Home | History | Annotate | Download | only in src
      1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "sandbox/win/src/policy_engine_opcodes.h"
      6 
      7 #include "base/basictypes.h"
      8 #include "sandbox/win/src/sandbox_nt_types.h"
      9 #include "sandbox/win/src/sandbox_types.h"
     10 
     11 namespace {
     12 const unsigned short kMaxUniStrSize = 0xfffc;
     13 
     14 bool InitStringUnicode(const wchar_t* source, size_t length,
     15                        UNICODE_STRING* ustring) {
     16   ustring->Buffer = const_cast<wchar_t*>(source);
     17   ustring->Length = static_cast<USHORT>(length) * sizeof(wchar_t);
     18   if (length > kMaxUniStrSize) {
     19       return false;
     20   }
     21   ustring->MaximumLength = (NULL != source) ?
     22                                 ustring->Length + sizeof(wchar_t) : 0;
     23   return true;
     24 }
     25 
     26 }  // namespace
     27 
     28 namespace sandbox {
     29 
     30 SANDBOX_INTERCEPT NtExports g_nt;
     31 
     32 // Note: The opcodes are implemented as functions (as opposed to classes derived
     33 // from PolicyOpcode) because you should not add more member variables to the
     34 // PolicyOpcode class since it would cause object slicing on the target. So to
     35 // enforce that (instead of just trusting the developer) the opcodes became
     36 // just functions.
     37 //
     38 // In the code that follows I have keep the evaluation function and the factory
     39 // function together to stress the close relationship between both. For example,
     40 // only the factory method and the evaluation function know the stored argument
     41 // order and meaning.
     42 
     43 template <int>
     44 EvalResult OpcodeEval(PolicyOpcode* opcode, const ParameterSet* pp,
     45                       MatchContext* match);
     46 
     47 //////////////////////////////////////////////////////////////////////////////
     48 // Opcode OpAlwaysFalse:
     49 // Does not require input parameter.
     50 
     51 PolicyOpcode* OpcodeFactory::MakeOpAlwaysFalse(uint32 options) {
     52   return MakeBase(OP_ALWAYS_FALSE, options, -1);
     53 }
     54 
     55 template <>
     56 EvalResult OpcodeEval<OP_ALWAYS_FALSE>(PolicyOpcode* opcode,
     57                                        const ParameterSet* param,
     58                                        MatchContext* context) {
     59   UNREFERENCED_PARAMETER(opcode);
     60   UNREFERENCED_PARAMETER(param);
     61   UNREFERENCED_PARAMETER(context);
     62   return EVAL_FALSE;
     63 }
     64 
     65 //////////////////////////////////////////////////////////////////////////////
     66 // Opcode OpAlwaysTrue:
     67 // Does not require input parameter.
     68 
     69 PolicyOpcode* OpcodeFactory::MakeOpAlwaysTrue(uint32 options) {
     70   return MakeBase(OP_ALWAYS_TRUE, options, -1);
     71 }
     72 
     73 template <>
     74 EvalResult OpcodeEval<OP_ALWAYS_TRUE>(PolicyOpcode* opcode,
     75                                       const ParameterSet* param,
     76                                       MatchContext* context) {
     77   UNREFERENCED_PARAMETER(opcode);
     78   UNREFERENCED_PARAMETER(param);
     79   UNREFERENCED_PARAMETER(context);
     80   return EVAL_TRUE;
     81 }
     82 
     83 //////////////////////////////////////////////////////////////////////////////
     84 // Opcode OpAction:
     85 // Does not require input parameter.
     86 // Argument 0 contains the actual action to return.
