tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

FuzzyLayer.cpp (13169B)

      1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
      2 /* vim:set ts=2 sw=2 sts=2 et cindent: */
      3 /* This Source Code Form is subject to the terms of the Mozilla Public
      4 * License, v. 2.0. If a copy of the MPL was not distributed with this
      5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      6 
      7 #include "FuzzyLayer.h"
      8 #include "nsTHashMap.h"
      9 #include "nsDeque.h"
     10 #include "nsIRunnable.h"
     11 #include "nsSocketTransportService2.h"
     12 #include "nsThreadUtils.h"
     13 
     14 #include "prmem.h"
     15 #include "prio.h"
     16 #include "mozilla/Logging.h"
     17 #include "mozilla/StaticMutex.h"
     18 
     19 namespace mozilla {
     20 namespace net {
     21 
     22 LazyLogModule gFuzzingLog("nsFuzzingNecko");
     23 
     24 #define FUZZING_LOG(args) \
     25  MOZ_LOG(mozilla::net::gFuzzingLog, mozilla::LogLevel::Verbose, args)
     26 
     27 // Mutex for modifying our hash tables
     28 StaticMutex gConnRecvMutex;
     29 
     30 // This structure will be created by addNetworkFuzzingBuffer below
     31 // and then added to the gNetworkFuzzingBuffers structure.
     32 //
     33 // It is assigned on connect and associated with the socket it belongs to.
     34 typedef struct {
     35  const uint8_t* buf;
     36  size_t size;
     37  bool allowRead;
     38  bool allowUnused;
     39  PRNetAddr* addr;
     40 } NetworkFuzzingBuffer;
     41 
     42 // This holds all connections we have currently open.
     43 MOZ_RUNINIT static nsTHashMap<nsPtrHashKey<PRFileDesc>, NetworkFuzzingBuffer*>
     44    gConnectedNetworkFuzzingBuffers;
     45 
     46 // This holds all buffers for connections we can still open.
     47 MOZ_RUNINIT static nsDeque<NetworkFuzzingBuffer> gNetworkFuzzingBuffers;
     48 
     49 // This is `true` once all connections are closed and either there are
     50 // no buffers left to be used or all remaining buffers are marked optional.
     51 // Used by `signalNetworkFuzzingDone` to tell the main thread if it needs
     52 // to spin-wait for `gFuzzingConnClosed`.
     53 static Atomic<bool> fuzzingNoWaitRequired(false);
     54 
     55 // Used to memorize if the main thread has indicated that it is done with
     56 // its iteration and we don't expect more connections now.
     57 static Atomic<bool> fuzzingMainSignaledDone(false);
     58 
     59 /*
     60 * The flag `gFuzzingConnClosed` is set by `FuzzyClose` when all connections
     61 * are closed *and* there are no more buffers in `gNetworkFuzzingBuffers` that
     62 * must be used. The main thread spins until this becomes true to synchronize
     63 * the fuzzing iteration between the main thread and the socket thread, if
     64 * the prior call to `signalNetworkFuzzingDone` returned `false`.
     65 */
     66 Atomic<bool> gFuzzingConnClosed(true);
     67 
     68 void addNetworkFuzzingBuffer(const uint8_t* data, size_t size, bool readFirst,
     69                             bool useIsOptional) {
     70  if (size > INT32_MAX) {
     71    MOZ_CRASH("Unsupported buffer size");
     72  }
     73 
     74  StaticMutexAutoLock lock(gConnRecvMutex);
     75 
     76  NetworkFuzzingBuffer* buf = new NetworkFuzzingBuffer();
     77  buf->buf = data;
     78  buf->size = size;
     79  buf->allowRead = readFirst;
     80  buf->allowUnused = useIsOptional;
     81  buf->addr = nullptr;
     82 
     83  gNetworkFuzzingBuffers.Push(buf);
     84 
     85  fuzzingMainSignaledDone = false;
     86  fuzzingNoWaitRequired = false;
     87 }
     88 
     89 /*
     90 * This method should be called by fuzzing from the main thread to signal to
     91 * the layer code that a fuzzing iteration is done. As a result, we can throw
     92 * away any optional buffers and signal back once all connections have been
     93 * closed. The main thread should synchronize on all connections being closed
     94 * after the actual request/action is complete.
     95 */
     96 bool signalNetworkFuzzingDone() {
     97  FUZZING_LOG(("[signalNetworkFuzzingDone] Called."));
     98  StaticMutexAutoLock lock(gConnRecvMutex);
     99  bool rv = false;
    100 
    101  if (fuzzingNoWaitRequired) {
    102    FUZZING_LOG(("[signalNetworkFuzzingDone] Purging remaining buffers."));
    103    // Easy case, we already have no connections and non-optional buffers left.
