diff options
Diffstat (limited to 'toolkit/components/downloads/ApplicationReputation.cpp')
| -rw-r--r-- | toolkit/components/downloads/ApplicationReputation.cpp | 1629 |
1 files changed, 1629 insertions, 0 deletions
diff --git a/toolkit/components/downloads/ApplicationReputation.cpp b/toolkit/components/downloads/ApplicationReputation.cpp new file mode 100644 index 000000000..7bd219dbf --- /dev/null +++ b/toolkit/components/downloads/ApplicationReputation.cpp @@ -0,0 +1,1629 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +// See +// https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc +// for a description of Chrome's implementation of this feature. +#include "ApplicationReputation.h" +#include "chrome/common/safe_browsing/csd.pb.h" + +#include "nsIArray.h" +#include "nsIApplicationReputation.h" +#include "nsIChannel.h" +#include "nsICryptoHash.h" +#include "nsIHttpChannel.h" +#include "nsIIOService.h" +#include "nsIPrefService.h" +#include "nsISimpleEnumerator.h" +#include "nsIStreamListener.h" +#include "nsIStringStream.h" +#include "nsITimer.h" +#include "nsIUploadChannel2.h" +#include "nsIURI.h" +#include "nsIURL.h" +#include "nsIUrlClassifierDBService.h" +#include "nsIX509Cert.h" +#include "nsIX509CertDB.h" +#include "nsIX509CertList.h" + +#include "mozilla/ArrayUtils.h" +#include "mozilla/BasePrincipal.h" +#include "mozilla/ErrorNames.h" +#include "mozilla/LoadContext.h" +#include "mozilla/Preferences.h" +#include "mozilla/Services.h" +#include "mozilla/Telemetry.h" +#include "mozilla/TimeStamp.h" + +#include "nsAutoPtr.h" +#include "nsCOMPtr.h" +#include "nsDebug.h" +#include "nsError.h" +#include "nsNetCID.h" +#include "nsReadableUtils.h" +#include "nsServiceManagerUtils.h" +#include "nsString.h" +#include "nsTArray.h" +#include "nsThreadUtils.h" +#include "nsXPCOMStrings.h" + +#include "nsIContentPolicy.h" +#include "nsILoadInfo.h" +#include "nsContentUtils.h" + +using mozilla::ArrayLength; +using mozilla::BasePrincipal; +using mozilla::DocShellOriginAttributes; +using mozilla::PrincipalOriginAttributes; +using mozilla::Preferences; +using mozilla::TimeStamp; +using mozilla::Telemetry::Accumulate; +using safe_browsing::ClientDownloadRequest; +using safe_browsing::ClientDownloadRequest_CertificateChain; +using safe_browsing::ClientDownloadRequest_Resource; +using safe_browsing::ClientDownloadRequest_SignatureInfo; + +// Preferences that we need to initialize the query. +#define PREF_SB_APP_REP_URL "browser.safebrowsing.downloads.remote.url" +#define PREF_SB_MALWARE_ENABLED "browser.safebrowsing.malware.enabled" +#define PREF_SB_DOWNLOADS_ENABLED "browser.safebrowsing.downloads.enabled" +#define PREF_SB_DOWNLOADS_REMOTE_ENABLED "browser.safebrowsing.downloads.remote.enabled" +#define PREF_SB_DOWNLOADS_REMOTE_TIMEOUT "browser.safebrowsing.downloads.remote.timeout_ms" +#define PREF_GENERAL_LOCALE "general.useragent.locale" +#define PREF_DOWNLOAD_BLOCK_TABLE "urlclassifier.downloadBlockTable" +#define PREF_DOWNLOAD_ALLOW_TABLE "urlclassifier.downloadAllowTable" + +// Preferences that are needed to action the verdict. +#define PREF_BLOCK_DANGEROUS "browser.safebrowsing.downloads.remote.block_dangerous" +#define PREF_BLOCK_DANGEROUS_HOST "browser.safebrowsing.downloads.remote.block_dangerous_host" +#define PREF_BLOCK_POTENTIALLY_UNWANTED "browser.safebrowsing.downloads.remote.block_potentially_unwanted" +#define PREF_BLOCK_UNCOMMON "browser.safebrowsing.downloads.remote.block_uncommon" + +// MOZ_LOG=ApplicationReputation:5 +mozilla::LazyLogModule ApplicationReputationService::prlog("ApplicationReputation"); +#define LOG(args) MOZ_LOG(ApplicationReputationService::prlog, mozilla::LogLevel::Debug, args) +#define LOG_ENABLED() MOZ_LOG_TEST(ApplicationReputationService::prlog, mozilla::LogLevel::Debug) + +class PendingDBLookup; + +// A single use class private to ApplicationReputationService encapsulating an +// nsIApplicationReputationQuery and an nsIApplicationReputationCallback. Once +// created by ApplicationReputationService, it is guaranteed to call mCallback. +// This class is private to ApplicationReputationService. +class PendingLookup final : public nsIStreamListener, + public nsITimerCallback, + public nsIObserver +{ +public: + NS_DECL_ISUPPORTS + NS_DECL_NSIREQUESTOBSERVER + NS_DECL_NSISTREAMLISTENER + NS_DECL_NSITIMERCALLBACK + NS_DECL_NSIOBSERVER + + // Constructor and destructor. + PendingLookup(nsIApplicationReputationQuery* aQuery, + nsIApplicationReputationCallback* aCallback); + + // Start the lookup. The lookup may have 2 parts: local and remote. In the + // local lookup, PendingDBLookups are created to query the local allow and + // blocklists for various URIs associated with this downloaded file. In the + // event that no results are found, a remote lookup is sent to the Application + // Reputation server. + nsresult StartLookup(); + +private: + ~PendingLookup(); + + friend class PendingDBLookup; + + // Telemetry states. + // Status of the remote response (valid or not). + enum SERVER_RESPONSE_TYPES { + SERVER_RESPONSE_VALID = 0, + SERVER_RESPONSE_FAILED = 1, + SERVER_RESPONSE_INVALID = 2, + }; + + // Number of blocklist and allowlist hits we have seen. + uint32_t mBlocklistCount; + uint32_t mAllowlistCount; + + // The query containing metadata about the downloaded file. + nsCOMPtr<nsIApplicationReputationQuery> mQuery; + + // The callback with which to report the verdict. + nsCOMPtr<nsIApplicationReputationCallback> mCallback; + + // An array of strings created from certificate information used to whitelist + // the downloaded file. + nsTArray<nsCString> mAllowlistSpecs; + // The source URI of the download, the referrer and possibly any redirects. + nsTArray<nsCString> mAnylistSpecs; + + // When we started this query + TimeStamp mStartTime; + + // The channel used to talk to the remote lookup server + nsCOMPtr<nsIChannel> mChannel; + + // Timer to abort this lookup if it takes too long + nsCOMPtr<nsITimer> mTimeoutTimer; + + // A protocol buffer for storing things we need in the remote request. We + // store the resource chain (redirect information) as well as signature + // information extracted using the Windows Authenticode API, if the binary is + // signed. + ClientDownloadRequest mRequest; + + // The response from the application reputation query. This is read in chunks + // as part of our nsIStreamListener implementation and may contain embedded + // NULLs. + nsCString