Add a mechanism to scramble Mojo message IDs.

mojo/public/tools/bindings/mojom_bindings_generator.py

 #!/usr/bin/env python
 # Copyright 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """The frontend for the Mojo bindings system."""
 
 
 import argparse
+import hashlib
 import imp
 import json
 import os
 import pprint
 import re
+import struct
 import sys
 
 # Disable lint check for finding modules:
 # pylint: disable=F0401
 
 def _GetDirAbove(dirname):
   """Returns the directory "above" this file containing |dirname| (which must
   also be "above" this file)."""
   path = os.path.abspath(__file__)
   while True:
@@ skipping 68 matching lines @@
   RelativePath with first file found, or an arbitrary non-existent file
   otherwise."""
   for rel_search_dir in [rel_dir] + search_rel_dirs:
     path = os.path.join(rel_search_dir.path, file_name)
     if os.path.isfile(path):
       return RelativePath(path, rel_search_dir.source_root)
   return RelativePath(os.path.join(rel_dir.path, file_name),
                       rel_dir.source_root)
 
 
+def ScrambleMethodOrdinals(interfaces, salt):
+  already_generated = set()
+  for interface in interfaces:
+    i = 0
+    already_generated.clear()
+    for method in interface.methods:
+      while True:
+        i = i + 1
+        if i == 1000000:
+          raise Exception("Could not generate %d method ordinals for %s" %
+              (len(interface.methods), interface.name))
+        # Generate a scrambled method.ordinal value. The algorithm doesn't have
+        # to be very strong, cryptographically. It just needs to be non-trivial
+        # to guess the results without the secret salt, in order to make it
+        # harder for a compromised process to send fake Mojo messages.
+        sha256 = hashlib.sha256(salt)
+        sha256.update(interface.name)
+        sha256.update(str(i))
+        # Take the first 4 bytes as a little-endian uint32.
+        ordinal = struct.unpack('<L', sha256.digest()[:4])[0]
+        # Trim to 31 bits, so it always fits into a Java (signed) int.
+        ordinal = ordinal & 0x7fffffff
+        if ordinal in already_generated:
+          continue
+        already_generated.add(ordinal)
+        method.ordinal = ordinal
+        method.ordinal_comment = (
+            'The %s value is based on sha256(salt + "%s%d").' %
+            (ordinal, interface.name, i))
+        break
+
+
 class MojomProcessor(object):
   """Parses mojom files and creates ASTs for them.
 
   Attributes:
     _processed_files: {Dict[str, mojom.generate.module.Module]} Mapping from
         relative mojom filename paths to the module AST for that mojom file.
   """
   def __init__(self, should_generate):
     self._should_generate = should_generate
     self._processed_files = {}
@@ skipping 34 matching lines @@
     imports = {}
     for parsed_imp in tree.import_list:
       rel_import_file = FindImportFile(
           RelativePath(dirname, rel_filename.source_root),
           parsed_imp.import_filename, args.import_directories)
       imports[parsed_imp.import_filename] = self._GenerateModule(
           args, remaining_args, generator_modules, rel_import_file)
 
     module = translate.OrderedModule(tree, name, imports)
 
+    if args.scrambled_message_id_salt:
+      ScrambleMethodOrdinals(module.interfaces, args.scrambled_message_id_salt)
+
     # Set the path as relative to the source root.
     module.path = rel_filename.relative_path()
 
     # Normalize to unix-style path here to keep the generators simpler.
     module.path = module.path.replace('\\', '/')
 
     if self._should_generate(rel_filename.path):
       for language, generator_module in generator_modules.iteritems():
         generator = generator_module.Generator(
             module, args.output_dir, typemap=self._typemap.get(language, {}),
@@ skipping 145 matching lines @@
       "component build.")
   generate_parser.add_argument(
       "--generate_non_variant_code", action="store_true",
       help="Generate code that is shared by different variants.")
   generate_parser.add_argument(
       "--depfile", type=str,
       help="A file into which the list of input files will be written.")
   generate_parser.add_argument(
       "--depfile_target", type=str,
       help="The target name to use in the depfile.")
+  generate_parser.add_argument(
+      "--scrambled_message_id_salt",
+      help="If non-empty, the salt for generating scrambled message IDs.")
   generate_parser.set_defaults(func=_Generate)
 
   precompile_parser = subparsers.add_parser("precompile",
       description="Precompile templates for the mojom bindings generator.")
   precompile_parser.add_argument(
       "-o", "--output_dir", dest="output_dir", default=".",
       help="output directory for precompiled templates")
   precompile_parser.set_defaults(func=_Precompile)
 
   args, remaining_args = parser.parse_known_args()
   return args.func(args, remaining_args)
 
 
 if __name__ == "__main__":
   sys.exit(main())