/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

/* vim: set ts=8 sts=2 et sw=2 tw=80: */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "FileDescriptorShuffle.h"

#include "base/eintr_wrapper.h"

#include "mozilla/Assertions.h"

#include "mozilla/DebugOnly.h"

#include <algorithm>

#include <unistd.h>

#include <fcntl.h>

namespace mozilla {

namespace ipc {

// F_DUPFD_CLOEXEC is like F_DUPFD (see below) but atomically makes

// the new fd close-on-exec.  This is useful to prevent accidental fd

// leaks into processes created by plain fork/exec, but IPC uses

// CloseSuperfluousFds so it's not essential.

//

// F_DUPFD_CLOEXEC is in POSIX 2008, but as of 2018 there are still

// some OSes that don't support it.  (Specifically: Solaris 10 doesn't

// have it, and Android should have kernel support but doesn't define

// the constant until API 21 (Lollipop).  We also don't use this for

// IPC child launching on Android, so there's no point in hard-coding

// the definitions like we do for Android in some other cases.)

#ifdef F_DUPFD_CLOEXEC

static const int kDupFdCmd = F_DUPFD_CLOEXEC;

#else

static const int kDupFdCmd = F_DUPFD;

#endif

// This implementation ensures that the *ranges* of the source and

// destination fds don't overlap, which is unnecessary but sufficient

// to avoid conflicts or identity mappings.

//

// In practice, the source fds will usually be large and the

// destination fds will all be relatively small, so there mostly won't

// be temporary fds.  This approach has the advantage of being simple

// (and linear-time, but hopefully there aren't enough fds for that to

// matter).

bool

FileDescriptorShuffle::Init(MappingRef aMapping)

{

  MOZ_ASSERT(mMapping.IsEmpty());

  // Find the maximum destination fd; any source fds not greater than

  // this will be duplicated.

  int maxDst = STDERR_FILENO;

  for (const auto& elem : aMapping) {

    maxDst = std::max(maxDst, elem.second);

  }

  mMaxDst = maxDst;

#ifdef DEBUG

  // Increase the limit to make sure the F_DUPFD case gets test coverage.

  if (!aMapping.IsEmpty()) {

    // Try to find a value that will create a nontrivial partition.

    int fd0 = aMapping[0].first;

    int fdn = aMapping.rbegin()->first;

    maxDst = std::max(maxDst, (fd0 + fdn) / 2);

  }

#endif

  for (const auto& elem : aMapping) {

    int src = elem.first;

    // F_DUPFD is like dup() but allows placing a lower bound

    // on the new fd, which is exactly what we want.

    if (src <= maxDst) {

      src = fcntl(src, kDupFdCmd, maxDst + 1);

      if (src < 0) {

        return false;

      }

      mTempFds.AppendElement(src);

    }

    MOZ_ASSERT(src > maxDst);

#ifdef DEBUG

    // Check for accidentally mapping two different fds to the same

    // destination.  (This is O(n^2) time, but it shouldn't matter.)

    for (const auto& otherElem : mMapping) {

      MOZ_ASSERT(elem.second != otherElem.second);

    }

#endif

    mMapping.AppendElement(std::make_pair(src, elem.second));

  }

  return true;

}

bool

FileDescriptorShuffle::MapsTo(int aFd) const

{

  // Prune fds that are too large to be a destination, rather than

  // searching; this should be the common case.

  if (aFd > mMaxDst) {

    return false;

  }

  for (const auto& elem : mMapping) {

    if (elem.second == aFd) {

      return true;

    }

  }

  return false;

}

FileDescriptorShuffle::~FileDescriptorShuffle()

{

  for (const auto& fd : mTempFds) {

    mozilla::DebugOnly<int> rv = IGNORE_EINTR(close(fd));

    MOZ_ASSERT(rv == 0);

  }

}

} // namespace ipc

} // namespace mozilla