- Revision
- 295357
- Author
- [email protected]
- Date
- 2022-06-07 10:48:03 -0700 (Tue, 07 Jun 2022)
Log Message
Some trustd network requests are not attributed to the UIProcess
https://bugs.webkit.org/show_bug.cgi?id=241352
Reviewed by Kate Cheney.
Some of the calls to SecTrustEvaluate (in particular the one in ResourceResponseCocoa) are not made
with a corresponding call to SecTrustSetClientAuditToken. As a result, if trustd ends up making a
network request to fulfill that API request (e.g. for OCSP verification), the corresponding network
request is attributed to NetworkProcess rather than the UIProcess. This causes us to receive spurious
network usage regression bugs from the power team claiming that NetworkProcess (rather than UIProcess)
is making extra network requests if we happen to make a request that triggers OCSP verification.
To fix this, we added a call SecTrustSetClientAuditToken in ResourceResponse::platformCertificateInfo.
* Source/WTF/wtf/PlatformHave.h:
* Source/WTF/wtf/spi/cocoa/SecuritySPI.h:
* Source/WebCore/platform/network/ResourceResponseBase.cpp:
(WebCore::ResourceResponseBase::includeCertificateInfo const):
* Source/WebCore/platform/network/ResourceResponseBase.h:
(WebCore::ResourceResponseBase::includeCertificateInfo):
(WebCore::ResourceResponseBase::platformCertificateInfo const):
* Source/WebCore/platform/network/cf/ResourceResponse.h:
* Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp:
(WebCore::ResourceResponse::platformCertificateInfo const):
* Source/WebCore/platform/network/cocoa/ResourceResponseCocoa.mm:
(WebCore::ResourceResponse::platformCertificateInfo const):
* Source/WebCore/platform/network/soup/ResourceResponse.h:
* Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp:
(WebCore::ResourceResponse::platformCertificateInfo const):
* Source/WebKit/NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::notifyDidReceiveResponse):
* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(NetworkSessionCocoa::setClientAuditToken):
Canonical link: https://commits.webkit.org/251366@main
Modified Paths
Diff
Modified: trunk/Source/WTF/wtf/PlatformHave.h (295356 => 295357)
--- trunk/Source/WTF/wtf/PlatformHave.h 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WTF/wtf/PlatformHave.h 2022-06-07 17:48:03 UTC (rev 295357)
@@ -361,6 +361,11 @@
#define HAVE_SEC_TRUST_SERIALIZATION 1
#endif
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 120000) \
+ || (PLATFORM(IOS_FAMILY) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 150000)
+#define HAVE_SEC_TRUST_SET_CLIENT_AUDIT_TOKEN 1
+#endif
+
#if PLATFORM(MAC)
#define HAVE_TOUCH_BAR 1
#endif
Modified: trunk/Source/WTF/wtf/spi/cocoa/SecuritySPI.h (295356 => 295357)
--- trunk/Source/WTF/wtf/spi/cocoa/SecuritySPI.h 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WTF/wtf/spi/cocoa/SecuritySPI.h 2022-06-07 17:48:03 UTC (rev 295357)
@@ -99,7 +99,10 @@
#endif
CF_RETURNS_RETAINED CFDictionaryRef SecTrustCopyInfo(SecTrustRef);
+
+#if HAVE(SEC_TRUST_SET_CLIENT_AUDIT_TOKEN)
OSStatus SecTrustSetClientAuditToken(SecTrustRef, CFDataRef);
+#endif
extern const CFStringRef kSecTrustInfoExtendedValidationKey;
extern const CFStringRef kSecTrustInfoCompanyNameKey;
Modified: trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp (295356 => 295357)
--- trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp 2022-06-07 17:48:03 UTC (rev 295357)
@@ -290,11 +290,11 @@
m_type = type;
}
