1475641 - Move ProxyAutoConfig to socket process

Status: RESOLVED FIXED

(Core :: Networking: HTTP, enhancement, P3)

Description

[Alex Gaynor [:Alex_Gaynor]]

PAC files are javascript files, which are run to get proxy configuration automatically, as obtained via the network. The code for this runs in the parent process: https://searchfox.org/mozilla-central/source/netwerk/base/ProxyAutoConfig.cpp#754-756

As a result of this, someone able to exploit a vulnerability in the Javascript VM (not including the DOM, and with limited globals I believe) can, given a position on the network, exploit this vulnerability directly in the unsandboxed parent process -- not the sandboxed content process where we usually run JS.

We should endeavor to move PAC files into a sandboxed process. I imagine this could be happen either via (1) the upcoming network process, (2) spinning up a temporary child process to run the PAC file.

(This may not need to be s-s, since it's not a specific vulnerability, but I figured better safe than sorry to get the conversation started)

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

https://googleprojectzero.blogspot.com/2017/12/apacolypse-now-exploiting-windows-10-in_18.html has some good background on the issues around PAC.

When I filed this, I had forgotten that WPAD was a distinct spec from PAC; do we support WPAD? It looks like yes, but I'm not sure if it's on by default or not.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

(In reply to Alex Gaynor [:Alex_Gaynor] from comment #1)
> https://googleprojectzero.blogspot.com/2017/12/apacolypse-now-exploiting-
> windows-10-in_18.html has some good background on the issues around PAC.
> 
> When I filed this, I had forgotten that WPAD was a distinct spec from PAC;
> do we support WPAD? It looks like yes, but I'm not sure if it's on by
> default or not.

We do support WPAD, but not by default. The user has to manually enable it in the proxy settings.

Comment 3

[Kershaw Chang [:kershaw]]

This is actually a part of socket process project.

Comment 4

[Kershaw Chang [:kershaw]]

Attachment: Bug 1475641 - Move PAProxyAutoConfig to socket process, r=#necko

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/da95455590d7
Move PAProxyAutoConfig to socket process, r=necko-reviewers,dragana

Comment 6

[Narcis Beleuzu [:NarcisB]]

Backed out for marionette crashes on test_profile_management.py

Backout link: https://hg.mozilla.org/integration/autoland/rev/229a08cc3fa5a6db8b6ca7b5a0da43981da6e204
Log link: https://treeherder.mozilla.org/logviewer?job_id=352278841&repo=autoland&lineNumber=49127

Comment 7

[Narcis Beleuzu [:NarcisB]]

Please also check https://treeherder.mozilla.org/logviewer?job_id=352277604&repo=autoland&lineNumber=8090

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/45877c2e8d6b
Move PAProxyAutoConfig to socket process, r=necko-reviewers,dragana

Comment 9

[Cristian Tuns]

Backed out for causing GTest failures on SocketProcessChild.cpp

• Backout link
• Push with failures
• Failure Log

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/21bb8cd199ba
Move PAProxyAutoConfig to socket process, r=necko-reviewers,dragana

Comment 11

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/21bb8cd199ba