     87 
     88 PolicyOpcode* OpcodeFactory::MakeOpAction(EvalResult action,
     89                                           uint32 options) {
     90   PolicyOpcode* opcode = MakeBase(OP_ACTION, options, 0);
     91   if (NULL == opcode) return NULL;
     92   opcode->SetArgument(0, action);
     93   return opcode;
     94 }
     95 
     96 template <>
     97 EvalResult OpcodeEval<OP_ACTION>(PolicyOpcode* opcode,
     98                                  const ParameterSet* param,
     99                                  MatchContext* context) {
    100   UNREFERENCED_PARAMETER(param);
    101   UNREFERENCED_PARAMETER(context);
    102   int action = 0;
    103   opcode->GetArgument(0, &action);
    104   return static_cast<EvalResult>(action);
    105 }
    106 
    107 //////////////////////////////////////////////////////////////////////////////
    108 // Opcode OpNumberMatch:
    109 // Requires a unsigned long or void* in selected_param
    110 // Argument 0 is the stored number to match.
    111 // Argument 1 is the C++ type of the 0th argument.
    112 
    113 PolicyOpcode* OpcodeFactory::MakeOpNumberMatch(int16 selected_param,
    114                                                unsigned long match,
    115                                                uint32 options) {
    116   PolicyOpcode* opcode = MakeBase(OP_NUMBER_MATCH, options, selected_param);
    117   if (NULL == opcode) return NULL;
    118   opcode->SetArgument(0, match);
    119   opcode->SetArgument(1, ULONG_TYPE);
    120   return opcode;
    121 }
    122 
    123 PolicyOpcode* OpcodeFactory::MakeOpVoidPtrMatch(int16 selected_param,
    124                                                 const void* match,
    125                                                 uint32 options) {
    126   PolicyOpcode* opcode = MakeBase(OP_NUMBER_MATCH, options, selected_param);
    127   if (NULL == opcode) return NULL;
    128   opcode->SetArgument(0, match);
    129   opcode->SetArgument(1, VOIDPTR_TYPE);
    130   return opcode;
    131 }
    132 
    133 template <>
    134 EvalResult OpcodeEval<OP_NUMBER_MATCH>(PolicyOpcode* opcode,
    135                                        const ParameterSet* param,
    136                                        MatchContext* context) {
    137   UNREFERENCED_PARAMETER(context);
    138   unsigned long value_ulong = 0;
    139   if (param->Get(&value_ulong)) {
    140     unsigned long match_ulong = 0;
    141     opcode->GetArgument(0, &match_ulong);
    142     return (match_ulong != value_ulong)? EVAL_FALSE : EVAL_TRUE;
    143   } else {
    144     const void* value_ptr = NULL;
    145     if (param->Get(&value_ptr)) {
    146       const void* match_ptr = NULL;
    147       opcode->GetArgument(0, &match_ptr);
    148       return (match_ptr != value_ptr)? EVAL_FALSE : EVAL_TRUE;
    149     }
    150   }
    151   return EVAL_ERROR;
    152 }
    153 
    154 //////////////////////////////////////////////////////////////////////////////
    155 // Opcode OpUlongMatchRange
    156 // Requires a unsigned long in selected_param.
    157 // Argument 0 is the stored lower bound to match.
    158 // Argument 1 is the stored upper bound to match.
    159 
    160 PolicyOpcode* OpcodeFactory::MakeOpUlongMatchRange(int16 selected_param,
    161                                                    unsigned long lower_bound,
    162                                                    unsigned long upper_bound,
    163                                                    uint32 options) {
    164   if (lower_bound > upper_bound) {
    165     return false;
    166   }
    167   PolicyOpcode* opcode = MakeBase(OP_ULONG_MATCH_RANGE, options,
    168                                   selected_param);
    169   if (NULL == opcode) return NULL;
    170   opcode->SetArgument(0, lower_bound);
    171   opcode->SetArgument(1, upper_bound);
    172   return opcode;
    173 }
    174 
    175 template <>
    176 EvalResult OpcodeEval<OP_ULONG_MATCH_RANGE>(PolicyOpcode* opcode,
    177                                             const ParameterSet* param,
    178                                             MatchContext* context) {
    179   UNREFERENCED_PARAMETER(context);
    180   unsigned long value = 0;
    181   if (!param->Get(&value)) return EVAL_ERROR;
    182 
    183   unsigned long lower_bound = 0;
    184   unsigned long upper_bound = 0;
    185   opcode->GetArgument(0, &lower_bound);
    186   opcode->GetArgument(1, &upper_bound);
    187   return((lower_bound <= value) && (upper_bound >= value))?
