http_shield_chrome.js File Reference

This file contains functions for Network Boundary Shield in Chromium-based browsers. More...

Functions
function	beforeSendHeadersListener (requestDetail)
	The event listener, hooked up to webRequest onBeforeSendHeaders event.
function	isRequestFromPublicToPrivateNet (sourceHostname, targetHostname)
	Based on the provided hostnames, the function analyzes whether the HTTP request is going from the public to the private network.
function	onResponseStartedListener (responseDetails)
	The event listener, hooked up to webRequest onResponseStarted event.
function	notifyBlockedHost (host)

Variables
var	dnsCache = new Object()
	Custom DNS cache (associtive array) created based on previous requests.
var	blockedHosts = new Object()
	Associtive array of hosts, that are currently among blocked hosts.

Detailed Description

This file contains functions for Network Boundary Shield in Chromium-based browsers.

This file contains Chrome specific functions for Network Boundary Shield.

Author

Copyright (C) 2020 Pavel Pohner

Copyright (C) 2020-2021 Martin Bednář

License:

SPDX-License-Identifier: GPL-3.0-or-later

This file contains webRequest API listeners. These listeners handle HTTP requests in two different phases (before send headers, on response started) and handle messages (on message event).

Chromium-based web browsers do not provide DNS web extension API to translate a domain name to the IP address. NBS creates a dnsCache that is filled during a processing of the first request to each domain.

• The resolved IP address for a domain is found during onResponseStarted event listener (and not blocked),
• Once known requests from public IP address to local IP address are blocked during onBeforeSendHeaders event listener.

Additionally, if a domain initiates an attack, it is detected and registered in the blockedHosts associative array. All successive requests by such hosts are blocked until the extension is reloaded or the host whitelisted.

Bug:

If multiple requests are performed in parallel before the first one reaches onResponseStarted, all requests go through.

Function Documentation

beforeSendHeadersListener()

function beforeSendHeadersListener

(

requestDetail

)

The event listener, hooked up to webRequest onBeforeSendHeaders event.

The listener catches all requests, analyzes them, does blocking. Requests coming from public IP ranges targeting the private IPs are blocked by default. Others are permitted by default.

Note

It is not possible to merge implementation of this function with implementation for Firefox, because Chrome does not support async listerners for blocking requests This function must not be asynchronous for Chrome. See more: https://stackoverflow.com/questions/47910732/browserextension-webrequest-onbeforerequest-return-promise

Parameters

requestDetail

Details of HTTP request.

Here is the call graph for this function:

isRequestFromPublicToPrivateNet()

function isRequestFromPublicToPrivateNet	(		sourceHostname,
			targetHostname
	)

Based on the provided hostnames, the function analyzes whether the HTTP request is going from the public to the private network.

First, each hostname is translated to an IP address (based on the own DNS cache), if the hostname is not already an IP address. Subsequently, it is analyzed whether the IP addresses are from the public or private range based on the locally served DNS zones loaded from IANA.

Parameters

sourceHostname	Hostname without "www" from HTTP request source URL.
targetHostname	Hostname without "www" from HTTP request target URL.

Returns

Returns an object with two properties:

• crossboundary: boolean (true when HTTP request is going from the public to the private network, false otherwise),
• undefinedtargetip: boolean (true if the IP address of the target is undefined, i.e. 0.0.0.0 or [::], false otherwise).

Here is the call graph for this function:

Here is the caller graph for this function:

notifyBlockedHost()

function notifyBlockedHost

(

host

)

Creates and presents notification to the user. Works with webExtensions notification API. Creates notification about blocked host.

Parameters

host	Host added to the black-list (blockedHosts).

Here is the caller graph for this function:

onResponseStartedListener()

function onResponseStartedListener

(

responseDetails

)

The event listener, hooked up to webRequest onResponseStarted event.

The listener analyzes a HTTP response and get an ip address and a hostname (a domain name) from the response. This listener is filling the custom dnsCache object from the obtained IP address and the domain name. In Chrome, custom DNS cache has to be created because Chrome does not have DNS API. This listener also adds suspicious guests to blocked ones. Once a host sends an HTTP request from the public to the private network, it gets to the blocked hosts.

Parameters

responseDetails

Details of HTTP response. responseDetails contains desired combination of an IP address and a corresponding domain name.

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

blockedHosts

var blockedHosts = new Object()

Associtive array of hosts, that are currently among blocked hosts.

Once a host sends an HTTP request from the public to the private network, it gets to the blocked hosts. Other HTTP queries from this guest will be blocked regardless of whether they are going to a public or private network. This more stringent measure only applies to Chrome-based web browsers. This is because Chrome-based web browsers can't resolve a domain name to an IP address using the DNS API before sending HTTP request. If one HTTP request is in the direction from the public to the internal network, all other requests are also considered offensive because it is not possible to verify the opposite (missing DNS API), and other HTTP requests will be blocked.

dnsCache

var dnsCache = new Object()

Custom DNS cache (associtive array) created based on previous requests.

This object dnsCache serves as a custom DNS cache that is filled from HTTP responces that have already been received. When a new HTTP request is sent, the listener beforeSendHeadersListener looks at the domain name (from this HTTP request) in the dnsCache object. If IP address (or addresses) are find for current domain name, this IP address (or addresses) are returned from listener and domain name is successfully translated like by a DNS resolver.