Home | History | Annotate | Download | only in ipc 
      1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "ipc/ipc_message_attachment_set.h"
      6 
      7 #include <stddef.h>
      8 
      9 #include <algorithm>
     10 
     11 #include "base/logging.h"
     12 #include "base/posix/eintr_wrapper.h"
     13 #include "build/build_config.h"
     14 #include "ipc/ipc_message_attachment.h"
     15 
     16 namespace IPC {
     17 
     18 namespace {
     19 
     20 unsigned count_attachments_of_type(
     21     const std::vector<scoped_refptr<MessageAttachment>>& attachments,
     22     MessageAttachment::Type type) {
     23   unsigned count = 0;
     24   for (const scoped_refptr<MessageAttachment>& attachment : attachments) {
     25     if (attachment->GetType() == type)
     26       ++count;
     27   }
     28   return count;
     29 }
     30 
     31 }  // namespace
     32 
     33 MessageAttachmentSet::MessageAttachmentSet()
     34     : consumed_descriptor_highwater_(0) {
     35 }
     36 
     37 MessageAttachmentSet::~MessageAttachmentSet() {
     38   if (consumed_descriptor_highwater_ == size())
     39     return;
     40 
     41   // We close all the owning descriptors. If this message should have
     42   // been transmitted, then closing those with close flags set mirrors
     43   // the expected behaviour.
     44   //
     45   // If this message was received with more descriptors than expected
     46   // (which could a DOS against the browser by a rogue renderer) then all
     47   // the descriptors have their close flag set and we free all the extra
     48   // kernel resources.
     49   LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed attachments: "
     50                << consumed_descriptor_highwater_ << "/" << size();
     51 }
     52 
     53 unsigned MessageAttachmentSet::num_descriptors() const {
     54   return count_attachments_of_type(attachments_,
     55                                    MessageAttachment::Type::PLATFORM_FILE);
     56 }
     57 
     58 unsigned MessageAttachmentSet::size() const {
     59   return static_cast<unsigned>(attachments_.size());
     60 }
     61 
     62 bool MessageAttachmentSet::AddAttachment(
     63     scoped_refptr<MessageAttachment> attachment,
     64     size_t* index) {
     65 #if defined(OS_POSIX)
     66   if (attachment->GetType() == MessageAttachment::Type::PLATFORM_FILE &&
     67       num_descriptors() == kMaxDescriptorsPerMessage) {
     68     DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
     69     return false;
     70   }
     71 #endif
     72 
     73   switch (attachment->GetType()) {
     74     case MessageAttachment::Type::PLATFORM_FILE:
     75     case MessageAttachment::Type::MOJO_HANDLE:
     76     case MessageAttachment::Type::WIN_HANDLE:
     77     case MessageAttachment::Type::MACH_PORT:
     78       attachments_.push_back(attachment);
     79       *index = attachments_.size() - 1;
     80       return true;
     81   }
     82   return false;
     83 }
     84 
     85 bool MessageAttachmentSet::AddAttachment(
     86     scoped_refptr<MessageAttachment> attachment) {
     87   size_t index;
     88   return AddAttachment(attachment, &index);
     89 }
     90 
     91 scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt(
     92     unsigned index) {
     93   if (index >= size()) {
     94     DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
     95     return scoped_refptr<MessageAttachment>();
     96   }
     97 
     98   // We should always walk the descriptors in order, so it's reasonable to
     99   // enforce this. Consider the case where a compromised renderer sends us
    100   // the following message:
    101   //
    102   //   ExampleMsg:
    103   //     num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
    104   //
    105   // Here the renderer sent us a message which should have a descriptor, but
    106   // actually sent two in an attempt to fill our fd table and kill us. By
    107   // setting the index of the descriptor in the message to 1 (it should be
    108   // 0), we would record a highwater of 1 and then consider all the
    109   // descriptors to have been used.
    110   //
    111   // So we can either track of the use of each descriptor in a bitset, or we
    112   // can enforce that we walk the indexes strictly in order.
    113   //
    114   // There's one more wrinkle: When logging messages, we may reparse them. So
    115   // we have an exception: When the consumed_descriptor_highwater_ is at the
    116   // end of the array and index 0 is requested, we reset the highwater value.
    117   // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
    118   // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
    119   if (index == 0 && consumed_descriptor_highwater_ == size()) {
    120     consumed_descriptor_highwater_ = 0;
    121   }
    122 
    123   if (index != consumed_descriptor_highwater_)
    124     return scoped_refptr<MessageAttachment>();
    125 
    126   consumed_descriptor_highwater_ = index + 1;
    127 
    128   return attachments_[index];
    129 }
    130 
    131 void MessageAttachmentSet::CommitAllDescriptors() {
    132   attachments_.clear();
    133   consumed_descriptor_highwater_ = 0;
    134 }
    135 
    136 }  // namespace IPC
    137