content/browser/ppapi_plugin_process_host.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/ppapi_plugin_process_host.h"
   6
   7 #include <string>
   8
   9 #include "base/base_switches.h"
  10 #include "base/command_line.h"
  11 #include "base/files/file_path.h"
  12 #include "base/metrics/field_trial.h"
  13 #include "base/strings/utf_string_conversions.h"
  14 #include "content/browser/browser_child_process_host_impl.h"
  15 #include "content/browser/plugin_service_impl.h"
  16 #include "content/browser/renderer_host/render_message_filter.h"
  17 #include "content/common/child_process_host_impl.h"
  18 #include "content/common/child_process_messages.h"
  19 #include "content/public/browser/content_browser_client.h"
  20 #include "content/public/common/content_constants.h"
  21 #include "content/public/common/content_switches.h"
  22 #include "content/public/common/pepper_plugin_info.h"
  23 #include "content/public/common/process_type.h"
  24 #include "ipc/ipc_switches.h"
  25 #include "net/base/network_change_notifier.h"
  26 #include "ppapi/proxy/ppapi_messages.h"
  27 #include "ui/base/ui_base_switches.h"
  28
  29 #if defined(OS_WIN)
  30 #include "content/common/sandbox_win.h"
  31 #include "content/public/common/sandboxed_process_launcher_delegate.h"
  32 #include "sandbox/win/src/sandbox_policy.h"
  33 #endif
  34
  35 namespace content {
  36
  37 #if defined(OS_WIN)
  38 // NOTE: changes to this class need to be reviewed by the security team.
  39 class PpapiPluginSandboxedProcessLauncherDelegate
  40     : public content::SandboxedProcessLauncherDelegate {
  41  public:
  42   explicit PpapiPluginSandboxedProcessLauncherDelegate(bool is_broker)
  43       : is_broker_(is_broker) {}
  44   virtual ~PpapiPluginSandboxedProcessLauncherDelegate() {}
  45
  46   virtual void ShouldSandbox(bool* in_sandbox) OVERRIDE {
  47     if (is_broker_)
  48       *in_sandbox = false;
  49   }
  50
  51   virtual void PreSpawnTarget(sandbox::TargetPolicy* policy,
  52                               bool* success) {
  53     if (is_broker_)
  54       return;
  55     // The Pepper process as locked-down as a renderer execpt that it can
  56     // create the server side of chrome pipes.
  57     sandbox::ResultCode result;
  58     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
  59                              sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
  60                              L"\\\\.\\pipe\\chrome.*");
  61     *success = (result == sandbox::SBOX_ALL_OK);
  62   }
  63
  64  private:
  65   bool is_broker_;
  66
  67   DISALLOW_COPY_AND_ASSIGN(PpapiPluginSandboxedProcessLauncherDelegate);
  68 };
  69 #endif  // OS_WIN
  70
  71 class PpapiPluginProcessHost::PluginNetworkObserver
  72     : public net::NetworkChangeNotifier::IPAddressObserver,
  73       public net::NetworkChangeNotifier::ConnectionTypeObserver {
  74  public:
  75   explicit PluginNetworkObserver(PpapiPluginProcessHost* process_host)
  76       : process_host_(process_host) {
  77     net::NetworkChangeNotifier::AddIPAddressObserver(this);
  78     net::NetworkChangeNotifier::AddConnectionTypeObserver(this);
  79   }
  80
  81   virtual ~PluginNetworkObserver() {
  82     net::NetworkChangeNotifier::RemoveConnectionTypeObserver(this);
  83     net::NetworkChangeNotifier::RemoveIPAddressObserver(this);
  84   }
  85
  86   // IPAddressObserver implementation.
  87   virtual void OnIPAddressChanged() OVERRIDE {
  88     // TODO(brettw) bug 90246: This doesn't seem correct. The online/offline
  89     // notification seems like it should be sufficient, but I don't see that
  90     // when I unplug and replug my network cable. Sending this notification when
  91     // "something" changes seems to make Flash reasonably happy, but seems
  92     // wrong. We should really be able to provide the real online state in
  93     // OnConnectionTypeChanged().
