Initial import.

1 files changed, 1028 insertions, 0 deletions

diff --git a/chromium/ipc/ipc_channel_posix.cc b/chromium/ipc/ipc_channel_posix.cc
new file mode 100644
index 00000000000..98a7cd8a9fa
--- /dev/null
+++ b/chromium/ipc/ipc_channel_posix.cc
@@ -0,0 +1,1028 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ipc/ipc_channel_posix.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stddef.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+#if defined(OS_OPENBSD)
+#include <sys/uio.h>
+#endif
+
+#include <map>
+#include <string>
+
+#include "base/command_line.h"
+#include "base/file_util.h"
+#include "base/files/file_path.h"
+#include "base/location.h"
+#include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/memory/singleton.h"
+#include "base/posix/eintr_wrapper.h"
+#include "base/posix/global_descriptors.h"
+#include "base/process/process_handle.h"
+#include "base/rand_util.h"
+#include "base/stl_util.h"
+#include "base/strings/string_util.h"
+#include "base/synchronization/lock.h"
+#include "ipc/file_descriptor_set_posix.h"
+#include "ipc/ipc_descriptors.h"
+#include "ipc/ipc_listener.h"
+#include "ipc/ipc_logging.h"
+#include "ipc/ipc_message_utils.h"
+#include "ipc/ipc_switches.h"
+#include "ipc/unix_domain_socket_util.h"
+
+namespace IPC {
+
+// IPC channels on Windows use named pipes (CreateNamedPipe()) with
+// channel ids as the pipe names.  Channels on POSIX use sockets as
+// pipes  These don't quite line up.
+//
+// When creating a child subprocess we use a socket pair and the parent side of
+// the fork arranges it such that the initial control channel ends up on the
+// magic file descriptor kPrimaryIPCChannel in the child.  Future
+// connections (file descriptors) can then be passed via that
+// connection via sendmsg().
+//
+// A POSIX IPC channel can also be set up as a server for a bound UNIX domain
+// socket, and will handle multiple connect and disconnect sequences.  Currently
+// it is limited to one connection at a time.
+
+//------------------------------------------------------------------------------
+namespace {
+
+// The PipeMap class works around this quirk related to unit tests:
+//
+// When running as a server, we install the client socket in a
+// specific file descriptor number (@kPrimaryIPCChannel). However, we
+// also have to support the case where we are running unittests in the
+// same process.  (We do not support forking without execing.)
+//
+// Case 1: normal running
+//   The IPC server object will install a mapping in PipeMap from the
+//   name which it was given to the client pipe. When forking the client, the
+//   GetClientFileDescriptorMapping will ensure that the socket is installed in
+//   the magic slot (@kPrimaryIPCChannel). The client will search for the
+//   mapping, but it won't find any since we are in a new process. Thus the
+//   magic fd number is returned. Once the client connects, the server will
+//   close its copy of the client socket and remove the mapping.
+//
+// Case 2: unittests - client and server in the same process
+//   The IPC server will install a mapping as before. The client will search
+//   for a mapping and find out. It duplicates the file descriptor and
+//   connects. Once the client connects, the server will close the original
+//   copy of the client socket and remove the mapping. Thus, when the client
+//   object closes, it will close the only remaining copy of the client socket
+//   in the fd table and the server will see EOF on its side.
+//
+// TODO(port): a client process cannot connect to multiple IPC channels with
+// this scheme.
+
+class PipeMap {
+ public:
+  static PipeMap* GetInstance() {
+    return Singleton<PipeMap>::get();
+  }
+
+  ~PipeMap() {
+    // Shouldn't have left over pipes.
+    DCHECK(map_.empty());
+  }
+
+  // Lookup a given channel id. Return -1 if not found.
+  int Lookup(const std::string& channel_id) {
+    base::AutoLock locked(lock_);
+
+    ChannelToFDMap::const_iterator i = map_.find(channel_id);
+    if (i == map_.end())
+      return -1;
+    return i->second;
+  }
+
+  // Remove the mapping for the given channel id. No error is signaled if the
+  // channel_id doesn't exist
+  void Remove(const std::string& channel_id) {
+    base::AutoLock locked(lock_);
+    map_.erase(channel_id);
+  }
+
+  // Insert a mapping from @channel_id to @fd. It's a fatal error to insert a
+  // mapping if one already exists for the given channel_id
+  void Insert(const std::string& channel_id, int fd) {
+    base::AutoLock locked(lock_);
+    DCHECK_NE(-1, fd);
+
+    ChannelToFDMap::const_iterator i = map_.find(channel_id);
+    CHECK(i == map_.end()) << "Creating second IPC server (fd " << fd << ") "
+                           << "for '" << channel_id << "' while first "
+                           << "(fd " << i->second << ") still exists";
+    map_[channel_id] = fd;
+  }
+
+ private:
+  base::Lock lock_;
+  typedef std::map<std::string, int> ChannelToFDMap;
+  ChannelToFDMap map_;
+
+  friend struct DefaultSingletonTraits<PipeMap>;
+};
+
+//------------------------------------------------------------------------------
+
+bool SocketWriteErrorIsRecoverable() {
+#if defined(OS_MACOSX)
+  // On OS X if sendmsg() is trying to send fds between processes and there
+  // isn't enough room in the output buffer to send the fd structure over
+  // atomically then EMSGSIZE is returned.
