Cast audio only policy enforcement support.

extensions/browser/api/cast_channel/cast_auth_util.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef EXTENSIONS_BROWSER_API_CAST_CHANNEL_CAST_AUTH_UTIL_H_
 #define EXTENSIONS_BROWSER_API_CAST_CHANNEL_CAST_AUTH_UTIL_H_
 
 #include <string>
 
 namespace extensions {
@@ skipping 28 matching lines @@
 
   static AuthResult CreateWithParseError(const std::string& error_message,
                                          ErrorType error_type);
   static AuthResult CreateWithNSSError(const std::string& error_message,
                                        ErrorType error_type,
                                        int nss_error_code);
 
   bool success() const { return error_type == ERROR_NONE; }
 
   std::string error_message;
+  std::string client_auth_certificate;

[mark a. foltz, 2015/01/12 22:01:56]

A better API would test the client_auth_certificate for a set of policy keys
defined in cast_auth_util.cc (like kAudioOnlyPolicy) and store the result as an
enum bitmask (like AUDIO_ONLY_POLICY)...

Then have a method AuthResult::HasPolicy(AUDIO_ONLY_POLICY) to test the bitmask.

This way the mechanism for testing the authentication protocol for a specific
policy advertisement is hidden from users of AuthResult.
 

[vadimgo, 2015/01/13 00:08:27]

Store the policy in AuthResult as suggested.

   ErrorType error_type;
   int nss_error_code;
 
  private:
   AuthResult(const std::string& error_message,
              ErrorType error_type,
              int nss_error_code);
 };
 
 // Authenticates the given |challenge_reply|:
 // 1. Signature contained in the reply is valid.
 // 2. Certficate used to sign is rooted to a trusted CA.
 AuthResult AuthenticateChallengeReply(const CastMessage& challenge_reply,
                                       const std::string& peer_cert);
 
 // Auth-library specific implementation of cryptographic signature
 // verification routines. Verifies that |response| contains a
 // valid signed form of |peer_cert|.
 AuthResult VerifyCredentials(const AuthResponse& response,
                              const std::string& peer_cert);
 
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions
 
 #endif  // EXTENSIONS_BROWSER_API_CAST_CHANNEL_CAST_AUTH_UTIL_H_