpt/beacon/resources/beacon-preflight.py:
+        (main):
+        * http/wpt/service-workers/resources/lengthy-pass.py:
+        (main):
+        * http/wpt/service-workers/server-trust-evaluation.https-expected.txt: Added.
+        * http/wpt/service-workers/server-trust-evaluation.https.html: Added.
+        * http/wpt/service-workers/server-trust-worker.js: Added.
+
 2019-08-21  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/LayoutTests/http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight-expected.txt

@@ -1 +1 @@
 
+PASS Beacon load should not be sent if server is not trusted. 
 PASS Should send beacon with no CORS preflight 
 

trunk/LayoutTests/http/wpt/beacon/cors/crossorigin-arraybufferview-no-preflight.html

@@ -27 +27 @@
 }
 
-function testCORSPreflightSuccess(what) {
-  var testBase = get_host_info().HTTP_REMOTE_ORIGIN + RESOURCES_DIR;
-  var id = self.token();
-  var testUrl = testBase + "beacon-preflight.py?allowCors=1&cmd=put&id=" + id;
+function testCORSPreflight(what) {
+  var testBase = get_host_info().HTTPS_REMOTE_ORIGIN + RESOURCES_DIR;
 
-  promise_test(function(test) {
+  promise_test(async function(test) {
+    var id = "ca33c073-1cf0-41e5-bbd4-55969fb1a6c7";
+    var testUrl = testBase + "beacon-preflight.py?allowCors=1&cmd=put&id=" + id;
+    if (window.testRunner) {
+      window.testRunner.setAllowsAnySSLCertificate(false);
+      window.testRunner.terminateNetworkProcess();
+      await fetch("").then(() => { }, () => { });
+    }
+
+    assert_true(navigator.sendBeacon(testUrl, what), "sendBeacon succeeded");
+    const result = await pollResult(test, id);
+    assert_equals(result['preflight'], 0, "Did not receive CORS preflight")
+    assert_equals(result['beacon'], 0, "Did not receive beacon")
+  }, "Beacon load should not be sent if server is not trusted.");
+
+  promise_test(async function(test) {
+    var id = self.token();
+    var testUrl = testBase + "beacon-preflight.py?allowCors=1&cmd=put&id=" + id;
+    if (window.testRunner) {
+      window.testRunner.setAllowsAnySSLCertificate(true);
+      window.testRunner.terminateNetworkProcess();
+      await fetch("").then(() => { }, () => { });
+    }
+
     assert_true(navigator.sendBeacon(testUrl, what), "SendBeacon Succeeded");
     return pollResult(test, id) .then(result => {
@@ -52 +73 @@
 }
 
-testCORSPreflightSuccess(stringToArrayBufferView("123"));
+testCORSPreflight(stringToArrayBufferView("123"));
     </script>
   </body>

trunk/LayoutTests/http/wpt/beacon/resources/beacon-preflight.py

@@ -45 +45 @@
       request.server.stash.put(test_id, stashed_data)
     return [("Content-Type", "text/plain")], ""
-  
+
   if command == "get":
-    if stashed_data is not None:
-      return [("Content-Type", "text/plain")], json.dumps(stashed_data)
-    return [("Content-Type", "text/plain")], ""
+    return [("Content-Type", "text/plain")], json.dumps(stashed_data)
 
   response.set_error(400, "Bad Command")

trunk/LayoutTests/http/wpt/service-workers/resources/lengthy-pass.py

@@ -4 +4 @@
     delay = 0.05
     response.headers.set("Content-type", "text/javascript")
+    response.headers.append("Access-Control-Allow-Origin", "*")
     response.write_status_headers()
     time.sleep(delay);

