1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
|
#pragma once
// IWYU pragma: private, include "rlbox.hpp"
// IWYU pragma: friend "rlbox_.*\.hpp"
#include <cstring>
#include <type_traits>
#include "rlbox_helpers.hpp"
#include "rlbox_types.hpp"
#include "rlbox_unwrap.hpp"
#include "rlbox_wrapper_traits.hpp"
namespace rlbox {
#define KEEP_CAST_FRIENDLY \
template<typename T_C_Lhs, \
typename T_C_Rhs, \
typename T_C_Sbx, \
template<typename, typename> \
typename T_C_Wrap> \
friend inline tainted<T_C_Lhs, T_C_Sbx> sandbox_reinterpret_cast( \
const T_C_Wrap<T_C_Rhs, T_C_Sbx>& rhs) noexcept; \
\
template<typename T_C_Lhs, \
typename T_C_Rhs, \
typename T_C_Sbx, \
template<typename, typename> \
typename T_C_Wrap> \
friend inline tainted<T_C_Lhs, T_C_Sbx> sandbox_const_cast( \
const T_C_Wrap<T_C_Rhs, T_C_Sbx>& rhs) noexcept; \
\
template<typename T_C_Lhs, \
typename T_C_Rhs, \
typename T_C_Sbx, \
template<typename, typename> \
typename T_C_Wrap> \
friend inline tainted<T_C_Lhs, T_C_Sbx> sandbox_static_cast( \
const T_C_Wrap<T_C_Rhs, T_C_Sbx>& rhs) noexcept;
/**
* @brief The equivalent of a reinterpret_cast but operates on sandboxed values.
*/
template<typename T_Lhs,
typename T_Rhs,
typename T_Sbx,
template<typename, typename>
typename T_Wrap>
inline tainted<T_Lhs, T_Sbx> sandbox_reinterpret_cast(
const T_Wrap<T_Rhs, T_Sbx>& rhs) noexcept
{
static_assert(detail::rlbox_is_wrapper_v<T_Wrap<T_Rhs, T_Sbx>> &&
std::is_pointer_v<T_Lhs> && std::is_pointer_v<T_Rhs>,
"sandbox_reinterpret_cast on incompatible types");
tainted<T_Rhs, T_Sbx> taintedVal = rhs;
auto raw = reinterpret_cast<T_Lhs>(taintedVal.INTERNAL_unverified_safe());
auto ret = tainted<T_Lhs, T_Sbx>::internal_factory(raw);
return ret;
}
/**
* @brief The equivalent of a const_cast but operates on sandboxed values.
*/
template<typename T_Lhs,
typename T_Rhs,
typename T_Sbx,
template<typename, typename>
typename T_Wrap>
inline tainted<T_Lhs, T_Sbx> sandbox_const_cast(
const T_Wrap<T_Rhs, T_Sbx>& rhs) noexcept
{
static_assert(detail::rlbox_is_wrapper_v<T_Wrap<T_Rhs, T_Sbx>>,
"sandbox_const_cast on incompatible types");
tainted<T_Rhs, T_Sbx> taintedVal = rhs;
auto raw = const_cast<T_Lhs>(taintedVal.INTERNAL_unverified_safe());
auto ret = tainted<T_Lhs, T_Sbx>::internal_factory(raw);
return ret;
}
/**
* @brief The equivalent of a static_cast but operates on sandboxed values.
*/
template<typename T_Lhs,
typename T_Rhs,
typename T_Sbx,
template<typename, typename>
typename T_Wrap>
inline tainted<T_Lhs, T_Sbx> sandbox_static_cast(
const T_Wrap<T_Rhs, T_Sbx>& rhs) noexcept
{
static_assert(detail::rlbox_is_wrapper_v<T_Wrap<T_Rhs, T_Sbx>>,
"sandbox_static_cast on incompatible types");
tainted<T_Rhs, T_Sbx> taintedVal = rhs;
auto raw = static_cast<T_Lhs>(taintedVal.INTERNAL_unverified_safe());
auto ret = tainted<T_Lhs, T_Sbx>::internal_factory(raw);
return ret;
}
/**
* @brief Fill sandbox memory with a constant byte.