    188     EVAL_TRUE : EVAL_FALSE;
    189 }
    190 
    191 //////////////////////////////////////////////////////////////////////////////
    192 // Opcode OpUlongAndMatch:
    193 // Requires a unsigned long in selected_param.
    194 // Argument 0 is the stored number to match.
    195 
    196 PolicyOpcode* OpcodeFactory::MakeOpUlongAndMatch(int16 selected_param,
    197                                                  unsigned long match,
    198                                                  uint32 options) {
    199   PolicyOpcode* opcode = MakeBase(OP_ULONG_AND_MATCH, options, selected_param);
    200   if (NULL == opcode) return NULL;
    201   opcode->SetArgument(0, match);
    202   return opcode;
    203 }
    204 
    205 template <>
    206 EvalResult OpcodeEval<OP_ULONG_AND_MATCH>(PolicyOpcode* opcode,
    207                                           const ParameterSet* param,
    208                                           MatchContext* context) {
    209   UNREFERENCED_PARAMETER(context);
    210   unsigned long value = 0;
    211   if (!param->Get(&value)) return EVAL_ERROR;
    212 
    213   unsigned long number = 0;
    214   opcode->GetArgument(0, &number);
    215   return (number & value)? EVAL_TRUE : EVAL_FALSE;
    216 }
    217 
    218 //////////////////////////////////////////////////////////////////////////////
    219 // Opcode OpWStringMatch:
    220 // Requires a wchar_t* in selected_param.
    221 // Argument 0 is the byte displacement of the stored string.
    222 // Argument 1 is the lenght in chars of the stored string.
    223 // Argument 2 is the offset to apply on the input string. It has special values.
    224 // as noted in the header file.
    225 // Argument 3 is the string matching options.
    226 
    227 PolicyOpcode* OpcodeFactory::MakeOpWStringMatch(int16 selected_param,
    228                                                 const wchar_t* match_str,
    229                                                 int start_position,
    230                                                 StringMatchOptions match_opts,
    231                                                 uint32 options) {
    232   if (NULL == match_str) {
    233     return NULL;
    234   }
    235   if ('\0' == match_str[0]) {
    236     return NULL;
    237   }
    238 
    239   int lenght = lstrlenW(match_str);
    240 
    241   PolicyOpcode* opcode = MakeBase(OP_WSTRING_MATCH, options, selected_param);
    242   if (NULL == opcode) {
    243     return NULL;
    244   }
    245   ptrdiff_t delta_str = AllocRelative(opcode, match_str, wcslen(match_str)+1);
    246   if (0 == delta_str) {
    247     return NULL;
    248   }
    249   opcode->SetArgument(0, delta_str);
    250   opcode->SetArgument(1, lenght);
    251   opcode->SetArgument(2, start_position);
    252   opcode->SetArgument(3, match_opts);
    253   return opcode;
    254 }
    255 
    256 template<>
    257 EvalResult OpcodeEval<OP_WSTRING_MATCH>(PolicyOpcode* opcode,
    258                                         const ParameterSet* param,
    259                                         MatchContext* context) {
    260   if (NULL == context) {
    261     return EVAL_ERROR;
    262   }
    263   const wchar_t* source_str = NULL;
    264   if (!param->Get(&source_str)) return EVAL_ERROR;
    265 
    266   int start_position = 0;
    267   int match_len = 0;
    268   unsigned int match_opts = 0;
    269   opcode->GetArgument(1, &match_len);
    270   opcode->GetArgument(2, &start_position);
    271   opcode->GetArgument(3, &match_opts);
    272 
    273   const wchar_t* match_str = opcode->GetRelativeString(0);
    274   // Advance the source string to the last successfully evaluated position
    275   // according to the match context.
