Skip to content

GitLab

T
tangled
Commit 410cd112 authored by sergeyu's avatar sergeyu Committed by Commit bot
Browse files
Options

Add Curve25519 version of pairing authenticators 

BUG=589698

Review URL: https://codereview.chromium.org/1800823002

Cr-Commit-Position: refs/heads/master@{#381664}
parent 79a6ade9
Show whitespace changes
Inline Side-by-side
Showing with 255 additions and 107 deletions
remoting/protocol/negotiating_authenticator_base.cc
View file @ 410cd112
...@@ -34,6 +34,8 @@ const NameMapElement<NegotiatingAuthenticatorBase::Method> ...@@ -34,6 +34,8 @@ const NameMapElement<NegotiatingAuthenticatorBase::Method>
{NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224, {NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224,
"spake2_pair"}, "spake2_pair"},
{NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_CURVE25519,
"pair_spake2_curve25519"},
{NegotiatingAuthenticatorBase::Method::THIRD_PARTY_SPAKE2_P224, {NegotiatingAuthenticatorBase::Method::THIRD_PARTY_SPAKE2_P224,
"third_party"}, "third_party"},
......
remoting/protocol/negotiating_authenticator_base.h
View file @ 410cd112
...@@ -77,8 +77,8 @@ class NegotiatingAuthenticatorBase : public Authenticator { ...@@ -77,8 +77,8 @@ class NegotiatingAuthenticatorBase : public Authenticator {
// SPAKE2 using shared pairing secret. Falls back to PIN-based // SPAKE2 using shared pairing secret. Falls back to PIN-based
// authentication when pairing fails. // authentication when pairing fails.
// TODO(sergeyu): Add CURVE25519 variant. crbug.com/593123
PAIRED_SPAKE2_P224, PAIRED_SPAKE2_P224,
PAIRED_SPAKE2_CURVE25519,
// Authentication using third-party authentication server. // Authentication using third-party authentication server.
// SPAKE2 with P224 using shared pairing secret. Falls back to PIN-based // SPAKE2 with P224 using shared pairing secret. Falls back to PIN-based
...@@ -103,7 +103,6 @@ class NegotiatingAuthenticatorBase : public Authenticator { ...@@ -103,7 +103,6 @@ class NegotiatingAuthenticatorBase : public Authenticator {
protected: protected:
friend class NegotiatingAuthenticatorTest; friend class NegotiatingAuthenticatorTest;
FRIEND_TEST_ALL_PREFIXES(NegotiatingAuthenticatorTest, IncompatibleMethods);
static const buzz::StaticQName kMethodAttributeQName; static const buzz::StaticQName kMethodAttributeQName;
static const buzz::StaticQName kSupportedMethodsAttributeQName; static const buzz::StaticQName kSupportedMethodsAttributeQName;
......
remoting/protocol/negotiating_authenticator_unittest.cc
View file @ 410cd112
...@@ -53,7 +53,7 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase { ...@@ -53,7 +53,7 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase {
~NegotiatingAuthenticatorTest() override {} ~NegotiatingAuthenticatorTest() override {}
protected: protected:
void InitAuthenticators(const std::string& client_id, virtual void InitAuthenticators(const std::string& client_id,
const std::string& client_paired_secret, const std::string& client_paired_secret,
const std::string& client_interactive_pin, const std::string& client_interactive_pin,
const std::string& host_secret, const std::string& host_secret,
...@@ -64,15 +64,18 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase { ...@@ -64,15 +64,18 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase {
} else { } else {
std::string host_secret_hash = std::string host_secret_hash =
GetSharedSecretHash(kTestHostId, host_secret); GetSharedSecretHash(kTestHostId, host_secret);
host_ = NegotiatingHostAuthenticator::CreateWithPin( scoped_ptr<NegotiatingHostAuthenticator> host =
NegotiatingHostAuthenticator::CreateWithPin(
kHostJid, kClientJid, host_cert_, key_pair_, host_secret_hash, kHostJid, kClientJid, host_cert_, key_pair_, host_secret_hash,
pairing_registry_); pairing_registry_);
host_as_negotiating_authenticator_ = host.get();
host_ = std::move(host);
} }
protocol::ClientAuthenticationConfig client_auth_config; protocol::ClientAuthenticationConfig client_auth_config;
client_auth_config.host_id = kTestHostId; client_auth_config.host_id = kTestHostId;
client_auth_config.pairing_client_id = client_id; client_auth_config.pairing_client_id = client_id;
client_auth_config.pairing_secret= client_paired_secret; client_auth_config.pairing_secret = client_paired_secret;
bool pairing_expected = pairing_registry_.get() != nullptr; bool pairing_expected = pairing_registry_.get() != nullptr;
