OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // ID Not In Map Note: | 5 // ID Not In Map Note: |
6 // A service, characteristic, or descriptor ID not in the corresponding | 6 // A service, characteristic, or descriptor ID not in the corresponding |
7 // BluetoothDispatcherHost map [service_to_device_, characteristic_to_service_, | 7 // BluetoothDispatcherHost map [service_to_device_, characteristic_to_service_, |
8 // descriptor_to_characteristic_] implies a hostile renderer because a renderer | 8 // descriptor_to_characteristic_] implies a hostile renderer because a renderer |
9 // obtains the corresponding ID from this class and it will be added to the map | 9 // obtains the corresponding ID from this class and it will be added to the map |
10 // at that time. | 10 // at that time. |
11 | 11 |
12 #include "content/browser/bluetooth/bluetooth_dispatcher_host.h" | 12 #include "content/browser/bluetooth/bluetooth_dispatcher_host.h" |
13 | 13 |
14 #include <stddef.h> | 14 #include <stddef.h> |
15 | 15 |
16 #include <utility> | 16 #include <utility> |
17 | 17 |
18 #include "base/bind.h" | 18 #include "base/bind.h" |
19 #include "base/single_thread_task_runner.h" | 19 #include "base/single_thread_task_runner.h" |
20 #include "base/strings/utf_string_conversions.h" | 20 #include "base/strings/utf_string_conversions.h" |
21 #include "base/thread_task_runner_handle.h" | 21 #include "base/thread_task_runner_handle.h" |
22 #include "content/browser/bad_message.h" | 22 #include "content/browser/bad_message.h" |
23 #include "content/browser/bluetooth/bluetooth_blacklist.h" | 23 #include "content/browser/bluetooth/bluetooth_blacklist.h" |
24 #include "content/browser/bluetooth/bluetooth_metrics.h" | 24 #include "content/browser/bluetooth/bluetooth_metrics.h" |
25 #include "content/browser/bluetooth/first_device_bluetooth_chooser.h" | 25 #include "content/browser/bluetooth/first_device_bluetooth_chooser.h" |
26 #include "content/browser/frame_host/render_frame_host_impl.h" | 26 #include "content/browser/frame_host/render_frame_host_impl.h" |
27 #include "content/common/bluetooth/bluetooth_messages.h" | |
28 #include "content/public/browser/content_browser_client.h" | 27 #include "content/public/browser/content_browser_client.h" |
29 #include "content/public/browser/web_contents.h" | 28 #include "content/public/browser/web_contents.h" |
30 #include "content/public/browser/web_contents_delegate.h" | 29 #include "content/public/browser/web_contents_delegate.h" |
31 #include "device/bluetooth/bluetooth_adapter.h" | 30 #include "device/bluetooth/bluetooth_adapter.h" |
32 #include "device/bluetooth/bluetooth_adapter_factory.h" | 31 #include "device/bluetooth/bluetooth_adapter_factory.h" |
33 #include "device/bluetooth/bluetooth_device.h" | 32 #include "device/bluetooth/bluetooth_device.h" |
34 #include "device/bluetooth/bluetooth_discovery_session.h" | 33 #include "device/bluetooth/bluetooth_discovery_session.h" |
35 #include "device/bluetooth/bluetooth_gatt_characteristic.h" | 34 #include "device/bluetooth/bluetooth_gatt_characteristic.h" |
36 #include "device/bluetooth/bluetooth_gatt_service.h" | 35 #include "device/bluetooth/bluetooth_gatt_service.h" |
37 | 36 |
(...skipping 265 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
303 bool handled = true; | 302 bool handled = true; |
304 IPC_BEGIN_MESSAGE_MAP(BluetoothDispatcherHost, message) | 303 IPC_BEGIN_MESSAGE_MAP(BluetoothDispatcherHost, message) |
