Bug 1088488 - On Windows only, use librlz and SHA256 code to generate a device-bound node id inside plugin-container, pass to GMP. r=henri,r=jesup

dom/media/gmp/GMPLoader.cpp

@@ -13,6 +13,24 @@
 
 #include <string>
 
+#if defined(XP_WIN) && defined(MOZ_SANDBOX)
+#include "mozilla/sandboxTarget.h"
+#endif
+
+#if defined(HASH_NODE_ID_WITH_DEVICE_ID)
+// In order to provide EME plugins with a "device binding" capability,
+// in the parent we generate and store some random bytes as salt for every
+// (origin, urlBarOrigin) pair that uses EME. We store these bytes so
+// that every time we revisit the same origin we get the same salt.
+// We send this salt to the child on startup. The child collects some
+// device specific data and munges that with the salt to create the
+// "node id" that we expose to EME plugins. It then overwrites the device
+// specific data, and activates the sandbox.
+#include "rlz/lib/machine_id.h"
+#include "rlz/lib/string_utils.h"
+#include "sha256.h"
+#endif
+
 namespace mozilla {
 namespace gmp {
 
@@ -58,9 +76,41 @@ GMPLoaderImpl::Load(const char* aLibPath,
                     uint32_t aOriginSaltLen,
                     const GMPPlatformAPI* aPlatformAPI)
 {
-  std::string nodeId(aOriginSalt, aOriginSalt + aOriginSaltLen);
+  std::string nodeId;
+#ifdef HASH_NODE_ID_WITH_DEVICE_ID
+  if (aOriginSaltLen > 0) {
+    string16 deviceId;
+    int volumeId;
+    if (!rlz_lib::GetRawMachineId(&deviceId, &volumeId)) {
+      return false;
+    }
 
-  // TODO (subsequent patch): Hash node id with device id, send to GMP.
+    SHA256Context ctx;
+    SHA256_Begin(&ctx);
+    SHA256_Update(&ctx, (const uint8_t*)aOriginSalt, aOriginSaltLen);
+    SHA256_Update(&ctx, (const uint8_t*)deviceId.c_str(), deviceId.size() * sizeof(string16::value_type));
+    SHA256_Update(&ctx, (const uint8_t*)&volumeId, sizeof(int));
+    uint8_t digest[SHA256_LENGTH] = {0};
+    unsigned int digestLen = 0;
+    SHA256_End(&ctx, digest, &digestLen, SHA256_LENGTH);
+
+    // Overwrite all data involved in calculation as it could potentially
+    // identify the user, so there's no chance a GMP can read it and use
+    // it for identity tracking.
+    memset(&ctx, 0, sizeof(ctx));
+    memset(aOriginSalt, 0, aOriginSaltLen);
+    volumeId = 0;
+    memset(&deviceId[0], '*', sizeof(string16::value_type) * deviceId.size());
+    deviceId = L"";
+
+    if (!rlz_lib::BytesToString(digest, SHA256_LENGTH, &nodeId)) {
+      return false;
+    }
+  } else
+#endif
+  {
+    nodeId = std::string(aOriginSalt, aOriginSalt + aOriginSaltLen);
+  }
 
 #if defined(MOZ_GMP_SANDBOX)
   // Start the sandbox now that we've generated the device bound node id.
@@ -89,6 +139,11 @@ GMPLoaderImpl::Load(const char* aLibPath,
     return false;
   }
 
+  GMPSetNodeIdFunc setNodeIdFunc = reinterpret_cast<GMPSetNodeIdFunc>(PR_FindFunctionSymbol(mLib, "GMPSetNodeId"));
+  if (setNodeIdFunc) {
+    setNodeIdFunc(nodeId.c_str(), nodeId.size());
+  }
+
   mGetAPIFunc = reinterpret_cast<GMPGetAPIFunc>(PR_FindFunctionSymbol(mLib, "GMPGetAPI"));
   if (!mGetAPIFunc) {
     return false;

dom/media/gmp/gmp-api/gmp-entrypoints.h

@@ -63,4 +63,10 @@ typedef GMPErr (*GMPGetAPIFunc)(const char* aAPIName, void* aHostAPI, void** aPl
 // - Called on main thread.
 typedef void   (*GMPShutdownFunc)(void);
 
+// GMPSetNodeId
+// - Optional, not required to be implemented. Only useful for EME plugins.
+// - Called after GMPInit to set the device-bound origin-specific node id
+//   that this GMP instance is running under.
+typedef void   (*GMPSetNodeIdFunc)(const char* aNodeId, uint32_t aLength);
+
 #endif // GMP_ENTRYPOINTS_h_

ipc/app/moz.build

@@ -56,11 +56,11 @@ if CONFIG['MOZ_SANDBOX'] and CONFIG['OS_ARCH'] == 'WINNT':
         'nss3.dll',
         'xul.dll'
     ]
+    DEFINES['HASH_NODE_ID_WITH_DEVICE_ID'] = 1;
     SOURCES += [
         'sha256.c',
     ]
 
-
 if CONFIG['_MSC_VER']:
     # Always enter a Windows program through wmain, whether or not we're
     # a console application.