/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef mozilla_Fuzzyfox_h
#define mozilla_Fuzzyfox_h

#include "nsIObserver.h"
#include "nsIObserverService.h"
#include "nsISupportsPrimitives.h"
#include "nsThreadUtils.h"
#include "mozilla/TimeStamp.h"

/*
 * This topic publishes the new canonical time according to Fuzzyfox,
 * in microseconds since the epoch. If code needs to know the current time,
 * it should listen for this topic and keep track of the 'current' time,
 * so as to respect Fuzzyfox and be in sync with the rest of the browser's
 * timekeeping.
 */
#define FUZZYFOX_UPDATECLOCK_OBSERVER_TOPIC "fuzzyfox-update-clocks"

/*
 * For Fuzzyfox's security guarentees to hold, the browser must not execute
 * actions while it should be paused. We currently only pause the main thread,
 * so actions that occur on other threads should be queued until the browser
 * unpaused (and moreso than unpauses: until it reaches a downtick.)
 * This topic indicates when any queued outbound events should be delivered.
 * TODO: Bug 1484300 and 1484299 would apply this to other communication
 * channels
 */
#define FUZZYFOX_FIREOUTBOUND_OBSERVER_TOPIC "fuzzyfox-fire-outbound"

namespace mozilla {

/*
 * Fuzzyfox is an implementation of the Fermata concept presented in
 * Trusted Browsers for Uncertain Times.
 *
 * Web Browsers expose explicit (performance.now()) and implicit
 * (WebVTT, Video Frames) timers that, when combined with algorithmic
 * improvements such as edge thresholding, produce extremely high
 * resolution clocks.
 *
 * High Resolution clocks can be used to time network accesses, browser
 * cache reads, web page rendering, access to the CPU cache, and other
 * operations - and the time these operations take to perform can yield
 * detailed information about user information we want to keep private.
 *
 * Fuzzyfox limits the information disclosure by limiting an attacker's
 * ability to create a high resolution clock. It does this by introducing
 * a concept called 'fuzzy time' that degrades all clocks (explicit and
 * implicit). This is done through a combination of holding time constant
 * during program execution and pausing program execution.
 *
 * @InProceedings{KS16,
 *   author = {David Kohlbrenner and Hovav Shacham},
 *   title = {Trusted Browsers for Uncertain Times},
 *   booktitle = {Proceedings of USENIX Security 2016},
 *   pages = {463-80},
 *   year = 2016,
 *   editor = {Thorsten Holz and Stefan Savage},
 *   month = aug,
 *   organization = {USENIX}
 * }
 * https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_kohlbrenner.pdf
 *
 * Fuzzyfox is an adaptation of
 *   W.-M. Hu, “Reducing timing channels with fuzzy time,” in
 *   Proceedings of IEEE Security and Privacy (“Oakland”)
 *   1991, T. F. Lunt and J. McLean, Eds. IEEE Computer
 *   Society, May 1991, pp. 8–20.
 */
class Fuzzyfox final : public Runnable, public nsIObserver {
 public:
  NS_DECL_ISUPPORTS_INHERITED
  NS_DECL_NSIOBSERVER

  static void Start();

  NS_IMETHOD
  Run() override;

 private:
  Fuzzyfox();
  ~Fuzzyfox();

  uint64_t ActualTime();

  uint64_t PickDuration();

  void UpdateClocks(uint64_t aNewTime, TimeStamp aNewTimeStamp);

  uint64_t FloorToGrain(uint64_t aValue);

  TimeStamp FloorToGrain(TimeStamp aValue);

  uint64_t CeilToGrain(uint64_t aValue);

  TimeStamp CeilToGrain(TimeStamp aValue);

  bool mSanityCheck;
  uint64_t mStartTime;
  uint32_t mDuration;

  enum Tick {
    eUptick,
    eDowntick,
  };

  Tick mTickType;

  nsCOMPtr<nsIObserverService> mObs = nullptr;
  nsCOMPtr<nsISupportsPRInt64> mTimeUpdateWrapper = nullptr;

  static Atomic<bool, Relaxed> sFuzzyfoxEnabledPrefMapped;
};

}  // namespace mozilla

#endif /* mozilla_Fuzzyfox_h */