Updating It2Me to use the new ValidatingAuthenticator class

remoting/host/it2me/it2me_host.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/it2me/it2me_host.h"
 
-#include <stddef.h>
-
+#include <cstdint>
+#include <memory>
+#include <string>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_util.h"
 #include "base/threading/platform_thread.h"
 #include "components/policy/policy_constants.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/url_request/url_request_context_getter.h"
@@ skipping 11 matching lines @@
 #include "remoting/host/policy_watcher.h"
 #include "remoting/host/register_support_host_request.h"
 #include "remoting/host/service_urls.h"
 #include "remoting/protocol/auth_util.h"
 #include "remoting/protocol/chromium_port_allocator_factory.h"
 #include "remoting/protocol/ice_transport.h"
 #include "remoting/protocol/it2me_host_authenticator_factory.h"
 #include "remoting/protocol/jingle_session_manager.h"
 #include "remoting/protocol/network_settings.h"
 #include "remoting/protocol/transport_context.h"
+#include "remoting/protocol/validating_authenticator.h"
+#include "remoting/signaling/jid_util.h"
 #include "remoting/signaling/server_log_entry.h"
 
 namespace remoting {
 
 namespace {
 
 // This is used for tagging system event logs.
 const char kApplicationName[] = "chromoting";
 const int kMaxLoginAttempts = 5;
 
+typedef protocol::ValidatingAuthenticator::Result ValidationResult;
+
 }  // namespace
 
 It2MeHost::It2MeHost(
     std::unique_ptr<ChromotingHostContext> host_context,
     std::unique_ptr<PolicyWatcher> policy_watcher,
     std::unique_ptr<It2MeConfirmationDialogFactory> confirmation_dialog_factory,
     base::WeakPtr<It2MeHost::Observer> observer,
     const XmppSignalStrategy::XmppServerConfig& xmpp_server_config,
     const std::string& directory_bot_jid)
     : host_context_(std::move(host_context)),
       task_runner_(host_context_->ui_task_runner()),
       observer_(observer),
       xmpp_server_config_(xmpp_server_config),
       directory_bot_jid_(directory_bot_jid),
       state_(kDisconnected),
       failed_login_attempts_(0),
       policy_watcher_(std::move(policy_watcher)),
       confirmation_dialog_factory_(std::move(confirmation_dialog_factory)),
       nat_traversal_enabled_(false),
       policy_received_(false) {
   DCHECK(task_runner_->BelongsToCurrentThread());
+  validation_callback_ =
+      base::Bind(&It2MeHost::ValidateConnectionDetails, base::Unretained(this));
+}
+
+It2MeHost::~It2MeHost() {
+  // Check that resources that need to be torn down on the UI thread are gone.
+  DCHECK(!desktop_environment_factory_.get());
+  DCHECK(!policy_watcher_.get());
 }
 
 void It2MeHost::Connect() {
   if (!host_context_->ui_task_runner()->BelongsToCurrentThread()) {
     DCHECK(task_runner_->BelongsToCurrentThread());
     host_context_->ui_task_runner()->PostTask(
         FROM_HERE, base::Bind(&It2MeHost::Connect, this));
     return;
   }
 
@@ skipping 235 matching lines @@
 
   SetState(kConnected, "");
 }
 
 void It2MeHost::OnClientDisconnected(const std::string& jid) {
   DCHECK(host_context_->network_task_runner()->BelongsToCurrentThread());
 
   DisconnectOnNetworkThread();
 }
 
+void It2MeHost::SetPolicyForTesting(
+    std::unique_ptr<base::DictionaryValue> policies,
+    const base::Closure& done_callback) {
+  host_context_->network_task_runner()->PostTaskAndReply(
+      FROM_HERE,
+      base::Bind(&It2MeHost::OnPolicyUpdate, this, base::Passed(&policies)),
+      done_callback);
+}
+
 void It2MeHost::OnPolicyUpdate(
     std::unique_ptr<base::DictionaryValue> policies) {
   // The policy watcher runs on the |ui_task_runner|.
   if (!host_context_->network_task_runner()->BelongsToCurrentThread()) {
     host_context_->network_task_runner()->PostTask(
         FROM_HERE,
         base::Bind(&It2MeHost::OnPolicyUpdate, this, base::Passed(&policies)));
     return;
   }
 