mResponse; + + // Returns true if the file is likely to be binary. + bool IsBinaryFile(); + + // Returns the type of download binary for the file. + ClientDownloadRequest::DownloadType GetDownloadType(const nsAString& aFilename); + + // Clean up and call the callback. PendingLookup must not be used after this + // function is called. + nsresult OnComplete(bool shouldBlock, nsresult rv, + uint32_t verdict = nsIApplicationReputationService::VERDICT_SAFE); + + // Wrapper function for nsIStreamListener.onStopRequest to make it easy to + // guarantee calling the callback + nsresult OnStopRequestInternal(nsIRequest *aRequest, + nsISupports *aContext, + nsresult aResult, + bool* aShouldBlock, + uint32_t* aVerdict); + + // Return the hex-encoded hash of the whole URI. + nsresult GetSpecHash(nsACString& aSpec, nsACString& hexEncodedHash); + + // Strip url parameters, fragments, and user@pass fields from the URI spec + // using nsIURL. Hash data URIs and return blob URIs unfiltered. + nsresult GetStrippedSpec(nsIURI* aUri, nsACString& spec); + + // Escape '/' and '%' in certificate attribute values. + nsCString EscapeCertificateAttribute(const nsACString& aAttribute); + + // Escape ':' in fingerprint values. + nsCString EscapeFingerprint(const nsACString& aAttribute); + + // Generate whitelist strings for the given certificate pair from the same + // certificate chain. + nsresult GenerateWhitelistStringsForPair( + nsIX509Cert* certificate, nsIX509Cert* issuer); + + // Generate whitelist strings for the given certificate chain, which starts + // with the signer and may go all the way to the root cert. + nsresult GenerateWhitelistStringsForChain( + const ClientDownloadRequest_CertificateChain& aChain); + + // For signed binaries, generate strings of the form: + // http://sb-ssl.google.com/safebrowsing/csd/certificate/ + // <issuer_cert_sha1_fingerprint>[/CN=<cn>][/O=<org>][/OU=<unit>] + // for each (cert, issuer) pair in each chain of certificates that is + // associated with the binary. + nsresult GenerateWhitelistStrings(); + + // Parse the XPCOM certificate lists and stick them into the protocol buffer + // version. + nsresult ParseCertificates(nsIArray* aSigArray); + + // Adds the redirects to mAnylistSpecs to be looked up. + nsresult AddRedirects(nsIArray* aRedirects); + + // Helper function to ensure that we call PendingLookup::LookupNext or + // PendingLookup::OnComplete. + nsresult DoLookupInternal(); + + // Looks up all the URIs that may be responsible for allowlisting or + // blocklisting the downloaded file. These URIs may include whitelist strings + // generated by certificates verifying the binary as well as the target URI + // from which the file was downloaded. + nsresult LookupNext(); + + // Sends a query to the remote application reputation service. Returns NS_OK + // on success. + nsresult SendRemoteQuery(); + + // Helper function to ensure that we always call the callback. + nsresult SendRemoteQueryInternal(); +}; + +// A single-use class for looking up a single URI in the safebrowsing DB. This +// class is private to PendingLookup. +class PendingDBLookup final : public nsIUrlClassifierCallback +{ +public: + NS_DECL_ISUPPORTS + NS_DECL_NSIURLCLASSIFIERCALLBACK + + // Constructor and destructor + explicit PendingDBLookup(PendingLookup* aPendingLookup); + + // Look up the given URI in the safebrowsing DBs, optionally on both the allow + // list and the blocklist. If there is a match, call + // PendingLookup::OnComplete. Otherwise, call PendingLookup::LookupNext. + nsresult LookupSpec(const nsACString& aSpec, bool aAllowlistOnly); + +private: + ~PendingDBLookup(); + + // The download appeared on the allowlist, blocklist, or no list (and thus + // could trigger a remote query. + enum LIST_TYPES { + ALLOW_LIST = 0, + BLOCK_LIST = 1, + NO_LIST = 2, + }; + + nsCString mSpec; + bool mAllowlistOnly; + RefPtr<PendingLookup> mPendingLookup; + nsresult LookupSpecInternal(const nsACString& aSpec); +}; + +NS_IMPL_ISUPPORTS(PendingDBLookup, + nsIUrlClassifierCallback) + +PendingDBLookup::PendingDBLookup(PendingLookup* aPendingLookup) : + mAllowlistOnly(false), + mPendingLookup(aPendingLookup) +{ + LOG(("Created pending DB lookup [this = %p]", this)); +} + +PendingDBLookup::~PendingDBLookup() +{ + LOG(("Destroying pending DB lookup [this = %p]", this)); + mPendingLookup = nullptr; +} + +nsresult +PendingDBLookup::LookupSpec(const nsACString& aSpec, + bool aAllowlistOnly) +{ + LOG(("Checking principal %s [this=%p]", aSpec.Data(), this)); + mSpec = aSpec; + mAllowlistOnly = aAllowlistOnly; + nsresult rv = LookupSpecInternal(aSpec); + if (NS_FAILED(rv)) { + nsAutoCString errorName; + mozilla::GetErrorName(rv, errorName); + LOG(("Error in LookupSpecInternal() [rv = %s, this = %p]", + errorName.get(), this)); + return mPendingLookup->LookupNext(); // ignore this lookup and move to next + } + // LookupSpecInternal has called nsIUrlClassifierCallback.lookup, which is + // guaranteed to call HandleEvent. + return rv; +} + +nsresult +PendingDBLookup::LookupSpecInternal(const nsACString& aSpec) +{ + nsresult rv; + + nsCOMPtr<nsIURI> uri; + nsCOMPtr<nsIIOService> ios = do_GetService(NS_IOSERVICE_CONTRACTID, &rv); + rv = ios->NewURI(aSpec, nullptr, nullptr, getter_AddRefs(uri)); + NS_ENSURE_SUCCESS(rv, rv); + + PrincipalOriginAttributes attrs; + nsCOMPtr<nsIPrincipal> principal = + BasePrincipal::CreateCodebasePrincipal(uri, attrs); + if (!principal) { + return NS_ERROR_FAILURE; + } + + // Check local lists to see if the URI has already been whitelisted or + // blacklisted. + LOG(("Checking DB service for principal %s [this = %p]", mSpec.get(), this)); + nsCOMPtr<nsIUrlClassifierDBService> dbService = + do_GetService(NS_URLCLASSIFIERDBSERVICE_CONTRACTID, &rv); + NS_ENSURE_SUCCESS(rv, rv); + + nsAutoCString tables; + nsAutoCString allowlist; + Preferences::GetCString(PREF_DOWNLOAD_ALLOW_TABLE, &allowlist); + if (!allowlist.IsEmpty()) { + tables.Append(allowlist); + } + nsAutoCString blocklist; + Preferences::GetCString(PREF_DOWNLOAD_BLOCK_TABLE, &blocklist); + if (!mAllowlistOnly && !blocklist.IsEmpty()) { + tables.Append(','); + tables.Append(blocklist); + } + return dbService->Lookup(principal, tables, this); +} + +NS_IMETHODIMP +PendingDBLookup::HandleEvent(const nsACString& tables) +{ + // HandleEvent is guaranteed to call either: + // 1) PendingLookup::OnComplete if the URL matches the blocklist, or + // 2) PendingLookup::LookupNext if the URL does