1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2 /* vim: set ts=2 et sw=2 tw=80: */
3 /* This Source Code Form is subject to the terms of the Mozilla Public
4 * License, v. 2.0. If a copy of the MPL was not distributed with this
5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
7 #include "BackgroundFileSaver.h"
9 #include "ScopedNSSTypes.h"
10 #include "mozilla/ArrayAlgorithm.h"
11 #include "mozilla/Casting.h"
12 #include "mozilla/Logging.h"
13 #include "mozilla/ScopeExit.h"
14 #include "mozilla/Telemetry.h"
15 #include "nsCOMArray.h"
16 #include "nsComponentManagerUtils.h"
17 #include "nsDependentSubstring.h"
18 #include "nsIAsyncInputStream.h"
20 #include "nsIMutableArray.h"
22 #include "nsNetUtil.h"
23 #include "nsThreadUtils.h"
30 # include <wintrust.h>
36 // MOZ_LOG=BackgroundFileSaver:5
37 static LazyLogModule
prlog("BackgroundFileSaver");
38 #define LOG(args) MOZ_LOG(prlog, mozilla::LogLevel::Debug, args)
39 #define LOG_ENABLED() MOZ_LOG_TEST(prlog, mozilla::LogLevel::Debug)
41 ////////////////////////////////////////////////////////////////////////////////
45 * Buffer size for writing to the output file or reading from the input file.
47 #define BUFFERED_IO_SIZE (1024 * 32)
50 * When this upper limit is reached, the original request is suspended.
52 #define REQUEST_SUSPEND_AT (1024 * 1024 * 4)
55 * When this lower limit is reached, the original request is resumed.
57 #define REQUEST_RESUME_AT (1024 * 1024 * 2)
59 ////////////////////////////////////////////////////////////////////////////////
60 //// NotifyTargetChangeRunnable
63 * Runnable object used to notify the control thread that file contents will now
64 * be saved to the specified file.
66 class NotifyTargetChangeRunnable final
: public Runnable
{
68 NotifyTargetChangeRunnable(BackgroundFileSaver
* aSaver
, nsIFile
* aTarget
)
69 : Runnable("net::NotifyTargetChangeRunnable"),
73 NS_IMETHOD
Run() override
{ return mSaver
->NotifyTargetChange(mTarget
); }
76 RefPtr
<BackgroundFileSaver
> mSaver
;
77 nsCOMPtr
<nsIFile
> mTarget
;
80 ////////////////////////////////////////////////////////////////////////////////
81 //// BackgroundFileSaver
83 uint32_t BackgroundFileSaver::sThreadCount
= 0;
84 uint32_t BackgroundFileSaver::sTelemetryMaxThreadCount
= 0;
86 BackgroundFileSaver::BackgroundFileSaver() {
87 LOG(("Created BackgroundFileSaver [this = %p]", this));
90 BackgroundFileSaver::~BackgroundFileSaver() {
91 LOG(("Destroying BackgroundFileSaver [this = %p]", this));
94 // Called on the control thread.
95 nsresult
BackgroundFileSaver::Init() {
96 MOZ_ASSERT(NS_IsMainThread(), "This should be called on the main thread");
98 NS_NewPipe2(getter_AddRefs(mPipeInputStream
),
99 getter_AddRefs(mPipeOutputStream
), true, true, 0,
100 HasInfiniteBuffer() ? UINT32_MAX
: 0);
102 mControlEventTarget
= GetCurrentSerialEventTarget();
103 NS_ENSURE_TRUE(mControlEventTarget
, NS_ERROR_NOT_INITIALIZED
);
105 nsresult rv
= NS_CreateBackgroundTaskQueue("BgFileSaver",
106 getter_AddRefs(mBackgroundET
));
107 NS_ENSURE_SUCCESS(rv
, rv
);
110 if (sThreadCount
> sTelemetryMaxThreadCount
) {
111 sTelemetryMaxThreadCount
= sThreadCount
;
117 // Called on the control thread.
119 BackgroundFileSaver::GetObserver(nsIBackgroundFileSaverObserver
** aObserver
) {
120 NS_ENSURE_ARG_POINTER(aObserver
);
121 *aObserver
= do_AddRef(mObserver
).take();
125 // Called on the control thread.
127 BackgroundFileSaver::SetObserver(nsIBackgroundFileSaverObserver
* aObserver
) {
128 mObserver
= aObserver
;
132 // Called on the control thread.
134 BackgroundFileSaver::EnableAppend() {
135 MOZ_ASSERT(NS_IsMainThread(), "This should be called on the main thread");
137 MutexAutoLock
lock(mLock
);
143 // Called on the control thread.
145 BackgroundFileSaver::SetTarget(nsIFile
* aTarget
, bool aKeepPartial
) {
146 NS_ENSURE_ARG(aTarget
);
148 MutexAutoLock
lock(mLock
);
149 if (!mInitialTarget
) {
150 aTarget
->Clone(getter_AddRefs(mInitialTarget
));
151 mInitialTargetKeepPartial
= aKeepPartial
;
153 aTarget
->Clone(getter_AddRefs(mRenamedTarget
));
154 mRenamedTargetKeepPartial
= aKeepPartial
;
158 // After the worker thread wakes up because attention is requested, it will
159 // rename or create the target file as requested, and start copying data.