305 IPC_MESSAGE_HANDLER(BluetoothHostMsg_RequestDevice, OnRequestDevice) | 304 IPC_MESSAGE_HANDLER(BluetoothHostMsg_RequestDevice, OnRequestDevice) |
306 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GATTServerConnect, OnGATTServerConnect) | 305 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GATTServerConnect, OnGATTServerConnect) |
307 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GATTServerDisconnect, | 306 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GATTServerDisconnect, |
308 OnGATTServerDisconnect) | 307 OnGATTServerDisconnect) |
309 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GetPrimaryService, OnGetPrimaryService) | 308 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GetPrimaryService, OnGetPrimaryService) |
310 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GetCharacteristic, OnGetCharacteristic) | 309 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GetCharacteristic, OnGetCharacteristic) |
311 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GetCharacteristics, OnGetCharacteristics) | 310 IPC_MESSAGE_HANDLER(BluetoothHostMsg_GetCharacteristics, OnGetCharacteristics) |
312 IPC_MESSAGE_HANDLER(BluetoothHostMsg_ReadValue, OnReadValue) | 311 IPC_MESSAGE_HANDLER(BluetoothHostMsg_ReadValue, OnReadValue) |
313 IPC_MESSAGE_HANDLER(BluetoothHostMsg_WriteValue, OnWriteValue) | |
314 IPC_MESSAGE_HANDLER(BluetoothHostMsg_StartNotifications, OnStartNotifications) | 312 IPC_MESSAGE_HANDLER(BluetoothHostMsg_StartNotifications, OnStartNotifications) |
315 IPC_MESSAGE_HANDLER(BluetoothHostMsg_StopNotifications, OnStopNotifications) | 313 IPC_MESSAGE_HANDLER(BluetoothHostMsg_StopNotifications, OnStopNotifications) |
316 IPC_MESSAGE_HANDLER(BluetoothHostMsg_RegisterCharacteristic, | 314 IPC_MESSAGE_HANDLER(BluetoothHostMsg_RegisterCharacteristic, |
317 OnRegisterCharacteristicObject); | 315 OnRegisterCharacteristicObject); |
318 IPC_MESSAGE_HANDLER(BluetoothHostMsg_UnregisterCharacteristic, | 316 IPC_MESSAGE_HANDLER(BluetoothHostMsg_UnregisterCharacteristic, |
319 OnUnregisterCharacteristicObject); | 317 OnUnregisterCharacteristicObject); |
320 IPC_MESSAGE_UNHANDLED(handled = false) | 318 IPC_MESSAGE_UNHANDLED(handled = false) |
321 IPC_END_MESSAGE_MAP() | 319 IPC_END_MESSAGE_MAP() |
322 return handled; | 320 return handled; |
323 } | 321 } |
(...skipping 78 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
402 const int thread_id; | 400 const int thread_id; |
403 const int request_id; | 401 const int request_id; |
404 const int frame_routing_id; | 402 const int frame_routing_id; |
405 const url::Origin origin; | 403 const url::Origin origin; |
406 const std::vector<BluetoothScanFilter> filters; | 404 const std::vector<BluetoothScanFilter> filters; |
407 const std::vector<BluetoothUUID> optional_services; | 405 const std::vector<BluetoothUUID> optional_services; |
408 scoped_ptr<BluetoothChooser> chooser; | 406 scoped_ptr<BluetoothChooser> chooser; |
409 scoped_ptr<device::BluetoothDiscoverySession> discovery_session; | 407 scoped_ptr<device::BluetoothDiscoverySession> discovery_session; |
410 }; | 408 }; |
411 | 409 |
412 struct BluetoothDispatcherHost::CacheQueryResult { | 410 BluetoothDispatcherHost::CacheQueryResult::CacheQueryResult() |
413 CacheQueryResult() | 411 : outcome(CacheQueryOutcome::SUCCESS) {} |
Jeffrey Yasskin
2016/03/25 00:48:23
I'd probably move this to a member initializer too
ortuno
2016/03/29 17:58:34
Done.
