PairingAuthenticator implementation and plumbing.

remoting/protocol/negotiating_authenticator_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "net/base/net_errors.h"
 #include "remoting/base/rsa_key_pair.h"
 #include "remoting/protocol/authenticator_test_base.h"
 #include "remoting/protocol/channel_authenticator.h"
 #include "remoting/protocol/connection_tester.h"
 #include "remoting/protocol/negotiating_authenticator_base.h"
 #include "remoting/protocol/negotiating_client_authenticator.h"
 #include "remoting/protocol/negotiating_host_authenticator.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/libjingle/source/talk/xmllite/xmlelement.h"
 
 using testing::_;
 using testing::DeleteArg;
 using testing::SaveArg;
 
 namespace remoting {
 namespace protocol {
 
 namespace {
 
 const int kMessageSize = 100;
 const int kMessages = 1;
 
+const char kNoClientId[] = "";
+const char kTestClientId[] = "client-id";
 const char kTestHostId[] = "12345678910123456";
 
 const char kTestSharedSecret[] = "1234-1234-5678";
 const char kTestSharedSecretBad[] = "0000-0000-0001";
 
 }  // namespace
 
 class NegotiatingAuthenticatorTest : public AuthenticatorTestBase {
  public:
   NegotiatingAuthenticatorTest() {
   }
   virtual ~NegotiatingAuthenticatorTest() {
   }
 
  protected:
   void InitAuthenticators(
+      const std::string& client_id,
       const std::string& client_secret,
       const std::string& host_secret,
       AuthenticationMethod::HashFunction hash_function,
-      bool client_hmac_only) {
+      bool client_hmac_only,
+      scoped_refptr<PairingRegistry> pairing_registry) {
     std::string host_secret_hash = AuthenticationMethod::ApplyHashFunction(
         hash_function, kTestHostId, host_secret);
     host_ = NegotiatingHostAuthenticator::CreateWithSharedSecret(
-        host_cert_, key_pair_, host_secret_hash, hash_function);
+        host_cert_, key_pair_, host_secret_hash, hash_function,
+        pairing_registry);
 
     std::vector<AuthenticationMethod> methods;
+    methods.push_back(AuthenticationMethod::Spake2Pair());
     methods.push_back(AuthenticationMethod::Spake2(
         AuthenticationMethod::HMAC_SHA256));
     if (!client_hmac_only) {
       methods.push_back(AuthenticationMethod::Spake2(
           AuthenticationMethod::NONE));
     }
-    client_.reset(new NegotiatingClientAuthenticator(
+    client_as_negotiating_authenticator_ = new NegotiatingClientAuthenticator(
+        client_id, client_secret,
         kTestHostId, base::Bind(&NegotiatingAuthenticatorTest::FetchSecret,
                                 client_secret),
-        scoped_ptr<ThirdPartyClientAuthenticator::TokenFetcher>(), methods));
+        scoped_ptr<ThirdPartyClientAuthenticator::TokenFetcher>(), methods);
+    client_.reset(client_as_negotiating_authenticator_);
+  }
+
+  scoped_refptr<PairingRegistry> CreatePairingRegistry(
+      PairingRegistry::Pairing* pairings, size_t num_pairings) {
+    PairingRegistry::PairedClients clients;
+    for (size_t i = 0; i < num_pairings; ++i) {
+      clients[pairings[i].client_id] = pairings[i];
+    }
+    scoped_refptr<PairingRegistry> result(
+        new PairingRegistry(
+            scoped_ptr<PairingRegistry::Delegate>(
+                new NotImplementedPairingRegistryDelegate),
+            clients));
+    return result;
   }
 
   static void FetchSecret(
       const std::string& client_secret,
       const protocol::SecretFetchedCallback& secret_fetched_callback) {
     secret_fetched_callback.Run(client_secret);
   }
+
   void VerifyRejected(Authenticator::RejectionReason reason) {
-    ASSERT_TRUE((client_->state() == Authenticator::REJECTED &&
-                 (client_->rejection_reason() == reason)) ||
-                (host_->state() == Authenticator::REJECTED &&
-                 (host_->rejection_reason() == reason)));
+    ASSERT_TRUE(client_->state() == Authenticator::REJECTED ||
+                host_->state() == Authenticator::REJECTED);
+    if (client_->state() == Authenticator::REJECTED) {
+      ASSERT_EQ(client_->rejection_reason(), reason);
+    }
+    if (host_->state() == Authenticator::REJECTED) {
+      ASSERT_EQ(host_->rejection_reason(), reason);
+    }
   }
 
-  void VerifyAccepted() {
+  void VerifyAccepted(const AuthenticationMethod& expected_method) {
     ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
 
     ASSERT_EQ(Authenticator::ACCEPTED, host_->state());
     ASSERT_EQ(Authenticator::ACCEPTED, client_->state());
 
     client_auth_ = client_->CreateChannelAuthenticator();
     host_auth_ = host_->CreateChannelAuthenticator();
     RunChannelAuth(false);
 
     EXPECT_TRUE(client_socket_.get() != NULL);
     EXPECT_TRUE(host_socket_.get() != NULL);
 
     StreamConnectionTester tester(host_socket_.get(), client_socket_.get(),
                                   kMessageSize, kMessages);
 
     tester.Start();
     message_loop_.Run();
     tester.CheckResults();
+    EXPECT_EQ(expected_method,
+              client_as_negotiating_authenticator_->current_method());
   }
 
+  // Use a bare pointer because the storage is managed by the base class.
+  NegotiatingClientAuthenticator* client_as_negotiating_authenticator_;

[rmsousa, 2013/05/16 00:46:25]

Nit: why not just static_cast<NegotiatingAuthenticatorBase>(client_)?

