Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(271)

Side by Side Diff: ipc/file_descriptor_set_posix.cc

Issue 583473002: IPC: Get rid of FileDescriptor usage from FileDescriptorSet and Message (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « ipc/file_descriptor_set_posix.h ('k') | ipc/file_descriptor_set_posix_unittest.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "ipc/file_descriptor_set_posix.h" 5 #include "ipc/file_descriptor_set_posix.h"
6 6
7 #include <sys/types.h> 7 #include <sys/types.h>
8 #include <sys/stat.h> 8 #include <sys/stat.h>
9 #include <unistd.h> 9 #include <unistd.h>
10 10
11 #include "base/logging.h" 11 #include "base/logging.h"
12 #include "base/posix/eintr_wrapper.h" 12 #include "base/posix/eintr_wrapper.h"
13 13
14 FileDescriptorSet::FileDescriptorSet() 14 FileDescriptorSet::FileDescriptorSet()
15 : consumed_descriptor_highwater_(0) { 15 : consumed_descriptor_highwater_(0) {
16 } 16 }
17 17
18 FileDescriptorSet::~FileDescriptorSet() { 18 FileDescriptorSet::~FileDescriptorSet() {
19 if (consumed_descriptor_highwater_ == descriptors_.size()) 19 if (consumed_descriptor_highwater_ == size())
20 return; 20 return;
21 21
22 LOG(WARNING) << "FileDescriptorSet destroyed with unconsumed descriptors"; 22 // We close all the owning descriptors. If this message should have
23 // We close all the descriptors where the close flag is set. If this 23 // been transmitted, then closing those with close flags set mirrors
24 // message should have been transmitted, then closing those with close 24 // the expected behaviour.
25 // flags set mirrors the expected behaviour.
26 // 25 //
27 // If this message was received with more descriptors than expected 26 // If this message was received with more descriptors than expected
28 // (which could a DOS against the browser by a rogue renderer) then all 27 // (which could a DOS against the browser by a rogue renderer) then all
29 // the descriptors have their close flag set and we free all the extra 28 // the descriptors have their close flag set and we free all the extra
30 // kernel resources. 29 // kernel resources.
31 for (unsigned i = consumed_descriptor_highwater_; 30 LOG(WARNING) << "FileDescriptorSet destroyed with unconsumed descriptors: "
32 i < descriptors_.size(); ++i) { 31 << consumed_descriptor_highwater_ << "/" << size();
33 if (descriptors_[i].auto_close)
34 if (IGNORE_EINTR(close(descriptors_[i].fd)) < 0)
35 PLOG(ERROR) << "close";
36 }
37 } 32 }
38 33
39 bool FileDescriptorSet::Add(int fd) { 34 bool FileDescriptorSet::AddToBorrow(base::PlatformFile fd) {
40 if (descriptors_.size() == kMaxDescriptorsPerMessage) { 35 DCHECK_EQ(consumed_descriptor_highwater_, 0u);
36
37 if (size() == kMaxDescriptorsPerMessage) {
41 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full."; 38 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full.";
42 return false; 39 return false;
43 } 40 }
44 41
45 struct base::FileDescriptor sd; 42 descriptors_.push_back(fd);
46 sd.fd = fd;
47 sd.auto_close = false;
48 descriptors_.push_back(sd);
49 return true; 43 return true;
50 } 44 }
51 45
52 bool FileDescriptorSet::AddAndAutoClose(int fd) { 46 bool FileDescriptorSet::AddToOwn(base::ScopedFD fd) {
53 if (descriptors_.size() == kMaxDescriptorsPerMessage) { 47 DCHECK_EQ(consumed_descriptor_highwater_, 0u);
48
49 if (size() == kMaxDescriptorsPerMessage) {
54 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full."; 50 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full.";
55 return false; 51 return false;
56 } 52 }
57 53
58 struct base::FileDescriptor sd; 54 descriptors_.push_back(fd.get());
