Open a firewall hole when a TCP server or UDP socket is bound.

extensions/browser/api/socket/socket_api.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef EXTENSIONS_BROWSER_API_SOCKET_SOCKET_API_H_
 #define EXTENSIONS_BROWSER_API_SOCKET_SOCKET_API_H_
 
 #include <string>
 
 #include "base/gtest_prod_util.h"
 #include "base/memory/ref_counted.h"
 #include "extensions/browser/api/api_resource_manager.h"
 #include "extensions/browser/api/async_api_function.h"
 #include "extensions/browser/extension_function.h"
 #include "extensions/common/api/socket.h"
 #include "net/base/address_list.h"
 #include "net/dns/host_resolver.h"
 #include "net/socket/tcp_client_socket.h"
 
+namespace chromeos {
+class FirewallHole;
+}
+
 namespace content {
 class BrowserContext;
 class ResourceContext;
 }
 
 namespace net {
 class IOBuffer;
 class URLRequestContextGetter;
 class SSLClientSocket;
 }
@@ skipping 81 matching lines @@
 
   virtual scoped_ptr<SocketResourceManagerInterface>
       CreateSocketResourceManager();
 
   int AddSocket(Socket* socket);
   Socket* GetSocket(int api_resource_id);
   void ReplaceSocket(int api_resource_id, Socket* socket);
   void RemoveSocket(int api_resource_id);
   base::hash_set<int>* GetSocketIds();
 
+  // Only implemented on Chrome OS.

[Finnur, 2015/02/27 11:23:52]

Is this intended to remain a ChromeOS-only feature?

[Reilly Grant (use Gerrit), 2015/02/27 15:57:24]

Yes, it is unnecessary on other platforms where there are existing methods to
control the system firewall.

+  void OpenFirewallHole(const std::string& address,

[Finnur, 2015/02/27 11:23:52]

Also, did this change go through API review?

[Reilly Grant (use Gerrit), 2015/02/27 15:57:24]

It's been signed off on by security (who did the permission_broker work). See
the document linked from the associated bug.

+                        int socket_id,
+                        Socket* socket);
+
  private:
+#if defined(OS_CHROMEOS)
+  void OnFirewallHoleOpenedOnUIThread(int socket_id,
+                                      scoped_ptr<chromeos::FirewallHole> hole);
+  void OnFirewallHoleOpened(int socket_id,
+                            scoped_ptr<chromeos::FirewallHole> hole);
+#endif  // OS_CHROMEOS
+
   scoped_ptr<SocketResourceManagerInterface> manager_;
 };
 
 class SocketExtensionWithDnsLookupFunction : public SocketAsyncApiFunction {
  protected:
   SocketExtensionWithDnsLookupFunction();
   ~SocketExtensionWithDnsLookupFunction() override;
 
   // AsyncApiFunction:
   bool PrePrepare() override;
@@ skipping 91 matching lines @@
 
 class SocketBindFunction : public SocketAsyncApiFunction {
  public:
   DECLARE_EXTENSION_FUNCTION("socket.bind", SOCKET_BIND)
 
  protected:
   ~SocketBindFunction() override {}
 
   // AsyncApiFunction:
   bool Prepare() override;
-  void Work() override;
+  void AsyncWorkStart() override;
 
  private:
   int socket_id_;
   std::string address_;
   uint16 port_;
 };
 
 class SocketListenFunction : public SocketAsyncApiFunction {
  public:
   DECLARE_EXTENSION_FUNCTION("socket.listen", SOCKET_LISTEN)
 
   SocketListenFunction();
 
  protected:
   ~SocketListenFunction() override;
 
   // AsyncApiFunction:
   bool Prepare() override;
-  void Work() override;
+  void AsyncWorkStart() override;
 
  private:
   scoped_ptr<core_api::socket::Listen::Params> params_;
 };
 
 class SocketAcceptFunction : public SocketAsyncApiFunction {
  public:
   DECLARE_EXTENSION_FUNCTION("socket.accept", SOCKET_ACCEPT)
 
   SocketAcceptFunction();
@@ skipping 268 matching lines @@
 
   scoped_ptr<core_api::socket::Secure::Params> params_;
   scoped_refptr<net::URLRequestContextGetter> url_request_getter_;
 
   DISALLOW_COPY_AND_ASSIGN(SocketSecureFunction);
 };
 
 }  // namespace extensions
 
 #endif  // EXTENSIONS_BROWSER_API_SOCKET_SOCKET_API_H_