160 return GetWorkerThreadAttention(true);
163 // Called on the control thread.
165 BackgroundFileSaver::Finish(nsresult aStatus
) {
168 // This will cause the NS_AsyncCopy operation, if it's in progress, to consume
169 // all the data that is still in the pipe, and then finish.
170 rv
= mPipeOutputStream
->Close();
171 NS_ENSURE_SUCCESS(rv
, rv
);
173 // Ensure that, when we get attention from the worker thread, if no pending
174 // rename operation is waiting, the operation will complete.
176 MutexAutoLock
lock(mLock
);
177 mFinishRequested
= true;
178 if (NS_SUCCEEDED(mStatus
)) {
183 // After the worker thread wakes up because attention is requested, it will
184 // process the completion conditions, detect that completion is requested, and
185 // notify the main thread of the completion. If this function was called with
186 // a success code, we wait for the copy to finish before processing the
187 // completion conditions, otherwise we interrupt the copy immediately.
188 return GetWorkerThreadAttention(NS_FAILED(aStatus
));
192 BackgroundFileSaver::EnableSha256() {
193 MOZ_ASSERT(NS_IsMainThread(),
194 "Can't enable sha256 or initialize NSS off the main thread");
195 // Ensure Personal Security Manager is initialized. This is required for
196 // PK11_* operations to work.
198 nsCOMPtr
<nsISupports
> nssDummy
= do_GetService("@mozilla.org/psm;1", &rv
);
199 NS_ENSURE_SUCCESS(rv
, rv
);
200 MutexAutoLock
lock(mLock
);
201 mSha256Enabled
= true; // this will be read by the worker thread
206 BackgroundFileSaver::GetSha256Hash(nsACString
& aHash
) {
207 MOZ_ASSERT(NS_IsMainThread(), "Can't inspect sha256 off the main thread");
208 // We acquire a lock because mSha256 is written on the worker thread.
209 MutexAutoLock
lock(mLock
);
210 if (mSha256
.IsEmpty()) {
211 return NS_ERROR_NOT_AVAILABLE
;
218 BackgroundFileSaver::EnableSignatureInfo() {
219 MOZ_ASSERT(NS_IsMainThread(),
220 "Can't enable signature extraction off the main thread");
221 // Ensure Personal Security Manager is initialized.
223 nsCOMPtr
<nsISupports
> nssDummy
= do_GetService("@mozilla.org/psm;1", &rv
);
224 NS_ENSURE_SUCCESS(rv
, rv
);
225 MutexAutoLock
lock(mLock
);
226 mSignatureInfoEnabled
= true;
231 BackgroundFileSaver::GetSignatureInfo(
232 nsTArray
<nsTArray
<nsTArray
<uint8_t>>>& aSignatureInfo
) {
233 MOZ_ASSERT(NS_IsMainThread(), "Can't inspect signature off the main thread");
234 // We acquire a lock because mSignatureInfo is written on the worker thread.
235 MutexAutoLock
lock(mLock
);
236 if (!mComplete
|| !mSignatureInfoEnabled
) {
237 return NS_ERROR_NOT_AVAILABLE
;
239 for (const auto& signatureChain
: mSignatureInfo
) {
240 aSignatureInfo
.AppendElement(TransformIntoNewArray(
241 signatureChain
, [](const auto& element
) { return element
.Clone(); }));
246 // Called on the control thread.
247 nsresult
BackgroundFileSaver::GetWorkerThreadAttention(
248 bool aShouldInterruptCopy
) {
251 MutexAutoLock
lock(mLock
);
253 // We only require attention one time. If this function is called two times
254 // before the worker thread wakes up, and the first has aShouldInterruptCopy
255 // false and the second true, we won't forcibly interrupt the copy from the
256 // control thread. However, that never happens, because calling Finish with a
257 // success code is the only case that may result in aShouldInterruptCopy being
258 // false. In that case, we won't call this function again, because consumers
259 // should not invoke other methods on the control thread after calling Finish.
260 // And in any case, Finish already closes one end of the pipe, causing the
261 // copy to finish properly on its own.
262 if (mWorkerThreadAttentionRequested
) {
266 if (!mAsyncCopyContext
) {
267 // Background event queues are not shutdown and could be called after
268 // the queue is reset to null. To match the behavior of nsIThread
269 // return NS_ERROR_UNEXPECTED
270 if (!mBackgroundET
) {
271 return NS_ERROR_UNEXPECTED
;
274 // Copy is not in progress, post an event to handle the change manually.
275 rv
= mBackgroundET
->Dispatch(
276 NewRunnableMethod("net::BackgroundFileSaver::ProcessAttention", this,
277 &BackgroundFileSaver::ProcessAttention
),
278 NS_DISPATCH_EVENT_MAY_BLOCK
);
279 NS_ENSURE_SUCCESS(rv
, rv
);
281 } else if (aShouldInterruptCopy
) {
282 // Interrupt the copy. The copy will be resumed, if needed, by the
283 // ProcessAttention function, invoked by the AsyncCopyCallback function.
284 NS_CancelAsyncCopy(mAsyncCopyContext
, NS_ERROR_ABORT
);
287 // Indicate that attention has been requested successfully, there is no need
288 // to post another event until the worker thread processes the current one.
