| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2015 The Crashpad Authors. All rights reserved. | |
| 2 // | |
| 3 // Licensed under the Apache License, Version 2.0 (the "License"); | |
| 4 // you may not use this file except in compliance with the License. | |
| 5 // You may obtain a copy of the License at | |
| 6 // | |
| 7 // http://www.apache.org/licenses/LICENSE-2.0 | |
| 8 // | |
| 9 // Unless required by applicable law or agreed to in writing, software | |
| 10 // distributed under the License is distributed on an "AS IS" BASIS, | |
| 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 12 // See the License for the specific language governing permissions and | |
| 13 // limitations under the License. | |
| 14 | |
| 15 #include "handler/win/registration_pipe_state.h" | |
| 16 | |
| 17 #include <string.h> | |
| 18 | |
| 19 #include <vector> | |
| 20 | |
| 21 #include "base/logging.h" | |
| 22 #include "base/memory/scoped_ptr.h" | |
| 23 #include "util/stdlib/pointer_container.h" | |
| 24 | |
| 25 namespace crashpad { | |
| 26 | |
| 27 RegistrationPipeState::RegistrationPipeState( | |
| 28 ScopedFileHANDLE pipe, | |
| 29 RegistrationServer::Delegate* delegate) | |
| 30 : request_(), | |
| 31 response_(), | |
| 32 completion_handler_(nullptr), | |
| 33 overlapped_(), | |
| 34 event_(), | |
| 35 pipe_(pipe.Pass()), | |
| 36 waiting_for_close_(false), | |
| 37 delegate_(delegate), | |
| 38 get_named_pipe_client_process_id_proc_(nullptr) { | |
| 39 HMODULE kernel_dll = GetModuleHandle(L"kernel32.dll"); | |
| 40 if (kernel_dll) { | |
| 41 get_named_pipe_client_process_id_proc_ = | |
| 42 reinterpret_cast<decltype(GetNamedPipeClientProcessId)*>( | |
| 43 GetProcAddress(kernel_dll, "GetNamedPipeClientProcessId")); | |
| 44 } | |
| 45 } | |
| 46 | |
| 47 RegistrationPipeState::~RegistrationPipeState() { | |
| 48 } | |
| 49 | |
| 50 bool RegistrationPipeState::Initialize() { | |
| 51 DCHECK(!event_.is_valid()); | |
| 52 DCHECK(pipe_.is_valid()); | |
| 53 | |
| 54 event_.reset(CreateEvent(nullptr, true, false, nullptr)); | |
| 55 | |
| 56 if (!event_.is_valid()) { | |
| 57 PLOG(ERROR) << "CreateEvent"; | |
| 58 } else { | |
| 59 overlapped_.hEvent = event_.get(); | |
| 60 if (IssueConnect()) | |
| 61 return true; | |
| 62 } | |
| 63 | |
| 64 overlapped_.hEvent = nullptr; | |
| 65 event_.reset(); | |
| 66 pipe_.reset(); | |
| 67 completion_handler_ = nullptr; | |
| 68 | |
| 69 return false; | |
| 70 } | |
| 71 | |
| 72 void RegistrationPipeState::Stop() { | |
| 73 DCHECK(pipe_.is_valid()); | |
| 74 if (!CancelIo(pipe_.get())) | |
| 75 PLOG(FATAL) << "CancelIo"; | |
| 76 } | |
| 77 | |
| 78 bool RegistrationPipeState::OnCompletion() { | |
| 79 AsyncCompletionHandler completion_handler = completion_handler_; | |
| 80 completion_handler_ = nullptr; | |
| 81 | |
| 82 DWORD bytes_transferred = 0; | |
| 83 BOOL success = GetOverlappedResult(pipe_.get(), | |
| 84 &overlapped_, | |
| 85 &bytes_transferred, | |
| 86 false); // Do not wait. | |
| 87 if (!success) { | |
| 88 // ERROR_BROKEN_PIPE is expected when we are waiting for the client to close | |
| 89 // the pipe (signaling that they are done reading the response). | |
| 90 if (!waiting_for_close_ || GetLastError() != ERROR_BROKEN_PIPE) | |
| 91 PLOG(ERROR) << "GetOverlappedResult"; | |
| 92 } | |
| 93 | |
| 94 bool still_running = false; | |
| 95 if (!ResetEvent(event_.get())) { | |
| 96 PLOG(ERROR) << "ResetEvent"; | |
| 97 } else if (!completion_handler) { | |
| 98 NOTREACHED(); | |
| 99 still_running = ResetConnection(); | |
| 100 } else if (!success) { | |
| 101 still_running = ResetConnection(); | |
