| Commit-Queue | +1 |
// `tls_certificate`, or null otherwise.I needed to mark this as nullable; now that the type is no longer opaque to Mojo, Mojo enforces nullability. This comment is updated to reflect a very similar comment in cert_verifier_service.mojom
// TODO(dcheng): Why can this be optional?... this one also came up in tests, though I'm not actually sure what it means to pass null here... any thoughts or feedback on improving this comment would be helpful.
HttpResponseHeaders? headers;I needed to mark this as nullable; now that the type is no longer opaque to Mojo, Mojo enforces nullability.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
pickle->WriteData(serialized);This is a slight change, but they are represented identically inside Pickle.
std::vector<uint8_t> HttpResponseHeaders::Serialize(I made this a helper because it's silly to make a string and copy it into a pickle and then copy that into the IPC.
I am going to try to do a fairly thorough review here. Still need to review everything from services/network/public/cpp/BUILD.gn down to signed_certificate_timestamp_and_status.h (I'm reviewing mojom and traits together, of course).
Hope to have done a pass over everything by Wednesday. May end up finishing things tomorrow, just stopping once my eyes start to glaze over.
pickle->WriteData(serialized);This is a slight change, but they are represented identically inside Pickle.
This new code means we create an extra copy of the string in the case of PERSIST_RAW, which we didn't do before.
While I agree that saving us extra copies in the Mojo case is likely more important, I think we should also keep the old behavior here in the PERSIST_RAW case. We can either also make Serialize() have its own redundant code for PERSIST_RAW, or have it CHECK that PERSIST_RAW isn't passed to it.
TEST(SSLInfoMojoTraitsTest, SSLInfo) {Suggest having two tests, with the values set differently, sharing a comparisons helper. Can just use default values in the other test, and non-defaults in this one.
ASSERT_EQ(in.client_cert_sent, out.client_cert_sent);
ASSERT_EQ(in.handshake_type, out.handshake_type);
ASSERT_EQ(in.public_key_hashes, out.public_key_hashes);
ASSERT_EQ(in.encrypted_client_hello, out.encrypted_client_hello);Let's match order in the mojom file here.
ASSERT_EQ(in.ocsp_result, out.ocsp_result);is_fatal_cert_error is missing.
ASSERT_EQ(in.ocsp_result, out.ocsp_result);Check that early_data_received and early_data_accepted are false? They're the two fields in SSLInfo that aren't passed over mojo. I have no idea if that's a but or not.
// Copyright 2026 The Chromium AuthorsNote: I did not review this file, and am not currently planning to - feel this is a bit too far out of my balliwick (though entirely possible I'll change my mind).
HASH_ALGO_NONE = 0,In some of the other files, you switched to using kCamelCaseConstScheme for fields that
kFromTlsExtension = 1,Think it's a bit weird that for some of these, you kept net's LEGACY ENUM NAMING SCHEME, while for others you switched to kCoolNewNamingScheme. Fine as-is, but think it's better to adopt a philosophy here and stick with it.
// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme, or 0 if unknown.Reflow comment.
IPEndPoint remote_endpoint)
=> (AuthCredentials? credentials);I highly recommend not doing random reformats in 2,000 line CLs. If you want to reformat stuff, send out another CL first. I'm happy to rubberstamp such CLs.
#include "base/memory/weak_ptr.h"
#include "net/http/http_request_headers.h"Think we can use a forward declaration here? Though the C++ file does need the include.
'net::HttpVersion',
'net::HttpResponseHeaders',These probably shouldn't the in the "Shared Memory" block, right?
I am going to try to do a fairly thorough review here. Still need to review everything from services/network/public/cpp/BUILD.gn down to signed_certificate_timestamp_and_status.h (I'm reviewing mojom and traits together, of course).
Hope to have done a pass over everything by Wednesday. May end up finishing things tomorrow, just stopping once my eyes start to glaze over.
Thanks for the detailed review! I've uploaded a patchset, but it doesn't address the `SSLInfo` comments yet; I need to work my way through those more carefully.
mmenkeThis is a slight change, but they are represented identically inside Pickle.
This new code means we create an extra copy of the string in the case of PERSIST_RAW, which we didn't do before.
While I agree that saving us extra copies in the Mojo case is likely more important, I think we should also keep the old behavior here in the PERSIST_RAW case. We can either also make Serialize() have its own redundant code for PERSIST_RAW, or have it CHECK that PERSIST_RAW isn't passed to it.
Done, with the latter.
HASH_ALGO_NONE = 0,In some of the other files, you switched to using kCamelCaseConstScheme for fields that
These are moved from the original digitally_signed.mojom so I didn't change these (git/gerrit is inconsistent about detecting this as a move).