    276   source_str = &source_str[context->position];
    277   int source_len  = static_cast<int>(g_nt.wcslen(source_str));
    278 
    279   if (0 == source_len) {
    280     // If we reached the end of the source string there is nothing we can
    281     // match against.
    282     return EVAL_FALSE;
    283   }
    284   if (match_len > source_len) {
    285     // There can't be a positive match when the target string is bigger than
    286     // the source string
    287     return EVAL_FALSE;
    288   }
    289 
    290   BOOL case_sensitive = (match_opts & CASE_INSENSITIVE) ? TRUE : FALSE;
    291 
    292   // We have three cases, depending on the value of start_pos:
    293   // Case 1. We skip N characters and compare once.
    294   // Case 2: We skip to the end and compare once.
    295   // Case 3: We match the first substring (if we find any).
    296   if (start_position >= 0) {
    297     if (kSeekToEnd == start_position) {
    298         start_position = source_len - match_len;
    299     } else if (match_opts & EXACT_LENGHT) {
    300         // A sub-case of case 3 is when the EXACT_LENGHT flag is on
    301         // the match needs to be not just substring but full match.
    302         if ((match_len + start_position) != source_len) {
    303           return EVAL_FALSE;
    304         }
    305     }
    306 
    307     // Advance start_pos characters. Warning! this does not consider
    308     // utf16 encodings (surrogate pairs) or other Unicode 'features'.
    309     source_str += start_position;
    310 
    311     // Since we skipped, lets reevaluate just the lengths again.
    312     if ((match_len + start_position) > source_len) {
    313       return EVAL_FALSE;
    314     }
    315 
    316     UNICODE_STRING match_ustr;
    317     InitStringUnicode(match_str, match_len, &match_ustr);
    318     UNICODE_STRING source_ustr;
    319     InitStringUnicode(source_str, match_len, &source_ustr);
    320 
    321     if (0 == g_nt.RtlCompareUnicodeString(&match_ustr, &source_ustr,
    322                                           case_sensitive)) {
    323       // Match! update the match context.
    324       context->position += start_position + match_len;
    325       return EVAL_TRUE;
    326     } else {
    327       return EVAL_FALSE;
    328     }
    329   } else if (start_position < 0) {
    330     UNICODE_STRING match_ustr;
    331     InitStringUnicode(match_str, match_len, &match_ustr);
    332     UNICODE_STRING source_ustr;
    333     InitStringUnicode(source_str, match_len, &source_ustr);
    334 
    335     do {
    336       if (0 == g_nt.RtlCompareUnicodeString(&match_ustr, &source_ustr,
    337                                             case_sensitive)) {
    338         // Match! update the match context.
    339         context->position += (source_ustr.Buffer - source_str) + match_len;
    340         return EVAL_TRUE;
    341       }
    342       ++source_ustr.Buffer;
    343       --source_len;
    344     } while (source_len >= match_len);
    345   }
    346   return EVAL_FALSE;
    347 }
    348 
    349 //////////////////////////////////////////////////////////////////////////////
    350 // OpcodeMaker (other member functions).
    351 
    352 PolicyOpcode* OpcodeFactory::MakeBase(OpcodeID opcode_id,
    353                                       uint32 options,
    354                                       int16 selected_param) {
    355   if (memory_size() < sizeof(PolicyOpcode)) {
    356     return NULL;
    357   }
    358 
    359   // Create opcode using placement-new on the buffer memory.
    360   PolicyOpcode* opcode = new(memory_top_) PolicyOpcode();
    361 
    362   // Fill in the standard fields, that every opcode has.