| 102 } else { | |
| 103 still_running = (this->*completion_handler)(bytes_transferred); | |
| 104 } | |
| 105 | |
| 106 if (!still_running) { | |
| 107 overlapped_.hEvent = nullptr; | |
| 108 event_.reset(); | |
| 109 pipe_.reset(); | |
| 110 completion_handler_ = nullptr; | |
| 111 } else { | |
| 112 DCHECK(completion_handler_); | |
| 113 } | |
| 114 | |
| 115 return still_running; | |
| 116 } | |
| 117 | |
| 118 bool RegistrationPipeState::OnConnectComplete(DWORD /* bytes_transferred */) { | |
| 119 return IssueRead(); | |
| 120 } | |
| 121 | |
| 122 bool RegistrationPipeState::OnReadComplete(DWORD bytes_transferred) { | |
| 123 if (bytes_transferred != sizeof(request_)) { | |
| 124 LOG(ERROR) << "Invalid message size: " << bytes_transferred; | |
| 125 return ResetConnection(); | |
| 126 } else { | |
| 127 return HandleRequest(); | |
| 128 } | |
| 129 } | |
| 130 | |
| 131 bool RegistrationPipeState::OnWriteComplete(DWORD bytes_transferred) { | |
| 132 if (bytes_transferred != sizeof(response_)) { | |
| 133 LOG(ERROR) << "Incomplete write operation. Bytes written: " | |
| 134 << bytes_transferred; | |
| 135 } | |
| 136 | |
| 137 return IssueWaitForClientClose(); | |
| 138 } | |
| 139 | |
| 140 bool RegistrationPipeState::OnWaitForClientCloseComplete( | |
| 141 DWORD bytes_transferred) { | |
| 142 LOG(ERROR) << "Unexpected extra data (" << bytes_transferred | |
| 143 << " bytes) received from client."; | |
| 144 return ResetConnection(); | |
| 145 } | |
| 146 | |
| 147 bool RegistrationPipeState::IssueConnect() { | |
| 148 if (ConnectNamedPipe(pipe_.get(), &overlapped_)) { | |
| 149 return OnConnectComplete(0); // bytes_transferred (ignored) | |
| 150 } else { | |
| 151 DWORD result = GetLastError(); | |
| 152 if (result == ERROR_PIPE_CONNECTED) { | |
| 153 return OnConnectComplete(0); // bytes_transferred (ignored) | |
| 154 } else if (result == ERROR_IO_PENDING) { | |
| 155 completion_handler_ = &RegistrationPipeState::OnConnectComplete; | |
| 156 return true; | |
| 157 } else { | |
| 158 PLOG(ERROR) << "ConnectNamedPipe"; | |
| 159 return false; | |
| 160 } | |
| 161 } | |
| 162 } | |
| 163 | |
| 164 bool RegistrationPipeState::IssueRead() { | |
| 165 DWORD bytes_read = 0; | |
| 166 if (ReadFile(pipe_.get(), | |
| 167 &request_, | |
| 168 sizeof(request_), | |
| 169 &bytes_read, | |
| 170 &overlapped_)) { | |
| 171 return OnReadComplete(bytes_read); | |
| 172 } else if (GetLastError() == ERROR_IO_PENDING) { | |
| 173 completion_handler_ = &RegistrationPipeState::OnReadComplete; | |
| 174 return true; | |
| 175 } else { | |
| 176 PLOG(ERROR) << "ReadFile"; | |
| 177 return ResetConnection(); | |
| 178 } | |
| 179 } | |
| 180 | |
| 181 bool RegistrationPipeState::IssueWrite() { | |
| 182 DWORD bytes_written = 0; | |
| 183 if (WriteFile(pipe_.get(), | |
| 184 &response_, | |
| 185 sizeof(response_), | |
| 186 &bytes_written, | |
| 187 &overlapped_)) { | |
| 188 return OnWriteComplete(bytes_written); | |
| 189 } else if (GetLastError() == ERROR_IO_PENDING) { | |
| 190 completion_handler_ = &RegistrationPipeState::OnWriteComplete; | |
| 191 return true; | |
| 192 } else { | |
| 193 PLOG(ERROR) << "WriteFile"; | |
| 194 return ResetConnection(); | |
| 195 } | |
| 196 } | |
| 197 | |
| 198 bool RegistrationPipeState::IssueWaitForClientClose() { | |
| 199 // If we invoke DisconnectNamedPipe before the client has read the response | |
| 200 // the response will never be delivered. Therefore we issue an extra ReadFile | |
| 201 // operation after writing the response. No data is expected - the operation | |