| |
414 : device(nullptr), | 412 |
415 service(nullptr), | 413 BluetoothDispatcherHost::CacheQueryResult::CacheQueryResult( |
416 characteristic(nullptr), | 414 CacheQueryOutcome outcome) |
417 outcome(CacheQueryOutcome::SUCCESS) {} | 415 : outcome(outcome) {} |
418 CacheQueryResult(CacheQueryOutcome outcome) | 416 |
419 : device(nullptr), | 417 BluetoothDispatcherHost::CacheQueryResult::~CacheQueryResult() {} |
420 service(nullptr), | 418 |
421 characteristic(nullptr), | 419 WebBluetoothError BluetoothDispatcherHost::CacheQueryResult::GetWebError() |
422 outcome(outcome) {} | 420 const { |
423 ~CacheQueryResult() {} | 421 switch (outcome) { |
424 WebBluetoothError GetWebError() const { | 422 case CacheQueryOutcome::SUCCESS: |
425 switch (outcome) { | 423 case CacheQueryOutcome::BAD_RENDERER: |
426 case CacheQueryOutcome::SUCCESS: | 424 NOTREACHED(); |
427 case CacheQueryOutcome::BAD_RENDERER: | 425 return WebBluetoothError::DeviceNoLongerInRange; |
428 NOTREACHED(); | 426 case CacheQueryOutcome::NO_DEVICE: |
429 return WebBluetoothError::DeviceNoLongerInRange; | 427 return WebBluetoothError::DeviceNoLongerInRange; |
430 case CacheQueryOutcome::NO_DEVICE: | 428 case CacheQueryOutcome::NO_SERVICE: |
431 return WebBluetoothError::DeviceNoLongerInRange; | 429 return WebBluetoothError::ServiceNoLongerExists; |
432 case CacheQueryOutcome::NO_SERVICE: | 430 case CacheQueryOutcome::NO_CHARACTERISTIC: |
433 return WebBluetoothError::ServiceNoLongerExists; | 431 return WebBluetoothError::CharacteristicNoLongerExists; |
434 case CacheQueryOutcome::NO_CHARACTERISTIC: | |
435 return WebBluetoothError::CharacteristicNoLongerExists; | |
436 } | |
437 NOTREACHED(); | |
438 return WebBluetoothError::DeviceNoLongerInRange; | |
439 } | 432 } |
440 | 433 NOTREACHED(); |
441 device::BluetoothDevice* device; | 434 return WebBluetoothError::DeviceNoLongerInRange; |
442 device::BluetoothGattService* service; | 435 } |
443 device::BluetoothGattCharacteristic* characteristic; | |
444 CacheQueryOutcome outcome; | |
445 }; | |
446 | 436 |
447 struct BluetoothDispatcherHost::PrimaryServicesRequest { | 437 struct BluetoothDispatcherHost::PrimaryServicesRequest { |
448 enum CallingFunction { GET_PRIMARY_SERVICE, GET_PRIMARY_SERVICES }; | 438 enum CallingFunction { GET_PRIMARY_SERVICE, GET_PRIMARY_SERVICES }; |
449 | 439 |
450 PrimaryServicesRequest(int thread_id, | 440 PrimaryServicesRequest(int thread_id, |
451 int request_id, | 441 int request_id, |
452 const std::string& service_uuid, | 442 const std::string& service_uuid, |
453 PrimaryServicesRequest::CallingFunction func) | 443 PrimaryServicesRequest::CallingFunction func) |
454 : thread_id(thread_id), | 444 : thread_id(thread_id), |
455 request_id(request_id), | 445 request_id(request_id), |
(...skipping 512 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
968 return; | 958 return; |
969 } | 959 } |
970 | 960 |
971 query_result.characteristic->ReadRemoteCharacteristic( | 961 query_result.characteristic->ReadRemoteCharacteristic( |
972 base::Bind(&BluetoothDispatcherHost::OnCharacteristicValueRead, | 962 base::Bind(&BluetoothDispatcherHost::OnCharacteristicValueRead, |
973 weak_ptr_on_ui_thread_, thread_id, request_id), | 963 weak_ptr_on_ui_thread_, thread_id, request_id), |
974 base::Bind(&BluetoothDispatcherHost::OnCharacteristicReadValueError, | 964 base::Bind(&BluetoothDispatcherHost::OnCharacteristicReadValueError, |
