Open a firewall hole when a TCP server or UDP socket is bound.

extensions/browser/api/socket/socket_api.h

Index: extensions/browser/api/socket/socket_api.h
diff --git a/extensions/browser/api/socket/socket_api.h b/extensions/browser/api/socket/socket_api.h
index 12f4557bfb0fea1d9b059389b023d01a3fb15358..2500dd0ae64d36c0d9bdc2d5910099f13e2639a1 100644
--- a/extensions/browser/api/socket/socket_api.h
+++ b/extensions/browser/api/socket/socket_api.h
@@ -17,6 +17,10 @@
 #include "net/dns/host_resolver.h"
 #include "net/socket/tcp_client_socket.h"
 
+namespace chromeos {
+class FirewallHole;
+}
+
 namespace content {
 class BrowserContext;
 class ResourceContext;
@@ -118,7 +122,19 @@ class SocketAsyncApiFunction : public AsyncApiFunction {
   void RemoveSocket(int api_resource_id);
   base::hash_set<int>* GetSocketIds();
 
+  // Only implemented on Chrome OS.

[Finnur, 2015/02/27 11:23:52]

Is this intended to remain a ChromeOS-only feature?

[Reilly Grant (use Gerrit), 2015/02/27 15:57:24]

Yes, it is unnecessary on other platforms where there are existing methods to
control the system firewall.

+  void OpenFirewallHole(const std::string& address,

[Finnur, 2015/02/27 11:23:52]

Also, did this change go through API review?

[Reilly Grant (use Gerrit), 2015/02/27 15:57:24]

It's been signed off on by security (who did the permission_broker work). See
the document linked from the associated bug.

+                        int socket_id,
+                        Socket* socket);
+
  private:
+#if defined(OS_CHROMEOS)
+  void OnFirewallHoleOpenedOnUIThread(int socket_id,
+                                      scoped_ptr<chromeos::FirewallHole> hole);
+  void OnFirewallHoleOpened(int socket_id,
+                            scoped_ptr<chromeos::FirewallHole> hole);
+#endif  // OS_CHROMEOS
+
   scoped_ptr<SocketResourceManagerInterface> manager_;
 };
 
@@ -230,7 +246,7 @@ class SocketBindFunction : public SocketAsyncApiFunction {
 
   // AsyncApiFunction:
   bool Prepare() override;
-  void Work() override;
+  void AsyncWorkStart() override;
 
  private:
   int socket_id_;
@@ -249,7 +265,7 @@ class SocketListenFunction : public SocketAsyncApiFunction {
 
   // AsyncApiFunction:
   bool Prepare() override;
-  void Work() override;
+  void AsyncWorkStart() override;
 
  private:
   scoped_ptr<core_api::socket::Listen::Params> params_;