Add ability to uncloak CNAME records

Related issue:
- uBlockOrigin/uBlock-issues#780

New webext permission added: `dns`, which purpose is
to allow an extension to fetch the DNS record of
specific hostnames, reference documentation:

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/dns

The webext API `dns` is available in Firefox 60+ only.

The new API will enable uBO to "uncloak" the actual
hostname used in network requests. The ability is
currently disabled by default for now -- this is only
a first commit related to the above issue to allow
advanced users to immediately use the new ability.

Four advanced settings have been created to control the
uncloaking of actual hostnames:

cnameAliasList: a space-separated list of hostnames.
Default value: unset => empty list.
Special value: * => all hostnames.
A space-separated list of hostnames => this tells uBO
to "uncloak" the  hostnames in the list will.

cnameIgnoreList: a space-separated list of hostnames.
Default value: unset => empty list.
Special value: * => all hostnames.
A space-separated list of hostnames => this tells uBO
to NOT re-run the network request through uBO's
filtering engine with the CNAME hostname. This is
useful to exclude commonly used actual hostnames
from being re-run through uBO's filtering engine, so
as to avoid pointless overhead.

cnameIgnore1stParty: boolean.
Default value: true.
Whether uBO should ignore to re-run a network request
through the filtering engine when the CNAME hostname
is 1st-party to the alias hostname.

cnameMaxTTL: number of minutes.
Default value: 120.
This tells uBO to clear its CNAME cache after the
specified time. For efficiency purpose, uBO will
cache alias=>CNAME associations for reuse so as
to reduce calls to `browser.dns.resolve`. All the
associations will be cleared after the specified time
to ensure the map does not grow too large and too
ensure uBO uses up to date CNAME information.

platform/chromium/vapi-background.js

@@ -1164,16 +1164,17 @@ vAPI.Net = class {
         browser.webRequest.onBeforeRequest.addListener(
             details => {
                 this.normalizeDetails(details);
-                if ( this.suspendDepth === 0 || details.tabId < 0 ) {
-                    if ( this.suspendableListener === undefined ) { return; }
-                    return this.suspendableListener(details);
+                if ( this.suspendDepth !== 0 && details.tabId >= 0 ) {
+                    return this.suspendOneRequest(details);
                 }
-                return this.suspendOneRequest(details);
+                return this.onBeforeSuspendableRequest(details);
             },
             this.denormalizeFilters({ urls: [ 'http://*/*', 'https://*/*' ] }),
             [ 'blocking' ]
         );
     }
+    setOptions(/* options */) {
+    }
     normalizeDetails(/* details */) {
     }
     denormalizeFilters(filters) {
@@ -1208,6 +1209,10 @@ vAPI.Net = class {
             options
         );
     }
+    onBeforeSuspendableRequest(details) {
+        if ( this.suspendableListener === undefined ) { return; }
+        return this.suspendableListener(details);
+    }
     setSuspendableListener(listener) {
         this.suspendableListener = listener;
     }
@@ -1242,7 +1247,7 @@ vAPI.Net = class {
             this.suspendDepth -= 1;
         }
         if ( this.suspendDepth !== 0 ) { return; }
-        this.unsuspendAllRequests(this.suspendableListener);
+        this.unsuspendAllRequests();
     }
     canSuspend() {
         return false;

