| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "remoting/host/security_key/gnubby_auth_handler.h" | |
| 6 | |
| 7 #include <stdint.h> | |
| 8 #include <unistd.h> | |
| 9 | |
| 10 #include <memory> | |
| 11 | |
| 12 #include "base/bind.h" | |
| 13 #include "base/files/file_util.h" | |
| 14 #include "base/lazy_instance.h" | |
| 15 #include "base/logging.h" | |
| 16 #include "base/stl_util.h" | |
| 17 #include "base/threading/thread_checker.h" | |
| 18 #include "base/threading/thread_restrictions.h" | |
| 19 #include "base/values.h" | |
| 20 #include "net/base/completion_callback.h" | |
| 21 #include "net/base/net_errors.h" | |
| 22 #include "net/socket/stream_socket.h" | |
| 23 #include "net/socket/unix_domain_server_socket_posix.h" | |
| 24 #include "remoting/base/logging.h" | |
| 25 #include "remoting/host/security_key/gnubby_socket.h" | |
| 26 | |
| 27 namespace { | |
| 28 | |
| 29 const int64_t kDefaultRequestTimeoutSeconds = 60; | |
| 30 | |
| 31 // The name of the socket to listen for gnubby requests on. | |
| 32 base::LazyInstance<base::FilePath>::Leaky g_gnubby_socket_name = | |
| 33 LAZY_INSTANCE_INITIALIZER; | |
| 34 | |
| 35 // Socket authentication function that only allows connections from callers with | |
| 36 // the current uid. | |
| 37 bool MatchUid(const net::UnixDomainServerSocket::Credentials& credentials) { | |
| 38 bool allowed = credentials.user_id == getuid(); | |
| 39 if (!allowed) | |
| 40 HOST_LOG << "Refused socket connection from uid " << credentials.user_id; | |
| 41 return allowed; | |
| 42 } | |
| 43 | |
| 44 // Returns the command code (the first byte of the data) if it exists, or -1 if | |
| 45 // the data is empty. | |
| 46 unsigned int GetCommandCode(const std::string& data) { | |
| 47 return data.empty() ? -1 : static_cast<unsigned int>(data[0]); | |
| 48 } | |
| 49 | |
| 50 } // namespace | |
| 51 | |
| 52 namespace remoting { | |
| 53 | |
| 54 class GnubbyAuthHandlerLinux : public GnubbyAuthHandler { | |
| 55 public: | |
| 56 GnubbyAuthHandlerLinux(); | |
| 57 ~GnubbyAuthHandlerLinux() override; | |
| 58 | |
| 59 private: | |
| 60 typedef std::map<int, GnubbySocket*> ActiveSockets; | |
| 61 | |
| 62 // GnubbyAuthHandler interface. | |
| 63 void CreateGnubbyConnection() override; | |
| 64 bool IsValidConnectionId(int gnubby_connection_id) const override; | |
| 65 void SendClientResponse(int gnubby_connection_id, | |
| 66 const std::string& response) override; | |
| 67 void SendErrorAndCloseConnection(int gnubby_connection_id) override; | |
| 68 void SetSendMessageCallback(const SendMessageCallback& callback) override; | |
| 69 size_t GetActiveConnectionCountForTest() const override; | |
| 70 void SetRequestTimeoutForTest(base::TimeDelta timeout) override; | |
| 71 | |
| 72 // Starts listening for connection. | |
| 73 void DoAccept(); | |
| 74 | |
| 75 // Called when a connection is accepted. | |
| 76 void OnAccepted(int result); | |
| 77 | |
| 78 // Called when a GnubbySocket has done reading. | |
| 79 void OnReadComplete(int gnubby_connection_id); | |
| 80 | |
| 81 // Gets an active socket iterator for |gnubby_connection_id|. | |
| 82 ActiveSockets::const_iterator GetSocketForConnectionId( | |
| 83 int gnubby_connection_id) const; | |
| 84 | |
| 85 // Send an error and closes an active socket. | |
| 86 void SendErrorAndCloseActiveSocket(const ActiveSockets::const_iterator& iter); | |
| 87 | |
| 88 // A request timed out. | |
| 89 void RequestTimedOut(int gnubby_connection_id); | |
| 90 | |
| 91 // Ensures GnubbyAuthHandlerLinux methods are called on the same thread. | |
| 92 base::ThreadChecker thread_checker_; | |
| 93 | |
| 94 // Socket used to listen for authorization requests. | |
| 95 std::unique_ptr<net::UnixDomainServerSocket> auth_socket_; | |
| 96 | |
| 97 // A temporary holder for an accepted connection. | |
