Generates the DTLS identity in browser process and returns it to render process.

content/browser/media/dtls_identity_store.cc

+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/media/dtls_identity_store.h"
+
+#include "base/bind.h"
+#include "base/callback_helpers.h"
+#include "base/location.h"
+#include "base/logging.h"
+#include "base/rand_util.h"
+#include "base/task_runner.h"
+#include "base/threading/worker_pool.h"
+#include "content/public/browser/browser_thread.h"
+#include "crypto/rsa_private_key.h"
+#include "googleurl/src/gurl.h"
+#include "net/base/net_errors.h"
+#include "net/cert/x509_certificate.h"
+
+namespace content {
+
+namespace {
+
+struct DTLSIdentityRequestResult {
+  int error;
+  std::string certificate;
+  std::string private_key;
+};
+
+static void GenerateIdentityWorker(const std::string& common_name,
+                                   DTLSIdentityRequestResult* result) {
+  result->error = net::OK;
+  std::string certificate;
+  std::vector<uint8> private_key_info;
+
+  int serial_number = base::RandInt(0, std::numeric_limits<int>::max());
+
+  scoped_ptr<crypto::RSAPrivateKey> key(crypto::RSAPrivateKey::Create(1024));
+  if (!key.get()) {
+    DLOG(ERROR) << "Unable to create key pair for client";
+    result->error = net::ERR_KEY_GENERATION_FAILED;
+    return;
+  }
+
+   scoped_refptr<net::X509Certificate> cert =
+      net::X509Certificate::CreateSelfSigned(key.get(),
+                                             "CN=" + common_name,
+                                             serial_number,
+                                             base::TimeDelta::FromDays(30));
+  if (!cert) {
+    DLOG(ERROR) << "Unable to create x509 cert for client";
+    result->error = net::ERR_SELF_SIGNED_CERT_GENERATION_FAILED;
+    return;
+  }
+  if (!net::X509Certificate::GetDEREncoded(cert->os_cert_handle(),
+                                           &result->certificate)) {
+    DLOG(ERROR) << "Unable to get the DER decoded data from the cert.";
+    result->error = net::ERR_SELF_SIGNED_CERT_GENERATION_FAILED;
+    return;
+  }
+
+  if (!key->ExportPrivateKey(&private_key_info)) {
+    DLOG(ERROR) << "Unable to export private key";
+    result->error = net::ERR_PRIVATE_KEY_EXPORT_FAILED;
+    return;
+  }
+
+  result->private_key =
+      std::string(private_key_info.begin(), private_key_info.end());
+}
+
+}  // namespace
+
+// The class represents a DTLS identity request internal to DTLSIdentityStore.
+// It has a one-to-one mapping to the external version of the request
+// DTLSIdentityRequestHandle, which is the target of the DTLSIdentityRequest's
+// completion callback.
+// It's deleted automatically when the request is completed.
+class DTLSIdentityRequest {
+ public:
+  DTLSIdentityRequest(const DTLSIdentityStore::CompletionCallback& callback)
+      : callback_(callback) {}
+
+ private:
+  friend DTLSIdentityStore;
+
+  void Cancel() {
+    callback_.Reset();
+  }
+
+  void Post(DTLSIdentityRequestResult* result) {
+    if (callback_.is_null())
+      return;
+    callback_.Run(result->error, result->certificate, result->private_key);
+    // "this" will be deleted after this point.
+  }
+
+  DTLSIdentityStore::CompletionCallback callback_;
+};
+
+// The class represents a DTLS identity request which calls back to the external
+// client when the request completes.
+// Its lifetime is tied with the Callback held by the corresponding
+// DTLSIdentityRequest.
+class DTLSIdentityRequestHandle {
+ public:
+  DTLSIdentityRequestHandle(
+      DTLSIdentityStore* store,
+      const DTLSIdentityStore::CompletionCallback& callback) :
+      store_(store), request_(NULL), callback_(callback) {

[Ryan Sleevi, 2013/06/17 18:13:23]

STYLE: Please see
http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml?showone=Constr...
about the two acceptable forms of constructor initializer lists.

