Implement crypto signature verification routines using OpenSSL.

extensions/browser/api/cast_channel/cast_auth_util.cc

Index: extensions/browser/api/cast_channel/cast_auth_util.cc
diff --git a/extensions/browser/api/cast_channel/cast_auth_util.cc b/extensions/browser/api/cast_channel/cast_auth_util.cc
index a9dabded6c50453c5ded8db2d29b583573f1603a..0d3b70cfcc4e63978255a0fb5f41919d60f1c593 100644
--- a/extensions/browser/api/cast_channel/cast_auth_util.cc
+++ b/extensions/browser/api/cast_channel/cast_auth_util.cc
@@ -17,35 +17,8 @@ namespace {
 
 const char* const kParseErrorPrefix = "Failed to parse auth message: ";
 
-}  // namespace
-
-AuthResult::AuthResult() : error_type(ERROR_NONE), nss_error_code(0) {
-}
-
-AuthResult::~AuthResult() {
-}
-
-// static
-AuthResult AuthResult::CreateWithParseError(const std::string& error_message,
-                                            ErrorType error_type) {
-  return AuthResult(kParseErrorPrefix + error_message, error_type, 0);
-}
-
-// static
-AuthResult AuthResult::CreateWithNSSError(const std::string& error_message,
-                                          ErrorType error_type,
-                                          int nss_error_code) {
-  return AuthResult(error_message, error_type, nss_error_code);
-}
-
-AuthResult::AuthResult(const std::string& error_message,
-                       ErrorType error_type,
-                       int nss_error_code)
-    : error_message(error_message),
-      error_type(error_type),
-      nss_error_code(nss_error_code) {
-}
-
+// Extracts an embedded DeviceAuthMessage payload from an auth challenge reply
+// message.
 AuthResult ParseAuthMessage(const CastMessage& challenge_reply,
                             DeviceAuthMessage* auth_message) {
   if (challenge_reply.payload_type() != CastMessage_PayloadType_BINARY) {
@@ -79,6 +52,81 @@ AuthResult ParseAuthMessage(const CastMessage& challenge_reply,
   return AuthResult();
 }
 
+}  // namespace
+
+AuthResult::AuthResult() : error_type(ERROR_NONE), nss_error_code(0) {
+}
+
+AuthResult::~AuthResult() {
+}
+
+AuthResult::AuthResult(const AuthResult& rvalue) :
+    error_message(rvalue.error_message),
+    error_type(rvalue.error_type),
+    nss_error_code(rvalue.nss_error_code),
+    openssl_errors(rvalue.openssl_errors) {}
+
+// static
+AuthResult AuthResult::CreateWithParseError(const std::string& error_message,
+                                            ErrorType error_type) {
+  return AuthResult(kParseErrorPrefix + error_message, error_type, 0,
+                    std::vector<std::pair<std::string, int>>());
+}
+
+// static
+AuthResult AuthResult::CreateWithNSSError(const std::string& error_message,
+                                          ErrorType error_type,
+                                          int nss_error_code) {
+  return AuthResult(error_message, error_type, nss_error_code,
+                    std::vector<std::pair<std::string, int>>());
+}
+
+// static
+AuthResult AuthResult::CreateWithOpenSSLErrors(
+    const std::string& error_message,
+    ErrorType error_type,
+    const std::vector<std::pair<std::string, int>>& openssl_errors) {
+  return AuthResult(kParseErrorPrefix + error_message, error_type, 0,
+                    openssl_errors);
+}
+
+AuthResult::AuthResult(
+    const std::string& error_message,
+    ErrorType error_type,
+    int nss_error_code,
+    const std::vector<std::pair<std::string, int>>& openssl_errors)
+    : error_message(error_message),
+      error_type(error_type),
+      nss_error_code(nss_error_code),
+      openssl_errors(openssl_errors) {
+}
+
+AuthResult AuthenticateChallengeReply(const CastMessage& challenge_reply,
+                                      const std::string& peer_cert) {
+  if (peer_cert.empty()) {
+    AuthResult result = AuthResult::CreateWithParseError(
+        "Peer cert was empty.", AuthResult::ERROR_PEER_CERT_EMPTY);
+    VLOG(1) << result.error_message;
+    return result;
+  }
+
+  DeviceAuthMessage auth_message;
+  AuthResult result = ParseAuthMessage(challenge_reply, &auth_message);
+  if (!result.success()) {
+    VLOG(1) << result.error_message;
+    return result;
+  }
+
+  const AuthResponse& response = auth_message.response();
+  result = VerifyCredentials(response, peer_cert);
+  if (!result.success()) {
+    VLOG(1) << result.error_message;
+    return result;
+  }
+
+  return AuthResult();
+}
+
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions