Make the Pepper TCP open the firewall on Cros.

content/browser/renderer_host/pepper/pepper_socket_utils.cc

Index: content/browser/renderer_host/pepper/pepper_socket_utils.cc
diff --git a/content/browser/renderer_host/pepper/pepper_socket_utils.cc b/content/browser/renderer_host/pepper/pepper_socket_utils.cc
index 45d35ce4160cf14f653cbb1879bc0d00a607e031..16ac1ff9f40fa14a5cd4ca9cd24fc6162a4761bd 100644
--- a/content/browser/renderer_host/pepper/pepper_socket_utils.cc
+++ b/content/browser/renderer_host/pepper/pepper_socket_utils.cc
@@ -15,11 +15,16 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/common/content_client.h"
+#include "net/base/ip_address_number.h"
 #include "net/cert/x509_certificate.h"
 #include "ppapi/c/private/ppb_net_address_private.h"
 #include "ppapi/shared_impl/private/net_address_private_impl.h"
 #include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
 
+#if defined(OS_CHROMEOS)
+#include "chromeos/network/firewall_hole.h"
+#endif  // defined(OS_CHROMEOS)
+
 namespace content {
 namespace pepper_socket_utils {
 
@@ -43,7 +48,7 @@ bool CanUseSocketAPIs(bool external_plugin,
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (!external_plugin) {
     // Always allow socket APIs for out-process plugins (other than external
-    // plugins instantiated by the embeeder through
+    // plugins instantiated by the embedder through
     // BrowserPpapiHost::CreateExternalPluginProcess).
     return true;
   }
@@ -128,5 +133,49 @@ bool GetCertificateFields(const char* der,
   return GetCertificateFields(*cert.get(), fields);
 }
 
+#if defined(OS_CHROMEOS)
+using ppapi::NetAddressPrivateImpl;
+namespace {
+bool isLoopbackAddress(const net::IPAddressNumber& address) {
+  static const net::IPAddressNumber kIPv6Loopback = {0, 0, 0, 0, 0, 0, 0, 0,
+                                                     0, 0, 0, 0, 0, 0, 0, 1};
+  if (address.size() == net::kIPv4AddressSize && address[0] == 0x7f) {
+    // All of 127.0.0.0/8 is loopback in ipv4.
+    return true;
+  } else if (address.size() == net::kIPv6AddressSize &&
+             address == kIPv6Loopback) {
+    // ::1 is the only loopback address in ipv6.
+    return true;
+  }
+  return false;
+}
+
+std::string addressToFirewallString(const net::IPAddressNumber& address) {
+  static const net::IPAddressNumber kIPv4Empty = {0, 0, 0, 0};
+  static const net::IPAddressNumber kIPv6Empty = {0, 0, 0, 0, 0, 0, 0, 0,
+                                                  0, 0, 0, 0, 0, 0, 0, 0};
+  if (address == kIPv4Empty || address == kIPv6Empty) {
+    return std::string();
+  }
+  return net::IPAddressToString(address);
+}
+}  // namespace
+
+bool OpenFirewallHole(const PP_NetAddress_Private& bind_address,
+                      FirewallHoleOpenCallback callback) {
+  net::IPAddressNumber address;
+  uint16_t port;
+  NetAddressPrivateImpl::NetAddressToIPEndPoint(bind_address, &address, &port);
+  if (isLoopbackAddress(address)) {
+    return false;
+  }
+  std::string address_string = addressToFirewallString(address);
+
+  chromeos::FirewallHole::Open(chromeos::FirewallHole::PortType::TCP, port,
+                               address_string, callback);
+  return true;
+}
+#endif  // defined(OS_CHROMEOS)
+
 }  // namespace pepper_socket_utils
 }  // namespace content