Implement IPC::ChannelFactory, a class that accept()s on a UNIX socket.

ipc/unix_domain_socket_util.cc

+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ipc/unix_domain_socket_util.h"
+
+#include <fcntl.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+#include "base/file_util.h"
+#include "base/files/file_path.h"
+#include "base/logging.h"
+#include "base/posix/eintr_wrapper.h"
+
+namespace IPC {
+
+// Verify that kMaxPipeNameLength is a decent size.
+COMPILE_ASSERT(sizeof(((sockaddr_un*)0)->sun_path) >= kMaxPipeNameLength,
+               BAD_SUN_PATH_LENGTH);
+
+namespace {
+
+// returns fd (>= 0) on success, -1 on failure.
+int MakeUnixAddrForPath(const std::string& pipe_name,
+                        struct sockaddr_un* unix_addr,
+                        size_t* unix_addr_len) {
+  DCHECK_GT(pipe_name.length(), 0u);
+  DCHECK_LT(pipe_name.length(), kMaxPipeNameLength);
+
+  if (pipe_name.length() == 0 || pipe_name.length() >= kMaxPipeNameLength) {
+    LOG(ERROR) << "Pipe name too long: " << pipe_name;
+    return -1;
+  }
+
+  // Create socket.
+  int fd = socket(AF_UNIX, SOCK_STREAM, 0);
+  if (fd < 0) {
+    PLOG(ERROR) << "socket";
+    return -1;
+  }
+
+  // Make socket non-blocking
+  if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0) {
+    PLOG(ERROR) << "fcntl(O_NONBLOCK) " << pipe_name;
+    if (HANDLE_EINTR(close(fd)) < 0)
+      PLOG(ERROR) << "close " << pipe_name;
+    return -1;
+  }
+
+  // Create unix_addr structure.
+  DCHECK(unix_addr);
+  memset(unix_addr, 0, sizeof(struct sockaddr_un));
+  unix_addr->sun_family = AF_UNIX;
+  strncpy(unix_addr->sun_path, pipe_name.c_str(), kMaxPipeNameLength);

[palmer, 2013/02/28 23:48:28]

strncpy does not guarantee to NUL-terminate the string! Additionally, you might
copy in a truncated path. I think you should enforce that the length of
pipe_name is appropriate before doing the strncpy. If it would be truncated or
would result in a non-NUL-terminated string, this funtion should fail.

[Mark Mentovai, 2013/03/01 03:19:17]

Chris P. wrote:
He’s already checked the length on line 33, although it needs to be changed to
|>= kMaxPipeNameLength - 1| in order to guarantee that this will be
NUL-terminated here.

strncpy is fine as long as the length is checked.

[jeremya, 2013/03/01 03:49:25]

I don't think it needs to be NUL-terminated, as the addr structure has a path
length in it.

+  *unix_addr_len =
+      offsetof(struct sockaddr_un, sun_path) + pipe_name.length() + 1;
+  return fd;
+}
+
+}  // namespace
+
+bool CreateServerUnixDomainSocket(const base::FilePath& pipe_path,
+                                  int* server_listen_fd) {
+  DCHECK(server_listen_fd);
+
+  std::string pipe_name = pipe_path.value();
+  base::FilePath pipe_dir = pipe_path.DirName();
+
+  struct sockaddr_un unix_addr;
+  size_t unix_addr_len;
+  int fd = MakeUnixAddrForPath(pipe_name, &unix_addr, &unix_addr_len);
+  if (fd < 0)
+    return false;
+  file_util::ScopedFD scoped_fd(&fd);
+
+  // Make sure the path we need exists.
+  if (!file_util::CreateDirectory(pipe_dir)) {
+    LOG(ERROR) << "Couldn't create directory: " << pipe_dir.value();
+    return false;
+  }
+
+  // Delete any old FS instances.
+  if (unlink(pipe_name.c_str()) < 0)
+    PLOG(ERROR) << "unlink " << pipe_name;
+
+  // Bind the socket.
+  if (bind(fd, reinterpret_cast<const sockaddr*>(&unix_addr),
+           unix_addr_len) < 0) {
+    PLOG(ERROR) << "bind " << pipe_path.value();
+    return false;
+  }
+
+  // Start listening on the socket.
+  const int listen_queue_length = 1;

[Mark Mentovai, 2013/03/01 03:19:17]

I don’t think you need a separate constant for this here, people who know what
listen does know what the argument does.

[jeremya, 2013/03/01 03:49:25]

Done.