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-08-22  Youenn Fablet  <youenn@apple.com>
+
+        Add a WebsiteDataStore delegate to handle AuthenticationChallenge that do not come from pages
+        https://bugs.webkit.org/show_bug.cgi?id=196870
+
+        Reviewed by Alex Christensen.
+
+        Make NetworkProcess provide the session ID for any authentication challenge.
+        In case there is no associated page for the authentication challenge or this is related to a service worker,
+        ask the website data store to take a decision.
+        Add website data store delegate to allow applications to make the decision.
+        Restrict using the delegate to server trust evaluation only.
+
+        Make ping loads reuse the same mechanism.
+
+        Covered by service worker tests and updated beacon test.
+
+        * NetworkProcess/NetworkCORSPreflightChecker.cpp:
+        (WebKit::NetworkCORSPreflightChecker::didReceiveChallenge):
+        * NetworkProcess/NetworkDataTask.cpp:
+        (WebKit::NetworkDataTask::sessionID const):
+        * NetworkProcess/NetworkDataTask.h:
+        * NetworkProcess/NetworkLoad.cpp:
+        (WebKit::NetworkLoad::didReceiveChallenge):
+        * NetworkProcess/NetworkLoadChecker.h:
+        (WebKit::NetworkLoadChecker::networkProcess):
+        * NetworkProcess/PingLoad.cpp:
+        (WebKit::PingLoad::didReceiveChallenge):
+        * Shared/Authentication/AuthenticationManager.cpp:
+        (WebKit::AuthenticationManager::didReceiveAuthenticationChallenge):
+        * Shared/Authentication/AuthenticationManager.h:
+        * Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.h: Copied from Tools/WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.h.
+        * Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.mm: Copied from Source/WebKit/Shared/Authentication/cocoa/ClientCertificateAuthenticationXPCConstants.h.
+        (WebKit::toAuthenticationChallengeDisposition):
+        * SourcesCocoa.txt:
+        * UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
+        (WebsiteDataStoreClient::WebsiteDataStoreClient):
+        * UIProcess/API/Cocoa/_WKWebsiteDataStoreDelegate.h:
+        * UIProcess/Cocoa/NavigationState.mm:
+        (WebKit::NavigationState::NavigationClient::didReceiveAuthenticationChallenge):
+        * UIProcess/Network/NetworkProcessProxy.cpp:
+        (WebKit::NetworkProcessProxy::didReceiveAuthenticationChallenge):
+        * UIProcess/Network/NetworkProcessProxy.h:
+        * UIProcess/Network/NetworkProcessProxy.messages.in:
+        * UIProcess/ServiceWorkerProcessProxy.cpp:
+        * UIProcess/ServiceWorkerProcessProxy.h:
+        * UIProcess/WebPageProxy.cpp:
+        * UIProcess/WebProcessPool.cpp:
+        (WebKit::WebProcessPool::isServiceWorkerPageID const):
+        * UIProcess/WebProcessPool.h:
+        * UIProcess/WebsiteData/WebsiteDataStoreClient.h:
+        (WebKit::WebsiteDataStoreClient::didReceiveAuthenticationChallenge):
+        * WebKit.xcodeproj/project.pbxproj:
+
 2019-08-22  Claudio Saavedra  <csaavedra@igalia.com>
 

trunk/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp

@@ -102 +102 @@
     }
 
-    m_networkProcess->authenticationManager().didReceiveAuthenticationChallenge(m_parameters.pageID, m_parameters.frameID, challenge, WTFMove(completionHandler));
+    m_networkProcess->authenticationManager().didReceiveAuthenticationChallenge(m_parameters.sessionID, m_parameters.pageID, m_parameters.frameID, challenge, WTFMove(completionHandler));
 }
 

trunk/Source/WebKit/NetworkProcess/NetworkDataTask.cpp

@@ -151 +151 @@
 }
 
+PAL::SessionID NetworkDataTask::sessionID() const
+{
+    return m_session->sessionID();
+}
+
 } // namespace WebKit

trunk/Source/WebKit/NetworkProcess/NetworkDataTask.h

@@ -35 +35 @@
 #include <WebCore/StoredCredentialsPolicy.h>
 #include <WebCore/Timer.h>
+#include <pal/SessionID.h>
 #include <wtf/CompletionHandler.h>
 #include <wtf/ThreadSafeRefCounted.h>
@@ -131 +132 @@
     virtual String description() const;
 
+    PAL::SessionID sessionID() const;
+
 protected:
     NetworkDataTask(NetworkSession&, NetworkDataTaskClient&, const WebCore::ResourceRequest&, WebCore::StoredCredentialsPolicy, bool shouldClearReferrerOnHTTPSToHTTPRedirect, bool dataTaskIsForMainFrameNavigation);

trunk/Source/WebKit/NetworkProcess/NetworkLoad.cpp

@@ -202 +202 @@
         m_networkProcess->authenticationManager().didReceiveAuthenticationChallenge(*pendingDownload, challenge, WTFMove(completionHandler));
     else
-        m_networkProcess->authenticationManager().didReceiveAuthenticationChallenge(m_parameters.webPageID, m_parameters.webFrameID, challenge, WTFMove(completionHandler));
+        m_networkProcess->authenticationManager().didReceiveAuthenticationChallenge(m_task->sessionID(), m_parameters.webPageID, m_parameters.webFrameID, challenge, WTFMove(completionHandler));
 }
 

trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.h

@@ -85 +85 @@
 #endif
 
+    NetworkProcess& networkProcess() { return m_networkProcess; }
+
     const URL& url() const { return m_url; }
     WebCore::StoredCredentialsPolicy storedCredentialsPolicy() const { return m_storedCredentialsPolicy; }

trunk/Source/WebKit/NetworkProcess/PingLoad.cpp

@@ -149 +149 @@
     RELEASE_LOG_IF_ALLOWED("didReceiveChallenge");
     if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested) {
-        completionHandler(AuthenticationChallengeDisposition::PerformDefaultHandling, { });
+        m_networkLoadChecker->networkProcess().authenticationManager().didReceiveAuthenticationChallenge(m_parameters.sessionID, m_parameters.webPageID, m_parameters.webFrameID, challenge, WTFMove(completionHandler));
         return;
     }

trunk/Source/WebKit/Shared/Authentication/AuthenticationManager.cpp

@@ -109 +109 @@
 }
 
-void AuthenticationManager::didReceiveAuthenticationChallenge(PageIdentifier pageID, FrameIdentifier frameID, const AuthenticationChallenge& authenticationChallenge, ChallengeCompletionHandler&& completionHandler)
+void AuthenticationManager::didReceiveAuthenticationChallenge(PAL::SessionID sessionID, PageIdentifier pageID, FrameIdentifier frameID, const AuthenticationChallenge& authenticationChallenge, ChallengeCompletionHandler&& completionHandler)
 {
     ASSERT(pageID);
@@ -120 +120 @@
         return;
     
-    m_process.send(Messages::NetworkProcessProxy::DidReceiveAuthenticationChallenge(pageID, frameID, authenticationChallenge, challengeID));
+    m_process.send(Messages::NetworkProcessProxy::DidReceiveAuthenticationChallenge(sessionID, pageID, frameID, authenticationChallenge, challengeID));
 }
 

trunk/Source/WebKit/Shared/Authentication/AuthenticationManager.h

@@ -64 +64 @@
     static const char* supplementName();
 
-    void didReceiveAuthenticationChallenge(WebCore::PageIdentifier, WebCore::FrameIdentifier, const WebCore::AuthenticationChallenge&, ChallengeCompletionHandler&&);
+    void didReceiveAuthenticationChallenge(PAL::SessionID, WebCore::PageIdentifier, WebCore::FrameIdentifier, const WebCore::AuthenticationChallenge&, ChallengeCompletionHandler&&);
     void didReceiveAuthenticationChallenge(IPC::MessageSender& download, const WebCore::AuthenticationChallenge&, ChallengeCompletionHandler&&);
 

trunk/Source/WebKit/Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.h

@@ -1 @@
-/*
+  /*
  * Copyright (C) 2019 Apple Inc. All rights reserved.
  *
@@ -26 +26 @@
 #pragma once
 
-#include <WebKit/_WKWebsiteDataStoreDelegate.h>
+#import "AuthenticationChallengeDisposition.h"
+#import <Foundation/NSURLSession.h>
 
-@interface TestWebsiteDataStoreDelegate: NSObject <_WKWebsiteDataStoreDelegate> {
-@private
-    BOOL _shouldAllowRaisingQuota;
-}
-- (instancetype)init;
-- (void)setAllowRaisingQuota:(BOOL)shouldAllowRaisingQuota;
-@end
+namespace WebKit {
+
+AuthenticationChallengeDisposition toAuthenticationChallengeDisposition(NSURLSessionAuthChallengeDisposition);
+
+} // namespace WebKit

trunk/Source/WebKit/Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.mm

@@ -1 +1 @@
 /*
- * Copyright (C) 2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2018-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -24 +24 @@
  */
 
-#pragma once
-
-#include <wtf/CompletionHandler.h>
-
-namespace WebCore {
-struct SecurityOriginData;
-}
+#include "config.h"
+#include "AuthenticationChallengeDispositionCocoa.h"
 
 namespace WebKit {
 
-class WebsiteDataStoreClient {
-    WTF_MAKE_FAST_ALLOCATED;
-public:
-    virtual ~WebsiteDataStoreClient() { }
-
-    virtual void requestStorageSpace(const WebCore::SecurityOriginData& topOrigin, const WebCore::SecurityOriginData& frameOrigin, uint64_t quota, uint64_t currentSize, uint64_t spaceRequired, CompletionHandler<void(Optional<uint64_t>)>&& completionHandler)
-    {
-        completionHandler({ });
+AuthenticationChallengeDisposition toAuthenticationChallengeDisposition(NSURLSessionAuthChallengeDisposition disposition)
+{
+    switch (disposition) {
+    case NSURLSessionAuthChallengeUseCredential:
+        return AuthenticationChallengeDisposition::UseCredential;
+    case NSURLSessionAuthChallengePerformDefaultHandling:
+        return AuthenticationChallengeDisposition::PerformDefaultHandling;
+    case NSURLSessionAuthChallengeCancelAuthenticationChallenge:
+        return AuthenticationChallengeDisposition::Cancel;
+    case NSURLSessionAuthChallengeRejectProtectionSpace:
+        return AuthenticationChallengeDisposition::RejectProtectionSpaceAndContinue;
     }
-};
+    [NSException raise:NSInvalidArgumentException format:@"Invalid NSURLSessionAuthChallengeDisposition (%ld)", (long)disposition];
+}
 
