ipc/ipc_message_attachment_set.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "ipc/ipc_message_attachment_set.h"
   6
   7 #include "base/logging.h"
   8 #include "base/posix/eintr_wrapper.h"
   9
  10 #if defined(OS_POSIX)
  11 #include <sys/types.h>
  12 #include <sys/stat.h>
  13 #include <unistd.h>
  14 #endif // OS_POSIX
  15
  16 namespace IPC {
  17
  18 MessageAttachmentSet::MessageAttachmentSet()
  19     : consumed_descriptor_highwater_(0) {
  20 }
  21
  22 MessageAttachmentSet::~MessageAttachmentSet() {
  23   if (consumed_descriptor_highwater_ == size())
  24     return;
  25
  26   // We close all the owning descriptors. If this message should have
  27   // been transmitted, then closing those with close flags set mirrors
  28   // the expected behaviour.
  29   //
  30   // If this message was received with more descriptors than expected
  31   // (which could a DOS against the browser by a rogue renderer) then all
  32   // the descriptors have their close flag set and we free all the extra
  33   // kernel resources.
  34   LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed descriptors: "
  35                << consumed_descriptor_highwater_ << "/" << size();
  36 }
  37
  38 unsigned MessageAttachmentSet::size() const {
  39 #if defined(OS_POSIX)
  40   return descriptors_.size();
  41 #else
  42   return 0;
  43 #endif
  44 }
  45
  46 #if defined(OS_POSIX)
  47
  48 bool MessageAttachmentSet::AddToBorrow(base::PlatformFile fd) {
  49   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
  50
  51   if (size() == kMaxDescriptorsPerMessage) {
  52     DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
  53     return false;
  54   }
  55
  56   descriptors_.push_back(fd);
  57   return true;
  58 }
  59
  60 bool MessageAttachmentSet::AddToOwn(base::ScopedFD fd) {
  61   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
  62
  63   if (size() == kMaxDescriptorsPerMessage) {
  64     DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
  65     return false;
  66   }
  67
  68   descriptors_.push_back(fd.get());
  69   owned_descriptors_.push_back(new base::ScopedFD(fd.Pass()));
  70   DCHECK(size() <= kMaxDescriptorsPerMessage);
  71   return true;
  72 }
  73
  74 base::PlatformFile MessageAttachmentSet::TakeDescriptorAt(unsigned index) {
  75   if (index >= size()) {
  76     DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
  77     return -1;
  78   }
  79
  80   // We should always walk the descriptors in order, so it's reasonable to
  81   // enforce this. Consider the case where a compromised renderer sends us
  82   // the following message:
  83   //
  84   //   ExampleMsg:
  85   //     num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
  86   //
  87   // Here the renderer sent us a message which should have a descriptor, but
  88   // actually sent two in an attempt to fill our fd table and kill us. By
  89   // setting the index of the descriptor in the message to 1 (it should be
  90   // 0), we would record a highwater of 1 and then consider all the
  91   // descriptors to have been used.
  92   //
  93   // So we can either track of the use of each descriptor in a bitset, or we
  94   // can enforce that we walk the indexes strictly in order.
  95   //
  96   // There's one more wrinkle: When logging messages, we may reparse them. So
  97   // we have an exception: When the consumed_descriptor_highwater_ is at the
  98   // end of the array and index 0 is requested, we reset the highwater value.
  99   // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
 100   // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
 101   if (index == 0 && consumed_descriptor_highwater_ == descriptors_.size())
 102     consumed_descriptor_highwater_ = 0;
 103
 104   if (index != consumed_descriptor_highwater_)
 105     return -1;
 106
 107   consumed_descriptor_highwater_ = index + 1;
 108
 109   base::PlatformFile file = descriptors_[index];
 110
 111   // TODO(morrita): In production, descriptors_.size() should be same as
 112   // owned_descriptors_.size() as all read descriptors are owned by Message.
 113   // We have to do this because unit test breaks this assumption. It should be
 114   // changed to exercise with own-able descriptors.
 115   for (ScopedVector<base::ScopedFD>::const_iterator i =
 116            owned_descriptors_.begin();
 117        i != owned_descriptors_.end(); ++i) {
 118     if ((*i)->get() == file) {
 119       ignore_result((*i)->release());
 120       break;
 121     }
 122   }
 123
 124   return file;
 125 }
 126
 127 void MessageAttachmentSet::PeekDescriptors(base::PlatformFile* buffer) const {
 128   std::copy(descriptors_.begin(), descriptors_.end(), buffer);
 129 }
 130
 131 bool MessageAttachmentSet::ContainsDirectoryDescriptor() const {
 132   struct stat st;
 133
 134   for (std::vector<base::PlatformFile>::const_iterator i = descriptors_.begin();
 135        i != descriptors_.end(); ++i) {
 136     if (fstat(*i, &st) == 0 && S_ISDIR(st.st_mode))
 137       return true;
 138   }
 139
 140   return false;
 141 }
 142
 143 void MessageAttachmentSet::CommitAll() {
 144   descriptors_.clear();
 145   owned_descriptors_.clear();
 146   consumed_descriptor_highwater_ = 0;
 147 }
 148
 149 void MessageAttachmentSet::ReleaseFDsToClose(
 150     std::vector<base::PlatformFile>* fds) {
 151   for (ScopedVector<base::ScopedFD>::iterator i = owned_descriptors_.begin();
 152        i != owned_descriptors_.end(); ++i) {
 153     fds->push_back((*i)->release());
 154   }
 155
 156   CommitAll();
 157 }
 158
 159 void MessageAttachmentSet::AddDescriptorsToOwn(const base::PlatformFile* buffer,
 160                                                unsigned count) {
 161   DCHECK(count <= kMaxDescriptorsPerMessage);
 162   DCHECK_EQ(size(), 0u);
 163   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
 164
 165   descriptors_.reserve(count);
 166   owned_descriptors_.reserve(count);
 167   for (unsigned i = 0; i < count; ++i) {
 168     descriptors_.push_back(buffer[i]);
 169     owned_descriptors_.push_back(new base::ScopedFD(buffer[i]));
 170   }
 171 }
 172
 173 #endif  // OS_POSIX
 174
 175 }  // namespace IPC
 176
 177