client_auth_config.fetch_secret_callback = client_auth_config.fetch_secret_callback =
base::Bind(&NegotiatingAuthenticatorTest::FetchSecret, base::Bind(&NegotiatingAuthenticatorTest::FetchSecret,
...@@ -82,6 +85,20 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase { ...@@ -82,6 +85,20 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase {
client_.reset(client_as_negotiating_authenticator_); client_.reset(client_as_negotiating_authenticator_);
} }
void DisableMethodOnClient(NegotiatingAuthenticatorBase::Method method) {
auto* methods = &(client_as_negotiating_authenticator_->methods_);
auto iter = std::find(methods->begin(), methods->end(), method);
ASSERT_TRUE(iter != methods->end());
methods->erase(iter);
}
void DisableMethodOnHost(NegotiatingAuthenticatorBase::Method method) {
auto* methods = &(host_as_negotiating_authenticator_->methods_);
auto iter = std::find(methods->begin(), methods->end(), method);
ASSERT_TRUE(iter != methods->end());
methods->erase(iter);
}
void CreatePairingRegistry(bool with_paired_client) { void CreatePairingRegistry(bool with_paired_client) {
pairing_registry_ = new SynchronousPairingRegistry( pairing_registry_ = new SynchronousPairingRegistry(
make_scoped_ptr(new MockPairingRegistryDelegate())); make_scoped_ptr(new MockPairingRegistryDelegate()));
...@@ -112,7 +129,7 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase { ...@@ -112,7 +129,7 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase {
} }
} }
void VerifyAccepted(NegotiatingAuthenticatorBase::Method expected_method) { virtual void VerifyAccepted() {
ASSERT_NO_FATAL_FAILURE(RunAuthExchange()); ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
ASSERT_EQ(Authenticator::ACCEPTED, host_->state()); ASSERT_EQ(Authenticator::ACCEPTED, host_->state());
...@@ -131,11 +148,14 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase { ...@@ -131,11 +148,14 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase {
tester.Start(); tester.Start();
message_loop_.Run(); message_loop_.Run();
tester.CheckResults(); tester.CheckResults();
EXPECT_EQ(expected_method, }
client_as_negotiating_authenticator_->current_method_);
NegotiatingAuthenticatorBase::Method current_method() {
return client_as_negotiating_authenticator_->current_method_;
} }
// Use a bare pointer because the storage is managed by the base class. // Use a bare pointer because the storage is managed by the base class.
NegotiatingHostAuthenticator* host_as_negotiating_authenticator_;
NegotiatingClientAuthenticator* client_as_negotiating_authenticator_; NegotiatingClientAuthenticator* client_as_negotiating_authenticator_;
private: private:
...@@ -144,18 +164,90 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase { ...@@ -144,18 +164,90 @@ class NegotiatingAuthenticatorTest : public AuthenticatorTestBase {
DISALLOW_COPY_AND_ASSIGN(NegotiatingAuthenticatorTest); DISALLOW_COPY_AND_ASSIGN(NegotiatingAuthenticatorTest);
}; };
struct PairingTestParameters {
bool p224_on_client;
bool curve25519_on_client;
bool p224_on_host;
bool curve25519_on_host;
bool expect_curve25519_used;
};
class NegotiatingPairingAuthenticatorTest
: public NegotiatingAuthenticatorTest,
public testing::WithParamInterface<PairingTestParameters> {
public:
void InitAuthenticators(const std::string& client_id,
const std::string& client_paired_secret,
const std::string& client_interactive_pin,
const std::string& host_secret,
bool it2me) override {
NegotiatingAuthenticatorTest::InitAuthenticators(
client_id, client_paired_secret, client_interactive_pin, host_secret,
it2me);
if (!GetParam().p224_on_client) {
DisableMethodOnClient(
NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224);
}
if (!GetParam().curve25519_on_client) {
DisableMethodOnClient(
NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_CURVE25519);
}
if (!GetParam().p224_on_host) {
DisableMethodOnHost(
NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224);
}
if (!GetParam().curve25519_on_host) {
DisableMethodOnHost(
NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_CURVE25519);
}
}
void VerifyAccepted() override {
NegotiatingAuthenticatorTest::VerifyAccepted();
EXPECT_TRUE(
current_method() ==
NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224 ||
current_method() ==
NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_CURVE25519);
}
};
INSTANTIATE_TEST_CASE_P(
PairingParams,
NegotiatingPairingAuthenticatorTest,
testing::Values(
// Only P224.