 } // namespace WebKit

trunk/Source/WebKit/SourcesCocoa.txt

@@ -134 +134 @@
 Shared/cg/ShareableBitmapCG.cpp
 
+Shared/Authentication/cocoa/AuthenticationChallengeDispositionCocoa.mm
 Shared/Authentication/cocoa/AuthenticationManagerCocoa.mm
 Shared/Authentication/cocoa/ClientCertificateAuthenticationXPCConstants.cpp

trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm

@@ -28 +28 @@
 
 #import "APIString.h"
+#import "AuthenticationChallengeDispositionCocoa.h"
 #import "CompletionHandlerCallChecker.h"
 #import "WKHTTPCookieStoreInternal.h"
 #import "WKNSArray.h"
+#import "WKNSURLAuthenticationChallenge.h"
 #import "WKWebViewInternal.h"
 #import "WKWebsiteDataRecordInternal.h"
@@ -39 +41 @@
 #import "_WKWebsiteDataStoreConfiguration.h"
 #import "_WKWebsiteDataStoreDelegate.h"
+#import <WebCore/Credential.h>
 #import <WebKit/ServiceWorkerProcessProxy.h>
 #import <wtf/BlockPtr.h>
@@ -49 +52 @@
         : m_delegate(delegate)
         , m_hasRequestStorageSpaceSelector([m_delegate.get() respondsToSelector:@selector(requestStorageSpace: frameOrigin: quota: currentSize: spaceRequired: decisionHandler:)])
+        , m_hasAuthenticationChallengeSelector([m_delegate.get() respondsToSelector:@selector(didReceiveAuthenticationChallenge: completionHandler:)])
     {
     }
@@ -74 +78 @@
     }
 
+    void didReceiveAuthenticationChallenge(Ref<WebKit::AuthenticationChallengeProxy>&& challenge) final
+    {
+        if (!m_hasAuthenticationChallengeSelector || !m_delegate) {
+            challenge->listener().completeChallenge(WebKit::AuthenticationChallengeDisposition::PerformDefaultHandling);
+            return;
+        }
+
+        auto nsURLChallenge = wrapper(challenge);
+        auto checker = WebKit::CompletionHandlerCallChecker::create(m_delegate.getAutoreleased(), @selector(didReceiveAuthenticationChallenge: completionHandler:));
+        auto completionHandler = makeBlockPtr([challenge = WTFMove(challenge), checker = WTFMove(checker)](NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential) mutable {
+            if (checker->completionHandlerHasBeenCalled())
+                return;
+            checker->didCallCompletionHandler();
+            challenge->listener().completeChallenge(WebKit::toAuthenticationChallengeDisposition(disposition), WebCore::Credential(credential));
+        });
+
+        [m_delegate.getAutoreleased() didReceiveAuthenticationChallenge:nsURLChallenge completionHandler:completionHandler.get()];
+    }
+
     WeakObjCPtr<id <_WKWebsiteDataStoreDelegate> > m_delegate;
     bool m_hasRequestStorageSpaceSelector { false };
+    bool m_hasAuthenticationChallengeSelector { false };
 };
 

trunk/Source/WebKit/UIProcess/API/Cocoa/_WKWebsiteDataStoreDelegate.h

@@ -35 +35 @@
 - (void)requestStorageSpace:(NSURL *)mainFrameURL frameOrigin:(NSURL *)frameURL quota:(NSUInteger)quota currentSize:(NSUInteger)currentSize spaceRequired:(NSUInteger)spaceRequired decisionHandler:(void (^)(unsigned long long quota))decisionHandler;
 
+- (void)didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential))completionHandler;
+
 @end

trunk/Source/WebKit/UIProcess/Cocoa/NavigationState.mm

@@ -36 +36 @@
 #import "APIWebsiteDataStore.h"
 #import "AuthenticationChallengeDisposition.h"
+#import "AuthenticationChallengeDispositionCocoa.h"
 #import "AuthenticationDecisionListener.h"
 #import "CompletionHandlerCallChecker.h"
@@ -960 +961 @@
 }
 
