[Remoting Host] Select Latest Valid Cert

remoting/host/token_validator_base.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/token_validator_base.h"
 
 #include <stddef.h>
 
 #include "base/base64.h"
 #include "base/bind.h"
@@ skipping 25 matching lines @@
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_status.h"
 #include "url/gurl.h"
 
 namespace {
 
 const int kBufferSize = 4096;
 const char kCertIssuerWildCard[] = "*";
 
+// The certificate is valid if:
+// * The issuer matches exactly the expected issuer or the expected issuer is
+//   a wildcard. And
+// * |now| is within [valid_start, valid_expiry], or [valid_start, +inf)
+//   if |valid_expiry| is null.
+bool IsCertificateValid(const std::string& issuer,
+                        const base::Time& now,
+                        const scoped_refptr<net::X509Certificate>& cert) {
+  return (issuer == kCertIssuerWildCard ||
+      issuer == cert->issuer().common_name) &&
+      cert->valid_start() <= now &&
+      (cert->valid_expiry() > now || cert->valid_expiry().is_null());
+}
+
+// Returns true if the certificate |c1| is worse than |c2|.
+//
+// Criteria:
+// 1. An invalid certificate is always worse than a valid certificate.
+// 2. Invalid certificates are equally worse, in which case false will be
+//    returned.
+// 3. A certificate with earlier |valid_start| time is worse.
+// 4. When |valid_start| are the same, the certificate with earlier
+//    |valid_expiry| is worse.
+bool WorseThan(const std::string& issuer,
+               const base::Time& now,
+               const scoped_refptr<net::X509Certificate>& c1,
+               const scoped_refptr<net::X509Certificate>& c2) {
+  bool c1_valid = IsCertificateValid(issuer, now, c1);
+  bool c2_valid = IsCertificateValid(issuer, now, c2);
+
+  if (!c1_valid && c2_valid)
+    return true;
+
+  if (!c2_valid)

[Lambros, 2016/09/27 22:13:58]

Optional: If this 'if' were moved before the first 'if', the first 'if' could be
simplified, because c2_valid would be true.

[Yuwei, 2016/09/27 22:22:49]

Done. It can be simplified a lot actually :)

+    return false;
+
+  if (c1->valid_start() != c2->valid_start())
+    return c1->valid_start() < c2->valid_start();
+
+  return c1->valid_expiry() < c2->valid_expiry();
+}
+
 }  // namespace
 
 namespace remoting {
 
 TokenValidatorBase::TokenValidatorBase(
     const ThirdPartyAuthConfig& third_party_auth_config,
     const std::string& token_scope,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter)
     : third_party_auth_config_(third_party_auth_config),
       token_scope_(token_scope),
@@ skipping 111 matching lines @@
       base::Bind(&TokenValidatorBase::OnCertificatesSelected,
                  weak_factory_.GetWeakPtr(), base::Owned(selected_certs),
                  base::Owned(client_cert_store)));
 }
 
 void TokenValidatorBase::OnCertificatesSelected(
     net::CertificateList* selected_certs,
     net::ClientCertStore* unused) {
   const std::string& issuer =
       third_party_auth_config_.token_validation_cert_issuer;
-  if (request_) {
-    for (size_t i = 0; i < selected_certs->size(); ++i) {
-      net::X509Certificate* cert = (*selected_certs)[i].get();
-      if (issuer == kCertIssuerWildCard ||
-          issuer == cert->issuer().common_name) {
-        request_->ContinueWithCertificate(
-            cert, net::FetchClientCertPrivateKey(cert).get());
-        return;
-      }
-    }
-    request_->ContinueWithCertificate(nullptr, nullptr);
+
+  base::Time now = base::Time::Now();
+
+  auto best_match_position =
+      std::max_element(selected_certs->begin(), selected_certs->end(),
+                       std::bind(&WorseThan, issuer, now, std::placeholders::_1,
+                                 std::placeholders::_2));
+
+  if (best_match_position == selected_certs->end() ||
+      !IsCertificateValid(issuer, now, *best_match_position)) {
+    ContinueWithCertificate(nullptr, nullptr);
+  } else {
+    ContinueWithCertificate(
+        best_match_position->get(),
+        net::FetchClientCertPrivateKey(best_match_position->get()).get());
   }
 }
 
+void TokenValidatorBase::ContinueWithCertificate(
+    net::X509Certificate* client_cert,
+    net::SSLPrivateKey* client_private_key) {
+  if (request_) {
+    request_->ContinueWithCertificate(client_cert, client_private_key);
+  }
+}
+
 bool TokenValidatorBase::IsValidScope(const std::string& token_scope) {
   // TODO(rmsousa): Deal with reordering/subsets/supersets/aliases/etc.
   return token_scope == token_scope_;
 }
 
 std::string TokenValidatorBase::ProcessResponse(int net_result) {
   // Verify that we got a successful response.
   if (net_result != net::OK) {
     LOG(ERROR) << "Error validating token, err=" << net_result;
     return std::string();
@@ skipping 22 matching lines @@
     return std::string();
   }
 
   std::string shared_secret;
   // Everything is valid, so return the shared secret to the caller.
   dict->GetStringWithoutPathExpansion("access_token", &shared_secret);
   return shared_secret;
 }
 
 }  // namespace remoting