289 mWorkerThreadAttentionRequested
= true;
294 // Called on the worker thread.
296 void BackgroundFileSaver::AsyncCopyCallback(void* aClosure
, nsresult aStatus
) {
297 // We called NS_ADDREF_THIS when NS_AsyncCopy started, to keep the object
298 // alive even if other references disappeared. At the end of this method,
299 // we've finished using the object and can safely release our reference.
300 RefPtr
<BackgroundFileSaver
> self
=
301 dont_AddRef((BackgroundFileSaver
*)aClosure
);
303 MutexAutoLock
lock(self
->mLock
);
305 // Now that the copy was interrupted or terminated, any notification from
306 // the control thread requires an event to be posted to the worker thread.
307 self
->mAsyncCopyContext
= nullptr;
309 // When detecting failures, ignore the status code we use to interrupt.
310 if (NS_FAILED(aStatus
) && aStatus
!= NS_ERROR_ABORT
&&
311 NS_SUCCEEDED(self
->mStatus
)) {
312 self
->mStatus
= aStatus
;
316 (void)self
->ProcessAttention();
319 // Called on the worker thread.
320 nsresult
BackgroundFileSaver::ProcessAttention() {
323 // This function is called whenever the attention of the worker thread has
324 // been requested. This may happen in these cases:
325 // * We are about to start the copy for the first time. In this case, we are
326 // called from an event posted on the worker thread from the control thread
327 // by GetWorkerThreadAttention, and mAsyncCopyContext is null.
328 // * We have interrupted the copy for some reason. In this case, we are
329 // called by AsyncCopyCallback, and mAsyncCopyContext is null.
330 // * We are currently executing ProcessStateChange, and attention is requested
331 // by the control thread, for example because SetTarget or Finish have been
332 // called. In this case, we are called from from an event posted through
333 // GetWorkerThreadAttention. While mAsyncCopyContext was always null when
334 // the event was posted, at this point mAsyncCopyContext may not be null
335 // anymore, because ProcessStateChange may have started the copy before the
336 // event that called this function was processed on the worker thread.
337 // If mAsyncCopyContext is not null, we interrupt the copy and re-enter
338 // through AsyncCopyCallback. This allows us to check if, for instance, we
339 // should rename the target file. We will then restart the copy if needed.
341 // mAsyncCopyContext is only written on the worker thread (which we are on)
342 MOZ_ASSERT(!NS_IsMainThread());
344 // Even though we're the only thread that writes this, we have to take the
346 MutexAutoLock
lock(mLock
);
347 if (mAsyncCopyContext
) {
348 NS_CancelAsyncCopy(mAsyncCopyContext
, NS_ERROR_ABORT
);
352 // Use the current shared state to determine the next operation to execute.
353 rv
= ProcessStateChange();
355 // If something failed while processing, terminate the operation now.
357 MutexAutoLock
lock(mLock
);
359 if (NS_SUCCEEDED(mStatus
)) {
363 // Ensure we notify completion now that the operation failed.
370 // Called on the worker thread.
371 nsresult
BackgroundFileSaver::ProcessStateChange() {
374 // We might have been notified because the operation is complete, verify.
375 if (CheckCompletion()) {
379 // Get a copy of the current shared state for the worker thread.
380 nsCOMPtr
<nsIFile
> initialTarget
;
381 bool initialTargetKeepPartial
;
382 nsCOMPtr
<nsIFile
> renamedTarget
;
383 bool renamedTargetKeepPartial
;
387 MutexAutoLock
lock(mLock
);
389 initialTarget
= mInitialTarget
;
390 initialTargetKeepPartial
= mInitialTargetKeepPartial
;
391 renamedTarget
= mRenamedTarget
;
392 renamedTargetKeepPartial
= mRenamedTargetKeepPartial
;
393 sha256Enabled
= mSha256Enabled
;
396 // From now on, another attention event needs to be posted if state changes.
397 mWorkerThreadAttentionRequested
= false;
400 // The initial target can only be null if it has never been assigned. In this
401 // case, there is nothing to do since we never created any output file.
402 if (!initialTarget
) {
406 // Determine if we are processing the attention request for the first time.
407 bool isContinuation
= !!mActualTarget
;
408 if (!isContinuation
) {
409 // Assign the target file for the first time.
410 mActualTarget
= initialTarget
;
411 mActualTargetKeepPartial
= initialTargetKeepPartial
;
414 // Verify whether we have actually been instructed to use a different file.
415 // This may happen the first time this function is executed, if SetTarget was
416 // called two times before the worker thread processed the attention request.
417 bool equalToCurrent
= false;
419 rv
= mActualTarget
->Equals(renamedTarget
, &equalToCurrent
);
420 NS_ENSURE_SUCCESS(rv
, rv
);
421 if (!equalToCurrent
) {
422 // If we were asked to rename the file but the initial file did not exist,
423 // we simply create the file in the renamed location. We avoid this check
424 // if we have already started writing the output file ourselves.
426 if (!isContinuation
) {
427 rv
= mActualTarget
->Exists(&exists
);
428 NS_ENSURE_SUCCESS(rv
, rv
);
431 // We are moving the previous target file to a different location.
