Move socket API restriction check to browser process

content/browser/renderer_host/pepper_message_filter.cc

Index: content/browser/renderer_host/pepper_message_filter.cc
diff --git a/content/browser/renderer_host/pepper_message_filter.cc b/content/browser/renderer_host/pepper_message_filter.cc
index f4183c6d3b8800a0ad23d4275663798dd9225746..28e23ddc585e17d0fe21f6828aeb267b19cf5aac 100644
--- a/content/browser/renderer_host/pepper_message_filter.cc
+++ b/content/browser/renderer_host/pepper_message_filter.cc
@@ -6,12 +6,15 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/process_util.h"
+#include "base/string_tokenizer.h"
 #include "base/threading/worker_pool.h"
 #include "base/values.h"
+#include "chrome/common/chrome_switches.h"

[Dmitry Polukhin, 2012/02/10 13:24:12]

It looks like header from chrome/... can't be included to content/... What place
would you recommend to place checks that work with chrome command line options?

[Dmitry Polukhin, 2012/02/10 14:05:45]

It looks like from architectural point of check for socket API should be part of
ContentBrowserClient interface and Chrome implementation should do actual check.
But I'm not sure that I fully understand architecture so please give me
directions.

[jam, 2012/02/10 18:23:54]

see my comment below. the switch and origin checking should be done in the
embedder

 #include "content/browser/font_list_async.h"
 #include "content/browser/renderer_host/pepper_tcp_socket.h"
 #include "content/browser/renderer_host/pepper_udp_socket.h"
@@ -46,24 +49,53 @@ namespace {
 const size_t kMaxSocketsAllowed = 1024;
 const uint32 kInvalidSocketID = 0;
 
+const char* kPredefinedAllowedSocketOrigins[] = {
+  "okddffdblfhhnmhodogpojmfkjmhinfp",  // Test SSH Client

[jam, 2012/02/10 18:23:54]

these are chrome extension IDs right? if so, extensions is a chrome feature and
doesn't belong in the content module. you will have to add a call out to the
embedder (i.e. through ContentBrowserClient) to ask it if a given socket origin
should be allowed

stepping back a bit. if i'm understanding correctly, what you want is that if a
renderer is hosting one of two known extensions, it can be allowed to use this
sockets APIs. if that's the case, then on construction of the
PepperMessageFilter (so on the UI thread) it can call the embedder with the
render_process_id. i dont know all the extension code, but it seems that we
should be able to get ExtensionService or some other class to tell us which
extension is being hosted in that process. then you can keep a boolean in
PepperMessageFilter about whether that API is allowed or not. then you don't
need the static maps etc.

[jam, 2012/02/10 18:33:42]

for completeness, here's how you can do this in the chrome code: 
BrowserContext* browser_context =
RenderProcessHost::FromID(process_id)->GetBrowserContext;
Profile* profile = Profile::FromBrowserContext(browser_context);
std::set<std::string> extensions =
profile->GetExtensionService()->process_map()->GetExtensionsInProcess();

and check if extensions has the two extension IDs that you want to whitelist
this API for

[Dmitry Polukhin, 2012/02/13 14:54:35]

Now this white-list contains only extensions but I don't want to limit it by
extensions only. Because it will complicate development process and all test for
TCP/UDP will have to be rewritten. I would like to keep ability to white-list
other hosts too (like local host or something more complicated).

Moreover as far as I understand render process may render multiple sites. I
would like to be precise and in case of uncompromised render allow to use
TCP/UDP sockets per-site (RenderView) not per-render process.

[Dmitry Polukhin, 2012/02/13 14:54:35]

My initial version used RenderProcessHost::FromID but it works only on UI thread
but I need to make check on IO thread and check must be sync (I can't post task
on UI thread). Therefore I have to pre-calculate which render can use sockets.

