Update CastSocket connection flow to check for receiver credentials.

chrome/browser/extensions/api/cast_channel/cast_socket.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/cast_channel/cast_socket.h"
 
 #include <string.h>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/lazy_instance.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/sys_byteorder.h"
+#include "chrome/browser/extensions/api/cast_channel/cast_auth_util.h"
 #include "chrome/browser/extensions/api/cast_channel/cast_channel.pb.h"
 #include "chrome/browser/extensions/api/cast_channel/cast_message_util.h"
 #include "net/base/address_list.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/x509_certificate.h"
 #include "net/http/transport_security_state.h"
 #include "net/socket/client_socket_factory.h"
@@ skipping 34 matching lines @@
 ApiResourceManager<api::cast_channel::CastSocket>::GetFactoryInstance() {
   return &g_factory.Get();
 }
 
 namespace api {
 namespace cast_channel {
 
 const uint32 kMaxMessageSize = 65536;
 
 CastSocket::CastSocket(const std::string& owner_extension_id,
-                       const GURL& url, CastSocket::Delegate* delegate,
+                       const GURL& url,
+                       CastSocket::Delegate* delegate,
                        net::NetLog* net_log) :
     ApiResource(owner_extension_id),
     channel_id_(0),
     url_(url),
     delegate_(delegate),
-    is_secure_(false),
+    auth_required_(false),
     error_state_(CHANNEL_ERROR_NONE),
     ready_state_(READY_STATE_NONE),
     write_callback_pending_(false),
     read_callback_pending_(false),
     current_message_size_(0),
     net_log_(net_log),
     next_state_(CONN_STATE_NONE) {
   DCHECK(net_log_);
   net_log_source_.type = net::NetLog::SOURCE_SOCKET;
   net_log_source_.id = net_log_->NextID();
 
   // We reuse these buffers for each message.
   header_read_buffer_ = new net::GrowableIOBuffer();
   header_read_buffer_->SetCapacity(kMessageHeaderSize);
   body_read_buffer_ = new net::GrowableIOBuffer();
   body_read_buffer_->SetCapacity(kMaxMessageSize);
   current_read_buffer_ = header_read_buffer_;
 }
 
 CastSocket::~CastSocket() { }
 
 const GURL& CastSocket::url() const {
   return url_;
 }
 
-bool CastSocket::ExtractPeerCert(std::string* cert) {
-  CHECK(peer_cert_.empty());
-  net::SSLInfo ssl_info;
-  if (!socket_->GetSSLInfo(&ssl_info) || !ssl_info.cert.get())
-    return false;
-  bool result = net::X509Certificate::GetDEREncoded(
-     ssl_info.cert->os_cert_handle(), cert);
-  if (result)
-    DVLOG(1) << "Successfully extracted peer certificate: " << *cert;
-  return result;
-}
-
 scoped_ptr<net::TCPClientSocket> CastSocket::CreateTcpSocket() {
   net::AddressList addresses(ip_endpoint_);
   scoped_ptr<net::TCPClientSocket> tcp_socket(
       new net::TCPClientSocket(addresses, net_log_, net_log_source_));
   // Enable keepalive
   tcp_socket->SetKeepAlive(true, kTcpKeepAliveDelaySecs);
   return tcp_socket.Pass();
 }
 
 scoped_ptr<net::SSLClientSocket> CastSocket::CreateSslSocket() {
@@ skipping 17 matching lines @@
 
   scoped_ptr<net::ClientSocketHandle> connection(new net::ClientSocketHandle);
   connection->SetSocket(tcp_socket_.PassAs<net::StreamSocket>());
   net::HostPortPair host_and_port = net::HostPortPair::FromIPEndPoint(
       ip_endpoint_);
 
   return net::ClientSocketFactory::GetDefaultFactory()->CreateSSLClientSocket(
       connection.Pass(), host_and_port, ssl_config, context);
 }
 