If you want consistency... I can go with the legacy style naming for everything, but I'm hoping not to :)
Think it's a bit weird that for some of these, you kept net's LEGACY ENUM NAMING SCHEME, while for others you switched to kCoolNewNamingScheme. Fine as-is, but think it's better to adopt a philosophy here and stick with it.
But these are new, hence the updated naming.
// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme, or 0 if unknown.Daniel ChengReflow comment.
... apparently the mojom formatter does not deal with this case. Done, manually.
IPEndPoint remote_endpoint)
=> (AuthCredentials? credentials);I highly recommend not doing random reformats in 2,000 line CLs. If you want to reformat stuff, send out another CL first. I'm happy to rubberstamp such CLs.
Sadly, The mojom formatter isn't nearly as clever as the C++ one, so it formats the whole file. I'll see what I can do...
#include "base/memory/weak_ptr.h"
#include "net/http/http_request_headers.h"Think we can use a forward declaration here? Though the C++ file does need the include.
Done
These probably shouldn't the in the "Shared Memory" block, right?
Blah, that's what I get for running `git cl format`. Fixed with a comment to hopefully keep this from happening again.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Sorry, did not get very far on this today. Still hoping to finish up tomorrow.
scoped_refptr<net::HttpResponseHeaders>* out) {
mojo::ArrayDataView<uint8_t> headers_data;This class is undocumented. I assume this gets us a raw view of the data sent over IPC without copying?
ASSERT_EQ(in.ocsp_result, out.ocsp_result);Check that early_data_received and early_data_accepted are false? They're the two fields in SSLInfo that aren't passed over mojo. I have no idea if that's a but or not.
*If that's a bug or not, rather.
HASH_ALGO_NONE = 0,Daniel ChengIn some of the other files, you switched to using kCamelCaseConstScheme for fields that
These are moved from the original digitally_signed.mojom so I didn't change these (git/gerrit is inconsistent about detecting this as a move).
If you want consistency... I can go with the legacy style naming for everything, but I'm hoping not to :)
Acknowledged. Hadn't realized this was copied from old code. I agree it's best to leave well enough alone in this CL.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Finished looking at this. Will sign off once comments are resolved. Thanks for the other CLs you made in response to my comments, too.
TEST(NetworkParamTraitsTest, HttpResponseHeaders) {We should probably make sure cookie headers are removed, to make sure the right method is being invoked.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
scoped_refptr<net::HttpResponseHeaders>* out) {
mojo::ArrayDataView<uint8_t> headers_data;This class is undocumented. I assume this gets us a raw view of the data sent over IPC without copying?
Yeah... I'll add some comments to this in a separate CL.
We should probably make sure cookie headers are removed, to make sure the right method is being invoked.
Done (good catch; I had meant to do that but forgot to come back to it)
Suggest having two tests, with the values set differently, sharing a comparisons helper. Can just use default values in the other test, and non-defaults in this one.
I was being lazy so I had gemini-cli write the boilerplate.
I think ... it's OK? But there doesn't seem to be a good place for these sorts of things to live outside the tests so I just left it in the test.
ASSERT_EQ(in.client_cert_sent, out.client_cert_sent);
ASSERT_EQ(in.handshake_type, out.handshake_type);
ASSERT_EQ(in.public_key_hashes, out.public_key_hashes);
ASSERT_EQ(in.encrypted_client_hello, out.encrypted_client_hello);Let's match order in the mojom file here.
Done
ASSERT_EQ(in.ocsp_result, out.ocsp_result);Daniel Chengis_fatal_cert_error is missing.
Done
ASSERT_EQ(in.ocsp_result, out.ocsp_result);mmenkeCheck that early_data_received and early_data_accepted are false? They're the two fields in SSLInfo that aren't passed over mojo. I have no idea if that's a but or not.
*If that's a bug or not, rather.
I've filed a bug and added a TODO to followup here as well.
Note: I did not review this file, and am not currently planning to - feel this is a bit too far out of my balliwick (though entirely possible I'll change my mind).
FWIW this is largely moved from network_param_mojom_traits.cc. Maybe the copyright header should match network_param_mojom_traits.cc? I'm never really sure...
// TODO(dcheng): Why can this be optional?... this one also came up in tests, though I'm not actually sure what it means to pass null here... any thoughts or feedback on improving this comment would be helpful.
@mme...@chromium.org curious if you have any suggestions for a comment here
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
+avi can you stamp the IWYU fixes in //chrome?
+andreaorru can you review the IWYU fix in //extensions? Feel free to review anything else you want as well if you want, though mmenke@ already did the overall and detailed review of the //net and //services/network portions
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Code-Review | +1 |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Code-Review | +1 |
Still LGTM
TEST(SSLInfoMojoTraitsTest, SSLInfo) {Daniel ChengSuggest having two tests, with the values set differently, sharing a comparisons helper. Can just use default values in the other test, and non-defaults in this one.