59 sd.fd = fd; 55 owned_descriptors_.push_back(new base::ScopedFD(fd.Pass()));
60 sd.auto_close = true; 56 DCHECK(size() <= kMaxDescriptorsPerMessage);
61 descriptors_.push_back(sd);
62 DCHECK(descriptors_.size() <= kMaxDescriptorsPerMessage);
63 return true; 57 return true;
64 } 58 }
65 59
66 int FileDescriptorSet::GetDescriptorAt(unsigned index) const { 60 base::PlatformFile FileDescriptorSet::TakeDescriptorAt(unsigned index) {
67 if (index >= descriptors_.size()) 61 if (index >= size()) {
62 DLOG(WARNING) << "Accessing out of bound index:"
63 << index << "/" << size();
68 return -1; 64 return -1;
65 }
66
69 67
70 // We should always walk the descriptors in order, so it's reasonable to 68 // We should always walk the descriptors in order, so it's reasonable to
71 // enforce this. Consider the case where a compromised renderer sends us 69 // enforce this. Consider the case where a compromised renderer sends us
72 // the following message: 70 // the following message:
73 // 71 //
74 // ExampleMsg: 72 // ExampleMsg:
75 // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m} 73 // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
76 // 74 //
77 // Here the renderer sent us a message which should have a descriptor, but 75 // Here the renderer sent us a message which should have a descriptor, but
78 // actually sent two in an attempt to fill our fd table and kill us. By 76 // actually sent two in an attempt to fill our fd table and kill us. By
79 // setting the index of the descriptor in the message to 1 (it should be 77 // setting the index of the descriptor in the message to 1 (it should be
80 // 0), we would record a highwater of 1 and then consider all the 78 // 0), we would record a highwater of 1 and then consider all the
81 // descriptors to have been used. 79 // descriptors to have been used.
82 // 80 //
83 // So we can either track of the use of each descriptor in a bitset, or we 81 // So we can either track of the use of each descriptor in a bitset, or we
84 // can enforce that we walk the indexes strictly in order. 82 // can enforce that we walk the indexes strictly in order.
85 // 83 //
86 // There's one more wrinkle: When logging messages, we may reparse them. So 84 // There's one more wrinkle: When logging messages, we may reparse them. So
87 // we have an exception: When the consumed_descriptor_highwater_ is at the 85 // we have an exception: When the consumed_descriptor_highwater_ is at the
88 // end of the array and index 0 is requested, we reset the highwater value. 86 // end of the array and index 0 is requested, we reset the highwater value.
87 // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
88 // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
89 if (index == 0 && consumed_descriptor_highwater_ == descriptors_.size()) 89 if (index == 0 && consumed_descriptor_highwater_ == descriptors_.size())
90 consumed_descriptor_highwater_ = 0; 90 consumed_descriptor_highwater_ = 0;
91 91
92 if (index != consumed_descriptor_highwater_) 92 if (index != consumed_descriptor_highwater_)
93 return -1; 93 return -1;
94 94
95 consumed_descriptor_highwater_ = index + 1; 95 consumed_descriptor_highwater_ = index + 1;
96 return descriptors_[index].fd; 96
97 base::PlatformFile file = descriptors_[index];
98
99 // TODO(morrita): In production, descriptors_.size() should be same as
100 // owned_descriptors_.size() as all read descriptors are owned by Message.
101 // We have to do this because unit test breaks this assumption. It should be
102 // changed to exercise with own-able descriptors.
