cast_auth_util.cc | Explore in Territory

// Copyright 2014 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "components/media_router/common/providers/cast/channel/cast_auth_util.h"

#include <vector>

#include "base/feature_list.h"
#include "base/logging.h"
#include "base/memory/singleton.h"
#include "base/strings/string_number_conversions.h"
#include "base/strings/string_util.h"
#include "components/media_router/common/providers/cast/certificate/cast_cert_validator.h"
#include "components/media_router/common/providers/cast/certificate/cast_crl.h"
#include "components/media_router/common/providers/cast/channel/cast_channel_enum.h"
#include "components/media_router/common/providers/cast/channel/cast_channel_metrics.h"
#include "components/media_router/common/providers/cast/channel/cast_message_util.h"
#include "crypto/random.h"
#include "net/cert/x509_certificate.h"
#include "net/cert/x509_util.h"
#include "third_party/boringssl/src/pki/parse_values.h"
#include "third_party/boringssl/src/pki/signature_algorithm.h"

namespace cast_channel {

// Enforce nonce checking when enabled.
// If disabled, the nonce value returned from the device is not checked against
// the one sent to the device. As a result, the nonce can be empty and omitted
// from the signature. This allows backwards compatibility with legacy Cast
// receivers.
BASE_FEATURE(…);

// Enforce the use of SHA256 digest for signatures.
// If disabled, the device may respond with a signature with SHA1 digest even
// though a signature with SHA256 digest was requested in the challenge. This
// allows for backwards compatibility with legacy Cast receivers.
BASE_FEATURE(…);

// Enforce cast fallback CRL revocation when enabled.
// If disabled, fallback CRL will be ignored. If the feature is enabled,  it
// overrides kEnforceRevocationChecking.
BASE_FEATURE(…);

// Enforce certificate revocation when enabled.
// If disabled, any revocation failures are ignored.
//
// This flags only controls the enforcement. Revocation is checked regardless.
//
// This flag tracks the changes necessary to fully enforce revocation.
BASE_FEATURE(…);

namespace {

const char kParseErrorPrefix[] = …;

// The maximum number of days a cert can live for.
const int kMaxSelfSignedCertLifetimeInDays = …;

// The size of the nonce challenge in bytes.
const int kNonceSizeInBytes = …;

// The number of hours after which a nonce is regenerated.
long kNonceExpirationTimeInHours = …;

cast_crypto;

// Extracts an embedded DeviceAuthMessage payload from an auth challenge reply
// message.
AuthResult ParseAuthMessage(const CastMessage& challenge_reply,
                            DeviceAuthMessage* auth_message) { … }

class CastNonce { … };

// Maps CastCertError to AuthResult.
// If crl_required is set to false, all revocation related errors are ignored.
AuthResult MapToAuthResult(cast_certificate::CastCertError error,
                           cast_certificate::CRLPolicy crl_policy) { … }

}  // namespace

AuthResult::AuthResult() = default;

AuthResult::AuthResult(const std::string& error_message,
                       ErrorType error_type,
                       CastChannelFlag flag)
    : … { … }

AuthResult::~AuthResult() = default;

void AuthResult::CopyFlagsFrom(const AuthResult& source) { … }

// static
AuthResult AuthResult::CreateWithParseError(const std::string& error_message,
                                            ErrorType error_type) { … }

// static
AuthContext AuthContext::Create() { … }

// static
AuthContext AuthContext::CreateForTest(const std::string& nonce_data) { … }

AuthContext::AuthContext(const std::string& nonce) : … { … }

AuthContext::~AuthContext() = default;

AuthResult AuthContext::VerifySenderNonce(
    const std::string& nonce_response) const { … }

AuthResult VerifyAndMapDigestAlgorithm(
    openscreen::cast::proto::HashAlgorithm response_digest_algorithm,
    cast_certificate::CastDigestAlgorithm* digest_algorithm) { … }

// Verifies the peer certificate and populates |peer_cert_der| with the DER
// encoded certificate.
AuthResult VerifyTLSCertificate(const net::X509Certificate& peer_cert,
                                std::string* peer_cert_der,
                                const base::Time& verification_time) { … }

AuthResult AuthenticateChallengeReply(const CastMessage& challenge_reply,
                                      const net::X509Certificate& peer_cert,
                                      const AuthContext& auth_context) { … }

// This function does the following
//
// * Verifies that the certificate chain |response.client_auth_certificate| +
//   |response.intermediate_certificate| is valid and chains to a trusted
//   Cast root. The certificate is verified at |verification_time|.
//
// * Verifies that none of the certificates in the chain are revoked based on
//   the CRL provided in the response |response.crl|. The CRL is verified to be
//   valid and its issuer certificate chains to a trusted Cast CRL root. The
//   list of trusted Cast CRL roots can be overrided by providing a non-nullptr
//   |crl_trust_store|. If |crl_policy| is CRL_OPTIONAL then the result of
//   revocation checking is ignored. The CRL is verified at
//   |verification_time|.
//
// * Verifies that |response.signature| matches the signature
//   of |signature_input| by |response.client_auth_certificate|'s public
//   key.
AuthResult VerifyCredentialsImpl(const AuthResponse& response,
                                 const std::string& signature_input,
                                 const cast_crypto::CRLPolicy& crl_policy,
                                 bssl::TrustStore* crl_trust_store,
                                 const base::Time& verification_time) { … }

AuthResult VerifyCredentials(const AuthResponse& response,
                             const std::string& signature_input) { … }

AuthResult VerifyCredentialsForTest(const AuthResponse& response,
                                    const std::string& signature_input,
                                    const cast_crypto::CRLPolicy& crl_policy,
                                    bssl::TrustStore* crl_trust_store,
                                    const base::Time& verification_time) { … }

}  // namespace cast_channel
chromium/components/media_router/common/providers/cast/channel/cast_auth_util.cc