[jiayl, 2013/06/17 18:58:00]

Done.

+  }
+
+ private:
+  friend DTLSIdentityStore;
+
+  // Cancel the request.  Does nothing if the request finished or was already
+  // cancelled.
+  void Cancel() {
+    if (request_) {

[Ryan Sleevi, 2013/06/17 18:13:23]

Try to handle errors immediately, to reduce the level of indentation and
complexity

if (!request_)
  return;

callback_.Reset();
....

[jiayl, 2013/06/17 18:58:00]

Done.

+      callback_.Reset();
+      DTLSIdentityRequest* request = request_;
+      request_ = NULL;
+      // "this" will be deleted after the following call, becuase "this" is
+      // owned by the Callback held by |request|.
+      store_->CancelRequestInternal(request);
+    }
+  }
+
+  void OnRequestStarted(DTLSIdentityRequest* request) {
+    DCHECK_NE(static_cast<DTLSIdentityRequest*>(NULL), request);

[Ryan Sleevi, 2013/06/17 18:13:23]

DCHECK(request)

[jiayl, 2013/06/17 18:58:00]

Done.

+    request_ = request;
+  }
+  void OnRequestComplete(int error,
+                         const std::string& certificate,
+                         const std::string& private_key) {
+    DCHECK_NE(static_cast<DTLSIdentityRequest*>(NULL), request_);
+    request_ = NULL;
+    base::ResetAndReturn(&callback_).Run(error, certificate, private_key);
+  }
+
+  DTLSIdentityStore* store_;
+  DTLSIdentityRequest* request_;
+  DTLSIdentityStore::CompletionCallback callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(DTLSIdentityRequestHandle);
+};
+
+DTLSIdentityStore::DTLSIdentityStore()
+    : task_runner_(base::WorkerPool::GetTaskRunner(true)) {
+}
+
+DTLSIdentityStore::~DTLSIdentityStore() {}
+
+base::Closure DTLSIdentityStore::RequestIdentity(const GURL& origin,
+                                        const std::string& identity_name,
+                                        const std::string& common_name,
+                                        const CompletionCallback& callback) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+
+  DTLSIdentityRequestHandle* handle = new DTLSIdentityRequestHandle(
+      this, callback);
+
+  DTLSIdentityRequest* request = new DTLSIdentityRequest(
+      base::Bind(&DTLSIdentityRequestHandle::OnRequestComplete,
+                 base::Owned(handle)));
+  handle->OnRequestStarted(request);
+
+  DTLSIdentityRequestResult* result = new DTLSIdentityRequestResult;
+  task_runner_->PostTaskAndReply(

[Ryan Sleevi, 2013/06/17 18:13:23]

SECURITY BUG:
If this fails to Post, then |request| will be deleted.

When |request| is deleted, it will run |callback_|'s destructor (line 98), which
is the callback setup on line 164-165.

|callback_| owns |handle| (line 165), which will then cause a U-A-F if the
caller attempts to Cancel the request (line 175-176)

[jiayl, 2013/06/17 18:58:00]

Fixed now by changing the return type to boolean and making the Closure an out
param. If it fails to post task, we do not set Closure.
On 2013/06/17 18:13:23, Ryan Sleevi wrote:

+      FROM_HERE,
+      base::Bind(&GenerateIdentityWorker, common_name, result),
+      base::Bind(&DTLSIdentityRequest::Post,
+                 base::Owned(request), base::Owned(result)));
+
+  return base::Bind(&DTLSIdentityRequestHandle::Cancel,
+                    base::Unretained(handle));
+}
+
+DTLSIdentityStore::DTLSIdentityStore(
+    const scoped_refptr<base::TaskRunner>& task_runner)
+    : task_runner_(task_runner) {
+}
+
+void DTLSIdentityStore::CancelRequestInternal(DTLSIdentityRequest* request) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+  request->Cancel();
+}
+
+}  // namespace content