Network traffic annotation added to gcm_network_channel.

components/invalidation/impl/gcm_network_channel.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/invalidation/impl/gcm_network_channel.h"
 
 #include <utility>
 
 #include "base/base64url.h"
 #include "base/i18n/time_formatting.h"
 #include "base/location.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/sha1.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
 #include "components/data_use_measurement/core/data_use_user_data.h"
 #include "components/invalidation/impl/gcm_network_channel_delegate.h"
 #include "google_apis/gaia/google_service_auth_error.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_status.h"
 
 #if !defined(OS_ANDROID)
 // channel_common.proto defines ANDROID constant that conflicts with Android
 // build. At the same time TiclInvalidationService is not used on Android so it
 // is safe to exclude these protos from Android build.
 #include "google/cacheinvalidation/android_channel.pb.h"
 #include "google/cacheinvalidation/channel_common.pb.h"
 #include "google/cacheinvalidation/types.pb.h"
@@ skipping 177 matching lines @@
     // Message won't get sent. Notify that http channel doesn't work.
     UpdateHttpChannelState(false);
     cached_message_.clear();
     return;
   }
   DCHECK(!token.empty());
   // Save access token in case POST fails and we need to invalidate it.
   access_token_ = token;
 
   DVLOG(2) << "Got access token, sending message";
-  fetcher_ = net::URLFetcher::Create(BuildUrl(registration_id_),
-                                     net::URLFetcher::POST, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("invalidation_service", R"(
+        semantics {
+          sender: "Invalidation service"
+          description:
+            "Chromium uses cacheinvalidation library to receive push "
+            "notifications from server about sync items (bookmarks, passwords, "

[msramek, 2017/03/07 10:53:29]

the server

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

+            "preferences, etc.) modified on other clients. It uses GCMClient "
+            "to receive incoming messages. This request is used for "
+            "client-to-server communications."
+          trigger:
+            "The first message is sent to register client with the server on "
+            "Chromium startup. It is then sent periodically to confirm that "
+            "client is still online. After receiving notification about server "

[msramek, 2017/03/07 10:53:29]

the client

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

+            "changes client sends this request to acknowledge that "

[msramek, 2017/03/07 10:53:29]

changes, the client

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

+            "notification is processed."

[msramek, 2017/03/07 10:53:29]

the notification

[Ramin Halavati, 2017/03/07 13:10:34]

Done.

+          data:
+            "No PII data is sent in this request. Request contains "

[msramek, 2017/03/07 10:53:29]

The request.

[Ramin Halavati, 2017/03/07 13:10:34]

Done.

+            "client_token generated on the server. It includes invalidation "
+            "object ids (not specific to client) and versions when confirming "

[msramek, 2017/03/07 10:53:29]

a client

I also don't fully understand the sentence. Does it contain version numbers of
the synced objects? What does "when confirming invalidations" mean? Should that
be "used to confirm invalidations", or does it mean that the request does not
always contain them, only sometimes, "when confirming invalidations"?

[msramek, 2017/03/14 16:17:50]

pavely@, can you please clarify this?

[pavely, 2017/03/15 17:55:46]

As I understand version is internal invalidations concept, each invalidation is
marked with version for client to be able to detect the ones that it already
received and for server to identify invalidations acknowledged by client. 
It means the request only contains ObjectIDs and versions only when confirming
invalidations.


I wanted to convey that this message contains protocol details that don't
include user data, but wasn't sure how much details to include into description.

Here is more structured description of the protocol. The network request is used
for:
- Initial registration: Doesn't contain user data.
- Updating the set of subscriptions. Contains server generated client_token and
ObjectIds identifying subscriptions. ObjectId is not unique to user.
- Invalidation acknowledgement. Contains client_token, ObjectId and server
version for corresponding subscription. Version is not related to sync data, it
is internal concept of invalidations protocol.

[Ramin Halavati, 2017/03/16 08:30:41]

Done.

+            "invalidations. When updating registrations request includes "

[msramek, 2017/03/07 10:53:30]

registrations, the request

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

[msramek, 2017/03/14 16:17:49]

nit: Still missing the article :)

[Ramin Halavati, 2017/03/15 07:04:19]

Done.

+            "object ids."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false
+          setting: "This feature cannot be disabled."
+          policy_exception_justification:
+            "Not implemented. Disabling InvalidationService might break "
+            "features that depend on it. I think it makes sense to control "

[msramek, 2017/03/07 10:53:29]

Keep in mind that this text will be read by enterprise admins. Who is "I"? Why
do Chromium developers "think" that this is the case instead of making a clear
statement?

[Ramin Halavati, 2017/03/07 13:10:34]

Done.

+            "top level features that use InvalidationService."
+        })");
+  fetcher_ =
+      net::URLFetcher::Create(BuildUrl(registration_id_), net::URLFetcher::POST,
+                              this, traffic_annotation);
   data_use_measurement::DataUseUserData::AttachToFetcher(
       fetcher_.get(), data_use_measurement::DataUseUserData::INVALIDATION);
   fetcher_->SetRequestContext(request_context_getter_.get());
   fetcher_->SetLoadFlags(net::LOAD_DO_NOT_SEND_COOKIES |
                          net::LOAD_DO_NOT_SAVE_COOKIES);
   const std::string auth_header("Authorization: Bearer " + access_token_);
   fetcher_->AddExtraRequestHeader(auth_header);
   if (!echo_token_.empty()) {
     const std::string echo_header("echo-token: " + echo_token_);
     fetcher_->AddExtraRequestHeader(echo_header);
@@ skipping 213 matching lines @@
     ENUM_CASE(gcm::GCMClient::UNKNOWN_ERROR);
     ENUM_CASE(gcm::GCMClient::INVALID_PARAMETER);
     ENUM_CASE(gcm::GCMClient::ASYNC_OPERATION_PENDING);
     ENUM_CASE(gcm::GCMClient::GCM_DISABLED);
   }
   NOTREACHED();
   return "";
 }
 
 }  // namespace syncer