Verify certificate of Privet v3 device

chrome/browser/local_discovery/privetv3_session.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/local_discovery/privetv3_session.h"
 
 #include "base/base64.h"
 #include "base/json/json_writer.h"
 #include "base/location.h"
 #include "base/logging.h"
@@ skipping 26 matching lines @@
 const char kPrivetV3KeyClientCommitment[] = "clientCommitment";
 const char kPrivetV3KeyCrypto[] = "crypto";
 const char kPrivetV3KeyDeviceCommitment[] = "deviceCommitment";
 const char kPrivetV3KeyMode[] = "mode";
 const char kPrivetV3KeyPairing[] = "pairing";
 const char kPrivetV3KeyRequestedScope[] = "requestedScope";
 const char kPrivetV3KeyScope[] = "scope";
 const char kPrivetV3KeySessionId[] = "sessionId";
 const char kPrivetV3KeyTokenType[] = "tokenType";
 
+const char kPrivetV3InfoHttpsPort[] = "endpoints.httpsPort";
+
 const char kPrivetV3PairingStartPath[] = "/privet/v3/pairing/start";
 const char kPrivetV3PairingConfirmPath[] = "/privet/v3/pairing/confirm";
 const char kPrivetV3PairingCancelPath[] = "/privet/v3/pairing/cancel";
 const char kPrivetV3AuthPath[] = "/privet/v3/auth";
 
 const char kUrlPlaceHolder[] = "http://host/";
 
-const int kUrlFetcherTimeoutSec = 30;
+const int kUrlFetcherTimeoutSec = 60;
 
 GURL CreatePrivetURL(const std::string& path) {
   GURL url(kUrlPlaceHolder);
   GURL::Replacements replacements;
   replacements.SetPathStr(path);
   return url.ReplaceComponents(replacements);
 }
 
 using PairingType = PrivetV3Session::PairingType;
 
@@ skipping 70 matching lines @@
 }
 
 std::string PrivetV3Session::FetcherDelegate::GetAuthToken() {
   return auth_token_;
 }
 
 void PrivetV3Session::FetcherDelegate::OnNeedPrivetToken(
     PrivetURLFetcher* fetcher,
     const PrivetURLFetcher::TokenCallback& callback) {
   NOTREACHED();
-  OnError(fetcher, PrivetURLFetcher::URL_FETCH_ERROR);
+  OnError(fetcher, PrivetURLFetcher::UNKNOWN_ERROR);
 }
 
 void PrivetV3Session::FetcherDelegate::OnError(
     PrivetURLFetcher* fetcher,
     PrivetURLFetcher::ErrorType error) {
   LOG(ERROR) << "PrivetURLFetcher url: " << fetcher->url()
              << ", error: " << error
              << ", response code: " << fetcher->response_code();
   ReplyAndDestroyItself(Result::STATUS_CONNECTIONERROR,
                         base::DictionaryValue());
@@ skipping 51 matching lines @@
 PrivetV3Session::PrivetV3Session(scoped_ptr<PrivetHTTPClient> client)
     : client_(client.Pass()), weak_ptr_factory_(this) {
 }
 
 PrivetV3Session::~PrivetV3Session() {
   Cancel();
 }
 
 void PrivetV3Session::Init(const InitCallback& callback) {
   DCHECK(fetchers_.empty());
-  DCHECK(fingerprint_.empty());
+  DCHECK(!client_->IsInHttpsMode());
   DCHECK(session_id_.empty());
   DCHECK(privet_auth_token_.empty());
 
   privet_auth_token_ = kPrivetV3AuthAnonymous;
-
   StartGetRequest(kPrivetInfoPath,
                   base::Bind(&PrivetV3Session::OnInfoDone,
                              weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void PrivetV3Session::OnInfoDone(const InitCallback& callback,
                                  Result result,
                                  const base::DictionaryValue& response) {
   if (result != Result::STATUS_SUCCESS)
     return callback.Run(result, response);
@@ skipping 14 matching lines @@
   }
 
   // The only supported crypto.
   if (!ContainsString(*authentication, kPrivetV3KeyCrypto,
                       kPrivetV3CryptoP224Spake2) ||
       !ContainsString(*authentication, kPrivetV3KeyMode, kPrivetV3KeyPairing)) {
     LOG(ERROR) << "Response: " << response;
     return callback.Run(Result::STATUS_SESSIONERROR, response);
   }
 
