tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

GMPDiskStorage.cpp (15075B)

      1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
      2 /* This Source Code Form is subject to the terms of the Mozilla Public
      3 * License, v. 2.0. If a copy of the MPL was not distributed with this
      4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      5 
      6 #include "GMPLog.h"
      7 #include "GMPParent.h"
      8 #include "gmp-storage.h"
      9 #include "mozilla/EndianUtils.h"
     10 #include "nsAppDirectoryServiceDefs.h"
     11 #include "nsClassHashtable.h"
     12 #include "nsDirectoryServiceDefs.h"
     13 #include "nsDirectoryServiceUtils.h"
     14 #include "nsServiceManagerUtils.h"
     15 #include "plhash.h"
     16 #include "prio.h"
     17 
     18 namespace mozilla::gmp {
     19 
     20 #define LOG(msg, ...)                   \
     21  MOZ_LOG(GetGMPLog(), LogLevel::Debug, \
     22          ("GMPDiskStorage=%p, " msg, this, ##__VA_ARGS__))
     23 
     24 // We store the records for a given GMP as files in the profile dir.
     25 // $profileDir/gmp/$platform/$gmpName/storage/$nodeId/
     26 static nsresult GetGMPStorageDir(nsIFile** aTempDir, const nsAString& aGMPName,
     27                                 const nsACString& aNodeId) {
     28  if (NS_WARN_IF(!aTempDir)) {
     29    return NS_ERROR_INVALID_ARG;
     30  }
     31 
     32  nsCOMPtr<mozIGeckoMediaPluginChromeService> mps =
     33      do_GetService("@mozilla.org/gecko-media-plugin-service;1");
     34  if (NS_WARN_IF(!mps)) {
     35    return NS_ERROR_FAILURE;
     36  }
     37 
     38  nsCOMPtr<nsIFile> tmpFile;
     39  nsresult rv = mps->GetStorageDir(getter_AddRefs(tmpFile));
     40  if (NS_WARN_IF(NS_FAILED(rv))) {
     41    return rv;
     42  }
     43 
     44  rv = tmpFile->Append(aGMPName);
     45  if (NS_WARN_IF(NS_FAILED(rv))) {
     46    return rv;
     47  }
     48 
     49  rv = tmpFile->AppendNative("storage"_ns);
     50  if (NS_WARN_IF(NS_FAILED(rv))) {
     51    return rv;
     52  }
     53 
     54  rv = tmpFile->AppendNative(aNodeId);
     55  if (NS_WARN_IF(NS_FAILED(rv))) {
     56    return rv;
     57  }
     58 
     59  rv = tmpFile->Create(nsIFile::DIRECTORY_TYPE, 0700);
     60  if (rv != NS_ERROR_FILE_ALREADY_EXISTS && NS_WARN_IF(NS_FAILED(rv))) {
     61    return rv;
     62  }
     63 
     64  tmpFile.forget(aTempDir);
     65 
     66  return NS_OK;
     67 }
     68 
     69 // Disk-backed GMP storage. Records are stored in files on disk in
     70 // the profile directory. The record name is a hash of the filename,
     71 // and we resolve hash collisions by just adding 1 to the hash code.
     72 // The format of records on disk is:
     73 //   4 byte, uint32_t $recordNameLength, in little-endian byte order,
     74 //   record name (i.e. $recordNameLength bytes, no null terminator)
     75 //   record bytes (entire remainder of file)
     76 class GMPDiskStorage : public GMPStorage {
     77 public:
     78  explicit GMPDiskStorage(const nsACString& aNodeId, const nsAString& aGMPName)
     79      : mNodeId(aNodeId), mGMPName(aGMPName) {
     80    LOG("Created GMPDiskStorage, nodeId=%s, gmpName=%s", mNodeId.BeginReading(),
     81        NS_ConvertUTF16toUTF8(mGMPName).get());
     82  }
     83 
     84  ~GMPDiskStorage() {
     85    // Close all open file handles.