-void ResourceResponseBase::includeCertificateInfo() const
+void ResourceResponseBase::includeCertificateInfo(Span<const std::byte> auditToken) const
{
if (m_certificateInfo)
return;
- m_certificateInfo = static_cast<const ResourceResponse*>(this)->platformCertificateInfo();
+ m_certificateInfo = static_cast<const ResourceResponse*>(this)->platformCertificateInfo(auditToken);
}
String ResourceResponseBase::suggestedFilename() const
Modified: trunk/Source/WebCore/platform/network/ResourceResponseBase.h (295356 => 295357)
--- trunk/Source/WebCore/platform/network/ResourceResponseBase.h 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebCore/platform/network/ResourceResponseBase.h 2022-06-07 17:48:03 UTC (rev 295357)
@@ -34,6 +34,7 @@
#include <wtf/Box.h>
#include <wtf/EnumTraits.h>
#include <wtf/Markable.h>
+#include <wtf/Span.h>
#include <wtf/URL.h>
#include <wtf/WallTime.h>
@@ -141,7 +142,7 @@
WEBCORE_EXPORT String suggestedFilename() const;
WEBCORE_EXPORT static String sanitizeSuggestedFilename(const String&);
- WEBCORE_EXPORT void includeCertificateInfo() const;
+ WEBCORE_EXPORT void includeCertificateInfo(Span<const std::byte> = { }) const;
void setCertificateInfo(CertificateInfo&& info) { m_certificateInfo = WTFMove(info); }
const std::optional<CertificateInfo>& certificateInfo() const { return m_certificateInfo; };
bool usedLegacyTLS() const { return m_usedLegacyTLS == UsedLegacyTLS::Yes; }
@@ -237,7 +238,7 @@
// The ResourceResponse subclass should shadow these functions to lazily initialize platform specific fields
void platformLazyInit(InitLevel) { }
- CertificateInfo platformCertificateInfo() const { return CertificateInfo(); };
+ CertificateInfo platformCertificateInfo(Span<const std::byte>) const { return CertificateInfo(); };
String platformSuggestedFileName() const { return String(); }
static bool platformCompare(const ResourceResponse&, const ResourceResponse&) { return true; }
Modified: trunk/Source/WebCore/platform/network/cf/ResourceResponse.h (295356 => 295357)
--- trunk/Source/WebCore/platform/network/cf/ResourceResponse.h 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebCore/platform/network/cf/ResourceResponse.h 2022-06-07 17:48:03 UTC (rev 295357)
@@ -102,7 +102,7 @@
void platformLazyInit(InitLevel);
String platformSuggestedFilename() const;
- CertificateInfo platformCertificateInfo() const;
+ CertificateInfo platformCertificateInfo(Span<const std::byte>) const;
static bool platformCompare(const ResourceResponse& a, const ResourceResponse& b);
Modified: trunk/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp (295356 => 295357)
--- trunk/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp 2022-06-07 17:48:03 UTC (rev 295357)
@@ -108,7 +108,7 @@
m_initLevel = initLevel;
}
-CertificateInfo ResourceResponse::platformCertificateInfo() const
+CertificateInfo ResourceResponse::platformCertificateInfo(Span<const std::byte>) const
{
return { };
}
Modified: trunk/Source/WebCore/platform/network/cocoa/ResourceResponseCocoa.mm (295356 => 295357)
--- trunk/Source/WebCore/platform/network/cocoa/ResourceResponseCocoa.mm 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebCore/platform/network/cocoa/ResourceResponseCocoa.mm 2022-06-07 17:48:03 UTC (rev 295357)
@@ -75,7 +75,7 @@
lazyInit(AllFields);
}
-CertificateInfo ResourceResponse::platformCertificateInfo() const
+CertificateInfo ResourceResponse::platformCertificateInfo(Span<const std::byte> auditToken) const
{
