CrOS - Add certificate support to VPN UI.

chrome/browser/chromeos/cros/network_library.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/network_library.h"
 
 #include <algorithm>
 #include <map>
 
 #include "base/i18n/icu_encoding_detection.h"
@@ skipping 209 matching lines @@
 
 // Flimflam security options.
 const char* kSecurityWpa = "wpa";
 const char* kSecurityWep = "wep";
 const char* kSecurityRsn = "rsn";
 const char* kSecurity8021x = "802_1x";
 const char* kSecurityPsk = "psk";
 const char* kSecurityNone = "none";
 
 // Flimflam L2TPIPsec property names.
-const char* kL2TPIPSecCACertProperty = "L2TPIPsec.CACert";
-const char* kL2TPIPSecCertProperty = "L2TPIPsec.Cert";
-const char* kL2TPIPSecKeyProperty = "L2TPIPsec.Key";
+const char* kL2TPIPSecCACertNSSProperty = "L2TPIPsec.CACertNSS";
+const char* kL2TPIPSecClientCertIDProperty = "L2TPIPsec.ClientCertID";
 const char* kL2TPIPSecPSKProperty = "L2TPIPsec.PSK";
 const char* kL2TPIPSecUserProperty = "L2TPIPsec.User";
 const char* kL2TPIPSecPasswordProperty = "L2TPIPsec.Password";
 
 // Flimflam EAP property names.
 // See src/third_party/flimflam/doc/service-api.txt.
 const char* kEapIdentityProperty = "EAP.Identity";
 const char* kEapMethodProperty = "EAP.EAP";
 const char* kEapPhase2AuthProperty = "EAP.InnerEAP";
 const char* kEapAnonymousIdentityProperty = "EAP.AnonymousIdentity";
@@ skipping 222 matching lines @@
   PROPERTY_INDEX_FAVORITE,
   PROPERTY_INDEX_FIRMWARE_REVISION,
   PROPERTY_INDEX_FOUND_NETWORKS,
   PROPERTY_INDEX_HARDWARE_REVISION,
   PROPERTY_INDEX_HOME_PROVIDER,
   PROPERTY_INDEX_HOST,
   PROPERTY_INDEX_IDENTITY,
   PROPERTY_INDEX_IMEI,
   PROPERTY_INDEX_IMSI,
   PROPERTY_INDEX_IS_ACTIVE,
-  PROPERTY_INDEX_L2TPIPSEC_CA_CERT,
-  PROPERTY_INDEX_L2TPIPSEC_CERT,

[Charlie Lee, 2011/05/20 21:44:46]

is this still needed?

-  PROPERTY_INDEX_L2TPIPSEC_KEY,
+  PROPERTY_INDEX_L2TPIPSEC_CA_CERT_NSS,
+  PROPERTY_INDEX_L2TPIPSEC_CLIENT_CERT_ID,
   PROPERTY_INDEX_L2TPIPSEC_PASSWORD,
   PROPERTY_INDEX_L2TPIPSEC_PSK,
   PROPERTY_INDEX_L2TPIPSEC_USER,
   PROPERTY_INDEX_MANUFACTURER,
   PROPERTY_INDEX_MDN,
   PROPERTY_INDEX_MEID,
   PROPERTY_INDEX_MIN,
   PROPERTY_INDEX_MODE,
   PROPERTY_INDEX_MODEL_ID,
   PROPERTY_INDEX_NAME,
@@ skipping 68 matching lines @@
   { kFavoriteProperty, PROPERTY_INDEX_FAVORITE },
   { kFirmwareRevisionProperty, PROPERTY_INDEX_FIRMWARE_REVISION },
   { kFoundNetworksProperty, PROPERTY_INDEX_FOUND_NETWORKS },
   { kHardwareRevisionProperty, PROPERTY_INDEX_HARDWARE_REVISION },
   { kHomeProviderProperty, PROPERTY_INDEX_HOME_PROVIDER },
   { kHostProperty, PROPERTY_INDEX_HOST },
   { kIdentityProperty, PROPERTY_INDEX_IDENTITY },
   { kImeiProperty, PROPERTY_INDEX_IMEI },
   { kImsiProperty, PROPERTY_INDEX_IMSI },
   { kIsActiveProperty, PROPERTY_INDEX_IS_ACTIVE },
-  { kL2TPIPSecCACertProperty, PROPERTY_INDEX_L2TPIPSEC_CA_CERT },
-  { kL2TPIPSecCertProperty, PROPERTY_INDEX_L2TPIPSEC_CERT },
-  { kL2TPIPSecKeyProperty, PROPERTY_INDEX_L2TPIPSEC_KEY },
+  { kL2TPIPSecCACertNSSProperty, PROPERTY_INDEX_L2TPIPSEC_CA_CERT_NSS },
+  { kL2TPIPSecClientCertIDProperty, PROPERTY_INDEX_L2TPIPSEC_CLIENT_CERT_ID },
   { kL2TPIPSecPasswordProperty, PROPERTY_INDEX_L2TPIPSEC_PASSWORD },
   { kL2TPIPSecPSKProperty, PROPERTY_INDEX_L2TPIPSEC_PSK },
   { kL2TPIPSecUserProperty, PROPERTY_INDEX_L2TPIPSEC_USER },
   { kManufacturerProperty, PROPERTY_INDEX_MANUFACTURER },
   { kMdnProperty, PROPERTY_INDEX_MDN },
   { kMeidProperty, PROPERTY_INDEX_MEID },
   { kMinProperty, PROPERTY_INDEX_MIN },
   { kModeProperty, PROPERTY_INDEX_MODE },
   { kModelIDProperty, PROPERTY_INDEX_MODEL_ID },
   { kNameProperty, PROPERTY_INDEX_NAME },
@@ skipping 724 matching lines @@
       // Note: shadows Network::name_ property.
       return value->GetAsString(&name_);
     case PROPERTY_INDEX_TYPE: {
       std::string provider_type_string;
       if (value->GetAsString(&provider_type_string)) {
         provider_type_ = ParseProviderType(provider_type_string);
         return true;
       }
       break;
     }
-    case PROPERTY_INDEX_L2TPIPSEC_CA_CERT:
-      return value->GetAsString(&ca_cert_);
+    case PROPERTY_INDEX_L2TPIPSEC_CA_CERT_NSS:
+      return value->GetAsString(&ca_cert_nss_);
     case PROPERTY_INDEX_L2TPIPSEC_PSK:
       return value->GetAsString(&psk_passphrase_);
-    case PROPERTY_INDEX_L2TPIPSEC_CERT:
-      return value->GetAsString(&user_cert_);
-    case PROPERTY_INDEX_L2TPIPSEC_KEY:
-      return value->GetAsString(&user_cert_key_);
+    case PROPERTY_INDEX_L2TPIPSEC_CLIENT_CERT_ID:
+      return value->GetAsString(&client_cert_id_);
     case PROPERTY_INDEX_L2TPIPSEC_USER:
       return value->GetAsString(&username_);
     case PROPERTY_INDEX_L2TPIPSEC_PASSWORD:
       return value->GetAsString(&user_passphrase_);
     default:
       break;
   }
   return false;
 }
 
