Google GitGoogle Git
Sign in
chromium/codesearch/chromium/src/HEAD/./content/browser/direct_sockets
tree: db7d73387050e2af74ba436ec01d6ab9c42a4c63
  1. DIR_METADATA
  2. direct_sockets_open_browsertest.cc
  3. direct_sockets_service_impl.cc
  4. direct_sockets_service_impl.h
  5. direct_sockets_tcp_browsertest.cc
  6. direct_sockets_test_utils.cc
  7. direct_sockets_test_utils.h
  8. direct_sockets_udp_browsertest.cc
  9. firewall_hole_browsertest.cc
  10. firewall_hole_delegate.cc
  11. firewall_hole_delegate.h
  12. firewall_hole_delegate_unittest.cc
  13. OWNERS
  14. README.md
content/browser/direct_sockets/README.md

Direct Sockets API (content/browser/direct_sockets)

This directory implements the browser-process service and security checks for the Direct Sockets API, allowing Isolated Web Apps (IWAs) and isolated contexts to establish raw TCP (TCPSocket, TCPServerSocket) and UDP (UDPSocket) connections.

Companion Documentation

Architecture & Security Checks

DirectSocketsServiceImpl supports connections initiated from a RenderFrameHost, SharedWorkerHost, or ServiceWorkerVersion (Context std::variant) and enforces:

  • Context & Delegate Validation:
    • For frames (CreateForFrame), verifies either (HasIsolatedContextCapability(render_frame_host) and PermissionsPolicyFeature::kDirectSockets) or DirectSocketsDelegate::AreDirectSocketsAllowed().
    • For workers (CreateForSharedWorker, CreateForServiceWorker), verifies IsIsolatedContext(RenderProcessHost*).
    • Validates each socket open request (kTcp, kConnectedUdp, kBoundUdp, kTcpServer) via content::DirectSocketsDelegate::ValidateRequest*().
  • Permissions Policy & Local Network Access: Enforces PermissionsPolicyFeature::kDirectSockets and PermissionsPolicyFeature::kMulticastInDirectSockets, and requests blink::PermissionType::LOCAL_NETWORK or blink::PermissionType::LOOPBACK_NETWORK via PermissionController when connecting or binding to non-public IP addresses.
  • ChromeOS Firewall Integration (FirewallHoleDelegate): Opens and manages scoped OS firewall holes for listening TCP/UDP server sockets on ChromeOS.

When requests pass these security checks, DirectSocketsServiceImpl forwards socket creation to the sandboxed Network Service (network::mojom::NetworkContext).