ssl_hmac_channel_authenticator.h 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef REMOTING_PROTOCOL_SSL_HMAC_CHANNEL_AUTHENTICATOR_H_
  5. #define REMOTING_PROTOCOL_SSL_HMAC_CHANNEL_AUTHENTICATOR_H_
  6. #include <memory>
  7. #include <string>
  8. #include "base/callback.h"
  9. #include "base/memory/ref_counted.h"
  10. #include "base/sequence_checker.h"
  11. #include "remoting/protocol/channel_authenticator.h"
  12. namespace net {
  13. class CertVerifier;
  14. class CTPolicyEnforcer;
  15. class DrainableIOBuffer;
  16. class GrowableIOBuffer;
  17. class SSLClientContext;
  18. class SSLServerContext;
  19. class SSLSocket;
  20. class TransportSecurityState;
  21. } // namespace net
  22. namespace remoting {
  23. class RsaKeyPair;
  24. namespace protocol {
  25. // SslHmacChannelAuthenticator implements ChannelAuthenticator that
  26. // secures channels using SSL and authenticates them with a shared
  27. // secret HMAC.
  28. // Please update network traffic annotation in the .cc file if this class is
  29. // used for any new purposes.
  30. class SslHmacChannelAuthenticator : public ChannelAuthenticator {
  31. public:
  32. enum LegacyMode {
  33. NONE,
  34. SEND_ONLY,
  35. RECEIVE_ONLY,
  36. };
  37. // CreateForClient() and CreateForHost() create an authenticator
  38. // instances for client and host. |auth_key| specifies shared key
  39. // known by both host and client. In case of V1Authenticator the
  40. // |auth_key| is set to access code. For EKE-based authentication
  41. // |auth_key| is the key established using EKE over the signaling
  42. // channel.
  43. static std::unique_ptr<SslHmacChannelAuthenticator> CreateForClient(
  44. const std::string& remote_cert,
  45. const std::string& auth_key);
  46. static std::unique_ptr<SslHmacChannelAuthenticator> CreateForHost(
  47. const std::string& local_cert,
  48. scoped_refptr<RsaKeyPair> key_pair,
  49. const std::string& auth_key);
  50. SslHmacChannelAuthenticator(const SslHmacChannelAuthenticator&) = delete;
  51. SslHmacChannelAuthenticator& operator=(const SslHmacChannelAuthenticator&) =
  52. delete;
  53. ~SslHmacChannelAuthenticator() override;
  54. // ChannelAuthenticator interface.
  55. void SecureAndAuthenticate(std::unique_ptr<P2PStreamSocket> socket,
  56. DoneCallback done_callback) override;
  57. private:
  58. class P2PStreamSocketAdapter;
  59. // P2PStreamSocketAdater outlives the SslHmacChannelAuthenticator, but SSL
  60. // sockets must not outlive their context structures. SslSocketContext bundles
  61. // them together for convenience.
  62. struct SslSocketContext {
  63. SslSocketContext();
  64. SslSocketContext(SslSocketContext&&);
  65. ~SslSocketContext();
  66. SslSocketContext& operator=(SslSocketContext&&);
  67. // Used in the SERVER mode only.
  68. std::unique_ptr<net::SSLServerContext> server_context;
  69. // Used in the CLIENT mode only.
  70. std::unique_ptr<net::TransportSecurityState> transport_security_state;
  71. std::unique_ptr<net::CertVerifier> cert_verifier;
  72. std::unique_ptr<net::CTPolicyEnforcer> ct_policy_enforcer;
  73. std::unique_ptr<net::SSLClientContext> client_context;
  74. };
  75. SslHmacChannelAuthenticator(const std::string& auth_key);
  76. bool is_ssl_server();
  77. void OnConnected(int result);
  78. void WriteAuthenticationBytes(bool* callback_called);
  79. void OnAuthBytesWritten(int result);
  80. bool HandleAuthBytesWritten(int result, bool* callback_called);
  81. void ReadAuthenticationBytes();
  82. void OnAuthBytesRead(int result);
  83. bool HandleAuthBytesRead(int result);
  84. bool VerifyAuthBytes(const std::string& received_auth_bytes);
  85. void CheckDone(bool* callback_called);
  86. void NotifyError(int error);
  87. // The mutual secret used for authentication.
  88. std::string auth_key_;
  89. // Used in the SERVER mode only.
  90. std::string local_cert_;
  91. scoped_refptr<RsaKeyPair> local_key_pair_;
  92. // Used in the CLIENT mode only.
  93. std::string remote_cert_;
  94. SslSocketContext socket_context_;
  95. std::unique_ptr<net::SSLSocket> socket_;
  96. DoneCallback done_callback_;
  97. scoped_refptr<net::DrainableIOBuffer> auth_write_buf_;
  98. scoped_refptr<net::GrowableIOBuffer> auth_read_buf_;
  99. SEQUENCE_CHECKER(sequence_checker_);
  100. };
  101. } // namespace protocol
  102. } // namespace remoting
  103. #endif // REMOTING_PROTOCOL_SSL_HMAC_CHANNEL_AUTHENTICATOR_H_