-
Notifications
You must be signed in to change notification settings - Fork 35
Bug 2037079 - Add support for captive portal #1129
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
mkaply
wants to merge
1
commit into
mozilla:enterprise-main
Choose a base branch
from
mkaply:2037079
base: enterprise-main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
291 changes: 291 additions & 0 deletions
291
toolkit/components/enterprise/modules/CaptivePortal.sys.mjs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,291 @@ | ||
| /* This Source Code Form is subject to the terms of the Mozilla Public | ||
| * License, v. 2.0. If a copy of the MPL was not distributed with this | ||
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | ||
|
|
||
| const lazy = {}; | ||
|
|
||
| ChromeUtils.defineESModuleGetters(lazy, { | ||
| FeltCommon: "chrome://felt/content/FeltCommon.sys.mjs", | ||
| FeltErrorReport: "resource://gre/modules/enterprise/FeltErrorReport.sys.mjs", | ||
| }); | ||
|
|
||
| /** | ||
| * Pre-authentication captive-portal sign-in for FELT (bug 2037079). Shows a | ||
| * banner rather than auto-opening anything, and hosts the portal in an | ||
| * embedded browser rather than a second top-level window (which would disturb | ||
| * FELT's window-lifecycle bookkeeping). Dismissal follows CaptivePortalService's | ||
| * connectivity signal, not the portal's navigation. | ||
| * | ||
| * Owns nothing about the sign-in flow itself: the FELT window injects callbacks | ||
| * at init() so this module never reaches back into window.js. | ||
| */ | ||
| export const CaptivePortal = { | ||
| _cps: Cc["@mozilla.org/network/captive-portal-service;1"].getService( | ||
| Ci.nsICaptivePortalService | ||
| ), | ||
|
|
||
| // Document of the FELT window, provided at init(). | ||
| _doc: null, | ||
|
|
||
| // Injected by init(): | ||
| // onStateChanged() - portal locked/unlocked; FELT re-evaluates UI. | ||
| // onConnectivityRestored() - network is back; FELT may resume sign-in. | ||
| // abortSso() - interrupt an in-flight SSO attempt. | ||
| // suspendUpdates() - stop the startup update check behind a portal. | ||
| // resumeUpdates() - re-run the update check once connectivity is back. | ||
| _onStateChanged: null, | ||
| _onConnectivityRestored: null, | ||
| _abortSso: null, | ||
| _suspendUpdates: null, | ||
| _resumeUpdates: null, | ||
|
|
||
| // True while we've suspended the update check for a portal, so we only resume | ||
| // a check we actually stopped (and never disturb an in-progress one). | ||
| _updatesSuspended: false, | ||
|
|
||
| get canonicalURL() { | ||
| return Services.prefs.getCharPref("captivedetect.canonicalURL"); | ||
| }, | ||
|
|
||
| // Tracked locally rather than read from _cps.state: CaptivePortalService | ||
| // sets LOCKED_PORTAL in its own observer of "captive-portal-login", and | ||
| // observer ordering for a single topic isn't guaranteed, so our observer | ||
| // can run before the service's -- reading .state at that point would race. | ||
| isLocked: false, | ||
|
|
||
| /** | ||
| * @param {Document} doc - The FELT window document. | ||
| * @param {object} [hooks] | ||
| * @param {Function} [hooks.onStateChanged] | ||
| * @param {Function} [hooks.onConnectivityRestored] | ||
| * @param {Function} [hooks.abortSso] | ||
| * @param {Function} [hooks.suspendUpdates] | ||
| * @param {Function} [hooks.resumeUpdates] | ||
| */ | ||
| init( | ||
| doc, | ||
| { | ||
| onStateChanged, | ||
| onConnectivityRestored, | ||
| abortSso, | ||
| suspendUpdates, | ||
| resumeUpdates, | ||
| } = {} | ||
| ) { | ||
| this._doc = doc; | ||
| this._onStateChanged = onStateChanged; | ||
| this._onConnectivityRestored = onConnectivityRestored; | ||
| this._abortSso = abortSso; | ||
| this._suspendUpdates = suspendUpdates; | ||
| this._resumeUpdates = resumeUpdates; | ||
|
|
||
| Services.obs.addObserver(this, "captive-portal-login"); | ||
| Services.obs.addObserver(this, "captive-portal-login-success"); | ||
| Services.obs.addObserver(this, "captive-portal-login-abort"); | ||
| Services.obs.addObserver(this, "network:captive-portal-connectivity"); | ||
| this._doc.defaultView.addEventListener("unload", () => this.uninit(), { | ||