@@ skipping 22 matching lines @@
       break;
   }
   return false;
 }
 
 void VirtualNetwork::ParseInfo(const DictionaryValue* info) {
   Network::ParseInfo(info);
   VLOG(1) << "VPN: " << name()
           << " Type: " << ProviderTypeToString(provider_type());
   if (provider_type_ == PROVIDER_TYPE_L2TP_IPSEC_PSK) {
-    if (!user_cert_.empty())
+    if (!client_cert_id_.empty())
       provider_type_ = PROVIDER_TYPE_L2TP_IPSEC_USER_CERT;
   }
 }
 
 bool VirtualNetwork::NeedMoreInfoToConnect() const {
   if (server_hostname_.empty() || username_.empty() || user_passphrase_.empty())
     return true;
   switch (provider_type_) {
     case PROVIDER_TYPE_L2TP_IPSEC_PSK:
       if (psk_passphrase_.empty())
         return true;
       break;
     case PROVIDER_TYPE_L2TP_IPSEC_USER_CERT:
     case PROVIDER_TYPE_OPEN_VPN:
-      if (user_cert_.empty())
+      if (client_cert_id_.empty())
         return true;
       break;
     case PROVIDER_TYPE_MAX:
       break;
   }
   return false;
 }
 
-void VirtualNetwork::SetCACert(const std::string& ca_cert) {
-  SetStringProperty(kL2TPIPSecCACertProperty, ca_cert, &ca_cert_);
+void VirtualNetwork::SetCACertNSS(const std::string& ca_cert_nss) {
+  SetStringProperty(kL2TPIPSecCACertNSSProperty, ca_cert_nss, &ca_cert_nss_);
 }
 
 void VirtualNetwork::SetPSKPassphrase(const std::string& psk_passphrase) {
   SetStringProperty(kL2TPIPSecPSKProperty, psk_passphrase,
                            &psk_passphrase_);
 }
 
-void VirtualNetwork::SetUserCert(const std::string& user_cert) {
-  SetStringProperty(kL2TPIPSecCertProperty, user_cert, &user_cert_);
-}
-
-void VirtualNetwork::SetUserCertKey(const std::string& key) {
-  SetStringProperty(kL2TPIPSecKeyProperty, key, &user_cert_key_);
+void VirtualNetwork::SetClientCertID(const std::string& cert_id) {
+  SetStringProperty(kL2TPIPSecClientCertIDProperty, cert_id, &client_cert_id_);
 }
 
 void VirtualNetwork::SetUsername(const std::string& username) {
   SetStringProperty(kL2TPIPSecUserProperty, username, &username_);
 }
 
 void VirtualNetwork::SetUserPassphrase(const std::string& user_passphrase) {
   SetStringProperty(kL2TPIPSecPasswordProperty, user_passphrase,
                     &user_passphrase_);
 }
@@ skipping 1558 matching lines @@
     connect_data_.server_hostname = server;
     connect_data_.psk_username = username;
     connect_data_.passphrase = user_passphrase;
     RequestVirtualNetwork(service_name.c_str(),
                           server.c_str(),
                           kProviderL2tpIpsec,
                           VPNServiceUpdateAndConnect,
                           this);
   }
 
