components/nacl/browser/nacl_browser.h

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef COMPONENTS_NACL_BROWSER_NACL_BROWSER_H_
   6 #define COMPONENTS_NACL_BROWSER_NACL_BROWSER_H_
   7
   8 #include <deque>
   9
  10 #include "base/bind.h"
  11 #include "base/containers/mru_cache.h"
  12 #include "base/files/file.h"
  13 #include "base/memory/singleton.h"
  14 #include "base/memory/weak_ptr.h"
  15 #include "base/time/time.h"
  16 #include "components/nacl/browser/nacl_browser_delegate.h"
  17 #include "components/nacl/browser/nacl_validation_cache.h"
  18
  19 class URLPattern;
  20 class GURL;
  21
  22 namespace base {
  23 class FileProxy;
  24 }
  25
  26 namespace nacl {
  27
  28 static const int kGdbDebugStubPortUnknown = -1;
  29 static const int kGdbDebugStubPortUnused = 0;
  30
  31 // Open an immutable executable file that can be mmapped (or a read-only file).
  32 // This function should only be called on a thread that can perform file IO.
  33 base::File OpenNaClReadExecImpl(const base::FilePath& file_path,
  34                                 bool is_executable);
  35
  36 // Represents shared state for all NaClProcessHost objects in the browser.
  37 class NaClBrowser {
  38  public:
  39   static NaClBrowser* GetInstance();
  40
  41   // Will it be possible to launch a NaCl process, eventually?
  42   bool IsOk() const;
  43
  44   // Are we ready to launch a NaCl process now?  Implies IsOk().
  45   bool IsReady() const;
  46
  47   // Attempt to asynchronously acquire all resources needed to start a process.
  48   // This method is idempotent - it is safe to call multiple times.
  49   void EnsureAllResourcesAvailable();
  50
  51   // Enqueues reply() in the message loop when all the resources needed to start
  52   // a process have been acquired.
  53   void WaitForResources(const base::Closure& reply);
  54
  55   // Asynchronously attempt to get the IRT open.
  56   // This is entailed by EnsureInitialized.  This method is exposed as part of
  57   // the public interface, however, so the IRT can be explicitly opened as
  58   // early as possible to prevent autoupdate issues.
  59   void EnsureIrtAvailable();
  60
  61   // Path to IRT. Available even before IRT is loaded.
  62   const base::FilePath& GetIrtFilePath();
  63
  64   // IRT file handle, only available when IsReady().
  65   const base::File& IrtFile() const;
  66
  67   // Methods for testing GDB debug stub in browser. If test adds debug stub
  68   // port listener, Chrome will allocate a currently-unused TCP port number for
  69   // debug stub server instead of a fixed one.
  70
  71   // Notify listener that new debug stub TCP port is allocated.
  72   void SetProcessGdbDebugStubPort(int process_id, int port);
  73   void SetGdbDebugStubPortListener(base::Callback<void(int)> listener);
  74   void ClearGdbDebugStubPortListener();
  75
  76   int GetProcessGdbDebugStubPort(int process_id);
  77
  78   enum ValidationCacheStatus {
  79     CACHE_MISS = 0,
  80     CACHE_HIT,
  81     CACHE_MAX
  82   };
  83
  84   bool ValidationCacheIsEnabled() const {
  85     return validation_cache_is_enabled_;
  86   }
  87
  88   const std::string& GetValidationCacheKey() const {
  89     return validation_cache_.GetValidationCacheKey();
  90   }
  91
  92   // The NaCl singleton keeps information about NaCl executable files opened via
  93   // PPAPI.  This allows the NaCl process to get trusted information about the
  94   // file directly from the browser process.  In theory, a compromised renderer
  95   // could provide a writable file handle or lie about the file's path.  If we
  96   // trusted the handle was read only but it was not, an mmapped file could be
  97   // modified after validation, allowing an escape from the NaCl sandbox.
  98   // Similarly, if we trusted the file path corresponded to the file handle but
  99   // it did not, the validation cache could be tricked into bypassing validation
 100   // for bad code.
 101   // Instead of allowing these attacks, the NaCl process only trusts information
 102   // it gets directly from the browser process.  Because the information is
 103   // stored in a cache of bounded size, it is not guaranteed the browser process
 104   // will be able to provide the requested information.  In these cases, the
 105   // NaCl process must make conservative assumptions about the origin of the
 106   // file.