+bool CastSocket::ExtractPeerCert(std::string* cert) {
+  DCHECK(cert);
+  DCHECK(peer_cert_.empty());
+  net::SSLInfo ssl_info;
+  if (!socket_->GetSSLInfo(&ssl_info) || !ssl_info.cert.get())
+    return false;
+  bool result = net::X509Certificate::GetDEREncoded(
+     ssl_info.cert->os_cert_handle(), cert);
+  if (result)
+    DVLOG(1) << "Successfully extracted peer certificate: " << *cert;
+  return result;
+}
+
+int CastSocket::SendAuthChallenge() {
+  CastMessage challenge_message;
+  CreateAuthChallengeMessage(&challenge_message);
+  return SendMessageInternal(
+      challenge_message,
+      base::Bind(&CastSocket::OnChallengeEvent, AsWeakPtr()));
+}
+
+int CastSocket::ReadAuthChallengeReply() {
+  return ReadData();
+}
+
 void CastSocket::OnConnectComplete(int result) {
   int rv = DoConnectLoop(result);
   if (rv != net::ERR_IO_PENDING)
     DoConnectCallback(rv);
 }
 
+void CastSocket::OnChallengeEvent(int result) {
+  int rv = DoConnectLoop(result);
+  if (rv != net::ERR_IO_PENDING)
+    DoConnectCallback(rv);
+}
+
 void CastSocket::Connect(const net::CompletionCallback& callback) {
   DCHECK(CalledOnValidThread());
   int result = net::ERR_CONNECTION_FAILED;
   DVLOG(1) << "Connect readyState = " << ready_state_;
   if (ready_state_ != READY_STATE_NONE) {
     callback.Run(result);
     return;
   }
   if (!ParseChannelUrl(url_)) {
     CloseWithError(cast_channel::CHANNEL_ERROR_CONNECT_ERROR);
-    // TODO(mfoltz): Signal channel errors via |callback|
     callback.Run(result);
     return;
   }
   connect_callback_ = callback;
   next_state_ = CONN_STATE_TCP_CONNECT;
   int rv = DoConnectLoop(net::OK);
   if (rv != net::ERR_IO_PENDING)
     DoConnectCallback(rv);
 }
 
@@ skipping 22 matching lines @@
       case CONN_STATE_TCP_CONNECT_COMPLETE:
         rv = DoTcpConnectComplete(rv);
         break;
       case CONN_STATE_SSL_CONNECT:
         DCHECK_EQ(net::OK, rv);
         rv = DoSslConnect();
         break;
       case CONN_STATE_SSL_CONNECT_COMPLETE:
         rv = DoSslConnectComplete(rv);
         break;
+      case CONN_STATE_AUTH_CHALLENGE_SEND:
+        rv = DoAuthChallengeSend();
+        break;
+      case CONN_STATE_AUTH_CHALLENGE_SEND_COMPLETE:
+        rv = DoAuthChallengeSendComplete(rv);
+        break;
+      case CONN_STATE_AUTH_CHALLENGE_REPLY_COMPLETE:
+        rv = DoAuthChallengeReplyComplete(rv);
+        break;
+
       default:
         NOTREACHED() << "BUG in CastSocket state machine code";
         break;
     }
   } while (rv != net::ERR_IO_PENDING && next_state_ != CONN_STATE_NONE);
   // Get out of the loop either when:
   // a. A network operation is pending, OR
   // b. The Do* method called did not change state
 
   return rv;
@@ skipping 13 matching lines @@
 }
 
 int CastSocket::DoSslConnect() {
   next_state_ = CONN_STATE_SSL_CONNECT_COMPLETE;
   socket_ = CreateSslSocket();
   return socket_->Connect(
       base::Bind(&CastSocket::OnConnectComplete, AsWeakPtr()));
 }
 
 int CastSocket::DoSslConnectComplete(int result) {
-  // TODO(mfoltz,munjal): Authenticate the channel if is_secure_ == true.
   if (result == net::ERR_CERT_AUTHORITY_INVALID &&
              peer_cert_.empty() &&
              ExtractPeerCert(&peer_cert_)) {
     next_state_ = CONN_STATE_TCP_CONNECT;
+  } else if (result == net::OK && auth_required_) {
+    next_state_ = CONN_STATE_AUTH_CHALLENGE_SEND;
   }
   return result;
 }
 
