ipc/ipc_channel_win.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "ipc/ipc_channel_win.h"
   6
   7 #include <windows.h>
   8
   9 #include "base/auto_reset.h"
  10 #include "base/bind.h"
  11 #include "base/compiler_specific.h"
  12 #include "base/logging.h"
  13 #include "base/pickle.h"
  14 #include "base/process_util.h"
  15 #include "base/rand_util.h"
  16 #include "base/string_number_conversions.h"
  17 #include "base/threading/thread_checker.h"
  18 #include "base/utf_string_conversions.h"
  19 #include "base/win/scoped_handle.h"
  20 #include "ipc/ipc_listener.h"
  21 #include "ipc/ipc_logging.h"
  22 #include "ipc/ipc_message_utils.h"
  23
  24 namespace IPC {
  25
  26 Channel::ChannelImpl::State::State(ChannelImpl* channel) : is_pending(false) {
  27   memset(&context.overlapped, 0, sizeof(context.overlapped));
  28   context.handler = channel;
  29 }
  30
  31 Channel::ChannelImpl::State::~State() {
  32   COMPILE_ASSERT(!offsetof(Channel::ChannelImpl::State, context),
  33                  starts_with_io_context);
  34 }
  35
  36 Channel::ChannelImpl::ChannelImpl(const IPC::ChannelHandle &channel_handle,
  37                                   Mode mode, Listener* listener)
  38     : ChannelReader(listener),
  39       ALLOW_THIS_IN_INITIALIZER_LIST(input_state_(this)),
  40       ALLOW_THIS_IN_INITIALIZER_LIST(output_state_(this)),
  41       pipe_(INVALID_HANDLE_VALUE),
  42       peer_pid_(base::kNullProcessId),
  43       waiting_connect_(mode & MODE_SERVER_FLAG),
  44       processing_incoming_(false),
  45       ALLOW_THIS_IN_INITIALIZER_LIST(weak_factory_(this)),
  46       client_secret_(0),
  47       validate_client_(false) {
  48   CreatePipe(channel_handle, mode);
  49 }
  50
  51 Channel::ChannelImpl::~ChannelImpl() {
  52   Close();
  53 }
  54
  55 void Channel::ChannelImpl::Close() {
  56   if (thread_check_.get()) {
  57     DCHECK(thread_check_->CalledOnValidThread());
  58   }
  59
  60   if (input_state_.is_pending || output_state_.is_pending)
  61     CancelIo(pipe_);
  62
  63   // Closing the handle at this point prevents us from issuing more requests
  64   // form OnIOCompleted().
  65   if (pipe_ != INVALID_HANDLE_VALUE) {
  66     CloseHandle(pipe_);
  67     pipe_ = INVALID_HANDLE_VALUE;
  68   }
  69
  70   // Make sure all IO has completed.
  71   base::Time start = base::Time::Now();
  72   while (input_state_.is_pending || output_state_.is_pending) {
  73     MessageLoopForIO::current()->WaitForIOCompletion(INFINITE, this);
  74   }
  75
  76   while (!output_queue_.empty()) {
  77     Message* m = output_queue_.front();
  78     output_queue_.pop();
  79     delete m;
  80   }
  81 }
  82
  83 bool Channel::ChannelImpl::Send(Message* message) {
  84   DCHECK(thread_check_->CalledOnValidThread());
  85   DVLOG(2) << "sending message @" << message << " on channel @" << this
  86            << " with type " << message->type()
  87            << " (" << output_queue_.size() << " in queue)";
  88
  89 #ifdef IPC_MESSAGE_LOG_ENABLED
  90   Logging::GetInstance()->OnSendMessage(message, "");
  91 #endif
  92
  93   message->TraceMessageBegin();
  94   output_queue_.push(message);
  95   // ensure waiting to write
  96   if (!waiting_connect_) {
  97     if (!output_state_.is_pending) {
  98       if (!ProcessOutgoingMessages(NULL, 0))
  99         return false;
 100     }
 101   }
 102
 103   return true;
 104 }
 105
 106 // static
 107 bool Channel::ChannelImpl::IsNamedServerInitialized(
 108     const std::string& channel_id) {
 109   if (WaitNamedPipe(PipeName(channel_id, NULL).c_str(), 1))
 110     return true;
 111   // If ERROR_SEM_TIMEOUT occurred, the pipe exists but is handling another
 112   // connection.