     86    for (const auto& record : mRecords.Values()) {
     87      if (record->mFileDesc) {
     88        PR_Close(record->mFileDesc);
     89        record->mFileDesc = nullptr;
     90      }
     91    }
     92    LOG("Destroyed GMPDiskStorage");
     93  }
     94 
     95  nsresult Init() {
     96    // Build our index of records on disk.
     97    nsCOMPtr<nsIFile> storageDir;
     98    nsresult rv =
     99        GetGMPStorageDir(getter_AddRefs(storageDir), mGMPName, mNodeId);
    100    if (NS_WARN_IF(NS_FAILED(rv))) {
    101      return NS_ERROR_FAILURE;
    102    }
    103 
    104    DirectoryEnumerator iter(storageDir, DirectoryEnumerator::FilesAndDirs);
    105    for (nsCOMPtr<nsIFile> dirEntry; (dirEntry = iter.Next()) != nullptr;) {
    106      PRFileDesc* fd = nullptr;
    107      if (NS_WARN_IF(
    108              NS_FAILED(dirEntry->OpenNSPRFileDesc(PR_RDONLY, 0, &fd)))) {
    109        continue;
    110      }
    111      int32_t recordLength = 0;
    112      nsCString recordName;
    113      nsresult err = ReadRecordMetadata(fd, recordLength, recordName);
    114      PR_Close(fd);
    115      if (NS_WARN_IF(NS_FAILED(err))) {
    116        // File is not a valid storage file. Don't index it. Delete the file,
    117        // to make our indexing faster in future.
    118        dirEntry->Remove(false);
    119        continue;
    120      }
    121 
    122      nsAutoString filename;
    123      rv = dirEntry->GetLeafName(filename);
    124      if (NS_WARN_IF(NS_FAILED(rv))) {
    125        continue;
    126      }
    127 
    128      mRecords.InsertOrUpdate(recordName,
    129                              MakeUnique<Record>(filename, recordName));
    130    }
    131 
    132    return NS_OK;
    133  }
    134 
    135  GMPErr Open(const nsACString& aRecordName) override {
    136    MOZ_ASSERT(!IsOpen(aRecordName));
    137 
    138    Record* const record =
    139        mRecords.WithEntryHandle(aRecordName, [&](auto&& entry) -> Record* {
    140          if (!entry) {
    141            // New file.
    142            nsAutoString filename;
    143            nsresult rv = GetUnusedFilename(aRecordName, filename);
    144            if (NS_WARN_IF(NS_FAILED(rv))) {
    145              return nullptr;
    146            }
    147            return entry.Insert(MakeUnique<Record>(filename, aRecordName))
    148                .get();
    149          }
    150 
    151          return entry->get();
    152        });
    153    if (!record) {
    154      return GMPGenericErr;
    155    }
    156 
    157    MOZ_ASSERT(record);
    158    if (record->mFileDesc) {
    159      NS_WARNING("Tried to open already open record");
    160      return GMPRecordInUse;
    161    }
    162 
    163    nsresult rv =
    164        OpenStorageFile(record->mFilename, ReadWrite, &record->mFileDesc);
    165    if (NS_WARN_IF(NS_FAILED(rv))) {
    166      return GMPGenericErr;
    167    }
    168 
    169    MOZ_ASSERT(IsOpen(aRecordName));
    170 
    171    return GMPNoErr;
    172  }
    173 
    174  bool IsOpen(const nsACString& aRecordName) const override {
    175    // We are open if we have a record indexed, and it has a valid
    176    // file descriptor.
    177    const Record* record = mRecords.Get(aRecordName);
    178    return record && !!record->mFileDesc;
    179  }
    180 
    181  GMPErr Read(const nsACString& aRecordName,
    182              nsTArray<uint8_t>& aOutBytes) override {
    183    if (!IsOpen(aRecordName)) {
    184      return GMPClosedErr;
    185    }
    186 
    187    Record* record = nullptr;
    188    mRecords.Get(aRecordName, &record);
    189    MOZ_ASSERT(record && !!record->mFileDesc);  // IsOpen() guarantees this.
    190 
    191    // Our error strategy is to report records with invalid contents as
    192    // containing 0 bytes. Zero length records are considered "deleted" by
    193    // the GMPStorage API.