+  //
+  // EMSGSIZE presents a problem since the system APIs can only call us when
+  // there's room in the socket buffer and not when there is "enough" room.
+  //
+  // The current behavior is to return to the event loop when EMSGSIZE is
+  // received and hopefull service another FD.  This is however still
+  // technically a busy wait since the event loop will call us right back until
+  // the receiver has read enough data to allow passing the FD over atomically.
+  return errno == EAGAIN || errno == EMSGSIZE;
+#else
+  return errno == EAGAIN;
+#endif  // OS_MACOSX
+}
+
+}  // namespace
+//------------------------------------------------------------------------------
+
+#if defined(OS_LINUX)
+int Channel::ChannelImpl::global_pid_ = 0;
+#endif  // OS_LINUX
+
+Channel::ChannelImpl::ChannelImpl(const IPC::ChannelHandle& channel_handle,
+                                  Mode mode, Listener* listener)
+    : ChannelReader(listener),
+      mode_(mode),
+      peer_pid_(base::kNullProcessId),
+      is_blocked_on_write_(false),
+      waiting_connect_(true),
+      message_send_bytes_written_(0),
+      server_listen_pipe_(-1),
+      pipe_(-1),
+      client_pipe_(-1),
+#if defined(IPC_USES_READWRITE)
+      fd_pipe_(-1),
+      remote_fd_pipe_(-1),
+#endif  // IPC_USES_READWRITE
+      pipe_name_(channel_handle.name),
+      must_unlink_(false) {
+  memset(input_cmsg_buf_, 0, sizeof(input_cmsg_buf_));
+  if (!CreatePipe(channel_handle)) {
+    // The pipe may have been closed already.
+    const char *modestr = (mode_ & MODE_SERVER_FLAG) ? "server" : "client";
+    LOG(WARNING) << "Unable to create pipe named \"" << channel_handle.name
+                 << "\" in " << modestr << " mode";
+  }
+}
+
+Channel::ChannelImpl::~ChannelImpl() {
+  Close();
+}
+
+bool SocketPair(int* fd1, int* fd2) {
+  int pipe_fds[2];
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, pipe_fds) != 0) {
+    PLOG(ERROR) << "socketpair()";
+    return false;
+  }
+
+  // Set both ends to be non-blocking.
+  if (fcntl(pipe_fds[0], F_SETFL, O_NONBLOCK) == -1 ||
+      fcntl(pipe_fds[1], F_SETFL, O_NONBLOCK) == -1) {
+    PLOG(ERROR) << "fcntl(O_NONBLOCK)";
+    if (HANDLE_EINTR(close(pipe_fds[0])) < 0)
+      PLOG(ERROR) << "close";
+    if (HANDLE_EINTR(close(pipe_fds[1])) < 0)
+      PLOG(ERROR) << "close";
+    return false;
+  }
+
+  *fd1 = pipe_fds[0];
+  *fd2 = pipe_fds[1];
+
+  return true;
+}
+
+bool Channel::ChannelImpl::CreatePipe(
+    const IPC::ChannelHandle& channel_handle) {
+  DCHECK(server_listen_pipe_ == -1 && pipe_ == -1);
+
+  // Four possible cases:
+  // 1) It's a channel wrapping a pipe that is given to us.
+  // 2) It's for a named channel, so we create it.
+  // 3) It's for a client that we implement ourself. This is used
+  //    in unittesting.
+  // 4) It's the initial IPC channel:
+  //   4a) Client side: Pull the pipe out of the GlobalDescriptors set.
+  //   4b) Server side: create the pipe.
+
+  int local_pipe = -1;
+  if (channel_handle.socket.fd != -1) {
+    // Case 1 from comment above.
+    local_pipe = channel_handle.socket.fd;
+#if defined(IPC_USES_READWRITE)
+    // Test the socket passed into us to make sure it is nonblocking.
+    // We don't want to call read/write on a blocking socket.
+    int value = fcntl(local_pipe, F_GETFL);
+    if (value == -1) {
+      PLOG(ERROR) << "fcntl(F_GETFL) " << pipe_name_;
+      return false;
+    }
+    if (!(value & O_NONBLOCK)) {
+      LOG(ERROR) << "Socket " << pipe_name_ << " must be O_NONBLOCK";
+      return false;
+    }
+#endif   // IPC_USES_READWRITE
+  } else if (mode_ & MODE_NAMED_FLAG) {
+    // Case 2 from comment above.