-static AuthenticationChallengeDisposition toAuthenticationChallengeDisposition(NSURLSessionAuthChallengeDisposition disposition)
-{
-    switch (disposition) {
-    case NSURLSessionAuthChallengeUseCredential:
-        return AuthenticationChallengeDisposition::UseCredential;
-    case NSURLSessionAuthChallengePerformDefaultHandling:
-        return AuthenticationChallengeDisposition::PerformDefaultHandling;
-    case NSURLSessionAuthChallengeCancelAuthenticationChallenge:
-        return AuthenticationChallengeDisposition::Cancel;
-    case NSURLSessionAuthChallengeRejectProtectionSpace:
-        return AuthenticationChallengeDisposition::RejectProtectionSpaceAndContinue;
-    }
-    [NSException raise:NSInvalidArgumentException format:@"Invalid NSURLSessionAuthChallengeDisposition (%ld)", (long)disposition];
-}
-    
 void NavigationState::NavigationClient::didReceiveAuthenticationChallenge(WebPageProxy&, AuthenticationChallengeProxy& authenticationChallenge)
 {
@@ -989 +975 @@
             return;
         checker->didCallCompletionHandler();
-        challenge->listener().completeChallenge(toAuthenticationChallengeDisposition(disposition), Credential(credential));
+        challenge->listener().completeChallenge(WebKit::toAuthenticationChallengeDisposition(disposition), Credential(credential));
     }).get()];
 }

trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp

@@ -38 +38 @@
 #include "NetworkProcessMessages.h"
 #include "SandboxExtension.h"
+#if HAVE(SEC_KEY_PROXY)
+#include "SecKeyProxyStore.h"
+#endif
 #include "ShouldGrandfatherStatistics.h"
 #include "StorageAccessStatus.h"
@@ -313 +316 @@
 }
 
-void NetworkProcessProxy::didReceiveAuthenticationChallenge(PageIdentifier pageID, FrameIdentifier frameID, WebCore::AuthenticationChallenge&& coreChallenge, uint64_t challengeID)
-{
-#if ENABLE(SERVICE_WORKER)
-    if (auto* serviceWorkerProcessProxy = m_processPool.serviceWorkerProcessProxyFromPageID(pageID)) {
-        auto authenticationChallenge = AuthenticationChallengeProxy::create(WTFMove(coreChallenge), challengeID, makeRef(*connection()), nullptr);
-        serviceWorkerProcessProxy->didReceiveAuthenticationChallenge(pageID, frameID, WTFMove(authenticationChallenge));
-        return;
-    }
-#endif
-
-    WebPageProxy* page = WebProcessProxy::webPage(pageID);
-    MESSAGE_CHECK(page);
-
-    auto authenticationChallenge = AuthenticationChallengeProxy::create(WTFMove(coreChallenge), challengeID, makeRef(*connection()), page->secKeyProxyStore(coreChallenge));
+void NetworkProcessProxy::didReceiveAuthenticationChallenge(PAL::SessionID sessionID, PageIdentifier pageID, FrameIdentifier frameID, WebCore::AuthenticationChallenge&& coreChallenge, uint64_t challengeID)
+{
+#if HAVE(SEC_KEY_PROXY)
+    WeakPtr<SecKeyProxyStore> secKeyProxyStore;
+    if (coreChallenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeClientCertificateRequested) {
+        if (auto* store = websiteDataStoreFromSessionID(sessionID)) {
+            auto newSecKeyProxyStore = SecKeyProxyStore::create();
+            secKeyProxyStore = makeWeakPtr(newSecKeyProxyStore.get());
+            store->addSecKeyProxyStore(WTFMove(newSecKeyProxyStore));
+        }
+    }
+    auto authenticationChallenge = AuthenticationChallengeProxy::create(WTFMove(coreChallenge), challengeID, makeRef(*connection()), WTFMove(secKeyProxyStore));
+#else
+    auto authenticationChallenge = AuthenticationChallengeProxy::create(WTFMove(coreChallenge), challengeID, makeRef(*connection()), nullptr);
+#endif
+
+    WebPageProxy* page = nullptr;
+    if (pageID && !m_processPool.isServiceWorkerPageID(pageID))
+        page = WebProcessProxy::webPage(pageID);
+
+    if (!page) {
+        auto* store = websiteDataStoreFromSessionID(sessionID);
+        if (!store || coreChallenge.protectionSpace().authenticationScheme() != ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested) {
+            authenticationChallenge->listener().completeChallenge(AuthenticationChallengeDisposition::PerformDefaultHandling);
+            return;
+        }
+        store->client().didReceiveAuthenticationChallenge(WTFMove(authenticationChallenge));
+        return;
+    }
+
     page->didReceiveAuthenticationChallengeProxy(frameID, WTFMove(authenticationChallenge));
 }

trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.h

@@ -214 +214 @@
     void didReceiveNetworkProcessProxyMessage(IPC::Connection&, IPC::Decoder&);
     void didCreateNetworkConnectionToWebProcess(const IPC::Attachment&);
-    void didReceiveAuthenticationChallenge(WebCore::PageIdentifier, WebCore::FrameIdentifier, WebCore::AuthenticationChallenge&&, uint64_t challengeID);
+    void didReceiveAuthenticationChallenge(PAL::SessionID, WebCore::PageIdentifier, WebCore::FrameIdentifier, WebCore::AuthenticationChallenge&&, uint64_t challengeID);
     void didFetchWebsiteData(uint64_t callbackID, const WebsiteData&);
     void didDeleteWebsiteData(uint64_t callbackID);

trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in

@@ -24 +24 @@
     DidCreateNetworkConnectionToWebProcess(IPC::Attachment connectionIdentifier)
 
-    DidReceiveAuthenticationChallenge(WebCore::PageIdentifier pageID, WebCore::FrameIdentifier frameID, WebCore::AuthenticationChallenge challenge, uint64_t challengeID)
+    DidReceiveAuthenticationChallenge(PAL::SessionID sessionID, WebCore::PageIdentifier pageID, WebCore::FrameIdentifier frameID, WebCore::AuthenticationChallenge challenge, uint64_t challengeID)
 
     DidFetchWebsiteData(uint64_t callbackID, struct WebKit::WebsiteData websiteData)

trunk/Source/WebKit/UIProcess/ServiceWorkerProcessProxy.cpp

@@ -91 +91 @@
 }
 
-void ServiceWorkerProcessProxy::didReceiveAuthenticationChallenge(PageIdentifier pageID, FrameIdentifier frameID, Ref<AuthenticationChallengeProxy>&& challenge)
-{
-    UNUSED_PARAM(pageID);
-    UNUSED_PARAM(frameID);
-
-    // FIXME: Expose an API to delegate the actual decision to the application layer.
-    auto& protectionSpace = challenge->core().protectionSpace();
-    if (protectionSpace.authenticationScheme() == WebCore::ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested && processPool().allowsAnySSLCertificateForServiceWorker()) {
-        auto credential = WebCore::Credential("accept server trust"_s, emptyString(), WebCore::CredentialPersistenceNone);
-        challenge->listener().completeChallenge(AuthenticationChallengeDisposition::UseCredential, credential);
-        return;
-    }
-    notImplemented();
-    challenge->listener().completeChallenge(AuthenticationChallengeDisposition::PerformDefaultHandling);
-}
-
 } // namespace WebKit
 

trunk/Source/WebKit/UIProcess/ServiceWorkerProcessProxy.h

@@ -42 +42 @@
     static bool hasRegisteredServiceWorkers(const String& serviceWorkerDirectory);
 
-    void didReceiveAuthenticationChallenge(WebCore::PageIdentifier, WebCore::FrameIdentifier, Ref<AuthenticationChallengeProxy>&&);
-
     void start(const WebPreferencesStore&, Optional<PAL::SessionID> initialSessionID);
     void setUserAgent(const String&);

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -7334 +7334 @@
 #endif
 
-WeakPtr<SecKeyProxyStore> WebPageProxy::secKeyProxyStore(const WebCore::AuthenticationChallenge& challenge)
-{
-#if HAVE(SEC_KEY_PROXY)
-    if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeClientCertificateRequested) {
-        auto secKeyProxyStore = SecKeyProxyStore::create();
-        auto weakPointer = makeWeakPtr(secKeyProxyStore.get());
-        m_websiteDataStore->addSecKeyProxyStore(WTFMove(secKeyProxyStore));
-        return weakPointer;
-    }
-#endif
-    return nullptr;
-}
-    
 void WebPageProxy::didReceiveAuthenticationChallengeProxy(FrameIdentifier, Ref<AuthenticationChallengeProxy>&& authenticationChallenge)
 {