432 nsCOMPtr
<nsIFile
> renamedTargetParentDir
;
433 rv
= renamedTarget
->GetParent(getter_AddRefs(renamedTargetParentDir
));
434 NS_ENSURE_SUCCESS(rv
, rv
);
436 nsAutoString renamedTargetName
;
437 rv
= renamedTarget
->GetLeafName(renamedTargetName
);
438 NS_ENSURE_SUCCESS(rv
, rv
);
440 // We must delete any existing target file before moving the current
442 rv
= renamedTarget
->Exists(&exists
);
443 NS_ENSURE_SUCCESS(rv
, rv
);
445 rv
= renamedTarget
->Remove(false);
446 NS_ENSURE_SUCCESS(rv
, rv
);
449 // Move the file. If this fails, we still reference the original file
450 // in mActualTarget, so that it is deleted if requested. If this
451 // succeeds, the nsIFile instance referenced by mActualTarget mutates
452 // and starts pointing to the new file, but we'll discard the reference.
453 rv
= mActualTarget
->MoveTo(renamedTargetParentDir
, renamedTargetName
);
454 NS_ENSURE_SUCCESS(rv
, rv
);
457 // We should not only update the mActualTarget with renameTarget when
458 // they point to the different files.
459 // In this way, if mActualTarget and renamedTarget point to the same file
460 // with different addresses, "CheckCompletion()" will return false
464 // Update mActualTarget with renameTarget,
465 // even if they point to the same file.
466 mActualTarget
= renamedTarget
;
467 mActualTargetKeepPartial
= renamedTargetKeepPartial
;
470 // Notify if the target file name actually changed.
471 if (!equalToCurrent
) {
472 // We must clone the nsIFile instance because mActualTarget is not
473 // immutable, it may change if the target is renamed later.
474 nsCOMPtr
<nsIFile
> actualTargetToNotify
;
475 rv
= mActualTarget
->Clone(getter_AddRefs(actualTargetToNotify
));
476 NS_ENSURE_SUCCESS(rv
, rv
);
478 RefPtr
<NotifyTargetChangeRunnable
> event
=
479 new NotifyTargetChangeRunnable(this, actualTargetToNotify
);
480 NS_ENSURE_TRUE(event
, NS_ERROR_FAILURE
);
482 rv
= mControlEventTarget
->Dispatch(event
, NS_DISPATCH_NORMAL
);
483 NS_ENSURE_SUCCESS(rv
, rv
);
486 if (isContinuation
) {
487 // The pending rename operation might be the last task before finishing. We
488 // may return here only if we have already created the target file.
489 if (CheckCompletion()) {
493 // Even if the operation did not complete, the pipe input stream may be
494 // empty and may have been closed already. We detect this case using the
495 // Available property, because it never returns an error if there is more
496 // data to be consumed. If the pipe input stream is closed, we just exit
497 // and wait for more calls like SetTarget or Finish to be invoked on the
498 // control thread. However, we still truncate the file or create the
499 // initial digest context if we are expected to do that.
501 rv
= mPipeInputStream
->Available(&available
);
507 // Create the digest if requested and NSS hasn't been shut down.
508 if (sha256Enabled
&& mDigest
.isNothing()) {
509 mDigest
.emplace(Digest());
510 mDigest
->Begin(SEC_OID_SHA256
);
513 // When we are requested to append to an existing file, we should read the
514 // existing data and ensure we include it as part of the final hash.
515 if (mDigest
.isSome() && append
&& !isContinuation
) {
516 nsCOMPtr
<nsIInputStream
> inputStream
;
517 rv
= NS_NewLocalFileInputStream(getter_AddRefs(inputStream
), mActualTarget
,
518 PR_RDONLY
| nsIFile::OS_READAHEAD
);
519 if (rv
!= NS_ERROR_FILE_NOT_FOUND
) {
520 NS_ENSURE_SUCCESS(rv
, rv
);
522 // Try to clean up the inputStream if an error occurs.
524 mozilla::MakeScopeExit([&] { Unused
<< inputStream
->Close(); });
526 char buffer
[BUFFERED_IO_SIZE
];
529 rv
= inputStream
->Read(buffer
, BUFFERED_IO_SIZE
, &count
);
530 NS_ENSURE_SUCCESS(rv
, rv
);
533 // We reached the end of the file.
537 rv
= mDigest
->Update(BitwiseCast
<unsigned char*, char*>(buffer
), count
);
538 NS_ENSURE_SUCCESS(rv
, rv
);
540 // The pending resume operation may have been cancelled by the control
541 // thread while the worker thread was reading in the existing file.
542 // Abort reading in the original file in that case, as the digest will
543 // be discarded anyway.
544 MutexAutoLock
lock(mLock
);
545 if (NS_FAILED(mStatus
)) {
546 return NS_ERROR_ABORT
;
550 // Close explicitly to handle any errors.
551 closeGuard
.release();
552 rv
= inputStream
->Close();
553 NS_ENSURE_SUCCESS(rv
, rv
);
557 // We will append to the initial target file only if it was requested by the
558 // caller, but we'll always append on subsequent accesses to the target file.