    104    gNetworkFuzzingBuffers.Erase();
    105    gFuzzingConnClosed = true;
    106    rv = true;
    107  } else {
    108    // We still have either connections left open or non-optional buffers left.
    109    // In this case, FuzzyClose will handle the tear-down and signaling.
    110    fuzzingMainSignaledDone = true;
    111  }
    112 
    113  return rv;
    114 }
    115 
    116 static PRDescIdentity sFuzzyLayerIdentity;
    117 static PRIOMethods sFuzzyLayerMethods;
    118 static PRIOMethods* sFuzzyLayerMethodsPtr = nullptr;
    119 
    120 static PRInt16 PR_CALLBACK FuzzyPoll(PRFileDesc* fd, PRInt16 in_flags,
    121                                     PRInt16* out_flags) {
    122  *out_flags = 0;
    123 
    124  FUZZING_LOG(("[FuzzyPoll] Called with in_flags=%X.", in_flags));
    125 
    126  NetworkFuzzingBuffer* fuzzBuf = gConnectedNetworkFuzzingBuffers.Get(fd);
    127 
    128  if (in_flags & PR_POLL_READ && fuzzBuf && fuzzBuf->allowRead) {
    129    *out_flags = PR_POLL_READ;
    130    return PR_POLL_READ;
    131  }
    132 
    133  if (in_flags & PR_POLL_WRITE) {
    134    *out_flags = PR_POLL_WRITE;
    135    return PR_POLL_WRITE;
    136  }
    137 
    138  return in_flags;
    139 }
    140 
    141 static PRStatus FuzzyConnect(PRFileDesc* fd, const PRNetAddr* addr,
    142                             PRIntervalTime timeout) {
    143  MOZ_RELEASE_ASSERT(fd->identity == sFuzzyLayerIdentity);
    144  MOZ_ASSERT(OnSocketThread(), "not on socket thread");
    145 
    146  StaticMutexAutoLock lock(gConnRecvMutex);
    147 
    148  NetworkFuzzingBuffer* buf = gNetworkFuzzingBuffers.PopFront();
    149  if (!buf) {
    150    FUZZING_LOG(("[FuzzyConnect] Denying additional connection."));
    151    return PR_FAILURE;
    152  }
    153 
    154  gConnectedNetworkFuzzingBuffers.InsertOrUpdate(fd, buf);
    155  fuzzingNoWaitRequired = false;
    156 
    157  FUZZING_LOG(("[FuzzyConnect] Successfully opened connection: %p", fd));
    158 
    159  gFuzzingConnClosed = false;
    160 
    161  return PR_SUCCESS;
    162 }
    163 
    164 static PRInt32 FuzzySendTo(PRFileDesc* fd, const void* buf, PRInt32 amount,
    165                           PRIntn flags, const PRNetAddr* addr,
    166                           PRIntervalTime timeout) {
    167  MOZ_RELEASE_ASSERT(fd->identity == sFuzzyLayerIdentity);
    168  MOZ_ASSERT(OnSocketThread(), "not on socket thread");
    169 
    170  StaticMutexAutoLock lock(gConnRecvMutex);
    171 
    172  NetworkFuzzingBuffer* fuzzBuf = gConnectedNetworkFuzzingBuffers.Get(fd);
    173  if (!fuzzBuf) {
    174    NetworkFuzzingBuffer* buf = gNetworkFuzzingBuffers.PopFront();
    175    if (!buf) {
    176      FUZZING_LOG(("[FuzzySentTo] Denying additional connection."));
    177      return 0;
    178    }
    179 
    180    gConnectedNetworkFuzzingBuffers.InsertOrUpdate(fd, buf);
    181 
    182    // Store connection address
    183    buf->addr = new PRNetAddr;
    184    memcpy(buf->addr, addr, sizeof(PRNetAddr));
    185 
    186    fuzzingNoWaitRequired = false;
    187 
    188    FUZZING_LOG(("[FuzzySendTo] Successfully opened connection: %p", fd));
    189 
    190    gFuzzingConnClosed = false;
    191  }
    192 
    193  // Allow reading once the implementation has written at least some data
    194  if (fuzzBuf && !fuzzBuf->allowRead) {
    195    FUZZING_LOG(("[FuzzySendTo] Write received, allowing further reads."));
    196    fuzzBuf->allowRead = true;
    197  }
    198 
    199  FUZZING_LOG(("[FuzzySendTo] Sent %" PRIx32 " bytes of data.", amount));
    200 
    201  return amount;
    202 }
    203 
    204 static PRInt32 FuzzySend(PRFileDesc* fd, const void* buf, PRInt32 amount,
    205                         PRIntn flags, PRIntervalTime timeout) {
    206  MOZ_RELEASE_ASSERT(fd->identity == sFuzzyLayerIdentity);
    207  MOZ_ASSERT(OnSocketThread(), "not on socket thread");
    208 
    209  StaticMutexAutoLock lock(gConnRecvMutex);
    210 
    211  NetworkFuzzingBuffer* fuzzBuf = gConnectedNetworkFuzzingBuffers.Get(fd);
    212  if (!fuzzBuf) {
    213    FUZZING_LOG(("[FuzzySend] Write on socket that is not connected."));
    214    amount = 0;
    215  }
    216 
    217  // Allow reading once the implementation has written at least some data
