authenticator.h 6.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef REMOTING_PROTOCOL_AUTHENTICATOR_H_
  5. #define REMOTING_PROTOCOL_AUTHENTICATOR_H_
  6. #include <memory>
  7. #include <string>
  8. #include "base/callback_forward.h"
  9. namespace jingle_xmpp {
  10. class XmlElement;
  11. } // namespace jingle_xmpp
  12. namespace remoting {
  13. namespace protocol {
  14. class Authenticator;
  15. class ChannelAuthenticator;
  16. // Authenticator is an abstract interface for authentication protocol
  17. // implementations. Different implementations of this interface may be used on
  18. // each side of the connection depending of type of the auth protocol. Client
  19. // and host will repeatedly call their Authenticators and deliver the messages
  20. // they generate, until successful authentication is reported.
  21. //
  22. // Authenticator may exchange multiple messages before session is authenticated.
  23. // Each message sent/received by an Authenticator is delivered either in a
  24. // session description inside session-initiate and session-accept messages or in
  25. // a session-info message. Session-info messages are used only if authenticators
  26. // need to exchange more than one message.
  27. class Authenticator {
  28. public:
  29. // Allowed state transitions:
  30. // When ProcessMessage() is called:
  31. // WAITING_MESSAGE -> MESSAGE_READY
  32. // WAITING_MESSAGE -> ACCEPTED
  33. // WAITING_MESSAGE -> REJECTED
  34. // WAITING_MESSAGE -> PROCESSING_MESSAGE
  35. // After asynchronous message processing finishes:
  36. // PROCESSING_MESSAGE -> MESSAGE_READY
  37. // PROCESSING_MESSAGE -> ACCEPTED
  38. // PROCESSING_MESSAGE -> REJECTED
  39. // When GetNextMessage() is called:
  40. // MESSAGE_READY -> WAITING_MESSAGE
  41. // MESSAGE_READY -> ACCEPTED
  42. enum State {
  43. // Waiting for the next message from the peer.
  44. WAITING_MESSAGE,
  45. // Next message is ready to be sent to the peer.
  46. MESSAGE_READY,
  47. // Session is authenticated successfully.
  48. ACCEPTED,
  49. // Session is rejected.
  50. REJECTED,
  51. // Asynchronously processing the last message from the peer.
  52. PROCESSING_MESSAGE,
  53. };
  54. enum class RejectionReason {
  55. // The account credentials were not valid (i.e. incorrect PIN).
  56. INVALID_CREDENTIALS,
  57. // The client JID was not valid (i.e. violated a policy or was malformed).
  58. INVALID_ACCOUNT_ID,
  59. // Generic error used when something goes wrong establishing a session.
  60. PROTOCOL_ERROR,
  61. // Session was rejected by the user (i.e. via the confirmation dialog).
  62. REJECTED_BY_USER,
  63. // Multiple, valid connection requests were received for the same session.
  64. TOO_MANY_CONNECTIONS,
  65. // The client is not authorized to connect to this device due to a policy
  66. // defined by the third party auth service. No denial reason was given.
  67. AUTHZ_POLICY_CHECK_FAILED,
  68. // The client is not authorized to connect to this device based on their
  69. // current location due to a policy defined by the third party auth service.
  70. LOCATION_AUTHZ_POLICY_CHECK_FAILED,
  71. };
  72. // Callback used for layered Authenticator implementations, particularly
  73. // third-party and pairing authenticators. They use this callback to create
  74. // base SPAKE2 authenticators.
  75. typedef base::RepeatingCallback<std::unique_ptr<Authenticator>(
  76. const std::string& shared_secret,
  77. Authenticator::State initial_state)>
  78. CreateBaseAuthenticatorCallback;
  79. // Returns true if |message| is an Authenticator message.
  80. static bool IsAuthenticatorMessage(const jingle_xmpp::XmlElement* message);
  81. // Creates an empty Authenticator message, owned by the caller.
  82. static std::unique_ptr<jingle_xmpp::XmlElement> CreateEmptyAuthenticatorMessage();
  83. // Finds Authenticator message among child elements of |message|, or
  84. // returns nullptr otherwise.
  85. static const jingle_xmpp::XmlElement* FindAuthenticatorMessage(
  86. const jingle_xmpp::XmlElement* message);
  87. Authenticator() {}
  88. virtual ~Authenticator() {}
  89. // Returns current state of the authenticator.
  90. virtual State state() const = 0;
  91. // Returns whether authentication has started. The chromoting host uses this
  92. // method to start the back off process to prevent malicious clients from
  93. // guessing the PIN by spamming the host with auth requests.
  94. virtual bool started() const = 0;
  95. // Returns rejection reason. Can be called only when in REJECTED state.
  96. virtual RejectionReason rejection_reason() const = 0;
  97. // Called in response to incoming message received from the peer.
  98. // Should only be called when in WAITING_MESSAGE state. Caller retains
  99. // ownership of |message|. |resume_callback| will be called when processing is
  100. // finished. The implementation must guarantee that |resume_callback| is not
  101. // called after the Authenticator is destroyed.
  102. virtual void ProcessMessage(const jingle_xmpp::XmlElement* message,
  103. base::OnceClosure resume_callback) = 0;
  104. // Must be called when in MESSAGE_READY state. Returns next
  105. // authentication message that needs to be sent to the peer.
  106. virtual std::unique_ptr<jingle_xmpp::XmlElement> GetNextMessage() = 0;
  107. // Returns the auth key received as result of the authentication handshake.
  108. virtual const std::string& GetAuthKey() const = 0;
  109. // Creates new authenticator for a channel. Can be called only in
  110. // the ACCEPTED state.
  111. virtual std::unique_ptr<ChannelAuthenticator> CreateChannelAuthenticator()
  112. const = 0;
  113. };
  114. // Factory for Authenticator instances.
  115. class AuthenticatorFactory {
  116. public:
  117. AuthenticatorFactory() {}
  118. virtual ~AuthenticatorFactory() {}
  119. // Called when session-initiate stanza is received to create
  120. // authenticator for the new session. |first_message| specifies
  121. // authentication part of the session-initiate stanza so that
  122. // appropriate type of Authenticator can be chosen for the session
  123. // (useful when multiple authenticators are supported). Returns nullptr
  124. // if the |first_message| is invalid and the session should be
  125. // rejected. ProcessMessage() should be called with |first_message|
  126. // for the result of this method.
  127. virtual std::unique_ptr<Authenticator> CreateAuthenticator(
  128. const std::string& local_jid,
  129. const std::string& remote_jid) = 0;
  130. };
  131. } // namespace protocol
  132. } // namespace remoting
  133. #endif // REMOTING_PROTOCOL_AUTHENTICATOR_H_