+  "pnhechapfaindjhompbnflcldabbghjo"   // HTerm App (SSH Client)
+};
+
 }  // namespace
 
+PepperMessageFilter::PepperMessageFilterMap PepperMessageFilter::instance_map_;
+base::Lock PepperMessageFilter::instance_map_mutex_;
+
 PepperMessageFilter::PepperMessageFilter(
+    int process_id,
     content::ResourceContext* resource_context)
     : resource_context_(resource_context),
       host_resolver_(NULL),
+      process_id_(process_id),
       next_socket_id_(1) {
   DCHECK(resource_context_);
+  DCHECK(process_id);
+  for (size_t i = 0; i < arraysize(kPredefinedAllowedSocketOrigins); ++i)
+    allowed_socket_origins_.insert(kPredefinedAllowedSocketOrigins[i]);
+
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  std::string allowed_list =
+      command_line.GetSwitchValueASCII(switches::kAllowNaClSocketAPI);
+  if (!allowed_list.empty()) {
+    StringTokenizer t(allowed_list, ",");
+    while (t.GetNext()) {
+      allowed_socket_origins_.insert(t.token());
+    }
+  }
+  base::AutoLock lock(instance_map_mutex_);
+  instance_map_.insert(PepperMessageFilterMap::value_type(process_id, this));
 }
 
 PepperMessageFilter::PepperMessageFilter(net::HostResolver* host_resolver)
     : resource_context_(NULL),
       host_resolver_(host_resolver),
+      process_id_(0),
       next_socket_id_(1) {
   DCHECK(host_resolver);
 }
 
-PepperMessageFilter::~PepperMessageFilter() {}
+PepperMessageFilter::~PepperMessageFilter() {
+  base::AutoLock lock(instance_map_mutex_);
+  instance_map_.erase(process_id_);
+}
 
 bool PepperMessageFilter::OnMessageReceived(const IPC::Message& msg,
                                             bool* message_was_ok) {
@@ -341,6 +373,11 @@ void PepperMessageFilter::OnGetFontFamilies(IPC::Message* reply_msg) {
 void PepperMessageFilter::OnTCPCreate(int32 routing_id,
                                       uint32 plugin_dispatcher_id,
                                       uint32* socket_id) {
+  if (!CanUseSocketAPIs(routing_id)) {
+    *socket_id = 0;
+    return;
+  }
+
   *socket_id = GenerateSocketID();
   if (*socket_id == kInvalidSocketID)
     return;
@@ -422,6 +459,11 @@ void PepperMessageFilter::OnTCPDisconnect(uint32 socket_id) {
 void PepperMessageFilter::OnUDPCreate(int32 routing_id,
                                       uint32 plugin_dispatcher_id,
                                       uint32* socket_id) {
+  if (!CanUseSocketAPIs(routing_id)) {
+    *socket_id = 0;
+    return;
+  }
+
   *socket_id = GenerateSocketID();
   if (*socket_id == kInvalidSocketID)
     return;
@@ -528,3 +570,36 @@ uint32 PepperMessageFilter::GenerateSocketID() {
 
   return socket_id;
 }
+
+bool PepperMessageFilter::CanUseSocketAPIs(int32 render_id) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+  if (host_resolver_) {
+    // Always allow socket APIs for out-process plugins.
+    // TODO(dpolukhin, yzshen): make the check consistent for in- and
+    // out-process cases.
+    return true;
+  }
+
+  base::AutoLock lock(allowed_socket_renders_mutex_);
+  return allowed_socket_renders_.find(render_id) !=
+      allowed_socket_renders_.end();
+}
+
+void PepperMessageFilter::SetRenderSite(int render_id, const GURL& url) {
+  base::AutoLock lock(allowed_socket_renders_mutex_);
+  if (url.is_valid() && allowed_socket_origins_.find(url.host()) !=
+                            allowed_socket_origins_.end()) {
+    allowed_socket_renders_.insert(render_id);
+  } else {
+    allowed_socket_renders_.erase(render_id);
+  }
+}
+
+void PepperMessageFilter::SetRenderSite(int process_id,
+                                        int render_id,
+                                        const GURL& url) {
+  base::AutoLock lock(instance_map_mutex_);
+  PepperMessageFilterMap::iterator it = instance_map_.find(process_id);
+  if (it != instance_map_.end())
+    it->second->SetRenderSite(render_id, url);
+}