Support tls-server-end-point channel bindings for HTTP authentication.

net/http/http_auth_sspi_win.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See "SSPI Sample Application" at
 // http://msdn.microsoft.com/en-us/library/aa918273.aspx
 
 #include "net/http/http_auth_sspi_win.h"
 
 #include "base/base64.h"
@@ skipping 274 matching lines @@
   if (!SecIsValidHandle(&ctxt_)) {
     return net::ParseFirstRoundChallenge(scheme_, tok);
   }
   std::string encoded_auth_token;
   return net::ParseLaterRoundChallenge(scheme_, tok, &encoded_auth_token,
                                        &decoded_server_auth_token_);
 }
 
 int HttpAuthSSPI::GenerateAuthToken(const AuthCredentials* credentials,
                                     const std::string& spn,
+                                    const std::string& channel_bindings,
                                     std::string* auth_token,
                                     const CompletionCallback& /*callback*/) {
   // Initial challenge.
   if (!SecIsValidHandle(&cred_)) {
     int rv = OnFirstRound(credentials);
     if (rv != OK)
       return rv;
   }
 
   DCHECK(SecIsValidHandle(&cred_));
   void* out_buf;
   int out_buf_len;
   int rv = GetNextSecurityToken(
-      spn,
-      static_cast<void *>(const_cast<char *>(
-          decoded_server_auth_token_.c_str())),
-      decoded_server_auth_token_.length(),
-      &out_buf,
-      &out_buf_len);
+      spn, channel_bindings,
+      static_cast<void*>(const_cast<char*>(decoded_server_auth_token_.c_str())),
+      decoded_server_auth_token_.length(), &out_buf, &out_buf_len);
   if (rv != OK)
     return rv;
 
   // Base64 encode data in output buffer and prepend the scheme.
   std::string encode_input(static_cast<char*>(out_buf), out_buf_len);
   std::string encode_output;
   base::Base64Encode(encode_input, &encode_output);
   // OK, we are done with |out_buf|
   free(out_buf);
   *auth_token = scheme_ + " " + encode_output;
@@ skipping 13 matching lines @@
       return rv;
   } else {
     rv = AcquireDefaultCredentials(library_, security_package_, &cred_);
     if (rv != OK)
       return rv;
   }
 
   return rv;
 }
 
-int HttpAuthSSPI::GetNextSecurityToken(
-    const std::string& spn,
-    const void* in_token,
-    int in_token_len,
-    void** out_token,
-    int* out_token_len) {
-  CtxtHandle* ctxt_ptr;
+int HttpAuthSSPI::GetNextSecurityToken(const std::string& spn,
+                                       const std::string& channel_bindings,
+                                       const void* in_token,
+                                       int in_token_len,
+                                       void** out_token,
+                                       int* out_token_len) {
+  CtxtHandle* ctxt_ptr = nullptr;
   SecBufferDesc in_buffer_desc, out_buffer_desc;
-  SecBufferDesc* in_buffer_desc_ptr;
-  SecBuffer in_buffer, out_buffer;
+  SecBufferDesc* in_buffer_desc_ptr = nullptr;
+  SecBuffer in_buffers[2], out_buffer;
 