+int CastSocket::DoAuthChallengeSend() {
+  next_state_ = CONN_STATE_AUTH_CHALLENGE_SEND_COMPLETE;
+  return SendAuthChallenge();
+}
+
+int CastSocket::DoAuthChallengeSendComplete(int result) {
+  if (result != net::OK)
+    return result;
+  next_state_ = CONN_STATE_AUTH_CHALLENGE_REPLY_COMPLETE;
+  return ReadAuthChallengeReply();
+}
+
+int CastSocket::DoAuthChallengeReplyComplete(int result) {
+  if (result != net::OK)
+    return result;
+  if (!VerifyChallengeReply())
+    return net::ERR_FAILED;
+  return net::OK;
+}
+
+bool CastSocket::VerifyChallengeReply() {
+  return AuthenticateChallengeReply(*challenge_reply_.get(), peer_cert_);
+}
+
 void CastSocket::DoConnectCallback(int result) {
   ready_state_ = (result == net::OK) ? READY_STATE_OPEN : READY_STATE_CLOSED;
   error_state_ = (result == net::OK) ?
       CHANNEL_ERROR_NONE : CHANNEL_ERROR_CONNECT_ERROR;
   base::ResetAndReturn(&connect_callback_).Run(result);
   if (result == net::OK)
     ReadData();
 }
 
 void CastSocket::Close(const net::CompletionCallback& callback) {
   DCHECK(CalledOnValidThread());
   DVLOG(1) << "Close ReadyState = " << ready_state_;
   tcp_socket_.reset(NULL);
   socket_.reset(NULL);
   cert_verifier_.reset(NULL);
   transport_security_state_.reset(NULL);
   ready_state_ = READY_STATE_CLOSED;
   callback.Run(net::OK);
 }
 
 void CastSocket::SendMessage(const MessageInfo& message,
                              const net::CompletionCallback& callback) {
   DCHECK(CalledOnValidThread());
   DVLOG(1) << "Send ReadyState " << ready_state_;
   int result = net::ERR_FAILED;
   if (ready_state_ != READY_STATE_OPEN) {
     callback.Run(result);
     return;
   }
-  WriteRequest write_request(callback);
   CastMessage message_proto;
-  if (!MessageInfoToCastMessage(message, &message_proto) ||
-      !write_request.SetContent(message_proto)) {
+  if (!MessageInfoToCastMessage(message, &message_proto)) {
     CloseWithError(cast_channel::CHANNEL_ERROR_INVALID_MESSAGE);
     // TODO(mfoltz): Do a better job of signaling cast_channel errors to the
     // caller.
     callback.Run(net::OK);
     return;
   }
-  write_queue_.push(write_request);
-  WriteData();
+  result = SendMessageInternal(message_proto, callback);
+  if (result == net::ERR_FAILED || result == net::OK)

[Ryan Sleevi, 2013/10/23 23:28:51]

BUG: You fail to handle a number of cases here.

SendMessageInternal() -> WriteData() -> socket_->Write() -> net::Error results

Shouldn't this just be

if (result != net::ERR_IO_PENDING && result != net::OK) {
  CloseWithError(...)
  callback.Run(...) ?
}

[Munjal (Google), 2013/10/24 00:00:56]

Done.

+  {

[Ryan Sleevi, 2013/10/23 23:28:51]

style: brace goes on line above

[Munjal (Google), 2013/10/24 00:00:56]

Done.

+    CloseWithError(cast_channel::CHANNEL_ERROR_INVALID_MESSAGE);
+    callback.Run(net::ERR_FAILED);
+  }
 }
 
-void CastSocket::WriteData() {
+int CastSocket::SendMessageInternal(const CastMessage& message_proto,
+                                     const net::CompletionCallback& callback) {
+  WriteRequest write_request(callback);
+  if (!write_request.SetContent(message_proto))
+    return net::ERR_FAILED;
+  write_queue_.push(write_request);
+  return WriteData();

[Ryan Sleevi, 2013/10/23 23:28:51]

BUG: Potentially bad recursion design

SendMessage -> SendMessageInternal -> WriteData() -> OnWriteData() WriteData()
-> OnWriteData() -> WriteData() -> OnWriteData(), etc

This is why I suggested in my first review that you consider a state machine
here.

[Munjal (Google), 2013/10/24 00:00:56]

The recursive nature of Write was already there in this class. I will address it
outside of this patch.

+}
+
+int CastSocket::WriteData() {
   DCHECK(CalledOnValidThread());
   DVLOG(1) << "WriteData q = " << write_queue_.size();
   if (write_queue_.empty() || write_callback_pending_)
-    return;
+    return net::ERR_FAILED;
 
   WriteRequest& request = write_queue_.front();
-  if (ready_state_ != READY_STATE_OPEN) {
-    request.callback.Run(net::ERR_FAILED);
-    return;
-  }
 
   DVLOG(1) << "WriteData byte_count = " << request.io_buffer->size() <<
     " bytes_written " << request.io_buffer->BytesConsumed();
 
   write_callback_pending_ = true;
   int result = socket_->Write(
       request.io_buffer.get(),
       request.io_buffer->BytesRemaining(),
       base::Bind(&CastSocket::OnWriteData, AsWeakPtr()));
 
-  DVLOG(1) << "WriteData result = " << result;
-
   if (result != net::ERR_IO_PENDING)
     OnWriteData(result);
+
+  return result;
 }
 
 void CastSocket::OnWriteData(int result) {
   DCHECK(CalledOnValidThread());
   DVLOG(1) << "OnWriteComplete result = " << result;
   DCHECK(write_callback_pending_);
   DCHECK(!write_queue_.empty());
   write_callback_pending_ = false;
   WriteRequest& request = write_queue_.front();
   scoped_refptr<net::DrainableIOBuffer> io_buffer = request.io_buffer;
 
   if (result >= 0) {
     io_buffer->DidConsume(result);
     if (io_buffer->BytesRemaining() > 0) {
       DVLOG(1) << "OnWriteComplete size = " << io_buffer->size() <<
         " consumed " << io_buffer->BytesConsumed() <<
         " remaining " << io_buffer->BytesRemaining() <<
         " # requests " << write_queue_.size();
       WriteData();
       return;
     }
     DCHECK_EQ(io_buffer->BytesConsumed(), io_buffer->size());
     DCHECK_EQ(io_buffer->BytesRemaining(), 0);
     result = io_buffer->BytesConsumed();
   }
 
   request.callback.Run(result);

[Ryan Sleevi, 2013/10/23 23:28:51]

DESIGN: If this callback wants to delete the object, it cannot (safely) do so,
because the next line will cause an out-of-memory error.

This is not generally preferable, and not stated as part of the
contract/lifetime of the CastSocket.

[Munjal (Google), 2013/10/24 00:00:56]

Right. But let me address it separately since it was already there.

   write_queue_.pop();
 
   DVLOG(1) << "OnWriteComplete size = " << io_buffer->size() <<
     " consumed " << io_buffer->BytesConsumed() <<
     " remaining " << io_buffer->BytesRemaining() <<
     " # requests " << write_queue_.size();
 
   if (result < 0) {
     CloseWithError(CHANNEL_ERROR_SOCKET_ERROR);
     return;
   }
 
   if (!write_queue_.empty())
     WriteData();
 }
 
-void CastSocket::ReadData() {
+int CastSocket::ReadData() {
   DCHECK(CalledOnValidThread());
-  if (!socket_.get() || ready_state_ != READY_STATE_OPEN) {
-    return;
-  }
+  if (!socket_.get())
+    return net::ERR_FAILED;
   DCHECK(!read_callback_pending_);
   read_callback_pending_ = true;
   // Figure out if we are reading the header or body, and the remaining bytes.
   uint32 num_bytes_to_read = 0;
   if (header_read_buffer_->RemainingCapacity() > 0) {
     current_read_buffer_ = header_read_buffer_;
     num_bytes_to_read = header_read_buffer_->RemainingCapacity();
     DCHECK_LE(num_bytes_to_read, kMessageHeaderSize);
   } else {
     DCHECK_GT(current_message_size_, 0U);
     num_bytes_to_read = current_message_size_ - body_read_buffer_->offset();
     current_read_buffer_ = body_read_buffer_;
     DCHECK_LE(num_bytes_to_read, kMaxMessageSize);
   }
   DCHECK_GT(num_bytes_to_read, 0U);
   // We read up to num_bytes_to_read into |current_read_buffer_|.
   int result = socket_->Read(
       current_read_buffer_.get(),
       num_bytes_to_read,
       base::Bind(&CastSocket::OnReadData, AsWeakPtr()));
   DVLOG(1) << "ReadData result = " << result;
   if (result > 0) {
     OnReadData(result);
   } else if (result != net::ERR_IO_PENDING) {
     CloseWithError(CHANNEL_ERROR_SOCKET_ERROR);
   }
+  return result;
 }
 
