pkasting@chromium.org | 9687a8f | 2011-09-01 09:50:13 +0900 | [diff] [blame] | 1 | // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
morrita | 33a3590 | 2015-01-15 06:17:06 +0900 | [diff] [blame] | 5 | #include "ipc/ipc_message_attachment_set.h" |
agl@chromium.org | c1e93ea | 2010-06-11 06:39:04 +0900 | [diff] [blame] | 6 | |
avi | 42ebda4 | 2015-12-22 11:39:04 +0900 | [diff] [blame] | 7 | #include <stddef.h> |
| 8 | |
morrita | 6308f32 | 2015-01-27 07:42:54 +0900 | [diff] [blame] | 9 | #include <algorithm> |
avi | 42ebda4 | 2015-12-22 11:39:04 +0900 | [diff] [blame] | 10 | |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 11 | #include "base/logging.h" |
brettw@chromium.org | b1788fb | 2012-11-15 05:54:35 +0900 | [diff] [blame] | 12 | #include "base/posix/eintr_wrapper.h" |
avi | 42ebda4 | 2015-12-22 11:39:04 +0900 | [diff] [blame] | 13 | #include "build/build_config.h" |
morrita | 6308f32 | 2015-01-27 07:42:54 +0900 | [diff] [blame] | 14 | #include "ipc/ipc_message_attachment.h" |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 15 | |
morrita | 33a3590 | 2015-01-15 06:17:06 +0900 | [diff] [blame] | 16 | namespace IPC { |
| 17 | |
erikchen | fdd43fe | 2015-07-08 07:13:11 +0900 | [diff] [blame] | 18 | namespace { |
| 19 | |
| 20 | unsigned count_attachments_of_type( |
| 21 | const std::vector<scoped_refptr<MessageAttachment>>& attachments, |
| 22 | MessageAttachment::Type type) { |
| 23 | unsigned count = 0; |
| 24 | for (const scoped_refptr<MessageAttachment>& attachment : attachments) { |
| 25 | if (attachment->GetType() == type) |
| 26 | ++count; |
| 27 | } |
| 28 | return count; |
| 29 | } |
| 30 | |
| 31 | } // namespace |
| 32 | |
morrita | 33a3590 | 2015-01-15 06:17:06 +0900 | [diff] [blame] | 33 | MessageAttachmentSet::MessageAttachmentSet() |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 34 | : consumed_descriptor_highwater_(0) { |
| 35 | } |
| 36 | |
morrita | 33a3590 | 2015-01-15 06:17:06 +0900 | [diff] [blame] | 37 | MessageAttachmentSet::~MessageAttachmentSet() { |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 38 | if (consumed_descriptor_highwater_ == size()) |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 39 | return; |
| 40 | |
morrita | ab20725 | 2014-09-25 05:11:45 +0900 | [diff] [blame] | 41 | // We close all the owning descriptors. If this message should have |
| 42 | // been transmitted, then closing those with close flags set mirrors |
| 43 | // the expected behaviour. |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 44 | // |
| 45 | // If this message was received with more descriptors than expected |
| 46 | // (which could a DOS against the browser by a rogue renderer) then all |
| 47 | // the descriptors have their close flag set and we free all the extra |
| 48 | // kernel resources. |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 49 | LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed attachments: " |
| 50 | << consumed_descriptor_highwater_ << "/" << size(); |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 51 | } |
| 52 | |
morrita | 6308f32 | 2015-01-27 07:42:54 +0900 | [diff] [blame] | 53 | unsigned MessageAttachmentSet::num_descriptors() const { |
erikchen | fdd43fe | 2015-07-08 07:13:11 +0900 | [diff] [blame] | 54 | return count_attachments_of_type(attachments_, |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 55 | MessageAttachment::Type::PLATFORM_FILE); |
morrita | 33a3590 | 2015-01-15 06:17:06 +0900 | [diff] [blame] | 56 | } |
| 57 | |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 58 | unsigned MessageAttachmentSet::size() const { |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 59 | return static_cast<unsigned>(attachments_.size()); |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 60 | } |
| 61 | |
morrita | 7d1bfcc | 2015-01-31 14:45:42 +0900 | [diff] [blame] | 62 | bool MessageAttachmentSet::AddAttachment( |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 63 | scoped_refptr<MessageAttachment> attachment, |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 64 | size_t* index) { |
morrita | 7d1bfcc | 2015-01-31 14:45:42 +0900 | [diff] [blame] | 65 | #if defined(OS_POSIX) |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 66 | if (attachment->GetType() == MessageAttachment::Type::PLATFORM_FILE && |
morrita | 7d1bfcc | 2015-01-31 14:45:42 +0900 | [diff] [blame] | 67 | num_descriptors() == kMaxDescriptorsPerMessage) { |