| 98 std::unique_ptr<net::StreamSocket> accept_socket_; | |
| 99 | |
| 100 // Used to pass gnubby extension messages to the client. | |
| 101 SendMessageCallback send_message_callback_; | |
| 102 | |
| 103 // The last assigned gnubby connection id. | |
| 104 int last_connection_id_; | |
| 105 | |
| 106 // Sockets by connection id used to process gnubbyd requests. | |
| 107 ActiveSockets active_sockets_; | |
| 108 | |
| 109 // Timeout used for a request. | |
| 110 base::TimeDelta request_timeout_; | |
| 111 | |
| 112 DISALLOW_COPY_AND_ASSIGN(GnubbyAuthHandlerLinux); | |
| 113 }; | |
| 114 | |
| 115 std::unique_ptr<GnubbyAuthHandler> GnubbyAuthHandler::Create( | |
| 116 ClientSessionDetails* client_session_details, | |
| 117 const SendMessageCallback& send_message_callback) { | |
| 118 std::unique_ptr<GnubbyAuthHandler> auth_handler(new GnubbyAuthHandlerLinux()); | |
| 119 auth_handler->SetSendMessageCallback(send_message_callback); | |
| 120 return auth_handler; | |
| 121 } | |
| 122 | |
| 123 void GnubbyAuthHandler::SetGnubbySocketName( | |
| 124 const base::FilePath& gnubby_socket_name) { | |
| 125 g_gnubby_socket_name.Get() = gnubby_socket_name; | |
| 126 } | |
| 127 | |
| 128 GnubbyAuthHandlerLinux::GnubbyAuthHandlerLinux() | |
| 129 : last_connection_id_(0), | |
| 130 request_timeout_( | |
| 131 base::TimeDelta::FromSeconds(kDefaultRequestTimeoutSeconds)) {} | |
| 132 | |
| 133 GnubbyAuthHandlerLinux::~GnubbyAuthHandlerLinux() { | |
| 134 STLDeleteValues(&active_sockets_); | |
| 135 } | |
| 136 | |
| 137 void GnubbyAuthHandlerLinux::CreateGnubbyConnection() { | |
| 138 DCHECK(thread_checker_.CalledOnValidThread()); | |
| 139 DCHECK(!g_gnubby_socket_name.Get().empty()); | |
| 140 | |
| 141 { | |
| 142 // DeleteFile() is a blocking operation, but so is creation of the unix | |
| 143 // socket below. Consider moving this class to a different thread if this | |
| 144 // causes any problems. See crbug.com/509807. | |
| 145 // TODO(joedow): Since this code now runs as a host extension, we should | |
| 146 // perform our IO on a separate thread: crbug.com/591739 | |
| 147 base::ThreadRestrictions::ScopedAllowIO allow_io; | |
| 148 | |
| 149 // If the file already exists, a socket in use error is returned. | |
| 150 base::DeleteFile(g_gnubby_socket_name.Get(), false); | |
| 151 } | |
| 152 | |
| 153 HOST_LOG << "Listening for gnubby requests on " | |
| 154 << g_gnubby_socket_name.Get().value(); | |
| 155 | |
| 156 auth_socket_.reset( | |
| 157 new net::UnixDomainServerSocket(base::Bind(MatchUid), false)); | |
| 158 int rv = auth_socket_->BindAndListen(g_gnubby_socket_name.Get().value(), | |
| 159 /*backlog=*/1); | |
| 160 if (rv != net::OK) { | |
| 161 LOG(ERROR) << "Failed to open socket for gnubby requests: '" << rv << "'"; | |
| 162 return; | |
| 163 } | |
| 164 DoAccept(); | |
| 165 } | |
| 166 | |
| 167 bool GnubbyAuthHandlerLinux::IsValidConnectionId( | |
| 168 int gnubby_connection_id) const { | |
| 169 return GetSocketForConnectionId(gnubby_connection_id) != | |
| 170 active_sockets_.end(); | |
| 171 } | |
| 172 | |
| 173 void GnubbyAuthHandlerLinux::SendClientResponse(int gnubby_connection_id, | |
| 174 const std::string& response) { | |
| 175 ActiveSockets::const_iterator iter = | |
| 176 GetSocketForConnectionId(gnubby_connection_id); | |
| 177 if (iter != active_sockets_.end()) { | |
| 178 iter->second->SendResponse(response); | |
| 179 } else { | |
| 180 LOG(WARNING) << "Unknown gnubby-auth data connection: '" | |
| 181 << gnubby_connection_id << "'"; | |
| 182 } | |
| 183 } | |
| 184 | |
| 185 void GnubbyAuthHandlerLinux::SendErrorAndCloseConnection( | |
| 186 int gnubby_connection_id) { | |
| 187 ActiveSockets::const_iterator iter = | |
| 188 GetSocketForConnectionId(gnubby_connection_id); | |
| 189 if (iter != active_sockets_.end()) { | |
| 190 HOST_LOG << "Sending gnubby error"; | |
