Verified Commit 8bc39ef1 authored by valenting's avatar valenting Committed by ma1
Browse files

Bug 2043200 - Bind RedirectChannelRegistrar ids to their destination content process a=dmeehan 

Original Revision: https://phabricator.services.mozilla.com/D309039

Differential Revision: https://phabricator.services.mozilla.com/D311188
parent b92df16f

docshell/base/nsDocShell.cpp

+3 −1
Original line number Diff line number Diff line
@@ -11003,7 +11003,9 @@ nsresult nsDocShell::OpenRedirectedChannel(nsDocShellLoadState* aLoadState) { 
    // it under the provided identifier.

    RefPtr<ParentChannelWrapper> wrapper =

        new ParentChannelWrapper(channel, loader);

    wrapper->Register(aLoadState->GetPendingRedirectChannelRegistrarId());

    // We're in the parent process, so the redirect is owned by the parent

    // process (ContentParentId 0).

    wrapper->Register(aLoadState->GetPendingRedirectChannelRegistrarId(), 0);



    mLoadGroup->AddRequest(channel, nullptr);

  } else if (nsCOMPtr<nsIChildChannel> childChannel =

dom/ipc/ContentParent.cpp

+4 −2
Original line number Diff line number Diff line
@@ -4657,14 +4657,16 @@ mozilla::ipc::IPCResult ContentParent::RecvExtProtocolChannelConnectParent( 


  // First get the real channel created before redirect on the parent.

  nsCOMPtr<nsIChannel> channel;

  rv = NS_LinkRedirectChannels(registrarId, nullptr, getter_AddRefs(channel));

  rv = NS_LinkRedirectChannels(registrarId, ChildID(), nullptr,

                               getter_AddRefs(channel));

  NS_ENSURE_SUCCESS(rv, IPC_OK());



  nsCOMPtr<nsIParentChannel> parent = do_QueryInterface(channel, &rv);

  NS_ENSURE_SUCCESS(rv, IPC_OK());



  // The channel itself is its own (faked) parent, link it.

  rv = NS_LinkRedirectChannels(registrarId, parent, getter_AddRefs(channel));

  rv = NS_LinkRedirectChannels(registrarId, ChildID(), parent,

                               getter_AddRefs(channel));

  NS_ENSURE_SUCCESS(rv, IPC_OK());



  // Signal the parent channel that it's a redirect-to parent.  This will

netwerk/base/RedirectChannelRegistrar.cpp

+14 −2
Original line number Diff line number Diff line
@@ -34,10 +34,12 @@ RedirectChannelRegistrar::GetOrCreate() { 
}



NS_IMETHODIMP

RedirectChannelRegistrar::RegisterChannel(nsIChannel* channel, uint64_t id) {

RedirectChannelRegistrar::RegisterChannel(nsIChannel* channel, uint64_t id,

                                          uint64_t aContentParentId) {

  MutexAutoLock lock(mLock);



  mRealChannels.InsertOrUpdate(id, channel);

  mChannelOwners.InsertOrUpdate(id, aContentParentId);



  return NS_OK;

}
@@ -53,10 +55,19 @@ RedirectChannelRegistrar::GetRegisteredChannel(uint64_t id, 
}



NS_IMETHODIMP

RedirectChannelRegistrar::LinkChannels(uint64_t id, nsIParentChannel* channel,

RedirectChannelRegistrar::LinkChannels(uint64_t id, uint64_t aContentParentId,

                                       nsIParentChannel* channel,

                                       nsIChannel** _retval) {

  MutexAutoLock lock(mLock);



  // Only hand back the registered channel if it was registered for the

  // requesting content process, since the id is supplied by the content

  // process.

  uint64_t owner;

  if (!mChannelOwners.Get(id, &owner) || owner != aContentParentId) {

    return NS_ERROR_NOT_AVAILABLE;

  }



  if (!mRealChannels.Get(id, _retval)) return NS_ERROR_NOT_AVAILABLE;



  mParentChannels.InsertOrUpdate(id, channel);
@@ -79,6 +90,7 @@ RedirectChannelRegistrar::DeregisterChannels(uint64_t id) { 


  mRealChannels.Remove(id);

  mParentChannels.Remove(id);

  mChannelOwners.Remove(id);

  return NS_OK;

}

netwerk/base/RedirectChannelRegistrar.h

+7 −0
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include "nsIParentChannel.h"

#include "nsInterfaceHashtable.h"

#include "mozilla/Attributes.h"

#include "nsTHashMap.h"

#include "mozilla/Mutex.h"



namespace mozilla {
@@ -36,6 +37,12 @@ class RedirectChannelRegistrar final : public nsIRedirectChannelRegistrar { 


  ChannelHashtable mRealChannels;

  ParentChannelHashtable mParentChannels;

  // Maps a registered channel id to the ContentParentId (as a raw uint64_t,

  // 0 for the parent process) of the process the redirect is destined for.

  // linkChannels refuses to pair a real channel with a parent actor coming

  // from any other process.

  nsTHashMap<nsUint64HashKey, uint64_t> mChannelOwners;



  Mutex mLock MOZ_UNANNOTATED;



  static StaticRefPtr<RedirectChannelRegistrar> gSingleton;

netwerk/base/SimpleChannelParent.cpp

+4 −1
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 


#include "SimpleChannelParent.h"

#include "mozilla/Assertions.h"

#include "mozilla/dom/ContentParent.h"

#include "nsNetUtil.h"

#include "nsIChannel.h"
@@ -23,8 +24,10 @@ NS_IMPL_ISUPPORTS(SimpleChannelParent, nsIParentChannel, nsIStreamListener) 
bool SimpleChannelParent::Init(const uint64_t& aChannelId) {

  nsCOMPtr<nsIChannel> channel;



  dom::ContentParentId cpId =

      static_cast<dom::ContentParent*>(Manager()->Manager())->ChildID();

  MOZ_ALWAYS_SUCCEEDS_FUZZING(

      NS_LinkRedirectChannels(aChannelId, this, getter_AddRefs(channel)));

      NS_LinkRedirectChannels(aChannelId, cpId, this, getter_AddRefs(channel)));



  return true;

}