| OLD | NEW |
| (Empty) |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef IPC_ATTACHMENT_BROKER_H_ | |
| 6 #define IPC_ATTACHMENT_BROKER_H_ | |
| 7 | |
| 8 #include "base/gtest_prod_util.h" | |
| 9 #include "base/macros.h" | |
| 10 #include "base/memory/ref_counted.h" | |
| 11 #include "base/process/process_handle.h" | |
| 12 #include "base/single_thread_task_runner.h" | |
| 13 #include "base/synchronization/lock.h" | |
| 14 #include "build/build_config.h" | |
| 15 #include "ipc/brokerable_attachment.h" | |
| 16 #include "ipc/ipc_export.h" | |
| 17 #include "ipc/ipc_listener.h" | |
| 18 | |
| 19 // If the platform has no attachments that need brokering, then it shouldn't | |
| 20 // compile any code that calls member functions of AttachmentBroker. This | |
| 21 // prevents symbols only used by AttachmentBroker and its subclasses from | |
| 22 // making it into the binary. | |
| 23 #if defined(OS_WIN) || (defined(OS_MACOSX) && !defined(OS_IOS)) | |
| 24 #define USE_ATTACHMENT_BROKER 1 | |
| 25 #else | |
| 26 #define USE_ATTACHMENT_BROKER 0 | |
| 27 #endif // defined(OS_WIN) | |
| 28 | |
| 29 namespace base { | |
| 30 class SequencedTaskRunner; | |
| 31 class SingleThreadTaskRunner; | |
| 32 }; | |
| 33 | |
| 34 namespace IPC { | |
| 35 | |
| 36 class AttachmentBroker; | |
| 37 class Endpoint; | |
| 38 | |
| 39 // Classes that inherit from this abstract base class are capable of | |
| 40 // communicating with a broker to send and receive attachments to Chrome IPC | |
| 41 // messages. | |
| 42 class IPC_EXPORT SupportsAttachmentBrokering { | |
| 43 public: | |
| 44 // Returns an AttachmentBroker used to broker attachments of IPC messages to | |
| 45 // other processes. There must be exactly one AttachmentBroker per process. | |
| 46 virtual AttachmentBroker* GetAttachmentBroker() = 0; | |
| 47 }; | |
| 48 | |
| 49 // Responsible for brokering attachments to Chrome IPC messages. On platforms | |
| 50 // that support attachment brokering, every IPC channel should have a reference | |
| 51 // to a AttachmentBroker. | |
| 52 // This class is not thread safe. The implementation of this class assumes that | |
| 53 // it is only ever used on the same thread as its consumers. | |
| 54 class IPC_EXPORT AttachmentBroker : public Listener { | |
| 55 public: | |
| 56 // A standard observer interface that allows consumers of the AttachmentBroker | |
| 57 // to be notified when a new attachment has been received. | |
| 58 class Observer { | |
| 59 public: | |
| 60 virtual void ReceivedBrokerableAttachmentWithId( | |
| 61 const BrokerableAttachment::AttachmentId& id) = 0; | |
| 62 }; | |
| 63 | |
| 64 // Each process has at most one attachment broker. The process is responsible | |
| 65 // for ensuring that |broker| stays alive for as long as the process is | |
| 66 // sending/receiving ipc messages. | |
| 67 static void SetGlobal(AttachmentBroker* broker); | |
| 68 static AttachmentBroker* GetGlobal(); | |
| 69 | |
| 70 AttachmentBroker(); | |
| 71 ~AttachmentBroker() override; | |
| 72 | |
| 73 // Sends |attachment| to |destination_process|. The implementation uses an | |
| 74 // IPC::Channel to communicate with the broker process. This may be the same | |
| 75 // IPC::Channel that is requesting the brokering of an attachment. | |
| 76 // Returns true on success and false otherwise. | |
| 77 virtual bool SendAttachmentToProcess( | |
| 78 const scoped_refptr<BrokerableAttachment>& attachment, | |
| 79 base::ProcessId destination_process) = 0; | |
| 80 | |
| 81 // Returns whether the attachment was available. If the attachment was | |
| 82 // available, populates the output parameter |attachment|. | |
| 83 bool GetAttachmentWithId(BrokerableAttachment::AttachmentId id, | |
| 84 scoped_refptr<BrokerableAttachment>* attachment); | |
| 85 | |
| 86 // Any given observer should only ever add itself once to the observer list. | |
| 87 // Notifications to |observer| will be posted to |runner|. | |
| 88 // The |observer| is expected to call RemoveObserver() before being destroyed. | |
