Mojo EDK: Add safe process connection API

remoting/host/win/wts_session_process_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file implements the Windows service controlling Me2Me host processes
 // running within user sessions.
 
 #include "remoting/host/win/wts_session_process_delegate.h"
 
+#include <memory>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/process/process_handle.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/win/scoped_handle.h"
 #include "ipc/ipc_channel.h"
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_message.h"
 #include "mojo/edk/embedder/embedder.h"
 #include "mojo/edk/embedder/named_platform_channel_pair.h"
+#include "mojo/edk/embedder/pending_process_connection.h"
 #include "mojo/edk/embedder/platform_channel_pair.h"
 #include "mojo/edk/embedder/platform_handle_utils.h"
 #include "mojo/edk/embedder/scoped_platform_handle.h"
 #include "remoting/host/host_main.h"
 #include "remoting/host/ipc_constants.h"
 #include "remoting/host/switches.h"
 #include "remoting/host/win/launch_process_with_token.h"
 #include "remoting/host/win/security_descriptor.h"
 #include "remoting/host/win/worker_process_launcher.h"
 #include "remoting/host/win/wts_terminal_monitor.h"
@@ skipping 108 matching lines @@
   // If launching elevated, this holds the server handle after launch, until
   // the final process launches.
   mojo::edk::ScopedPlatformHandle elevated_server_handle_;
 
   // If launching elevated, this is the pid of the launcher process.
   base::ProcessId elevated_launcher_pid_ = base::kNullProcessId;
 
   // Tracks the id of the worker process.
   base::ProcessId worker_process_pid_ = base::kNullProcessId;
 
-  // The mojo child token for the process being launched.
-  std::string mojo_child_token_;
+  // The pending process connection for the process being launched.
+  std::unique_ptr<mojo::edk::PendingProcessConnection> process_connection_;
 
   DISALLOW_COPY_AND_ASSIGN(Core);
 };
 
 WtsSessionProcessDelegate::Core::Core(
     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner,
     std::unique_ptr<base::CommandLine> target_command,
     bool launch_elevated,
     const std::string& channel_security)
     : caller_task_runner_(base::ThreadTaskRunnerHandle::Get()),
@@ skipping 80 matching lines @@
 void WtsSessionProcessDelegate::Core::CloseChannel() {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 
   if (!channel_) {
     return;
   }
 
   channel_.reset();
   elevated_server_handle_.reset();
   elevated_launcher_pid_ = base::kNullProcessId;
-  if (!mojo_child_token_.empty()) {
-    mojo::edk::ChildProcessLaunchFailed(mojo_child_token_);
-    mojo_child_token_.clear();
-  }
+  process_connection_.reset();
 }
 
 void WtsSessionProcessDelegate::Core::KillProcess() {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 
   CloseChannel();
 
   event_handler_ = nullptr;
   launch_pending_ = false;
 
@@ skipping 110 matching lines @@
       return;
     }
 
     // Create the command line passing the name of the IPC channel to use and
     // copying known switches from the caller's command line.
     command_line.SetProgram(helper_binary);
     command_line.AppendSwitchPath(kElevateSwitchName,
                                   target_command_->GetProgram());
   }
 
-  const std::string mojo_message_pipe_token = mojo::edk::GenerateRandomToken();
-  mojo_child_token_ = mojo::edk::GenerateRandomToken();
+  std::string mojo_pipe_token;
+  process_connection_ = base::MakeUnique<mojo::edk::PendingProcessConnection>();
   std::unique_ptr<IPC::ChannelProxy> channel = IPC::ChannelProxy::Create(
-      mojo::edk::CreateParentMessagePipe(mojo_message_pipe_token,
-                                         mojo_child_token_)
-          .release(),
+      process_connection_->CreateMessagePipe(&mojo_pipe_token).release(),
       IPC::Channel::MODE_SERVER, this, io_task_runner_);
-  command_line.AppendSwitchASCII(kMojoPipeToken, mojo_message_pipe_token);
+  command_line.AppendSwitchASCII(kMojoPipeToken, mojo_pipe_token);
 
   std::unique_ptr<mojo::edk::PlatformChannelPair> normal_mojo_channel;
   std::unique_ptr<mojo::edk::NamedPlatformChannelPair> elevated_mojo_channel;
   base::HandlesToInheritVector handles_to_inherit;
   if (launch_elevated_) {
     // Pass the name of the IPC channel to use.
     mojo::edk::NamedPlatformChannelPair::Options options;
     options.security_descriptor = base::UTF8ToUTF16(channel_security_);
     elevated_mojo_channel =
         base::MakeUnique<mojo::edk::NamedPlatformChannelPair>(options);
@@ skipping 139 matching lines @@
   event_handler_ = nullptr;
   event_handler->OnFatalError();
 }
 
 void WtsSessionProcessDelegate::Core::ReportProcessLaunched(
     base::win::ScopedHandle worker_process,
     mojo::edk::ScopedPlatformHandle server_handle) {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
   DCHECK(!worker_process_.IsValid());
 
-  mojo::edk::ChildProcessLaunched(worker_process.Get(),
-                                  std::move(server_handle),
-                                  mojo_child_token_);
-  mojo_child_token_.clear();
+  process_connection_->Connect(worker_process.Get(), std::move(server_handle));
+  process_connection_.reset();
   worker_process_ = std::move(worker_process);
 
   // Report a handle that can be used to wait for the worker process completion,
   // query information about the process and duplicate handles.
   DWORD desired_access =
       SYNCHRONIZE | PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION;
   HANDLE temp_handle;
   if (!DuplicateHandle(GetCurrentProcess(), worker_process_.Get(),
                        GetCurrentProcess(), &temp_handle, desired_access, FALSE,
                        0)) {
@@ skipping 34 matching lines @@
 
 void WtsSessionProcessDelegate::CloseChannel() {
   core_->CloseChannel();
 }
 
 void WtsSessionProcessDelegate::KillProcess() {
   core_->KillProcess();
 }
 
 }  // namespace remoting