  94     process_host_->Send(new PpapiMsg_SetNetworkState(true));
  95   }
  96
  97   // ConnectionTypeObserver implementation.
  98   virtual void OnConnectionTypeChanged(
  99       net::NetworkChangeNotifier::ConnectionType type) OVERRIDE {
 100     process_host_->Send(new PpapiMsg_SetNetworkState(
 101         type != net::NetworkChangeNotifier::CONNECTION_NONE));
 102   }
 103
 104  private:
 105   PpapiPluginProcessHost* const process_host_;
 106 };
 107
 108 PpapiPluginProcessHost::~PpapiPluginProcessHost() {
 109   DVLOG(1) << "PpapiPluginProcessHost" << (is_broker_ ? "[broker]" : "")
 110            << "~PpapiPluginProcessHost()";
 111   CancelRequests();
 112 }
 113
 114 // static
 115 PpapiPluginProcessHost* PpapiPluginProcessHost::CreatePluginHost(
 116     const PepperPluginInfo& info,
 117     const base::FilePath& profile_data_directory) {
 118   PpapiPluginProcessHost* plugin_host = new PpapiPluginProcessHost(
 119       info, profile_data_directory);
 120   DCHECK(plugin_host);
 121   if (plugin_host->Init(info))
 122     return plugin_host;
 123
 124   NOTREACHED();  // Init is not expected to fail.
 125   return NULL;
 126 }
 127
 128 // static
 129 PpapiPluginProcessHost* PpapiPluginProcessHost::CreateBrokerHost(
 130     const PepperPluginInfo& info) {
 131   PpapiPluginProcessHost* plugin_host =
 132       new PpapiPluginProcessHost();
 133   if (plugin_host->Init(info))
 134     return plugin_host;
 135
 136   NOTREACHED();  // Init is not expected to fail.
 137   return NULL;
 138 }
 139
 140 // static
 141 void PpapiPluginProcessHost::DidCreateOutOfProcessInstance(
 142     int plugin_process_id,
 143     int32 pp_instance,
 144     const PepperRendererInstanceData& instance_data) {
 145   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
 146     if (iter->process_.get() &&
 147         iter->process_->GetData().id == plugin_process_id) {
 148       // Found the plugin.
 149       iter->host_impl_->AddInstance(pp_instance, instance_data);
 150       return;
 151     }
 152   }
 153   // We'll see this passed with a 0 process ID for the browser tag stuff that
 154   // is currently in the process of being removed.
 155   //
 156   // TODO(brettw) When old browser tag impl is removed
 157   // (PepperPluginDelegateImpl::CreateBrowserPluginModule passes a 0 plugin
 158   // process ID) this should be converted to a NOTREACHED().
 159   DCHECK(plugin_process_id == 0)
 160       << "Renderer sent a bad plugin process host ID";
 161 }
 162
 163 // static
 164 void PpapiPluginProcessHost::DidDeleteOutOfProcessInstance(
 165     int plugin_process_id,
 166     int32 pp_instance) {
 167   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
 168     if (iter->process_.get() &&
 169         iter->process_->GetData().id == plugin_process_id) {
 170       // Found the plugin.
 171       iter->host_impl_->DeleteInstance(pp_instance);
 172       return;
 173     }
 174   }
 175   // Note: It's possible that the plugin process has already been deleted by
 176   // the time this message is received. For example, it could have crashed.
 177   // That's OK, we can just ignore this message.
 178 }
 179
 180 // static
 181 void PpapiPluginProcessHost::FindByName(
 182     const base::string16& name,
 183     std::vector<PpapiPluginProcessHost*>* hosts) {
 184   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
 185     if (iter->process_.get() && iter->process_->GetData().name == name)
 186       hosts->push_back(*iter);
 187   }
 188 }
 189
 190 bool PpapiPluginProcessHost::Send(IPC::Message* message) {
 191   return process_->Send(message);
 192 }
 193
 194 void PpapiPluginProcessHost::OpenChannelToPlugin(Client* client) {
 195   if (process_->GetHost()->IsChannelOpening()) {
 196     // The channel is already in the process of being opened.  Put
 197     // this "open channel" request into a queue of requests that will
 198     // be run once the channel is open.