    218  if (fuzzBuf && !fuzzBuf->allowRead) {
    219    FUZZING_LOG(("[FuzzySend] Write received, allowing further reads."));
    220    fuzzBuf->allowRead = true;
    221  }
    222 
    223  FUZZING_LOG(("[FuzzySend] Sent %" PRIx32 " bytes of data.", amount));
    224 
    225  return amount;
    226 }
    227 
    228 static PRInt32 FuzzyWrite(PRFileDesc* fd, const void* buf, PRInt32 amount) {
    229  return FuzzySend(fd, buf, amount, 0, PR_INTERVAL_NO_WAIT);
    230 }
    231 
    232 static PRInt32 FuzzyRecv(PRFileDesc* fd, void* buf, PRInt32 amount,
    233                         PRIntn flags, PRIntervalTime timeout) {
    234  MOZ_RELEASE_ASSERT(fd->identity == sFuzzyLayerIdentity);
    235 
    236  StaticMutexAutoLock lock(gConnRecvMutex);
    237 
    238  NetworkFuzzingBuffer* fuzzBuf = gConnectedNetworkFuzzingBuffers.Get(fd);
    239  if (!fuzzBuf) {
    240    FUZZING_LOG(("[FuzzyRecv] Denying read, connection is closed."));
    241    return 0;
    242  }
    243 
    244  // As long as we haven't written anything, act as if no data was there yet
    245  if (!fuzzBuf->allowRead) {
    246    FUZZING_LOG(("[FuzzyRecv] Denying read, nothing written before."));
    247    PR_SetError(PR_WOULD_BLOCK_ERROR, 0);
    248    return -1;
    249  }
    250 
    251  if (gFuzzingConnClosed) {
    252    FUZZING_LOG(("[FuzzyRecv] Denying read, connection is closed."));
    253    return 0;
    254  }
    255 
    256  // No data left, act as if the connection was closed.
    257  if (!fuzzBuf->size) {
    258    FUZZING_LOG(("[FuzzyRecv] Read failed, no data left."));
    259    return 0;
    260  }
    261 
    262  // Use the remains of fuzzing buffer, if too little is left
    263  if (fuzzBuf->size < (PRUint32)amount) amount = fuzzBuf->size;
    264 
    265  // Consume buffer, copy data
    266  memcpy(buf, fuzzBuf->buf, amount);
    267 
    268  if (!(flags & PR_MSG_PEEK)) {
    269    fuzzBuf->buf += amount;
    270    fuzzBuf->size -= amount;
    271  }
    272 
    273  FUZZING_LOG(("[FuzzyRecv] Read %" PRIx32 " bytes of data.", amount));
    274 
    275  return amount;
    276 }
    277 
    278 static PRInt32 FuzzyRecvFrom(PRFileDesc* fd, void* buf, PRInt32 amount,
    279                             PRIntn flags, PRNetAddr* addr,
    280                             PRIntervalTime timeout) {
    281  // Return the same address used for initial SendTo on this fd
    282  if (addr) {
    283    NetworkFuzzingBuffer* fuzzBuf = gConnectedNetworkFuzzingBuffers.Get(fd);
    284    if (!fuzzBuf) {
    285      FUZZING_LOG(("[FuzzyRecvFrom] Denying read, connection is closed."));
    286      return 0;
    287    }
    288 
    289    if (fuzzBuf->addr) {
    290      memcpy(addr, fuzzBuf->addr, sizeof(PRNetAddr));
    291    } else {
    292      FUZZING_LOG(("[FuzzyRecvFrom] No address found for connection"));
    293    }
    294  }
    295  return FuzzyRecv(fd, buf, amount, flags, timeout);
    296 }
    297 
    298 static PRInt32 FuzzyRead(PRFileDesc* fd, void* buf, PRInt32 amount) {
    299  return FuzzyRecv(fd, buf, amount, 0, PR_INTERVAL_NO_WAIT);
    300 }
    301 
    302 static PRStatus FuzzyClose(PRFileDesc* fd) {
    303  if (!fd) {
    304    return PR_FAILURE;
    305  }
    306  PRFileDesc* layer = PR_PopIOLayer(fd, PR_TOP_IO_LAYER);
    307  MOZ_RELEASE_ASSERT(layer && layer->identity == sFuzzyLayerIdentity,
    308                     "Fuzzy Layer not on top of stack");
    309 
    310  layer->dtor(layer);
    311 
    312  StaticMutexAutoLock lock(gConnRecvMutex);
    313 
    314  NetworkFuzzingBuffer* fuzzBuf = nullptr;
    315  if (gConnectedNetworkFuzzingBuffers.Remove(fd, &fuzzBuf)) {
    316    FUZZING_LOG(("[FuzzyClose] Received close on socket %p", fd));
    317    if (fuzzBuf->addr) {
    318      delete fuzzBuf->addr;
    319    }
    320    delete fuzzBuf;
    321  } else {
    322    /* Happens when close is called on a non-connected socket */
    323    FUZZING_LOG(("[FuzzyClose] Received close on unknown socket %p.", fd));
    324  }
    325 
    326  PRStatus ret = fd->methods->close(fd);
    327 
    328  if (!gConnectedNetworkFuzzingBuffers.Count()) {
    329    // At this point, all connections are closed, but we might still have
    330    // unused network buffers that were not marked as optional.
    331    bool haveRemainingUnusedBuffers = false;
    332    for (size_t i = 0; i < gNetworkFuzzingBuffers.GetSize(); ++i) {
    333      NetworkFuzzingBuffer* buf = gNetworkFuzzingBuffers.ObjectAt(i);
    334 
    335      if (!buf->allowUnused) {
    336        haveRemainingUnusedBuffers = true;
    337        break;
    338      }
    339    }
    340 
    341    if (haveRemainingUnusedBuffers) {
    342      FUZZING_LOG(
    343          ("[FuzzyClose] All connections closed, waiting for remaining "
    344           "connections."));
    345    } else if (!fuzzingMainSignaledDone) {
    346      // We have no connections left, but the main thread hasn't signaled us
    347      // yet. For now, that means once the main thread signals us, we can tell
    348      // it immediately that it won't have to wait for closing connections.
    349      FUZZING_LOG(
    350          ("[FuzzyClose] All connections closed, waiting for main thread."));
    351      fuzzingNoWaitRequired = true;
    352    } else {
    353      // No connections left and main thread is already done. Perform cleanup
    354      // and then signal the main thread to continue.
    355      FUZZING_LOG(("[FuzzyClose] All connections closed, cleaning up."));
    356 
    357      gNetworkFuzzingBuffers.Erase();
    358      gFuzzingConnClosed = true;
    359 
    360      // We need to dispatch this so the main thread is guaranteed to wake up
    361      nsCOMPtr<nsIRunnable> r(new mozilla::Runnable("Dummy"));
    362      NS_DispatchToMainThread(r.forget());
    363    }
    364  } else {
    365    FUZZING_LOG(("[FuzzyClose] Connection closed."));
    366  }
    367 
    368  return ret;
    369 }
    370 
    371 nsresult AttachFuzzyIOLayer(PRFileDesc* fd) {
    372  MOZ_ASSERT(OnSocketThread(), "not on socket thread");
    373 
    374  if (!sFuzzyLayerMethodsPtr) {
    375    sFuzzyLayerIdentity = PR_GetUniqueIdentity("Fuzzy Layer");
    376    sFuzzyLayerMethods = *PR_GetDefaultIOMethods();
    377    sFuzzyLayerMethods.connect = FuzzyConnect;
    378    sFuzzyLayerMethods.send = FuzzySend;
    379    sFuzzyLayerMethods.sendto = FuzzySendTo;
    380    sFuzzyLayerMethods.write = FuzzyWrite;
    381    sFuzzyLayerMethods.recv = FuzzyRecv;
    382    sFuzzyLayerMethods.recvfrom = FuzzyRecvFrom;
    383    sFuzzyLayerMethods.read = FuzzyRead;
    384    sFuzzyLayerMethods.close = FuzzyClose;
    385    sFuzzyLayerMethods.poll = FuzzyPoll;
    386    sFuzzyLayerMethodsPtr = &sFuzzyLayerMethods;
    387  }
    388 
    389  PRFileDesc* layer =
    390      PR_CreateIOLayerStub(sFuzzyLayerIdentity, sFuzzyLayerMethodsPtr);
    391 
    392  if (!layer) {
    393    return NS_ERROR_FAILURE;
    394  }
    395 
    396  PRStatus status = PR_PushIOLayer(fd, PR_TOP_IO_LAYER, layer);
    397 
    398  if (status == PR_FAILURE) {
    399    PR_Free(layer);  // PR_CreateIOLayerStub() uses PR_Malloc().
    400    return NS_ERROR_FAILURE;
    401  }
    402 
    403  return NS_OK;
    404 }
    405 
    406 }  // namespace net
    407 }  // namespace mozilla