OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "ipc/file_descriptor_set_posix.h" | 5 #include "ipc/file_descriptor_set_posix.h" |
6 | 6 |
7 #include <sys/types.h> | 7 #include <sys/types.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 #include <unistd.h> | 9 #include <unistd.h> |
10 | 10 |
11 #include "base/logging.h" | 11 #include "base/logging.h" |
12 #include "base/posix/eintr_wrapper.h" | 12 #include "base/posix/eintr_wrapper.h" |
13 | 13 |
14 FileDescriptorSet::FileDescriptorSet() | 14 FileDescriptorSet::FileDescriptorSet() |
15 : consumed_descriptor_highwater_(0) { | 15 : consumed_descriptor_highwater_(0) { |
16 } | 16 } |
17 | 17 |
18 FileDescriptorSet::~FileDescriptorSet() { | 18 FileDescriptorSet::~FileDescriptorSet() { |
19 if (consumed_descriptor_highwater_ == descriptors_.size()) | 19 if (consumed_descriptor_highwater_ == size()) |
20 return; | 20 return; |
21 | 21 |
22 LOG(WARNING) << "FileDescriptorSet destroyed with unconsumed descriptors"; | 22 // We close all the owning descriptors. If this message should have |
23 // We close all the descriptors where the close flag is set. If this | 23 // been transmitted, then closing those with close flags set mirrors |
24 // message should have been transmitted, then closing those with close | 24 // the expected behaviour. |
25 // flags set mirrors the expected behaviour. | |
26 // | 25 // |
27 // If this message was received with more descriptors than expected | 26 // If this message was received with more descriptors than expected |
28 // (which could a DOS against the browser by a rogue renderer) then all | 27 // (which could a DOS against the browser by a rogue renderer) then all |
29 // the descriptors have their close flag set and we free all the extra | 28 // the descriptors have their close flag set and we free all the extra |
30 // kernel resources. | 29 // kernel resources. |
31 for (unsigned i = consumed_descriptor_highwater_; | 30 LOG(WARNING) << "FileDescriptorSet destroyed with unconsumed descriptors: " |
32 i < descriptors_.size(); ++i) { | 31 << consumed_descriptor_highwater_ << "/" << size(); |
33 if (descriptors_[i].auto_close) | |
34 if (IGNORE_EINTR(close(descriptors_[i].fd)) < 0) | |
35 PLOG(ERROR) << "close"; | |
36 } | |
37 } | 32 } |
38 | 33 |
39 bool FileDescriptorSet::Add(int fd) { | 34 bool FileDescriptorSet::AddToBorrow(base::PlatformFile fd) { |
40 if (descriptors_.size() == kMaxDescriptorsPerMessage) { | 35 DCHECK_EQ(consumed_descriptor_highwater_, 0u); |
| 36 |
| 37 if (size() == kMaxDescriptorsPerMessage) { |
41 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full."; | 38 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full."; |
42 return false; | 39 return false; |
43 } | 40 } |
44 | 41 |
45 struct base::FileDescriptor sd; | 42 descriptors_.push_back(fd); |
46 sd.fd = fd; | |
47 sd.auto_close = false; | |
48 descriptors_.push_back(sd); | |
49 return true; | 43 return true; |
50 } | 44 } |
51 | 45 |
52 bool FileDescriptorSet::AddAndAutoClose(int fd) { | 46 bool FileDescriptorSet::AddToOwn(base::ScopedFD fd) { |
53 if (descriptors_.size() == kMaxDescriptorsPerMessage) { | 47 DCHECK_EQ(consumed_descriptor_highwater_, 0u); |
| 48 |
| 49 if (size() == kMaxDescriptorsPerMessage) { |
54 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full."; | 50 DLOG(WARNING) << "Cannot add file descriptor. FileDescriptorSet full."; |
55 return false; | 51 return false; |
56 } | 52 } |
57 | 53 |
58 struct base::FileDescriptor sd; | 54 descriptors_.push_back(fd.get()); |
59 sd.fd = fd; | 55 owned_descriptors_.push_back(new base::ScopedFD(fd.Pass())); |
