content/browser/ppapi_plugin_process_host.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/ppapi_plugin_process_host.h"
   6
   7 #include <string>
   8
   9 #include "base/base_switches.h"
  10 #include "base/command_line.h"
  11 #include "base/files/file_path.h"
  12 #include "base/metrics/field_trial.h"
  13 #include "base/strings/utf_string_conversions.h"
  14 #include "content/browser/browser_child_process_host_impl.h"
  15 #include "content/browser/plugin_service_impl.h"
  16 #include "content/browser/renderer_host/render_message_filter.h"
  17 #include "content/common/child_process_host_impl.h"
  18 #include "content/common/child_process_messages.h"
  19 #include "content/public/browser/content_browser_client.h"
  20 #include "content/public/common/content_constants.h"
  21 #include "content/public/common/content_switches.h"
  22 #include "content/public/common/pepper_plugin_info.h"
  23 #include "content/public/common/process_type.h"
  24 #include "content/public/common/sandboxed_process_launcher_delegate.h"
  25 #include "ipc/ipc_switches.h"
  26 #include "net/base/network_change_notifier.h"
  27 #include "ppapi/proxy/ppapi_messages.h"
  28 #include "ui/base/ui_base_switches.h"
  29
  30 #if defined(OS_WIN)
  31 #include "content/common/sandbox_win.h"
  32 #include "sandbox/win/src/sandbox_policy.h"
  33 #endif
  34
  35 namespace content {
  36
  37 // NOTE: changes to this class need to be reviewed by the security team.
  38 class PpapiPluginSandboxedProcessLauncherDelegate
  39     : public content::SandboxedProcessLauncherDelegate {
  40  public:
  41   PpapiPluginSandboxedProcessLauncherDelegate(bool is_broker,
  42                                               const PepperPluginInfo& info,
  43                                               ChildProcessHost* host)
  44       :
  45 #if defined(OS_POSIX)
  46         info_(info),
  47         ipc_fd_(host->TakeClientFileDescriptor()),
  48 #endif  // OS_POSIX
  49         is_broker_(is_broker) {}
  50
  51   ~PpapiPluginSandboxedProcessLauncherDelegate() override {}
  52
  53 #if defined(OS_WIN)
  54   bool ShouldSandbox() override {
  55     return !is_broker_;
  56   }
  57
  58   void PreSpawnTarget(sandbox::TargetPolicy* policy, bool* success) override {
  59     if (is_broker_)
  60       return;
  61     // The Pepper process as locked-down as a renderer execpt that it can
  62     // create the server side of chrome pipes.
  63     sandbox::ResultCode result;
  64     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
  65                              sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
  66                              L"\\\\.\\pipe\\chrome.*");
  67     *success = (result == sandbox::SBOX_ALL_OK);
  68   }
  69
  70 #elif defined(OS_POSIX)
  71   bool ShouldUseZygote() override {
  72     const base::CommandLine& browser_command_line =
  73         *base::CommandLine::ForCurrentProcess();
  74     base::CommandLine::StringType plugin_launcher = browser_command_line
  75         .GetSwitchValueNative(switches::kPpapiPluginLauncher);
  76     return !is_broker_ && plugin_launcher.empty();
  77   }
  78   base::ScopedFD TakeIpcFd() override { return ipc_fd_.Pass(); }
  79 #endif  // OS_WIN
  80
  81  private:
  82 #if defined(OS_POSIX)
  83   const PepperPluginInfo& info_;
  84   base::ScopedFD ipc_fd_;
  85 #endif  // OS_POSIX
  86   bool is_broker_;
  87
  88   DISALLOW_COPY_AND_ASSIGN(PpapiPluginSandboxedProcessLauncherDelegate);
  89 };
  90
  91 class PpapiPluginProcessHost::PluginNetworkObserver
  92     : public net::NetworkChangeNotifier::IPAddressObserver,
  93       public net::NetworkChangeNotifier::ConnectionTypeObserver {
  94  public:
  95   explicit PluginNetworkObserver(PpapiPluginProcessHost* process_host)
  96       : process_host_(process_host) {
  97     net::NetworkChangeNotifier::AddIPAddressObserver(this);
  98     net::NetworkChangeNotifier::AddConnectionTypeObserver(this);
  99   }
 100
 101   ~PluginNetworkObserver() override {
 102     net::NetworkChangeNotifier::RemoveConnectionTypeObserver(this);
 103     net::NetworkChangeNotifier::RemoveIPAddressObserver(this);
 104   }
 105
 106   // IPAddressObserver implementation.