103 for (ScopedVector<base::ScopedFD>::const_iterator i =
104 owned_descriptors_.begin();
105 i != owned_descriptors_.end();
106 ++i) {
107 if ((*i)->get() == file) {
108 ignore_result((*i)->release());
109 break;
110 }
111 }
112
113 return file;
97 } 114 }
98 115
99 void FileDescriptorSet::GetDescriptors(int* buffer) const { 116 void FileDescriptorSet::PeekDescriptors(base::PlatformFile* buffer) const {
100 for (std::vector<base::FileDescriptor>::const_iterator 117 std::copy(descriptors_.begin(), descriptors_.end(), buffer);
101 i = descriptors_.begin(); i != descriptors_.end(); ++i) {
102 *(buffer++) = i->fd;
103 }
104 } 118 }
105 119
106 bool FileDescriptorSet::ContainsDirectoryDescriptor() const { 120 bool FileDescriptorSet::ContainsDirectoryDescriptor() const {
107 struct stat st; 121 struct stat st;
108 122
109 for (std::vector<base::FileDescriptor>::const_iterator 123 for (std::vector<base::PlatformFile>::const_iterator i = descriptors_.begin();
110 i = descriptors_.begin(); i != descriptors_.end(); ++i) { 124 i != descriptors_.end();
111 if (fstat(i->fd, &st) == 0 && S_ISDIR(st.st_mode)) 125 ++i) {
126 if (fstat(*i, &st) == 0 && S_ISDIR(st.st_mode))
112 return true; 127 return true;
113 } 128 }
114 129
115 return false; 130 return false;
116 } 131 }
117 132
118 void FileDescriptorSet::CommitAll() { 133 void FileDescriptorSet::CommitAll() {
119 for (std::vector<base::FileDescriptor>::iterator
120 i = descriptors_.begin(); i != descriptors_.end(); ++i) {
121 if (i->auto_close)
122 if (IGNORE_EINTR(close(i->fd)) < 0)
123 PLOG(ERROR) << "close";
124 }
125 descriptors_.clear(); 134 descriptors_.clear();
135 owned_descriptors_.clear();
126 consumed_descriptor_highwater_ = 0; 136 consumed_descriptor_highwater_ = 0;
127 } 137 }
128 138
129 void FileDescriptorSet::ReleaseFDsToClose(std::vector<int>* fds) { 139 void FileDescriptorSet::ReleaseFDsToClose(
130 for (std::vector<base::FileDescriptor>::iterator 140 std::vector<base::PlatformFile>* fds) {
131 i = descriptors_.begin(); i != descriptors_.end(); ++i) { 141 for (ScopedVector<base::ScopedFD>::iterator i = owned_descriptors_.begin();
132 if (i->auto_close) 142 i != owned_descriptors_.end();
133 fds->push_back(i->fd); 143 ++i) {
144 fds->push_back((*i)->release());
134 } 145 }
135 descriptors_.clear(); 146
136 consumed_descriptor_highwater_ = 0; 147 CommitAll();
137 } 148 }
138 149
139 void FileDescriptorSet::SetDescriptors(const int* buffer, unsigned count) { 150 void FileDescriptorSet::AddDescriptorsToOwn(const base::PlatformFile* buffer,
151 unsigned count) {
140 DCHECK(count <= kMaxDescriptorsPerMessage); 152 DCHECK(count <= kMaxDescriptorsPerMessage);
141 DCHECK_EQ(descriptors_.size(), 0u); 153 DCHECK_EQ(size(), 0u);
142 DCHECK_EQ(consumed_descriptor_highwater_, 0u); 154 DCHECK_EQ(consumed_descriptor_highwater_, 0u);
143 155
144 descriptors_.reserve(count); 156 descriptors_.reserve(count);
157 owned_descriptors_.reserve(count);
145 for (unsigned i = 0; i < count; ++i) { 158 for (unsigned i = 0; i < count; ++i) {
146 struct base::FileDescriptor sd; 159 descriptors_.push_back(buffer[i]);
147 sd.fd = buffer[i]; 160 owned_descriptors_.push_back(new base::ScopedFD(buffer[i]));
148 sd.auto_close = true;
149 descriptors_.push_back(sd);
150 } 161 }
151 } 162 }
OLDNEW
« no previous file with comments | « ipc/file_descriptor_set_posix.h ('k') | ipc/file_descriptor_set_posix_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698