 113   return GetLastError() == ERROR_SEM_TIMEOUT;
 114 }
 115
 116 Channel::ChannelImpl::ReadState Channel::ChannelImpl::ReadData(
 117     char* buffer,
 118     int buffer_len,
 119     int* /* bytes_read */) {
 120   if (INVALID_HANDLE_VALUE == pipe_)
 121     return READ_FAILED;
 122
 123   DWORD bytes_read = 0;
 124   BOOL ok = ReadFile(pipe_, buffer, buffer_len,
 125                      &bytes_read, &input_state_.context.overlapped);
 126   if (!ok) {
 127     DWORD err = GetLastError();
 128     if (err == ERROR_IO_PENDING) {
 129       input_state_.is_pending = true;
 130       return READ_PENDING;
 131     }
 132     LOG(ERROR) << "pipe error: " << err;
 133     return READ_FAILED;
 134   }
 135
 136   // We could return READ_SUCCEEDED here. But the way that this code is
 137   // structured we instead go back to the message loop. Our completion port
 138   // will be signalled even in the "synchronously completed" state.
 139   //
 140   // This allows us to potentially process some outgoing messages and
 141   // interleave other work on this thread when we're getting hammered with
 142   // input messages. Potentially, this could be tuned to be more efficient
 143   // with some testing.
 144   input_state_.is_pending = true;
 145   return READ_PENDING;
 146 }
 147
 148 bool Channel::ChannelImpl::WillDispatchInputMessage(Message* msg) {
 149   // Make sure we get a hello when client validation is required.
 150   if (validate_client_)
 151     return IsHelloMessage(*msg);
 152   return true;
 153 }
 154
 155 void Channel::ChannelImpl::HandleHelloMessage(const Message& msg) {
 156   // The hello message contains one parameter containing the PID.
 157   PickleIterator it(msg);
 158   int32 claimed_pid;
 159   bool failed = !it.ReadInt(&claimed_pid);
 160
 161   if (!failed && validate_client_) {
 162     int32 secret;
 163     failed = it.ReadInt(&secret) ? (secret != client_secret_) : true;
 164   }
 165
 166   if (failed) {
 167     NOTREACHED();
 168     Close();
 169     listener()->OnChannelError();
 170     return;
 171   }
 172
 173   peer_pid_ = claimed_pid;
 174   // Validation completed.
 175   validate_client_ = false;
 176   listener()->OnChannelConnected(claimed_pid);
 177 }
 178
 179 bool Channel::ChannelImpl::DidEmptyInputBuffers() {
 180   // We don't need to do anything here.
 181   return true;
 182 }
 183
 184 // static
 185 const string16 Channel::ChannelImpl::PipeName(
 186     const std::string& channel_id, int32* secret) {
 187   std::string name("\\\\.\\pipe\\chrome.");
 188
 189   // Prevent the shared secret from ending up in the pipe name.
 190   size_t index = channel_id.find_first_of('\\');
 191   if (index != std::string::npos) {
 192     if (secret)  // Retrieve the secret if asked for.
 193       base::StringToInt(channel_id.substr(index + 1), secret);
 194     return ASCIIToWide(name.append(channel_id.substr(0, index - 1)));
 195   }
 196
 197   // This case is here to support predictable named pipes in tests.
 198   if (secret)
 199     *secret = 0;
 200   return ASCIIToWide(name.append(channel_id));
 201 }
 202
 203 bool Channel::ChannelImpl::CreatePipe(const IPC::ChannelHandle &channel_handle,
 204                                       Mode mode) {
 205   DCHECK_EQ(INVALID_HANDLE_VALUE, pipe_);
 206   string16 pipe_name;
 207   // If we already have a valid pipe for channel just copy it.