 107   void OnIPAddressChanged() override {
 108     // TODO(brettw) bug 90246: This doesn't seem correct. The online/offline
 109     // notification seems like it should be sufficient, but I don't see that
 110     // when I unplug and replug my network cable. Sending this notification when
 111     // "something" changes seems to make Flash reasonably happy, but seems
 112     // wrong. We should really be able to provide the real online state in
 113     // OnConnectionTypeChanged().
 114     process_host_->Send(new PpapiMsg_SetNetworkState(true));
 115   }
 116
 117   // ConnectionTypeObserver implementation.
 118   void OnConnectionTypeChanged(
 119       net::NetworkChangeNotifier::ConnectionType type) override {
 120     process_host_->Send(new PpapiMsg_SetNetworkState(
 121         type != net::NetworkChangeNotifier::CONNECTION_NONE));
 122   }
 123
 124  private:
 125   PpapiPluginProcessHost* const process_host_;
 126 };
 127
 128 PpapiPluginProcessHost::~PpapiPluginProcessHost() {
 129   DVLOG(1) << "PpapiPluginProcessHost" << (is_broker_ ? "[broker]" : "")
 130            << "~PpapiPluginProcessHost()";
 131   CancelRequests();
 132 }
 133
 134 // static
 135 PpapiPluginProcessHost* PpapiPluginProcessHost::CreatePluginHost(
 136     const PepperPluginInfo& info,
 137     const base::FilePath& profile_data_directory) {
 138   PpapiPluginProcessHost* plugin_host = new PpapiPluginProcessHost(
 139       info, profile_data_directory);
 140   DCHECK(plugin_host);
 141   if (plugin_host->Init(info))
 142     return plugin_host;
 143
 144   NOTREACHED();  // Init is not expected to fail.
 145   return NULL;
 146 }
 147
 148 // static
 149 PpapiPluginProcessHost* PpapiPluginProcessHost::CreateBrokerHost(
 150     const PepperPluginInfo& info) {
 151   PpapiPluginProcessHost* plugin_host =
 152       new PpapiPluginProcessHost();
 153   if (plugin_host->Init(info))
 154     return plugin_host;
 155
 156   NOTREACHED();  // Init is not expected to fail.
 157   return NULL;
 158 }
 159
 160 // static
 161 void PpapiPluginProcessHost::DidCreateOutOfProcessInstance(
 162     int plugin_process_id,
 163     int32 pp_instance,
 164     const PepperRendererInstanceData& instance_data) {
 165   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
 166     if (iter->process_.get() &&
 167         iter->process_->GetData().id == plugin_process_id) {
 168       // Found the plugin.
 169       iter->host_impl_->AddInstance(pp_instance, instance_data);
 170       return;
 171     }
 172   }
 173   // We'll see this passed with a 0 process ID for the browser tag stuff that
 174   // is currently in the process of being removed.
 175   //
 176   // TODO(brettw) When old browser tag impl is removed
 177   // (PepperPluginDelegateImpl::CreateBrowserPluginModule passes a 0 plugin
 178   // process ID) this should be converted to a NOTREACHED().
 179   DCHECK(plugin_process_id == 0)
 180       << "Renderer sent a bad plugin process host ID";
 181 }
 182
 183 // static
 184 void PpapiPluginProcessHost::DidDeleteOutOfProcessInstance(
 185     int plugin_process_id,
 186     int32 pp_instance) {
 187   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
 188     if (iter->process_.get() &&
 189         iter->process_->GetData().id == plugin_process_id) {
 190       // Found the plugin.
 191       iter->host_impl_->DeleteInstance(pp_instance);
 192       return;
 193     }
 194   }
 195   // Note: It's possible that the plugin process has already been deleted by
 196   // the time this message is received. For example, it could have crashed.
 197   // That's OK, we can just ignore this message.
 198 }
 199
 200 // static
 201 void PpapiPluginProcessHost::OnPluginInstanceThrottleStateChange(
 202     int plugin_process_id,
 203     int32 pp_instance,
 204     bool is_throttled) {
 205   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
 206     if (iter->process_.get() &&
 207         iter->process_->GetData().id == plugin_process_id) {
 208       // Found the plugin.
