Implement crypto signature verification routines using OpenSSL.

extensions/browser/api/cast_channel/cast_auth_util.cc

Index: extensions/browser/api/cast_channel/cast_auth_util.cc
diff --git a/extensions/browser/api/cast_channel/cast_auth_util.cc b/extensions/browser/api/cast_channel/cast_auth_util.cc
index a9dabded6c50453c5ded8db2d29b583573f1603a..be88f4f5abee7b5fda1501329aff52d591dbb5d2 100644
--- a/extensions/browser/api/cast_channel/cast_auth_util.cc
+++ b/extensions/browser/api/cast_channel/cast_auth_util.cc
@@ -17,6 +17,41 @@ namespace {
 
 const char* const kParseErrorPrefix = "Failed to parse auth message: ";
 
+// Extracts an embedded DeviceAuthMessage payload from an auth challenge reply
+// message.
+AuthResult ParseAuthMessage(const CastMessage& challenge_reply,
+                            DeviceAuthMessage* auth_message) {
+  if (challenge_reply.payload_type() != CastMessage_PayloadType_BINARY) {
+    return AuthResult::CreateWithParseError(
+        "Wrong payload type in challenge reply",
+        AuthResult::ERROR_WRONG_PAYLOAD_TYPE);
+  }
+  if (!challenge_reply.has_payload_binary()) {
+    return AuthResult::CreateWithParseError(
+        "Payload type is binary but payload_binary field not set",
+        AuthResult::ERROR_NO_PAYLOAD);
+  }
+  if (!auth_message->ParseFromString(challenge_reply.payload_binary())) {
+    return AuthResult::CreateWithParseError(
+        "Cannot parse binary payload into DeviceAuthMessage",
+        AuthResult::ERROR_PAYLOAD_PARSING_FAILED);
+  }
+
+  VLOG(1) << "Auth message: " << AuthMessageToString(*auth_message);
+
+  if (auth_message->has_error()) {
+    return AuthResult::CreateWithParseError(
+        "Auth message error: " +
+            base::IntToString(auth_message->error().error_type()),
+        AuthResult::ERROR_MESSAGE_ERROR);
+  }
+  if (!auth_message->has_response()) {
+    return AuthResult::CreateWithParseError(
+        "Auth message has no response field", AuthResult::ERROR_NO_RESPONSE);
+  }
+  return AuthResult();
+}
+
 }  // namespace
 
 AuthResult::AuthResult() : error_type(ERROR_NONE), nss_error_code(0) {
@@ -46,36 +81,29 @@ AuthResult::AuthResult(const std::string& error_message,
       nss_error_code(nss_error_code) {
 }
 
-AuthResult ParseAuthMessage(const CastMessage& challenge_reply,
-                            DeviceAuthMessage* auth_message) {
-  if (challenge_reply.payload_type() != CastMessage_PayloadType_BINARY) {
-    return AuthResult::CreateWithParseError(
-        "Wrong payload type in challenge reply",
-        AuthResult::ERROR_WRONG_PAYLOAD_TYPE);
-  }
-  if (!challenge_reply.has_payload_binary()) {
-    return AuthResult::CreateWithParseError(
-        "Payload type is binary but payload_binary field not set",
-        AuthResult::ERROR_NO_PAYLOAD);
-  }
-  if (!auth_message->ParseFromString(challenge_reply.payload_binary())) {
-    return AuthResult::CreateWithParseError(
-        "Cannot parse binary payload into DeviceAuthMessage",
-        AuthResult::ERROR_PAYLOAD_PARSING_FAILED);
+AuthResult AuthenticateChallengeReply(const CastMessage& challenge_reply,
+                                      const std::string& peer_cert) {
+  if (peer_cert.empty()) {
+    AuthResult result = AuthResult::CreateWithParseError(
+        "Peer cert was empty.", AuthResult::ERROR_PEER_CERT_EMPTY);
+    VLOG(1) << result.error_message;

[mark a. foltz, 2014/11/03 19:06:27]

Perhaps the caller should have this log statement instead of repeating it for
every early return (assuming there is one call site).

[Kevin M, 2014/11/03 19:41:55]

Huh, that is already the case. Removed the redundant VLOGs.

+    return result;
   }
 
-  VLOG(1) << "Auth message: " << AuthMessageToString(*auth_message);
-
-  if (auth_message->has_error()) {
-    return AuthResult::CreateWithParseError(
-        "Auth message error: " +
-            base::IntToString(auth_message->error().error_type()),
-        AuthResult::ERROR_MESSAGE_ERROR);
+  DeviceAuthMessage auth_message;
+  AuthResult result = ParseAuthMessage(challenge_reply, &auth_message);
+  if (!result.success()) {
+    VLOG(1) << result.error_message;
+    return result;
   }
-  if (!auth_message->has_response()) {
-    return AuthResult::CreateWithParseError(
-        "Auth message has no response field", AuthResult::ERROR_NO_RESPONSE);
+
+  const AuthResponse& response = auth_message.response();
+  result = VerifyCredentials(response, peer_cert);
+  if (!result.success()) {
+    VLOG(1) << result.error_message;
+    return result;
   }
+
   return AuthResult();
 }