| 68 | DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full."; |
| 69 | return false; |
| 70 | } |
| 71 | #endif |
| 72 | |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 73 | switch (attachment->GetType()) { |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 74 | case MessageAttachment::Type::PLATFORM_FILE: |
| 75 | case MessageAttachment::Type::MOJO_HANDLE: |
| 76 | case MessageAttachment::Type::WIN_HANDLE: |
| 77 | case MessageAttachment::Type::MACH_PORT: |
Scott Graham | 3038c29 | 2017-06-30 10:07:10 +0900 | [diff] [blame] | 78 | case MessageAttachment::Type::FUCHSIA_HANDLE: |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 79 | attachments_.push_back(attachment); |
| 80 | *index = attachments_.size() - 1; |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 81 | return true; |
| 82 | } |
| 83 | return false; |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 84 | } |
| 85 | |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 86 | bool MessageAttachmentSet::AddAttachment( |
| 87 | scoped_refptr<MessageAttachment> attachment) { |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 88 | size_t index; |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 89 | return AddAttachment(attachment, &index); |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 90 | } |
| 91 | |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 92 | scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt( |
| 93 | unsigned index) { |
| 94 | if (index >= size()) { |
| 95 | DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size(); |
morrita | 6308f32 | 2015-01-27 07:42:54 +0900 | [diff] [blame] | 96 | return scoped_refptr<MessageAttachment>(); |
morrita | ab20725 | 2014-09-25 05:11:45 +0900 | [diff] [blame] | 97 | } |
| 98 | |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 99 | // We should always walk the descriptors in order, so it's reasonable to |
| 100 | // enforce this. Consider the case where a compromised renderer sends us |
| 101 | // the following message: |
| 102 | // |
| 103 | // ExampleMsg: |
| 104 | // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m} |
| 105 | // |
| 106 | // Here the renderer sent us a message which should have a descriptor, but |
| 107 | // actually sent two in an attempt to fill our fd table and kill us. By |
| 108 | // setting the index of the descriptor in the message to 1 (it should be |
| 109 | // 0), we would record a highwater of 1 and then consider all the |
| 110 | // descriptors to have been used. |
| 111 | // |
| 112 | // So we can either track of the use of each descriptor in a bitset, or we |
| 113 | // can enforce that we walk the indexes strictly in order. |
| 114 | // |
| 115 | // There's one more wrinkle: When logging messages, we may reparse them. So |
| 116 | // we have an exception: When the consumed_descriptor_highwater_ is at the |
| 117 | // end of the array and index 0 is requested, we reset the highwater value. |
morrita | ab20725 | 2014-09-25 05:11:45 +0900 | [diff] [blame] | 118 | // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer |
| 119 | // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294 |
sammc | 1458336 | 2016-11-23 12:17:35 +0900 | [diff] [blame] | 120 | if (index == 0 && consumed_descriptor_highwater_ == size()) { |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 121 | consumed_descriptor_highwater_ = 0; |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 122 | } |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 123 | |
| 124 | if (index != consumed_descriptor_highwater_) |
morrita | 6308f32 | 2015-01-27 07:42:54 +0900 | [diff] [blame] | 125 | return scoped_refptr<MessageAttachment>(); |
agl@chromium.org | 1c6dcf2 | 2009-07-23 08:57:21 +0900 | [diff] [blame] | 126 | |
| 127 | consumed_descriptor_highwater_ = index + 1; |
morrita | ab20725 | 2014-09-25 05:11:45 +0900 | [diff] [blame] | 128 | |
morrita | 6308f32 | 2015-01-27 07:42:54 +0900 | [diff] [blame] | 129 | return attachments_[index]; |
| 130 | } |
morrita | ab20725 | 2014-09-25 05:11:45 +0900 | [diff] [blame] | 131 | |
erikchen | c8fa421 | 2015-10-10 11:43:49 +0900 | [diff] [blame] | 132 | void MessageAttachmentSet::CommitAllDescriptors() { |
morrita | 1b52e4c | 2015-02-06 09:58:30 +0900 | [diff] [blame] | 133 | attachments_.clear(); |
| 134 | consumed_descriptor_highwater_ = 0; |
| 135 | } |
| 136 | |
morrita | 33a3590 | 2015-01-15 06:17:06 +0900 | [diff] [blame] | 137 | } // namespace IPC |