+  int port = 0;
+  if (!response.GetInteger(kPrivetV3InfoHttpsPort, &port) || port <= 0 ||
+      port > std::numeric_limits<uint16_t>::max()) {
+    LOG(ERROR) << "Response: " << response;
+    return callback.Run(Result::STATUS_SESSIONERROR, response);
+  }
+  https_port_ = port;
+
   callback.Run(Result::STATUS_SUCCESS, response);
 }
 
 void PrivetV3Session::StartPairing(PairingType pairing_type,
                                    const ResultCallback& callback) {
   base::DictionaryValue input;
   input.SetString(kPrivetV3KeyPairing,
                   extensions::api::gcd_private::ToString(pairing_type));
   input.SetString(kPrivetV3KeyCrypto, kPrivetV3CryptoP224Spake2);
 
@@ skipping 49 matching lines @@
     const ResultCallback& callback,
     Result result,
     const base::DictionaryValue& response) {
   if (result != Result::STATUS_SUCCESS)
     return callback.Run(result);
 
   std::string fingerprint;
   std::string signature;
   if (!GetDecodedString(response, kPrivetV3KeyCertFingerprint, &fingerprint) ||
       !GetDecodedString(response, kPrivetV3KeyCertSignature, &signature)) {
-    LOG(ERROR) << "Response: " << response;
+    LOG(ERROR) << "Invalid response: " << response;
     return callback.Run(Result::STATUS_SESSIONERROR);
   }
 
+  net::SHA256HashValue hash;
+  if (fingerprint.size() != sizeof(hash.data)) {
+    LOG(ERROR) << "Invalid fingerprint size: " << response;
+    return callback.Run(Result::STATUS_SESSIONERROR);
+  }
+  memcpy(hash.data, fingerprint.data(), sizeof(hash.data));
+
   crypto::HMAC hmac(crypto::HMAC::SHA256);
   // Key will be verified below, using HMAC.
   const std::string& key = spake_->GetUnverifiedKey();
   if (!hmac.Init(reinterpret_cast<const unsigned char*>(key.c_str()),
                  key.size()) ||
       !hmac.Verify(fingerprint, signature)) {
-    LOG(ERROR) << "Response: " << response;
-    return callback.Run(Result::STATUS_SESSIONERROR);
+    LOG(ERROR) << "Verification failed: " << response;
+    return callback.Run(Result::STATUS_BADPAIRINGCODEERROR);
   }
 
   std::string auth_code(hmac.DigestLength(), ' ');
   if (!hmac.Sign(session_id_,
                  reinterpret_cast<unsigned char*>(string_as_array(&auth_code)),
                  auth_code.size())) {
     LOG(FATAL) << "Signing failed";
     return callback.Run(Result::STATUS_SESSIONERROR);
   }
-  // From now this is expected certificate.
-  fingerprint_ = fingerprint;
+
+  // From now use only https with fixed certificate.
+  VLOG(1) << "Expected certificate: " << fingerprint;
+  client_->SwitchToHttps(https_port_, hash);
 
   std::string auth_code_base64;
   base::Base64Encode(auth_code, &auth_code_base64);
 
   base::DictionaryValue input;
   input.SetString(kPrivetV3KeyAuthCode, auth_code_base64);
   input.SetString(kPrivetV3KeyMode, kPrivetV3KeyPairing);
   input.SetString(kPrivetV3KeyRequestedScope, kPrivetV3Auto);
 
   // Now we can use SendMessage with certificate validation.
@@ skipping 20 matching lines @@
   }
 
   privet_auth_token_ = token_type + " " + access_token;
 
   return callback.Run(Result::STATUS_SUCCESS);
 }
 
 void PrivetV3Session::SendMessage(const std::string& api,
                                   const base::DictionaryValue& input,
                                   const MessageCallback& callback) {
-  // TODO(vitalybuka): Implement validating HTTPS certificate using
-  // fingerprint_.
-  if (fingerprint_.empty()) {
+  if (!client_->IsInHttpsMode()) {
     LOG(ERROR) << "Session is not paired";
     return callback.Run(Result::STATUS_SESSIONERROR, base::DictionaryValue());
   }
 
   StartPostRequest(api, input, callback);
 }
 
 void PrivetV3Session::RunCallback(const base::Closure& callback) {
   callback.Run();
 }
@@ skipping 30 matching lines @@
   return fetcher->CreateURLFetcher(CreatePrivetURL(api), request_type,
                                    orphaned);
 }
 
 void PrivetV3Session::DeleteFetcher(const FetcherDelegate* fetcher) {
   fetchers_.erase(std::find(fetchers_.begin(), fetchers_.end(), fetcher));
 }
 
 void PrivetV3Session::Cancel() {
   // Cancel started unconfirmed sessions.
-  if (session_id_.empty() || !fingerprint_.empty())
+  if (session_id_.empty() || client_->IsInHttpsMode())
     return;
   base::DictionaryValue input;
   input.SetString(kPrivetV3KeySessionId, session_id_);
   StartPostRequest(kPrivetV3PairingCancelPath, input, MessageCallback());
 }
 
 }  // namespace local_discovery