 208   if (channel_handle.pipe.handle) {
 209     DCHECK(channel_handle.name.empty());
 210     pipe_name = L"Not Available";  // Just used for LOG
 211     // Check that the given pipe confirms to the specified mode.  We can
 212     // only check for PIPE_TYPE_MESSAGE & PIPE_SERVER_END flags since the
 213     // other flags (PIPE_TYPE_BYTE, and PIPE_CLIENT_END) are defined as 0.
 214     DWORD flags = 0;
 215     GetNamedPipeInfo(channel_handle.pipe.handle, &flags, NULL, NULL, NULL);
 216     DCHECK(!(flags & PIPE_TYPE_MESSAGE));
 217     if (((mode & MODE_SERVER_FLAG) && !(flags & PIPE_SERVER_END)) ||
 218         ((mode & MODE_CLIENT_FLAG) && (flags & PIPE_SERVER_END))) {
 219       LOG(WARNING) << "Inconsistent open mode. Mode :" << mode;
 220       return false;
 221     }
 222     if (!DuplicateHandle(GetCurrentProcess(),
 223                          channel_handle.pipe.handle,
 224                          GetCurrentProcess(),
 225                          &pipe_,
 226                          0,
 227                          FALSE,
 228                          DUPLICATE_SAME_ACCESS)) {
 229       LOG(WARNING) << "DuplicateHandle failed. Error :" << GetLastError();
 230       return false;
 231     }
 232   } else if (mode & MODE_SERVER_FLAG) {
 233     DCHECK(!channel_handle.pipe.handle);
 234     const DWORD open_mode = PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED |
 235                             FILE_FLAG_FIRST_PIPE_INSTANCE;
 236     pipe_name = PipeName(channel_handle.name, &client_secret_);
 237     validate_client_ = !!client_secret_;
 238     pipe_ = CreateNamedPipeW(pipe_name.c_str(),
 239                              open_mode,
 240                              PIPE_TYPE_BYTE | PIPE_READMODE_BYTE,
 241                              1,
 242                              Channel::kReadBufferSize,
 243                              Channel::kReadBufferSize,
 244                              5000,
 245                              NULL);
 246   } else if (mode & MODE_CLIENT_FLAG) {
 247     DCHECK(!channel_handle.pipe.handle);
 248     pipe_name = PipeName(channel_handle.name, &client_secret_);
 249     pipe_ = CreateFileW(pipe_name.c_str(),
 250                         GENERIC_READ | GENERIC_WRITE,
 251                         0,
 252                         NULL,
 253                         OPEN_EXISTING,
 254                         SECURITY_SQOS_PRESENT | SECURITY_IDENTIFICATION |
 255                             FILE_FLAG_OVERLAPPED,
 256                         NULL);
 257   } else {
 258     NOTREACHED();
 259   }
 260
 261   if (pipe_ == INVALID_HANDLE_VALUE) {
 262     // If this process is being closed, the pipe may be gone already.
 263     LOG(WARNING) << "Unable to create pipe \"" << pipe_name <<
 264                     "\" in " << (mode & MODE_SERVER_FLAG ? "server" : "client")
 265                     << " mode. Error :" << GetLastError();
 266     return false;
 267   }
 268
 269   // Create the Hello message to be sent when Connect is called
 270   scoped_ptr<Message> m(new Message(MSG_ROUTING_NONE,
 271                                     HELLO_MESSAGE_TYPE,
 272                                     IPC::Message::PRIORITY_NORMAL));
 273
 274   // Don't send the secret to the untrusted process, and don't send a secret
 275   // if the value is zero (for IPC backwards compatability).