trunk/Source/WebKit/UIProcess/WebProcessPool.cpp

@@ -2232 +2232 @@
 }
 
+bool WebProcessPool::isServiceWorkerPageID(PageIdentifier pageID) const
+{
 #if ENABLE(SERVICE_WORKER)
-ServiceWorkerProcessProxy* WebProcessPool::serviceWorkerProcessProxyFromPageID(PageIdentifier pageID) const
-{
     // FIXME: This is inefficient.
     for (auto* serviceWorkerProcess : m_serviceWorkerProcesses.values()) {
         if (serviceWorkerProcess->pageID() == pageID)
-            return serviceWorkerProcess;
-    }
-    return nullptr;
-}
-#endif
+            return true;
+    }
+#endif
+    return false;
+}
 
 void WebProcessPool::addProcessToOriginCacheSet(WebProcessProxy& process, const URL& url)

trunk/Source/WebKit/UIProcess/WebProcessPool.h

@@ -380 +380 @@
     void getNetworkProcessConnection(WebProcessProxy&, Messages::WebProcessProxy::GetNetworkProcessConnection::DelayedReply&&);
 
+    bool isServiceWorkerPageID(WebCore::PageIdentifier) const;
 #if ENABLE(SERVICE_WORKER)
     void establishWorkerContextConnectionToNetworkProcess(NetworkProcessProxy&, WebCore::RegistrableDomain&&, Optional<PAL::SessionID>);
-    ServiceWorkerProcessProxy* serviceWorkerProcessProxyFromPageID(WebCore::PageIdentifier) const;
     const HashMap<WebCore::RegistrableDomain, ServiceWorkerProcessProxy*>& serviceWorkerProxies() const { return m_serviceWorkerProcesses; }
     void setAllowsAnySSLCertificateForServiceWorker(bool allows) { m_allowsAnySSLCertificateForServiceWorker = allows; }

trunk/Source/WebKit/UIProcess/WebsiteData/WebsiteDataStoreClient.h

@@ -26 +26 @@
 #pragma once
 
+#include "AuthenticationChallengeDisposition.h"
+#include "AuthenticationChallengeProxy.h"
+#include "AuthenticationDecisionListener.h"
 #include <wtf/CompletionHandler.h>
 
@@ -43 +46 @@
         completionHandler({ });
     }
+
+    virtual void didReceiveAuthenticationChallenge(Ref<AuthenticationChallengeProxy>&& challenge)
+    {
+        challenge->listener().completeChallenge(AuthenticationChallengeDisposition::PerformDefaultHandling);
+    }
 };
 

trunk/Source/WebKit/WebKit.xcodeproj/project.pbxproj

@@ -3148 +3148 @@
                 41897ED61F415D860016FA42 /* CacheStorageEngine.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = CacheStorageEngine.cpp; sourceTree = "<group>"; };
                 419ACF9B1F981D26009F1A83 /* WebServiceWorkerFetchTaskClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebServiceWorkerFetchTaskClient.h; sourceTree = "<group>"; };
+                41A5F7B9226ECF7C00671764 /* AuthenticationChallengeDispositionCocoa.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = AuthenticationChallengeDispositionCocoa.h; sourceTree = "<group>"; };
+                41A5F7BA226ECF7C00671764 /* AuthenticationChallengeDispositionCocoa.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = AuthenticationChallengeDispositionCocoa.mm; sourceTree = "<group>"; };
                 41AC86811E042E5300303074 /* WebRTCResolver.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; lineEnding = 0; name = WebRTCResolver.messages.in; path = Network/webrtc/WebRTCResolver.messages.in; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = "<none>"; };
                 41B28B081F83AD3E00FB52AC /* RTCPacketOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RTCPacketOptions.h; sourceTree = "<group>"; };
@@ -7011 +7013 @@
                         isa = PBXGroup;
                         children = (
+                                41A5F7B9226ECF7C00671764 /* AuthenticationChallengeDispositionCocoa.h */,
+                                41A5F7BA226ECF7C00671764 /* AuthenticationChallengeDispositionCocoa.mm */,
                                 57B4B45D20B504AB00D4AD79 /* AuthenticationManagerCocoa.mm */,
                                 44A481C621F2D27B00F2F919 /* ClientCertificateAuthenticationXPCConstants.cpp */,

trunk/Tools/ChangeLog

@@ +1 @@
+2019-08-22  Youenn Fablet  <youenn@apple.com>
+
+        Add a WebsiteDataStore delegate to handle AuthenticationChallenge that do not come from pages
+        https://bugs.webkit.org/show_bug.cgi?id=196870
+
+        Reviewed by Alex Christensen.
+
+        Implement the new delegate by respecting the value set by testRunner.setAllowsAnySSLCertificate
+        Accept any server certificate by default.
+
+        * WebKitTestRunner/TestController.cpp:
+        * WebKitTestRunner/cocoa/TestControllerCocoa.mm:
+        (WTR::TestController::cocoaResetStateToConsistentValues):
+        (WTR::TestController::setAllowsAnySSLCertificate):
+        * WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.h:
+        * WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.mm:
+        (-[TestWebsiteDataStoreDelegate didReceiveAuthenticationChallenge:completionHandler:]):
+        (-[TestWebsiteDataStoreDelegate setAllowAnySSLCertificate:]):
+
 2019-08-21  Jonathan Bedard  <jbedard@apple.com>
 