 199     pending_requests_.push_back(client);
 200     return;
 201   }
 202
 203   // We already have an open channel, send a request right away to plugin.
 204   RequestPluginChannel(client);
 205 }
 206
 207 PpapiPluginProcessHost::PpapiPluginProcessHost(
 208     const PepperPluginInfo& info,
 209     const base::FilePath& profile_data_directory)
 210     : profile_data_directory_(profile_data_directory),
 211       is_broker_(false) {
 212   uint32 base_permissions = info.permissions;
 213   if (GetContentClient()->browser()->IsPluginAllowedToUseDevChannelAPIs())
 214     base_permissions |= ppapi::PERMISSION_DEV_CHANNEL;
 215   permissions_ = ppapi::PpapiPermissions::GetForCommandLine(base_permissions);
 216
 217   process_.reset(new BrowserChildProcessHostImpl(
 218       PROCESS_TYPE_PPAPI_PLUGIN, this));
 219
 220   host_impl_.reset(new BrowserPpapiHostImpl(this, permissions_, info.name,
 221                                             info.path, profile_data_directory,
 222                                             false /* in_process */,
 223                                             false /* external_plugin */));
 224
 225   filter_ = new PepperMessageFilter();
 226   process_->AddFilter(filter_.get());
 227   process_->GetHost()->AddFilter(host_impl_->message_filter().get());
 228
 229   GetContentClient()->browser()->DidCreatePpapiPlugin(host_impl_.get());
 230
 231   // Only request network status updates if the plugin has dev permissions.
 232   if (permissions_.HasPermission(ppapi::PERMISSION_DEV))
 233     network_observer_.reset(new PluginNetworkObserver(this));
 234 }
 235
 236 PpapiPluginProcessHost::PpapiPluginProcessHost()
 237     : is_broker_(true) {
 238   process_.reset(new BrowserChildProcessHostImpl(
 239       PROCESS_TYPE_PPAPI_BROKER, this));
 240
 241   ppapi::PpapiPermissions permissions;  // No permissions.
 242   // The plugin name, path and profile data directory shouldn't be needed for
 243   // the broker.
 244   host_impl_.reset(new BrowserPpapiHostImpl(this, permissions,
 245                                             std::string(), base::FilePath(),
 246                                             base::FilePath(),
 247                                             false /* in_process */,
 248                                             false /* external_plugin */));
 249 }
 250
 251 bool PpapiPluginProcessHost::Init(const PepperPluginInfo& info) {
 252   plugin_path_ = info.path;
 253   if (info.name.empty()) {
 254     process_->SetName(plugin_path_.BaseName().LossyDisplayName());
 255   } else {
 256     process_->SetName(base::UTF8ToUTF16(info.name));
 257   }
 258
 259   std::string channel_id = process_->GetHost()->CreateChannel();
 260   if (channel_id.empty()) {
 261     VLOG(1) << "Could not create pepper host channel.";
 262     return false;
 263   }
 264
 265   const CommandLine& browser_command_line = *CommandLine::ForCurrentProcess();
 266   CommandLine::StringType plugin_launcher =
 267       browser_command_line.GetSwitchValueNative(switches::kPpapiPluginLauncher);
 268
 269 #if defined(OS_LINUX)
 270   int flags = plugin_launcher.empty() ? ChildProcessHost::CHILD_ALLOW_SELF :
 271                                         ChildProcessHost::CHILD_NORMAL;
 272 #else
 273   int flags = ChildProcessHost::CHILD_NORMAL;
 274 #endif
 275   base::FilePath exe_path = ChildProcessHost::GetChildPath(flags);
 276   if (exe_path.empty()) {
 277     VLOG(1) << "Pepper plugin exe path is empty.";
 278     return false;
 279   }
 280
 281   CommandLine* cmd_line = new CommandLine(exe_path);
 282   cmd_line->AppendSwitchASCII(switches::kProcessType,
 283                               is_broker_ ? switches::kPpapiBrokerProcess
 284                                          : switches::kPpapiPluginProcess);
 285   cmd_line->AppendSwitchASCII(switches::kProcessChannelID, channel_id);
 286
 287   // These switches are forwarded to both plugin and broker pocesses.