559 int32_t creationIoFlags
;
560 if (isContinuation
) {
561 creationIoFlags
= PR_APPEND
;
563 creationIoFlags
= (append
? PR_APPEND
: PR_TRUNCATE
) | PR_CREATE_FILE
;
566 // Create the target file, or append to it if we already started writing it.
567 // The 0600 permissions are used while the file is being downloaded, and for
568 // interrupted downloads. Those may be located in the system temporary
569 // directory, as well as the target directory, and generally have a ".part"
570 // extension. Those part files should never be group or world-writable even
571 // if the umask allows it.
572 nsCOMPtr
<nsIOutputStream
> outputStream
;
573 rv
= NS_NewLocalFileOutputStream(getter_AddRefs(outputStream
), mActualTarget
,
574 PR_WRONLY
| creationIoFlags
, 0600);
575 NS_ENSURE_SUCCESS(rv
, rv
);
577 nsCOMPtr
<nsIOutputStream
> bufferedStream
;
578 rv
= NS_NewBufferedOutputStream(getter_AddRefs(bufferedStream
),
579 outputStream
.forget(), BUFFERED_IO_SIZE
);
580 NS_ENSURE_SUCCESS(rv
, rv
);
581 outputStream
= bufferedStream
;
583 // Wrap the output stream so that it feeds the digest if needed.
584 if (mDigest
.isSome()) {
585 // Constructing the DigestOutputStream cannot fail. Passing mDigest
586 // to DigestOutputStream is safe, because BackgroundFileSaver always
587 // outlives the outputStream. BackgroundFileSaver is reference-counted
588 // before the call to AsyncCopy, and mDigest is never destroyed
589 // before AsyncCopyCallback.
590 outputStream
= new DigestOutputStream(outputStream
, mDigest
.ref());
593 // Start copying our input to the target file. No errors can be raised past
594 // this point if the copy starts, since they should be handled by the thread.
596 MutexAutoLock
lock(mLock
);
598 rv
= NS_AsyncCopy(mPipeInputStream
, outputStream
, mBackgroundET
,
599 NS_ASYNCCOPY_VIA_READSEGMENTS
, 4096, AsyncCopyCallback
,
600 this, false, true, getter_AddRefs(mAsyncCopyContext
),
601 GetProgressCallback());
603 NS_WARNING("NS_AsyncCopy failed.");
604 mAsyncCopyContext
= nullptr;
609 // If the operation succeeded, we must ensure that we keep this object alive
610 // for the entire duration of the copy, since only the raw pointer will be
611 // provided as the argument of the AsyncCopyCallback function. We can add the
612 // reference now, after NS_AsyncCopy returned, because it always starts
613 // processing asynchronously, and there is no risk that the callback is
614 // invoked before we reach this point. If the operation failed instead, then
615 // AsyncCopyCallback will never be called.
621 // Called on the worker thread.
622 bool BackgroundFileSaver::CheckCompletion() {
627 MutexAutoLock
lock(mLock
);
628 MOZ_ASSERT(!mAsyncCopyContext
,
629 "Should not be copying when checking completion conditions.");
635 // If an error occurred, we don't need to do the checks in this code block,
636 // and the operation can be completed immediately with a failure code.
637 if (NS_SUCCEEDED(mStatus
)) {
640 // We did not incur in an error, so we must determine if we can stop now.
641 // If the Finish method has not been called, we can just continue now.
642 if (!mFinishRequested
) {
646 // We can only stop when all the operations requested by the control
647 // thread have been processed. First, we check whether we have processed
648 // the first SetTarget call, if any. Then, we check whether we have
649 // processed any rename requested by subsequent SetTarget calls.
650 if ((mInitialTarget
&& !mActualTarget
) ||
651 (mRenamedTarget
&& mRenamedTarget
!= mActualTarget
)) {
655 // If we still have data to write to the output file, allow the copy
656 // operation to resume. The Available getter may return an error if one
657 // of the pipe's streams has been already closed.
659 rv
= mPipeInputStream
->Available(&available
);
660 if (NS_SUCCEEDED(rv
) && available
!= 0) {
668 // Ensure we notify completion now that the operation finished.
669 // Do a best-effort attempt to remove the file if required.
670 if (failed
&& mActualTarget
&& !mActualTargetKeepPartial
) {
671 (void)mActualTarget
->Remove(false);
674 // Finish computing the hash
675 if (!failed
&& mDigest
.isSome()) {
676 nsTArray
<uint8_t> outArray
;
677 rv
= mDigest
->End(outArray
);
678 if (NS_SUCCEEDED(rv
)) {
679 MutexAutoLock
lock(mLock
);
680 mSha256
= nsDependentCSubstring(
681 BitwiseCast
<char*, uint8_t*>(outArray
.Elements()), outArray
.Length());
685 // Compute the signature of the binary. ExtractSignatureInfo doesn't do
686 // anything on non-Windows platforms except return an empty nsIArray.
687 if (!failed
&& mActualTarget
) {
689 mActualTarget
->GetTarget(filePath
);
690 nsresult rv
= ExtractSignatureInfo(filePath
);
692 LOG(("Unable to extract signature information [this = %p].", this));
694 LOG(("Signature extraction success! [this = %p]", this));
698 // Post an event to notify that the operation completed.