PairingTestParameters{true, false, true, false},
// Only curve25519.
PairingTestParameters{false, true, false, true},
// Both P224 and curve25519.
PairingTestParameters{true, true, true, true},
// One end supports both, the other supports only P224 or curve25519.
PairingTestParameters{false, true, true, true},
PairingTestParameters{true, false, true, true},
PairingTestParameters{true, true, false, true},
PairingTestParameters{true, true, true, false}));
TEST_F(NegotiatingAuthenticatorTest, SuccessfulAuthMe2MePin) { TEST_F(NegotiatingAuthenticatorTest, SuccessfulAuthMe2MePin) {
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret,
kTestPin, kTestPin, false)); kTestPin, kTestPin, false));
VerifyAccepted( VerifyAccepted();
NegotiatingAuthenticatorBase::Method::SHARED_SECRET_SPAKE2_CURVE25519); EXPECT_EQ(
NegotiatingAuthenticatorBase::Method::SHARED_SECRET_SPAKE2_CURVE25519,
current_method());
} }
TEST_F(NegotiatingAuthenticatorTest, SuccessfulAuthIt2me) { TEST_F(NegotiatingAuthenticatorTest, SuccessfulAuthIt2me) {
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret,
kTestPin, kTestPin, true)); kTestPin, kTestPin, true));
VerifyAccepted( VerifyAccepted();
NegotiatingAuthenticatorBase::Method::SHARED_SECRET_PLAIN_SPAKE2_P224); EXPECT_EQ(
NegotiatingAuthenticatorBase::Method::SHARED_SECRET_PLAIN_SPAKE2_P224,
current_method());
} }
TEST_F(NegotiatingAuthenticatorTest, InvalidMe2MePin) { TEST_F(NegotiatingAuthenticatorTest, InvalidMe2MePin) {
...@@ -177,11 +269,8 @@ TEST_F(NegotiatingAuthenticatorTest, InvalidIt2MeAccessCode) { ...@@ -177,11 +269,8 @@ TEST_F(NegotiatingAuthenticatorTest, InvalidIt2MeAccessCode) {
TEST_F(NegotiatingAuthenticatorTest, IncompatibleMethods) { TEST_F(NegotiatingAuthenticatorTest, IncompatibleMethods) {
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret,
kTestPin, kTestPinBad, true)); kTestPin, kTestPinBad, true));
std::vector<NegotiatingAuthenticatorBase::Method>* methods = DisableMethodOnClient(
&(client_as_negotiating_authenticator_->methods_); NegotiatingAuthenticatorBase::Method::SHARED_SECRET_PLAIN_SPAKE2_P224);
methods->erase(std::find(
methods->begin(), methods->end(),
NegotiatingAuthenticatorBase::Method::SHARED_SECRET_PLAIN_SPAKE2_P224));
ASSERT_NO_FATAL_FAILURE(RunAuthExchange()); ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
...@@ -192,27 +281,29 @@ TEST_F(NegotiatingAuthenticatorTest, PairingNotSupported) { ...@@ -192,27 +281,29 @@ TEST_F(NegotiatingAuthenticatorTest, PairingNotSupported) {
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret,
kTestPin, kTestPin, false)); kTestPin, kTestPin, false));
ASSERT_NO_FATAL_FAILURE(RunAuthExchange()); ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
VerifyAccepted( VerifyAccepted();
NegotiatingAuthenticatorBase::Method::SHARED_SECRET_SPAKE2_CURVE25519); EXPECT_EQ(
NegotiatingAuthenticatorBase::Method::SHARED_SECRET_SPAKE2_CURVE25519,
current_method());
} }
TEST_F(NegotiatingAuthenticatorTest, PairingSupportedButNotPaired) { TEST_P(NegotiatingPairingAuthenticatorTest, PairingSupportedButNotPaired) {
CreatePairingRegistry(false); CreatePairingRegistry(false);
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kNoClientId, kNoPairedSecret,
kTestPin, kTestPin, false)); kTestPin, kTestPin, false));