 209       iter->host_impl_->OnThrottleStateChanged(pp_instance, is_throttled);
 210       return;
 211     }
 212   }
 213   // Note: It's possible that the plugin process has already been deleted by
 214   // the time this message is received. For example, it could have crashed.
 215   // That's OK, we can just ignore this message.
 216 }
 217
 218 // static
 219 void PpapiPluginProcessHost::FindByName(
 220     const base::string16& name,
 221     std::vector<PpapiPluginProcessHost*>* hosts) {
 222   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
 223     if (iter->process_.get() && iter->process_->GetData().name == name)
 224       hosts->push_back(*iter);
 225   }
 226 }
 227
 228 bool PpapiPluginProcessHost::Send(IPC::Message* message) {
 229   return process_->Send(message);
 230 }
 231
 232 void PpapiPluginProcessHost::OpenChannelToPlugin(Client* client) {
 233   if (process_->GetHost()->IsChannelOpening()) {
 234     // The channel is already in the process of being opened.  Put
 235     // this "open channel" request into a queue of requests that will
 236     // be run once the channel is open.
 237     pending_requests_.push_back(client);
 238     return;
 239   }
 240
 241   // We already have an open channel, send a request right away to plugin.
 242   RequestPluginChannel(client);
 243 }
 244
 245 PpapiPluginProcessHost::PpapiPluginProcessHost(
 246     const PepperPluginInfo& info,
 247     const base::FilePath& profile_data_directory)
 248     : profile_data_directory_(profile_data_directory),
 249       is_broker_(false) {
 250   uint32 base_permissions = info.permissions;
 251
 252   // We don't have to do any whitelisting for APIs in this process host, so
 253   // don't bother passing a browser context or document url here.
 254   if (GetContentClient()->browser()->IsPluginAllowedToUseDevChannelAPIs(
 255           NULL, GURL()))
 256     base_permissions |= ppapi::PERMISSION_DEV_CHANNEL;
 257   permissions_ = ppapi::PpapiPermissions::GetForCommandLine(base_permissions);
 258
 259   process_.reset(new BrowserChildProcessHostImpl(
 260       PROCESS_TYPE_PPAPI_PLUGIN, this));
 261
 262   host_impl_.reset(new BrowserPpapiHostImpl(this, permissions_, info.name,
 263                                             info.path, profile_data_directory,
 264                                             false /* in_process */,
 265                                             false /* external_plugin */));
 266
 267   filter_ = new PepperMessageFilter();
 268   process_->AddFilter(filter_.get());
 269   process_->GetHost()->AddFilter(host_impl_->message_filter().get());
 270
 271   GetContentClient()->browser()->DidCreatePpapiPlugin(host_impl_.get());
 272
 273   // Only request network status updates if the plugin has dev permissions.
 274   if (permissions_.HasPermission(ppapi::PERMISSION_DEV))
 275     network_observer_.reset(new PluginNetworkObserver(this));
 276 }
 277
 278 PpapiPluginProcessHost::PpapiPluginProcessHost()
 279     : is_broker_(true) {
 280   process_.reset(new BrowserChildProcessHostImpl(
 281       PROCESS_TYPE_PPAPI_BROKER, this));
 282
 283   ppapi::PpapiPermissions permissions;  // No permissions.
 284   // The plugin name, path and profile data directory shouldn't be needed for
 285   // the broker.
