Allow ${CERT_SAN_EMAIL} and ${CERT_SAN_UPN} in the ONC Identity field

chromeos/network/client_cert_resolver.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/client_cert_resolver.h"
 
 #include <cert.h>
 #include <certt.h>  // for (SECCertUsageEnum) certUsageAnyCA
 #include <pk11pub.h>
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
+#include "base/strings/string_util.h"
 #include "base/task_runner.h"
 #include "base/threading/worker_pool.h"
 #include "base/time/clock.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/shill_service_client.h"
 #include "chromeos/network/managed_network_configuration_handler.h"
 #include "chromeos/network/network_state.h"
 #include "components/onc/onc_constants.h"
 #include "dbus/object_path.h"
 #include "net/cert/scoped_nss_types.h"
 #include "net/cert/x509_certificate.h"
+#include "net/cert/x509_util_nss.h"
+#include "third_party/cros_system_api/dbus/service_constants.h"
 
 namespace chromeos {
 
 // Describes a network |network_path| for which a matching certificate |cert_id|
 // was found or for which no certificate was found (|cert_id| will be empty).
 struct ClientCertResolver::NetworkAndMatchingCert {
   NetworkAndMatchingCert(const std::string& network_path,
                          client_cert::ConfigType config_type,
                          const std::string& cert_id,
-                         int slot_id)
+                         int slot_id,
+                         const std::string& configured_identity)
       : service_path(network_path),
         cert_config_type(config_type),
         pkcs11_id(cert_id),
-        key_slot_id(slot_id) {}
+        key_slot_id(slot_id),
+        identity(configured_identity) {}
 
   std::string service_path;
   client_cert::ConfigType cert_config_type;
 
   // The id of the matching certificate or empty if no certificate was found.
   std::string pkcs11_id;
 
   // The id of the slot containing the certificate and the private key.
   int key_slot_id;
+
+  // The EAP-TLS Identity field, if it is configured through a policy
+  // substitution.
+  std::string identity;
 };
 
 typedef std::vector<ClientCertResolver::NetworkAndMatchingCert>
     NetworkCertMatches;
 
 namespace {
 
 // Returns true if |vector| contains |value|.
 template <class T>
 bool ContainsValue(const std::vector<T>& vector, const T& value) {
@@ skipping 110 matching lines @@
         !CertLoader::IsCertificateHardwareBacked(&cert)) {
       continue;
     }
     client_certs.push_back(CertAndIssuer(*it, GetPEMEncodedIssuer(cert)));
   }
 
   std::sort(client_certs.begin(), client_certs.end(), &CompareCertExpiration);
   return client_certs;
 }
 
+// Looks up subjectAlternativeName fields in |cert| that match |type|,
+// then searches for |var_name| in |identity| and replaces any occurrences
+// with the SAN.
+void ReplaceSAN(std::string* identity,

[stevenjb, 2016/02/29 19:04:20]

Output parameters should be passed in last.

[Kevin Cernekee, 2016/02/29 21:50:29]

Done.

+                const std::string& var_name,
+                const net::X509Certificate& cert,
+                net::x509_util::SubjectAltNameType type) {
+  if (identity->find(var_name, 0) != std::string::npos) {

[stevenjb, 2016/02/29 19:04:20]

invert and early exit

[Kevin Cernekee, 2016/02/29 21:50:29]

Done.

+    std::vector<std::string> names;
+    GetSubjectAltName(cert.os_cert_handle(), type, &names);

[stevenjb, 2016/02/29 19:04:20]

Is this intended to be x509_util::GetSubjectAltName? That seems to have a
different signature though. I'm confused.

[Kevin Cernekee, 2016/02/29 21:50:29]

Yes, I added another variant in crrev.com/1720653002

(Is there a way to mark it as a dependent CL?  I've seen others that do this but
haven't figured out how.)

[stevenjb, 2016/02/29 22:06:21]

It looks like this should still be in the x509_util namespace? I'm unclear how
this compiles...

WRT dependent CLs:

If you have a branch A that has been uploaded, and branch B is branched from A
(or has the upstream set to A with 'git cl upstream'), then 'git cl upload'
should take care of that. Just make sure that if you rebase A that you re-upload
A, then rebase B off A, then re-upload B.

[Kevin Cernekee, 2016/02/29 22:53:49]

Switched to new name, and added the net::x509_util:: prefix.

