Cast audio only policy enforcement support.

extensions/browser/api/cast_channel/cast_socket.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/cast_channel/cast_socket.h"
 
 #include <stdlib.h>
 #include <string.h>
 
 #include "base/bind.h"
@@ skipping 35 matching lines @@
 namespace {
 
 // The default keepalive delay.  On Linux, keepalives probes will be sent after
 // the socket is idle for this length of time, and the socket will be closed
 // after 9 failed probes.  So the total idle time before close is 10 *
 // kTcpKeepAliveDelaySecs.
 const int kTcpKeepAliveDelaySecs = 10;
 
 const int kMaxSelfSignedCertLifetimeInDays = 2;
 
+const char kAudioOnlyPolicy[] =

[mark a. foltz, 2015/01/12 22:01:57]

This is an odd place to define a constant that is related to the certificate
contents.  cast_auth_util.cc would be better

[vadimgo, 2015/01/13 00:08:27]

Done.

+    {0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0xD6, 0x79, 0x02, 0x05, 0x02};
+
 std::string FormatTimeForLogging(base::Time time) {
   base::Time::Exploded exploded;
   time.UTCExplode(&exploded);
   return base::StringPrintf(
       "%04d-%02d-%02d %02d:%02d:%02d.%03d UTC", exploded.year, exploded.month,
       exploded.day_of_month, exploded.hour, exploded.minute, exploded.second,
       exploded.millisecond);
 }
 
 }  // namespace
@@ skipping 28 matching lines @@
       auth_delegate_(this),
       owner_extension_id_(owner_extension_id),
       channel_id_(0),
       ip_endpoint_(ip_endpoint),
       channel_auth_(channel_auth),
       net_log_(net_log),
       logger_(logger),
       connect_timeout_(timeout),
       connect_timeout_timer_(new base::OneShotTimer<CastSocketImpl>),
       is_canceled_(false),
+      has_video_out_(true),
       connect_state_(proto::CONN_STATE_NONE),
       error_state_(CHANNEL_ERROR_NONE),
       ready_state_(READY_STATE_NONE) {
   DCHECK(net_log_);
   DCHECK(channel_auth_ == CHANNEL_AUTH_TYPE_SSL ||
          channel_auth_ == CHANNEL_AUTH_TYPE_SSL_VERIFIED);
   net_log_source_.type = net::NetLog::SOURCE_SOCKET;
   net_log_source_.id = net_log_->NextID();
 }
 
@@ skipping 16 matching lines @@
 }
 
 int CastSocketImpl::id() const {
   return channel_id_;
 }
 
 void CastSocketImpl::set_id(int id) {
   channel_id_ = id;
 }
 
+void CastSocketImpl::set_has_video_out(bool has_video_out) {
+  has_video_out_ = has_video_out;
+}
+
 ChannelAuthType CastSocketImpl::channel_auth() const {
   return channel_auth_;
 }
 
 scoped_ptr<net::TCPClientSocket> CastSocketImpl::CreateTcpSocket() {
   net::AddressList addresses(ip_endpoint_);
   return scoped_ptr<net::TCPClientSocket>(
       new net::TCPClientSocket(addresses, net_log_, net_log_source_));
   // Options cannot be set on the TCPClientSocket yet, because the
   // underlying platform socket will not be created until Bind()
@@ skipping 61 matching lines @@
     VLOG_WITH_CONNECTION(1) << "Successfully extracted peer certificate";
   }
 
   logger_->LogSocketEventWithRv(
       channel_id_, proto::DER_ENCODED_CERT_OBTAIN, result ? 1 : 0);
   return result;
 }
 
 bool CastSocketImpl::VerifyChallengeReply() {
   AuthResult result = AuthenticateChallengeReply(*challenge_reply_, peer_cert_);
+  logger_->LogSocketChallengeReplyEvent(channel_id_, result);
   if (result.success()) {
     VLOG(1) << result.error_message;
+    if (has_video_out_) {

[mark a. foltz, 2015/01/12 22:01:57]

if (HasCapability(VIDEO_OUT) && result.HasPolicy(AuthResult::AUDIO_ONLY_POLICY))
{ ... }

[mark a. foltz, 2015/01/12 22:01:57]

Slightly prefer to capture policy enforcement in its own method:

CastSocketImpl::EnforceConnectionPolicy(result);

[vadimgo, 2015/01/13 00:08:27]

Done.

+      if (result.client_auth_certificate.find(kAudioOnlyPolicy) !=
+          std::string::npos) {
+        // The device claims to have a video out capability, but the certificate
+        // contains audio only policy.
+        LOG(ERROR) << "Audio only policy enforced";

[mark a. foltz, 2015/01/12 22:01:57]

Please add an event to logging.proto and log it here so we capture the reason
the authenication failed.

Perhaps the call to LogSocketChallengeReplyEvent on success could be moved after
this block and instead we LogSocketChallengeReplyEvent here with a different
code on error.

[vadimgo, 2015/01/13 00:08:27]

Done.

+        return false;
+      }
+    }
   }
-  logger_->LogSocketChallengeReplyEvent(channel_id_, result);
   return result.success();
 }
 
 void CastSocketImpl::SetTransportForTesting(
     scoped_ptr<CastTransport> transport) {
   transport_ = transport.Pass();
 }
 
 void CastSocketImpl::Connect(scoped_ptr<CastTransport::Delegate> delegate,
                              base::Callback<void(ChannelError)> callback) {
@@ skipping 325 matching lines @@
 void CastSocketImpl::SetErrorState(ChannelError error_state) {
   VLOG_WITH_CONNECTION(1) << "SetErrorState " << error_state;
   DCHECK_EQ(CHANNEL_ERROR_NONE, error_state_);
   error_state_ = error_state;
   logger_->LogSocketErrorState(channel_id_, ErrorStateToProto(error_state_));
 }
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions
 #undef VLOG_WITH_CONNECTION