| 202 // will be 'completed' when the client closes the pipe. | |
| 203 waiting_for_close_ = true; | |
| 204 DWORD bytes_read = 0; | |
| 205 if (ReadFile(pipe_.get(), | |
| 206 &request_, | |
| 207 sizeof(request_), | |
| 208 &bytes_read, | |
| 209 &overlapped_)) { | |
| 210 return OnWaitForClientCloseComplete(bytes_read); | |
| 211 } else if (GetLastError() == ERROR_IO_PENDING) { | |
| 212 completion_handler_ = &RegistrationPipeState::OnWaitForClientCloseComplete; | |
| 213 return true; | |
| 214 } else { | |
| 215 PLOG(ERROR) << "ReadFile"; | |
| 216 return ResetConnection(); | |
| 217 } | |
| 218 } | |
| 219 | |
| 220 bool RegistrationPipeState::HandleRequest() { | |
| 221 if (get_named_pipe_client_process_id_proc_) { | |
| 222 // On Vista+ we can verify that the client is who they claim to be, thus | |
| 223 // preventing arbitrary processes from having us duplicate handles into | |
| 224 // other processes. | |
| 225 DWORD real_client_process_id = 0; | |
| 226 if (!get_named_pipe_client_process_id_proc_(pipe_.get(), | |
| 227 &real_client_process_id)) { | |
| 228 PLOG(ERROR) << "GetNamedPipeClientProcessId"; | |
| 229 } else if (real_client_process_id != request_.client_process_id) { | |
| 230 LOG(ERROR) << "Client process ID from request (" | |
| 231 << request_.client_process_id | |
| 232 << ") does not match pipe client process ID (" | |
| 233 << real_client_process_id << ")."; | |
| 234 return ResetConnection(); | |
| 235 } | |
| 236 } | |
| 237 | |
| 238 ScopedKernelHANDLE client_process( | |
| 239 OpenProcess(PROCESS_ALL_ACCESS, false, request_.client_process_id)); | |
| 240 if (!client_process.is_valid()) { | |
| 241 if (ImpersonateNamedPipeClient(pipe_.get())) { | |
| 242 client_process.reset( | |
| 243 OpenProcess(PROCESS_ALL_ACCESS, false, request_.client_process_id)); | |
| 244 RevertToSelf(); | |
| 245 } | |
| 246 } | |
| 247 | |
| 248 if (!client_process.is_valid()) { | |
| 249 LOG(ERROR) << "Failed to open client process."; | |
| 250 return ResetConnection(); | |
| 251 } | |
| 252 | |
| 253 memset(&response_, 0, sizeof(response_)); | |
| 254 | |
| 255 HANDLE request_report_event = nullptr; | |
| 256 HANDLE report_complete_event = nullptr; | |
| 257 | |
| 258 if (!delegate_->RegisterClient(client_process.Pass(), | |
| 259 request_.crashpad_info_address, | |
| 260 &request_report_event, | |
| 261 &report_complete_event)) { | |
| 262 return ResetConnection(); | |
| 263 } | |
| 264 | |
| 265 // A handle has at most 32 significant bits, though its type is void*. Thus we | |
| 266 // truncate it here. An interesting exception is INVALID_HANDLE_VALUE, which | |
| 267 // is '-1'. It is still safe to truncate it from 0xFFFFFFFFFFFFFFFF to | |
| 268 // 0xFFFFFFFF, but a 64-bit client receiving that value must correctly sign | |
| 269 // extend it. | |
| 270 response_.request_report_event = | |
| 271 reinterpret_cast<uint32_t>(request_report_event); | |
| 272 response_.report_complete_event = | |
| 273 reinterpret_cast<uint32_t>(report_complete_event); | |
| 274 return IssueWrite(); | |
| 275 } | |
| 276 | |
| 277 bool RegistrationPipeState::ResetConnection() { | |
| 278 memset(&request_, 0, sizeof(request_)); | |
| 279 waiting_for_close_ = false; | |
| 280 | |
| 281 if (!DisconnectNamedPipe(pipe_.get())) { | |
| 282 PLOG(ERROR) << "DisconnectNamedPipe"; | |
| 283 return false; | |
| 284 } else { | |
| 285 return IssueConnect(); | |
| 286 } | |
| 287 } | |
| 288 | |
| 289 } // namespace crashpad | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1301853002:
win: Crash handler server (Closed)
Base URL: https://chromium.googlesource.com/crashpad/crashpad@master