michael@0: // Copyright (c) 2011 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: #include "sandbox/win/src/handle_table.h"
michael@0: 
michael@0: #include <algorithm>
michael@0: #include <cstdlib>
michael@0: 
michael@0: #include "base/logging.h"
michael@0: #include "base/memory/scoped_ptr.h"
michael@0: #include "sandbox/win/src/win_utils.h"
michael@0: 
michael@0: namespace {
michael@0: 
michael@0: bool CompareHandleEntries(const SYSTEM_HANDLE_INFORMATION& a,
michael@0:                           const SYSTEM_HANDLE_INFORMATION& b) {
michael@0:   return a.ProcessId < b.ProcessId;
michael@0: }
michael@0: 
michael@0: }  // namespace
michael@0: 
michael@0: namespace sandbox {
michael@0: 
michael@0: const char16* HandleTable::kTypeProcess = L"Process";
michael@0: const char16* HandleTable::kTypeThread = L"Thread";
michael@0: const char16* HandleTable::kTypeFile = L"File";
michael@0: const char16* HandleTable::kTypeDirectory = L"Directory";
michael@0: const char16* HandleTable::kTypeKey = L"Key";
michael@0: const char16* HandleTable::kTypeWindowStation = L"WindowStation";
michael@0: const char16* HandleTable::kTypeDesktop = L"Desktop";
michael@0: const char16* HandleTable::kTypeService = L"Service";
michael@0: const char16* HandleTable::kTypeMutex = L"Mutex";
michael@0: const char16* HandleTable::kTypeSemaphore = L"Semaphore";
michael@0: const char16* HandleTable::kTypeEvent = L"Event";
michael@0: const char16* HandleTable::kTypeTimer = L"Timer";
michael@0: const char16* HandleTable::kTypeNamedPipe = L"NamedPipe";
michael@0: const char16* HandleTable::kTypeJobObject = L"JobObject";
michael@0: const char16* HandleTable::kTypeFileMap = L"FileMap";
michael@0: const char16* HandleTable::kTypeAlpcPort = L"ALPC Port";
michael@0: 
michael@0: HandleTable::HandleTable() {
michael@0:   static NtQuerySystemInformation QuerySystemInformation = NULL;
michael@0:   if (!QuerySystemInformation)
michael@0:     ResolveNTFunctionPtr("NtQuerySystemInformation", &QuerySystemInformation);
michael@0: 
michael@0:   ULONG size = 0x15000;
michael@0:   NTSTATUS result;
michael@0:   do {
michael@0:     handle_info_buffer_.resize(size);
michael@0:     result = QuerySystemInformation(SystemHandleInformation,
michael@0:         handle_info_internal(), size, &size);
michael@0:   } while (result == STATUS_INFO_LENGTH_MISMATCH);
michael@0: 
michael@0:   // We failed, so make an empty table.
michael@0:   if (!NT_SUCCESS(result)) {
michael@0:     handle_info_buffer_.resize(0);
michael@0:     return;
michael@0:   }
michael@0: 
michael@0:   // Sort it to make process lookups faster.
michael@0:   std::sort(handle_info_internal()->Information,
michael@0:       handle_info_internal()->Information +
michael@0:       handle_info_internal()->NumberOfHandles, CompareHandleEntries);
michael@0: }
michael@0: 
michael@0: HandleTable::Iterator HandleTable::HandlesForProcess(ULONG process_id) const {
michael@0:   SYSTEM_HANDLE_INFORMATION key;
michael@0:   key.ProcessId = process_id;
michael@0: 
michael@0:   const SYSTEM_HANDLE_INFORMATION* start = handle_info()->Information;
michael@0:   const SYSTEM_HANDLE_INFORMATION* finish =
michael@0:       &handle_info()->Information[handle_info()->NumberOfHandles];
michael@0: 
michael@0:   start = std::lower_bound(start, finish, key, CompareHandleEntries);
michael@0:   if (start->ProcessId != process_id)
michael@0:     return Iterator(*this, finish, finish);
michael@0:   finish = std::upper_bound(start, finish, key, CompareHandleEntries);
michael@0:   return Iterator(*this, start, finish);
michael@0: }
michael@0: 
michael@0: HandleTable::HandleEntry::HandleEntry(
michael@0:     const SYSTEM_HANDLE_INFORMATION* handle_info_entry)
michael@0:     : handle_entry_(handle_info_entry), last_entry_(0) {
michael@0: }
michael@0: 
michael@0: void HandleTable::HandleEntry::UpdateInfo(UpdateType flag) {
michael@0:   static NtQueryObject QueryObject = NULL;
michael@0:   if (!QueryObject)
michael@0:     ResolveNTFunctionPtr("NtQueryObject", &QueryObject);
michael@0: 
michael@0:   NTSTATUS result;
michael@0: 
michael@0:   // Always update the basic type info, but grab the names as needed.
