broker_simple_message.cc 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/linux/syscall_broker/broker_simple_message.h"
  5. #include <errno.h>
  6. #include <string.h>
  7. #include <sys/socket.h>
  8. #include <unistd.h>
  9. #include "base/check_op.h"
  10. #include "base/containers/span.h"
  11. #include "base/files/scoped_file.h"
  12. #include "base/notreached.h"
  13. #include "base/numerics/safe_math.h"
  14. #include "base/posix/eintr_wrapper.h"
  15. #include "base/posix/unix_domain_socket.h"
  16. #include "base/process/process_handle.h"
  17. #include "build/build_config.h"
  18. namespace sandbox {
  19. namespace syscall_broker {
  20. ssize_t BrokerSimpleMessage::SendRecvMsgWithFlags(int fd,
  21. int recvmsg_flags,
  22. base::ScopedFD* result_fd,
  23. BrokerSimpleMessage* reply) {
  24. return SendRecvMsgWithFlagsMultipleFds(fd, recvmsg_flags, {}, {result_fd, 1},
  25. reply);
  26. }
  27. ssize_t BrokerSimpleMessage::SendRecvMsgWithFlagsMultipleFds(
  28. int fd,
  29. int recvmsg_flags,
  30. base::span<const int> send_fds,
  31. base::span<base::ScopedFD> result_fds,
  32. BrokerSimpleMessage* reply) {
  33. RAW_CHECK(reply);
  34. RAW_CHECK(send_fds.size() + 1 <= base::UnixDomainSocket::kMaxFileDescriptors);
  35. // This socketpair is only used for the IPC and is cleaned up before
  36. // returning.
  37. base::ScopedFD recv_sock;
  38. base::ScopedFD send_sock;
  39. if (!base::CreateSocketPair(&recv_sock, &send_sock))
  40. return -1;
  41. int send_fds_with_reply_socket[base::UnixDomainSocket::kMaxFileDescriptors];
  42. send_fds_with_reply_socket[0] = send_sock.get();
  43. for (size_t i = 0; i < send_fds.size(); i++) {
  44. send_fds_with_reply_socket[i + 1] = send_fds[i];
  45. }
  46. if (!SendMsgMultipleFds(fd,
  47. {send_fds_with_reply_socket, send_fds.size() + 1})) {
  48. return -1;
  49. }
  50. // Close the sending end of the socket right away so that if our peer closes
  51. // it before sending a response (e.g., from exiting), RecvMsgWithFlags() will
  52. // return EOF instead of hanging.
  53. send_sock.reset();
  54. const ssize_t reply_len = reply->RecvMsgWithFlagsMultipleFds(
  55. recv_sock.get(), recvmsg_flags, result_fds);
  56. recv_sock.reset();
  57. if (reply_len == -1)
  58. return -1;
  59. return reply_len;
  60. }
  61. bool BrokerSimpleMessage::SendMsg(int fd, int send_fd) {
  62. return SendMsgMultipleFds(
  63. fd, send_fd == -1 ? base::span<int>() : base::span<int>(&send_fd, 1));
  64. }
  65. bool BrokerSimpleMessage::SendMsgMultipleFds(int fd,
  66. base::span<const int> send_fds) {
  67. if (broken_)
  68. return false;
  69. RAW_CHECK(send_fds.size() <= base::UnixDomainSocket::kMaxFileDescriptors);
  70. struct msghdr msg = {};
  71. const void* buf = reinterpret_cast<const void*>(message_);
  72. struct iovec iov = {const_cast<void*>(buf), length_};
  73. msg.msg_iov = &iov;
  74. msg.msg_iovlen = 1;
  75. const unsigned control_len = CMSG_SPACE(send_fds.size() * sizeof(int));
  76. char control_buffer[control_len];
  77. if (send_fds.size() >= 1) {
  78. struct cmsghdr* cmsg;
  79. msg.msg_control = control_buffer;
  80. msg.msg_controllen = control_len;
  81. cmsg = CMSG_FIRSTHDR(&msg);
  82. cmsg->cmsg_level = SOL_SOCKET;
  83. cmsg->cmsg_type = SCM_RIGHTS;
  84. int len = 0;
  85. for (size_t i = 0; i < send_fds.size(); i++) {
  86. if (send_fds[i] < 0)
  87. return false;
  88. // CMSG_DATA() not guaranteed to be aligned so this must use memcpy.
