ipc/file_descriptor_set_posix.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "ipc/file_descriptor_set_posix.h"
   6
   7 #include <sys/types.h>
   8 #include <sys/stat.h>
   9 #include <unistd.h>
  10
  11 #include "base/logging.h"
  12 #include "base/posix/eintr_wrapper.h"
  13
  14 FileDescriptorSet::FileDescriptorSet()
  15     : consumed_descriptor_highwater_(0) {
  16 }
  17
  18 FileDescriptorSet::~FileDescriptorSet() {
  19   if (consumed_descriptor_highwater_ == size())
  20     return;
  21
  22   // We close all the owning descriptors. If this message should have
  23   // been transmitted, then closing those with close flags set mirrors
  24   // the expected behaviour.
  25   //
  26   // If this message was received with more descriptors than expected
  27   // (which could a DOS against the browser by a rogue renderer) then all
  28   // the descriptors have their close flag set and we free all the extra
  29   // kernel resources.
  30   LOG(WARNING) << "FileDescriptorSet destroyed with unconsumed descriptors: "
  31                << consumed_descriptor_highwater_ << "/" << size();
  32 }
  33
  34 bool FileDescriptorSet::AddToBorrow(base::PlatformFile fd) {
  35   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
  36
  37   if (size() == kMaxDescriptorsPerMessage) {
  38     DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full.";
  39     return false;
  40   }
  41
  42   descriptors_.push_back(fd);
  43   return true;
  44 }
  45
  46 bool FileDescriptorSet::AddToOwn(base::ScopedFD fd) {
  47   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
  48
  49   if (size() == kMaxDescriptorsPerMessage) {
  50     DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full.";
  51     return false;
  52   }
  53
  54   descriptors_.push_back(fd.get());
  55   owned_descriptors_.push_back(new base::ScopedFD(fd.Pass()));
  56   DCHECK(size() <= kMaxDescriptorsPerMessage);
  57   return true;
  58 }
  59
  60 base::PlatformFile FileDescriptorSet::TakeDescriptorAt(unsigned index) {
  61   if (index >= size()) {
  62     DLOG(WARNING) << "Accessing out of bound index:"
  63                   << index << "/" << size();
  64     return -1;
  65   }
  66
  67
  68   // We should always walk the descriptors in order, so it's reasonable to
  69   // enforce this. Consider the case where a compromised renderer sends us
  70   // the following message:
  71   //
  72   //   ExampleMsg:
  73   //     num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
  74   //
  75   // Here the renderer sent us a message which should have a descriptor, but
  76   // actually sent two in an attempt to fill our fd table and kill us. By
  77   // setting the index of the descriptor in the message to 1 (it should be
  78   // 0), we would record a highwater of 1 and then consider all the
  79   // descriptors to have been used.
  80   //
  81   // So we can either track of the use of each descriptor in a bitset, or we
  82   // can enforce that we walk the indexes strictly in order.
  83   //
  84   // There's one more wrinkle: When logging messages, we may reparse them. So
  85   // we have an exception: When the consumed_descriptor_highwater_ is at the
  86   // end of the array and index 0 is requested, we reset the highwater value.
  87   // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
  88   // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
  89   if (index == 0 && consumed_descriptor_highwater_ == descriptors_.size())
  90     consumed_descriptor_highwater_ = 0;
  91
  92   if (index != consumed_descriptor_highwater_)
  93     return -1;
  94
  95   consumed_descriptor_highwater_ = index + 1;
  96
  97   base::PlatformFile file = descriptors_[index];
  98
  99   // TODO(morrita): In production, descriptors_.size() should be same as
 100   // owned_descriptors_.size() as all read descriptors are owned by Message.
 101   // We have to do this because unit test breaks this assumption. It should be
 102   // changed to exercise with own-able descriptors.
 103   for (ScopedVector<base::ScopedFD>::const_iterator i =
 104            owned_descriptors_.begin();
 105        i != owned_descriptors_.end();
 106        ++i) {
 107     if ((*i)->get() == file) {
 108       ignore_result((*i)->release());
 109       break;
 110     }
 111   }
 112
 113   return file;
 114 }
 115
 116 void FileDescriptorSet::PeekDescriptors(base::PlatformFile* buffer) const {
 117   std::copy(descriptors_.begin(), descriptors_.end(), buffer);
 118 }
 119
 120 bool FileDescriptorSet::ContainsDirectoryDescriptor() const {
 121   struct stat st;
 122
 123   for (std::vector<base::PlatformFile>::const_iterator i = descriptors_.begin();
 124        i != descriptors_.end();
 125        ++i) {
 126     if (fstat(*i, &st) == 0 && S_ISDIR(st.st_mode))
 127       return true;
 128   }
 129
 130   return false;
 131 }
 132
 133 void FileDescriptorSet::CommitAll() {
 134   descriptors_.clear();
 135   owned_descriptors_.clear();
 136   consumed_descriptor_highwater_ = 0;
 137 }
 138
 139 void FileDescriptorSet::ReleaseFDsToClose(
 140     std::vector<base::PlatformFile>* fds) {
 141   for (ScopedVector<base::ScopedFD>::iterator i = owned_descriptors_.begin();
 142        i != owned_descriptors_.end();
 143        ++i) {
 144     fds->push_back((*i)->release());
 145   }
 146
 147   CommitAll();
 148 }
 149
 150 void FileDescriptorSet::AddDescriptorsToOwn(const base::PlatformFile* buffer,
 151                                             unsigned count) {
 152   DCHECK(count <= kMaxDescriptorsPerMessage);
 153   DCHECK_EQ(size(), 0u);
 154   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
 155
 156   descriptors_.reserve(count);
 157   owned_descriptors_.reserve(count);
 158   for (unsigned i = 0; i < count; ++i) {
 159     descriptors_.push_back(buffer[i]);
 160     owned_descriptors_.push_back(new base::ScopedFD(buffer[i]));
 161   }
 162 }