Changeset 294371 in webkit

Timestamp:

May 17, 2022, 5:55:16 PM (4 years ago)

Author:

commit-queue@webkit.org

Message:

Private relay should fail closed for third party loads if the main resource was loaded over private relay
​https://bugs.webkit.org/show_bug.cgi?id=240483
<rdar://92697007>

Patch by Alex Christensen <​achristensen@webkit.org> on 2022-05-17
Reviewed by Chris Dumez.

This re-lands the change from r293861 along with r293481 which should fix problems related to rdar://92336270
along with r293591 which should fix performance regressions related to rdar://92458995 but was insufficient.
During a basic browsing test, I found two more places where we were making a NetworkDataTask without setting the
parameters' top origin, one in the SpeculativeLoad constructor and another in WebLoaderStrategy::preconnectTo.

• Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp:

(WebKit::NetworkCORSPreflightChecker::startPreflight):

• Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:

(WebKit::NetworkCache::SpeculativeLoad::SpeculativeLoad):

• Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTaskCocoa::NetworkDataTaskCocoa):

• Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
(WebKit::NetworkSessionCocoa::createWebSocketTask):

• Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::preconnectTo):

Location:

trunk/Source/WebKit

Files:

• NetworkProcess/NetworkCORSPreflightChecker.cpp (modified) (1 diff)
• NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp (modified) (1 diff)
• NetworkProcess/cocoa/NetworkDataTaskCocoa.mm (modified) (1 diff)
• NetworkProcess/cocoa/NetworkSessionCocoa.mm (modified) (2 diffs)
• WebProcess/Network/WebLoaderStrategy.cpp (modified) (2 diffs)

trunk/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp

@@ -76 +76 @@
 
     loadParameters.webPageProxyID = m_parameters.webPageProxyID;
+    loadParameters.topOrigin = m_parameters.topOrigin;
+    loadParameters.sourceOrigin = m_parameters.sourceOrigin.ptr();
 
     if (auto* networkSession = m_networkProcess->networkSession(m_parameters.sessionID)) {

trunk/Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp

@@ -68 +68 @@
     parameters.contentEncodingSniffingPolicy = ContentEncodingSniffingPolicy::Sniff;
     parameters.request = m_originalRequest;
+    parameters.topOrigin = SecurityOrigin::create(m_originalRequest.firstPartyForCookies());
     parameters.isNavigatingToAppBoundDomain = isNavigatingToAppBoundDomain;
     m_networkLoad = makeUnique<NetworkLoad>(*this, nullptr, WTFMove(parameters), *networkSession);

trunk/Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm

@@ -340 +340 @@
     RetainPtr<NSURLRequest> nsRequest = request.nsURLRequest(WebCore::HTTPBodyUpdatePolicy::UpdateHTTPBody);
     RetainPtr<NSMutableURLRequest> mutableRequest = adoptNS([nsRequest.get() mutableCopy]);
+
+    if (parameters.isMainFrameNavigation
+        || parameters.hadMainFrameMainResourcePrivateRelayed
+        || !parameters.topOrigin
+        || request.url().host() == parameters.topOrigin->host()) {
+        if ([mutableRequest respondsToSelector:@selector(_setPrivacyProxyFailClosedForUnreachableNonMainHosts:)])
+            [mutableRequest _setPrivacyProxyFailClosedForUnreachableNonMainHosts:YES];
+    }
 
 #if ENABLE(APP_PRIVACY_REPORT)

trunk/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm

@@ -937 +937 @@
         NSURLSessionTaskTransactionMetrics *metrics = taskMetrics.transactionMetrics.lastObject;
 #if HAVE(NETWORK_CONNECTION_PRIVACY_STANCE)
-        auto privateRelayed = metrics._privacyStance == nw_connection_privacy_stance_direct ? PrivateRelayed::No : PrivateRelayed::Yes;
+        auto privateRelayed = metrics._privacyStance == nw_connection_privacy_stance_direct
+            || metrics._privacyStance == nw_connection_privacy_stance_not_eligible
+            ? PrivateRelayed::No : PrivateRelayed::Yes;
 #else
         auto privateRelayed = PrivateRelayed::No;
@@ -1713 +1715 @@
 #endif
 
+    // FIXME: This function can make up to 3 copies of a request.
+    // Reduce that to one if the protocol is null, the request isn't app initiated,
+    // or the main frame main resource was private relayed, then set all properties
+    // on the one copy.
+    if (hadMainFrameMainResourcePrivateRelayed || request.url().host() == clientOrigin.topOrigin.host) {
+        RetainPtr<NSMutableURLRequest> mutableRequest = adoptNS([nsRequest.get() mutableCopy]);
+        if ([mutableRequest respondsToSelector:@selector(_setPrivacyProxyFailClosedForUnreachableNonMainHosts:)])
+            [mutableRequest _setPrivacyProxyFailClosedForUnreachableNonMainHosts:YES];
+        nsRequest = WTFMove(mutableRequest);
+    }
+
     auto& sessionSet = sessionSetForPage(webPageProxyID);
     RetainPtr<NSURLSessionWebSocketTask> task = [sessionSet.sessionWithCredentialStorage.session webSocketTaskWithRequest:nsRequest.get()];

trunk/Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp

@@ -830 +830 @@
     }
 
+    NetworkResourceLoadParameters parameters;
+
     if (auto* document = webPage.mainFrame()->document()) {
         if (shouldPreconnectAsFirstParty == ShouldPreconnectAsFirstParty::Yes)
@@ -837 +839 @@
         if (auto* loader = document->loader())
             request.setIsAppInitiated(loader->lastNavigationWasAppInitiated());
-    }
-
-    NetworkResourceLoadParameters parameters;
+        parameters.topOrigin = &document->topOrigin();
+        parameters.sourceOrigin = &document->securityOrigin();
+    }
+
     parameters.request = WTFMove(request);
     if (parameters.request.httpUserAgent().isEmpty()) {