diff --git a/libs/hbb_common b/libs/hbb_common index 24ae0c426..0d2ca8aa4 160000 --- a/libs/hbb_common +++ b/libs/hbb_common @@ -1 +1 @@ -Subproject commit 24ae0c426c25ad116c5a7b57b0dd0102f5833cb7 +Subproject commit 0d2ca8aa44c4ec2a0f3b702e4a09fc1c192dfec9 diff --git a/src/ipc/auth.rs b/src/ipc/auth.rs index 89beef072..6f40ab115 100644 --- a/src/ipc/auth.rs +++ b/src/ipc/auth.rs @@ -24,7 +24,6 @@ use std::os::windows::io::AsRawHandle; use std::{ fs, path::{Path, PathBuf}, - sync::{Mutex, OnceLock}, }; #[cfg(windows)] use windows::Win32::{Foundation::HANDLE, System::Pipes::GetNamedPipeClientProcessId}; @@ -520,66 +519,17 @@ pub(crate) fn ensure_peer_executable_matches_current_by_fd( #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))] const UNAUTHORIZED_IPC_LOG_INTERVAL: std::time::Duration = std::time::Duration::from_secs(5); -#[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))] -#[derive(Default)] -struct UnauthorizedIpcLogThrottle { - last_log_at: Option, - suppressed: u64, -} - -#[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))] -impl UnauthorizedIpcLogThrottle { - #[inline] - fn on_reject(&mut self, now: std::time::Instant) -> Option { - if let Some(last) = self.last_log_at { - if now.saturating_duration_since(last) < UNAUTHORIZED_IPC_LOG_INTERVAL { - self.suppressed += 1; - return None; - } - } - self.last_log_at = Some(now); - Some(std::mem::take(&mut self.suppressed)) - } -} - -#[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))] -#[inline] -fn throttled_unauthorized_ipc_log( - throttle_cell: &OnceLock>, - emit: impl FnOnce(u64), -) { - let throttle = throttle_cell.get_or_init(|| Mutex::new(UnauthorizedIpcLogThrottle::default())); - let should_log = match throttle.lock() { - Ok(mut throttle) => throttle.on_reject(std::time::Instant::now()), - Err(_) => Some(0), - }; - if let Some(suppressed) = should_log { - emit(suppressed); - } -} - #[cfg(any(target_os = "linux", target_os = "macos"))] #[inline] fn log_rejected_service_connection(postfix: &str, peer_uid: Option, active_uid: Option) { - static LOG_THROTTLE: OnceLock> = OnceLock::new(); - throttled_unauthorized_ipc_log(&LOG_THROTTLE, |suppressed| { - if suppressed > 0 { - log::warn!( - "Rejected unauthorized connection on protected service-scoped IPC channel: postfix={}, peer_uid={:?}, active_uid={:?} (suppressed {} similar events)", - postfix, - peer_uid, - active_uid, - suppressed - ); - } else { - log::warn!( - "Rejected unauthorized connection on protected service-scoped IPC channel: postfix={}, peer_uid={:?}, active_uid={:?}", - postfix, - peer_uid, - active_uid - ); - } - }); + hbb_common::throttled_log!( + UNAUTHORIZED_IPC_LOG_INTERVAL, + warn, + "Rejected unauthorized connection on protected service-scoped IPC channel: postfix={}, peer_uid={:?}, active_uid={:?}", + postfix, + peer_uid, + active_uid + ); } #[cfg(target_os = "linux")] @@ -589,25 +539,14 @@ pub(crate) fn log_rejected_uinput_connection( peer_uid: Option, active_uid: Option, ) { - static LOG_THROTTLE: OnceLock> = OnceLock::new(); - throttled_unauthorized_ipc_log(&LOG_THROTTLE, |suppressed| { - if suppressed > 0 { - log::warn!( - "Rejected unauthorized connection on uinput ipc channel: postfix={}, peer_uid={:?}, active_uid={:?} (suppressed {} similar events)", - postfix, - peer_uid, - active_uid, - suppressed - ); - } else { - log::warn!( - "Rejected unauthorized connection on uinput ipc channel: postfix={}, peer_uid={:?}, active_uid={:?}", - postfix, - peer_uid, - active_uid - ); - } - }); + hbb_common::throttled_log!( + UNAUTHORIZED_IPC_LOG_INTERVAL, + warn, + "Rejected unauthorized connection on uinput ipc channel: postfix={}, peer_uid={:?}, active_uid={:?}", + postfix, + peer_uid, + active_uid + ); } #[cfg(windows)] @@ -620,31 +559,17 @@ pub(crate) fn log_rejected_windows_ipc_connection( peer_is_system: Option, peer_is_elevated: Option, ) { - static LOG_THROTTLE: OnceLock> = OnceLock::new(); - throttled_unauthorized_ipc_log(&LOG_THROTTLE, |suppressed| { - if suppressed > 0 { - log::warn!( - "Rejected unauthorized connection on ipc channel: postfix={}, peer_pid={:?}, peer_session_id={:?}, expected_session_id={:?}, peer_is_system={:?}, peer_is_elevated={:?} (suppressed {} similar events)", - postfix, - peer_pid, - peer_session_id, - expected_session_id, - peer_is_system, - peer_is_elevated, - suppressed - ); - } else { - log::warn!( - "Rejected unauthorized connection on ipc channel: postfix={}, peer_pid={:?}, peer_session_id={:?}, expected_session_id={:?}, peer_is_system={:?}, peer_is_elevated={:?}", - postfix, - peer_pid, - peer_session_id, - expected_session_id, - peer_is_system, - peer_is_elevated - ); - } - }); + hbb_common::throttled_log!( + UNAUTHORIZED_IPC_LOG_INTERVAL, + warn, + "Rejected unauthorized connection on ipc channel: postfix={}, peer_pid={:?}, peer_session_id={:?}, expected_session_id={:?}, peer_is_system={:?}, peer_is_elevated={:?}", + postfix, + peer_pid, + peer_session_id, + expected_session_id, + peer_is_system, + peer_is_elevated + ); } #[cfg(any(target_os = "linux", target_os = "macos"))]