not match the blocklist. + // Blocklisting trumps allowlisting. + nsAutoCString blockList; + Preferences::GetCString(PREF_DOWNLOAD_BLOCK_TABLE, &blockList); + if (!mAllowlistOnly && FindInReadable(blockList, tables)) { + mPendingLookup->mBlocklistCount++; + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, BLOCK_LIST); + LOG(("Found principal %s on blocklist [this = %p]", mSpec.get(), this)); + return mPendingLookup->OnComplete(true, NS_OK, + nsIApplicationReputationService::VERDICT_DANGEROUS); + } + + nsAutoCString allowList; + Preferences::GetCString(PREF_DOWNLOAD_ALLOW_TABLE, &allowList); + if (FindInReadable(allowList, tables)) { + mPendingLookup->mAllowlistCount++; + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, ALLOW_LIST); + LOG(("Found principal %s on allowlist [this = %p]", mSpec.get(), this)); + // Don't call onComplete, since blocklisting trumps allowlisting + } else { + LOG(("Didn't find principal %s on any list [this = %p]", mSpec.get(), + this)); + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, NO_LIST); + } + return mPendingLookup->LookupNext(); +} + +NS_IMPL_ISUPPORTS(PendingLookup, + nsIStreamListener, + nsIRequestObserver, + nsIObserver) + +PendingLookup::PendingLookup(nsIApplicationReputationQuery* aQuery, + nsIApplicationReputationCallback* aCallback) : + mBlocklistCount(0), + mAllowlistCount(0), + mQuery(aQuery), + mCallback(aCallback) +{ + LOG(("Created pending lookup [this = %p]", this)); +} + +PendingLookup::~PendingLookup() +{ + LOG(("Destroying pending lookup [this = %p]", this)); +} + +static const char16_t* kBinaryFileExtensions[] = { + // Extracted from the "File Type Policies" Chrome extension + //u".001", + //u".7z", + //u".ace", + //u".action", // Mac script + //u".ad", // Windows + u".ade", // MS Access + u".adp", // MS Access + u".apk", // Android package + u".app", // Executable application + u".application", // MS ClickOnce + u".appref-ms", // MS ClickOnce + //u".arc", + //u".arj", + u".as", // Mac archive + u".asp", // Windows Server script + u".asx", // Windows Media Player + //u".b64", + //u".balz", + u".bas", // Basic script + u".bash", // Linux shell + u".bat", // Windows shell + //u".bhx", + //u".bin", + u".bz", // Linux archive (bzip) + u".bz2", // Linux archive (bzip2) + u".bzip2", // Linux archive (bzip2) + u".cab", // Windows archive + u".cdr", // Mac disk image + u".cfg", // Windows + u".chi", // Windows Help + u".chm", // Windows Help + u".class", // Java + u".cmd", // Windows executable + u".com", // Windows executable + u".command", // Mac script + u".cpgz", // Mac archive + //u".cpio", + u".cpl", // Windows executable + u".crt", // Windows signed certificate + u".crx", // Chrome extensions + u".csh", // Linux shell + u".dart", // Mac disk image + u".dc42", // Apple DiskCopy Image + u".deb", // Linux package + u".dex", // Android + u".diskcopy42", // Apple DiskCopy Image + u".dll", // Windows executable + u".dmg", // Mac disk image + u".dmgpart", // Mac disk image + //u".docb", // MS Office + //u".docm", // MS Word + //u".docx", // MS Word + //u".dotm", // MS Word + //u".dott", // MS Office + u".drv", // Windows driver + u".dvdr", // Mac Disk image + u".efi", // Firmware + u".eml", // MS Outlook + u".exe", // Windows executable + //u".fat", + u".fon", // Windows font + u".fxp", // MS FoxPro + u".gadget", // Windows + u".grp", // Windows + u".gz", // Linux archive (gzip) + u".gzip", // Linux archive (gzip) + u".hfs", // Mac disk image + u".hlp", // Windows Help + u".hqx", // Mac archive + u".hta", // HTML trusted application + u".htt", // MS HTML template + u".img", // Mac disk image + u".imgpart", // Mac disk image + u".inf", // Windows installer + u".ini", // Generic config file + u".ins", // IIS config + //u".inx", // InstallShield + u".iso", // CD image + u".isp", // IIS config + //u".isu", // InstallShield + u".jar", // Java + u".jnlp", // Java + //u".job", // Windows + u".js", // JavaScript script + u".jse", // JScript + u".ksh", // Linux shell + //u".lha", + u".lnk", // Windows + u".local", // Windows + //u".lpaq1", + //u".lpaq5", + //u".lpaq8", + //u".lzh", + //u".lzma", + u".mad", // MS Access + u".maf", // MS Access + u".mag", // MS Access + u".mam", // MS Access + u".manifest", // Windows + u".maq", // MS Access + u".mar", // MS Access + u".mas", // MS Access + u".mat", // MS Access + u".mau", // Media attachment + u".mav", // MS Access + u".maw", // MS Access + u".mda", // MS Access + u".mdb", // MS Access + u".mde", // MS Access + u".mdt", // MS Access + u".mdw", // MS Access + u".mdz", // MS Access + u".mht", // MS HTML + u".mhtml", // MS HTML + u".mim", // MS Mail + u".mmc", // MS Office + u".mof", // Windows + u".mpkg", // Mac installer + u".msc", // Windows executable + u".msg", // MS Outlook + u".msh", // Windows shell + u".msh1", // Windows shell + u".msh1xml", // Windows shell + u".msh2", // Windows shell + u".msh2xml", // Windows shell + u".mshxml", // Windows + u".msi", // Windows installer + u".msp", // Windows installer + u".mst", // Windows installer + u".ndif", // Mac disk image + //u".ntfs", // 7z + u".ocx", // ActiveX + u".ops", // MS Office + //u".out", // Linux binary + //u".paf", // PortableApps package + //u".paq8f", + //u".paq8jd", + //u".paq8l", + //u".paq8o", + u".partial", // Downloads + u".pax", // Mac archive + u".pcd", // Microsoft Visual Test + u".pdf", // Adobe Acrobat + //u".pea", + u".pet", // Linux package + u".pif", // Windows + u".pkg", // Mac installer + u".pl", // Perl script + u".plg", // MS Visual Studio + //u".potx", // MS PowerPoint + //u".ppam", // MS PowerPoint + //u".ppsx", // MS PowerPoint + //u".pptm", // MS PowerPoint + //u".pptx", // MS PowerPoint + u".prf", // MS Outlook + u".prg", // Windows + u".ps1", // Windows shell + u".ps1xml", // Windows shell + u".ps2", // Windows shell + u".ps2xml", // Windows shell + u".psc1", // Windows shell + u".psc2", // Windows shell + u".pst", // MS Outlook + u".pup", // Linux package + u".py", // Python script + u".pyc", // Python binary + u".pyw", // Python GUI + //u".quad", + //u".r00", + //u".r01", + //u".r02", + //u".r03", + //u".r04", + //u".r05", + //u".r06", + //u".r07", + //u".r08", + //u".r09", + //u".r10", + //u".r11", + //u".r12", + //u".r13", + //u".r14", + //u".r15", + //u".r16", + //u".r17", + //u".r18", + //u".r19", + //u".r20", + //u".r21", + //u".r22", + //u".r23", + //u".r24", + //u".r25", + //u".r26", + //u".r27", + //u".r28", + //u".r29", + //u".rar", + u".rb", // Ruby