token_validator_factory_impl.cc 5.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "remoting/host/token_validator_factory_impl.h"
  5. #include <stddef.h>
  6. #include <memory>
  7. #include <utility>
  8. #include "base/base64.h"
  9. #include "base/bind.h"
  10. #include "base/callback.h"
  11. #include "base/check.h"
  12. #include "base/json/json_reader.h"
  13. #include "base/strings/escape.h"
  14. #include "base/strings/string_util.h"
  15. #include "base/strings/stringize_macros.h"
  16. #include "base/task/single_thread_task_runner.h"
  17. #include "base/values.h"
  18. #include "build/branding_buildflags.h"
  19. #include "crypto/random.h"
  20. #include "net/base/elements_upload_data_stream.h"
  21. #include "net/base/io_buffer.h"
  22. #include "net/base/request_priority.h"
  23. #include "net/base/upload_bytes_element_reader.h"
  24. #include "net/url_request/url_request.h"
  25. #include "net/url_request/url_request_context.h"
  26. #include "remoting/base/rsa_key_pair.h"
  27. #include "remoting/host/token_validator_base.h"
  28. #include "url/gurl.h"
  29. namespace {
  30. // Length in bytes of the cryptographic nonce used to salt the token scope.
  31. const size_t kNonceLength = 16; // 128 bits.
  32. } // namespace
  33. namespace remoting {
  34. class TokenValidatorImpl : public TokenValidatorBase {
  35. public:
  36. TokenValidatorImpl(
  37. const ThirdPartyAuthConfig& third_party_auth_config,
  38. scoped_refptr<RsaKeyPair> key_pair,
  39. const std::string& local_jid,
  40. const std::string& remote_jid,
  41. scoped_refptr<net::URLRequestContextGetter> request_context_getter);
  42. TokenValidatorImpl(const TokenValidatorImpl&) = delete;
  43. TokenValidatorImpl& operator=(const TokenValidatorImpl&) = delete;
  44. protected:
  45. void StartValidateRequest(const std::string& token) override;
  46. private:
  47. static std::string CreateScope(const std::string& local_jid,
  48. const std::string& remote_jid);
  49. std::string post_body_;
  50. scoped_refptr<RsaKeyPair> key_pair_;
  51. };
  52. TokenValidatorImpl::TokenValidatorImpl(
  53. const ThirdPartyAuthConfig& third_party_auth_config,
  54. scoped_refptr<RsaKeyPair> key_pair,
  55. const std::string& local_jid,
  56. const std::string& remote_jid,
  57. scoped_refptr<net::URLRequestContextGetter> request_context_getter)
  58. : TokenValidatorBase(third_party_auth_config,
  59. CreateScope(local_jid, remote_jid),
  60. request_context_getter),
  61. key_pair_(key_pair) {
  62. DCHECK(key_pair_.get());
  63. }
  64. // TokenValidator interface.
  65. void TokenValidatorImpl::StartValidateRequest(const std::string& token) {
  66. post_body_ = "code=" + base::EscapeUrlEncodedData(token, true) +
  67. "&client_id=" +
  68. base::EscapeUrlEncodedData(key_pair_->GetPublicKey(), true) +
  69. "&client_secret=" +
  70. base::EscapeUrlEncodedData(key_pair_->SignMessage(token), true) +
  71. "&grant_type=authorization_code";
  72. request_ = request_context_getter_->GetURLRequestContext()->CreateRequest(
  73. third_party_auth_config_.token_validation_url, net::DEFAULT_PRIORITY,
  74. this, MISSING_TRAFFIC_ANNOTATION);
  75. #if BUILDFLAG(GOOGLE_CHROME_BRANDING)
  76. std::string app_name = "Chrome Remote Desktop";
  77. #else
  78. std::string app_name = "Chromoting";
  79. #endif
  80. #ifndef VERSION
  81. #error VERSION is not set.
  82. #endif
  83. // Set a user-agent for logging/auditing purposes.
  84. request_->SetExtraRequestHeaderByName(net::HttpRequestHeaders::kUserAgent,
  85. app_name + " " + STRINGIZE(VERSION),
  86. true);
  87. request_->SetExtraRequestHeaderByName(
  88. net::HttpRequestHeaders::kContentType,
  89. "application/x-www-form-urlencoded", true);
  90. request_->set_method("POST");
  91. std::unique_ptr<net::UploadElementReader> reader(
  92. new net::UploadBytesElementReader(post_body_.data(), post_body_.size()));
  93. request_->set_upload(
  94. net::ElementsUploadDataStream::CreateWithReader(std::move(reader), 0));
  95. request_->Start();
  96. }
  97. std::string TokenValidatorImpl::CreateScope(
  98. const std::string& local_jid,
  99. const std::string& remote_jid) {
  100. std::string nonce_bytes;
  101. crypto::RandBytes(base::WriteInto(&nonce_bytes, kNonceLength + 1),
  102. kNonceLength);
  103. std::string nonce;
  104. base::Base64Encode(nonce_bytes, &nonce);
  105. // Note that because of how FTL signaling IDs are managed, |local_jid| will
  106. // not change between connections to a given host instance. We do expect that
  107. // |remote_jid| will be different for each connection (clients should not
  108. // reuse the same channel for connections) but the host does not control this.
  109. // Since at least one of the JIDs will be reused between connections, we rely
  110. // on the nonce to guarantee that the scope string is unique and cannot be
  111. // reused for multiple connections.
  112. return "client:" + remote_jid + " host:" + local_jid + " nonce:" + nonce;
  113. }
  114. TokenValidatorFactoryImpl::TokenValidatorFactoryImpl(
  115. const ThirdPartyAuthConfig& third_party_auth_config,
  116. scoped_refptr<RsaKeyPair> key_pair,
  117. scoped_refptr<net::URLRequestContextGetter> request_context_getter)
  118. : third_party_auth_config_(third_party_auth_config),
  119. key_pair_(key_pair),
  120. request_context_getter_(request_context_getter) {
  121. }
  122. TokenValidatorFactoryImpl::~TokenValidatorFactoryImpl() = default;
  123. std::unique_ptr<protocol::TokenValidator>
  124. TokenValidatorFactoryImpl::CreateTokenValidator(const std::string& local_jid,
  125. const std::string& remote_jid) {
  126. return std::make_unique<TokenValidatorImpl>(third_party_auth_config_,
  127. key_pair_, local_jid, remote_jid,
  128. request_context_getter_);
  129. }
  130. } // namespace remoting