975 weak_ptr_on_ui_thread_, thread_id, request_id)); | 965 weak_ptr_on_ui_thread_, thread_id, request_id)); |
976 } | 966 } |
977 | 967 |
978 void BluetoothDispatcherHost::OnWriteValue( | |
979 int thread_id, | |
980 int request_id, | |
981 int frame_routing_id, | |
982 const std::string& characteristic_instance_id, | |
983 const std::vector<uint8_t>& value) { | |
984 DCHECK_CURRENTLY_ON(BrowserThread::UI); | |
985 RecordWebBluetoothFunctionCall( | |
986 UMAWebBluetoothFunction::CHARACTERISTIC_WRITE_VALUE); | |
987 | |
988 // Length check per step 3 of writeValue algorithm: | |
989 // https://webbluetoothchrome.github.io/web-bluetooth/#dom-bluetoothgattcharac teristic-writevalue | |
990 // We perform the length check on the renderer side. So if we | |
991 // get a value with length > 512, we can assume it's a hostile | |
992 // renderer and kill it. | |
993 if (value.size() > 512) { | |
994 bad_message::ReceivedBadMessage( | |
995 this, bad_message::BDH_INVALID_WRITE_VALUE_LENGTH); | |
996 return; | |
997 } | |
998 | |
999 const CacheQueryResult query_result = QueryCacheForCharacteristic( | |
1000 GetOrigin(frame_routing_id), characteristic_instance_id); | |
1001 | |
1002 if (query_result.outcome == CacheQueryOutcome::BAD_RENDERER) { | |
1003 return; | |
1004 } | |
1005 | |
1006 if (query_result.outcome != CacheQueryOutcome::SUCCESS) { | |
1007 RecordCharacteristicWriteValueOutcome(query_result.outcome); | |
1008 Send(new BluetoothMsg_WriteCharacteristicValueError( | |
1009 thread_id, request_id, query_result.GetWebError())); | |
1010 return; | |
1011 } | |
1012 | |
1013 if (BluetoothBlacklist::Get().IsExcludedFromWrites( | |
1014 query_result.characteristic->GetUUID())) { | |
1015 RecordCharacteristicWriteValueOutcome(UMAGATTOperationOutcome::BLACKLISTED); | |
1016 Send(new BluetoothMsg_WriteCharacteristicValueError( | |
1017 thread_id, request_id, WebBluetoothError::BlacklistedWrite)); | |
1018 return; | |
1019 } | |
1020 | |
1021 query_result.characteristic->WriteRemoteCharacteristic( | |
1022 value, base::Bind(&BluetoothDispatcherHost::OnWriteValueSuccess, | |
1023 weak_ptr_on_ui_thread_, thread_id, request_id), | |
1024 base::Bind(&BluetoothDispatcherHost::OnWriteValueFailed, | |
1025 weak_ptr_on_ui_thread_, thread_id, request_id)); | |
1026 } | |
1027 | |
1028 void BluetoothDispatcherHost::OnStartNotifications( | 968 void BluetoothDispatcherHost::OnStartNotifications( |
1029 int thread_id, | 969 int thread_id, |
1030 int request_id, | 970 int request_id, |
1031 int frame_routing_id, | 971 int frame_routing_id, |
1032 const std::string& characteristic_instance_id) { | 972 const std::string& characteristic_instance_id) { |
1033 DCHECK_CURRENTLY_ON(BrowserThread::UI); | 973 DCHECK_CURRENTLY_ON(BrowserThread::UI); |
1034 RecordWebBluetoothFunctionCall( | 974 RecordWebBluetoothFunctionCall( |
1035 UMAWebBluetoothFunction::CHARACTERISTIC_START_NOTIFICATIONS); | 975 UMAWebBluetoothFunction::CHARACTERISTIC_START_NOTIFICATIONS); |
1036 | 976 |
1037 // BluetoothDispatcher will never send a request for a characteristic | 977 // BluetoothDispatcher will never send a request for a characteristic |
(...skipping 460 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1498 int thread_id, | 1438 int thread_id, |
1499 int request_id, | 1439 int request_id, |
