ppapi: PPB_VpnProvider: Implement Resource Host

ppapi/proxy/vpn_provider_resource.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/vpn_provider_resource.h"
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/proxy/dispatch_reply_message.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/shared_impl/array_var.h"
 #include "ppapi/shared_impl/ppapi_globals.h"
 #include "ppapi/shared_impl/var_tracker.h"
 
 namespace ppapi {
 namespace proxy {
 
 VpnProviderResource::VpnProviderResource(Connection connection,
                                          PP_Instance instance)
     : PluginResource(connection, instance),
       bind_callback_(nullptr),
       send_packet_callback_(nullptr),
       receive_packet_callback_(nullptr),
       receive_packet_callback_var_(nullptr),
-      bound_(false) {}
+      bound_(false) {
+  SendCreate(BROWSER, PpapiHostMsg_VpnProvider_Create());
+}
 
 VpnProviderResource::~VpnProviderResource() {}
 
 thunk::PPB_VpnProvider_API* VpnProviderResource::AsPPB_VpnProvider_API() {
   return this;
 }
 
 void VpnProviderResource::OnReplyReceived(
     const ResourceMessageReplyParams& params,
     const IPC::Message& msg) {
-  PluginResource::OnReplyReceived(params, msg);
+  PPAPI_BEGIN_MESSAGE_MAP(VpnProviderResource, msg)
+    PPAPI_DISPATCH_PLUGIN_RESOURCE_CALL(PpapiPluginMsg_VpnProvider_OnUnbind,
+                                        OnPluginMsgOnUnbindReceived)
+    PPAPI_DISPATCH_PLUGIN_RESOURCE_CALL(
+        PpapiPluginMsg_VpnProvider_OnPacketReceived,
+        OnPluginMsgOnPacketReceived)
+    PPAPI_DISPATCH_PLUGIN_RESOURCE_CALL_UNHANDLED(
+        PluginResource::OnReplyReceived(params, msg))
+  PPAPI_END_MESSAGE_MAP()
 }
 
 int32_t VpnProviderResource::Bind(
     const PP_Var& configuration_id,
     const PP_Var& configuration_name,
     const scoped_refptr<TrackedCallback>& callback) {
   if (TrackedCallback::IsPending(bind_callback_))
     return PP_ERROR_INPROGRESS;
 
   StringVar* configuration_id_var = StringVar::FromPPVar(configuration_id);
   if (!configuration_id_var)
     return PP_ERROR_BADARGUMENT;
   StringVar* configuration_name_var = StringVar::FromPPVar(configuration_name);
   if (!configuration_name_var)
     return PP_ERROR_BADARGUMENT;
 
-  return PP_ERROR_NOTSUPPORTED;
+  bind_callback_ = callback;
+
+  Call<PpapiPluginMsg_VpnProvider_BindReply>(
+      BROWSER, PpapiHostMsg_VpnProvider_Bind(configuration_id_var->value(),
+                                             configuration_name_var->value()),
+      base::Bind(&VpnProviderResource::OnPluginMsgBindReply, this));
+
+  return PP_OK_COMPLETIONPENDING;
 }
 
 int32_t VpnProviderResource::SendPacket(
     const PP_Var& packet,
     const scoped_refptr<TrackedCallback>& callback) {
   if (!bound_)
     return PP_ERROR_FAILED;
   if (TrackedCallback::IsPending(send_packet_callback_))
     return PP_ERROR_INPROGRESS;
   if (!ArrayBufferVar::FromPPVar(packet))
@@ skipping 14 matching lines @@
   }
 }
 
 int32_t VpnProviderResource::DoSendPacket(const PP_Var& packet, uint32_t id) {
   // Convert packet to std::vector<char>, then send it.
   scoped_refptr<ArrayBufferVar> packet_arraybuffer =
       ArrayBufferVar::FromPPVar(packet);
   if (!packet_arraybuffer.get())
     return PP_ERROR_BADARGUMENT;
 
+  uint32_t packet_size = packet_arraybuffer->ByteLength();
+  if (packet_size > send_packet_buffer_->GetMaxPacketSize())
+    return PP_ERROR_MESSAGE_TOO_BIG;

[bbudge, 2016/06/23 18:10:23]

It's fine to check this to help plugin writers, but it doesn't add to security
as malicious plugins can bypass it.

[adrian.belgun, 2016/06/24 13:19:37]

How can it be bypassed? When the plugin will call SendPacket() with bigger
messages, the message will be rejected before being written to the buffer.

+
   char* packet_pointer = static_cast<char*>(packet_arraybuffer->Map());
-  uint32_t packet_size = packet_arraybuffer->ByteLength();
   memcpy(send_packet_buffer_->GetBuffer(id), packet_pointer, packet_size);
   packet_arraybuffer->Unmap();
 
+  Call<PpapiPluginMsg_VpnProvider_SendPacketReply>(
+      BROWSER, PpapiHostMsg_VpnProvider_SendPacket(packet_size, id),
+      base::Bind(&VpnProviderResource::OnPluginMsgSendPacketReply, this));
+
   return PP_OK;
 }
 
 int32_t VpnProviderResource::ReceivePacket(
     PP_Var* packet,
     const scoped_refptr<TrackedCallback>& callback) {
   if (TrackedCallback::IsPending(receive_packet_callback_))
     return PP_ERROR_INPROGRESS;
 
   // Return previously received packet.
@@ skipping 21 matching lines @@
   while (!send_packets_.empty()) {
     PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(send_packets_.front());
     send_packets_.pop();
   }
 }
 
 void VpnProviderResource::OnPluginMsgOnPacketReceived(
     const ResourceMessageReplyParams& params,
     uint32_t packet_size,
     uint32_t id) {
-  if (!bound_) {
+  if (!bound_ || (packet_size > receive_packet_buffer_->GetMaxPacketSize())) {

[bbudge, 2016/06/23 18:10:23]

packet_size is coming from the browser so this should never happen. Perhaps a
DCHECK?

[adrian.belgun, 2016/06/24 13:19:37]

Done.

+    // Ignore packet and mark shared memory as available
+    Post(BROWSER, PpapiHostMsg_VpnProvider_OnPacketReceivedReply(id));
     return;
   }
 
   // Append received packet to queue.
   void* packet_pointer = receive_packet_buffer_->GetBuffer(id);
   scoped_refptr<Var> packet_var(
       PpapiGlobals::Get()->GetVarTracker()->MakeArrayBufferVar(packet_size,
                                                                packet_pointer));
   received_packets_.push(packet_var);
 
+  // Mark shared memory as available for next packet
+  Post(BROWSER, PpapiHostMsg_VpnProvider_OnPacketReceivedReply(id));
+
   if (!TrackedCallback::IsPending(receive_packet_callback_) ||
       TrackedCallback::IsScheduledToRun(receive_packet_callback_)) {
     return;
   }
 
   scoped_refptr<TrackedCallback> callback;
   callback.swap(receive_packet_callback_);
   WritePacket();
   callback->Run(PP_OK);
 }
@@ skipping 56 matching lines @@
   if (!receive_packet_callback_var_)
     return;
 
   *receive_packet_callback_var_ = received_packets_.front()->GetPPVar();
   received_packets_.pop();
   receive_packet_callback_var_ = nullptr;
 }
 
 }  // namespace proxy
 }  // namespace ppapi