*/
template<typename T_Sbx,
typename T_Rhs,
typename T_Val,
typename T_Num,
template<typename, typename>
typename T_Wrap>
inline T_Wrap<T_Rhs*, T_Sbx> memset(rlbox_sandbox<T_Sbx>& sandbox,
T_Wrap<T_Rhs*, T_Sbx> ptr,
T_Val value,
T_Num num)
{
static_assert(detail::rlbox_is_tainted_or_vol_v<T_Wrap<T_Rhs, T_Sbx>>,
"memset called on non wrapped type");
static_assert(!std::is_const_v<T_Rhs>, "Destination is const");
auto num_val = detail::unwrap_value(num);
detail::dynamic_check(num_val <= sandbox.get_total_memory(),
"Called memset for memory larger than the sandbox");
tainted<T_Rhs*, T_Sbx> ptr_tainted = ptr;
void* dest_start = ptr_tainted.INTERNAL_unverified_safe();
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(dest_start, num_val);
std::memset(dest_start, detail::unwrap_value(value), num_val);
return ptr;
}
/**
* @brief types that do not need to be adjusted to fix ABI differences.
* Currently these are only char, wchar, float, and double
*/
template<typename T>
static constexpr bool can_type_be_memcopied =
std::is_same_v<char, std::remove_cv_t<T>> || std::is_same_v<wchar_t, std::remove_cv_t<T>> ||
std::is_same_v<float, std::remove_cv_t<T>> || std::is_same_v<double, std::remove_cv_t<T>> ||
std::is_same_v<char16_t, std::remove_cv_t<T>> || std::is_same_v<short, std::remove_cv_t<T>>;
/**
* @brief Copy to sandbox memory area. Note that memcpy is meant to be called on
* byte arrays does not adjust data according to ABI differences. If the
* programmer does accidentally call memcpy on buffers that needs ABI
* adjustment, this may cause compatibility issues, but will not cause a
* security issue as the destination is always a tainted or tainted_volatile
* pointer
*/
template<typename T_Sbx,
typename T_Rhs,
typename T_Lhs,
typename T_Num,
template<typename, typename>
typename T_Wrap>
inline T_Wrap<T_Rhs*, T_Sbx> memcpy(rlbox_sandbox<T_Sbx>& sandbox,
T_Wrap<T_Rhs*, T_Sbx> dest,
T_Lhs src,
T_Num num)
{
static_assert(detail::rlbox_is_tainted_or_vol_v<T_Wrap<T_Rhs, T_Sbx>>,
"memcpy called on non wrapped type");
static_assert(!std::is_const_v<T_Rhs>, "Destination is const");
auto num_val = detail::unwrap_value(num);
detail::dynamic_check(num_val <= sandbox.get_total_memory(),
"Called memcpy for memory larger than the sandbox");
tainted<T_Rhs*, T_Sbx> dest_tainted = dest;
void* dest_start = dest_tainted.INTERNAL_unverified_safe();
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(dest_start, num_val);
// src also needs to be checked, as we don't want to allow a src rand to start
// inside the sandbox and end outside, and vice versa
// src may or may not be a wrapper, so use unwrap_value
const void* src_start = detail::unwrap_value(src);
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(src_start, num_val);
std::memcpy(dest_start, src_start, num_val);
return dest;
}
/**
* @brief Compare data in sandbox memory area.
*/
template<typename T_Sbx, typename T_Rhs, typename T_Lhs, typename T_Num>
inline tainted_int_hint memcmp(rlbox_sandbox<T_Sbx>& sandbox,
T_Rhs&& dest,
T_Lhs&& src,
T_Num&& num)
{
static_assert(
detail::rlbox_is_tainted_or_vol_v<detail::remove_cv_ref_t<T_Rhs>> ||
detail::rlbox_is_tainted_or_vol_v<detail::remove_cv_ref_t<T_Lhs>>,
"memcmp called on non wrapped type");
auto num_val = detail::unwrap_value(num);
detail::dynamic_check(num_val <= sandbox.get_total_memory(),
"Called memcmp for memory larger than the sandbox");
void* dest_start = dest.INTERNAL_unverified_safe();
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(dest_start, num_val);
// src also needs to be checked, as we don't want to allow a src rand to start
// inside the sandbox and end outside, and vice versa
// src may or may not be a wrapper, so use unwrap_value
const void* src_start = detail::unwrap_value(src);
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(src_start, num_val);
int ret = std::memcmp(dest_start, src_start, num_val);
tainted_int_hint converted_ret(ret);
return converted_ret;
}
/**
* @brief This function either
* - copies the given buffer into the sandbox calling delete on the src
* OR
* - if the sandbox allows, adds the buffer to the existing sandbox memory
* @param sandbox Target sandbox
* @param src Raw pointer to the buffer
* @param num Number of T-sized elements in the buffer
* @param free_source_on_copy If the source buffer was copied, this variable
* controls whether copy_memory_or_grant_access should call delete on the src.
