forked from mirrors/gecko-dev
8f762fbd63
Converts privacy.fuzzyfox.clockgrainus varcache pref to a static pref. This pref used two #define values, which I also removed. Differential Revision: https://phabricator.services.mozilla.com/D41102 --HG-- extra : moz-landing-system : lando
123 lines
3.9 KiB
C++
123 lines
3.9 KiB
C++
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
||
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
|
||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||
|
||
#ifndef mozilla_Fuzzyfox_h
|
||
#define mozilla_Fuzzyfox_h
|
||
|
||
#include "nsIObserver.h"
|
||
#include "nsIObserverService.h"
|
||
#include "nsISupportsPrimitives.h"
|
||
#include "nsThreadUtils.h"
|
||
#include "mozilla/TimeStamp.h"
|
||
|
||
/*
|
||
* This topic publishes the new canonical time according to Fuzzyfox,
|
||
* in microseconds since the epoch. If code needs to know the current time,
|
||
* it should listen for this topic and keep track of the 'current' time,
|
||
* so as to respect Fuzzyfox and be in sync with the rest of the browser's
|
||
* timekeeping.
|
||
*/
|
||
#define FUZZYFOX_UPDATECLOCK_OBSERVER_TOPIC "fuzzyfox-update-clocks"
|
||
|
||
/*
|
||
* For Fuzzyfox's security guarentees to hold, the browser must not execute
|
||
* actions while it should be paused. We currently only pause the main thread,
|
||
* so actions that occur on other threads should be queued until the browser
|
||
* unpaused (and moreso than unpauses: until it reaches a downtick.)
|
||
* This topic indicates when any queued outbound events should be delivered.
|
||
* TODO: Bug 1484300 and 1484299 would apply this to other communication
|
||
* channels
|
||
*/
|
||
#define FUZZYFOX_FIREOUTBOUND_OBSERVER_TOPIC "fuzzyfox-fire-outbound"
|
||
|
||
namespace mozilla {
|
||
|
||
/*
|
||
* Fuzzyfox is an implementation of the Fermata concept presented in
|
||
* Trusted Browsers for Uncertain Times.
|
||
*
|
||
* Web Browsers expose explicit (performance.now()) and implicit
|
||
* (WebVTT, Video Frames) timers that, when combined with algorithmic
|
||
* improvements such as edge thresholding, produce extremely high
|
||
* resolution clocks.
|
||
*
|
||
* High Resolution clocks can be used to time network accesses, browser
|
||
* cache reads, web page rendering, access to the CPU cache, and other
|
||
* operations - and the time these operations take to perform can yield
|
||
* detailed information about user information we want to keep private.
|
||
*
|
||
* Fuzzyfox limits the information disclosure by limiting an attacker's
|
||
* ability to create a high resolution clock. It does this by introducing
|
||
* a concept called 'fuzzy time' that degrades all clocks (explicit and
|
||
* implicit). This is done through a combination of holding time constant
|
||
* during program execution and pausing program execution.
|
||
*
|
||
* @InProceedings{KS16,
|
||
* author = {David Kohlbrenner and Hovav Shacham},
|
||
* title = {Trusted Browsers for Uncertain Times},
|
||
* booktitle = {Proceedings of USENIX Security 2016},
|
||
* pages = {463-80},
|
||
* year = 2016,
|
||
* editor = {Thorsten Holz and Stefan Savage},
|
||
* month = aug,
|
||
* organization = {USENIX}
|
||
* }
|
||
* https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_kohlbrenner.pdf
|
||
*
|
||
* Fuzzyfox is an adaptation of
|
||
* W.-M. Hu, “Reducing timing channels with fuzzy time,” in
|
||
* Proceedings of IEEE Security and Privacy (“Oakland”)
|
||
* 1991, T. F. Lunt and J. McLean, Eds. IEEE Computer
|
||
* Society, May 1991, pp. 8–20.
|
||
*/
|
||
class Fuzzyfox final : public Runnable, public nsIObserver {
|
||
public:
|
||
NS_DECL_ISUPPORTS_INHERITED
|
||
NS_DECL_NSIOBSERVER
|
||
|
||
static void Start();
|
||
|
||
NS_IMETHOD
|
||
Run() override;
|
||
|
||
private:
|
||
Fuzzyfox();
|
||
~Fuzzyfox();
|
||
|
||
uint64_t ActualTime();
|
||
|
||
uint64_t PickDuration();
|
||
|
||
void UpdateClocks(uint64_t aNewTime, TimeStamp aNewTimeStamp);
|
||
|
||
uint64_t FloorToGrain(uint64_t aValue);
|
||
|
||
TimeStamp FloorToGrain(TimeStamp aValue);
|
||
|
||
uint64_t CeilToGrain(uint64_t aValue);
|
||
|
||
TimeStamp CeilToGrain(TimeStamp aValue);
|
||
|
||
bool mSanityCheck;
|
||
uint64_t mStartTime;
|
||
uint32_t mDuration;
|
||
|
||
enum Tick {
|
||
eUptick,
|
||
eDowntick,
|
||
};
|
||
|
||
Tick mTickType;
|
||
|
||
nsCOMPtr<nsIObserverService> mObs = nullptr;
|
||
nsCOMPtr<nsISupportsPRInt64> mTimeUpdateWrapper = nullptr;
|
||
|
||
static Atomic<bool, Relaxed> sFuzzyfoxEnabledPrefMapped;
|
||
};
|
||
|
||
} // namespace mozilla
|
||
|
||
#endif /* mozilla_Fuzzyfox_h */
|