 276   int32 secret = validate_client_ ? 0 : client_secret_;
 277   if (!m->WriteInt(GetCurrentProcessId()) ||
 278       (secret && !m->WriteUInt32(secret))) {
 279     CloseHandle(pipe_);
 280     pipe_ = INVALID_HANDLE_VALUE;
 281     return false;
 282   }
 283
 284   output_queue_.push(m.release());
 285   return true;
 286 }
 287
 288 bool Channel::ChannelImpl::Connect() {
 289   DLOG_IF(WARNING, thread_check_.get()) << "Connect called more than once";
 290
 291   if (!thread_check_.get())
 292     thread_check_.reset(new base::ThreadChecker());
 293
 294   if (pipe_ == INVALID_HANDLE_VALUE)
 295     return false;
 296
 297   MessageLoopForIO::current()->RegisterIOHandler(pipe_, this);
 298
 299   // Check to see if there is a client connected to our pipe...
 300   if (waiting_connect_)
 301     ProcessConnection();
 302
 303   if (!input_state_.is_pending) {
 304     // Complete setup asynchronously. By not setting input_state_.is_pending
 305     // to true, we indicate to OnIOCompleted that this is the special
 306     // initialization signal.
 307     MessageLoopForIO::current()->PostTask(
 308         FROM_HERE, base::Bind(&Channel::ChannelImpl::OnIOCompleted,
 309                               weak_factory_.GetWeakPtr(), &input_state_.context,
 310                               0, 0));
 311   }
 312
 313   if (!waiting_connect_)
 314     ProcessOutgoingMessages(NULL, 0);
 315   return true;
 316 }
 317
 318 bool Channel::ChannelImpl::ProcessConnection() {
 319   DCHECK(thread_check_->CalledOnValidThread());
 320   if (input_state_.is_pending)
 321     input_state_.is_pending = false;
 322
 323   // Do we have a client connected to our pipe?
 324   if (INVALID_HANDLE_VALUE == pipe_)
 325     return false;
 326
 327   BOOL ok = ConnectNamedPipe(pipe_, &input_state_.context.overlapped);
 328
 329   DWORD err = GetLastError();
 330   if (ok) {
 331     // Uhm, the API documentation says that this function should never
 332     // return success when used in overlapped mode.
 333     NOTREACHED();
 334     return false;
 335   }
 336
 337   switch (err) {
 338   case ERROR_IO_PENDING:
 339     input_state_.is_pending = true;
 340     break;
 341   case ERROR_PIPE_CONNECTED:
 342     waiting_connect_ = false;
 343     break;
 344   case ERROR_NO_DATA:
 345     // The pipe is being closed.
 346     return false;
 347   default:
 348     NOTREACHED();
 349     return false;
 350   }
 351
 352   return true;
 353 }
 354
 355 bool Channel::ChannelImpl::ProcessOutgoingMessages(
 356     MessageLoopForIO::IOContext* context,
 357     DWORD bytes_written) {
 358   DCHECK(!waiting_connect_);  // Why are we trying to send messages if there's
 359                               // no connection?
 360   DCHECK(thread_check_->CalledOnValidThread());
 361
 362   if (output_state_.is_pending) {
 363     DCHECK(context);
 364     output_state_.is_pending = false;
 365     if (!context || bytes_written == 0) {
 366       DWORD err = GetLastError();
 367       LOG(ERROR) << "pipe error: " << err;
 368       return false;
 369     }
 370     // Message was sent.
 371     DCHECK(!output_queue_.empty());
 372     Message* m = output_queue_.front();
 373     output_queue_.pop();
 374     delete m;
 375   }
 376
 377   if (output_queue_.empty())
 378     return true;
 379
 380   if (INVALID_HANDLE_VALUE == pipe_)
 381     return false;
 382
 383   // Write to pipe...