michael@0:   if (needs_info_update()) {
michael@0:     handle_name_.clear();
michael@0:     type_name_.clear();
michael@0:     last_entry_ = handle_entry_;
michael@0: 
michael@0:     // Most handle names are very short, so start small and reuse this buffer.
michael@0:     if (type_info_buffer_.empty())
michael@0:       type_info_buffer_.resize(sizeof(OBJECT_TYPE_INFORMATION)
michael@0:           + (32 * sizeof(wchar_t)));
michael@0:     ULONG size = static_cast<ULONG>(type_info_buffer_.size());
michael@0:     result = QueryObject(reinterpret_cast<HANDLE>(handle_entry_->Handle),
michael@0:         ObjectTypeInformation, type_info_internal(), size, &size);
michael@0:     while (result == STATUS_INFO_LENGTH_MISMATCH) {
michael@0:       type_info_buffer_.resize(size);
michael@0:       result = QueryObject(reinterpret_cast<HANDLE>(handle_entry_->Handle),
michael@0:           ObjectTypeInformation, type_info_internal(), size, &size);
michael@0:     }
michael@0: 
michael@0:     if (!NT_SUCCESS(result)) {
michael@0:       type_info_buffer_.clear();
michael@0:       return;
michael@0:     }
michael@0:   }
michael@0: 
michael@0:   // Don't bother copying out names until we ask for them, and then cache them.
michael@0:   switch (flag) {
michael@0:     case UPDATE_INFO_AND_NAME:
michael@0:       if (type_info_buffer_.size() && handle_name_.empty()) {
michael@0:         ULONG size = MAX_PATH;
michael@0:         scoped_ptr<UNICODE_STRING, base::FreeDeleter> name;
michael@0:         do {
michael@0:           name.reset(static_cast<UNICODE_STRING*>(malloc(size)));
michael@0:           DCHECK(name.get());
michael@0:           result = QueryObject(reinterpret_cast<HANDLE>(
michael@0:               handle_entry_->Handle), ObjectNameInformation, name.get(),
michael@0:               size, &size);
michael@0:         } while (result == STATUS_INFO_LENGTH_MISMATCH);
michael@0: 
michael@0:         if (NT_SUCCESS(result)) {
michael@0:           handle_name_.assign(name->Buffer, name->Length / sizeof(wchar_t));
michael@0:         }
michael@0:       }
michael@0:       break;
michael@0: 
michael@0:     case UPDATE_INFO_AND_TYPE_NAME:
michael@0:       if (!type_info_buffer_.empty() && type_info_internal()->Name.Buffer &&
michael@0:           type_name_.empty()) {
michael@0:         type_name_.assign(type_info_internal()->Name.Buffer,
michael@0:             type_info_internal()->Name.Length / sizeof(wchar_t));
michael@0:       }
michael@0:       break;
michael@0:   }
michael@0: }
michael@0: 
michael@0: const OBJECT_TYPE_INFORMATION* HandleTable::HandleEntry::TypeInfo() {
michael@0:   UpdateInfo(UPDATE_INFO_ONLY);
michael@0:   return type_info_buffer_.empty() ? NULL : type_info_internal();
michael@0: }
michael@0: 
michael@0: const string16& HandleTable::HandleEntry::Name() {
michael@0:   UpdateInfo(UPDATE_INFO_AND_NAME);
michael@0:   return handle_name_;
michael@0: }
michael@0: 
michael@0: const string16& HandleTable::HandleEntry::Type() {
michael@0:   UpdateInfo(UPDATE_INFO_AND_TYPE_NAME);
michael@0:   return type_name_;
michael@0: }
michael@0: 
michael@0: bool HandleTable::HandleEntry::IsType(const string16& type_string) {
michael@0:   UpdateInfo(UPDATE_INFO_ONLY);
michael@0:   if (type_info_buffer_.empty())
michael@0:     return false;
michael@0:   return type_string.compare(0,
michael@0:       type_info_internal()->Name.Length / sizeof(wchar_t),
michael@0:       type_info_internal()->Name.Buffer) == 0;
michael@0: }
michael@0: 
michael@0: HandleTable::Iterator::Iterator(const HandleTable& table,
michael@0:                                 const SYSTEM_HANDLE_INFORMATION* start,
michael@0:                                 const SYSTEM_HANDLE_INFORMATION* end)
michael@0:     : table_(table), current_(start), end_(end) {
michael@0: }
michael@0: 
michael@0: HandleTable::Iterator::Iterator(const Iterator& it)
michael@0:     : table_(it.table_), current_(it.current_.handle_entry_), end_(it.end_) {
michael@0: }
michael@0: 
michael@0: }  // namespace sandbox