I was being lazy so I had gemini-cli write the boilerplate.
I think ... it's OK? But there doesn't seem to be a good place for these sorts of things to live outside the tests so I just left it in the test.
I'm not a big fan of matchers unless they get you quite a lot that you couldn't get without them, because they're so much more difficult to read than C++. That having said, I'm certainly not going to push against a CL that uses them.
// Copyright 2026 The Chromium AuthorsDaniel ChengNote: I did not review this file, and am not currently planning to - feel this is a bit too far out of my balliwick (though entirely possible I'll change my mind).
FWIW this is largely moved from network_param_mojom_traits.cc. Maybe the copyright header should match network_param_mojom_traits.cc? I'm never really sure...
I'm not seeing any calls to CreateCryptoBuffer or CryptoBufferAsSpan in network_param_mojom_traits.cc or any traits file in all of Chrome, for that matter.
It looks like net_ipc_param_traits does have some removed code to read/write x509 certs, but it looks substantially different to me. Not suspecting a bug, but it requires more than just glancing at two methods and confirming they're the same. Anyhow, I have skipped reviewing this.
// TODO(dcheng): Why can this be optional?Daniel Cheng... this one also came up in tests, though I'm not actually sure what it means to pass null here... any thoughts or feedback on improving this comment would be helpful.
@mme...@chromium.org curious if you have any suggestions for a comment here
So, the description is:
```
// Will flush cached client certificate for `host` if `certificate`
// doesn't match the corresponding cached certificate.
```
So passing in null presumably unconditionally clears the cached client cert for `host`, regardless or what client cert is cached for host. Disclaimer: I'm not familiar with this API, but that seems like what it would presumably mean?
// Copyright 2026 The Chromium AuthorsDaniel ChengNote: I did not review this file, and am not currently planning to - feel this is a bit too far out of my balliwick (though entirely possible I'll change my mind).
mmenkeFWIW this is largely moved from network_param_mojom_traits.cc. Maybe the copyright header should match network_param_mojom_traits.cc? I'm never really sure...
I'm not seeing any calls to CreateCryptoBuffer or CryptoBufferAsSpan in network_param_mojom_traits.cc or any traits file in all of Chrome, for that matter.
It looks like net_ipc_param_traits does have some removed code to read/write x509 certs, but it looks substantially different to me. Not suspecting a bug, but it requires more than just glancing at two methods and confirming they're the same. Anyhow, I have skipped reviewing this.
... ok I looked into this a bit more. I got confused at an earlier stage due to the large size of the diffs after the initial gemini pass.
So this logic is mostly inlined from [`Persist()`](https://source.chromium.org/chromium/chromium/src/+/main:net/cert/x509_certificate.cc;l=325;drc=0a4317210c4de343411da25ccf8145d3091b3007), but we can't use that helper directly here. I did simplify it a bit, but internally, it's all stored in `cert_buffers_`, where the first element is the cert represented by the object, and all subsequent elements are intermediates. I changed the .mojom definition to make this a bit clearer, since the cert itself is always mandatory.
For serialization, I also changed it to use `cert_span()` instead of `net::x509_util::CryptoBufferAsSpan(cert->cert_buffer())`; there does not appear to be any such helper for intermediates.
For deserialization, it's similarly inspired by [`X509Certificate::CreateFromPickleUnsafeOptions()`](https://source.chromium.org/chromium/chromium/src/+/main:net/cert/x509_certificate.cc;l=215;drc=56ce19c7e5b06543b57ccdf2436cd419051969a4). I also updated it to produce fewer copies by using a std::vector<std::string_view> and a different overload, and re-added the comment that was not preserved when the code moved. This also means the bssl magic is better encapsulated inside X509Certificate. Thank you for highlighting this, and sorry for missing this earlier.
// TODO(dcheng): Why can this be optional?Daniel Cheng... this one also came up in tests, though I'm not actually sure what it means to pass null here... any thoughts or feedback on improving this comment would be helpful.
mmenke@mme...@chromium.org curious if you have any suggestions for a comment here
So, the description is:
```
// Will flush cached client certificate for `host` if `certificate`
// doesn't match the corresponding cached certificate.
```So passing in null presumably unconditionally clears the cached client cert for `host`, regardless or what client cert is cached for host. Disclaimer: I'm not familiar with this API, but that seems like what it would presumably mean?
Good enough for me, thanks!
(This roughly matches my guess/understanding, but I wasn't 100% sure either. I'll just delete the TODO in that case)
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
21 is the latest approved patch-set.
The change was submitted with unreviewed changes in the following files:
```
The name of the file: services/network/public/mojom/network_context.mojom
Insertions: 0, Deletions: 1.
The diff is too large to show. Please review the diff.