60 sd.auto_close = true; | 56 DCHECK(size() <= kMaxDescriptorsPerMessage); |
61 descriptors_.push_back(sd); | |
62 DCHECK(descriptors_.size() <= kMaxDescriptorsPerMessage); | |
63 return true; | 57 return true; |
64 } | 58 } |
65 | 59 |
66 int FileDescriptorSet::GetDescriptorAt(unsigned index) const { | 60 base::PlatformFile FileDescriptorSet::TakeDescriptorAt(unsigned index) { |
67 if (index >= descriptors_.size()) | 61 if (index >= size()) { |
| 62 DLOG(WARNING) << "Accessing out of bound index:" |
| 63 << index << "/" << size(); |
68 return -1; | 64 return -1; |
| 65 } |
| 66 |
69 | 67 |
70 // We should always walk the descriptors in order, so it's reasonable to | 68 // We should always walk the descriptors in order, so it's reasonable to |
71 // enforce this. Consider the case where a compromised renderer sends us | 69 // enforce this. Consider the case where a compromised renderer sends us |
72 // the following message: | 70 // the following message: |
73 // | 71 // |
74 // ExampleMsg: | 72 // ExampleMsg: |
75 // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m} | 73 // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m} |
76 // | 74 // |
77 // Here the renderer sent us a message which should have a descriptor, but | 75 // Here the renderer sent us a message which should have a descriptor, but |
78 // actually sent two in an attempt to fill our fd table and kill us. By | 76 // actually sent two in an attempt to fill our fd table and kill us. By |
79 // setting the index of the descriptor in the message to 1 (it should be | 77 // setting the index of the descriptor in the message to 1 (it should be |
80 // 0), we would record a highwater of 1 and then consider all the | 78 // 0), we would record a highwater of 1 and then consider all the |
81 // descriptors to have been used. | 79 // descriptors to have been used. |
82 // | 80 // |
83 // So we can either track of the use of each descriptor in a bitset, or we | 81 // So we can either track of the use of each descriptor in a bitset, or we |
84 // can enforce that we walk the indexes strictly in order. | 82 // can enforce that we walk the indexes strictly in order. |
85 // | 83 // |
86 // There's one more wrinkle: When logging messages, we may reparse them. So | 84 // There's one more wrinkle: When logging messages, we may reparse them. So |
87 // we have an exception: When the consumed_descriptor_highwater_ is at the | 85 // we have an exception: When the consumed_descriptor_highwater_ is at the |
88 // end of the array and index 0 is requested, we reset the highwater value. | 86 // end of the array and index 0 is requested, we reset the highwater value. |
| 87 // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer |
| 88 // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294 |
89 if (index == 0 && consumed_descriptor_highwater_ == descriptors_.size()) | 89 if (index == 0 && consumed_descriptor_highwater_ == descriptors_.size()) |
90 consumed_descriptor_highwater_ = 0; | 90 consumed_descriptor_highwater_ = 0; |
91 | 91 |
92 if (index != consumed_descriptor_highwater_) | 92 if (index != consumed_descriptor_highwater_) |
93 return -1; | 93 return -1; |
94 | 94 |
95 consumed_descriptor_highwater_ = index + 1; | 95 consumed_descriptor_highwater_ = index + 1; |
96 return descriptors_[index].fd; | 96 |
| 97 base::PlatformFile file = descriptors_[index]; |
| 98 |
| 99 // TODO(morrita): In production, descriptors_.size() should be same as |
| 100 // owned_descriptors_.size() as all read descriptors are owned by Message. |
| 101 // We have to do this because unit test breaks this assumption. It should be |
