Private API for extensions like ssh-client that need access to TCP.

chrome/browser/chromeos/web_socket_proxy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "web_socket_proxy.h"
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ skipping 12 matching lines @@
 #include <sys/types.h>
 #include <sys/wait.h>
 
 #include "base/base64.h"
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/md5.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/string_number_conversions.h"
 #include "base/string_util.h"
+#include "chrome/browser/internal_auth.h"
 #include "content/browser/browser_thread.h"
 #include "content/common/notification_service.h"
 #include "content/common/notification_type.h"
-// TODO(dilmah): enable this once webSocketProxyPrivate.getToken is wired.
-#if 0
-#include "chrome/browser/internal_auth.h"
-#endif
+#include "content/common/url_constants.h"
+#include "googleurl/src/gurl.h"
 #include "third_party/libevent/evdns.h"
 #include "third_party/libevent/event.h"
 
 namespace chromeos {
 
 namespace {
 
 const uint8 kCRLF[] = "\r\n";
 const uint8 kCRLFCRLF[] = "\r\n\r\n";
 
@@ skipping 48 matching lines @@
       *result *= 10;
       int digit = s[i] - '0';
       if (*result > std::numeric_limits<uint32>::max() - digit)
         return false;
       *result += digit;
     }
   }
   return got_something;
 }
 
-// Parses "token:hostname:port:" string.  Returns true on success.
-bool FetchTokenNamePort(
+// Parses "passport:hostname:port:" string.  Returns true on success.
+bool FetchPassportNamePort(
     uint8* begin, uint8* end,
-    std::string* token, std::string* name, uint32* port) {
+    std::string* passport, std::string* name, uint32* port) {
   std::string input(begin, end);
   if (input[input.size() - 1] != ':')
     return false;
   input.resize(input.size() - 1);
 
   size_t pos = input.find_last_of(':');
   if (pos == std::string::npos)
     return false;
   std::string port_str(input, pos + 1);
   if (port_str.empty())
     return false;
   const char kAsciiDigits[] = "0123456789";
   COMPILE_ASSERT(sizeof(kAsciiDigits) == 10 + 1, mess_with_digits);
   if (port_str.find_first_not_of(kAsciiDigits) != std::string::npos)
     return false;
   if (!FetchDecimalDigits(port_str, port) ||
       *port <= 0 ||
       *port >= (1 << 16)) {
     return false;
   }
   input.resize(pos);
 
   pos = input.find_first_of(':');
   if (pos == std::string::npos)
     return false;
-  token->assign(input, 0, pos);
+  passport->assign(input, 0, pos);
   name->assign(input, pos + 1, std::string::npos);
   return !name->empty();
 }
 
-std::string FetchExtensionIdFromOrigin(const std::string origin) {
-  // Origin of extension looks like "chrome-extension://EXTENSION_ID".
-  return origin.substr(origin.find_last_of('/'));
+std::string FetchExtensionIdFromOrigin(const std::string &origin) {
+  GURL url(origin);
+  if (url.SchemeIs(chrome::kExtensionScheme))
+    return url.host();
+  else
+    return std::string();
 }
 
 inline size_t strlen(const uint8* s) {
   return ::strlen(reinterpret_cast<const char*>(s));
 }
 
 void SendNotification() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   NotificationService::current()->Notify(
       NotificationType::WEB_SOCKET_PROXY_STARTED,
@@ skipping 571 matching lines @@
     if (!key.empty())
       header_fields_[key] = FetchLowerCasedASCIISnippet(npos, pos);
   }
 
   // Values of Upgrade and Connection fields are hardcoded in the protocol.
   if (header_fields_["upgrade"] != "websocket" ||
       header_fields_["connection"] != "upgrade") {
     return STATUS_ABORT;
   }
 
-  if (!master_->IsOriginAllowed(header_fields_["origin"]))
+  // Normalize origin (e.g. leading slash).
+  GURL origin = GURL(header_fields_["origin"]).GetOrigin();
+  if (!origin.is_valid())
+    return STATUS_ABORT;
+  // Here we check origin.  This check may seem redundant because we verify
+  // passport token later.  However the earlier we can reject connection the
+  // better.  We receive origin field in websocket header way before receiving
+  // passport string.
+  if (!master_->IsOriginAllowed(origin.spec()))
     return STATUS_ABORT;
 
   static const std::string kSecKey1 = "sec-websocket-key1";
   static const std::string kSecKey2 = "sec-websocket-key2";
   uint32 key_number1, key_number2;
-  if (!FetchDecimalDigits(header_fields_[kSecKey1],
-                          &key_number1) ||
-      !FetchDecimalDigits(header_fields_[kSecKey2],
-                          &key_number2)) {
+  if (!FetchDecimalDigits(header_fields_[kSecKey1], &key_number1) ||
+      !FetchDecimalDigits(header_fields_[kSecKey2], &key_number2)) {
     return STATUS_ABORT;
   }
 
   // We limit incoming header size so following numbers shall not be too high.
   int spaces1 = CountSpaces(header_fields_[kSecKey1]);
   int spaces2 = CountSpaces(header_fields_[kSecKey2]);
   if (spaces1 == 0 ||
       spaces2 == 0 ||
       key_number1 % spaces1 != 0 ||
       key_number2 % spaces2 != 0) {
@@ skipping 65 matching lines @@
   uint8* buf_end = buf + buf_size;
   uint8* term_pos = std::find(buf + 1, buf_end, 0xff);
   if (term_pos == buf_end) {
     if (buf_size >= WebSocketProxy::kHeaderLimit) {
       // So big and still worth nothing.
       return STATUS_ABORT;
     }
     return STATUS_INCOMPLETE;
   }
 
-  std::string token;
-  if (!FetchTokenNamePort(buf + 1, term_pos, &token, &destname_, &destport_))
+  std::string passport;
+  if (!FetchPassportNamePort(
+      buf + 1, term_pos, &passport, &destname_, &destport_)) {
     return STATUS_ABORT;
-  // TODO(dilmah): enable this once webSocketProxyPrivate.getToken is wired.
-#if 0
+  }
   std::map<std::string, std::string> map;
   map["hostname"] = destname_;
   map["port"] = base::IntToString(destport_);
   map["extension_id"] = FetchExtensionIdFromOrigin(header_fields_["origin"]);
-  if (!browser::InternalAuthVerification::VerifyToken(
-      "web_socket_proxy", token, map)) {
+  if (!browser::InternalAuthVerification::VerifyPassport(
+      passport, "web_socket_proxy", map)) {
     return STATUS_ABORT;
   }
-#endif
 
   evbuffer_drain(evb, term_pos - buf + 1);
   return STATUS_OK;
 }
 
 Conn::Status Conn::ConsumeFrameHeader(struct evbuffer* evb) {
   uint8* buf = EVBUFFER_DATA(evb);
   size_t buf_size = EVBUFFER_LENGTH(evb);
 
   if (buf_size < 1)
@@ skipping 426 matching lines @@
 void WebSocketProxy::Run() {
   static_cast<Serv*>(impl_)->Run();
 }
 
 void WebSocketProxy::Shutdown() {
   static_cast<Serv*>(impl_)->Shutdown();
 }
 
 }  // namespace chromeos