script + u".reg", // Windows Registry + u".rels", // MS Office + //u".rgs", // Windows Registry + u".rpm", // Linux package + //u".rtf", // MS Office + //u".run", // Linux shell + u".scf", // Windows shell + u".scr", // Windows + u".sct", // Windows shell + u".search-ms", // Windows + u".sh", // Linux shell + u".shar", // Linux shell + u".shb", // Windows + u".shs", // Windows shell + //u".sldm", // MS PowerPoint + //u".sldx", // MS PowerPoint + u".slp", // Linux package + u".smi", // Mac disk image + u".sparsebundle", // Mac disk image + u".sparseimage", // Mac disk image + u".spl", // Adobe Flash + //u".squashfs", + u".svg", + u".swf", // Adobe Flash + u".swm", // Windows Imaging + u".sys", // Windows + u".tar", // Linux archive + u".taz", // Linux archive (bzip2) + u".tbz", // Linux archive (bzip2) + u".tbz2", // Linux archive (bzip2) + u".tcsh", // Linux shell + u".tgz", // Linux archive (gzip) + //u".toast", // Roxio disk image + //u".torrent", // Bittorrent + u".tpz", // Linux archive (gzip) + u".txz", // Linux archive (xz) + u".tz", // Linux archive (gzip) + //u".u3p", // U3 Smart Apps + u".udf", // MS Excel + u".udif", // Mac disk image + u".url", // Windows + //u".uu", + //u".uue", + u".vb", // Visual Basic script + u".vbe", // Visual Basic script + u".vbs", // Visual Basic script + //u".vbscript", // Visual Basic script + u".vhd", // Windows virtual hard drive + u".vhdx", // Windows virtual hard drive + u".vmdk", // VMware virtual disk + u".vsd", // MS Visio + u".vsmacros", // MS Visual Studio + u".vss", // MS Visio + u".vst", // MS Visio + u".vsw", // MS Visio + u".website", // Windows + u".wim", // Windows Imaging + //u".workflow", // Mac Automator + //u".wrc", // FreeArc archive + u".ws", // Windows script + u".wsc", // Windows script + u".wsf", // Windows script + u".wsh", // Windows script + u".xar", // MS Excel + u".xbap", // XAML Browser Application + u".xip", // Mac archive + //u".xlsm", // MS Excel + //u".xlsx", // MS Excel + //u".xltm", // MS Excel + //u".xltx", // MS Excel + u".xml", + u".xnk", // MS Exchange + u".xrm-ms", // Windows + u".xsl", // XML Stylesheet + //u".xxe", + u".xz", // Linux archive (xz) + u".z", // InstallShield +#ifdef XP_WIN // disable on Mac/Linux, see 1167493 + u".zip", // Generic archive +#endif + u".zipx", // WinZip + //u".zpaq", +}; + +bool +PendingLookup::IsBinaryFile() +{ + nsString fileName; + nsresult rv = mQuery->GetSuggestedFileName(fileName); + if (NS_FAILED(rv)) { + LOG(("No suggested filename [this = %p]", this)); + return false; + } + LOG(("Suggested filename: %s [this = %p]", + NS_ConvertUTF16toUTF8(fileName).get(), this)); + + for (size_t i = 0; i < ArrayLength(kBinaryFileExtensions); ++i) { + if (StringEndsWith(fileName, nsDependentString(kBinaryFileExtensions[i]))) { + return true; + } + } + + return false; +} + +ClientDownloadRequest::DownloadType +PendingLookup::GetDownloadType(const nsAString& aFilename) { + MOZ_ASSERT(IsBinaryFile()); + + // From https://cs.chromium.org/chromium/src/chrome/common/safe_browsing/download_protection_util.cc?l=17 + if (StringEndsWith(aFilename, NS_LITERAL_STRING(".zip"))) { + return ClientDownloadRequest::ZIPPED_EXECUTABLE; + } else if (StringEndsWith(aFilename, NS_LITERAL_STRING(".apk"))) { + return ClientDownloadRequest::ANDROID_APK; + } else if (StringEndsWith(aFilename, NS_LITERAL_STRING(".app")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".cdr")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".dart")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".dc42")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".diskcopy42")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".dmg")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".dmgpart")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".dvdr")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".img")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".imgpart")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".iso")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".mpkg")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".ndif")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".pkg")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".smi")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".sparsebundle")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".sparseimage")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".toast")) || + StringEndsWith(aFilename, NS_LITERAL_STRING(".udif"))) { + return ClientDownloadRequest::MAC_EXECUTABLE; + } + + return ClientDownloadRequest::WIN_EXECUTABLE; // default to Windows binaries +} + +nsresult +PendingLookup::LookupNext() +{ + // We must call LookupNext or SendRemoteQuery upon return. + // Look up all of the URLs that could allow or block this download. + // Blocklist first. + if (mBlocklistCount > 0) { + return OnComplete(true, NS_OK, + nsIApplicationReputationService::VERDICT_DANGEROUS); + } + int index = mAnylistSpecs.Length() - 1; + nsCString spec; + if (index >= 0) { + // Check the source URI, referrer and redirect chain. + spec = mAnylistSpecs[index]; + mAnylistSpecs.RemoveElementAt(index); + RefPtr<PendingDBLookup> lookup(new PendingDBLookup(this)); + return lookup->LookupSpec(spec, false); + } + // If any of mAnylistSpecs matched the blocklist, go ahead and block. + if (mBlocklistCount > 0) { + return OnComplete(true, NS_OK, + nsIApplicationReputationService::VERDICT_DANGEROUS); + } + // If any of mAnylistSpecs matched the allowlist, go ahead and pass. + if (mAllowlistCount > 0) { + return OnComplete(false, NS_OK); + } + // Only binary signatures remain. + index = mAllowlistSpecs.Length() - 1; + if (index >= 0) { + spec = mAllowlistSpecs[index]; + LOG(("PendingLookup::LookupNext: checking %s on allowlist", spec.get())); + mAllowlistSpecs.RemoveElementAt(index); + RefPtr<PendingDBLookup> lookup(new PendingDBLookup(this)); + return lookup->LookupSpec(spec, true); + } + // There are no more URIs to check against local list. If the file is + // not eligible for remote lookup, bail. + if (!IsBinaryFile()) { + LOG(("Not eligible for remote lookups [this=%x]", this)); + return OnComplete(false, NS_OK); + } + nsresult rv = SendRemoteQuery(); + if (NS_FAILED(rv)) { + return OnComplete(false, rv); + } + return NS_OK; +} + +nsCString +PendingLookup::EscapeCertificateAttribute(const nsACString& aAttribute) +{ + // Escape '/' because it's a field