```
```
The name of the file: services/network/public/cpp/x509_certificate_mojom_traits.cc
Insertions: 24, Deletions: 20.
The diff is too large to show. Please review the diff.
```
```
The name of the file: services/network/public/mojom/x509_certificate.mojom
Insertions: 4, Deletions: 3.
The diff is too large to show. Please review the diff.
```
```
The name of the file: services/network/public/cpp/x509_certificate_mojom_traits.h
Insertions: 6, Deletions: 1.
The diff is too large to show. Please review the diff.
```
Remove use deprecated [Native] types in network_param.mojom
This ends up being large change since it is easiest to convert an entire
tree of `[Native]` types at once, as it's a awkward to mix and match
`[Native]` and non-`[Native]` types without introducing temporary
`[Native]` types to bridge the transition. The opaque nature of
`[Native]` types also means that there were types that Mojo didn't even
know about at all, further increasing the size of the change.
To avoid making network_param.mojom a dumping ground of arbitrary types,
define the new types in distinct .mojom files, using a simple heuristic:
if the C++ types are defined in a single header, the Mojo types should
be defined in a single .mojom file as well. Several types previously
defined in network_param.mojom are also moved out to match this
heuristic.
The typemap definitions are also reorganized and split into smaller
blocks; in theory, this should allow more granular dependencies, though
this CL does not take full advantage of this since all the trait
definitions are built as one source set still. Additional cleanups:
- normalize how .cc trait sources are defined in the GN rules–the
typemap definitions no longer use `trait_sources` and depend on the
`source_set` that includes all the trait sources
- normalize where trait declarations and definitions live: the traits
for X509Certificate are now in x509_certificate_mojom_traits.{cc,h}
rather than being split across x509_certificate_mojom_traits.h and
network_param_mojom_traits.cc.
Many typemaps also need to become shared typemaps now. This is necessary
because `URLLoaderCompletionStatus` transitively depends on `SSLInfo`,
which was previously a `[Native]` type. Unfortunately, this results in a
large compile size increase which is unavoidable: `[Native]` types are
entirely opaque to Mojo and as such, very little generated code was
needed to support them. Teaching Mojo about these types results in a lot
more generated code.
`HttpResponseHeaders` now has an internal, shared serialization helper,
since serializing to a pickle first and then serializing to Mojo is an
additional wasted copy. This helper is used by the original `Persist()`
method, as well as the new `SerializeForMojoIpc()` method. It would be
possible to do even better here, i.e. by teaching Mojo how to serialize
a segmented string, but that is left for a future followup if additional
efficiency is needed.
Since `HttpResponseHeaders` and `X509Certificate` are no longer opaque
types, nullability checks are now enforced by Mojo deserialization: this
revealed several bugs (in `CertVerifierService`, `NetworkContext`, and
`URLResponseHead`) where fields/parameters are not marked as nullable
despite comments indicating it could be null.
Finally, though it's not strictly necessary, make `HttpResponseHeaders`
a shared typemap as well. The raw form of `HttpResponseHeaders` is hard
to hold correctly, and it's safer to use the `net::HttpResponseHeaders`
to handle it.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
LUCI Bisection has identified this change as the cause of a test failure. See the analysis: https://ci.chromium.org/ui/p/chromium/bisection/test-analysis/b/6359254454763520
Sample build with failed test: https://ci.chromium.org/b/8684561873987853713
Affected test(s):
[://\:blink_web_tests!webtest::virtual/stable/fast/dom/Window#open-invalid-url.html](https://ci.chromium.org/ui/test/chromium/:%2F%2F%5C:blink_web_tests%21webtest::virtual%2Fstable%2Ffast%2Fdom%2FWindow%23open-invalid-url.html?q=VHash%3Afe35cfb6dbc13663)
[://content/test\:content_unittests!gtest::NavigationURLLoaderImplTest#RedirectDuringURLLoader](https://ci.chromium.org/ui/test/chromium/:%2F%2Fcontent%2Ftest%5C:content_unittests%21gtest::NavigationURLLoaderImplTest%23RedirectDuringURLLoader?q=VHash%3Ac3bb378dfca1afa3)
A revert for this change was not created because the builder that this CL broke is not watched by gardeners, therefore less important. You can consider revert this CL, fix forward or let builder owners resolve it themselves.
If this is a false positive, please report it at http://b.corp.google.com/createIssue?component=1199205&description=Analysis%3A+https%3A%2F%2Fci.chromium.org%2Fui%2Fp%2Fchromium%2Fbisection%2Ftest-analysis%2Fb%2F6359254454763520&format=PLAIN&priority=P3&title=Wrongly+blamed+https%3A%2F%2Fchromium-review.googlesource.com%2Fc%2Fchromium%2Fsrc%2F%2B%2F7724381&type=BUG
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |