1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifndef mozilla_Fuzzyfox_h
#define mozilla_Fuzzyfox_h
#include "nsIObserver.h"
#include "nsIObserverService.h"
#include "nsISupportsPrimitives.h"
#include "nsThreadUtils.h"
#include "mozilla/TimeStamp.h"
/*
* This topic publishes the new canonical time according to Fuzzyfox,
* in microseconds since the epoch. If code needs to know the current time,
* it should listen for this topic and keep track of the 'current' time,
* so as to respect Fuzzyfox and be in sync with the rest of the browser's
* timekeeping.
*/
#define FUZZYFOX_UPDATECLOCK_OBSERVER_TOPIC "fuzzyfox-update-clocks"
/*
* For Fuzzyfox's security guarentees to hold, the browser must not execute
* actions while it should be paused. We currently only pause the main thread,
* so actions that occur on other threads should be queued until the browser
* unpaused (and moreso than unpauses: until it reaches a downtick.)
* This topic indicates when any queued outbound events should be delivered.
* TODO: Bug 1484300 and 1484299 would apply this to other communication
* channels
*/
#define FUZZYFOX_FIREOUTBOUND_OBSERVER_TOPIC "fuzzyfox-fire-outbound"
namespace mozilla {
/*
* Fuzzyfox is an implementation of the Fermata concept presented in
* Trusted Browsers for Uncertain Times.
*
* Web Browsers expose explicit (performance.now()) and implicit
* (WebVTT, Video Frames) timers that, when combined with algorithmic
* improvements such as edge thresholding, produce extremely high
* resolution clocks.
*
* High Resolution clocks can be used to time network accesses, browser
* cache reads, web page rendering, access to the CPU cache, and other
* operations - and the time these operations take to perform can yield
* detailed information about user information we want to keep private.
*
* Fuzzyfox limits the information disclosure by limiting an attacker's
* ability to create a high resolution clock. It does this by introducing
* a concept called 'fuzzy time' that degrades all clocks (explicit and
* implicit). This is done through a combination of holding time constant
* during program execution and pausing program execution.
*
* @InProceedings{KS16,
* author = {David Kohlbrenner and Hovav Shacham},
* title = {Trusted Browsers for Uncertain Times},
* booktitle = {Proceedings of USENIX Security 2016},
* pages = {463-80},
* year = 2016,
* editor = {Thorsten Holz and Stefan Savage},
* month = aug,
* organization = {USENIX}
* }
* https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_kohlbrenner.pdf
*
* Fuzzyfox is an adaptation of
* W.-M. Hu, “Reducing timing channels with fuzzy time,” in
* Proceedings of IEEE Security and Privacy (“Oakland”)
* 1991, T. F. Lunt and J. McLean, Eds. IEEE Computer
* Society, May 1991, pp. 8–20.
*/
class Fuzzyfox final : public Runnable, public nsIObserver {
public:
NS_DECL_ISUPPORTS_INHERITED
NS_DECL_NSIOBSERVER
static void Start();
NS_IMETHOD
Run() override;
private:
Fuzzyfox();
~Fuzzyfox();
uint64_t ActualTime();
uint64_t PickDuration();
void UpdateClocks(uint64_t aNewTime, TimeStamp aNewTimeStamp);
uint64_t FloorToGrain(uint64_t aValue);
TimeStamp FloorToGrain(TimeStamp aValue);
uint64_t CeilToGrain(uint64_t aValue);
TimeStamp CeilToGrain(TimeStamp aValue);
bool mSanityCheck;
uint64_t mStartTime;
uint32_t mDuration;
enum Tick {
eUptick,
eDowntick,
};
Tick mTickType;
nsCOMPtr<nsIObserverService> mObs = nullptr;
nsCOMPtr<nsISupportsPRInt64> mTimeUpdateWrapper = nullptr;
static Atomic<bool, Relaxed> sFuzzyfoxEnabledPrefMapped;
};
} // namespace mozilla
#endif /* mozilla_Fuzzyfox_h */
|
