ipc/ipc_message_attachment_set.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "ipc/ipc_message_attachment_set.h"
   6
   7 #include <algorithm>
   8 #include "base/logging.h"
   9 #include "base/posix/eintr_wrapper.h"
  10 #include "ipc/ipc_message_attachment.h"
  11
  12 #if defined(OS_POSIX)
  13 #include <sys/types.h>
  14 #include <sys/stat.h>
  15 #include <unistd.h>
  16 #include "ipc/ipc_platform_file_attachment_posix.h"
  17 #endif // OS_POSIX
  18
  19 namespace IPC {
  20
  21 MessageAttachmentSet::MessageAttachmentSet()
  22     : consumed_descriptor_highwater_(0) {
  23 }
  24
  25 MessageAttachmentSet::~MessageAttachmentSet() {
  26   if (consumed_descriptor_highwater_ == size())
  27     return;
  28
  29   // We close all the owning descriptors. If this message should have
  30   // been transmitted, then closing those with close flags set mirrors
  31   // the expected behaviour.
  32   //
  33   // If this message was received with more descriptors than expected
  34   // (which could a DOS against the browser by a rogue renderer) then all
  35   // the descriptors have their close flag set and we free all the extra
  36   // kernel resources.
  37   LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed descriptors: "
  38                << consumed_descriptor_highwater_ << "/" << size();
  39 }
  40
  41 unsigned MessageAttachmentSet::num_descriptors() const {
  42   return std::count_if(attachments_.begin(), attachments_.end(),
  43                        [](scoped_refptr<MessageAttachment> i) {
  44     return i->GetType() == MessageAttachment::TYPE_PLATFORM_FILE;
  45   });
  46 }
  47
  48 unsigned MessageAttachmentSet::num_mojo_handles() const {
  49   return std::count_if(attachments_.begin(), attachments_.end(),
  50                        [](scoped_refptr<MessageAttachment> i) {
  51     return i->GetType() == MessageAttachment::TYPE_MOJO_HANDLE;
  52   });
  53 }
  54
  55 unsigned MessageAttachmentSet::size() const {
  56   return static_cast<unsigned>(attachments_.size());
  57 }
  58
  59 bool MessageAttachmentSet::AddAttachment(
  60     scoped_refptr<MessageAttachment> attachment) {
  61 #if defined(OS_POSIX)
  62   if (attachment->GetType() == MessageAttachment::TYPE_PLATFORM_FILE &&
  63       num_descriptors() == kMaxDescriptorsPerMessage) {
  64     DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
  65     return false;
  66   }
  67 #endif
  68
  69   attachments_.push_back(attachment);
  70   return true;
  71 }
  72
  73 scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt(
  74     unsigned index) {
  75   if (index >= size()) {
  76     DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
  77     return scoped_refptr<MessageAttachment>();
  78   }
  79
  80   // We should always walk the descriptors in order, so it's reasonable to
  81   // enforce this. Consider the case where a compromised renderer sends us
  82   // the following message:
  83   //
  84   //   ExampleMsg:
  85   //     num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
  86   //
  87   // Here the renderer sent us a message which should have a descriptor, but
  88   // actually sent two in an attempt to fill our fd table and kill us. By
  89   // setting the index of the descriptor in the message to 1 (it should be
  90   // 0), we would record a highwater of 1 and then consider all the
  91   // descriptors to have been used.
  92   //
  93   // So we can either track of the use of each descriptor in a bitset, or we
  94   // can enforce that we walk the indexes strictly in order.
  95   //
  96   // There's one more wrinkle: When logging messages, we may reparse them. So
  97   // we have an exception: When the consumed_descriptor_highwater_ is at the
  98   // end of the array and index 0 is requested, we reset the highwater value.
  99   // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
 100   // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
 101   if (index == 0 && consumed_descriptor_highwater_ == size())
 102     consumed_descriptor_highwater_ = 0;
 103
 104   if (index != consumed_descriptor_highwater_)
 105     return scoped_refptr<MessageAttachment>();
 106
 107   consumed_descriptor_highwater_ = index + 1;
 108
 109   return attachments_[index];
 110 }
 111
 112 void MessageAttachmentSet::CommitAll() {
 113   attachments_.clear();
 114   consumed_descriptor_highwater_ = 0;
 115 }
 116
 117 #if defined(OS_POSIX)
 118
 119 void MessageAttachmentSet::PeekDescriptors(base::PlatformFile* buffer) const {
 120   for (size_t i = 0; i != attachments_.size(); ++i)
 121     buffer[i] = internal::GetPlatformFile(attachments_[i]);
 122 }
 123
 124 bool MessageAttachmentSet::ContainsDirectoryDescriptor() const {
 125   struct stat st;
 126
 127   for (auto i = attachments_.begin(); i != attachments_.end(); ++i) {
 128     if (fstat(internal::GetPlatformFile(*i), &st) == 0 && S_ISDIR(st.st_mode))
 129       return true;
 130   }
 131
 132   return false;
 133 }
 134
 135 void MessageAttachmentSet::ReleaseFDsToClose(
 136     std::vector<base::PlatformFile>* fds) {
 137   for (size_t i = 0; i < attachments_.size(); ++i) {
 138     internal::PlatformFileAttachment* file =
 139         static_cast<internal::PlatformFileAttachment*>(attachments_[i].get());
 140     if (file->Owns())
 141       fds->push_back(file->TakePlatformFile());
 142   }
 143
 144   CommitAll();
 145 }
 146
 147 void MessageAttachmentSet::AddDescriptorsToOwn(const base::PlatformFile* buffer,
 148                                                unsigned count) {
 149   DCHECK(count <= kMaxDescriptorsPerMessage);
 150   DCHECK_EQ(num_descriptors(), 0u);
 151   DCHECK_EQ(consumed_descriptor_highwater_, 0u);
 152
 153   attachments_.reserve(count);
 154   for (unsigned i = 0; i < count; ++i)
 155     AddAttachment(
 156         new internal::PlatformFileAttachment(base::ScopedFD(buffer[i])));
 157 }
 158
 159 #endif  // OS_POSIX
 160
 161 }  // namespace IPC
 162
 163