 void CastSocket::OnReadData(int result) {
   DCHECK(CalledOnValidThread());
-  DVLOG(1) << "OnReadData result = " << result <<
-    " header offset = " << header_read_buffer_->offset() <<
-    " body offset = " << body_read_buffer_->offset();
+  DVLOG(1) << "OnReadData result = " << result
+           << " header offset = " << header_read_buffer_->offset()
+           << " body offset = " << body_read_buffer_->offset();
   read_callback_pending_ = false;
   if (result <= 0) {
     CloseWithError(CHANNEL_ERROR_SOCKET_ERROR);
     return;
   }
   // We read some data.  Move the offset in the current buffer forward.
   DCHECK_LE(current_read_buffer_->offset() + result,
             current_read_buffer_->capacity());
   current_read_buffer_->set_offset(current_read_buffer_->offset() + result);
 
@@ skipping 42 matching lines @@
 
 bool CastSocket::ParseMessageFromBody() {
   DCHECK(CalledOnValidThread());
   DCHECK_EQ(static_cast<uint32>(body_read_buffer_->offset()),
             current_message_size_);
   CastMessage message_proto;
   if (!message_proto.ParseFromArray(
       body_read_buffer_->StartOfBuffer(),
       current_message_size_))
     return false;
-  DVLOG(1) << "Parsed message " << MessageProtoToString(message_proto);
-  if (delegate_) {
+  DVLOG(1) << "Parsed message " << CastMessageToString(message_proto);
+  // If the message is an auth message then we handle it internally.
+  if (IsAuthMessage(message_proto)) {
+    challenge_reply_.reset(new CastMessage(message_proto));
+    OnChallengeEvent(net::OK);
+  } else if (delegate_) {
     MessageInfo message;
     if (!CastMessageToMessageInfo(message_proto, &message))
       return false;
     delegate_->OnMessage(this, message);
   }
   return true;
 }
 
 // static
 bool CastSocket::Serialize(const CastMessage& message_proto,
@@ skipping 16 matching lines @@
   socket_.reset(NULL);
   ready_state_ = READY_STATE_CLOSED;
   error_state_ = error;
   if (delegate_)
     delegate_->OnError(this, error);
 }
 
 bool CastSocket::ParseChannelUrl(const GURL& url) {
   DVLOG(1) << "url = " + url.spec();
   if (url.SchemeIs(kCastInsecureScheme)) {
-    is_secure_ = false;
+    auth_required_ = false;
   } else if (url.SchemeIs(kCastSecureScheme)) {
-    is_secure_ = true;
+    auth_required_ = true;
   } else {
     return false;
   }
   // TODO(mfoltz): Manual parsing, yech. Register cast[s] as standard schemes?
   // TODO(mfoltz): Test for IPv6 addresses.  Brackets or no brackets?
   // TODO(mfoltz): Maybe enforce restriction to IPv4 private and IPv6 link-local
   // networks
   const std::string& path = url.path();
   // Shortest possible: //A:B
   if (path.size() < 5) {
@@ skipping 65 matching lines @@
   io_buffer = new net::DrainableIOBuffer(new net::StringIOBuffer(message_data),
                                          message_data.size());
   return true;
 }
 
 CastSocket::WriteRequest::~WriteRequest() { }
 
 }  // namespace cast_channel
 }  // namespace api
 }  // namespace extensions