Network traffic annotation added to gcm_network_channel.

components/invalidation/impl/gcm_network_channel.cc

Index: components/invalidation/impl/gcm_network_channel.cc
diff --git a/components/invalidation/impl/gcm_network_channel.cc b/components/invalidation/impl/gcm_network_channel.cc
index 033843c4ec2f8999febb1da5b6cc41ee6d7fada1..a677ea58ce1981af2d51fd2929fbda9fa269e632 100644
--- a/components/invalidation/impl/gcm_network_channel.cc
+++ b/components/invalidation/impl/gcm_network_channel.cc
@@ -21,6 +21,7 @@
 #include "google_apis/gaia/google_service_auth_error.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_status.h"
 
@@ -218,8 +219,41 @@ void GCMNetworkChannel::OnGetTokenComplete(
   access_token_ = token;
 
   DVLOG(2) << "Got access token, sending message";
-  fetcher_ = net::URLFetcher::Create(BuildUrl(registration_id_),
-                                     net::URLFetcher::POST, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("invalidation_service", R"(
+        semantics {
+          sender: "Invalidation service"
+          description:
+            "Chromium uses cacheinvalidation library to receive push "
+            "notifications from server about sync items (bookmarks, passwords, "

[msramek, 2017/03/07 10:53:29]

the server

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

+            "preferences, etc.) modified on other clients. It uses GCMClient "
+            "to receive incoming messages. This request is used for "
+            "client-to-server communications."
+          trigger:
+            "The first message is sent to register client with the server on "
+            "Chromium startup. It is then sent periodically to confirm that "
+            "client is still online. After receiving notification about server "

[msramek, 2017/03/07 10:53:29]

the client

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

+            "changes client sends this request to acknowledge that "

[msramek, 2017/03/07 10:53:29]

changes, the client

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

+            "notification is processed."

[msramek, 2017/03/07 10:53:29]

the notification

[Ramin Halavati, 2017/03/07 13:10:34]

Done.

+          data:
+            "No PII data is sent in this request. Request contains "

[msramek, 2017/03/07 10:53:29]

The request.

[Ramin Halavati, 2017/03/07 13:10:34]

Done.

+            "client_token generated on the server. It includes invalidation "
+            "object ids (not specific to client) and versions when confirming "

[msramek, 2017/03/07 10:53:29]

a client

I also don't fully understand the sentence. Does it contain version numbers of
the synced objects? What does "when confirming invalidations" mean? Should that
be "used to confirm invalidations", or does it mean that the request does not
always contain them, only sometimes, "when confirming invalidations"?

[msramek, 2017/03/14 16:17:50]

pavely@, can you please clarify this?

[pavely, 2017/03/15 17:55:46]

As I understand version is internal invalidations concept, each invalidation is
marked with version for client to be able to detect the ones that it already
received and for server to identify invalidations acknowledged by client. 
It means the request only contains ObjectIDs and versions only when confirming
invalidations.


I wanted to convey that this message contains protocol details that don't
include user data, but wasn't sure how much details to include into description.

Here is more structured description of the protocol. The network request is used
for:
- Initial registration: Doesn't contain user data.
- Updating the set of subscriptions. Contains server generated client_token and
ObjectIds identifying subscriptions. ObjectId is not unique to user.
- Invalidation acknowledgement. Contains client_token, ObjectId and server
version for corresponding subscription. Version is not related to sync data, it
is internal concept of invalidations protocol.

[Ramin Halavati, 2017/03/16 08:30:41]

Done.

+            "invalidations. When updating registrations request includes "

[msramek, 2017/03/07 10:53:30]

registrations, the request

[Ramin Halavati, 2017/03/07 13:10:35]

Done.

[msramek, 2017/03/14 16:17:49]

nit: Still missing the article :)

[Ramin Halavati, 2017/03/15 07:04:19]

Done.

+            "object ids."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false
+          setting: "This feature cannot be disabled."
+          policy_exception_justification:
+            "Not implemented. Disabling InvalidationService might break "
+            "features that depend on it. I think it makes sense to control "

[msramek, 2017/03/07 10:53:29]

Keep in mind that this text will be read by enterprise admins. Who is "I"? Why
do Chromium developers "think" that this is the case instead of making a clear
statement?

[Ramin Halavati, 2017/03/07 13:10:34]

Done.

+            "top level features that use InvalidationService."
+        })");
+  fetcher_ =
+      net::URLFetcher::Create(BuildUrl(registration_id_), net::URLFetcher::POST,
+                              this, traffic_annotation);
   data_use_measurement::DataUseUserData::AttachToFetcher(
       fetcher_.get(), data_use_measurement::DataUseUserData::INVALIDATION);
   fetcher_->SetRequestContext(request_context_getter_.get());