Network traffic annotation added to url_provision_fetcher.

content/browser/media/url_provision_fetcher.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/media/url_provision_fetcher.h"
 
 #include "base/memory/ptr_util.h"
 #include "content/public/browser/provision_fetcher_factory.h"
 #include "media/base/bind_to_current_loop.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 
 using net::URLFetcher;
 
 namespace content {
 
 // Implementation of URLProvisionFetcher.
 
 URLProvisionFetcher::URLProvisionFetcher(
     net::URLRequestContextGetter* context_getter)
     : context_getter_(context_getter) {}
 
 URLProvisionFetcher::~URLProvisionFetcher() {}
 
 void URLProvisionFetcher::Retrieve(
     const std::string& default_url,
     const std::string& request_data,
     const media::ProvisionFetcher::ResponseCB& response_cb) {
   response_cb_ = response_cb;
 
   const std::string request_string =
       default_url + "&signedRequest=" + request_data;
   DVLOG(1) << __func__ << ": request:" << request_string;
 
   DCHECK(!request_);
-  request_ = URLFetcher::Create(GURL(request_string), URLFetcher::POST, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("url_prevision_fetcher", R"(
+        semantics {
+          sender: "ProvisionFetcher for Android MediaDrm"

[Ramin Halavati, 2017/04/04 08:23:52]

This field should be a rather short and descriptive name of the module. Are any
of these suitable:
Content Decryption Module
Android MediaDrm.
MediaDrm Bridge

[xhwang, 2017/04/04 17:08:32]

This is also used on ChromeCast so "Content Decryption Module" is the best fit.

[slan, 2017/04/04 19:30:20]

+1

[Ramin Halavati, 2017/04/05 09:12:06]

Done.

+          description:
+            "For a Content Decryption Module (CDM) to obtain origin-specific "
+            "identifiers from an individualization or provisioning server. See "
+            "https://w3c.github.io/encrypted-media/#direct-individualization."
+          trigger:
+            "During protected content playback, if the CDM hasn’t been "
+            "provisioned yet, it may trigger a provision request which will be "
+            "sent to a provisioning server."
+          data:
+            "Opaque provision request generated by the CDM. It may contain "
+            "distinctive identifiers (see "
+            "https://w3c.github.io/encrypted-media/#distinctive-identifier) "
+            "and/or distinctive permanent identifiers (see "
+            "https://w3c.github.io/encrypted-media/#distinctive-permanent-"
+            "identifier), which must be encrypted. It does NOT contain origin "
+            "information, even in encrypted form."
+          destination: OTHER

[Ramin Halavati, 2017/04/04 08:23:52]

My understanding is it may send to websites not owned by Google, am I correct?

[xhwang, 2017/04/04 17:08:32]

Currently it's mostly Google sites, but this can change in the future. And
fundamentally, Chromium is designed to support different CDMs, which might use
different websites (including those not owned by Google) to do provisioning.

So OTHER sgtm.

[Ramin Halavati, 2017/04/05 09:12:06]

Done.

+        }
+        policy {
+          cookies_allowed: false/true

[Ramin Halavati, 2017/04/04 08:23:52]

It seems to me that cookies are not specifically disabled here. On desktop the
default state is enabled, if it is the same on Android, can I add another CL
that specifically disables the cookies?

[xhwang, 2017/04/04 17:08:32]

Sure. Thank you!

[Ramin Halavati, 2017/04/05 09:12:06]

Done in https://codereview.chromium.org/2804563002

+          cookies_store: "..."
+          setting:
+            "Users can disable this feature by blocking Protected Media "
+            "Identifier permissions via unchecking Protected content in "
+            "Android settings, under Site Settings, Media."

[xhwang, 2017/04/04 17:08:32]

Again, this setting is for Android only. I am not sure whether we have a
permission or have any way to block this on ChromeCast. +slan

On Android, users can disable this feature by either:
- block Protected Media Identifier permissions prompt, or
- disable "Protected Media Identifier permission" via "Android settings, under
Site Settings, Media, Protected Media."

I am not sure how much detail you want to get into. Maybe just something like:

On Android, users can disable this feature by disabling Protected Media
Identifier permissions.

[slan, 2017/04/04 19:30:20]

We don't have support for disabling protected media on Cast, nor do we plan on
exposing anything like this to users. Xiaohan's suggestion SGTM.

[Ramin Halavati, 2017/04/05 09:12:06]

Done.

+          policy_exception_justification: "Not implemented."
+        })");
+  request_ = URLFetcher::Create(GURL(request_string), URLFetcher::POST, this,
+                                traffic_annotation);
 
   // SetUploadData is mandatory even if we are not uploading anything.
   request_->SetUploadData("", "");
   request_->AddExtraRequestHeader("User-Agent: Widevine CDM v1.0");
   request_->AddExtraRequestHeader("Content-Type: application/json");
 
   DCHECK(context_getter_);
   request_->SetRequestContext(context_getter_);
 
   request_->Start();
@@ skipping 22 matching lines @@
 
 // Implementation of content public method CreateProvisionFetcher().
 
 std::unique_ptr<media::ProvisionFetcher> CreateProvisionFetcher(
     net::URLRequestContextGetter* context_getter) {
   DCHECK(context_getter);
   return base::MakeUnique<URLProvisionFetcher>(context_getter);
 }
 
 }  // namespace content