separator, and '%' because Chrome does + nsCString escaped; + escaped.SetCapacity(aAttribute.Length()); + for (unsigned int i = 0; i < aAttribute.Length(); ++i) { + if (aAttribute.Data()[i] == '%') { + escaped.AppendLiteral("%25"); + } else if (aAttribute.Data()[i] == '/') { + escaped.AppendLiteral("%2F"); + } else if (aAttribute.Data()[i] == ' ') { + escaped.AppendLiteral("%20"); + } else { + escaped.Append(aAttribute.Data()[i]); + } + } + return escaped; +} + +nsCString +PendingLookup::EscapeFingerprint(const nsACString& aFingerprint) +{ + // Google's fingerprint doesn't have colons + nsCString escaped; + escaped.SetCapacity(aFingerprint.Length()); + for (unsigned int i = 0; i < aFingerprint.Length(); ++i) { + if (aFingerprint.Data()[i] != ':') { + escaped.Append(aFingerprint.Data()[i]); + } + } + return escaped; +} + +nsresult +PendingLookup::GenerateWhitelistStringsForPair( + nsIX509Cert* certificate, + nsIX509Cert* issuer) +{ + // The whitelist paths have format: + // http://sb-ssl.google.com/safebrowsing/csd/certificate/<issuer_cert_fingerprint>[/CN=<cn>][/O=<org>][/OU=<unit>] + // Any of CN, O, or OU may be omitted from the whitelist entry. Unfortunately + // this is not publicly documented, but the Chrome implementation can be found + // here: + // https://code.google.com/p/chromium/codesearch#search/&q=GetCertificateWhitelistStrings + nsCString whitelistString( + "http://sb-ssl.google.com/safebrowsing/csd/certificate/"); + + nsString fingerprint; + nsresult rv = issuer->GetSha1Fingerprint(fingerprint); + NS_ENSURE_SUCCESS(rv, rv); + whitelistString.Append( + EscapeFingerprint(NS_ConvertUTF16toUTF8(fingerprint))); + + nsString commonName; + rv = certificate->GetCommonName(commonName); + NS_ENSURE_SUCCESS(rv, rv); + if (!commonName.IsEmpty()) { + whitelistString.AppendLiteral("/CN="); + whitelistString.Append( + EscapeCertificateAttribute(NS_ConvertUTF16toUTF8(commonName))); + } + + nsString organization; + rv = certificate->GetOrganization(organization); + NS_ENSURE_SUCCESS(rv, rv); + if (!organization.IsEmpty()) { + whitelistString.AppendLiteral("/O="); + whitelistString.Append( + EscapeCertificateAttribute(NS_ConvertUTF16toUTF8(organization))); + } + + nsString organizationalUnit; + rv = certificate->GetOrganizationalUnit(organizationalUnit); + NS_ENSURE_SUCCESS(rv, rv); + if (!organizationalUnit.IsEmpty()) { + whitelistString.AppendLiteral("/OU="); + whitelistString.Append( + EscapeCertificateAttribute(NS_ConvertUTF16toUTF8(organizationalUnit))); + } + LOG(("Whitelisting %s", whitelistString.get())); + + mAllowlistSpecs.AppendElement(whitelistString); + return NS_OK; +} + +nsresult +PendingLookup::GenerateWhitelistStringsForChain( + const safe_browsing::ClientDownloadRequest_CertificateChain& aChain) +{ + // We need a signing certificate and an issuer to construct a whitelist + // entry. + if (aChain.element_size() < 2) { + return NS_OK; + } + + // Get the signer. + nsresult rv; + nsCOMPtr<nsIX509CertDB> certDB = do_GetService(NS_X509CERTDB_CONTRACTID, &rv); + NS_ENSURE_SUCCESS(rv, rv); + + nsCOMPtr<nsIX509Cert> signer; + rv = certDB->ConstructX509( + const_cast<char *>(aChain.element(0).certificate().data()), + aChain.element(0).certificate().size(), getter_AddRefs(signer)); + NS_ENSURE_SUCCESS(rv, rv); + + for (int i = 1; i < aChain.element_size(); ++i) { + // Get the issuer. + nsCOMPtr<nsIX509Cert> issuer; + rv = certDB->ConstructX509( + const_cast<char *>(aChain.element(i).certificate().data()), + aChain.element(i).certificate().size(), getter_AddRefs(issuer)); + NS_ENSURE_SUCCESS(rv, rv); + + rv = GenerateWhitelistStringsForPair(signer, issuer); + NS_ENSURE_SUCCESS(rv, rv); + } + return NS_OK; +} + +nsresult +PendingLookup::GenerateWhitelistStrings() +{ + for (int i = 0; i < mRequest.signature().certificate_chain_size(); ++i) { + nsresult rv = GenerateWhitelistStringsForChain( + mRequest.signature().certificate_chain(i)); + NS_ENSURE_SUCCESS(rv, rv); + } + return NS_OK; +} + +nsresult +PendingLookup::AddRedirects(nsIArray* aRedirects) +{ + uint32_t length = 0; + aRedirects->GetLength(&length); + LOG(("ApplicationReputation: Got %u redirects", length)); + nsCOMPtr<nsISimpleEnumerator> iter; + nsresult rv = aRedirects->Enumerate(getter_AddRefs(iter)); + NS_ENSURE_SUCCESS(rv, rv); + + bool hasMoreRedirects = false; + rv = iter->HasMoreElements(&hasMoreRedirects); + NS_ENSURE_SUCCESS(rv, rv); + + while (hasMoreRedirects) { + nsCOMPtr<nsISupports> supports; + rv = iter->GetNext(getter_AddRefs(supports)); + NS_ENSURE_SUCCESS(rv, rv); + + nsCOMPtr<nsIPrincipal> principal = do_QueryInterface(supports, &rv); + NS_ENSURE_SUCCESS(rv, rv); + + nsCOMPtr<nsIURI> uri; + rv = principal->GetURI(getter_AddRefs(uri)); + NS_ENSURE_SUCCESS(rv, rv); + + // Add the spec to our list of local lookups. The most recent redirect is + // the last element. + nsCString spec; + rv = GetStrippedSpec(uri, spec); + NS_ENSURE_SUCCESS(rv, rv); + mAnylistSpecs.AppendElement(spec); + LOG(("ApplicationReputation: Appending redirect %s\n", spec.get())); + + // Store the redirect information in the remote request. + ClientDownloadRequest_Resource* resource = mRequest.add_resources(); + resource->set_url(spec.get()); + resource->set_type(ClientDownloadRequest::DOWNLOAD_REDIRECT); + + rv = iter->HasMoreElements(&hasMoreRedirects); + NS_ENSURE_SUCCESS(rv, rv); + } + return NS_OK; +} + +nsresult +PendingLookup::StartLookup() +{ + mStartTime = TimeStamp::Now(); + nsresult rv = DoLookupInternal(); + if (NS_FAILED(rv)) { + return OnComplete(false, NS_OK); + } + return rv; +} + +nsresult +PendingLookup::GetSpecHash(nsACString& aSpec, nsACString& hexEncodedHash) +{ + nsresult rv; + + nsCOMPtr<nsICryptoHash> cryptoHash = + do_CreateInstance("@mozilla.org/security/hash;1", &rv); + NS_ENSURE_SUCCESS(rv, rv); + rv = cryptoHash->Init(nsICryptoHash::SHA256); + NS_ENSURE_SUCCESS(rv, rv); + + rv = cryptoHash->Update(reinterpret_cast<const uint8_t*>(aSpec.BeginReading()), + aSpec.Length()); + NS_ENSURE_SUCCESS(rv, rv); + + nsAutoCString binaryHash; + rv = cryptoHash->Finish(false, binaryHash); + NS_ENSURE_SUCCESS(rv, rv); + + // This needs to match HexEncode() in Chrome's + // src/base/strings/string_number_conversions.cc + static const char* const hex = "0123456789ABCDEF"; + hexEncodedHash.SetCapacity(2 * binaryHash.Length()); + for (size_t i = 0; i < binaryHash.Length(); ++i) { + auto c = static_cast<const unsigned char>(binaryHash[i]); + hexEncodedHash.Append(hex[(c >> 4) & 0x0F]); + hexEncodedHash.Append(hex[c & 0x0F]); + } + + return NS_OK; +} + +nsresult +PendingLookup::GetStrippedSpec(nsIURI* aUri, nsACString& escaped) +{ + if (NS_WARN_IF(!aUri)) { + return NS_ERROR_INVALID_ARG; + } + + nsresult rv; + rv = aUri->GetScheme(escaped); + NS_ENSURE_SUCCESS(rv, rv); + + if (escaped.EqualsLiteral("blob")) { + aUri->GetSpec(escaped); + LOG(("PendingLookup::GetStrippedSpec(): blob URL left unstripped as '%s' [this = %p]", + PromiseFlatCString(escaped).get(), this)); + return NS_OK; + + } else if (escaped.EqualsLiteral("data")) { + // Replace URI with "data:<everything before comma>,SHA256(<whole URI>)" + aUri->GetSpec(escaped); + int32_t comma = escaped.FindChar(','); + if (comma > -1 && + static_cast<nsCString::size_type>(comma) < escaped.Length() - 1) { + MOZ_ASSERT(comma > 4, "Data URIs start with 'data:'"); + nsAutoCString hexEncodedHash; + rv = GetSpecHash(escaped, hexEncodedHash); + if (NS_SUCCEEDED(rv)) { + escaped.Truncate(comma + 1); + escaped.Append(hexEncodedHash); + } + } + + LOG(("PendingLookup::GetStrippedSpec(): data URL stripped to '%s' [this = %p]", + PromiseFlatCString(escaped).get(), this)); + return NS_OK; + } + + // If aURI is not an nsIURL, we do not want to check the lists or send a + // remote query. + nsCOMPtr<nsIURL> url = do_QueryInterface(aUri, &rv); + if (NS_FAILED(rv)) { + LOG(("PendingLookup::GetStrippedSpec(): scheme '%s' is not supported [this = %p]", + PromiseFlatCString(escaped).get(), this)); + return rv; + } + + nsCString temp; + rv = url->GetHostPort(temp); + NS_ENSURE_SUCCESS(rv, rv); + + escaped.Append("://"); + escaped.Append(temp); + + rv = url->GetFilePath(temp); + NS_ENSURE_SUCCESS(rv, rv); + + // nsIUrl.filePath starts with '/' + escaped.Append(temp); + + LOG(("PendingLookup::GetStrippedSpec(): URL stripped to '%s' [this = %p]", + PromiseFlatCString(escaped).get(), this)); + return NS_OK; +} + +nsresult +PendingLookup::DoLookupInternal() +{ + // We want to check the target URI, its referrer, and associated redirects + // against the local lists. + nsCOMPtr<nsIURI> uri; + nsresult rv = mQuery->GetSourceURI(getter_AddRefs(uri)); + NS_ENSURE_SUCCESS(rv, rv); + + nsCString sourceSpec; + rv = GetStrippedSpec(uri, sourceSpec); + NS_ENSURE_SUCCESS(rv, rv); + + mAnylistSpecs.AppendElement(sourceSpec); + + ClientDownloadRequest_Resource* resource = mRequest.add_resources(); + resource->set_url(sourceSpec.get()); + resource->set_type(ClientDownloadRequest::DOWNLOAD_URL); + + nsCOMPtr<nsIURI> referrer = nullptr; + rv = mQuery->GetReferrerURI(getter_AddRefs(referrer)); + if (referrer) { + nsCString referrerSpec; + rv = GetStrippedSpec(referrer, referrerSpec); + NS_ENSURE_SUCCESS(rv, rv); + mAnylistSpecs.AppendElement(referrerSpec); + resource->set_referrer(referrerSpec.get()); + } + nsCOMPtr<nsIArray> redirects; + rv = mQuery->GetRedirects(getter_AddRefs(redirects)); + if (redirects) { + AddRedirects(redirects); + } else { + LOG(("ApplicationReputation: Got no redirects [this=%p]", this)); + } + + // Extract the signature and parse certificates so we can use it to check + // whitelists. + nsCOMPtr<nsIArray> sigArray; + rv = mQuery->GetSignatureInfo(getter_AddRefs(sigArray)); + NS_ENSURE_SUCCESS(rv, rv); + + if (sigArray) { + rv = ParseCertificates(sigArray); + NS_ENSURE_SUCCESS(rv, rv); + } + + rv = GenerateWhitelistStrings(); + NS_ENSURE_SUCCESS(rv, rv); + + // Start the call chain. + return LookupNext(); +} + +nsresult +PendingLookup::OnComplete(bool shouldBlock, nsresult rv, uint32_t verdict) +{ + MOZ_ASSERT(!shouldBlock || + verdict != nsIApplicationReputationService::VERDICT_SAFE); + + if (NS_FAILED(rv)) { + nsAutoCString errorName; + mozilla::GetErrorName(rv, errorName); + LOG(("Failed sending remote query for application reputation " + "[rv = %s, this = %p]", errorName.get(), this)); + } + + if (mTimeoutTimer) { + mTimeoutTimer->Cancel(); + mTimeoutTimer = nullptr; + } + + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SHOULD_BLOCK, + shouldBlock); + double t = (TimeStamp::Now() - mStartTime).ToMilliseconds(); + LOG(("Application Reputation verdict is %lu, obtained in %f ms [this = %p]", + verdict, t, this)); + if (shouldBlock) { + LOG(("Application Reputation check failed, blocking bad binary [this = %p]", + this)); + } else { + LOG(("Application Reputation check passed [this = %p]", this)); + } + nsresult res = mCallback->OnComplete(shouldBlock, rv, verdict); + return res; +} + +nsresult +PendingLookup::ParseCertificates(nsIArray* aSigArray) +{ + // If we haven't been set for any reason, bail. + NS_ENSURE_ARG_POINTER(aSigArray); + + // Binaries may be signed by multiple chains of certificates. If there are no + // chains, the binary is unsigned (or we were unable to extract signature + // information on a non-Windows platform) + nsCOMPtr<nsISimpleEnumerator> chains; + nsresult rv = aSigArray->Enumerate(getter_AddRefs(chains)); + NS_ENSURE_SUCCESS(rv, rv); + + bool hasMoreChains = false; + rv = chains->HasMoreElements(&hasMoreChains); + NS_ENSURE_SUCCESS(rv, rv); + + while (hasMoreChains) { + nsCOMPtr<nsISupports> chainSupports; + rv = chains->GetNext(getter_AddRefs(chainSupports)); + NS_ENSURE_SUCCESS(rv, rv); + + nsCOMPtr<nsIX509CertList> certList = do_QueryInterface(chainSupports, &rv); + NS_ENSURE_SUCCESS(rv, rv); + + safe_browsing::ClientDownloadRequest_CertificateChain* certChain = + mRequest.mutable_signature()->add_certificate_chain(); + nsCOMPtr<nsISimpleEnumerator> chainElt; + rv = certList->GetEnumerator(getter_AddRefs(chainElt)); + NS_ENSURE_SUCCESS(rv, rv); + + // Each chain may have multiple certificates. + bool hasMoreCerts = false; + rv = chainElt->HasMoreElements(&hasMoreCerts); + while (hasMoreCerts) { + nsCOMPtr<nsISupports> certSupports; + rv = chainElt->GetNext(getter_AddRefs(certSupports)); + NS_ENSURE_SUCCESS(rv, rv); + + nsCOMPtr<nsIX509Cert> cert = do_QueryInterface(certSupports, &rv); + NS_ENSURE_SUCCESS(rv, rv); + + uint8_t* data = nullptr; + uint32_t len = 0; + rv = cert->GetRawDER(&len, &data); + NS_ENSURE_SUCCESS(rv, rv); + + // Add this certificate to the protobuf to send remotely. + certChain->add_element()->set_certificate(data, len); + free(data); + + rv = chainElt->HasMoreElements(&hasMoreCerts); + NS_ENSURE_SUCCESS(rv, rv); + } + rv = chains->HasMoreElements(&hasMoreChains); + NS_ENSURE_SUCCESS(rv, rv); + } + if (mRequest.signature().certificate_chain_size() > 0) { + mRequest.mutable_signature()->set_trusted(true); + } + return