    363   memory_top_ += sizeof(PolicyOpcode);
    364   opcode->opcode_id_ = opcode_id;
    365   opcode->options_ = static_cast<int16>(options);
    366   opcode->parameter_ = selected_param;
    367   return opcode;
    368 }
    369 
    370 ptrdiff_t OpcodeFactory::AllocRelative(void* start, const wchar_t* str,
    371                                        size_t lenght) {
    372   size_t bytes = lenght * sizeof(wchar_t);
    373   if (memory_size() < bytes) {
    374     return 0;
    375   }
    376   memory_bottom_ -= bytes;
    377   if (reinterpret_cast<UINT_PTR>(memory_bottom_) & 1) {
    378     // TODO(cpu) replace this for something better.
    379     ::DebugBreak();
    380   }
    381   memcpy(memory_bottom_, str, bytes);
    382   ptrdiff_t delta = memory_bottom_ - reinterpret_cast<char*>(start);
    383   return delta;
    384 }
    385 
    386 //////////////////////////////////////////////////////////////////////////////
    387 // Opcode evaluation dispatchers.
    388 
    389 // This function is the one and only entry for evaluating any opcode. It is
    390 // in charge of applying any relevant opcode options and calling EvaluateInner
    391 // were the actual dispatch-by-id is made. It would seem at first glance that
    392 // the dispatch should be done by virtual function (vtable) calls but you have
    393 // to remember that the opcodes are made in the broker process and copied as
    394 // raw memory to the target process.
    395 
    396 EvalResult PolicyOpcode::Evaluate(const ParameterSet* call_params,
    397                                   size_t param_count, MatchContext* match) {
    398   if (NULL == call_params) {
    399     return EVAL_ERROR;
    400   }
    401   const ParameterSet* selected_param = NULL;
    402   if (parameter_ >= 0) {
    403     if (static_cast<size_t>(parameter_) >= param_count) {
    404       return EVAL_ERROR;
    405     }
    406     selected_param = &call_params[parameter_];
    407   }
    408   EvalResult result = EvaluateHelper(selected_param, match);
    409 
    410   // Apply the general options regardless of the particular type of opcode.
    411   if (kPolNone == options_) {
    412     return result;
    413   }
    414 
    415   if (options_ & kPolNegateEval) {
    416     if (EVAL_TRUE == result) {
    417       result = EVAL_FALSE;
    418     } else if (EVAL_FALSE == result) {
    419       result = EVAL_TRUE;
    420     } else if (EVAL_ERROR != result) {
    421       result = EVAL_ERROR;
    422     }
    423   }
    424   if (NULL != match) {
    425     if (options_ & kPolClearContext) {
    426       match->Clear();
    427     }
    428     if (options_ & kPolUseOREval) {
    429       match->options = kPolUseOREval;
    430     }
    431   }
    432   return result;
    433 }
    434 
    435 #define OPCODE_EVAL(op, x, y, z) case op: return OpcodeEval<op>(x, y, z)
    436 
    437 EvalResult PolicyOpcode::EvaluateHelper(const ParameterSet* parameters,
    438                                        MatchContext* match) {
    439   switch (opcode_id_) {
    440     OPCODE_EVAL(OP_ALWAYS_FALSE, this, parameters, match);
    441     OPCODE_EVAL(OP_ALWAYS_TRUE, this, parameters, match);
    442     OPCODE_EVAL(OP_NUMBER_MATCH, this, parameters, match);
    443     OPCODE_EVAL(OP_ULONG_MATCH_RANGE, this, parameters, match);
    444     OPCODE_EVAL(OP_WSTRING_MATCH, this, parameters, match);
    445     OPCODE_EVAL(OP_ULONG_AND_MATCH, this, parameters, match);
    446     OPCODE_EVAL(OP_ACTION, this, parameters, match);
    447     default:
    448       return EVAL_ERROR;
    449   }
    450 }
    451 
    452 #undef OPCODE_EVAL
    453 
    454 }  // namespace sandbox
    455