ipc/ipc_message_attachment_set.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "ipc/ipc_message_attachment_set.h"
   6
   7 #include <algorithm>
   8 #include "base/logging.h"
   9 #include "base/posix/eintr_wrapper.h"
  10 #include "ipc/brokerable_attachment.h"
  11 #include "ipc/ipc_message_attachment.h"
  12
  13 #if defined(OS_POSIX)
  14 #include <sys/types.h>
  15 #include <sys/stat.h>
  16 #include <unistd.h>
  17 #include "ipc/ipc_platform_file_attachment_posix.h"
  18 #endif // OS_POSIX
  19
  20 namespace IPC {
  21
  22 namespace {
  23
  24 unsigned count_attachments_of_type(
  25     const std::vector<scoped_refptr<MessageAttachment>>& attachments,
  26     MessageAttachment::Type type) {
  27   unsigned count = 0;
  28   for (const scoped_refptr<MessageAttachment>& attachment : attachments) {
  29     if (attachment->GetType() == type)
  30       ++count;
  31   }
  32   return count;
  33 }
  34
  35 }  // namespace
  36
  37 MessageAttachmentSet::MessageAttachmentSet()
  38     : consumed_descriptor_highwater_(0) {
  39 }
  40
  41 MessageAttachmentSet::~MessageAttachmentSet() {
  42   if (consumed_descriptor_highwater_ == size())
  43     return;
  44
  45   // We close all the owning descriptors. If this message should have
  46   // been transmitted, then closing those with close flags set mirrors
  47   // the expected behaviour.
  48   //
  49   // If this message was received with more descriptors than expected
  50   // (which could a DOS against the browser by a rogue renderer) then all
  51   // the descriptors have their close flag set and we free all the extra
  52   // kernel resources.
  53   LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed descriptors: "
  54                << consumed_descriptor_highwater_ << "/" << size();
  55 }
  56
  57 unsigned MessageAttachmentSet::num_descriptors() const {
  58   return count_attachments_of_type(attachments_,
  59                                    MessageAttachment::TYPE_PLATFORM_FILE);
  60 }
  61
  62 unsigned MessageAttachmentSet::num_mojo_handles() const {
  63   return count_attachments_of_type(attachments_,
  64                                    MessageAttachment::TYPE_MOJO_HANDLE);
  65 }
  66
  67 unsigned MessageAttachmentSet::num_brokerable_attachments() const {
  68   return count_attachments_of_type(
  69       attachments_, MessageAttachment::TYPE_BROKERABLE_ATTACHMENT);
  70 }
  71
  72 unsigned MessageAttachmentSet::size() const {
  73   return static_cast<unsigned>(attachments_.size());
  74 }
  75
  76 bool MessageAttachmentSet::AddAttachment(
  77     scoped_refptr<MessageAttachment> attachment) {
  78 #if defined(OS_POSIX)
  79   if (attachment->GetType() == MessageAttachment::TYPE_PLATFORM_FILE &&
  80       num_descriptors() == kMaxDescriptorsPerMessage) {
  81     DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
  82     return false;
  83   }
  84 #endif
  85
  86   attachments_.push_back(attachment);
  87   return true;
  88 }
  89
  90 scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt(
  91     unsigned index) {
  92   if (index >= size()) {
  93     DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
  94     return scoped_refptr<MessageAttachment>();
  95   }
  96
  97   // We should always walk the descriptors in order, so it's reasonable to
  98   // enforce this. Consider the case where a compromised renderer sends us
  99   // the following message:
 100   //
 101   //   ExampleMsg:
 102   //     num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
 103   //
 104   // Here the renderer sent us a message which should have a descriptor, but
 105   // actually sent two in an attempt to fill our fd table and kill us. By
 106   // setting the index of the descriptor in the message to 1 (it should be
 107   // 0), we would record a highwater of 1 and then consider all the
 108   // descriptors to have been used.
 109   //
 110   // So we can either track of the use of each descriptor in a bitset, or we
 111   // can enforce that we walk the indexes strictly in order.