+    if (mode_ & MODE_SERVER_FLAG) {
+      if (!CreateServerUnixDomainSocket(base::FilePath(pipe_name_),
+                                        &local_pipe)) {
+        return false;
+      }
+      must_unlink_ = true;
+    } else if (mode_ & MODE_CLIENT_FLAG) {
+      if (!CreateClientUnixDomainSocket(base::FilePath(pipe_name_),
+                                        &local_pipe)) {
+        return false;
+      }
+    } else {
+      LOG(ERROR) << "Bad mode: " << mode_;
+      return false;
+    }
+  } else {
+    local_pipe = PipeMap::GetInstance()->Lookup(pipe_name_);
+    if (mode_ & MODE_CLIENT_FLAG) {
+      if (local_pipe != -1) {
+        // Case 3 from comment above.
+        // We only allow one connection.
+        local_pipe = HANDLE_EINTR(dup(local_pipe));
+        PipeMap::GetInstance()->Remove(pipe_name_);
+      } else {
+        // Case 4a from comment above.
+        // Guard against inappropriate reuse of the initial IPC channel.  If
+        // an IPC channel closes and someone attempts to reuse it by name, the
+        // initial channel must not be recycled here.  http://crbug.com/26754.
+        static bool used_initial_channel = false;
+        if (used_initial_channel) {
+          LOG(FATAL) << "Denying attempt to reuse initial IPC channel for "
+                     << pipe_name_;
+          return false;
+        }
+        used_initial_channel = true;
+
+        local_pipe =
+            base::GlobalDescriptors::GetInstance()->Get(kPrimaryIPCChannel);
+      }
+    } else if (mode_ & MODE_SERVER_FLAG) {
+      // Case 4b from comment above.
+      if (local_pipe != -1) {
+        LOG(ERROR) << "Server already exists for " << pipe_name_;
+        return false;
+      }
+      base::AutoLock lock(client_pipe_lock_);
+      if (!SocketPair(&local_pipe, &client_pipe_))
+        return false;
+      PipeMap::GetInstance()->Insert(pipe_name_, client_pipe_);
+    } else {
+      LOG(ERROR) << "Bad mode: " << mode_;
+      return false;
+    }
+  }
+
+#if defined(IPC_USES_READWRITE)
+  // Create a dedicated socketpair() for exchanging file descriptors.
+  // See comments for IPC_USES_READWRITE for details.
+  if (mode_ & MODE_CLIENT_FLAG) {
+    if (!SocketPair(&fd_pipe_, &remote_fd_pipe_)) {
+      return false;
+    }
+  }
+#endif  // IPC_USES_READWRITE
+
+  if ((mode_ & MODE_SERVER_FLAG) && (mode_ & MODE_NAMED_FLAG)) {
+    server_listen_pipe_ = local_pipe;
+    local_pipe = -1;
+  }
+
+  pipe_ = local_pipe;
+  return true;
+}
+
+bool Channel::ChannelImpl::Connect() {
+  if (server_listen_pipe_ == -1 && pipe_ == -1) {
+    DLOG(INFO) << "Channel creation failed: " << pipe_name_;
+    return false;
+  }
+
+  bool did_connect = true;
+  if (server_listen_pipe_ != -1) {
+    // Watch the pipe for connections, and turn any connections into
+    // active sockets.
+    base::MessageLoopForIO::current()->WatchFileDescriptor(
+        server_listen_pipe_,
+        true,
+        base::MessageLoopForIO::WATCH_READ,
+        &server_listen_connection_watcher_,
+        this);
+  } else {
+    did_connect = AcceptConnection();
+  }
+  return did_connect;
+}
+
+bool Channel::ChannelImpl::ProcessOutgoingMessages() {
+  DCHECK(!waiting_connect_);  // Why are we trying to send messages if there's
+                              // no connection?
+  if (output_queue_.empty())
+    return true;
+
+  if (pipe_ == -1)
+    return false;
+
+  // Write out all the messages we can till the write blocks or there are no
+  // more outgoing messages.
+  while (!output_queue_.empty()) {
+    Message* msg = output_queue_.front();
+
+    size_t amt_to_write = msg->size() - message_send_bytes_written_;
+    DCHECK_NE(0U, amt_to_write);
+    const char* out_bytes = reinterpret_cast<const char*>(msg->data()) +
+        message_send_bytes_written_;
+
+    struct msghdr msgh = {0};
+    struct iovec iov = {const_cast<char*>(out_bytes), amt_to_write};
+    msgh.msg_iov = &iov;
+    msgh.msg_iovlen = 1;
+    char buf[CMSG_SPACE(
+        sizeof(int) * FileDescriptorSet::kMaxDescriptorsPerMessage)];
+
+    ssize_t bytes_written = 1;
+    int fd_written = -1;
+
+    if (message_send_bytes_written_ == 0 &&
+        !msg->file_descriptor_set()->empty()) {
+      // This is the first chunk of a message which has descriptors to send
+      struct cmsghdr *cmsg;
+      const unsigned num_fds = msg->file_descriptor_set()->size();
+
+      DCHECK(num_fds <= FileDescriptorSet::kMaxDescriptorsPerMessage);
+      if (msg->file_descriptor_set()->ContainsDirectoryDescriptor()) {
+        LOG(FATAL) << "Panic: attempting to transport directory descriptor over"
+                      " IPC. Aborting to maintain sandbox isolation.";
+        // If you have hit this then something tried to send a file descriptor
+        // to a directory over an IPC channel. Since IPC channels span
+        // sandboxes this is very bad: the receiving process can use openat
+        // with ".." elements in the path in order to reach the real
+        // filesystem.