 288   static const char* kCommonForwardSwitches[] = {
 289     switches::kVModule
 290   };
 291   cmd_line->CopySwitchesFrom(browser_command_line, kCommonForwardSwitches,
 292                              arraysize(kCommonForwardSwitches));
 293
 294   if (!is_broker_) {
 295     static const char* kPluginForwardSwitches[] = {
 296       switches::kDisableSeccompFilterSandbox,
 297 #if defined(OS_MACOSX)
 298       switches::kEnableSandboxLogging,
 299 #endif
 300       switches::kNoSandbox,
 301       switches::kPpapiStartupDialog,
 302     };
 303     cmd_line->CopySwitchesFrom(browser_command_line, kPluginForwardSwitches,
 304                                arraysize(kPluginForwardSwitches));
 305
 306     // Copy any flash args over and introduce field trials if necessary.
 307     // TODO(vtl): Stop passing flash args in the command line, or windows is
 308     // going to explode.
 309     std::string field_trial =
 310         base::FieldTrialList::FindFullName(kFlashHwVideoDecodeFieldTrialName);
 311     std::string existing_args =
 312         browser_command_line.GetSwitchValueASCII(switches::kPpapiFlashArgs);
 313     if (field_trial == kFlashHwVideoDecodeFieldTrialEnabledName) {
 314       // Arguments passed to Flash are comma delimited.
 315       if (!existing_args.empty())
 316         existing_args.append(",");
 317       existing_args.append("enable_hw_video_decode=1");
 318     }
 319     cmd_line->AppendSwitchASCII(switches::kPpapiFlashArgs, existing_args);
 320   }
 321
 322   std::string locale = GetContentClient()->browser()->GetApplicationLocale();
 323   if (!locale.empty()) {
 324     // Pass on the locale so the plugin will know what language we're using.
 325     cmd_line->AppendSwitchASCII(switches::kLang, locale);
 326   }
 327
 328   if (!plugin_launcher.empty())
 329     cmd_line->PrependWrapper(plugin_launcher);
 330
 331   // On posix, never use the zygote for the broker. Also, only use the zygote if
 332   // the plugin is sandboxed, and we are not using a plugin launcher - having a
 333   // plugin launcher means we need to use another process instead of just
 334   // forking the zygote.
 335 #if defined(OS_POSIX)
 336   bool use_zygote = !is_broker_ && plugin_launcher.empty() && info.is_sandboxed;
 337   if (!info.is_sandboxed)
 338     cmd_line->AppendSwitchASCII(switches::kNoSandbox, std::string());
 339 #endif  // OS_POSIX
 340   process_->Launch(
 341 #if defined(OS_WIN)
 342       new PpapiPluginSandboxedProcessLauncherDelegate(is_broker_),
 343 #elif defined(OS_POSIX)
 344       use_zygote,
 345       base::EnvironmentMap(),
 346 #endif
 347       cmd_line);
 348   return true;
 349 }
 350
 351 void PpapiPluginProcessHost::RequestPluginChannel(Client* client) {
 352   base::ProcessHandle process_handle;
 353   int renderer_child_id;
 354   client->GetPpapiChannelInfo(&process_handle, &renderer_child_id);
 355
 356   base::ProcessId process_id = (process_handle == base::kNullProcessHandle) ?
 357       0 : base::GetProcId(process_handle);
 358
 359   // We can't send any sync messages from the browser because it might lead to
 360   // a hang. See the similar code in PluginProcessHost for more description.