| once: true, | ||
| }); | ||
|
|
||
| this._doc | ||
| .getElementById("felt-open-network-login") | ||
| .addEventListener("click", () => this.showPortalBrowser()); | ||
|
|
||
| // Already behind a portal at startup: stop the update check and surface the | ||
| // banner. Otherwise let the update check (already running) proceed; if a | ||
| // portal turns up mid-check our observer interrupts it. | ||
| if (this._cps.state == this._cps.LOCKED_PORTAL) { | ||
| this.isLocked = true; | ||
| this.showBanner(); | ||
| } else if (this._cps.state == this._cps.UNKNOWN) { | ||
| // Probe so a portal surfaces promptly rather than as an update failure. | ||
| this._cps.recheckCaptivePortal(); | ||
| } | ||
| }, | ||
|
|
||
| // Suspend the update check behind a portal, tracking that we did so so we | ||
| // only ever resume a check we stopped. | ||
| _suspendUpdatesForPortal() { | ||
| if (!this._updatesSuspended) { | ||
| this._updatesSuspended = true; | ||
| this._suspendUpdates?.(); | ||
| } | ||
| }, | ||
|
|
||
| // Re-run the update check now that connectivity is confirmed, but only if a | ||
| // portal made us suspend it (never disturb an in-progress check). | ||
| _resumeUpdatesAfterPortal() { | ||
| if (this._updatesSuspended) { | ||
| this._updatesSuspended = false; | ||
| this._resumeUpdates?.(); | ||
| } | ||
| }, | ||
|
|
||
| uninit() { | ||
| Services.obs.removeObserver(this, "captive-portal-login"); | ||
| Services.obs.removeObserver(this, "captive-portal-login-success"); | ||
| Services.obs.removeObserver(this, "captive-portal-login-abort"); | ||
| Services.obs.removeObserver(this, "network:captive-portal-connectivity"); | ||
| this._onStateChanged = null; | ||
| this._onConnectivityRestored = null; | ||
| this._abortSso = null; | ||
| this._suspendUpdates = null; | ||
| this._resumeUpdates = null; | ||
| this._doc = null; | ||
| }, | ||
|
|
||
| // Re-probe so a real portal surfaces as the banner, not a dead-end error. | ||
| recheck() { | ||
| this._cps.recheckCaptivePortal(); | ||
| }, | ||
|
|
||
| observe(subject, topic) { | ||
| switch (topic) { | ||
| case "captive-portal-login": | ||
| this.isLocked = true; | ||
| this.showBanner(); | ||
| break; | ||
| case "captive-portal-login-success": | ||
| this.isLocked = false; | ||
| // DNS lookups made while captive may be cached stale; flush so console | ||
| // requests resolve freshly now that we're connected. | ||
| Services.dns.clearCache(true); | ||
| this.hidePortalBrowser(); | ||
| this.hideBanner(true); | ||
| // Connectivity restored: run the update check we suspended. | ||
| this._resumeUpdatesAfterPortal(); | ||
| break; | ||
| case "captive-portal-login-abort": | ||
| // Portal dismissed without connecting: leave the update check suspended | ||
| // (there's still no connectivity) until a connectivity signal arrives. | ||
| this.isLocked = false; | ||
| this.hidePortalBrowser(); | ||
| this.hideBanner(false); | ||
|
mkaply marked this conversation as resolved.
|
||
| break; | ||
| case "network:captive-portal-connectivity": | ||
| // Fired only once a probe confirms connectivity (no portal, or a portal | ||
| // just cleared). If we'd suspended the update check for a portal, run it. | ||
| this._resumeUpdatesAfterPortal(); | ||
| break; | ||
| } | ||
| }, | ||
|
|
||
| showBanner() { | ||
| // Stop the startup update check so it doesn't fail behind the portal and | ||
| // show an update error over the banner. This also shows the login pane back | ||
| // (the update check may have hidden it), giving the banner somewhere to sit. | ||
| this._suspendUpdatesForPortal(); | ||
|
|
||
| // Clear any stray connection-error bar from a failed posture/SSO attempt. | ||
| lazy.FeltErrorReport.reset(); | ||
|
|
||
| // Interrupt an in-flight SSO attempt instead of showing both at once. | ||
| this._abortSso?.(); | ||
| const ssoBrowser = this._doc.getElementById("browser"); | ||
| if ( | ||
| !this._doc | ||
| .querySelector(".felt-login__sso") | ||
| .classList.contains("is-hidden") | ||
| ) { | ||
| ssoBrowser.stop(); | ||
| this._doc.querySelector(".felt-login__sso").classList.add("is-hidden"); | ||
| } | ||
|
|
||
| // The banner sits above the email form: make sure the form is visible, in | ||