+  if (listen(fd, listen_queue_length) < 0) {
+    PLOG(ERROR) << "listen " << pipe_path.value();
+    unlink(pipe_name.c_str());
+    return false;
+  }
+
+  *server_listen_fd = *scoped_fd.release();
+  return true;
+}
+
+bool CreateClientUnixDomainSocket(const base::FilePath& pipe_path,
+                                  int* client_socket) {
+  DCHECK(client_socket);
+
+  std::string pipe_name = pipe_path.value();
+  base::FilePath pipe_dir = pipe_path.DirName();
+
+  struct sockaddr_un unix_addr;
+  size_t unix_addr_len;
+  int fd = MakeUnixAddrForPath(pipe_name, &unix_addr, &unix_addr_len);
+  if (fd < 0)
+    return false;
+  file_util::ScopedFD scoped_fd(&fd);
+
+  if (HANDLE_EINTR(connect(fd, reinterpret_cast<sockaddr*>(&unix_addr),
+                           unix_addr_len)) < 0) {
+    PLOG(ERROR) << "connect " << pipe_path.value();
+    return false;
+  }
+
+  *client_socket = *scoped_fd.release();
+  return true;
+}
+
+bool GetPeerEuid(int fd, uid_t* client_euid) {
+#if defined(OS_MACOSX) || defined(OS_OPENBSD)

[palmer, 2013/02/28 23:48:28]

This method works on FreeBSD >= 4.6 (which is why it works on Mac OS X), FWIW.

[jeremya, 2013/03/01 03:49:25]

Not sure what you're implying here. Should I remove or add a #if somewhere?

[palmer, 2013/03/01 19:14:30]

I'd say:

#if defined(OS_MACOSX) || defined(OS_OPENBSD) || defined(OS_FREEBSD)

Currently, FreeBSD falls through to the #else, and I'm not sure that code works
on FreeBSD. (Haven't checked though.)

[jeremya, 2013/03/03 21:39:03]

Done.

+  uid_t peer_euid;
+  gid_t peer_gid;
+  if (getpeereid(fd, &peer_euid, &peer_gid) < 0) {
+    PLOG(ERROR) << "getpeereid " << fd;
+    return false;
+  }
+  *client_euid = peer_euid;
+  return true;
+#elif defined(OS_SOLARIS)
+  return false;

[palmer, 2013/02/28 23:48:28]

Yikes!! Not that Solaris is an officially-supported platform, but do they really
not support a way to get the peer's EUID? Oh, I found:

http://docs.oracle.com/cd/E19963-01/html/821-1465/getpeerucred-3c.html

FWIW.

[jeremya, 2013/03/01 03:49:25]

Just copied from the ipc_channel_posix.cc implementation of this. I've removed
the OS_SOLARIS bit, seems silly to keep it.

+#else

[palmer, 2013/02/28 23:48:28]

...and I'm not entirely sure this method *does* work on FreeBSD. So we should
use getpeereid on FreeBSD. (It is implemented in terms of LOCAL_PEERCRED, which
may or may not be an alias for SO_PEERCRED...)

[jeremya, 2013/03/01 03:49:25]

Eh? What about Linux?

[palmer, 2013/03/01 19:14:30]

This #else block works/should work fine as-is for Linux.

+  struct ucred cred;
+  socklen_t cred_len = sizeof(cred);
+  if (getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &cred, &cred_len) < 0) {
+    PLOG(ERROR) << "getsockopt " << fd;
+    return false;
+  }
+  if (static_cast<unsigned>(cred_len) < sizeof(cred)) {
+    NOTREACHED() << "Truncated ucred from SO_PEERCRED?";
+    return false;
+  }
+  *client_euid = cred.uid;
+  return true;
+#endif
+}
+
+bool ServerAcceptConnection(int server_listen_fd, int* server_socket) {
+  DCHECK(server_socket);
+
+  int accept_fd = HANDLE_EINTR(accept(server_listen_fd, NULL, 0));
+  if (accept_fd < 0)
+    return false;
+  if (fcntl(accept_fd, F_SETFL, O_NONBLOCK) < 0) {
+    PLOG(ERROR) << "fcntl(O_NONBLOCK) " << accept_fd;
+    if (HANDLE_EINTR(close(accept_fd)) < 0)

[Mark Mentovai, 2013/03/01 03:19:17]

You can use the scoper in this function too.

[jeremya, 2013/03/01 03:49:25]

Done.

+      PLOG(ERROR) << "close " << accept_fd;
+    return false;
+  }
+
+  *server_socket = accept_fd;
+  return true;
+}
+
+}  // namespace IPC