+      }
+
+      msgh.msg_control = buf;
+      msgh.msg_controllen = CMSG_SPACE(sizeof(int) * num_fds);
+      cmsg = CMSG_FIRSTHDR(&msgh);
+      cmsg->cmsg_level = SOL_SOCKET;
+      cmsg->cmsg_type = SCM_RIGHTS;
+      cmsg->cmsg_len = CMSG_LEN(sizeof(int) * num_fds);
+      msg->file_descriptor_set()->GetDescriptors(
+          reinterpret_cast<int*>(CMSG_DATA(cmsg)));
+      msgh.msg_controllen = cmsg->cmsg_len;
+
+      // DCHECK_LE above already checks that
+      // num_fds < kMaxDescriptorsPerMessage so no danger of overflow.
+      msg->header()->num_fds = static_cast<uint16>(num_fds);
+
+#if defined(IPC_USES_READWRITE)
+      if (!IsHelloMessage(*msg)) {
+        // Only the Hello message sends the file descriptor with the message.
+        // Subsequently, we can send file descriptors on the dedicated
+        // fd_pipe_ which makes Seccomp sandbox operation more efficient.
+        struct iovec fd_pipe_iov = { const_cast<char *>(""), 1 };
+        msgh.msg_iov = &fd_pipe_iov;
+        fd_written = fd_pipe_;
+        bytes_written = HANDLE_EINTR(sendmsg(fd_pipe_, &msgh, MSG_DONTWAIT));
+        msgh.msg_iov = &iov;
+        msgh.msg_controllen = 0;
+        if (bytes_written > 0) {
+          msg->file_descriptor_set()->CommitAll();
+        }
+      }
+#endif  // IPC_USES_READWRITE
+    }
+
+    if (bytes_written == 1) {
+      fd_written = pipe_;
+#if defined(IPC_USES_READWRITE)
+      if ((mode_ & MODE_CLIENT_FLAG) && IsHelloMessage(*msg)) {
+        DCHECK_EQ(msg->file_descriptor_set()->size(), 1U);
+      }
+      if (!msgh.msg_controllen) {
+        bytes_written = HANDLE_EINTR(write(pipe_, out_bytes, amt_to_write));
+      } else
+#endif  // IPC_USES_READWRITE
+      {
+        bytes_written = HANDLE_EINTR(sendmsg(pipe_, &msgh, MSG_DONTWAIT));
+      }
+    }
+    if (bytes_written > 0)
+      msg->file_descriptor_set()->CommitAll();
+
+    if (bytes_written < 0 && !SocketWriteErrorIsRecoverable()) {
+#if defined(OS_MACOSX)
+      // On OSX writing to a pipe with no listener returns EPERM.
+      if (errno == EPERM) {
+        Close();
+        return false;
+      }
+#endif  // OS_MACOSX
+      if (errno == EPIPE) {
+        Close();
+        return false;
+      }
+      PLOG(ERROR) << "pipe error on "
+                  << fd_written
+                  << " Currently writing message of size: "
+                  << msg->size();
+      return false;
+    }
+
+    if (static_cast<size_t>(bytes_written) != amt_to_write) {
+      if (bytes_written > 0) {
+        // If write() fails with EAGAIN then bytes_written will be -1.
+        message_send_bytes_written_ += bytes_written;
+      }
+
+      // Tell libevent to call us back once things are unblocked.
+      is_blocked_on_write_ = true;
+      base::MessageLoopForIO::current()->WatchFileDescriptor(
+          pipe_,
+          false,  // One shot
+          base::MessageLoopForIO::WATCH_WRITE,
+          &write_watcher_,
+          this);
+      return true;
+    } else {
+      message_send_bytes_written_ = 0;
+
+      // Message sent OK!