+  virtual void ConnectToVirtualNetworkCert(
+      const std::string& service_name,
+      const std::string& server_hostname,
+      const std::string& client_cert_id,
+      const std::string& username,
+      const std::string& user_passphrase) {
+    if (!EnsureCrosLoaded())
+      return;
+    // Store the connection data to be used by the callback.
+    connect_data_.service_name = service_name;
+    connect_data_.server_hostname = server_hostname;
+    connect_data_.vpn_client_cert_pkcs11_id = client_cert_id;
+    connect_data_.psk_username = username;
+    connect_data_.passphrase = user_passphrase;
+    RequestVirtualNetwork(service_name.c_str(),
+                          server_hostname.c_str(),
+                          kProviderL2tpIpsec,
+                          VPNServiceUpdateAndConnect,
+                          this);
+  }
+
   // Callback
   static void VPNServiceUpdateAndConnect(void* object,
                                          const char* service_path,
                                          const Value* info) {
     NetworkLibraryImpl* networklib = static_cast<NetworkLibraryImpl*>(object);
     DCHECK(networklib);
     if (service_path && info) {
       VLOG(1) << "Connecting to new VPN Service: " << service_path;
       DCHECK_EQ(info->GetType(), Value::TYPE_DICTIONARY);
       const DictionaryValue* dict = static_cast<const DictionaryValue*>(info);
@@ skipping 11 matching lines @@
     ConnectData& data = connect_data_;
     if (vpn->name() != data.service_name) {
       LOG(WARNING) << "Virtual network name does not match ConnectData: "
                    << vpn->name() << " != " << data.service_name;
       return;
     }
 
     vpn->set_added(true);
     if (!data.server_hostname.empty())
       vpn->set_server_hostname(data.server_hostname);
-    vpn->SetCACert("");
-    vpn->SetUserCert("");
-    vpn->SetUserCertKey("");
+    vpn->SetCACertNSS("");
+    vpn->SetClientCertID(data.vpn_client_cert_pkcs11_id);
     vpn->SetPSKPassphrase(data.psk_key);
     vpn->SetUsername(data.psk_username);
     vpn->SetUserPassphrase(data.passphrase);
 
     CallConnectToNetwork(vpn);
   }
 
   virtual void DisconnectFromNetwork(const Network* network) {
     DCHECK(network);
     if (!EnsureCrosLoaded() || !network)
@@ skipping 1437 matching lines @@
     EAPPhase2Auth eap_auth;
     std::string eap_server_ca_cert_nss_nickname;
     bool eap_use_system_cas;
     std::string eap_client_cert_pkcs11_id;
     std::string eap_identity;
     std::string eap_anonymous_identity;
     bool save_credentials;
     std::string psk_key;
     std::string psk_username;
     std::string server_hostname;
+    std::string vpn_client_cert_pkcs11_id;
   };
   ConnectData connect_data_;
 
   DISALLOW_COPY_AND_ASSIGN(NetworkLibraryImpl);
 };
 
 class NetworkLibraryStubImpl : public NetworkLibrary {
  public:
   NetworkLibraryStubImpl()
       : ip_address_("1.1.1.1"),
@@ skipping 126 matching lines @@
       const std::string& passphrase,
       bool save_credentials) {}
   virtual void ConnectToCellularNetwork(CellularNetwork* network) {}
   virtual void ConnectToVirtualNetwork(VirtualNetwork* network) {}
   virtual void ConnectToVirtualNetworkPSK(
       const std::string& service_name,
       const std::string& server,
       const std::string& psk,
       const std::string& username,
       const std::string& user_passphrase) {}
+  virtual void ConnectToVirtualNetworkCert(
+      const std::string& service_name,
+      const std::string& server_hostname,
+      const std::string& client_cert_id,
+      const std::string& username,
+      const std::string& user_passphrase) {}
   virtual void SignalCellularPlanPayment() {}
   virtual bool HasRecentCellularPlanPayment() { return false; }
   virtual void DisconnectFromNetwork(const Network* network) {}
   virtual void ForgetWifiNetwork(const std::string& service_path) {}
   virtual std::string GetCellularHomeCarrierId() const { return std::string(); }
   virtual bool ethernet_available() const { return true; }
   virtual bool wifi_available() const { return false; }
   virtual bool cellular_available() const { return false; }
   virtual bool ethernet_enabled() const { return true; }
   virtual bool wifi_enabled() const { return false; }
@@ skipping 30 matching lines @@
     return new NetworkLibraryStubImpl();
   else
     return new NetworkLibraryImpl();
 }
 
 }  // namespace chromeos
 
 // Allows InvokeLater without adding refcounting. This class is a Singleton and
 // won't be deleted until it's last InvokeLater is run.
 DISABLE_RUNNABLE_METHOD_REFCOUNT(chromeos::NetworkLibraryImpl);