IPC: Generalize FileDescriptorSet to MessageAttachmentSet
This is a preparation for crbug.com/448190, where we're going
to allow Mojo MessagePipe being sent over Chrome IPC.
The plan is that we'll extend existing FileDescriptorSet to
carry both platform handles and Mojo's MessagePipes, then
let ChannelMojo take care of these handles.
As the first step, this change renames FileDescriptorSet to
MessageAttachmentSet and moves it out from the OS_POSIX guard.
Although this change doesn't do anything significant, we'll
generalize it to carry both platform files and mojo handles
eventually.
R=agl@chromium.org, viettrungluu@chromium.org
BUG=448190
Review URL: https://codereview.chromium.org/835873004
Cr-Commit-Position: refs/heads/master@{#311546}
CrOS-Libchrome-Original-Commit: 4b5c28e2f3e3400b5e91129704368845688d40fe
diff --git a/ipc/ipc_message_attachment_set.cc b/ipc/ipc_message_attachment_set.cc
new file mode 100644
index 0000000..665f939
--- /dev/null
+++ b/ipc/ipc_message_attachment_set.cc
@@ -0,0 +1,177 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ipc/ipc_message_attachment_set.h"
+
+#include "base/logging.h"
+#include "base/posix/eintr_wrapper.h"
+
+#if defined(OS_POSIX)
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#endif // OS_POSIX
+
+namespace IPC {
+
+MessageAttachmentSet::MessageAttachmentSet()
+ : consumed_descriptor_highwater_(0) {
+}
+
+MessageAttachmentSet::~MessageAttachmentSet() {
+ if (consumed_descriptor_highwater_ == size())
+ return;
+
+ // We close all the owning descriptors. If this message should have
+ // been transmitted, then closing those with close flags set mirrors
+ // the expected behaviour.
+ //
+ // If this message was received with more descriptors than expected
+ // (which could a DOS against the browser by a rogue renderer) then all
+ // the descriptors have their close flag set and we free all the extra
+ // kernel resources.
+ LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed descriptors: "
+ << consumed_descriptor_highwater_ << "/" << size();
+}
+
+unsigned MessageAttachmentSet::size() const {
+#if defined(OS_POSIX)
+ return descriptors_.size();
+#else
+ return 0;
+#endif
+}
+
+#if defined(OS_POSIX)
+
+bool MessageAttachmentSet::AddToBorrow(base::PlatformFile fd) {
+ DCHECK_EQ(consumed_descriptor_highwater_, 0u);
+
+ if (size() == kMaxDescriptorsPerMessage) {
+ DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
+ return false;
+ }
+
+ descriptors_.push_back(fd);
+ return true;
+}
+
+bool MessageAttachmentSet::AddToOwn(base::ScopedFD fd) {
+ DCHECK_EQ(consumed_descriptor_highwater_, 0u);
+
+ if (size() == kMaxDescriptorsPerMessage) {
+ DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
+ return false;
+ }
+
+ descriptors_.push_back(fd.get());
+ owned_descriptors_.push_back(new base::ScopedFD(fd.Pass()));
+ DCHECK(size() <= kMaxDescriptorsPerMessage);
+ return true;
+}
+
+base::PlatformFile MessageAttachmentSet::TakeDescriptorAt(unsigned index) {
+ if (index >= size()) {
+ DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
+ return -1;
+ }
+
+ // We should always walk the descriptors in order, so it's reasonable to
+ // enforce this. Consider the case where a compromised renderer sends us
+ // the following message:
+ //
+ // ExampleMsg:
+ // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
+ //
+ // Here the renderer sent us a message which should have a descriptor, but
+ // actually sent two in an attempt to fill our fd table and kill us. By
+ // setting the index of the descriptor in the message to 1 (it should be
+ // 0), we would record a highwater of 1 and then consider all the
+ // descriptors to have been used.
+ //
+ // So we can either track of the use of each descriptor in a bitset, or we
+ // can enforce that we walk the indexes strictly in order.
+ //
+ // There's one more wrinkle: When logging messages, we may reparse them. So
+ // we have an exception: When the consumed_descriptor_highwater_ is at the
+ // end of the array and index 0 is requested, we reset the highwater value.
+ // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
+ // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
+ if (index == 0 && consumed_descriptor_highwater_ == descriptors_.size())
+ consumed_descriptor_highwater_ = 0;
+
+ if (index != consumed_descriptor_highwater_)
+ return -1;
+
+ consumed_descriptor_highwater_ = index + 1;
+
+ base::PlatformFile file = descriptors_[index];
+
+ // TODO(morrita): In production, descriptors_.size() should be same as
+ // owned_descriptors_.size() as all read descriptors are owned by Message.
+ // We have to do this because unit test breaks this assumption. It should be
+ // changed to exercise with own-able descriptors.
+ for (ScopedVector<base::ScopedFD>::const_iterator i =
+ owned_descriptors_.begin();
+ i != owned_descriptors_.end(); ++i) {
+ if ((*i)->get() == file) {
+ ignore_result((*i)->release());
+ break;
+ }
+ }
+
+ return file;
+}
+
+void MessageAttachmentSet::PeekDescriptors(base::PlatformFile* buffer) const {
+ std::copy(descriptors_.begin(), descriptors_.end(), buffer);
+}
+
+bool MessageAttachmentSet::ContainsDirectoryDescriptor() const {
+ struct stat st;
+
+ for (std::vector<base::PlatformFile>::const_iterator i = descriptors_.begin();
+ i != descriptors_.end(); ++i) {
+ if (fstat(*i, &st) == 0 && S_ISDIR(st.st_mode))
+ return true;
+ }
+
+ return false;
+}
+
+void MessageAttachmentSet::CommitAll() {
+ descriptors_.clear();
+ owned_descriptors_.clear();
+ consumed_descriptor_highwater_ = 0;
+}
+
+void MessageAttachmentSet::ReleaseFDsToClose(
+ std::vector<base::PlatformFile>* fds) {
+ for (ScopedVector<base::ScopedFD>::iterator i = owned_descriptors_.begin();
+ i != owned_descriptors_.end(); ++i) {
+ fds->push_back((*i)->release());
+ }
+
+ CommitAll();
+}
+
+void MessageAttachmentSet::AddDescriptorsToOwn(const base::PlatformFile* buffer,
+ unsigned count) {
+ DCHECK(count <= kMaxDescriptorsPerMessage);
+ DCHECK_EQ(size(), 0u);
+ DCHECK_EQ(consumed_descriptor_highwater_, 0u);
+
+ descriptors_.reserve(count);
+ owned_descriptors_.reserve(count);
+ for (unsigned i = 0; i < count; ++i) {
+ descriptors_.push_back(buffer[i]);
+ owned_descriptors_.push_back(new base::ScopedFD(buffer[i]));
+ }
+}
+
+#endif // OS_POSIX
+
+} // namespace IPC
+
+