| 191 SendErrorAndCloseActiveSocket(iter); | |
| 192 } else { | |
| 193 LOG(WARNING) << "Unknown gnubby-auth data connection: '" | |
| 194 << gnubby_connection_id << "'"; | |
| 195 } | |
| 196 } | |
| 197 | |
| 198 void GnubbyAuthHandlerLinux::SetSendMessageCallback( | |
| 199 const SendMessageCallback& callback) { | |
| 200 send_message_callback_ = callback; | |
| 201 } | |
| 202 | |
| 203 size_t GnubbyAuthHandlerLinux::GetActiveConnectionCountForTest() const { | |
| 204 return active_sockets_.size(); | |
| 205 } | |
| 206 | |
| 207 void GnubbyAuthHandlerLinux::SetRequestTimeoutForTest(base::TimeDelta timeout) { | |
| 208 request_timeout_ = timeout; | |
| 209 } | |
| 210 | |
| 211 void GnubbyAuthHandlerLinux::DoAccept() { | |
| 212 int result = auth_socket_->Accept( | |
| 213 &accept_socket_, | |
| 214 base::Bind(&GnubbyAuthHandlerLinux::OnAccepted, base::Unretained(this))); | |
| 215 if (result != net::ERR_IO_PENDING) | |
| 216 OnAccepted(result); | |
| 217 } | |
| 218 | |
| 219 void GnubbyAuthHandlerLinux::OnAccepted(int result) { | |
| 220 DCHECK(thread_checker_.CalledOnValidThread()); | |
| 221 DCHECK_NE(net::ERR_IO_PENDING, result); | |
| 222 | |
| 223 if (result < 0) { | |
| 224 LOG(ERROR) << "Error in accepting a new connection"; | |
| 225 return; | |
| 226 } | |
| 227 | |
| 228 int gnubby_connection_id = ++last_connection_id_; | |
| 229 GnubbySocket* socket = new GnubbySocket( | |
| 230 std::move(accept_socket_), request_timeout_, | |
| 231 base::Bind(&GnubbyAuthHandlerLinux::RequestTimedOut, | |
| 232 base::Unretained(this), gnubby_connection_id)); | |
| 233 active_sockets_[gnubby_connection_id] = socket; | |
| 234 socket->StartReadingRequest( | |
| 235 base::Bind(&GnubbyAuthHandlerLinux::OnReadComplete, | |
| 236 base::Unretained(this), gnubby_connection_id)); | |
| 237 | |
| 238 // Continue accepting new connections. | |
| 239 DoAccept(); | |
| 240 } | |
| 241 | |
| 242 void GnubbyAuthHandlerLinux::OnReadComplete(int gnubby_connection_id) { | |
| 243 DCHECK(thread_checker_.CalledOnValidThread()); | |
| 244 | |
| 245 ActiveSockets::const_iterator iter = | |
| 246 active_sockets_.find(gnubby_connection_id); | |
| 247 DCHECK(iter != active_sockets_.end()); | |
| 248 std::string request_data; | |
| 249 if (!iter->second->GetAndClearRequestData(&request_data)) { | |
| 250 SendErrorAndCloseActiveSocket(iter); | |
| 251 return; | |
| 252 } | |
| 253 | |
| 254 HOST_LOG << "Received gnubby request: " << GetCommandCode(request_data); | |
| 255 send_message_callback_.Run(gnubby_connection_id, request_data); | |
| 256 | |
| 257 iter->second->StartReadingRequest( | |
| 258 base::Bind(&GnubbyAuthHandlerLinux::OnReadComplete, | |
| 259 base::Unretained(this), gnubby_connection_id)); | |
| 260 } | |
| 261 | |
| 262 GnubbyAuthHandlerLinux::ActiveSockets::const_iterator | |
| 263 GnubbyAuthHandlerLinux::GetSocketForConnectionId( | |
| 264 int gnubby_connection_id) const { | |
| 265 return active_sockets_.find(gnubby_connection_id); | |
| 266 } | |
| 267 | |
| 268 void GnubbyAuthHandlerLinux::SendErrorAndCloseActiveSocket( | |
| 269 const ActiveSockets::const_iterator& iter) { | |
| 270 iter->second->SendSshError(); | |
| 271 delete iter->second; | |
| 272 active_sockets_.erase(iter); | |
| 273 } | |
| 274 | |
| 275 void GnubbyAuthHandlerLinux::RequestTimedOut(int gnubby_connection_id) { | |
| 276 HOST_LOG << "Gnubby request timed out"; | |
| 277 ActiveSockets::const_iterator iter = | |
| 278 active_sockets_.find(gnubby_connection_id); | |
| 279 if (iter != active_sockets_.end()) | |
| 280 SendErrorAndCloseActiveSocket(iter); | |
| 281 } | |
| 282 | |
| 283 } // namespace remoting | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2164753004:
Renaming Gnubby and RemoteSecurityKey files/classes/members (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master