Enable passing cast channel certificate authority keys.

extensions/browser/api/cast_channel/cast_auth_util.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef EXTENSIONS_BROWSER_API_CAST_CHANNEL_CAST_AUTH_UTIL_H_
 #define EXTENSIONS_BROWSER_API_CAST_CHANNEL_CAST_AUTH_UTIL_H_
 
 #include <string>
+#include "crypto/scoped_nss_types.h"
+#include "extensions/common/api/cast_channel/authority_keys.pb.h"
+#include "net/base/hash_value.h"
 
 namespace extensions {
 namespace core_api {
 namespace cast_channel {
 
 class CastMessage;
 
 struct AuthResult {
  public:
   enum ErrorType {
@@ skipping 26 matching lines @@
   std::string error_message;
   ErrorType error_type;
   int nss_error_code;
 
  private:
   AuthResult(const std::string& error_message,
              ErrorType error_type,
              int nss_error_code);
 };
 
+// Helper class for intermediate certificate authority validation.
+class AuthorityKeysStore {
+ public:
+  AuthorityKeysStore();
+  ~AuthorityKeysStore();
+
+  const SECItem* GetICAPublicKeyFromFingerprint(

[mark a. foltz, 2014/10/14 06:15:04]

Please document these method declarations.

[vadimgo, 2014/10/14 19:51:24]

Done.

+      const net::SHA256HashValue& fingerprint);
+
+  const SECItem* GetDefaultICAPublicKey();
+
+  bool Load(std::string& keys);
+
+ private:
+  // Info for trusted ICA certs.
+  struct ICACertInfo {
+    const net::SHA256HashValue* fingerprint;
+    SECItem public_key;
+  };
+
+  static const ICACertInfo kAllowedICAs[];

[mark a. foltz, 2014/10/14 06:15:04]

This holds the existing hard coded values, right?  Please document this to
distinguish it from certificate_authorities_.

[vadimgo, 2014/10/14 19:51:24]

Done.

+
+  // The list of trusted certificate authorities.
+  std::vector<ICACertInfo> certificate_authorities_;
+
+  // Trusted certificate authorities data passed from the extension.
+  proto::AuthorityKeys authority_keys_;

[mark a. foltz, 2014/10/14 06:15:04]

Why does the proto::AuthorityKeys have to be retained beyond the call to Load()?

[vadimgo, 2014/10/14 19:51:24]

certificate_authorities_ points to either hard-coded const or protobuf data -
that's why protobuf data is retained.  I added a comment on this.

+};
+
 // Authenticates the given |challenge_reply|:
 // 1. Signature contained in the reply is valid.
 // 2. Certficate used to sign is rooted to a trusted CA.
 AuthResult AuthenticateChallengeReply(const CastMessage& challenge_reply,
                                       const std::string& peer_cert);
 
+// Sets trusted certificate authorities.
+bool SetTrustedCertificateAuthorities(const std::string& keys,
+                                      const std::string& signature);
+
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions
 
 #endif  // EXTENSIONS_BROWSER_API_CAST_CHANNEL_CAST_AUTH_UTIL_H_