1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
// Copyright 2018 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "services/network/proxy_resolving_client_socket_factory.h"
#include "base/check.h"
#include "base/time/time.h"
#include "net/base/ip_address.h"
#include "net/http/http_network_session.h"
#include "net/http/http_transaction_factory.h"
#include "net/url_request/url_request_context.h"
#include "services/network/proxy_resolving_client_socket.h"
namespace network {
ProxyResolvingClientSocketFactory::ProxyResolvingClientSocketFactory(
net::URLRequestContext* request_context)
: request_context_(request_context) {
DCHECK(request_context);
net::HttpNetworkSessionContext session_context;
session_context.client_socket_factory =
request_context->GetNetworkSessionContext()->client_socket_factory;
session_context.host_resolver = request_context->host_resolver();
session_context.cert_verifier = request_context->cert_verifier();
session_context.transport_security_state =
request_context->transport_security_state();
session_context.sct_auditing_delegate =
request_context->sct_auditing_delegate();
session_context.proxy_resolution_service =
request_context->proxy_resolution_service();
session_context.proxy_delegate = request_context->proxy_delegate();
session_context.ssl_config_service = request_context->ssl_config_service();
session_context.http_auth_handler_factory =
request_context->http_auth_handler_factory();
session_context.http_server_properties =
request_context->http_server_properties();
session_context.quic_context = request_context->quic_context();
session_context.net_log = request_context->net_log();
const net::HttpNetworkSessionParams* reference_params =
request_context->GetNetworkSessionParams();
net::HttpNetworkSessionParams session_params;
if (reference_params) {
// TODO(mmenke): Just copying specific parameters seems highly regression
// prone. Should have a better way to do this.
session_params.ignore_certificate_errors =
reference_params->ignore_certificate_errors;
session_params.testing_fixed_http_port =
reference_params->testing_fixed_http_port;
session_params.testing_fixed_https_port =
reference_params->testing_fixed_https_port;
// Disable H2 negotiation via ALPN.
//
// TODO(crbug.com/40946183): Should this be allowed for proxies, but
// not for direct connections?
session_params.enable_http2 = false;
// Disable H2 alternative service as well. It's not supported for proxies,
// unlike ALPN, so no concerns with completely disabling it.
session_params.enable_http2_alternative_service = false;
// Note that ProxyResolvingClientSocket does not use QUIC, so enabling QUIC
// won't do anything here.
}
// Disable early data. When early data is enabled, replay protection is not
// enabled until partway through the connection, so callers are expected to
// call `ConfirmHandshake` before performing replay-sensitive operations.
// These sockets bypass the HTTP-specific logic that handles this.
session_params.enable_early_data = false;
// TODO(mmenke): Is a new HttpNetworkSession still needed?
// ProxyResolvingClientSocket doesn't use socket pools, just the
// SpdySessionPool, so it may be sufficient to create a new SpdySessionPool,
// just use CommonConnectJobParams that reference it, but otherwise uses
// |request_context|'s NetworkSession's objects.
network_session_ = std::make_unique<net::HttpNetworkSession>(session_params,
session_context);
common_connect_job_params_ = std::make_unique<net::CommonConnectJobParams>(
network_session_->CreateCommonConnectJobParams());
}
ProxyResolvingClientSocketFactory::~ProxyResolvingClientSocketFactory() {}
std::unique_ptr<ProxyResolvingClientSocket>
ProxyResolvingClientSocketFactory::CreateSocket(
const GURL& url,
const net::NetworkAnonymizationKey& network_anonymization_key,
bool use_tls) {
// |request_context|'s HttpAuthCache might have updates. For example, a user
// might have since entered proxy credentials. Clear the http auth of
// |network_session_| and copy over the data from |request_context|'s auth
// cache.
//
// TODO(davidben): This does not share the SSLClientContext, so proxy client
// certificate credentials do not work. However, client certificates for both
// proxy and origin are handled at the socket layer, so doing so would pick up
// both sets. Depending on how these sockets are used, this may not be what we
// want. Toggling privacy mode (i.e. CORS uncredentialed mode) on the
// ConnectJob should give proxy auth without origin auth, but only after
// https://crbug.com/775438 is fixed.
network_session_->http_auth_cache()->ClearAllEntries();
net::HttpAuthCache* other_auth_cache =
request_context_->http_transaction_factory()
->GetSession()
->http_auth_cache();
network_session_->http_auth_cache()->CopyProxyEntriesFrom(*other_auth_cache);
return std::make_unique<ProxyResolvingClientSocket>(
network_session_.get(), common_connect_job_params_.get(), url,
network_anonymization_key, use_tls, connect_job_factory_.get());
}
} // namespace network
|