trunk/Tools/WebKitTestRunner/TestController.cpp

@@ -1033 +1033 @@
     m_openPanelFileURLsMediaIcon = nullptr;
 #endif
-    
+
+    setAllowsAnySSLCertificate(true);
+
     statisticsResetToConsistentState();
     
@@ -1193 +1195 @@
 }
 
+#if !PLATFORM(COCOA)
 void TestController::setAllowsAnySSLCertificate(bool allows)
 {
+    m_allowsAnySSLCertificate = allows;
     WKContextSetAllowsAnySSLCertificateForWebSocketTesting(platformContext(), allows);
 }
+#endif
 
 static std::string testPath(WKURLRef url)
@@ -2340 +2345 @@
         m_serverTrustEvaluationCallbackCallsCount++;
 
-        WKRetainPtr<WKCredentialRef> credential = adoptWK(WKCredentialCreate(toWK("accept server trust").get(), toWK("").get(), kWKCredentialPersistenceNone));
-        WKAuthenticationDecisionListenerUseCredential(decisionListener, credential.get());
+        if (m_allowsAnySSLCertificate) {
+            WKRetainPtr<WKCredentialRef> credential = adoptWK(WKCredentialCreate(toWK("accept server trust").get(), toWK("").get(), kWKCredentialPersistenceNone));
+            WKAuthenticationDecisionListenerUseCredential(decisionListener, credential.get());
+            return;
+        }
+        WKAuthenticationDecisionListenerRejectProtectionSpaceAndContinue(decisionListener);
         return;
     }

trunk/Tools/WebKitTestRunner/TestController.h

@@ -592 +592 @@
     uint64_t m_serverTrustEvaluationCallbackCallsCount { 0 };
     bool m_shouldDismissJavaScriptAlertsAsynchronously { false };
+    bool m_allowsAnySSLCertificate { true };
 };
 

trunk/Tools/WebKitTestRunner/cocoa/TestControllerCocoa.mm

@@ -36 +36 @@
 #import <Security/SecItem.h>
 #import <WebKit/WKContextConfigurationRef.h>
+#import <WebKit/WKContextPrivate.h>
 #import <WebKit/WKCookieManager.h>
 #import <WebKit/WKPreferencesRefPrivate.h>
@@ -398 +399 @@
 }
 
+void TestController::setAllowsAnySSLCertificate(bool allows)
+{
+    m_allowsAnySSLCertificate = allows;
+    WKContextSetAllowsAnySSLCertificateForWebSocketTesting(platformContext(), allows);
+    [globalWebsiteDataStoreDelegateClient setAllowAnySSLCertificate: allows];
+}
+
 bool TestController::canDoServerTrustEvaluationInNetworkProcess() const
 {

trunk/Tools/WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.h

@@ -31 +31 @@
 @private
     BOOL _shouldAllowRaisingQuota;
+    BOOL _shouldAllowAnySSLCertificate;
 }
 - (instancetype)init;
 - (void)setAllowRaisingQuota:(BOOL)shouldAllowRaisingQuota;
+- (void)setAllowAnySSLCertificate:(BOOL)shouldAllowAnySSLCertificate;
 @end

trunk/Tools/WebKitTestRunner/cocoa/TestWebsiteDataStoreDelegate.mm

@@ -43 +43 @@
     _shouldAllowRaisingQuota = shouldAllowRaisingQuota;
 }
+
+- (void)didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential * _Nullable credential))completionHandler
+{
+    NSString *method = challenge.protectionSpace.authenticationMethod;
+    if ([method isEqualToString:NSURLAuthenticationMethodServerTrust]) {
+        if (_shouldAllowAnySSLCertificate)
+            completionHandler(NSURLSessionAuthChallengeUseCredential, [NSURLCredential credentialForTrust: challenge.protectionSpace.serverTrust]);
+        else
+            completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
+        return;
+    }
+    completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
+}
+
+- (void)setAllowAnySSLCertificate:(BOOL)shouldAllowAnySSLCertificate
+{
+    _shouldAllowAnySSLCertificate = shouldAllowAnySSLCertificate;
+}
+
 @end