699 if (NS_FAILED(mControlEventTarget
->Dispatch(
700 NewRunnableMethod("BackgroundFileSaver::NotifySaveComplete", this,
701 &BackgroundFileSaver::NotifySaveComplete
),
702 NS_DISPATCH_NORMAL
))) {
703 NS_WARNING("Unable to post completion event to the control thread.");
709 // Called on the control thread.
710 nsresult
BackgroundFileSaver::NotifyTargetChange(nsIFile
* aTarget
) {
712 (void)mObserver
->OnTargetChange(this, aTarget
);
718 // Called on the control thread.
719 nsresult
BackgroundFileSaver::NotifySaveComplete() {
720 MOZ_ASSERT(NS_IsMainThread(), "This should be called on the main thread");
724 MutexAutoLock
lock(mLock
);
729 (void)mObserver
->OnSaveComplete(this, status
);
730 // If mObserver keeps alive an enclosure that captures `this`, we'll have a
731 // cycle that won't be caught by the cycle-collector, so we need to break it
732 // when we're done here (see bug 1444265).
736 // At this point, the worker thread will not process any more events, and we
737 // can shut it down. Shutting down a thread may re-enter the event loop on
738 // this thread. This is not a problem in this case, since this function is
739 // called by a top-level event itself, and we have already invoked the
740 // completion observer callback. Re-entering the loop can only delay the
741 // final release and destruction of this saver object, since we are keeping a
742 // reference to it through the event object.
743 mBackgroundET
= nullptr;
747 // When there are no more active downloads, we consider the download session
748 // finished. We record the maximum number of concurrent downloads reached
749 // during the session in a telemetry histogram, and we reset the maximum
750 // thread counter for the next download session
751 if (sThreadCount
== 0) {
752 Telemetry::Accumulate(Telemetry::BACKGROUNDFILESAVER_THREAD_COUNT
,
753 sTelemetryMaxThreadCount
);
754 sTelemetryMaxThreadCount
= 0;
760 nsresult
BackgroundFileSaver::ExtractSignatureInfo(const nsAString
& filePath
) {
761 MOZ_ASSERT(!NS_IsMainThread(), "Cannot extract signature on main thread");
763 MutexAutoLock
lock(mLock
);
764 if (!mSignatureInfoEnabled
) {
769 // Setup the file to check.
770 WINTRUST_FILE_INFO fileToCheck
= {0};
771 fileToCheck
.cbStruct
= sizeof(WINTRUST_FILE_INFO
);
772 fileToCheck
.pcwszFilePath
= filePath
.Data();
773 fileToCheck
.hFile
= nullptr;
774 fileToCheck
.pgKnownSubject
= nullptr;
776 // We want to check it is signed and trusted.
777 WINTRUST_DATA trustData
= {0};
778 trustData
.cbStruct
= sizeof(trustData
);
779 trustData
.pPolicyCallbackData
= nullptr;
780 trustData
.pSIPClientData
= nullptr;
781 trustData
.dwUIChoice
= WTD_UI_NONE
;
782 trustData
.fdwRevocationChecks
= WTD_REVOKE_NONE
;
783 trustData
.dwUnionChoice
= WTD_CHOICE_FILE
;
784 trustData
.dwStateAction
= WTD_STATEACTION_VERIFY
;
785 trustData
.hWVTStateData
= nullptr;
786 trustData
.pwszURLReference
= nullptr;
787 // Disallow revocation checks over the network
788 trustData
.dwProvFlags
= WTD_CACHE_ONLY_URL_RETRIEVAL
;
790 trustData
.dwUIContext
= 0;
791 trustData
.pFile
= &fileToCheck
;
793 // The WINTRUST_ACTION_GENERIC_VERIFY_V2 policy verifies that the certificate
794 // chains up to a trusted root CA and has appropriate permissions to sign
796 GUID policyGUID
= WINTRUST_ACTION_GENERIC_VERIFY_V2
;
797 // Check if the file is signed by something that is trusted. If the file is
798 // not signed, this is a no-op.
799 LONG ret
= WinVerifyTrust(nullptr, &policyGUID
, &trustData
);
800 CRYPT_PROVIDER_DATA
* cryptoProviderData
= nullptr;
801 // According to the Windows documentation, we should check against 0 instead
802 // of ERROR_SUCCESS, which is an HRESULT.
804 cryptoProviderData
= WTHelperProvDataFromStateData(trustData
.hWVTStateData
);
806 if (cryptoProviderData
) {
807 // Lock because signature information is read on the main thread.
808 MutexAutoLock
lock(mLock
);
809 LOG(("Downloaded trusted and signed file [this = %p].", this));
810 // A binary may have multiple signers. Each signer may have multiple certs
812 for (DWORD i
= 0; i
< cryptoProviderData
->csSigners
; ++i
) {
813 const CERT_CHAIN_CONTEXT
* certChainContext
=
814 cryptoProviderData
->pasSigners
[i
].pChainContext
;
815 if (!certChainContext
) {
818 for (DWORD j
= 0; j
< certChainContext
->cChain
; ++j
) {
819 const CERT_SIMPLE_CHAIN
* certSimpleChain
=
820 certChainContext
->rgpChain
[j
];
821 if (!certSimpleChain
) {
825 nsTArray
<nsTArray
<uint8_t>> certList
;
826 bool extractionSuccess
= true;
827 for (DWORD k
= 0; k
< certSimpleChain
->cElement
; ++k
) {
828 CERT_CHAIN_ELEMENT
* certChainElement
= certSimpleChain
->rgpElement
[k
];
829 if (certChainElement
->pCertContext
->dwCertEncodingType
!=
833 nsTArray
<uint8_t> cert
;
834 cert
.AppendElements(certChainElement
->pCertContext
->pbCertEncoded
,
835 certChainElement
->pCertContext
->cbCertEncoded
);
836 certList
.AppendElement(std::move(cert
));
838 if (extractionSuccess
) {
839 mSignatureInfo
.AppendElement(std::move(certList
));
843 // Free the provider data if cryptoProviderData is not null.