  89. memcpy(CMSG_DATA(cmsg) + (sizeof(int) * i), &send_fds[i], sizeof(int));
  90. len += sizeof(int);
  91. }
  92. cmsg->cmsg_len = CMSG_LEN(len);
  93. msg.msg_controllen = cmsg->cmsg_len;
  94. }
  95. // Avoid a SIGPIPE if the other end breaks the connection.
  96. // Due to a bug in the Linux kernel (net/unix/af_unix.c) MSG_NOSIGNAL isn't
  97. // regarded for SOCK_SEQPACKET in the AF_UNIX domain, but it is mandated by
  98. // POSIX.
  99. const int flags = MSG_NOSIGNAL;
  100. const ssize_t r = HANDLE_EINTR(sendmsg(fd, &msg, flags));
  101. return static_cast<ssize_t>(length_) == r;
  102. }
  103. ssize_t BrokerSimpleMessage::RecvMsgWithFlags(int fd,
  104. int flags,
  105. base::ScopedFD* return_fd) {
  106. ssize_t ret = RecvMsgWithFlagsMultipleFds(
  107. fd, flags, base::span<base::ScopedFD>(return_fd, 1));
  108. return ret;
  109. }
  110. ssize_t BrokerSimpleMessage::RecvMsgWithFlagsMultipleFds(
  111. int fd,
  112. int flags,
  113. base::span<base::ScopedFD> return_fds) {
  114. // The message must be fresh and unused.
  115. RAW_CHECK(!read_only_ && !write_only_);
  116. RAW_CHECK(return_fds.size() <= base::UnixDomainSocket::kMaxFileDescriptors);
  117. read_only_ = true; // The message should not be written to again.
  118. struct msghdr msg = {};
  119. struct iovec iov = {message_, kMaxMessageLength};
  120. msg.msg_iov = &iov;
  121. msg.msg_iovlen = 1;
  122. const size_t kControlBufferSize =
  123. CMSG_SPACE(sizeof(fd) * base::UnixDomainSocket::kMaxFileDescriptors) +
  124. CMSG_SPACE(sizeof(struct ucred));
  125. char control_buffer[kControlBufferSize];
  126. msg.msg_control = control_buffer;
  127. msg.msg_controllen = sizeof(control_buffer);
  128. const ssize_t r = HANDLE_EINTR(recvmsg(fd, &msg, flags));
  129. if (r == -1)
  130. return -1;
  131. int* wire_fds = nullptr;
  132. size_t wire_fds_len = 0;
  133. base::ProcessId pid = -1;
  134. if (msg.msg_controllen > 0) {
  135. struct cmsghdr* cmsg;
  136. for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
  137. const size_t payload_len = cmsg->cmsg_len - CMSG_LEN(0);
  138. if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
  139. DCHECK_EQ(payload_len % sizeof(fd), 0u);
  140. DCHECK_EQ(wire_fds, nullptr);
  141. wire_fds = reinterpret_cast<int*>(CMSG_DATA(cmsg));
  142. wire_fds_len = payload_len / sizeof(fd);
  143. }
  144. if (cmsg->cmsg_level == SOL_SOCKET &&
  145. cmsg->cmsg_type == SCM_CREDENTIALS) {
  146. DCHECK_EQ(payload_len, sizeof(struct ucred));
  147. DCHECK_EQ(pid, -1);
  148. pid = reinterpret_cast<struct ucred*>(CMSG_DATA(cmsg))->pid;
  149. }
  150. }
  151. }
  152. if (msg.msg_flags & MSG_TRUNC || msg.msg_flags & MSG_CTRUNC) {
  153. for (size_t i = 0; i < wire_fds_len; ++i) {
  154. close(wire_fds[i]);
  155. }
  156. errno = EMSGSIZE;
  157. return -1;
  158. }
  159. if (wire_fds) {
  160. if (wire_fds_len > return_fds.size()) {
  161. // The number of fds received is limited to return_fds.size(). If there
  162. // are more in the message than expected, close them and return an error.
  163. for (size_t i = 0; i < wire_fds_len; ++i) {
  164. close(wire_fds[i]);
  165. }
  166. errno = EMSGSIZE;
  167. NOTREACHED();
  168. return -1;
  169. }
  170. for (size_t i = 0; i < wire_fds_len; ++i) {
  171. return_fds[i] = base::ScopedFD(wire_fds[i]);
  172. }
  173. }
  174. // At this point, |r| is guaranteed to be >= 0.
  175. length_ = static_cast<size_t>(r);
  176. return r;
  177. }
  178. bool BrokerSimpleMessage::AddStringToMessage(const char* string) {
  179. // strlen() + 1 to always include the '\0' terminating character.
