PairingAuthenticator implementation and plumbing.

remoting/protocol/negotiating_host_authenticator.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/protocol/negotiating_host_authenticator.h"
 
 #include <algorithm>
 #include <sstream>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/strings/string_split.h"
 #include "remoting/base/rsa_key_pair.h"
 #include "remoting/protocol/channel_authenticator.h"
+#include "remoting/protocol/pairing_host_authenticator.h"
+#include "remoting/protocol/pairing_registry.h"
 #include "remoting/protocol/v2_authenticator.h"
 #include "third_party/libjingle/source/talk/xmllite/xmlelement.h"
 
 namespace remoting {
 namespace protocol {
 
 NegotiatingHostAuthenticator::NegotiatingHostAuthenticator(
     const std::string& local_cert,
     scoped_refptr<RsaKeyPair> key_pair)
     : NegotiatingAuthenticatorBase(WAITING_MESSAGE),
       local_cert_(local_cert),
       local_key_pair_(key_pair) {
 }
 
 // static
 scoped_ptr<Authenticator> NegotiatingHostAuthenticator::CreateWithSharedSecret(
     const std::string& local_cert,
     scoped_refptr<RsaKeyPair> key_pair,
     const std::string& shared_secret_hash,
-    AuthenticationMethod::HashFunction hash_function) {
+    AuthenticationMethod::HashFunction hash_function,
+    scoped_refptr<PairingRegistry> pairing_registry) {
   scoped_ptr<NegotiatingHostAuthenticator> result(
       new NegotiatingHostAuthenticator(local_cert, key_pair));
   result->shared_secret_hash_ = shared_secret_hash;
+  result->pairing_registry_ = pairing_registry;
   result->AddMethod(AuthenticationMethod::Spake2(hash_function));
+  if (pairing_registry) {
+    result->AddMethod(AuthenticationMethod::Spake2Pair());
+  }
   return scoped_ptr<Authenticator>(result.Pass());
 }
 
 // static
 scoped_ptr<Authenticator>
 NegotiatingHostAuthenticator::CreateWithThirdPartyAuth(
     const std::string& local_cert,
     scoped_refptr<RsaKeyPair> key_pair,
     scoped_ptr<ThirdPartyHostAuthenticator::TokenValidator> token_validator) {
   scoped_ptr<NegotiatingHostAuthenticator> result(
@@ skipping 15 matching lines @@
   AuthenticationMethod method = AuthenticationMethod::FromString(method_attr);
 
   // If the host has already chosen a method, it can't be changed by the client.
   if (current_method_.is_valid() && method != current_method_) {
     state_ = REJECTED;
     rejection_reason_ = PROTOCOL_ERROR;
     resume_callback.Run();
     return;
   }
 
-  // If the client did not specify auth method or specified unknown method,
-  // then select the first known method from the supported-methods attribute.
+  // If the client did not specify auth method or specified an unknown

[Wez, 2013/05/18 20:08:36]

nit: comma between 'method' and 'or'

[Wez, 2013/05/18 20:08:36]

nit: ".. specify a preferred auth method ..." ?

[Jamie, 2013/05/21 01:24:34]

Done.

[Jamie, 2013/05/21 01:24:34]

Done.

+  // or unsupported method, then select the first known method from
+  // the supported-methods attribute.
   if (!method.is_valid() ||
       std::find(methods_.begin(), methods_.end(), method) == methods_.end()) {
     method = AuthenticationMethod::Invalid();
 
     std::string supported_methods_attr =
         message->Attr(kSupportedMethodsAttributeQName);
     if (supported_methods_attr.empty()) {
       // Message contains neither method nor supported-methods attributes.
       state_ = REJECTED;
       rejection_reason_ = PROTOCOL_ERROR;
@@ skipping 61 matching lines @@
     const base::Closure& resume_callback) {
   DCHECK(current_method_.is_valid());
 
   if (current_method_.type() == AuthenticationMethod::THIRD_PARTY) {
     // |ThirdPartyHostAuthenticator| takes ownership of |token_validator_|.
     // The authentication method negotiation logic should guarantee that only
     // one |ThirdPartyHostAuthenticator| will need to be created per session.
     DCHECK(token_validator_);
     current_authenticator_.reset(new ThirdPartyHostAuthenticator(
         local_cert_, local_key_pair_, token_validator_.Pass()));
+  } else if (current_method_ == AuthenticationMethod::Spake2Pair() &&
+             preferred_initial_state == WAITING_MESSAGE) {
+    // If the client requested Spake2Pair and sent an initial message, attempt
+    // the paired connection protocol.
+    current_authenticator_.reset(new PairingHostAuthenticator(
+        pairing_registry_, local_cert_, local_key_pair_, shared_secret_hash_));
   } else {
+    // In all other cases, use the V2 protocol. Note that this includes the
+    // case where the protocol is Spake2Pair but the client is not yet paired.
+    // In this case, the on-the-wire protocol is plain Spake2, advertised as
+    // Spake2Pair so that the client knows that the host supports pairing and
+    // that it can therefore present the option to the user when they enter
+    // the PIN.
     current_authenticator_ = V2Authenticator::CreateForHost(
         local_cert_, local_key_pair_, shared_secret_hash_,
         preferred_initial_state);
   }
-
   resume_callback.Run();
 }
 
 }  // namespace protocol
 }  // namespace remoting