    194    aOutBytes.SetLength(0);
    195 
    196    int32_t recordLength = 0;
    197    nsCString recordName;
    198    nsresult err =
    199        ReadRecordMetadata(record->mFileDesc, recordLength, recordName);
    200    if (NS_WARN_IF(NS_FAILED(err) || recordLength == 0)) {
    201      // We failed to read the record metadata. Or the record is 0 length.
    202      // Treat damaged records as empty.
    203      // ReadRecordMetadata() could fail if the GMP opened a new record and
    204      // tried to read it before anything was written to it..
    205      return GMPNoErr;
    206    }
    207 
    208    if (!aRecordName.Equals(recordName)) {
    209      NS_WARNING("Record file contains some other record's contents!");
    210      return GMPRecordCorrupted;
    211    }
    212 
    213    // After calling ReadRecordMetadata, we should be ready to read the
    214    // record data.
    215    if (PR_Available(record->mFileDesc) != recordLength) {
    216      NS_WARNING("Record file length mismatch!");
    217      return GMPRecordCorrupted;
    218    }
    219 
    220    aOutBytes.SetLength(recordLength);
    221    int32_t bytesRead =
    222        PR_Read(record->mFileDesc, aOutBytes.Elements(), recordLength);
    223    return (bytesRead == recordLength) ? GMPNoErr : GMPRecordCorrupted;
    224  }
    225 
    226  GMPErr Write(const nsACString& aRecordName,
    227               const nsTArray<uint8_t>& aBytes) override {
    228    if (!IsOpen(aRecordName)) {
    229      return GMPClosedErr;
    230    }
    231 
    232    Record* record = nullptr;
    233    mRecords.Get(aRecordName, &record);
    234    MOZ_ASSERT(record && !!record->mFileDesc);  // IsOpen() guarantees this.
    235 
    236    // Write operations overwrite the entire record. So close it now.
    237    PR_Close(record->mFileDesc);
    238    record->mFileDesc = nullptr;
    239 
    240    // Writing 0 bytes means removing (deleting) the file.
    241    if (aBytes.Length() == 0) {
    242      nsresult rv = RemoveStorageFile(record->mFilename);
    243      if (NS_WARN_IF(NS_FAILED(rv))) {
    244        // Could not delete file -> Continue with trying to erase the contents.
    245      } else {
    246        return GMPNoErr;
    247      }
    248    }
    249 
    250    // Write operations overwrite the entire record. So re-open the file
    251    // in truncate mode, to clear its contents.
    252    if (NS_WARN_IF(NS_FAILED(OpenStorageFile(record->mFilename, Truncate,
    253                                             &record->mFileDesc)))) {
    254      return GMPGenericErr;
    255    }
    256 
    257    // Store the length of the record name followed by the record name
    258    // at the start of the file.
    259    int32_t bytesWritten = 0;
    260    char buf[sizeof(uint32_t)] = {0};
    261    LittleEndian::writeUint32(buf, aRecordName.Length());
    262    bytesWritten = PR_Write(record->mFileDesc, buf, std::size(buf));
    263    if (bytesWritten != std::size(buf)) {
    264      NS_WARNING("Failed to write GMPStorage record name length.");
    265      return GMPRecordCorrupted;
    266    }
    267    bytesWritten = PR_Write(record->mFileDesc, aRecordName.BeginReading(),
    268                            aRecordName.Length());
    269    if (bytesWritten != (int32_t)aRecordName.Length()) {
    270      NS_WARNING("Failed to write GMPStorage record name.");
    271      return GMPRecordCorrupted;
    272    }
    273 
    274    bytesWritten =
    275        PR_Write(record->mFileDesc, aBytes.Elements(), aBytes.Length());
    276    if (bytesWritten != (int32_t)aBytes.Length()) {
    277      NS_WARNING("Failed to write GMPStorage record data.");
    278      return GMPRecordCorrupted;
    279    }
    280 
    281    // Try to sync the file to disk, so that in the event of a crash,
    282    // the record is less likely to be corrupted.