* This calls delete[] if num > 1.
* @param copied out parameter indicating if the source was copied or transfered
*/
template<typename T_Sbx, typename T>
tainted<T*, T_Sbx> copy_memory_or_grant_access(rlbox_sandbox<T_Sbx>& sandbox,
T* src,
size_t num,
bool free_source_on_copy,
bool& copied)
{
copied = false;
// This function is meant for byte buffers only
static_assert(can_type_be_memcopied<std::remove_pointer_t<T>>,
"copy_memory_or_grant_access not supported on this type as "
"there may be ABI differences");
// overflow ok
size_t source_size = num * sizeof(T);
// sandbox can grant access if it includes the following line
// using can_grant_deny_access = void;
if constexpr (detail::has_member_using_can_grant_deny_access_v<T_Sbx>) {
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(src, source_size);
bool success;
auto ret = sandbox.INTERNAL_grant_access(src, num, success);
if (success) {
return ret;
}
}
// Malloc in sandbox takes a uint32_t as the parameter, need a bounds check
detail::dynamic_check(num <= std::numeric_limits<uint32_t>::max(),
"Granting access too large a region");
using T_nocv = std::remove_cv_t<T>;
tainted<T_nocv*, T_Sbx> copy =
sandbox.template malloc_in_sandbox<T_nocv>(static_cast<uint32_t>(num));
if (!copy) {
return nullptr;
}
rlbox::memcpy(sandbox, copy, src, source_size);
if (free_source_on_copy) {
free(const_cast<void*>(reinterpret_cast<const void*>(src)));
}
copied = true;
return sandbox_const_cast<T*>(copy);
}
/**
* @brief This function either
* - copies the given buffer out of the sandbox calling free_in_sandbox on the
* src
* OR
* - if the sandbox allows, moves the buffer out of existing sandbox memory
* @param sandbox Target sandbox
* @param src Raw pointer to the buffer
* @param num Number of T-sized elements in the buffer
* @param free_source_on_copy If the source buffer was copied, this variable
* controls whether copy_memory_or_deny_access should call delete on the src.
* This calls delete[] if num > 1.
* @param copied out parameter indicating if the source was copied or transfered
*/
template<typename T_Sbx,
typename T,
template<typename, typename>
typename T_Wrap>
T* copy_memory_or_deny_access(rlbox_sandbox<T_Sbx>& sandbox,
T_Wrap<T*, T_Sbx> src,
size_t num,
bool free_source_on_copy,
bool& copied)
{
copied = false;
// This function is meant for byte buffers only - so char and char16
static_assert(can_type_be_memcopied<std::remove_pointer_t<T>>,
"copy_memory_or_deny_access not supported on this type as "
"there may be ABI differences");
// overflow ok
size_t source_size = num * sizeof(T);
// sandbox can grant access if it includes the following line
// using can_grant_deny_access = void;
if constexpr (detail::has_member_using_can_grant_deny_access_v<T_Sbx>) {
detail::check_range_doesnt_cross_app_sbx_boundary<T_Sbx>(
src.INTERNAL_unverified_safe(), source_size);
bool success;
auto ret = sandbox.INTERNAL_deny_access(src, num, success);
if (success) {
return ret;
}
}
auto copy = static_cast<T*>(malloc(source_size));
if (!copy) {
return nullptr;
}
tainted<T*, T_Sbx> src_tainted = src;
char* src_raw = src_tainted.copy_and_verify_buffer_address(
[](uintptr_t val) { return reinterpret_cast<char*>(val); }, num);
std::memcpy(copy, src_raw, source_size);
if (free_source_on_copy) {
sandbox.free_in_sandbox(src);
}
copied = true;
return copy;
}
}
|