 361   PpapiMsg_CreateChannel* msg = new PpapiMsg_CreateChannel(
 362       process_id, renderer_child_id, client->OffTheRecord());
 363   msg->set_unblock(true);
 364   if (Send(msg)) {
 365     sent_requests_.push(client);
 366   } else {
 367     client->OnPpapiChannelOpened(IPC::ChannelHandle(), base::kNullProcessId, 0);
 368   }
 369 }
 370
 371 void PpapiPluginProcessHost::OnProcessLaunched() {
 372   VLOG(2) << "ppapi plugin process launched.";
 373   host_impl_->set_plugin_process_handle(process_->GetHandle());
 374 }
 375
 376 void PpapiPluginProcessHost::OnProcessCrashed(int exit_code) {
 377   VLOG(1) << "ppapi plugin process crashed.";
 378   PluginServiceImpl::GetInstance()->RegisterPluginCrash(plugin_path_);
 379 }
 380
 381 bool PpapiPluginProcessHost::OnMessageReceived(const IPC::Message& msg) {
 382   bool handled = true;
 383   IPC_BEGIN_MESSAGE_MAP(PpapiPluginProcessHost, msg)
 384     IPC_MESSAGE_HANDLER(PpapiHostMsg_ChannelCreated,
 385                         OnRendererPluginChannelCreated)
 386     IPC_MESSAGE_UNHANDLED(handled = false)
 387   IPC_END_MESSAGE_MAP()
 388   DCHECK(handled);
 389   return handled;
 390 }
 391
 392 // Called when the browser <--> plugin channel has been established.
 393 void PpapiPluginProcessHost::OnChannelConnected(int32 peer_pid) {
 394   // This will actually load the plugin. Errors will actually not be reported
 395   // back at this point. Instead, the plugin will fail to establish the
 396   // connections when we request them on behalf of the renderer(s).
 397   Send(new PpapiMsg_LoadPlugin(plugin_path_, permissions_));
 398
 399   // Process all pending channel requests from the renderers.
 400   for (size_t i = 0; i < pending_requests_.size(); i++)
 401     RequestPluginChannel(pending_requests_[i]);
 402   pending_requests_.clear();
 403 }
 404
 405 // Called when the browser <--> plugin channel has an error. This normally
 406 // means the plugin has crashed.
 407 void PpapiPluginProcessHost::OnChannelError() {
 408   VLOG(1) << "PpapiPluginProcessHost" << (is_broker_ ? "[broker]" : "")
 409           << "::OnChannelError()";
 410   // We don't need to notify the renderers that were communicating with the
 411   // plugin since they have their own channels which will go into the error
 412   // state at the same time. Instead, we just need to notify any renderers
 413   // that have requested a connection but have not yet received one.
 414   CancelRequests();
 415 }
 416
 417 void PpapiPluginProcessHost::CancelRequests() {
 418   DVLOG(1) << "PpapiPluginProcessHost" << (is_broker_ ? "[broker]" : "")
 419            << "CancelRequests()";
 420   for (size_t i = 0; i < pending_requests_.size(); i++) {
 421     pending_requests_[i]->OnPpapiChannelOpened(IPC::ChannelHandle(),
 422                                                base::kNullProcessId, 0);
 423   }
 424   pending_requests_.clear();
 425
 426   while (!sent_requests_.empty()) {
 427     sent_requests_.front()->OnPpapiChannelOpened(IPC::ChannelHandle(),
 428                                                  base::kNullProcessId, 0);
 429     sent_requests_.pop();
 430   }
 431 }
 432
 433 // Called when a new plugin <--> renderer channel has been created.
 434 void PpapiPluginProcessHost::OnRendererPluginChannelCreated(
 435     const IPC::ChannelHandle& channel_handle) {
 436   if (sent_requests_.empty())
 437     return;
 438
 439   // All requests should be processed FIFO, so the next item in the
 440   // sent_requests_ queue should be the one that the plugin just created.
 441   Client* client = sent_requests_.front();
 442   sent_requests_.pop();
 443
 444   const ChildProcessData& data = process_->GetData();
 445   client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle),
 446                                data.id);
 447 }
 448
 449 }  // namespace content