 286   host_impl_.reset(new BrowserPpapiHostImpl(this, permissions,
 287                                             std::string(), base::FilePath(),
 288                                             base::FilePath(),
 289                                             false /* in_process */,
 290                                             false /* external_plugin */));
 291 }
 292
 293 bool PpapiPluginProcessHost::Init(const PepperPluginInfo& info) {
 294   plugin_path_ = info.path;
 295   if (info.name.empty()) {
 296     process_->SetName(plugin_path_.BaseName().LossyDisplayName());
 297   } else {
 298     process_->SetName(base::UTF8ToUTF16(info.name));
 299   }
 300
 301   std::string channel_id = process_->GetHost()->CreateChannel();
 302   if (channel_id.empty()) {
 303     VLOG(1) << "Could not create pepper host channel.";
 304     return false;
 305   }
 306
 307   const base::CommandLine& browser_command_line =
 308       *base::CommandLine::ForCurrentProcess();
 309   base::CommandLine::StringType plugin_launcher =
 310       browser_command_line.GetSwitchValueNative(switches::kPpapiPluginLauncher);
 311
 312 #if defined(OS_LINUX)
 313   int flags = plugin_launcher.empty() ? ChildProcessHost::CHILD_ALLOW_SELF :
 314                                         ChildProcessHost::CHILD_NORMAL;
 315 #else
 316   int flags = ChildProcessHost::CHILD_NORMAL;
 317 #endif
 318   base::FilePath exe_path = ChildProcessHost::GetChildPath(flags);
 319   if (exe_path.empty()) {
 320     VLOG(1) << "Pepper plugin exe path is empty.";
 321     return false;
 322   }
 323
 324   base::CommandLine* cmd_line = new base::CommandLine(exe_path);
 325   cmd_line->AppendSwitchASCII(switches::kProcessType,
 326                               is_broker_ ? switches::kPpapiBrokerProcess
 327                                          : switches::kPpapiPluginProcess);
 328   cmd_line->AppendSwitchASCII(switches::kProcessChannelID, channel_id);
 329
 330   // These switches are forwarded to both plugin and broker pocesses.
 331   static const char* kCommonForwardSwitches[] = {
 332     switches::kVModule
 333   };
 334   cmd_line->CopySwitchesFrom(browser_command_line, kCommonForwardSwitches,
 335                              arraysize(kCommonForwardSwitches));
 336
 337   if (!is_broker_) {
 338     static const char* kPluginForwardSwitches[] = {
 339       switches::kDisableSeccompFilterSandbox,
 340 #if defined(OS_MACOSX)
 341       switches::kEnableSandboxLogging,
 342 #endif
 343       switches::kNoSandbox,
 344       switches::kPpapiStartupDialog,
 345     };
 346     cmd_line->CopySwitchesFrom(browser_command_line, kPluginForwardSwitches,
 347                                arraysize(kPluginForwardSwitches));
 348
 349     // Copy any flash args over and introduce field trials if necessary.
 350     // TODO(vtl): Stop passing flash args in the command line, or windows is
 351     // going to explode.
 352     std::string field_trial =
 353         base::FieldTrialList::FindFullName(kFlashHwVideoDecodeFieldTrialName);
 354     std::string existing_args =
 355         browser_command_line.GetSwitchValueASCII(switches::kPpapiFlashArgs);
 356     if (field_trial == kFlashHwVideoDecodeFieldTrialEnabledName) {
 357       // Arguments passed to Flash are comma delimited.
 358       if (!existing_args.empty())
 359         existing_args.append(",");
 360       existing_args.append("enable_hw_video_decode=1");
 361 #if defined(OS_MACOSX)
 362       // TODO(ihf): Remove this once Flash newer than 15.0.0.223 is released.
 363       existing_args.append(",enable_hw_video_decode_mac=1");
 364 #endif
 365     }
 366     cmd_line->AppendSwitchASCII(switches::kPpapiFlashArgs, existing_args);
 367   }
 368
 369   std::string locale = GetContentClient()->browser()->GetApplicationLocale();
 370   if (!locale.empty()) {
 371     // Pass on the locale so the plugin will know what language we're using.
 372     cmd_line->AppendSwitchASCII(switches::kLang, locale);
 373   }
 374
 375   if (!plugin_launcher.empty())
 376     cmd_line->PrependWrapper(plugin_launcher);
 377
 378   // On posix, never use the zygote for the broker. Also, only use the zygote if
 379   // we are not using a plugin launcher - having a plugin launcher means we need
 380   // to use another process instead of just forking the zygote.
 381   process_->Launch(
 382       new PpapiPluginSandboxedProcessLauncherDelegate(is_broker_,
 383                                                       info,
 384                                                       process_->GetHost()),
 385       cmd_line,
 386       true);
 387   return true;
 388 }
 389
 390 void PpapiPluginProcessHost::RequestPluginChannel(Client* client) {
 391   base::ProcessHandle process_handle;
 392   int renderer_child_id;
 393   client->GetPpapiChannelInfo(&process_handle, &renderer_child_id);
 394
 395   base::ProcessId process_id = (process_handle == base::kNullProcessHandle) ?
