Networking

netwerk/ ("Necko") is Gecko's networking stack: HTTP/1.1, HTTP/2, HTTP/3, WebSocket, WebTransport, DNS, cookies, the disk and memory cache, the URI parser, and protocol handlers for file:, data:, blob:, chrome:, etc.

Purpose

Provide a single abstraction (nsIChannel) for fetching anything from anywhere, with a uniform pipeline for redirects, content sniffing, security checks, caching, and progress notifications.

Directory layout

netwerk/
├── base/         # Channel API (nsIChannel, nsIRequest), event sinks
├── protocol/
│   ├── http/     # HTTP/1.1 + HTTP/2; HTTP/3 plumbing
│   ├── websocket/# WebSocket protocol
│   ├── webtransport/# WebTransport
│   ├── res/      # resource:// URLs
│   ├── data/     # data: URLs
│   ├── file/     # file: URLs
│   └── ...
├── dns/          # DNS resolver, TRR (DNS-over-HTTPS)
├── cookie/       # Cookie storage and policies
├── cache2/       # Disk + memory cache
├── socket/
│   ├── neqo_glue/   # Rust QUIC/HTTP3 (Neqo) glue
│   └── ...
├── mime/         # Content-type sniffing
├── streamconv/   # Stream converters (gzip, brotli, ...)
├── ipc/          # PNeckoChild / PNeckoParent: per-process necko proxy
├── url-classifier/ # Safe Browsing-style URL filtering
├── system/       # Per-platform integration
└── test/

Key abstractions

Type	File	Role
nsIChannel	netwerk/base/nsIChannel.idl	A single network request
nsHttpHandler	netwerk/protocol/http/nsHttpHandler.h	HTTP protocol entry; manages connection pool, prefs
nsHttpConnection / Http2Session / Http3Session	netwerk/protocol/http/	Connection-level state for each protocol version
nsHttpChannel	netwerk/protocol/http/nsHttpChannel.h	The HTTP channel
nsCacheStorageService	netwerk/cache2/	The HTTP cache
nsCookieService	netwerk/cookie/CookieService.cpp	Cookie store and policy
nsDNSService / TRRService	netwerk/dns/	DNS, including DNS-over-HTTPS
Neqo glue	netwerk/socket/neqo_glue/	Rust QUIC implementation (mozilla-neqo crate)

Process model

Networking can run in two modes:

• Parent process (legacy / fallback) — sockets, TLS, cache live in the parent.
• Socket process (modern default) — a dedicated child process owns the network stack. Content processes talk to it via PNecko IPDL.

graph LR
    Content[Content process] -->|PNecko IPDL| Socket[Socket process]
    Socket --> NSS[NSS / TLS]
    Socket --> Sockets[OS sockets]
    Socket --> Neqo[Neqo / HTTP/3]
    Socket --> Cache[Disk cache]
    Cache -->|files| Profile[Profile dir]

A typical HTTP fetch

sequenceDiagram
    participant Caller as nsHttpChannel (parent or socket)
    participant Handler as nsHttpHandler
    participant Pool as nsHttpConnectionMgr
    participant Conn as nsHttpConnection / Http3Session
    participant NSS as NSS (TLS)
    Caller->>Handler: AsyncOpen
    Handler->>Pool: GetSocketTransport
    Pool->>Conn: open or reuse
    Conn->>NSS: TLS handshake
    Conn-->>Caller: stream events (OnStartRequest, OnDataAvailable, OnStopRequest)

HTTP/3 / QUIC

Mozilla wrote its own pure-Rust QUIC implementation: Neqo. The crate lives outside this tree (in mozilla/neqo) and is vendored under third_party/rust/neqo-*. The Gecko-side glue lives in netwerk/socket/neqo_glue/ and is one of the workspace members in Cargo.toml.

Cookies

Cookies live in cookies.sqlite in the profile. Policy lives in netwerk/cookie/, including:

• Total Cookie Protection — partitions cookies per top-level origin to prevent cross-site tracking.
• First-party isolation behavior under privacy.firstparty.isolate.
• SameSite semantics.

Cache

Disk cache lives in cache2/entries/ (by hash). The cache obeys HTTP semantics (Cache-Control, Vary, etc.) and is shared between processes.

DNS

The DNS resolver supports system DNS plus TRR (Trusted Recursive Resolver) — DNS-over-HTTPS to an opt-in provider. Pref: network.trr.mode.

Related

• Process model
• Security
• Storage