+    if (!names.empty())
+      base::ReplaceSubstringsAfterOffset(identity, 0, var_name, names.at(0));
+  }
+}
+
 // Searches for matches between |networks| and |certs| and writes matches to
 // |matches|. Because this calls NSS functions and is potentially slow, it must
 // be run on a worker thread.
 void FindCertificateMatches(const net::CertificateList& certs,
                             std::vector<NetworkAndCertPattern>* networks,
                             base::Time now,
                             NetworkCertMatches* matches) {
   std::vector<CertAndIssuer> client_certs(
       CreateSortedCertAndIssuerList(certs, now));
 
   for (std::vector<NetworkAndCertPattern>::const_iterator it =
            networks->begin();
        it != networks->end(); ++it) {
     std::vector<CertAndIssuer>::iterator cert_it =
         std::find_if(client_certs.begin(),
                      client_certs.end(),
                      MatchCertWithPattern(it->cert_config.pattern));
     std::string pkcs11_id;
     int slot_id = -1;
+    std::string identity;
+
     if (cert_it == client_certs.end()) {
       VLOG(1) << "Couldn't find a matching client cert for network "
               << it->service_path;
       // Leave |pkcs11_id| empty to indicate that no cert was found for this
       // network.
     } else {
       pkcs11_id =
           CertLoader::GetPkcs11IdAndSlotForCert(*cert_it->cert, &slot_id);
       if (pkcs11_id.empty()) {
         LOG(ERROR) << "Couldn't determine PKCS#11 ID.";
         // So far this error is not expected to happen. We can just continue, in
         // the worst case the user can remove the problematic cert.
         continue;
       }
+
+      // If the policy specifies an identity containing ${CERT_SAN_xxx},
+      // see if the cert contains a suitable subjectAltName that we can
+      // stuff into the shill properties.
+      identity = it->cert_config.policy_identity;
+      ReplaceSAN(&identity, ::onc::substitutes::kCertSANEmail, *cert_it->cert,
+                 net::x509_util::SAN_RFC822_NAME);
+      ReplaceSAN(&identity, ::onc::substitutes::kCertSANUPN, *cert_it->cert,
+                 net::x509_util::SAN_UPN);
     }
+
     matches->push_back(ClientCertResolver::NetworkAndMatchingCert(
-        it->service_path, it->cert_config.location, pkcs11_id, slot_id));
+        it->service_path, it->cert_config.location, pkcs11_id, slot_id,
+        identity));
   }
 }
 
 void LogError(const std::string& service_path,
               const std::string& dbus_error_name,
               const std::string& dbus_error_message) {
   network_handler::ShillErrorCallbackFunction(
       "ClientCertResolver.SetProperties failed",
       service_path,
       network_handler::ErrorCallback(),
@@ skipping 268 matching lines @@
     VLOG(1) << "Configuring certificate of network " << it->service_path;
     base::DictionaryValue shill_properties;
     if (it->pkcs11_id.empty()) {
       client_cert::SetEmptyShillProperties(it->cert_config_type,
                                            &shill_properties);
     } else {
       client_cert::SetShillProperties(it->cert_config_type,
                                       it->key_slot_id,
                                       it->pkcs11_id,
                                       &shill_properties);
+      if (!it->identity.empty())
+        shill_properties.SetStringWithoutPathExpansion(
+            shill::kEapIdentityProperty, it->identity);

[stevenjb, 2016/02/29 19:04:20]

{}

[Kevin Cernekee, 2016/02/29 21:50:29]

Done.

     }
     network_properties_changed_ = true;
     DBusThreadManager::Get()->GetShillServiceClient()->
         SetProperties(dbus::ObjectPath(it->service_path),
                         shill_properties,
                         base::Bind(&base::DoNothing),
                         base::Bind(&LogError, it->service_path));
     network_state_handler_->RequestUpdateForNetwork(it->service_path);
   }
   if (queued_networks_to_resolve_.empty())
@@ skipping 11 matching lines @@
   FOR_EACH_OBSERVER(Observer, observers_, ResolveRequestCompleted(changed));
 }
 
 base::Time ClientCertResolver::Now() const {
   if (testing_clock_)
     return testing_clock_->Now();
   return base::Time::Now();
 }
 
 }  // namespace chromeos