 112   //
 113   // There's one more wrinkle: When logging messages, we may reparse them. So
 114   // we have an exception: When the consumed_descriptor_highwater_ is at the
 115   // end of the array and index 0 is requested, we reset the highwater value.
 116   // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
 117   // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
 118   if (index == 0 && consumed_descriptor_highwater_ == size())
 119     consumed_descriptor_highwater_ = 0;
 120
 121   if (index != consumed_descriptor_highwater_)
 122     return scoped_refptr<MessageAttachment>();
 123
 124   consumed_descriptor_highwater_ = index + 1;
 125
 126   return attachments_[index];
 127 }
 128
 129 void MessageAttachmentSet::CommitAll() {
 130   attachments_.clear();
 131   consumed_descriptor_highwater_ = 0;
 132 }
 133
 134 std::vector<const BrokerableAttachment*>
 135 MessageAttachmentSet::PeekBrokerableAttachments() const {
 136   std::vector<const BrokerableAttachment*> output;
 137   for (const scoped_refptr<MessageAttachment>& attachment : attachments_) {
 138     if (attachment->GetType() ==
 139         MessageAttachment::TYPE_BROKERABLE_ATTACHMENT) {
 140       output.push_back(static_cast<BrokerableAttachment*>(attachment.get()));
 141     }
 142   }
 143   return output;
 144 }
 145
 146 void MessageAttachmentSet::ReplacePlaceholderWithAttachment(
 147     const scoped_refptr<BrokerableAttachment>& attachment) {
 148   for (auto it = attachments_.begin(); it != attachments_.end(); ++it) {
 149     if ((*it)->GetType() != MessageAttachment::TYPE_BROKERABLE_ATTACHMENT)
 150       continue;
 151     BrokerableAttachment* brokerable_attachment =
 152         static_cast<BrokerableAttachment*>(it->get());
 153
 154     if (brokerable_attachment->GetBrokerableType() ==
 155             BrokerableAttachment::PLACEHOLDER &&
 156         brokerable_attachment->GetIdentifier() == attachment->GetIdentifier()) {
 157       *it = attachment;
 158       return;
 159     }
 160   }
 161
 162   // This function should only be called if there is a placeholder ready to be
 163   // replaced.
 164   NOTREACHED();
 165 }
 166
 167 #if defined(OS_POSIX)
 168
 169 void MessageAttachmentSet::PeekDescriptors(base::PlatformFile* buffer) const {
 170   for (size_t i = 0; i != attachments_.size(); ++i)
 171     buffer[i] = internal::GetPlatformFile(attachments_[i]);
 172 }
 173
 174 bool MessageAttachmentSet::ContainsDirectoryDescriptor() const {
 175   struct stat st;
 176
 177   for (auto i = attachments_.begin(); i != attachments_.end(); ++i) {
 178     if (fstat(internal::GetPlatformFile(*i), &st) == 0 && S_ISDIR(st.st_mode))
 179       return true;
 180   }
 181
 182   return false;
 183 }
 184
 185 void MessageAttachmentSet::ReleaseFDsToClose(
 186     std::vector<base::PlatformFile>* fds) {
 187   for (size_t i = 0; i < attachments_.size(); ++i) {
 188     internal::PlatformFileAttachment* file =
 189         static_cast<internal::PlatformFileAttachment*>(attachments_[i].get());
 190     if (file->Owns())
 191       fds->push_back(file->TakePlatformFile());
 192   }
 193
 194   CommitAll();
 195 }
 196
 197 void MessageAttachmentSet::AddDescriptorsToOwn(const base::PlatformFile* buffer,
 198                                                unsigned count) {
 199   DCHECK(count <= kMaxDescriptorsPerMessage);
 200   DCHECK_EQ(num_descriptors(), 0u);
 201   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
 202
 203   attachments_.reserve(count);
 204   for (unsigned i = 0; i < count; ++i)
 205     AddAttachment(
 206         new internal::PlatformFileAttachment(base::ScopedFD(buffer[i])));
 207 }
 208
 209 #endif  // OS_POSIX
 210
 211 }  // namespace IPC
 212
 213