@@ skipping 62 matching lines @@
   VLOG(2) << "UpdateClientDomainPolicy: " << client_domain;
 
   // When setting a client  domain policy, disconnect any existing session.
   if (!client_domain.empty() && IsConnected()) {
     DisconnectOnNetworkThread();
   }
 
   required_client_domain_ = client_domain;
 }
 
-It2MeHost::~It2MeHost() {
-  // Check that resources that need to be torn down on the UI thread are gone.
-  DCHECK(!desktop_environment_factory_.get());
-  DCHECK(!policy_watcher_.get());
-}
-
 void It2MeHost::SetState(It2MeHostState state,
                          const std::string& error_message) {
   DCHECK(host_context_->network_task_runner()->BelongsToCurrentThread());
 
   switch (state_) {
     case kDisconnected:
       DCHECK(state == kStarting ||
              state == kError) << state;
       break;
     case kStarting:
@@ skipping 59 matching lines @@
     std::string error_message = "Failed to generate host certificate.";
     LOG(ERROR) << error_message;
     SetState(kError, error_message);
     DisconnectOnNetworkThread();
     return;
   }
 
   std::unique_ptr<protocol::AuthenticatorFactory> factory(
       new protocol::It2MeHostAuthenticatorFactory(
           local_certificate, host_key_pair_, access_code_hash,
-          required_client_domain_));
+          validation_callback_));
   host_->SetAuthenticatorFactory(std::move(factory));
 
   // Pass the Access Code to the script object before changing state.
   task_runner_->PostTask(
       FROM_HERE, base::Bind(&It2MeHost::Observer::OnStoreAccessCode,
                             observer_, access_code, lifetime));
 
   SetState(kReceivedAccessCode, "");
 }
 
+void It2MeHost::ValidateConnectionDetails(
+    const std::string& remote_jid,
+    const protocol::ValidatingAuthenticator::ResultCallback& result_callback) {
+  // Check the client domain policy.
+  if (!required_client_domain_.empty()) {
+    std::string client_username;
+    if (!SplitJidResource(remote_jid, &client_username, /*resource=*/nullptr)) {
+      LOG(ERROR) << "Rejecting incoming connection from " << remote_jid
+                 << ": Invalid JID.";
+      result_callback.Run(ValidationResult::ERROR_INVALID_ACCOUNT);
+      return;
+    }
+    if (!base::EndsWith(client_username,
+                        std::string("@") + required_client_domain_,
+                        base::CompareCase::INSENSITIVE_ASCII)) {
+      LOG(ERROR) << "Rejecting incoming connection from " << remote_jid
+                 << ": Domain mismatch.";
+      result_callback.Run(ValidationResult::ERROR_INVALID_ACCOUNT);
+      return;
+    }
+  }
+
+  result_callback.Run(ValidationResult::SUCCESS);
+}
+
 It2MeHostFactory::It2MeHostFactory() : policy_service_(nullptr) {
 }
 
 It2MeHostFactory::~It2MeHostFactory() {}
 
 void It2MeHostFactory::set_policy_service(
     policy::PolicyService* policy_service) {
   DCHECK(policy_service);
   DCHECK(!policy_service_) << "|policy_service| can only be set once.";
   policy_service_ = policy_service;
 }
 
 scoped_refptr<It2MeHost> It2MeHostFactory::CreateIt2MeHost(
     std::unique_ptr<ChromotingHostContext> context,
     base::WeakPtr<It2MeHost::Observer> observer,
     const XmppSignalStrategy::XmppServerConfig& xmpp_server_config,
     const std::string& directory_bot_jid) {
   DCHECK(context->ui_task_runner()->BelongsToCurrentThread());
 
   std::unique_ptr<It2MeConfirmationDialogFactory> confirmation_dialog_factory(
       new It2MeConfirmationDialogFactory());
   std::unique_ptr<PolicyWatcher> policy_watcher =
       PolicyWatcher::Create(policy_service_, context->file_task_runner());
   return new It2MeHost(std::move(context), std::move(policy_watcher),
                        std::move(confirmation_dialog_factory), observer,
                        xmpp_server_config, directory_bot_jid);
 }
 
 }  // namespace remoting