Move SSL layer initialization into ChannelAuthenticator implementations.

remoting/protocol/simple_host_channel_authenticator.cc

Index: remoting/protocol/simple_host_channel_authenticator.cc
diff --git a/remoting/protocol/simple_host_channel_authenticator.cc b/remoting/protocol/simple_host_channel_authenticator.cc
new file mode 100644
index 0000000000000000000000000000000000000000..897d461da2378086d80660215c2df848bffae02b
--- /dev/null
+++ b/remoting/protocol/simple_host_channel_authenticator.cc
@@ -0,0 +1,147 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/protocol/simple_host_channel_authenticator.h"
+
+#include "crypto/rsa_private_key.h"
+#include "net/base/io_buffer.h"
+#include "net/base/net_errors.h"
+#include "net/base/ssl_config_service.h"
+#include "net/socket/ssl_server_socket.h"

[Wez, 2011/11/22 22:29:48]

Move this below x509_certificate.h

[Sergey Ulanov, 2011/11/23 01:23:42]

Done.

+#include "net/base/x509_certificate.h"
+#include "remoting/protocol/auth_util.h"
+
+namespace remoting {
+namespace protocol {
+
+SimpleHostChannelAuthenticator::SimpleHostChannelAuthenticator(
+    const std::string& local_cert,
+    crypto::RSAPrivateKey* local_private_key,
+    const std::string& shared_secret)
+    : local_cert_(local_cert),
+      local_private_key_(local_private_key),
+      shared_secret_(shared_secret),
+      socket_(NULL),
+      ALLOW_THIS_IN_INITIALIZER_LIST(connect_callback_(
+          this, &SimpleHostChannelAuthenticator::OnConnected)),
+      ALLOW_THIS_IN_INITIALIZER_LIST(auth_read_callback_(
+          this, &SimpleHostChannelAuthenticator::OnAuthBytesRead)) {
+}
+
+SimpleHostChannelAuthenticator::~SimpleHostChannelAuthenticator() {
+}
+
+void SimpleHostChannelAuthenticator::SecureAndAuthenticate(
+    net::StreamSocket* socket, const DoneCallback& done_callback) {
+  DCHECK(CalledOnValidThread());
+
+  scoped_ptr<net::StreamSocket> channel_socket(socket);
+  done_callback_ = done_callback;
+
+  scoped_refptr<net::X509Certificate> cert =
+      net::X509Certificate::CreateFromBytes(
+          local_cert_.data(), local_cert_.length());
+  if (!cert) {
+    LOG(ERROR) << "Failed to parse X509Certificate";
+    done_callback.Run(net::ERR_FAILED, NULL);
+    return;
+  }
+
+  // Create server SSL socket.

[Wez, 2011/11/22 22:29:48]

nit: This comment's a bit redundant...

[Sergey Ulanov, 2011/11/23 01:23:42]

Done.

+  net::SSLConfig ssl_config;
+  socket_.reset(net::CreateSSLServerSocket(
+      channel_socket.release(), cert, local_private_key_, ssl_config));
+
+  int result = socket_->Handshake(&connect_callback_);
+  if (result == net::ERR_IO_PENDING) {
+    return;
+  }
+  OnConnected(result);
+}
+
+void SimpleHostChannelAuthenticator::OnConnected(int result) {
+  if (result != net::OK) {
+    LOG(ERROR) << "Failed to establish SSL connection";
+    done_callback_.Run(static_cast<net::Error>(result), NULL);
+  }
+
+  unsigned char key_material[kAuthDigestLength];
+  int export_result = socket_->ExportKeyingMaterial(
+      kClientAuthSslExporterLabel, "", key_material, kAuthDigestLength);
+  if (export_result != net::OK) {
+    LOG(ERROR) << "Error fetching keying material: " << export_result;
+    done_callback_.Run(static_cast<net::Error>(export_result), NULL);
+    return;
+  }
+
+  if (!GetAuthBytes(shared_secret_,
+                    std::string(key_material, key_material + kAuthDigestLength),
+                    &auth_bytes_)) {
+    done_callback_.Run(net::ERR_FAILED, NULL);
+    return;
+  }
+
+  // Read an authentication digest.
+  auth_read_buf_ = new net::GrowableIOBuffer();
+  auth_read_buf_->SetCapacity(kAuthDigestLength);
+  DoAuthRead();
+}
+
+void SimpleHostChannelAuthenticator::DoAuthRead() {
+  while (true) {
+    int result = socket_->Read(auth_read_buf_,
+                               auth_read_buf_->RemainingCapacity(),
+                               &auth_read_callback_);
+    if (result == net::ERR_IO_PENDING)
+      break;
+    if (!HandleAuthBytesRead(result))
+      break;
+  }
+}
+
+void SimpleHostChannelAuthenticator::OnAuthBytesRead(int result) {
+  DCHECK(CalledOnValidThread());
+
+  if (HandleAuthBytesRead(result))
+    DoAuthRead();
+}
+
+bool SimpleHostChannelAuthenticator::HandleAuthBytesRead(int read_result) {
+  if (read_result <= 0) {
+    LOG(ERROR) << "Error reading authentication: " << read_result;

[Wez, 2011/11/22 22:29:48]

nit: Don't really need this logging, or the preceding instances

[Sergey Ulanov, 2011/11/23 01:23:42]

Done.

+    done_callback_.Run(static_cast<net::Error>(read_result), NULL);
+    return false;
+  }
+
+  auth_read_buf_->set_offset(auth_read_buf_->offset() + read_result);
+  if (auth_read_buf_->RemainingCapacity() > 0)
+    return true;
+
+  if (!VerifyAuthBytes(std::string(
+          auth_read_buf_->StartOfBuffer(),
+          auth_read_buf_->StartOfBuffer() + kAuthDigestLength))) {
+    LOG(ERROR) << "Mismatched authentication";

[Wez, 2011/11/22 22:29:48]

nit: Make this a warning, or remove it?  Is there a better error-code we can
return?

[Sergey Ulanov, 2011/11/23 01:23:42]

Done.

+    done_callback_.Run(net::ERR_FAILED, NULL);
+    return false;
+  }
+
+  done_callback_.Run(net::OK, socket_.release());
+  return false;
+}
+
+bool SimpleHostChannelAuthenticator::VerifyAuthBytes(
+    const std::string& received_auth_bytes) {
+  DCHECK(received_auth_bytes.length() == kAuthDigestLength);
+
+  // Compare the received and expected digests in fixed time, to limit the
+  // scope for timing attacks.
+  uint8 result = 0;
+  for (unsigned i = 0; i < auth_bytes_.length(); i++) {
+    result |= received_auth_bytes[i] ^ auth_bytes_[i];

[Ryan Sleevi, 2011/11/19 19:45:26]

nit: See crypto/secure_util.h -> crypto::SecureMemEqual

[Sergey Ulanov, 2011/11/22 02:49:18]

Done.

+  }
+  return result == 0;
+}
+
+}  // namespace protocol
+}  // namespace remoting