 107   // In theory, a compromised renderer could guess file tokens in an attempt to
 108   // read files it normally doesn't have access to.  This would not compromise
 109   // the NaCl sandbox, however, and only has a 1 in ~2**120 chance of success
 110   // per guess.
 111   // TODO(ncbray): move the cache onto NaClProcessHost so that we don't need to
 112   // rely on tokens being unguessable by another process.
 113   void PutFilePath(const base::FilePath& path, uint64* file_token_lo,
 114                    uint64* file_token_hi);
 115   bool GetFilePath(uint64 file_token_lo, uint64 file_token_hi,
 116                    base::FilePath* path);
 117
 118   bool QueryKnownToValidate(const std::string& signature, bool off_the_record);
 119   void SetKnownToValidate(const std::string& signature, bool off_the_record);
 120   void ClearValidationCache(const base::Closure& callback);
 121 #if defined(OS_WIN)
 122   // Get path to NaCl loader on the filesystem if possible.
 123   // |exe_path| does not change if the method fails.
 124   bool GetNaCl64ExePath(base::FilePath* exe_path);
 125 #endif
 126
 127   void EarlyStartup();
 128   static void SetDelegate(NaClBrowserDelegate* delegate);
 129   static NaClBrowserDelegate* GetDelegate();
 130
 131   // Each time a NaCl process ends, the browser is notified.
 132   void OnProcessEnd(int process_id);
 133   // Support for NaCl crash throttling.
 134   // Each time a NaCl module crashes, the browser is notified.
 135   void OnProcessCrashed();
 136   // If "too many" crashes occur within a given time period, NaCl is throttled
 137   // until the rate again drops below the threshold.
 138   bool IsThrottled();
 139
 140  private:
 141   friend struct DefaultSingletonTraits<NaClBrowser>;
 142
 143   enum NaClResourceState {
 144     NaClResourceUninitialized,
 145     NaClResourceRequested,
 146     NaClResourceReady
 147   };
 148
 149   NaClBrowser();
 150   ~NaClBrowser();
 151
 152   void InitIrtFilePath();
 153
 154   void OpenIrtLibraryFile();
 155
 156   void OnIrtOpened(scoped_ptr<base::FileProxy> file_proxy,
 157                    base::File::Error error_code);
 158
 159   void InitValidationCacheFilePath();
 160   void EnsureValidationCacheAvailable();
 161   void OnValidationCacheLoaded(const std::string* data);
 162   void RunWithoutValidationCache();
 163
 164   // Dispatch waiting tasks if we are ready, or if we know we'll never be ready.
 165   void CheckWaiting();
 166
 167   // Indicate that it is impossible to launch a NaCl process.
 168   void MarkAsFailed();
 169
 170   void MarkValidationCacheAsModified();
 171   void PersistValidationCache();
 172
 173
 174   base::File irt_file_;
 175   base::FilePath irt_filepath_;
 176   NaClResourceState irt_state_;
 177   NaClValidationCache validation_cache_;
 178   NaClValidationCache off_the_record_validation_cache_;
 179   base::FilePath validation_cache_file_path_;
 180   bool validation_cache_is_enabled_;
 181   bool validation_cache_is_modified_;
 182   NaClResourceState validation_cache_state_;
 183   base::Callback<void(int)> debug_stub_port_listener_;
 184
 185   // Map from process id to debug stub port if any.
 186   typedef std::map<int, int> GdbDebugStubPortMap;
 187   GdbDebugStubPortMap gdb_debug_stub_port_map_;
 188
 189   typedef base::HashingMRUCache<std::string, base::FilePath> PathCacheType;
 190   PathCacheType path_cache_;
 191
 192   bool ok_;
 193
 194   // A list of pending tasks to start NaCl processes.
 195   std::vector<base::Closure> waiting_;
 196
 197   scoped_ptr<NaClBrowserDelegate> browser_delegate_;
 198
 199   std::deque<base::Time> crash_times_;
 200
 201   // Singletons get destroyed at shutdown.
 202   base::WeakPtrFactory<NaClBrowser> weak_factory_;
 203
 204   DISALLOW_COPY_AND_ASSIGN(NaClBrowser);
 205 };
 206
 207 } // namespace nacl
 208
 209 #endif  // COMPONENTS_NACL_BROWSER_NACL_BROWSER_H_