Add method GetKeyFromSystem to WiFiService on Windows and Mac.

components/wifi/wifi_service_mac.mm

Index: components/wifi/wifi_service_mac.mm
diff --git a/components/wifi/wifi_service_mac.mm b/components/wifi/wifi_service_mac.mm
index ffe3846d8306de6ae7f35f424ccf8f45d2871016..6ae8820ebe15923bce1bbd8e6e114f66824487ab 100644
--- a/components/wifi/wifi_service_mac.mm
+++ b/components/wifi/wifi_service_mac.mm
@@ -97,6 +97,11 @@ class WiFiServiceMac : public WiFiService {
   virtual void StartDisconnect(const std::string& network_guid,
                                std::string* error) OVERRIDE;
 
+  virtual void GetKeyFromSystem(const std::string& network_guid,
+                                bool get_plaintext_key,
+                                std::string* key_data,
+                                std::string* error) OVERRIDE;
+
   virtual void SetEventObservers(
       scoped_refptr<base::MessageLoopProxy> message_loop_proxy,
       const NetworkGuidListCallback& networks_changed_observer,
@@ -367,6 +372,47 @@ void WiFiServiceMac::StartDisconnect(const std::string& network_guid,
   }
 }
 
+void WiFiServiceMac::GetKeyFromSystem(const std::string& network_guid,
+                                      bool get_plaintext_key,
+                                      std::string* key_data,
+                                      std::string* error) {
+  const char kAirPortServiceName[] = "AirPort";

[arw, 2014/02/06 20:51:30]

Probably could be static?

[mef, 2014/02/06 21:53:43]

Done.

+
+  UInt32 password_length = 0;
+  void *password_data = nil;

[arw, 2014/02/06 20:51:30]

Not super familiar with ObjC++... but should password_data be initialized to
NULL? Was under the impression that nil was reserved for using with ids?

[mef, 2014/02/06 21:53:43]

Done.

+  OSStatus status = noErr;
+  if (get_plaintext_key) {
+    status = SecKeychainFindGenericPassword(NULL,
+                                            strlen(kAirPortServiceName),
+                                            kAirPortServiceName,
+                                            network_guid.length(),
+                                            network_guid.c_str(),
+                                            &password_length,
+                                            &password_data,
+                                            NULL);
+  } else {
+    status = SecKeychainFindGenericPassword(NULL,
+                                            strlen(kAirPortServiceName),
+                                            kAirPortServiceName,
+                                            network_guid.length(),
+                                            network_guid.c_str(),
+                                            NULL,
+                                            NULL,
+                                            NULL);

[arw, 2014/02/06 20:51:30]

Do you mean to pass in an itemRef here and derive key_data from that?
password_data is not set here, so key_data will not get set below.

[mef, 2014/02/06 21:53:43]

Good point. My idea was to have a method of checking whether there is a key
stored in the system without bringing up the privilege elevation prompt. Windows
API can return the key protected by system key, do you know whether there is
something similar on Mac? In my test if I pass an itemRef, then I get the
keychain unlock prompt.

[arw, 2014/02/07 23:25:29]

Yeah, it is possible to see if the password exists. Try this snippet of code:

+ (BOOL)isPasswordAvailable:(NSString *)network {
  if (network) {
    NSDictionary *query;
    query = [NSDictionary dictionaryWithObjectsAndKeys:
             kSecClassGenericPassword, kSecClass,
             network, kSecAttrAccount,
             kCFBooleanTrue, kSecReturnRef,
             nil];

    CFDataRef data;
    OSStatus status = SecItemCopyMatching((CFDictionaryRef)query,
                                          (void *)&data);
    [(id) data autorelease];
    return status == errSecSuccess ? YES : NO;
  }
  return NO;
}

On 2014/02/06 21:53:43, mef wrote:

[mef, 2014/02/12 16:29:37]

Done. SecKeychainFindGenericPassword with NULL output parameters seemed to work
for detection as well.

[arw, 2014/02/12 17:41:50]

Okay, I think I understand now. My final suggestion is to make this method a
little more explicit about what it does (an "exists" parameter, or even perhaps
breaking this out into 2 methods). Also, it's also not quite clear from the
comment on this function that it is checking for the presence of a password if
get_plaintext_key is false. From reading the method description - it sounds like
the method would attempt to retrieve the password without privilege elevation if
get_plaintext_key is not set to true.

On 2014/02/12 16:29:37, mef wrote:

[mef, 2014/02/12 22:26:21]

Done. There is no immediate need for key existence checking method, so I've just
removed 'get_plaintext_key' parameter and will consider adding a separate method
later if necessary.

+  }
+
+  if (status != noErr) {
+    *error = kErrorNotFound;
+    return;
+  }
+
+  if (password_data) {
+    *key_data = std::string(reinterpret_cast<char*>(password_data),
+                            password_length);
+    SecKeychainItemFreeContent(NULL, password_data);
+  }
+}
+
 void WiFiServiceMac::SetEventObservers(
     scoped_refptr<base::MessageLoopProxy> message_loop_proxy,
     const NetworkGuidListCallback& networks_changed_observer,