Add method GetKeyFromSystem to WiFiService on Windows and Mac.

components/wifi/wifi_service_mac.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/wifi/wifi_service.h"
 
 #import <netinet/in.h>
 #import <CoreWLAN/CoreWLAN.h>
 #import <SystemConfiguration/SystemConfiguration.h>
 
@@ skipping 79 matching lines @@
                                   base::ListValue* network_list) OVERRIDE;
 
   virtual void RequestNetworkScan() OVERRIDE;
 
   virtual void StartConnect(const std::string& network_guid,
                             std::string* error) OVERRIDE;
 
   virtual void StartDisconnect(const std::string& network_guid,
                                std::string* error) OVERRIDE;
 
+  virtual void GetKeyFromSystem(const std::string& network_guid,
+                                bool get_plaintext_key,
+                                std::string* key_data,
+                                std::string* error) OVERRIDE;
+
   virtual void SetEventObservers(
       scoped_refptr<base::MessageLoopProxy> message_loop_proxy,
       const NetworkGuidListCallback& networks_changed_observer,
       const NetworkGuidListCallback& network_list_changed_observer) OVERRIDE;
 
   virtual void RequestConnectedNetworkUpdate() OVERRIDE;
 
  private:
   // Checks |ns_error| and if is not |nil|, then stores |error_name|
   // into |error|.
@@ skipping 250 matching lines @@
     NSError* ns_error = nil;
     [interface_ setPower:NO error:&ns_error];
     CheckError(ns_error, kErrorAssociateToNetwork, error);
     [interface_ setPower:YES error:&ns_error];
     CheckError(ns_error, kErrorAssociateToNetwork, error);
   } else {
     *error = kErrorNotConnected;
   }
 }
 
+void WiFiServiceMac::GetKeyFromSystem(const std::string& network_guid,
+                                      bool get_plaintext_key,
+                                      std::string* key_data,
+                                      std::string* error) {
+  const char kAirPortServiceName[] = "AirPort";

[arw, 2014/02/06 20:51:30]

Probably could be static?

[mef, 2014/02/06 21:53:43]

Done.

+
+  UInt32 password_length = 0;
+  void *password_data = nil;

[arw, 2014/02/06 20:51:30]

Not super familiar with ObjC++... but should password_data be initialized to
NULL? Was under the impression that nil was reserved for using with ids?

[mef, 2014/02/06 21:53:43]

Done.

+  OSStatus status = noErr;
+  if (get_plaintext_key) {
+    status = SecKeychainFindGenericPassword(NULL,
+                                            strlen(kAirPortServiceName),
+                                            kAirPortServiceName,
+                                            network_guid.length(),
+                                            network_guid.c_str(),
+                                            &password_length,
+                                            &password_data,
+                                            NULL);
+  } else {
+    status = SecKeychainFindGenericPassword(NULL,
+                                            strlen(kAirPortServiceName),
+                                            kAirPortServiceName,
+                                            network_guid.length(),
+                                            network_guid.c_str(),
+                                            NULL,
+                                            NULL,
+                                            NULL);

[arw, 2014/02/06 20:51:30]

Do you mean to pass in an itemRef here and derive key_data from that?
password_data is not set here, so key_data will not get set below.

[mef, 2014/02/06 21:53:43]

Good point. My idea was to have a method of checking whether there is a key
stored in the system without bringing up the privilege elevation prompt. Windows
API can return the key protected by system key, do you know whether there is
something similar on Mac? In my test if I pass an itemRef, then I get the
keychain unlock prompt.

[arw, 2014/02/07 23:25:29]

Yeah, it is possible to see if the password exists. Try this snippet of code:

+ (BOOL)isPasswordAvailable:(NSString *)network {
  if (network) {
    NSDictionary *query;
    query = [NSDictionary dictionaryWithObjectsAndKeys:
             kSecClassGenericPassword, kSecClass,
             network, kSecAttrAccount,
             kCFBooleanTrue, kSecReturnRef,
             nil];

    CFDataRef data;
    OSStatus status = SecItemCopyMatching((CFDictionaryRef)query,
                                          (void *)&data);
    [(id) data autorelease];
    return status == errSecSuccess ? YES : NO;
  }
  return NO;
}

On 2014/02/06 21:53:43, mef wrote:

[mef, 2014/02/12 16:29:37]

Done. SecKeychainFindGenericPassword with NULL output parameters seemed to work
for detection as well.

[arw, 2014/02/12 17:41:50]

Okay, I think I understand now. My final suggestion is to make this method a
little more explicit about what it does (an "exists" parameter, or even perhaps
breaking this out into 2 methods). Also, it's also not quite clear from the
comment on this function that it is checking for the presence of a password if
get_plaintext_key is false. From reading the method description - it sounds like
the method would attempt to retrieve the password without privilege elevation if
get_plaintext_key is not set to true.

On 2014/02/12 16:29:37, mef wrote:

[mef, 2014/02/12 22:26:21]

Done. There is no immediate need for key existence checking method, so I've just
removed 'get_plaintext_key' parameter and will consider adding a separate method
later if necessary.

+  }
+
+  if (status != noErr) {
+    *error = kErrorNotFound;
+    return;
+  }
+
+  if (password_data) {
+    *key_data = std::string(reinterpret_cast<char*>(password_data),
+                            password_length);
+    SecKeychainItemFreeContent(NULL, password_data);
+  }
+}
+
 void WiFiServiceMac::SetEventObservers(
     scoped_refptr<base::MessageLoopProxy> message_loop_proxy,
     const NetworkGuidListCallback& networks_changed_observer,
     const NetworkGuidListCallback& network_list_changed_observer) {
   message_loop_proxy_.swap(message_loop_proxy);
   networks_changed_observer_ = networks_changed_observer;
   network_list_changed_observer_ = network_list_changed_observer;
 
   // Remove previous OS notifications observer.
   if (wlan_observer_) {
@@ skipping 214 matching lines @@
   NetworkGuidList changed_networks(1, network_guid);
   message_loop_proxy_->PostTask(
       FROM_HERE,
       base::Bind(networks_changed_observer_, changed_networks));
 }
 
 // static
 WiFiService* WiFiService::Create() { return new WiFiServiceMac(); }
 
 }  // namespace wifi