CFURLResponseRef cfResponse = [m_nsResponse _CFURLResponse];
if (!cfResponse)
@@ -90,6 +90,15 @@
return { };
auto trust = checked_cf_cast<SecTrustRef>(trustValue);
+#if HAVE(SEC_TRUST_SET_CLIENT_AUDIT_TOKEN)
+ if (trust && auditToken.size()) {
+ auto data = "" reinterpret_cast<const uint8_t*>(auditToken.data()), auditToken.size()));
+ SecTrustSetClientAuditToken(trust, data.get());
+ }
+#else
+ UNUSED_PARAM(auditToken);
+#endif
+
SecTrustResultType trustResultType;
OSStatus result = SecTrustGetTrustResult(trust, &trustResultType);
if (result != errSecSuccess)
Modified: trunk/Source/WebCore/platform/network/soup/ResourceResponse.h (295356 => 295357)
--- trunk/Source/WebCore/platform/network/soup/ResourceResponse.h 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebCore/platform/network/soup/ResourceResponse.h 2022-06-07 17:48:03 UTC (rev 295357)
@@ -59,7 +59,7 @@
void doUpdateResourceResponse() { }
String platformSuggestedFilename() const;
- CertificateInfo platformCertificateInfo() const;
+ CertificateInfo platformCertificateInfo(Span<const std::byte>) const;
};
} // namespace WebCore
Modified: trunk/Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp (295356 => 295357)
--- trunk/Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp 2022-06-07 17:48:03 UTC (rev 295357)
@@ -93,7 +93,7 @@
addHTTPHeaderField(String::fromLatin1(headerName), String::fromLatin1(headerValue));
}
-CertificateInfo ResourceResponse::platformCertificateInfo() const
+CertificateInfo ResourceResponse::platformCertificateInfo(Span<const std::byte>) const
{
return CertificateInfo(m_certificate.get(), m_tlsErrors);
}
Modified: trunk/Source/WebKit/NetworkProcess/NetworkLoad.cpp (295356 => 295357)
--- trunk/Source/WebKit/NetworkProcess/NetworkLoad.cpp 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebKit/NetworkProcess/NetworkLoad.cpp 2022-06-07 17:48:03 UTC (rev 295357)
@@ -248,9 +248,17 @@
{
ASSERT(RunLoop::isMain());
- if (m_parameters.needsCertificateInfo)
- response.includeCertificateInfo();
+ if (m_parameters.needsCertificateInfo) {
+ Span<const std::byte> auditToken;
+#if PLATFORM(COCOA)
+ if (auto token = m_networkProcess->sourceApplicationAuditToken())
+ auditToken = asBytes(Span<unsigned> { token->val });
+#endif
+
+ response.includeCertificateInfo(auditToken);
+ }
+
m_client.get().didReceiveResponse(WTFMove(response), privateRelayed, WTFMove(completionHandler));
}
Modified: trunk/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm (295356 => 295357)
--- trunk/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm 2022-06-07 17:22:16 UTC (rev 295356)
+++ trunk/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm 2022-06-07 17:48:03 UTC (rev 295357)
@@ -690,12 +690,9 @@
void NetworkSessionCocoa::setClientAuditToken(const WebCore::AuthenticationChallenge& challenge)
{
-#if ENABLE(APP_PRIVACY_REPORT)
- if (auto auditToken = networkProcess().sourceApplicationAuditToken()) {
- auto& tokenValue = *auditToken;
- RetainPtr<NSData> token = adoptNS([[NSData alloc] initWithBytes:(uint8_t *)&tokenValue length:sizeof(tokenValue)]);
- SecTrustSetClientAuditToken(challenge.nsURLAuthenticationChallenge().protectionSpace.serverTrust, bridge_cast(token.get()));
- }
+#if HAVE(SEC_TRUST_SET_CLIENT_AUDIT_TOKEN)
+ if (auto auditData = networkProcess().sourceApplicationAuditData())
+ SecTrustSetClientAuditToken(challenge.nsURLAuthenticationChallenge().protectionSpace.serverTrust, auditData.get());
#else
UNUSED_PARAM(challenge);
#endif