| 89 void AddObserver(Observer* observer, | |
| 90 const scoped_refptr<base::SequencedTaskRunner>& runner); | |
| 91 void RemoveObserver(Observer* observer); | |
| 92 | |
| 93 // These two methods should only be called by the broker process. | |
| 94 // | |
| 95 // Each unprivileged process should have one IPC channel on which it | |
| 96 // communicates attachment information with the broker process. In the broker | |
| 97 // process, these channels must be registered and deregistered with the | |
| 98 // Attachment Broker as they are created and destroyed. | |
| 99 // | |
| 100 // Invocations of Send() on |endpoint| will occur on thread bound to |runner|. | |
| 101 virtual void RegisterCommunicationChannel( | |
| 102 Endpoint* endpoint, | |
| 103 scoped_refptr<base::SingleThreadTaskRunner> runner); | |
| 104 virtual void DeregisterCommunicationChannel(Endpoint* endpoint); | |
| 105 | |
| 106 // In each unprivileged process, exactly one channel should be used to | |
| 107 // communicate brokerable attachments with the broker process. | |
| 108 virtual void RegisterBrokerCommunicationChannel(Endpoint* endpoint); | |
| 109 virtual void DeregisterBrokerCommunicationChannel(Endpoint* endpoint); | |
| 110 | |
| 111 // Informs the attachment broker that a channel endpoint has received its | |
| 112 // peer's PID. | |
| 113 virtual void ReceivedPeerPid(base::ProcessId peer_pid); | |
| 114 | |
| 115 // True if and only if this broker is privileged. | |
| 116 virtual bool IsPrivilegedBroker(); | |
| 117 | |
| 118 protected: | |
| 119 using AttachmentVector = std::vector<scoped_refptr<BrokerableAttachment>>; | |
| 120 | |
| 121 // Adds |attachment| to |attachments_|, and notifies the observers. | |
| 122 void HandleReceivedAttachment( | |
| 123 const scoped_refptr<BrokerableAttachment>& attachment); | |
| 124 | |
| 125 // Informs the observers that a new BrokerableAttachment has been received. | |
| 126 void NotifyObservers(const BrokerableAttachment::AttachmentId& id); | |
| 127 | |
| 128 // Informs the observer identified by |unique_id| that a new | |
| 129 // BrokerableAttachment has been received. | |
| 130 void NotifyObserver(int unique_id, | |
| 131 const BrokerableAttachment::AttachmentId& id); | |
| 132 | |
| 133 // This method is exposed for testing only. | |
| 134 AttachmentVector* get_attachments() { return &attachments_; } | |
| 135 | |
| 136 base::Lock* get_lock() { return &lock_; } | |
| 137 | |
| 138 private: | |
| 139 #if defined(OS_WIN) | |
| 140 FRIEND_TEST_ALL_PREFIXES(AttachmentBrokerUnprivilegedWinTest, | |
| 141 ReceiveValidMessage); | |
| 142 FRIEND_TEST_ALL_PREFIXES(AttachmentBrokerUnprivilegedWinTest, | |
| 143 ReceiveInvalidMessage); | |
| 144 #endif // defined(OS_WIN) | |
| 145 | |
| 146 // A vector of BrokerableAttachments that have been received, but not yet | |
| 147 // consumed. | |
| 148 // A std::vector is used instead of a std::map because this container is | |
| 149 // expected to have few elements, for which a std::vector is expected to have | |
| 150 // better performance. | |
| 151 AttachmentVector attachments_; | |
| 152 | |
| 153 struct ObserverInfo { | |
| 154 ObserverInfo(); | |
| 155 ObserverInfo(const ObserverInfo& other); | |
| 156 ~ObserverInfo(); | |
| 157 | |
| 158 Observer* observer; | |
| 159 int unique_id; | |
| 160 | |
| 161 // Notifications must be dispatched onto |runner|. | |
| 162 scoped_refptr<base::SequencedTaskRunner> runner; | |
| 163 }; | |
| 164 std::vector<ObserverInfo> observers_; | |
| 165 | |
| 166 // This member holds the last id given to an ObserverInfo. | |
| 167 int last_unique_id_; | |
| 168 | |
| 169 // The AttachmentBroker can be accessed from any thread, so modifications to | |
| 170 // internal state must be guarded by a lock. | |
| 171 base::Lock lock_; | |
| 172 DISALLOW_COPY_AND_ASSIGN(AttachmentBroker); | |
| 173 }; | |
| 174 | |
| 175 } // namespace IPC | |
| 176 | |
| 177 #endif // IPC_ATTACHMENT_BROKER_H_ | |
| OLD | NEW |