    283    PR_Sync(record->mFileDesc);
    284 
    285    return GMPNoErr;
    286  }
    287 
    288  void Close(const nsACString& aRecordName) override {
    289    Record* record = nullptr;
    290    mRecords.Get(aRecordName, &record);
    291    if (record && !!record->mFileDesc) {
    292      PR_Close(record->mFileDesc);
    293      record->mFileDesc = nullptr;
    294    }
    295    MOZ_ASSERT(!IsOpen(aRecordName));
    296  }
    297 
    298 private:
    299  // We store records in a file which is a hash of the record name.
    300  // If there is a hash collision, we just keep adding 1 to the hash
    301  // code, until we find a free slot.
    302  nsresult GetUnusedFilename(const nsACString& aRecordName,
    303                             nsString& aOutFilename) {
    304    nsCOMPtr<nsIFile> storageDir;
    305    nsresult rv =
    306        GetGMPStorageDir(getter_AddRefs(storageDir), mGMPName, mNodeId);
    307    if (NS_WARN_IF(NS_FAILED(rv))) {
    308      return rv;
    309    }
    310 
    311    uint64_t recordNameHash = HashString(PromiseFlatCString(aRecordName).get());
    312    for (int i = 0; i < 1000000; i++) {
    313      nsCOMPtr<nsIFile> f;
    314      rv = storageDir->Clone(getter_AddRefs(f));
    315      if (NS_WARN_IF(NS_FAILED(rv))) {
    316        return rv;
    317      }
    318      nsAutoString hashStr;
    319      hashStr.AppendInt(recordNameHash);
    320      rv = f->Append(hashStr);
    321      if (NS_WARN_IF(NS_FAILED(rv))) {
    322        return rv;
    323      }
    324      bool exists = false;
    325      f->Exists(&exists);
    326      if (!exists) {
    327        // Filename not in use, we can write into this file.
    328        aOutFilename = hashStr;
    329        return NS_OK;
    330      } else {
    331        // Hash collision; just increment the hash name and try that again.
    332        ++recordNameHash;
    333        continue;
    334      }
    335    }
    336    // Somehow, we've managed to completely fail to find a vacant file name.
    337    // Give up.
    338    NS_WARNING("GetUnusedFilename had extreme hash collision!");
    339    return NS_ERROR_FAILURE;
    340  }
    341 
    342  enum OpenFileMode { ReadWrite, Truncate };
    343 
    344  nsresult OpenStorageFile(const nsAString& aFileLeafName,
    345                           const OpenFileMode aMode, PRFileDesc** aOutFD) {
    346    MOZ_ASSERT(aOutFD);
    347 
    348    nsCOMPtr<nsIFile> f;
    349    nsresult rv = GetGMPStorageDir(getter_AddRefs(f), mGMPName, mNodeId);
    350    if (NS_WARN_IF(NS_FAILED(rv))) {
    351      return rv;
    352    }
    353    f->Append(aFileLeafName);
    354 
    355    auto mode = PR_RDWR | PR_CREATE_FILE;
    356    if (aMode == Truncate) {
    357      mode |= PR_TRUNCATE;
    358    }
    359 
    360    return f->OpenNSPRFileDesc(mode, PR_IRWXU, aOutFD);
    361  }
    362 
    363  nsresult ReadRecordMetadata(PRFileDesc* aFd, int32_t& aOutRecordLength,
    364                              nsACString& aOutRecordName) {
    365    int32_t offset = PR_Seek(aFd, 0, PR_SEEK_END);
    366    PR_Seek(aFd, 0, PR_SEEK_SET);
    367 
    368    if (offset < 0 || offset > GMP_MAX_RECORD_SIZE) {
    369      // Refuse to read big records, or records where we can't get a length.