platform/chromium/vapi-common.js

@@ -116,6 +116,51 @@ vAPI.webextFlavor = {
 
 /******************************************************************************/
 
+{
+    const punycode = self.punycode;
+    const reCommonHostnameFromURL  = /^https?:\/\/([0-9a-z_][0-9a-z._-]*[0-9a-z])\//;
+    const reAuthorityFromURI       = /^(?:[^:\/?#]+:)?(\/\/[^\/?#]+)/;
+    const reHostFromNakedAuthority = /^[0-9a-z._-]+[0-9a-z]$/i;
+    const reHostFromAuthority      = /^(?:[^@]*@)?([^:]+)(?::\d*)?$/;
+    const reIPv6FromAuthority      = /^(?:[^@]*@)?(\[[0-9a-f:]+\])(?::\d*)?$/i;
+    const reMustNormalizeHostname  = /[^0-9a-z._-]/;
+
+    vAPI.hostnameFromURI = function(uri) {
+        let matches = reCommonHostnameFromURL.exec(uri);
+        if ( matches !== null ) { return matches[1]; }
+        matches = reAuthorityFromURI.exec(uri);
+        if ( matches === null ) { return ''; }
+        const authority = matches[1].slice(2);
+        if ( reHostFromNakedAuthority.test(authority) ) {
+            return authority.toLowerCase();
+        }
+        matches = reHostFromAuthority.exec(authority);
+        if ( matches === null ) {
+            matches = reIPv6FromAuthority.exec(authority);
+            if ( matches === null ) { return ''; }
+        }
+        let hostname = matches[1];
+        while ( hostname.endsWith('.') ) {
+            hostname = hostname.slice(0, -1);
+        }
+        if ( reMustNormalizeHostname.test(hostname) ) {
+            hostname = punycode.toASCII(hostname.toLowerCase());
+        }
+        return hostname;
+    };
+
+    const psl = self.publicSuffixList;
+    const reIPAddressNaive = /^\d+\.\d+\.\d+\.\d+$|^\[[\da-zA-Z:]+\]$/;
+
+    vAPI.domainFromHostname = function(hostname) {
+        return reIPAddressNaive.test(hostname)
+            ? hostname
+            : psl.getDomain(hostname);
+    };
+}
+
+/******************************************************************************/
+
 vAPI.download = function(details) {
     if ( !details.url ) { return; }
     const a = document.createElement('a');

platform/firefox/manifest.json

@@ -75,6 +75,7 @@
     "open_in_tab": true
   },
   "permissions": [
+    "dns",
     "menus",
     "privacy",
     "storage",