[Jamie, 2013/05/16 19:30:16]

It would introduce a hidden, type-unsafe, dependency between the creation and
access of client_. It's not a big deal, but this felt like the safer approach.

+
  private:
   DISALLOW_COPY_AND_ASSIGN(NegotiatingAuthenticatorTest);
 };
 
 TEST_F(NegotiatingAuthenticatorTest, SuccessfulAuthHmac) {
   ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
-      kTestSharedSecret, kTestSharedSecret,
-      AuthenticationMethod::HMAC_SHA256, false));
-  VerifyAccepted();
+      kNoClientId, kTestSharedSecret, kTestSharedSecret,
+      AuthenticationMethod::HMAC_SHA256, false, NULL));
+  VerifyAccepted(
+      AuthenticationMethod::Spake2(AuthenticationMethod::HMAC_SHA256));
 }
 
 TEST_F(NegotiatingAuthenticatorTest, SuccessfulAuthPlain) {
   ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
-      kTestSharedSecret, kTestSharedSecret,
-      AuthenticationMethod::NONE, false));
-  VerifyAccepted();
+      kNoClientId, kTestSharedSecret, kTestSharedSecret,
+      AuthenticationMethod::NONE, false, NULL));
+  VerifyAccepted(AuthenticationMethod::Spake2(AuthenticationMethod::NONE));
 }
 
 TEST_F(NegotiatingAuthenticatorTest, InvalidSecretHmac) {
   ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
-      kTestSharedSecret, kTestSharedSecretBad,
-      AuthenticationMethod::HMAC_SHA256, false));
+      kNoClientId, kTestSharedSecret, kTestSharedSecretBad,
+      AuthenticationMethod::HMAC_SHA256, false, NULL));
   ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
 
   VerifyRejected(Authenticator::INVALID_CREDENTIALS);
 }
 
 TEST_F(NegotiatingAuthenticatorTest, InvalidSecretPlain) {
   ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
-      kTestSharedSecret, kTestSharedSecretBad,
-      AuthenticationMethod::NONE, false));
+      kNoClientId, kTestSharedSecret, kTestSharedSecretBad,
+      AuthenticationMethod::NONE, false, NULL));
   ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
 
   VerifyRejected(Authenticator::INVALID_CREDENTIALS);
 }
 
 TEST_F(NegotiatingAuthenticatorTest, IncompatibleMethods) {
   ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
-      kTestSharedSecret, kTestSharedSecretBad,
-      AuthenticationMethod::NONE, true));
+      kNoClientId, kTestSharedSecret, kTestSharedSecretBad,
+      AuthenticationMethod::NONE, true, NULL));
   ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
 
   VerifyRejected(Authenticator::PROTOCOL_ERROR);
 }
 
+TEST_F(NegotiatingAuthenticatorTest, PairingRequestedButNotSupported) {
+  ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
+      kTestClientId, kTestSharedSecret, kTestSharedSecret,
+      AuthenticationMethod::HMAC_SHA256, false, NULL));
+  ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
+  VerifyAccepted(
+      AuthenticationMethod::Spake2(AuthenticationMethod::HMAC_SHA256));
+}
+
+TEST_F(NegotiatingAuthenticatorTest, PairingSupportedButNotPaired) {
+  ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
+      kNoClientId, kTestSharedSecret, kTestSharedSecret,

[rmsousa, 2013/05/16 00:52:39]

This is only passing because the same string is being used as client secret and
PIN. In this case, teh client is currently using the ClientSecret flow, and the
host is using the PIN flow. Please define different strings for ClientSecret and
PIN.

[Jamie, 2013/05/16 19:30:16]

Ah yes. I knew there was something I intended to fix up here... Well spotted!
Fixed.

+      AuthenticationMethod::HMAC_SHA256, false,
+      CreatePairingRegistry(NULL, 0)));
+  ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
+  VerifyAccepted(AuthenticationMethod::Spake2Pair());
+}
+
+TEST_F(NegotiatingAuthenticatorTest, RevokedPairing) {
+  ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
+      kTestClientId, kTestSharedSecret, kTestSharedSecret,
+      AuthenticationMethod::HMAC_SHA256, false,
+      CreatePairingRegistry(NULL, 0)));
+  ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
+  VerifyAccepted(AuthenticationMethod::Spake2Pair());
+}
+
+TEST_F(NegotiatingAuthenticatorTest, SuccessfulPairing) {
+  PairingRegistry::Pairing pairing;
+  pairing.client_id = kTestClientId;
+  pairing.shared_secret = kTestSharedSecret;
+  ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
+      kTestClientId, kTestSharedSecret, kTestSharedSecret,
+      AuthenticationMethod::HMAC_SHA256, false,
+      CreatePairingRegistry(&pairing, 1)));
+  ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
+  VerifyAccepted(AuthenticationMethod::Spake2Pair());
+}
+
+TEST_F(NegotiatingAuthenticatorTest, FailedPairingInvalidSecret) {
+  PairingRegistry::Pairing pairing;
+  pairing.client_id = kTestClientId;
+  pairing.shared_secret = kTestSharedSecret;
+  ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
+      kTestClientId, kTestSharedSecretBad, kTestSharedSecret,
+      AuthenticationMethod::HMAC_SHA256, false,
+      CreatePairingRegistry(&pairing, 1)));
+  ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
+  VerifyRejected(Authenticator::INVALID_CREDENTIALS);
+}
+
 }  // namespace protocol
 }  // namespace remoting