  180. return AddDataToMessage(string, strlen(string) + 1);
  181. }
  182. bool BrokerSimpleMessage::AddDataToMessage(const char* data, size_t length) {
  183. if (read_only_ || broken_)
  184. return false;
  185. write_only_ = true; // Message should only be written to going forward.
  186. base::CheckedNumeric<size_t> safe_length(length);
  187. safe_length += length_;
  188. safe_length += sizeof(EntryType);
  189. safe_length += sizeof(length);
  190. if (safe_length.ValueOrDie() > kMaxMessageLength) {
  191. broken_ = true;
  192. return false;
  193. }
  194. EntryType type = EntryType::DATA;
  195. // Write the type to the message
  196. memcpy(write_next_, &type, sizeof(EntryType));
  197. write_next_ += sizeof(EntryType);
  198. // Write the length of the buffer to the message
  199. memcpy(write_next_, &length, sizeof(length));
  200. write_next_ += sizeof(length);
  201. // Write the data in the buffer to the message
  202. memcpy(write_next_, data, length);
  203. write_next_ += length;
  204. length_ = write_next_ - message_;
  205. return true;
  206. }
  207. bool BrokerSimpleMessage::AddIntToMessage(int data) {
  208. if (read_only_ || broken_)
  209. return false;
  210. write_only_ = true; // Message should only be written to going forward.
  211. base::CheckedNumeric<size_t> safe_length(length_);
  212. safe_length += sizeof(data);
  213. safe_length += sizeof(EntryType);
  214. if (!safe_length.IsValid() || safe_length.ValueOrDie() > kMaxMessageLength) {
  215. broken_ = true;
  216. return false;
  217. }
  218. EntryType type = EntryType::INT;
  219. memcpy(write_next_, &type, sizeof(EntryType));
  220. write_next_ += sizeof(EntryType);
  221. memcpy(write_next_, &data, sizeof(data));
  222. write_next_ += sizeof(data);
  223. length_ = write_next_ - message_;
  224. return true;
  225. }
  226. bool BrokerSimpleMessage::ReadString(const char** data) {
  227. size_t str_len;
  228. bool result = ReadData(data, &str_len);
  229. return result && (*data)[str_len - 1] == '\0';
  230. }
  231. bool BrokerSimpleMessage::ReadData(const char** data, size_t* length) {
  232. if (write_only_ || broken_)
  233. return false;
  234. read_only_ = true; // Message should not be written to.
  235. if (read_next_ > (message_ + length_)) {
  236. broken_ = true;
  237. return false;
  238. }
  239. if (!ValidateType(EntryType::DATA)) {
  240. broken_ = true;
  241. return false;
  242. }
  243. // Get the length of the data buffer from the message.
  244. if ((read_next_ + sizeof(size_t)) > (message_ + length_)) {
  245. broken_ = true;
  246. return false;
  247. }
  248. memcpy(length, read_next_, sizeof(size_t));
  249. read_next_ = read_next_ + sizeof(size_t);
  250. // Get the raw data buffer from the message.
  251. if ((read_next_ + *length) > (message_ + length_)) {
  252. broken_ = true;
  253. return false;
  254. }
  255. *data = reinterpret_cast<char*>(read_next_.get());
  256. read_next_ = read_next_ + *length;
  257. return true;
  258. }
  259. bool BrokerSimpleMessage::ReadInt(int* result) {
  260. if (write_only_ || broken_)
  261. return false;
  262. read_only_ = true; // Message should not be written to.
  263. if (read_next_ > (message_ + length_)) {
  264. broken_ = true;
  265. return false;
  266. }
  267. if (!ValidateType(EntryType::INT)) {
  268. broken_ = true;
  269. return false;
  270. }
  271. if ((read_next_ + sizeof(*result)) > (message_ + length_)) {
  272. broken_ = true;
  273. return false;
  274. }
  275. memcpy(result, read_next_, sizeof(*result));
  276. read_next_ = read_next_ + sizeof(*result);
  277. return true;
  278. }
  279. bool BrokerSimpleMessage::ValidateType(EntryType expected_type) {
  280. if ((read_next_ + sizeof(EntryType)) > (message_ + length_))
  281. return false;
  282. EntryType type;
  283. memcpy(&type, read_next_, sizeof(EntryType));
  284. if (type != expected_type)
  285. return false;
  286. read_next_ = read_next_ + sizeof(EntryType);
  287. return true;
  288. }
  289. } // namespace syscall_broker
  290. } // namespace sandbox