+      DVLOG(2) << "sent message @" << msg << " on channel @" << this
+               << " with type " << msg->type() << " on fd " << pipe_;
+      delete output_queue_.front();
+      output_queue_.pop();
+    }
+  }
+  return true;
+}
+
+bool Channel::ChannelImpl::Send(Message* message) {
+  DVLOG(2) << "sending message @" << message << " on channel @" << this
+           << " with type " << message->type()
+           << " (" << output_queue_.size() << " in queue)";
+
+#ifdef IPC_MESSAGE_LOG_ENABLED
+  Logging::GetInstance()->OnSendMessage(message, "");
+#endif  // IPC_MESSAGE_LOG_ENABLED
+
+  message->TraceMessageBegin();
+  output_queue_.push(message);
+  if (!is_blocked_on_write_ && !waiting_connect_) {
+    return ProcessOutgoingMessages();
+  }
+
+  return true;
+}
+
+int Channel::ChannelImpl::GetClientFileDescriptor() {
+  base::AutoLock lock(client_pipe_lock_);
+  return client_pipe_;
+}
+
+int Channel::ChannelImpl::TakeClientFileDescriptor() {
+  base::AutoLock lock(client_pipe_lock_);
+  int fd = client_pipe_;
+  if (client_pipe_ != -1) {
+    PipeMap::GetInstance()->Remove(pipe_name_);
+    client_pipe_ = -1;
+  }
+  return fd;
+}
+
+void Channel::ChannelImpl::CloseClientFileDescriptor() {
+  base::AutoLock lock(client_pipe_lock_);
+  if (client_pipe_ != -1) {
+    PipeMap::GetInstance()->Remove(pipe_name_);
+    if (HANDLE_EINTR(close(client_pipe_)) < 0)
+      PLOG(ERROR) << "close " << pipe_name_;
+    client_pipe_ = -1;
+  }
+}
+
+bool Channel::ChannelImpl::AcceptsConnections() const {
+  return server_listen_pipe_ != -1;
+}
+
+bool Channel::ChannelImpl::HasAcceptedConnection() const {
+  return AcceptsConnections() && pipe_ != -1;
+}
+
+bool Channel::ChannelImpl::GetPeerEuid(uid_t* peer_euid) const {
+  DCHECK(!(mode_ & MODE_SERVER) || HasAcceptedConnection());
+  return IPC::GetPeerEuid(pipe_, peer_euid);
+}
+
+void Channel::ChannelImpl::ResetToAcceptingConnectionState() {
+  // Unregister libevent for the unix domain socket and close it.
+  read_watcher_.StopWatchingFileDescriptor();
+  write_watcher_.StopWatchingFileDescriptor();
+  if (pipe_ != -1) {
+    if (HANDLE_EINTR(close(pipe_)) < 0)
+      PLOG(ERROR) << "close pipe_ " << pipe_name_;
+    pipe_ = -1;
+  }
+#if defined(IPC_USES_READWRITE)
+  if (fd_pipe_ != -1) {
+    if (HANDLE_EINTR(close(fd_pipe_)) < 0)
+      PLOG(ERROR) << "close fd_pipe_ " << pipe_name_;
+    fd_pipe_ = -1;
+  }
+  if (remote_fd_pipe_ != -1) {
+    if (HANDLE_EINTR(close(remote_fd_pipe_)) < 0)
+      PLOG(ERROR) << "close remote_fd_pipe_ " << pipe_name_;
+    remote_fd_pipe_ = -1;
+  }
+#endif  // IPC_USES_READWRITE
+
+  while (!output_queue_.empty()) {
+    Message* m = output_queue_.front();
+    output_queue_.pop();
+    delete m;
+  }
+
+  // Close any outstanding, received file descriptors.
+  ClearInputFDs();
+}
+
+// static
+bool Channel::ChannelImpl::IsNamedServerInitialized(
+    const std::string& channel_id) {
+  return base::PathExists(base::FilePath(channel_id));
+}
+
+#if defined(OS_LINUX)
+// static
+void Channel::ChannelImpl::SetGlobalPid(int pid) {
+  global_pid_ = pid;
+}
+#endif  // OS_LINUX
+
+// Called by libevent when we can read from the pipe without blocking.
+void Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int fd) {
+  bool send_server_hello_msg = false;
+  if (fd == server_listen_pipe_) {
+    int new_pipe = 0;
+    if (!ServerAcceptConnection(server_listen_pipe_, &new_pipe) ||
+        new_pipe < 0) {
+      Close();
+      listener()->OnChannelListenError();
+    }
+
+    if (pipe_ != -1) {
+      // We already have a connection. We only handle one at a time.
+      // close our new descriptor.
+      if (HANDLE_EINTR(shutdown(new_pipe, SHUT_RDWR)) < 0)
+        DPLOG(ERROR) << "shutdown " << pipe_name_;
+      if (HANDLE_EINTR(close(new_pipe)) < 0)
+        DPLOG(ERROR) << "close " << pipe_name_;
+      listener()->OnChannelDenied();
+      return;
+    }
+    pipe_ = new_pipe;
+
+    if ((mode_ & MODE_OPEN_ACCESS_FLAG) == 0) {
+      // Verify that the IPC channel peer is running as the same user.