 396       0 : base::GetProcId(process_handle);
 397
 398   // We can't send any sync messages from the browser because it might lead to
 399   // a hang. See the similar code in PluginProcessHost for more description.
 400   PpapiMsg_CreateChannel* msg = new PpapiMsg_CreateChannel(
 401       process_id, renderer_child_id, client->OffTheRecord());
 402   msg->set_unblock(true);
 403   if (Send(msg)) {
 404     sent_requests_.push(client);
 405   } else {
 406     client->OnPpapiChannelOpened(IPC::ChannelHandle(), base::kNullProcessId, 0);
 407   }
 408 }
 409
 410 void PpapiPluginProcessHost::OnProcessLaunched() {
 411   VLOG(2) << "ppapi plugin process launched.";
 412   host_impl_->set_plugin_process(process_->GetProcess().Duplicate());
 413 }
 414
 415 void PpapiPluginProcessHost::OnProcessCrashed(int exit_code) {
 416   VLOG(1) << "ppapi plugin process crashed.";
 417   PluginServiceImpl::GetInstance()->RegisterPluginCrash(plugin_path_);
 418 }
 419
 420 bool PpapiPluginProcessHost::OnMessageReceived(const IPC::Message& msg) {
 421   bool handled = true;
 422   IPC_BEGIN_MESSAGE_MAP(PpapiPluginProcessHost, msg)
 423     IPC_MESSAGE_HANDLER(PpapiHostMsg_ChannelCreated,
 424                         OnRendererPluginChannelCreated)
 425     IPC_MESSAGE_UNHANDLED(handled = false)
 426   IPC_END_MESSAGE_MAP()
 427   DCHECK(handled);
 428   return handled;
 429 }
 430
 431 // Called when the browser <--> plugin channel has been established.
 432 void PpapiPluginProcessHost::OnChannelConnected(int32 peer_pid) {
 433   // This will actually load the plugin. Errors will actually not be reported
 434   // back at this point. Instead, the plugin will fail to establish the
 435   // connections when we request them on behalf of the renderer(s).
 436   Send(new PpapiMsg_LoadPlugin(plugin_path_, permissions_));
 437
 438   // Process all pending channel requests from the renderers.
 439   for (size_t i = 0; i < pending_requests_.size(); i++)
 440     RequestPluginChannel(pending_requests_[i]);
 441   pending_requests_.clear();
 442 }
 443
 444 // Called when the browser <--> plugin channel has an error. This normally
 445 // means the plugin has crashed.
 446 void PpapiPluginProcessHost::OnChannelError() {
 447   VLOG(1) << "PpapiPluginProcessHost" << (is_broker_ ? "[broker]" : "")
 448           << "::OnChannelError()";
 449   // We don't need to notify the renderers that were communicating with the
 450   // plugin since they have their own channels which will go into the error
 451   // state at the same time. Instead, we just need to notify any renderers
 452   // that have requested a connection but have not yet received one.
 453   CancelRequests();
 454 }
 455
 456 void PpapiPluginProcessHost::CancelRequests() {
 457   DVLOG(1) << "PpapiPluginProcessHost" << (is_broker_ ? "[broker]" : "")
 458            << "CancelRequests()";
 459   for (size_t i = 0; i < pending_requests_.size(); i++) {
 460     pending_requests_[i]->OnPpapiChannelOpened(IPC::ChannelHandle(),
 461                                                base::kNullProcessId, 0);
 462   }
 463   pending_requests_.clear();
 464
 465   while (!sent_requests_.empty()) {
 466     sent_requests_.front()->OnPpapiChannelOpened(IPC::ChannelHandle(),
 467                                                  base::kNullProcessId, 0);
 468     sent_requests_.pop();
 469   }
 470 }
 471
 472 // Called when a new plugin <--> renderer channel has been created.
 473 void PpapiPluginProcessHost::OnRendererPluginChannelCreated(
 474     const IPC::ChannelHandle& channel_handle) {
 475   if (sent_requests_.empty())
 476     return;
 477
 478   // All requests should be processed FIFO, so the next item in the
 479   // sent_requests_ queue should be the one that the plugin just created.
 480   Client* client = sent_requests_.front();
 481   sent_requests_.pop();
 482
 483   const ChildProcessData& data = process_->GetData();
 484   client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle),
 485                                data.id);
 486 }
 487
 488 }  // namespace content