    370      return NS_ERROR_FAILURE;
    371    }
    372    const uint32_t fileLength = static_cast<uint32_t>(offset);
    373 
    374    // At the start of the file the length of the record name is stored in a
    375    // uint32_t (little endian byte order) followed by the record name at the
    376    // start of the file. The record name is not null terminated. The remainder
    377    // of the file is the record's data.
    378 
    379    if (fileLength < sizeof(uint32_t)) {
    380      // Record file doesn't have enough contents to store the record name
    381      // length. Fail.
    382      return NS_ERROR_FAILURE;
    383    }
    384 
    385    // Read length, and convert to host byte order.
    386    uint32_t recordNameLength = 0;
    387    char buf[sizeof(recordNameLength)] = {0};
    388    int32_t bytesRead = PR_Read(aFd, &buf, sizeof(recordNameLength));
    389    recordNameLength = LittleEndian::readUint32(buf);
    390    if (sizeof(recordNameLength) != bytesRead || recordNameLength == 0 ||
    391        recordNameLength + sizeof(recordNameLength) > fileLength ||
    392        recordNameLength > GMP_MAX_RECORD_NAME_SIZE) {
    393      // Record file has invalid contents. Fail.
    394      return NS_ERROR_FAILURE;
    395    }
    396 
    397    nsCString recordName;
    398    recordName.SetLength(recordNameLength);
    399    bytesRead = PR_Read(aFd, recordName.BeginWriting(), recordNameLength);
    400    if ((uint32_t)bytesRead != recordNameLength) {
    401      // Read failed.
    402      return NS_ERROR_FAILURE;
    403    }
    404 
    405    MOZ_ASSERT(fileLength >= sizeof(recordNameLength) + recordNameLength);
    406    int32_t recordLength =
    407        fileLength - (sizeof(recordNameLength) + recordNameLength);
    408 
    409    aOutRecordLength = recordLength;
    410    aOutRecordName = recordName;
    411 
    412    // Read cursor should be positioned after the record name, before the record
    413    // contents.
    414    if (PR_Seek(aFd, 0, PR_SEEK_CUR) !=
    415        (int32_t)(sizeof(recordNameLength) + recordNameLength)) {
    416      NS_WARNING("Read cursor mismatch after ReadRecordMetadata()");
    417      return NS_ERROR_FAILURE;
    418    }
    419 
    420    return NS_OK;
    421  }
    422 
    423  nsresult RemoveStorageFile(const nsAString& aFilename) {
    424    nsCOMPtr<nsIFile> f;
    425    nsresult rv = GetGMPStorageDir(getter_AddRefs(f), mGMPName, mNodeId);
    426    if (NS_WARN_IF(NS_FAILED(rv))) {
    427      return rv;
    428    }
    429    rv = f->Append(aFilename);
    430    if (NS_WARN_IF(NS_FAILED(rv))) {
    431      return rv;
    432    }
    433    return f->Remove(/* bool recursive= */ false);
    434  }
    435 
    436  struct Record {
    437    Record(const nsAString& aFilename, const nsACString& aRecordName)
    438        : mFilename(aFilename), mRecordName(aRecordName), mFileDesc(0) {}
    439    ~Record() { MOZ_ASSERT(!mFileDesc); }
    440    nsString mFilename;
    441    nsCString mRecordName;
    442    PRFileDesc* mFileDesc;
    443  };
    444 
    445  // Hash record name to record data.
    446  nsClassHashtable<nsCStringHashKey, Record> mRecords;
    447  const nsCString mNodeId;
    448  const nsString mGMPName;
    449 };
    450 
    451 already_AddRefed<GMPStorage> CreateGMPDiskStorage(const nsACString& aNodeId,
    452                                                  const nsAString& aGMPName) {
    453  RefPtr<GMPDiskStorage> storage(new GMPDiskStorage(aNodeId, aGMPName));
    454  if (NS_FAILED(storage->Init())) {
    455    NS_WARNING("Failed to initialize on disk GMP storage");
    456    return nullptr;
    457  }
    458  return storage.forget();
    459 }
    460 
    461 #undef LOG
    462 
    463 }  // namespace mozilla::gmp