+      uid_t client_euid;
+      if (!GetPeerEuid(&client_euid)) {
+        DLOG(ERROR) << "Unable to query client euid";
+        ResetToAcceptingConnectionState();
+        return;
+      }
+      if (client_euid != geteuid()) {
+        DLOG(WARNING) << "Client euid is not authorised";
+        ResetToAcceptingConnectionState();
+        return;
+      }
+    }
+
+    if (!AcceptConnection()) {
+      NOTREACHED() << "AcceptConnection should not fail on server";
+    }
+    send_server_hello_msg = true;
+    waiting_connect_ = false;
+  } else if (fd == pipe_) {
+    if (waiting_connect_ && (mode_ & MODE_SERVER_FLAG)) {
+      send_server_hello_msg = true;
+      waiting_connect_ = false;
+    }
+    if (!ProcessIncomingMessages()) {
+      // ClosePipeOnError may delete this object, so we mustn't call
+      // ProcessOutgoingMessages.
+      send_server_hello_msg = false;
+      ClosePipeOnError();
+    }
+  } else {
+    NOTREACHED() << "Unknown pipe " << fd;
+  }
+
+  // If we're a server and handshaking, then we want to make sure that we
+  // only send our handshake message after we've processed the client's.
+  // This gives us a chance to kill the client if the incoming handshake
+  // is invalid.
+  if (send_server_hello_msg) {
+    ProcessOutgoingMessages();
+  }
+}
+
+// Called by libevent when we can write to the pipe without blocking.
+void Channel::ChannelImpl::OnFileCanWriteWithoutBlocking(int fd) {
+  DCHECK_EQ(pipe_, fd);
+  is_blocked_on_write_ = false;
+  if (!ProcessOutgoingMessages()) {
+    ClosePipeOnError();
+  }
+}
+
+bool Channel::ChannelImpl::AcceptConnection() {
+  base::MessageLoopForIO::current()->WatchFileDescriptor(
+      pipe_, true, base::MessageLoopForIO::WATCH_READ, &read_watcher_, this);
+  QueueHelloMessage();
+
+  if (mode_ & MODE_CLIENT_FLAG) {
+    // If we are a client we want to send a hello message out immediately.
+    // In server mode we will send a hello message when we receive one from a
+    // client.
+    waiting_connect_ = false;
+    return ProcessOutgoingMessages();
+  } else if (mode_ & MODE_SERVER_FLAG) {
+    waiting_connect_ = true;
+    return true;
+  } else {
+    NOTREACHED();
+    return false;
+  }
+}
+
+void Channel::ChannelImpl::ClosePipeOnError() {
+  if (HasAcceptedConnection()) {
+    ResetToAcceptingConnectionState();
+    listener()->OnChannelError();
+  } else {
+    Close();
+    if (AcceptsConnections()) {
+      listener()->OnChannelListenError();
+    } else {
+      listener()->OnChannelError();
+    }
+  }
+}
+
+int Channel::ChannelImpl::GetHelloMessageProcId() {
+  int pid = base::GetCurrentProcId();
+#if defined(OS_LINUX)
+  // Our process may be in a sandbox with a separate PID namespace.
+  if (global_pid_) {
+    pid = global_pid_;
+  }
+#endif
+  return pid;
+}
+
+void Channel::ChannelImpl::QueueHelloMessage() {
+  // Create the Hello message
+  scoped_ptr<Message> msg(new Message(MSG_ROUTING_NONE,
+                                      HELLO_MESSAGE_TYPE,
+                                      IPC::Message::PRIORITY_NORMAL));
+  if (!msg->WriteInt(GetHelloMessageProcId())) {
+    NOTREACHED() << "Unable to pickle hello message proc id";
+  }
+#if defined(IPC_USES_READWRITE)
+  scoped_ptr<Message> hello;
+  if (remote_fd_pipe_ != -1) {
+    if (!msg->WriteFileDescriptor(base::FileDescriptor(remote_fd_pipe_,
+                                                       false))) {
+      NOTREACHED() << "Unable to pickle hello message file descriptors";
+    }
+    DCHECK_EQ(msg->file_descriptor_set()->size(), 1U);
+  }
+#endif  // IPC_USES_READWRITE
+  output_queue_.push(msg.release());
+}
+
+Channel::ChannelImpl::ReadState Channel::ChannelImpl::ReadData(
+    char* buffer,
+    int buffer_len,
+    int* bytes_read) {
+  if (pipe_ == -1)
+    return READ_FAILED;
+
+  struct msghdr msg = {0};
+
+  struct iovec iov = {buffer, static_cast<size_t>(buffer_len)};
+  msg.msg_iov = &iov;
+  msg.msg_iovlen = 1;
+
+  msg.msg_control = input_cmsg_buf_;
+
+  // recvmsg() returns 0 if the connection has closed or EAGAIN if no data
+  // is waiting on the pipe.