844 trustData
.dwStateAction
= WTD_STATEACTION_CLOSE
;
845 WinVerifyTrust(nullptr, &policyGUID
, &trustData
);
847 LOG(("Downloaded unsigned or untrusted file [this = %p].", this));
853 ////////////////////////////////////////////////////////////////////////////////
854 //// BackgroundFileSaverOutputStream
856 NS_IMPL_ISUPPORTS(BackgroundFileSaverOutputStream
, nsIBackgroundFileSaver
,
857 nsIOutputStream
, nsIAsyncOutputStream
,
858 nsIOutputStreamCallback
)
860 BackgroundFileSaverOutputStream::BackgroundFileSaverOutputStream()
861 : mAsyncWaitCallback(nullptr) {}
863 bool BackgroundFileSaverOutputStream::HasInfiniteBuffer() { return false; }
865 nsAsyncCopyProgressFun
BackgroundFileSaverOutputStream::GetProgressCallback() {
870 BackgroundFileSaverOutputStream::Close() { return mPipeOutputStream
->Close(); }
873 BackgroundFileSaverOutputStream::Flush() { return mPipeOutputStream
->Flush(); }
876 BackgroundFileSaverOutputStream::StreamStatus() {
877 return mPipeOutputStream
->StreamStatus();
881 BackgroundFileSaverOutputStream::Write(const char* aBuf
, uint32_t aCount
,
883 return mPipeOutputStream
->Write(aBuf
, aCount
, _retval
);
887 BackgroundFileSaverOutputStream::WriteFrom(nsIInputStream
* aFromStream
,
888 uint32_t aCount
, uint32_t* _retval
) {
889 return mPipeOutputStream
->WriteFrom(aFromStream
, aCount
, _retval
);
893 BackgroundFileSaverOutputStream::WriteSegments(nsReadSegmentFun aReader
,
894 void* aClosure
, uint32_t aCount
,
896 return mPipeOutputStream
->WriteSegments(aReader
, aClosure
, aCount
, _retval
);
900 BackgroundFileSaverOutputStream::IsNonBlocking(bool* _retval
) {
901 return mPipeOutputStream
->IsNonBlocking(_retval
);
905 BackgroundFileSaverOutputStream::CloseWithStatus(nsresult reason
) {
906 return mPipeOutputStream
->CloseWithStatus(reason
);
910 BackgroundFileSaverOutputStream::AsyncWait(nsIOutputStreamCallback
* aCallback
,
912 uint32_t aRequestedCount
,
913 nsIEventTarget
* aEventTarget
) {
914 NS_ENSURE_STATE(!mAsyncWaitCallback
);
916 mAsyncWaitCallback
= aCallback
;
918 return mPipeOutputStream
->AsyncWait(this, aFlags
, aRequestedCount
,
923 BackgroundFileSaverOutputStream::OnOutputStreamReady(
924 nsIAsyncOutputStream
* aStream
) {
925 NS_ENSURE_STATE(mAsyncWaitCallback
);
927 nsCOMPtr
<nsIOutputStreamCallback
> asyncWaitCallback
= nullptr;
928 asyncWaitCallback
.swap(mAsyncWaitCallback
);
930 return asyncWaitCallback
->OnOutputStreamReady(this);
933 ////////////////////////////////////////////////////////////////////////////////
934 //// BackgroundFileSaverStreamListener
936 NS_IMPL_ISUPPORTS(BackgroundFileSaverStreamListener
, nsIBackgroundFileSaver
,
937 nsIRequestObserver
, nsIStreamListener
)
939 bool BackgroundFileSaverStreamListener::HasInfiniteBuffer() { return true; }
941 nsAsyncCopyProgressFun
942 BackgroundFileSaverStreamListener::GetProgressCallback() {
943 return AsyncCopyProgressCallback
;
947 BackgroundFileSaverStreamListener::OnStartRequest(nsIRequest
* aRequest
) {
948 NS_ENSURE_ARG(aRequest
);
954 BackgroundFileSaverStreamListener::OnStopRequest(nsIRequest
* aRequest
,
955 nsresult aStatusCode
) {
956 // If an error occurred, cancel the operation immediately. On success, wait
957 // until the caller has determined whether the file should be renamed.
958 if (NS_FAILED(aStatusCode
)) {
966 BackgroundFileSaverStreamListener::OnDataAvailable(nsIRequest
* aRequest
,
967 nsIInputStream
* aInputStream
,
972 NS_ENSURE_ARG(aRequest
);
974 // Read the requested data. Since the pipe has an infinite buffer, we don't
975 // expect any write error to occur here.