+  in_buffer_desc.ulVersion = SECBUFFER_VERSION;
+  in_buffer_desc.cBuffers = 0;
+  in_buffer_desc.pBuffers = in_buffers;
   if (in_token_len > 0) {
     // Prepare input buffer.
-    in_buffer_desc.ulVersion = SECBUFFER_VERSION;
-    in_buffer_desc.cBuffers = 1;
-    in_buffer_desc.pBuffers = &in_buffer;
-    in_buffer.BufferType = SECBUFFER_TOKEN;
-    in_buffer.cbBuffer = in_token_len;
-    in_buffer.pvBuffer = const_cast<void*>(in_token);
+    SecBuffer& sec_buffer = in_buffers[in_buffer_desc.cBuffers++];
+    sec_buffer.BufferType = SECBUFFER_TOKEN;
+    sec_buffer.cbBuffer = in_token_len;
+    sec_buffer.pvBuffer = const_cast<void*>(in_token);
     ctxt_ptr = &ctxt_;
-    in_buffer_desc_ptr = &in_buffer_desc;
   } else {
     // If there is no input token, then we are starting a new authentication
     // sequence.  If we have already initialized our security context, then
     // we're incorrectly reusing the auth handler for a new sequence.
     if (SecIsValidHandle(&ctxt_)) {
       NOTREACHED();
       return ERR_UNEXPECTED;
     }
-    ctxt_ptr = NULL;
-    in_buffer_desc_ptr = NULL;
   }
 
+  std::vector<char> sec_channel_bindings_buffer;
+  if (!channel_bindings.empty()) {
+    sec_channel_bindings_buffer.reserve(sizeof(SEC_CHANNEL_BINDINGS) +
+                                        channel_bindings.size());
+    sec_channel_bindings_buffer.resize(sizeof(SEC_CHANNEL_BINDINGS));
+    SEC_CHANNEL_BINDINGS* bindings_desc =
+        reinterpret_cast<SEC_CHANNEL_BINDINGS*>(
+            &sec_channel_bindings_buffer.front());
+    bindings_desc->cbApplicationDataLength = channel_bindings.size();
+    bindings_desc->dwApplicationDataOffset = sizeof(SEC_CHANNEL_BINDINGS);
+    DCHECK_EQ(0u, bindings_desc->dwInitiatorAddrType);
+    DCHECK_EQ(0u, bindings_desc->cbInitiatorLength);
+    DCHECK_EQ(0u, bindings_desc->dwInitiatorOffset);
+    DCHECK_EQ(0u, bindings_desc->dwAcceptorAddrType);
+    DCHECK_EQ(0u, bindings_desc->cbAcceptorLength);
+    DCHECK_EQ(0u, bindings_desc->dwAcceptorOffset);

[Ryan Sleevi, 2016/03/18 21:27:40]

Why these DCHECKs? This is guaranteed by 378/380

[asanka, 2016/03/23 04:51:30]

Removed.

+    sec_channel_bindings_buffer.insert(sec_channel_bindings_buffer.end(),
+                                       channel_bindings.begin(),
+                                       channel_bindings.end());
+    DCHECK_EQ(sizeof(SEC_CHANNEL_BINDINGS) + channel_bindings.size(),
+              sec_channel_bindings_buffer.size());
+
+    SecBuffer& sec_buffer = in_buffers[in_buffer_desc.cBuffers++];
+    sec_buffer.BufferType = SECBUFFER_CHANNEL_BINDINGS;
+    sec_buffer.cbBuffer = sec_channel_bindings_buffer.size();
+    sec_buffer.pvBuffer = &sec_channel_bindings_buffer.front();
+  }
+
+  if (in_buffer_desc.cBuffers > 0)
+    in_buffer_desc_ptr = &in_buffer_desc;
+
   // Prepare output buffer.
   out_buffer_desc.ulVersion = SECBUFFER_VERSION;
   out_buffer_desc.cBuffers = 1;
   out_buffer_desc.pBuffers = &out_buffer;
   out_buffer.BufferType = SECBUFFER_TOKEN;
   out_buffer.cbBuffer = max_token_length_;
   out_buffer.pvBuffer = malloc(out_buffer.cbBuffer);
   if (!out_buffer.pvBuffer)
     return ERR_OUT_OF_MEMORY;
 
@@ skipping 64 matching lines @@
   int token_length = pkg_info->cbMaxToken;
   status = library->FreeContextBuffer(pkg_info);
   rv = MapFreeContextBufferStatusToError(status);
   if (rv != OK)
     return rv;
   *max_token_length = token_length;
   return OK;
 }
 
 }  // namespace net