platform/firefox/vapi-webrequest.js

@@ -60,6 +60,20 @@
         constructor() {
             super();
             this.pendingRequests = [];
+            this.cnames = new Map();
+            this.cnameAliasList = null;
+            this.cnameIgnoreList = null;
+            this.url = new URL(vAPI.getURL('/'));
+            this.cnameMaxTTL = 60;
+            this.cnameTimer = undefined;
+        }
+        setOptions(options) {
+            super.setOptions(options);
+            this.cnameAliasList = this.regexFromStrList(options.cnameAliasList);
+            this.cnameIgnoreList = this.regexFromStrList(options.cnameIgnoreList);
+            this.cnameIgnore1stParty = options.cnameIgnore1stParty === true;
+            this.cnameMaxTTL = options.cnameMaxTTL || 120;
+            this.cnames.clear();
         }
         normalizeDetails(details) {
             if ( mustPunycode && !reAsciiHostname.test(details.url) ) {
@@ -109,6 +123,87 @@
             }
             return Array.from(out);
         }
+        processCanonicalName(cname, details) {
+            this.url.href = details.url;
+            details.cnameOf = this.url.hostname;
+            this.url.hostname = cname;
+            details.url = this.url.href;
+            return super.onBeforeSuspendableRequest(details);
+        }
+        recordCanonicalName(hn, record) {
+            let cname =
+                typeof record.canonicalName === 'string' &&
+                record.canonicalName !== hn
+                    ? record.canonicalName
+                    : '';
+            if (
+                cname !== '' &&
+                this.cnameIgnore1stParty &&
+                vAPI.domainFromHostname(cname) === vAPI.domainFromHostname(hn)
+            ) {
+                cname = '';
+            }
+            if (
+                cname !== '' &&
+                this.cnameIgnoreList !== null &&
+                this.cnameIgnoreList.test(cname)
+            ) {
+
+                cname = '';
+            }
+            this.cnames.set(hn, cname);
+            if ( this.cnameTimer === undefined ) {
+                this.cnameTimer = self.setTimeout(
+                    ( ) => {
+                        this.cnameTimer = undefined;
+                        this.cnames.clear();
+                    },
+                    this.cnameMaxTTL * 60000
+                );
+            }
+            return cname;
+        }
+        regexFromStrList(list) {
+            if (
+                typeof list !== 'string' ||
+                list.length === 0 ||
+                list === 'unset'
+            ) {
+                return null;
+            }
+            if ( list === '*' ) {
+                return /^./;
+            }
+            return new RegExp(
+                '(?:^|\.)(?:' +
+                list.trim()
+                    .split(/\s+/)
+                    .map(a => a.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+                    .join('|') +
+                ')$'
+            );
+        }
+        onBeforeSuspendableRequest(details) {
+            let r = super.onBeforeSuspendableRequest(details);
+            if ( r !== undefined ) { return r; }
+            if ( this.cnameAliasList === null ) { return; }
+            const hn = vAPI.hostnameFromURI(details.url);
+            let cname = this.cnames.get(hn);
+            if ( cname === '' ) { return; }
+            if ( cname !== undefined ) {
+                return this.processCanonicalName(cname, details);
+            }
+            if ( this.cnameAliasList.test(hn) === false ) {
+                this.cnames.set(hn, '');
+                return;
+            }
+            return browser.dns.resolve(hn, [ 'canonical_name' ]).then(rec => {
+                const cname = this.recordCanonicalName(hn, rec);
+                if ( cname === '' ) { return; }
+                return this.processCanonicalName(cname, details);
+
+            });
+        }
         suspendOneRequest(details) {
             const pending = {
                 details: Object.assign({}, details),
@@ -121,11 +216,11 @@
             this.pendingRequests.push(pending);
             return pending.promise;
         }
-        unsuspendAllRequests(resolver) {
+        unsuspendAllRequests() {
             const pendingRequests = this.pendingRequests;
             this.pendingRequests = [];
             for ( const entry of pendingRequests ) {
-                entry.resolve(resolver(entry.details));
+                entry.resolve(this.onBeforeSuspendableRequest(entry.details));
             }
         }
         canSuspend() {

src/css/logger-ui.css

@@ -268,6 +268,9 @@ body.colorBlind #vwRenderer .logEntry > div.cosmeticRealm,
 body.colorBlind #vwRenderer .logEntry > div.redirect {
     background-color: rgba(0, 19, 110, 0.1);
     }
+#vwRenderer .logEntry > div[data-cnameof] {
+    color: mediumblue;
+    }
 #vwRenderer .logEntry > div[data-type="tabLoad"] {
     background-color: #666;
     color: white;

src/js/background.js

@@ -46,6 +46,10 @@ const µBlock = (( ) => { // jshint ignore:line
         cacheStorageAPI: 'unset',
         cacheStorageCompression: true,
         cacheControlForFirefox1376932: 'no-cache, no-store, must-revalidate',
+        cnameAliasList: 'unset',
+        cnameIgnoreList: 'unset',
+        cnameIgnore1stParty: true,
+        cnameMaxTTL: 120,
         consoleLogLevel: 'unset',
         debugScriptlets: false,
         debugScriptletInjector: false,

src/js/filtering-context.js

@@ -30,6 +30,7 @@
     this.tstamp = 0;
     this.realm = '';
     this.type = undefined;
+    this.cnameOf = undefined;
     this.url = undefined;
     this.hostname = undefined;
     this.domain = undefined;
@@ -65,6 +66,7 @@
         this.realm = '';
         this.type = details.type;
         this.setURL(details.url);
+        this.cnameOf = details.cnameOf !== undefined ? details.cnameOf : '';
         this.docId = details.type !== 'sub_frame'
             ? details.frameId
             : details.parentFrameId;