+#if defined(IPC_USES_READWRITE)
+  if (fd_pipe_ >= 0) {
+    *bytes_read = HANDLE_EINTR(read(pipe_, buffer, buffer_len));
+    msg.msg_controllen = 0;
+  } else
+#endif  // IPC_USES_READWRITE
+  {
+    msg.msg_controllen = sizeof(input_cmsg_buf_);
+    *bytes_read = HANDLE_EINTR(recvmsg(pipe_, &msg, MSG_DONTWAIT));
+  }
+  if (*bytes_read < 0) {
+    if (errno == EAGAIN) {
+      return READ_PENDING;
+#if defined(OS_MACOSX)
+    } else if (errno == EPERM) {
+      // On OSX, reading from a pipe with no listener returns EPERM
+      // treat this as a special case to prevent spurious error messages
+      // to the console.
+      return READ_FAILED;
+#endif  // OS_MACOSX
+    } else if (errno == ECONNRESET || errno == EPIPE) {
+      return READ_FAILED;
+    } else {
+      PLOG(ERROR) << "pipe error (" << pipe_ << ")";
+      return READ_FAILED;
+    }
+  } else if (*bytes_read == 0) {
+    // The pipe has closed...
+    return READ_FAILED;
+  }
+  DCHECK(*bytes_read);
+
+  CloseClientFileDescriptor();
+
+  // Read any file descriptors from the message.
+  if (!ExtractFileDescriptorsFromMsghdr(&msg))
+    return READ_FAILED;
+  return READ_SUCCEEDED;
+}
+
+#if defined(IPC_USES_READWRITE)
+bool Channel::ChannelImpl::ReadFileDescriptorsFromFDPipe() {
+  char dummy;
+  struct iovec fd_pipe_iov = { &dummy, 1 };
+
+  struct msghdr msg = { 0 };
+  msg.msg_iov = &fd_pipe_iov;
+  msg.msg_iovlen = 1;
+  msg.msg_control = input_cmsg_buf_;
+  msg.msg_controllen = sizeof(input_cmsg_buf_);
+  ssize_t bytes_received = HANDLE_EINTR(recvmsg(fd_pipe_, &msg, MSG_DONTWAIT));
+
+  if (bytes_received != 1)
+    return true;  // No message waiting.
+
+  if (!ExtractFileDescriptorsFromMsghdr(&msg))
+    return false;
+  return true;
+}
+#endif
+
+// On Posix, we need to fix up the file descriptors before the input message
+// is dispatched.
+//
+// This will read from the input_fds_ (READWRITE mode only) and read more
+// handles from the FD pipe if necessary.
+bool Channel::ChannelImpl::WillDispatchInputMessage(Message* msg) {
+  uint16 header_fds = msg->header()->num_fds;
+  if (!header_fds)
+    return true;  // Nothing to do.
+
+  // The message has file descriptors.
+  const char* error = NULL;
+  if (header_fds > input_fds_.size()) {
+    // The message has been completely received, but we didn't get
+    // enough file descriptors.
+#if defined(IPC_USES_READWRITE)
+    if (!ReadFileDescriptorsFromFDPipe())
+      return false;
+    if (header_fds > input_fds_.size())
+#endif  // IPC_USES_READWRITE
+      error = "Message needs unreceived descriptors";
+  }
+
+  if (header_fds > FileDescriptorSet::kMaxDescriptorsPerMessage)
+    error = "Message requires an excessive number of descriptors";
+
+  if (error) {
+    LOG(WARNING) << error
+                 << " channel:" << this
+                 << " message-type:" << msg->type()
+                 << " header()->num_fds:" << header_fds;
+    // Abort the connection.
+    ClearInputFDs();
+    return false;
+  }
+
+  // The shenaniganery below with &foo.front() requires input_fds_ to have
+  // contiguous underlying storage (such as a simple array or a std::vector).
+  // This is why the header warns not to make input_fds_ a deque<>.
+  msg->file_descriptor_set()->SetDescriptors(&input_fds_.front(),
+                                             header_fds);
+  input_fds_.erase(input_fds_.begin(), input_fds_.begin() + header_fds);
+  return true;
+}
+
+bool Channel::ChannelImpl::DidEmptyInputBuffers() {
+  // When the input data buffer is empty, the fds should be too. If this is
+  // not the case, we probably have a rogue renderer which is trying to fill
+  // our descriptor table.
+  return input_fds_.empty();
+}
+
+bool Channel::ChannelImpl::ExtractFileDescriptorsFromMsghdr(msghdr* msg) {
+  // Check that there are any control messages. On OSX, CMSG_FIRSTHDR will
+  // return an invalid non-NULL pointer in the case that controllen == 0.
+  if (msg->msg_controllen == 0)
+    return true;
+
+  for (cmsghdr* cmsg = CMSG_FIRSTHDR(msg);
+       cmsg;
+       cmsg = CMSG_NXTHDR(msg, cmsg)) {
+    if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
+      unsigned payload_len = cmsg->cmsg_len - CMSG_LEN(0);
+      DCHECK_EQ(0U, payload_len % sizeof(int));
+      const int* file_descriptors = reinterpret_cast<int*>(CMSG_DATA(cmsg));
+      unsigned num_file_descriptors = payload_len / 4;
+      input_fds_.insert(input_fds_.end(),
+                        file_descriptors,
+                        file_descriptors + num_file_descriptors);
+
+      // Check this after adding the FDs so we don't leak them.