977 rv
= mPipeOutputStream
->WriteFrom(aInputStream
, aCount
, &writeCount
);
978 NS_ENSURE_SUCCESS(rv
, rv
);
980 // If reading from the input stream fails for any reason, the pipe will return
981 // a success code, but without reading all the data. Since we should be able
982 // to read the requested data when OnDataAvailable is called, raise an error.
983 if (writeCount
< aCount
) {
984 NS_WARNING("Reading from the input stream should not have failed.");
985 return NS_ERROR_UNEXPECTED
;
988 bool stateChanged
= false;
990 MutexAutoLock
lock(mSuspensionLock
);
992 if (!mReceivedTooMuchData
) {
994 nsresult rv
= mPipeInputStream
->Available(&available
);
995 if (NS_SUCCEEDED(rv
) && available
> REQUEST_SUSPEND_AT
) {
996 mReceivedTooMuchData
= true;
1004 NotifySuspendOrResume();
1010 // Called on the worker thread.
1012 void BackgroundFileSaverStreamListener::AsyncCopyProgressCallback(
1013 void* aClosure
, uint32_t aCount
) {
1014 BackgroundFileSaverStreamListener
* self
=
1015 (BackgroundFileSaverStreamListener
*)aClosure
;
1017 // Wait if the control thread is in the process of suspending or resuming.
1018 MutexAutoLock
lock(self
->mSuspensionLock
);
1020 // This function is called when some bytes are consumed by NS_AsyncCopy. Each
1021 // time this happens, verify if a suspended request should be resumed, because
1022 // we have now consumed enough data.
1023 if (self
->mReceivedTooMuchData
) {
1025 nsresult rv
= self
->mPipeInputStream
->Available(&available
);
1026 if (NS_FAILED(rv
) || available
< REQUEST_RESUME_AT
) {
1027 self
->mReceivedTooMuchData
= false;
1029 // Post an event to verify if the request should be resumed.
1030 if (NS_FAILED(self
->mControlEventTarget
->Dispatch(
1032 "BackgroundFileSaverStreamListener::NotifySuspendOrResume",
1034 &BackgroundFileSaverStreamListener::NotifySuspendOrResume
),
1035 NS_DISPATCH_NORMAL
))) {
1036 NS_WARNING("Unable to post resume event to the control thread.");
1042 // Called on the control thread.
1043 nsresult
BackgroundFileSaverStreamListener::NotifySuspendOrResume() {
1044 // Prevent the worker thread from changing state while processing.
1045 MutexAutoLock
lock(mSuspensionLock
);
1047 if (mReceivedTooMuchData
) {
1048 if (!mRequestSuspended
) {
1049 // Try to suspend the request. If this fails, don't try to resume later.
1050 if (NS_SUCCEEDED(mRequest
->Suspend())) {
1051 mRequestSuspended
= true;
1053 NS_WARNING("Unable to suspend the request.");
1057 if (mRequestSuspended
) {
1058 // Resume the request only if we succeeded in suspending it.
1059 if (NS_SUCCEEDED(mRequest
->Resume())) {
1060 mRequestSuspended
= false;
1062 NS_WARNING("Unable to resume the request.");
1070 ////////////////////////////////////////////////////////////////////////////////
1071 //// DigestOutputStream
1072 NS_IMPL_ISUPPORTS(DigestOutputStream
, nsIOutputStream
)
1074 DigestOutputStream::DigestOutputStream(nsIOutputStream
* aStream
,
1076 : mOutputStream(aStream
), mDigest(aDigest
) {
1077 MOZ_ASSERT(mOutputStream
, "Can't have null output stream");
1081 DigestOutputStream::Close() { return mOutputStream
->Close(); }
1084 DigestOutputStream::Flush() { return mOutputStream
->Flush(); }
1087 DigestOutputStream::StreamStatus() { return mOutputStream
->StreamStatus(); }
1090 DigestOutputStream::Write(const char* aBuf
, uint32_t aCount
, uint32_t* retval
) {
1091 nsresult rv
= mDigest
.Update(
1092 BitwiseCast
<const unsigned char*, const char*>(aBuf
), aCount
);
1093 NS_ENSURE_SUCCESS(rv
, rv
);
1095 return mOutputStream
->Write(aBuf
, aCount
, retval
);
1099 DigestOutputStream::WriteFrom(nsIInputStream
* aFromStream
, uint32_t aCount
,
1101 // Not supported. We could read the stream to a buf, call DigestOp on the
1102 // result, seek back and pass the stream on, but it's not worth it since our
1103 // application (NS_AsyncCopy) doesn't invoke this on the sink.
1104 MOZ_CRASH("DigestOutputStream::WriteFrom not implemented");
1108 DigestOutputStream::WriteSegments(nsReadSegmentFun aReader
, void* aClosure
,
1109 uint32_t aCount
, uint32_t* retval
) {
1110 MOZ_CRASH("DigestOutputStream::WriteSegments not implemented");
1114 DigestOutputStream::IsNonBlocking(bool* retval
) {
1115 return mOutputStream
->IsNonBlocking(retval
);
1121 } // namespace mozilla