| 102 // changed to exercise with own-able descriptors. |
| 103 for (ScopedVector<base::ScopedFD>::const_iterator i = |
| 104 owned_descriptors_.begin(); |
| 105 i != owned_descriptors_.end(); |
| 106 ++i) { |
| 107 if ((*i)->get() == file) { |
| 108 ignore_result((*i)->release()); |
| 109 break; |
| 110 } |
| 111 } |
| 112 |
| 113 return file; |
97 } | 114 } |
98 | 115 |
99 void FileDescriptorSet::GetDescriptors(int* buffer) const { | 116 void FileDescriptorSet::PeekDescriptors(base::PlatformFile* buffer) const { |
100 for (std::vector<base::FileDescriptor>::const_iterator | 117 std::copy(descriptors_.begin(), descriptors_.end(), buffer); |
101 i = descriptors_.begin(); i != descriptors_.end(); ++i) { | |
102 *(buffer++) = i->fd; | |
103 } | |
104 } | 118 } |
105 | 119 |
106 bool FileDescriptorSet::ContainsDirectoryDescriptor() const { | 120 bool FileDescriptorSet::ContainsDirectoryDescriptor() const { |
107 struct stat st; | 121 struct stat st; |
108 | 122 |
109 for (std::vector<base::FileDescriptor>::const_iterator | 123 for (std::vector<base::PlatformFile>::const_iterator i = descriptors_.begin(); |
110 i = descriptors_.begin(); i != descriptors_.end(); ++i) { | 124 i != descriptors_.end(); |
111 if (fstat(i->fd, &st) == 0 && S_ISDIR(st.st_mode)) | 125 ++i) { |
| 126 if (fstat(*i, &st) == 0 && S_ISDIR(st.st_mode)) |
112 return true; | 127 return true; |
113 } | 128 } |
114 | 129 |
115 return false; | 130 return false; |
116 } | 131 } |
117 | 132 |
118 void FileDescriptorSet::CommitAll() { | 133 void FileDescriptorSet::CommitAll() { |
119 for (std::vector<base::FileDescriptor>::iterator | |
120 i = descriptors_.begin(); i != descriptors_.end(); ++i) { | |
121 if (i->auto_close) | |
122 if (IGNORE_EINTR(close(i->fd)) < 0) | |
123 PLOG(ERROR) << "close"; | |
124 } | |
125 descriptors_.clear(); | 134 descriptors_.clear(); |
| 135 owned_descriptors_.clear(); |
126 consumed_descriptor_highwater_ = 0; | 136 consumed_descriptor_highwater_ = 0; |
127 } | 137 } |
128 | 138 |
129 void FileDescriptorSet::ReleaseFDsToClose(std::vector<int>* fds) { | 139 void FileDescriptorSet::ReleaseFDsToClose( |
130 for (std::vector<base::FileDescriptor>::iterator | 140 std::vector<base::PlatformFile>* fds) { |
131 i = descriptors_.begin(); i != descriptors_.end(); ++i) { | 141 for (ScopedVector<base::ScopedFD>::iterator i = owned_descriptors_.begin(); |
132 if (i->auto_close) | 142 i != owned_descriptors_.end(); |
133 fds->push_back(i->fd); | 143 ++i) { |
| 144 fds->push_back((*i)->release()); |
134 } | 145 } |
135 descriptors_.clear(); | 146 |
136 consumed_descriptor_highwater_ = 0; | 147 CommitAll(); |
137 } | 148 } |
138 | 149 |
139 void FileDescriptorSet::SetDescriptors(const int* buffer, unsigned count) { | 150 void FileDescriptorSet::AddDescriptorsToOwn(const base::PlatformFile* buffer, |
| 151 unsigned count) { |
140 DCHECK(count <= kMaxDescriptorsPerMessage); | 152 DCHECK(count <= kMaxDescriptorsPerMessage); |
141 DCHECK_EQ(descriptors_.size(), 0u); | 153 DCHECK_EQ(size(), 0u); |
142 DCHECK_EQ(consumed_descriptor_highwater_, 0u); | 154 DCHECK_EQ(consumed_descriptor_highwater_, 0u); |
143 | 155 |
144 descriptors_.reserve(count); | 156 descriptors_.reserve(count); |
| 157 owned_descriptors_.reserve(count); |
145 for (unsigned i = 0; i < count; ++i) { | 158 for (unsigned i = 0; i < count; ++i) { |
146 struct base::FileDescriptor sd; | 159 descriptors_.push_back(buffer[i]); |
147 sd.fd = buffer[i]; | 160 owned_descriptors_.push_back(new base::ScopedFD(buffer[i])); |
148 sd.auto_close = true; | |
149 descriptors_.push_back(sd); | |
150 } | 161 } |
151 } | 162 } |
OLD | NEW |