+      if (msg->msg_flags & MSG_CTRUNC) {
+        ClearInputFDs();
+        return false;
+      }
+
+      return true;
+    }
+  }
+
+  // No file descriptors found, but that's OK.
+  return true;
+}
+
+void Channel::ChannelImpl::ClearInputFDs() {
+  for (size_t i = 0; i < input_fds_.size(); ++i) {
+    if (HANDLE_EINTR(close(input_fds_[i])) < 0)
+      PLOG(ERROR) << "close ";
+  }
+  input_fds_.clear();
+}
+
+void Channel::ChannelImpl::HandleHelloMessage(const Message& msg) {
+  // The Hello message contains only the process id.
+  PickleIterator iter(msg);
+  int pid;
+  if (!msg.ReadInt(&iter, &pid))
+    NOTREACHED();
+
+#if defined(IPC_USES_READWRITE)
+  if (mode_ & MODE_SERVER_FLAG) {
+    // With IPC_USES_READWRITE, the Hello message from the client to the
+    // server also contains the fd_pipe_, which  will be used for all
+    // subsequent file descriptor passing.
+    DCHECK_EQ(msg.file_descriptor_set()->size(), 1U);
+    base::FileDescriptor descriptor;
+    if (!msg.ReadFileDescriptor(&iter, &descriptor)) {
+      NOTREACHED();
+    }
+    fd_pipe_ = descriptor.fd;
+    CHECK(descriptor.auto_close);
+  }
+#endif  // IPC_USES_READWRITE
+  peer_pid_ = pid;
+  listener()->OnChannelConnected(pid);
+}
+
+void Channel::ChannelImpl::Close() {
+  // Close can be called multiple time, so we need to make sure we're
+  // idempotent.
+
+  ResetToAcceptingConnectionState();
+
+  if (must_unlink_) {
+    unlink(pipe_name_.c_str());
+    must_unlink_ = false;
+  }
+  if (server_listen_pipe_ != -1) {
+    if (HANDLE_EINTR(close(server_listen_pipe_)) < 0)
+      DPLOG(ERROR) << "close " << server_listen_pipe_;
+    server_listen_pipe_ = -1;
+    // Unregister libevent for the listening socket and close it.
+    server_listen_connection_watcher_.StopWatchingFileDescriptor();
+  }
+
+  CloseClientFileDescriptor();
+}
+
+//------------------------------------------------------------------------------
+// Channel's methods simply call through to ChannelImpl.
+Channel::Channel(const IPC::ChannelHandle& channel_handle, Mode mode,
+                 Listener* listener)
+    : channel_impl_(new ChannelImpl(channel_handle, mode, listener)) {
+}
+
+Channel::~Channel() {
+  delete channel_impl_;
+}
+
+bool Channel::Connect() {
+  return channel_impl_->Connect();
+}
+
+void Channel::Close() {
+  if (channel_impl_)
+    channel_impl_->Close();
+}
+
+base::ProcessId Channel::peer_pid() const {
+  return channel_impl_->peer_pid();
+}
+
+bool Channel::Send(Message* message) {
+  return channel_impl_->Send(message);
+}
+
+int Channel::GetClientFileDescriptor() const {
+  return channel_impl_->GetClientFileDescriptor();
+}
+
+int Channel::TakeClientFileDescriptor() {
+  return channel_impl_->TakeClientFileDescriptor();
+}
+
+bool Channel::AcceptsConnections() const {
+  return channel_impl_->AcceptsConnections();
+}
+
+bool Channel::HasAcceptedConnection() const {
+  return channel_impl_->HasAcceptedConnection();
+}
+
+bool Channel::GetPeerEuid(uid_t* peer_euid) const {
+  return channel_impl_->GetPeerEuid(peer_euid);
+}
+
+void Channel::ResetToAcceptingConnectionState() {
+  channel_impl_->ResetToAcceptingConnectionState();
+}
+
+// static
+bool Channel::IsNamedServerInitialized(const std::string& channel_id) {
+  return ChannelImpl::IsNamedServerInitialized(channel_id);
+}
+
+// static
+std::string Channel::GenerateVerifiedChannelID(const std::string& prefix) {
+  // A random name is sufficient validation on posix systems, so we don't need
+  // an additional shared secret.
+
+  std::string id = prefix;
+  if (!id.empty())
+    id.append(".");
+
+  return id.append(GenerateUniqueRandomChannelID());
+}
+
+
+#if defined(OS_LINUX)
+// static
+void Channel::SetGlobalPid(int pid) {
+  ChannelImpl::SetGlobalPid(pid);
+}
+#endif  // OS_LINUX
+
+}  // namespace IPC