 384   Message* m = output_queue_.front();
 385   DCHECK(m->size() <= INT_MAX);
 386   BOOL ok = WriteFile(pipe_,
 387                       m->data(),
 388                       static_cast<int>(m->size()),
 389                       &bytes_written,
 390                       &output_state_.context.overlapped);
 391   if (!ok) {
 392     DWORD err = GetLastError();
 393     if (err == ERROR_IO_PENDING) {
 394       output_state_.is_pending = true;
 395
 396       DVLOG(2) << "sent pending message @" << m << " on channel @" << this
 397                << " with type " << m->type();
 398
 399       return true;
 400     }
 401     LOG(ERROR) << "pipe error: " << err;
 402     return false;
 403   }
 404
 405   DVLOG(2) << "sent message @" << m << " on channel @" << this
 406            << " with type " << m->type();
 407
 408   output_state_.is_pending = true;
 409   return true;
 410 }
 411
 412 void Channel::ChannelImpl::OnIOCompleted(MessageLoopForIO::IOContext* context,
 413                                          DWORD bytes_transfered,
 414                                          DWORD error) {
 415   bool ok = true;
 416   DCHECK(thread_check_->CalledOnValidThread());
 417   if (context == &input_state_.context) {
 418     if (waiting_connect_) {
 419       if (!ProcessConnection())
 420         return;
 421       // We may have some messages queued up to send...
 422       if (!output_queue_.empty() && !output_state_.is_pending)
 423         ProcessOutgoingMessages(NULL, 0);
 424       if (input_state_.is_pending)
 425         return;
 426       // else, fall-through and look for incoming messages...
 427     }
 428
 429     // We don't support recursion through OnMessageReceived yet!
 430     DCHECK(!processing_incoming_);
 431     base::AutoReset<bool> auto_reset_processing_incoming(
 432         &processing_incoming_, true);
 433
 434     // Process the new data.
 435     if (input_state_.is_pending) {
 436       // This is the normal case for everything except the initialization step.
 437       input_state_.is_pending = false;
 438       if (!bytes_transfered)
 439         ok = false;
 440       else
 441         ok = AsyncReadComplete(bytes_transfered);
 442     } else {
 443       DCHECK(!bytes_transfered);
 444     }
 445
 446     // Request more data.
 447     if (ok)
 448       ok = ProcessIncomingMessages();
 449   } else {
 450     DCHECK(context == &output_state_.context);
 451     ok = ProcessOutgoingMessages(context, bytes_transfered);
 452   }
 453   if (!ok && INVALID_HANDLE_VALUE != pipe_) {
 454     // We don't want to re-enter Close().
 455     Close();
 456     listener()->OnChannelError();
 457   }
 458 }
 459
 460 //------------------------------------------------------------------------------
 461 // Channel's methods simply call through to ChannelImpl.
 462 Channel::Channel(const IPC::ChannelHandle &channel_handle, Mode mode,
 463                  Listener* listener)
 464     : channel_impl_(new ChannelImpl(channel_handle, mode, listener)) {
 465 }
 466
 467 Channel::~Channel() {
 468   delete channel_impl_;
 469 }
 470
 471 bool Channel::Connect() {
 472   return channel_impl_->Connect();
 473 }
 474
 475 void Channel::Close() {
 476   if (channel_impl_)
 477     channel_impl_->Close();
 478 }
 479
 480 void Channel::set_listener(Listener* listener) {
 481   channel_impl_->set_listener(listener);
 482 }
 483
 484 base::ProcessId Channel::peer_pid() const {
 485   return channel_impl_->peer_pid();
 486 }
 487
 488 bool Channel::Send(Message* message) {
 489   return channel_impl_->Send(message);
 490 }
 491
 492 // static
 493 bool Channel::IsNamedServerInitialized(const std::string& channel_id) {
 494   return ChannelImpl::IsNamedServerInitialized(channel_id);
 495 }
 496
 497 // static
 498 std::string Channel::GenerateVerifiedChannelID(const std::string& prefix) {
 499   // Windows pipes can be enumerated by low-privileged processes. So, we
 500   // append a strong random value after the \ character. This value is not
 501   // included in the pipe name, but sent as part of the client hello, to
 502   // hijacking the pipe name to spoof the client.
 503
 504   std::string id = prefix;
 505   if (!id.empty())
 506     id.append(".");
 507
 508   int secret;
 509   do {  // Guarantee we get a non-zero value.
 510     secret = base::RandInt(0, std::numeric_limits<int>::max());
 511   } while (secret == 0);
 512
 513   id.append(GenerateUniqueRandomChannelID());
 514   return id.append(base::StringPrintf("\\%d", secret));
 515 }
 516
 517 }  // namespace IPC