1500 device::BluetoothGattService::GattErrorCode error_code) { | 1440 device::BluetoothGattService::GattErrorCode error_code) { |
1501 DCHECK_CURRENTLY_ON(BrowserThread::UI); | 1441 DCHECK_CURRENTLY_ON(BrowserThread::UI); |
1502 // TranslateGATTError calls RecordGATTOperationOutcome. | 1442 // TranslateGATTError calls RecordGATTOperationOutcome. |
1503 Send(new BluetoothMsg_ReadCharacteristicValueError( | 1443 Send(new BluetoothMsg_ReadCharacteristicValueError( |
1504 thread_id, request_id, | 1444 thread_id, request_id, |
1505 TranslateGATTError(error_code, UMAGATTOperation::CHARACTERISTIC_READ))); | 1445 TranslateGATTError(error_code, UMAGATTOperation::CHARACTERISTIC_READ))); |
1506 } | 1446 } |
1507 | 1447 |
1508 void BluetoothDispatcherHost::OnWriteValueSuccess(int thread_id, | |
1509 int request_id) { | |
1510 DCHECK_CURRENTLY_ON(BrowserThread::UI); | |
1511 RecordCharacteristicWriteValueOutcome(UMAGATTOperationOutcome::SUCCESS); | |
1512 Send(new BluetoothMsg_WriteCharacteristicValueSuccess(thread_id, request_id)); | |
1513 } | |
1514 | |
1515 void BluetoothDispatcherHost::OnWriteValueFailed( | |
1516 int thread_id, | |
1517 int request_id, | |
1518 device::BluetoothGattService::GattErrorCode error_code) { | |
1519 DCHECK_CURRENTLY_ON(BrowserThread::UI); | |
1520 // TranslateGATTError calls RecordGATTOperationOutcome. | |
1521 Send(new BluetoothMsg_WriteCharacteristicValueError( | |
1522 thread_id, request_id, | |
1523 TranslateGATTError(error_code, UMAGATTOperation::CHARACTERISTIC_WRITE))); | |
1524 } | |
1525 | |
1526 void BluetoothDispatcherHost::OnStartNotifySessionSuccess( | 1448 void BluetoothDispatcherHost::OnStartNotifySessionSuccess( |
1527 int thread_id, | 1449 int thread_id, |
1528 int request_id, | 1450 int request_id, |
1529 scoped_ptr<device::BluetoothGattNotifySession> notify_session) { | 1451 scoped_ptr<device::BluetoothGattNotifySession> notify_session) { |
1530 RecordStartNotificationsOutcome(UMAGATTOperationOutcome::SUCCESS); | 1452 RecordStartNotificationsOutcome(UMAGATTOperationOutcome::SUCCESS); |
1531 | 1453 |
1532 // Copy Characteristic Instance ID before passing scoped pointer because | 1454 // Copy Characteristic Instance ID before passing scoped pointer because |
1533 // compilers may evaluate arguments in any order. | 1455 // compilers may evaluate arguments in any order. |
1534 const std::string characteristic_instance_id = | 1456 const std::string characteristic_instance_id = |
1535 notify_session->GetCharacteristicIdentifier(); | 1457 notify_session->GetCharacteristicIdentifier(); |
(...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1664 | 1586 |
1665 bool BluetoothDispatcherHost::CanFrameAccessCharacteristicInstance( | 1587 bool BluetoothDispatcherHost::CanFrameAccessCharacteristicInstance( |
1666 int frame_routing_id, | 1588 int frame_routing_id, |
1667 const std::string& characteristic_instance_id) { | 1589 const std::string& characteristic_instance_id) { |
1668 return QueryCacheForCharacteristic(GetOrigin(frame_routing_id), | 1590 return QueryCacheForCharacteristic(GetOrigin(frame_routing_id), |
1669 characteristic_instance_id) | 1591 characteristic_instance_id) |
1670 .outcome != CacheQueryOutcome::BAD_RENDERER; | 1592 .outcome != CacheQueryOutcome::BAD_RENDERER; |
1671 } | 1593 } |
1672 | 1594 |
1673 } // namespace content | 1595 } // namespace content |
OLD | NEW |