NS_OK; +} + +nsresult +PendingLookup::SendRemoteQuery() +{ + nsresult rv = SendRemoteQueryInternal(); + if (NS_FAILED(rv)) { + return OnComplete(false, rv); + } + // SendRemoteQueryInternal has fired off the query and we call OnComplete in + // the nsIStreamListener.onStopRequest. + return rv; +} + +nsresult +PendingLookup::SendRemoteQueryInternal() +{ + // If we aren't supposed to do remote lookups, bail. + if (!Preferences::GetBool(PREF_SB_DOWNLOADS_REMOTE_ENABLED, false)) { + LOG(("Remote lookups are disabled [this = %p]", this)); + return NS_ERROR_NOT_AVAILABLE; + } + // If the remote lookup URL is empty or absent, bail. + nsCString serviceUrl; + NS_ENSURE_SUCCESS(Preferences::GetCString(PREF_SB_APP_REP_URL, &serviceUrl), + NS_ERROR_NOT_AVAILABLE); + if (serviceUrl.IsEmpty()) { + LOG(("Remote lookup URL is empty [this = %p]", this)); + return NS_ERROR_NOT_AVAILABLE; + } + + // If the blocklist or allowlist is empty (so we couldn't do local lookups), + // bail + { + nsAutoCString table; + NS_ENSURE_SUCCESS(Preferences::GetCString(PREF_DOWNLOAD_BLOCK_TABLE, + &table), + NS_ERROR_NOT_AVAILABLE); + if (table.IsEmpty()) { + LOG(("Blocklist is empty [this = %p]", this)); + return NS_ERROR_NOT_AVAILABLE; + } + } +#ifdef XP_WIN + // The allowlist is only needed to do signature verification on Windows + { + nsAutoCString table; + NS_ENSURE_SUCCESS(Preferences::GetCString(PREF_DOWNLOAD_ALLOW_TABLE, + &table), + NS_ERROR_NOT_AVAILABLE); + if (table.IsEmpty()) { + LOG(("Allowlist is empty [this = %p]", this)); + return NS_ERROR_NOT_AVAILABLE; + } + } +#endif + + LOG(("Sending remote query for application reputation [this = %p]", + this)); + // We did not find a local result, so fire off the query to the + // application reputation service. + nsCOMPtr<nsIURI> uri; + nsresult rv; + rv = mQuery->GetSourceURI(getter_AddRefs(uri)); + NS_ENSURE_SUCCESS(rv, rv); + nsCString spec; + rv = GetStrippedSpec(uri, spec); + NS_ENSURE_SUCCESS(rv, rv); + mRequest.set_url(spec.get()); + + uint32_t fileSize; + rv = mQuery->GetFileSize(&fileSize); + NS_ENSURE_SUCCESS(rv, rv); + mRequest.set_length(fileSize); + // We have no way of knowing whether or not a user initiated the + // download. Set it to true to lessen the chance of false positives. + mRequest.set_user_initiated(true); + + nsCString locale; + NS_ENSURE_SUCCESS(Preferences::GetCString(PREF_GENERAL_LOCALE, &locale), + NS_ERROR_NOT_AVAILABLE); + mRequest.set_locale(locale.get()); + nsCString sha256Hash; + rv = mQuery->GetSha256Hash(sha256Hash); + NS_ENSURE_SUCCESS(rv, rv); + mRequest.mutable_digests()->set_sha256(sha256Hash.Data()); + nsString fileName; + rv = mQuery->GetSuggestedFileName(fileName); + NS_ENSURE_SUCCESS(rv, rv); + mRequest.set_file_basename(NS_ConvertUTF16toUTF8(fileName).get()); + mRequest.set_download_type(GetDownloadType(fileName)); + + if (mRequest.signature().trusted()) { + LOG(("Got signed binary for remote application reputation check " + "[this = %p]", this)); + } else { + LOG(("Got unsigned binary for remote application reputation check " + "[this = %p]", this)); + } + + // Serialize the protocol buffer to a string. This can only fail if we are + // out of memory, or if the protocol buffer req is missing required fields + // (only the URL for now). + std::string serialized; + if (!mRequest.SerializeToString(&serialized)) { + return NS_ERROR_UNEXPECTED; + } + LOG(("Serialized protocol buffer [this = %p]: (length=%d) %s", this, + serialized.length(), serialized.c_str())); + + // Set the input stream to the serialized protocol buffer + nsCOMPtr<nsIStringInputStream> sstream = + do_CreateInstance("@mozilla.org/io/string-input-stream;1", &rv); + NS_ENSURE_SUCCESS(rv, rv); + + rv = sstream->SetData(serialized.c_str(), serialized.length()); + NS_ENSURE_SUCCESS(rv, rv); + + // Set up the channel to transmit the request to the service. + nsCOMPtr<nsIIOService> ios = do_GetService(NS_IOSERVICE_CONTRACTID, &rv); + rv = ios->NewChannel2(serviceUrl, + nullptr, + nullptr, + nullptr, // aLoadingNode + nsContentUtils::GetSystemPrincipal(), + nullptr, // aTriggeringPrincipal + nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL, + nsIContentPolicy::TYPE_OTHER, + getter_AddRefs(mChannel)); + NS_ENSURE_SUCCESS(rv, rv); + + nsCOMPtr<nsILoadInfo> loadInfo = mChannel->GetLoadInfo(); + if (loadInfo) { + loadInfo->SetOriginAttributes( + mozilla::NeckoOriginAttributes(NECKO_SAFEBROWSING_APP_ID, false)); + } + + nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(mChannel, &rv)); + NS_ENSURE_SUCCESS(rv, rv); + mozilla::Unused << httpChannel; + + // Upload the protobuf to the application reputation service. + nsCOMPtr<nsIUploadChannel2> uploadChannel = do_QueryInterface(mChannel, &rv); + NS_ENSURE_SUCCESS(rv, rv); + + rv = uploadChannel->ExplicitSetUploadStream(sstream, + NS_LITERAL_CSTRING("application/octet-stream"), serialized.size(), + NS_LITERAL_CSTRING("POST"), false); + NS_ENSURE_SUCCESS(rv, rv); + + // Set the Safebrowsing cookie jar, so that the regular Google cookie is not + // sent with this request. See bug 897516. + DocShellOriginAttributes attrs; + attrs.mAppId = NECKO_SAFEBROWSING_APP_ID; + nsCOMPtr<nsIInterfaceRequestor> loadContext = new mozilla::LoadContext(attrs); + rv = mChannel->SetNotificationCallbacks(loadContext); + NS_ENSURE_SUCCESS(rv, rv); + + uint32_t timeoutMs = Preferences::GetUint(PREF_SB_DOWNLOADS_REMOTE_TIMEOUT, 10000); + mTimeoutTimer = do_CreateInstance(NS_TIMER_CONTRACTID); + mTimeoutTimer->InitWithCallback(this, timeoutMs, nsITimer::TYPE_ONE_SHOT); + + rv = mChannel->AsyncOpen2(this); + NS_ENSURE_SUCCESS(rv, rv); + + return NS_OK; +} + +NS_IMETHODIMP +PendingLookup::Notify(nsITimer* aTimer) +{ + LOG(("Remote lookup timed out [this = %p]", this)); + MOZ_ASSERT(aTimer == mTimeoutTimer); + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_REMOTE_LOOKUP_TIMEOUT, + true); + mChannel->Cancel(NS_ERROR_NET_TIMEOUT); + mTimeoutTimer->Cancel(); + return NS_OK; +} + +/////////////////////////////////////////////////////////////////////////////// +// nsIObserver implementation +NS_IMETHODIMP +PendingLookup::Observe(nsISupports *aSubject, const char *aTopic, + const char16_t *aData) +{ + if (!strcmp(aTopic, "quit-application")) { + if (mTimeoutTimer) { + mTimeoutTimer->Cancel(); + mTimeoutTimer = nullptr; + } + if (mChannel) { + mChannel->Cancel(NS_ERROR_ABORT); + } + } + return NS_OK; +} + +//////////////////////////////////////////////////////////////////////////////// +//// nsIStreamListener +static nsresult +AppendSegmentToString(nsIInputStream* inputStream, + void *closure, + const char *rawSegment, + uint32_t toOffset, + uint32_t count, + uint32_t *writeCount) { + nsAutoCString* decodedData = static_cast<nsAutoCString*>(closure); + decodedData->Append(rawSegment, count); + *writeCount = count; + return NS_OK; +} + +NS_IMETHODIMP +PendingLookup::OnDataAvailable(nsIRequest *aRequest, + nsISupports *aContext, + nsIInputStream *aStream, + uint64_t offset, + uint32_t count) { + uint32_t read; + return aStream->ReadSegments(AppendSegmentToString, &mResponse, count, &read); +} + +NS_IMETHODIMP +PendingLookup::OnStartRequest(nsIRequest *aRequest, + nsISupports *aContext) { + return NS_OK; +} + +NS_IMETHODIMP +PendingLookup::OnStopRequest(nsIRequest *aRequest, + nsISupports *aContext, + nsresult aResult) { + NS_ENSURE_STATE(mCallback); + + bool shouldBlock = false; + uint32_t verdict = nsIApplicationReputationService::VERDICT_SAFE; + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_REMOTE_LOOKUP_TIMEOUT, + false); + + nsresult rv = OnStopRequestInternal(aRequest, aContext, aResult, + &shouldBlock, &verdict); + OnComplete(shouldBlock, rv, verdict); + return rv; +} + +nsresult +PendingLookup::OnStopRequestInternal(nsIRequest *aRequest, + nsISupports *aContext, + nsresult aResult, + bool* aShouldBlock, + uint32_t* aVerdict) { + if (NS_FAILED(aResult)) { + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER, + SERVER_RESPONSE_FAILED); + return aResult; + } + + *aShouldBlock = false; + *aVerdict = nsIApplicationReputationService::VERDICT_SAFE; + nsresult rv; + nsCOMPtr<nsIHttpChannel> channel = do_QueryInterface(aRequest, &rv); + if (NS_FAILED(rv)) { + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER, + SERVER_RESPONSE_FAILED); + return rv; + } + + uint32_t status = 0; + rv = channel->GetResponseStatus(&status); + if (NS_FAILED(rv)) { + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER, + SERVER_RESPONSE_FAILED); + return rv; + } + + if (status != 200) { + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER, + SERVER_RESPONSE_FAILED); + return NS_ERROR_NOT_AVAILABLE; + } + + std::string buf(mResponse.Data(), mResponse.Length()); + safe_browsing::ClientDownloadResponse response; + if (!response.ParseFromString(buf)) { + LOG(("Invalid protocol buffer response [this = %p]: %s", this, buf.c_str())); + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER, + SERVER_RESPONSE_INVALID); + return NS_ERROR_CANNOT_CONVERT_DATA; + } + + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER, + SERVER_RESPONSE_VALID); + // Clamp responses 0-7, we only know about 0-4 for now. + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER_VERDICT, + std::min<uint32_t>(response.verdict(), 7)); + switch(response.verdict()) { + case safe_browsing::ClientDownloadResponse::DANGEROUS: + *aShouldBlock = Preferences::GetBool(PREF_BLOCK_DANGEROUS, true); + *aVerdict = nsIApplicationReputationService::VERDICT_DANGEROUS; + break; + case safe_browsing::ClientDownloadResponse::DANGEROUS_HOST: + *aShouldBlock = Preferences::GetBool(PREF_BLOCK_DANGEROUS_HOST, true); + *aVerdict = nsIApplicationReputationService::VERDICT_DANGEROUS_HOST; + break; + case safe_browsing::ClientDownloadResponse::POTENTIALLY_UNWANTED: + *aShouldBlock = Preferences::GetBool(PREF_BLOCK_POTENTIALLY_UNWANTED, false); + *aVerdict = nsIApplicationReputationService::VERDICT_POTENTIALLY_UNWANTED; + break; + case safe_browsing::ClientDownloadResponse::UNCOMMON: + *aShouldBlock = Preferences::GetBool(PREF_BLOCK_UNCOMMON, false); + *aVerdict = nsIApplicationReputationService::VERDICT_UNCOMMON; + break; + default: + // Treat everything else as safe + break; + } + + return NS_OK; +} + +NS_IMPL_ISUPPORTS(ApplicationReputationService, + nsIApplicationReputationService) + +ApplicationReputationService* + ApplicationReputationService::gApplicationReputationService = nullptr; + +ApplicationReputationService* +ApplicationReputationService::GetSingleton() +{ + if (gApplicationReputationService) { + NS_ADDREF(gApplicationReputationService); + return gApplicationReputationService; + } + + // We're not initialized yet. + gApplicationReputationService = new ApplicationReputationService(); + if (gApplicationReputationService) { + NS_ADDREF(gApplicationReputationService); + } + + return gApplicationReputationService; +} + +ApplicationReputationService::ApplicationReputationService() +{ + LOG(("Application reputation service started up")); +} + +ApplicationReputationService::~ApplicationReputationService() { + LOG(("Application reputation service shutting down")); + MOZ_ASSERT(gApplicationReputationService == this); + gApplicationReputationService = nullptr; +} + +NS_IMETHODIMP +ApplicationReputationService::QueryReputation( + nsIApplicationReputationQuery* aQuery, + nsIApplicationReputationCallback* aCallback) { + LOG(("Starting application reputation check [query=%p]", aQuery)); + NS_ENSURE_ARG_POINTER(aQuery); + NS_ENSURE_ARG_POINTER(aCallback); + + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_COUNT, true); + nsresult rv = QueryReputationInternal(aQuery, aCallback); + if (NS_FAILED(rv)) { + Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SHOULD_BLOCK, + false); + aCallback->OnComplete(false, rv, + nsIApplicationReputationService::VERDICT_SAFE); + } + return NS_OK; +} + +nsresult ApplicationReputationService::QueryReputationInternal( + nsIApplicationReputationQuery* aQuery, + nsIApplicationReputationCallback* aCallback) { + nsresult rv; + // If malware checks aren't enabled, don't query application reputation. + if (!Preferences::GetBool(PREF_SB_MALWARE_ENABLED, false)) { + return NS_ERROR_NOT_AVAILABLE; + } + + if (!Preferences::GetBool(PREF_SB_DOWNLOADS_ENABLED, false)) { + return NS_ERROR_NOT_AVAILABLE; + } + + nsCOMPtr<nsIURI> uri; + rv = aQuery->GetSourceURI(getter_AddRefs(uri)); + NS_ENSURE_SUCCESS(rv, rv); + // Bail if the URI hasn't been set. + NS_ENSURE_STATE(uri); + + // Create a new pending lookup and start the call chain. + RefPtr<PendingLookup> lookup(new PendingLookup(aQuery, aCallback)); + NS_ENSURE_STATE(lookup); + + // Add an observer for shutdown + nsCOMPtr<nsIObserverService> observerService = + mozilla::services::GetObserverService(); + if (!observerService) { + return NS_ERROR_FAILURE; + } + + observerService->AddObserver(lookup, "quit-application", false); + return lookup->StartLookup(); +} |