| // case the SSO pane we just hid had hidden it. Otherwise dismissing the | ||
| // banner without resuming (login-abort) would leave a blank login area. | ||
| this._doc | ||
| .querySelector(".felt-login__email-pane") | ||
| .classList.remove("is-hidden"); | ||
|
|
||
| this._doc | ||
| .querySelector(".felt-browser-error-captive-portal") | ||
| .classList.remove("is-hidden"); | ||
| this._onStateChanged?.(); | ||
| }, | ||
|
|
||
| hideBanner(restored) { | ||
| this._doc | ||
| .querySelector(".felt-browser-error-captive-portal") | ||
| .classList.add("is-hidden"); | ||
| this._onStateChanged?.(); | ||
|
|
||
| // Network is back: let the FELT window decide whether to resume a sign-in. | ||
| if (restored) { | ||
| this._onConnectivityRestored?.(); | ||
| } | ||
| }, | ||
|
|
||
| showPortalBrowser() { | ||
| const url = this.canonicalURL; | ||
| // Exempt the plaintext probe from an HTTPS upgrade. HTTPS-First is on by | ||
| // default in private browsing (dom.security.https_first_pbm) and this | ||
| // browser is private, so without this the http probe gets upgraded and a | ||
| // real portal can't transparently intercept it. Same approach desktop uses | ||
| // in browser-captivePortal.js. privateBrowsingId must be 1 to match this | ||
| // browser's forced-private content. | ||
| const uri = Services.io.newURI(url); | ||
| const principal = Services.scriptSecurityManager.createContentPrincipal( | ||
| uri, | ||
| { privateBrowsingId: lazy.FeltCommon.PRIVATE_BROWSING_ID } | ||
| ); | ||
| Services.perms.addFromPrincipal( | ||
| principal, | ||
| "https-only-load-insecure", | ||
| Ci.nsIPermissionManager.ALLOW_ACTION, | ||
| Ci.nsIPermissionManager.EXPIRE_SESSION | ||
| ); | ||
|
|
||
| this._doc | ||
| .querySelector(".felt-login__portal") | ||
| .classList.remove("is-hidden"); | ||
|
|
||
| const browser = this._doc.getElementById("portal-browser"); | ||
| browser.setAttribute("maychangeremoteness", "true"); | ||
| // Pass the (private) FELT window so the prediction picks up its | ||
| // privateBrowsingId; otherwise it predicts for a default pbId=0 context. | ||
| browser.setAttribute( | ||
| "remoteType", | ||
| ChromeUtils.predictRemoteTypeForURI(url, { | ||
| window: this._doc.defaultView, | ||
| }) | ||
| ); | ||
|
|
||
| // Untrusted third-party content: use a null principal, carrying the FELT | ||
| // window's privateBrowsingId so its origin attributes match the docshell. | ||
| browser.fixupAndLoadURIString(url, { | ||
| triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({ | ||
| privateBrowsingId: lazy.FeltCommon.PRIVATE_BROWSING_ID, | ||
| }), | ||
| }); | ||
| browser.focus(); | ||
| }, | ||
|
|
||
| // Hide the overlay without tearing the browser down. Used when an error is | ||
| // shown so the overlay doesn't cover it. Guarded so it's safe to call from | ||
| // FeltErrorReport before init(). | ||
| hideOverlay() { | ||
| this._doc?.querySelector(".felt-login__portal")?.classList.add("is-hidden"); | ||
| }, | ||
|
|
||
| hidePortalBrowser() { | ||
| const browser = this._doc.getElementById("portal-browser"); | ||
| this.hideOverlay(); | ||
| // The portal is untrusted content sharing the private session | ||
| // (privateBrowsingId=1) with the SSO flow, and FELT collects every cookie | ||
| // in that session (getAllCookies matches on privateBrowsingId alone). Drop | ||
| // the portal's cookies whenever we tear it down -- on both success and | ||
| // abort -- so they aren't swept into the enterprise session. Safe because | ||
| // the portal runs before the SSO flow, so no console cookies exist yet. | ||
| Services.cookies.removeCookiesWithOriginAttributes( | ||
| JSON.stringify({ privateBrowsingId: lazy.FeltCommon.PRIVATE_BROWSING_ID }) | ||
| ); | ||
| // Discard whatever the portal was showing; dismissal is driven by the | ||
| // connectivity signal, not portal navigation. | ||
| browser.fixupAndLoadURIString("about:blank", { | ||
| triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({ | ||
| privateBrowsingId: lazy.FeltCommon.PRIVATE_BROWSING_ID, | ||
| }), | ||
| }); | ||
| }, | ||
|
mkaply marked this conversation as resolved.
|
||
| }; | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.