ASSERT_NO_FATAL_FAILURE(RunAuthExchange()); ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
VerifyAccepted(NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224); VerifyAccepted();
} }
TEST_F(NegotiatingAuthenticatorTest, PairingRevokedPinOkay) { TEST_P(NegotiatingPairingAuthenticatorTest, PairingRevokedPinOkay) {
CreatePairingRegistry(false); CreatePairingRegistry(false);
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret,
kTestPin, kTestPin, false)); kTestPin, kTestPin, false));
ASSERT_NO_FATAL_FAILURE(RunAuthExchange()); ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
VerifyAccepted(NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224); VerifyAccepted();
} }
TEST_F(NegotiatingAuthenticatorTest, PairingRevokedPinBad) { TEST_P(NegotiatingPairingAuthenticatorTest, PairingRevokedPinBad) {
CreatePairingRegistry(false); CreatePairingRegistry(false);
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret,
kTestPinBad, kTestPin, false)); kTestPinBad, kTestPin, false));
...@@ -220,24 +311,24 @@ TEST_F(NegotiatingAuthenticatorTest, PairingRevokedPinBad) { ...@@ -220,24 +311,24 @@ TEST_F(NegotiatingAuthenticatorTest, PairingRevokedPinBad) {
VerifyRejected(Authenticator::INVALID_CREDENTIALS); VerifyRejected(Authenticator::INVALID_CREDENTIALS);
} }
TEST_F(NegotiatingAuthenticatorTest, PairingSucceeded) { TEST_P(NegotiatingPairingAuthenticatorTest, PairingSucceeded) {
CreatePairingRegistry(true); CreatePairingRegistry(true);
ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret, ASSERT_NO_FATAL_FAILURE(InitAuthenticators(kTestClientId, kTestPairedSecret,
kTestPinBad, kTestPin, false)); kTestPinBad, kTestPin, false));
ASSERT_NO_FATAL_FAILURE(RunAuthExchange()); ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
VerifyAccepted(NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224); VerifyAccepted();
} }
TEST_F(NegotiatingAuthenticatorTest, TEST_P(NegotiatingPairingAuthenticatorTest,
PairingSucceededInvalidSecretButPinOkay) { PairingSucceededInvalidSecretButPinOkay) {
CreatePairingRegistry(true); CreatePairingRegistry(true);
ASSERT_NO_FATAL_FAILURE(InitAuthenticators( ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
kTestClientId, kTestPairedSecretBad, kTestPin, kTestPin, false)); kTestClientId, kTestPairedSecretBad, kTestPin, kTestPin, false));
ASSERT_NO_FATAL_FAILURE(RunAuthExchange()); ASSERT_NO_FATAL_FAILURE(RunAuthExchange());
VerifyAccepted(NegotiatingAuthenticatorBase::Method::PAIRED_SPAKE2_P224); VerifyAccepted();
} }
TEST_F(NegotiatingAuthenticatorTest, PairingFailedInvalidSecretAndPin) { TEST_P(NegotiatingPairingAuthenticatorTest, PairingFailedInvalidSecretAndPin) {
CreatePairingRegistry(true); CreatePairingRegistry(true);
ASSERT_NO_FATAL_FAILURE(InitAuthenticators( ASSERT_NO_FATAL_FAILURE(InitAuthenticators(
kTestClientId, kTestPairedSecretBad, kTestPinBad, kTestPin, false)); kTestClientId, kTestPairedSecretBad, kTestPinBad, kTestPin, false));
......
remoting/protocol/negotiating_client_authenticator.cc
View file @ 410cd112
...@@ -36,6 +36,7 @@ NegotiatingClientAuthenticator::NegotiatingClientAuthenticator( ...@@ -36,6 +36,7 @@ NegotiatingClientAuthenticator::NegotiatingClientAuthenticator(
AddMethod(Method::THIRD_PARTY_SPAKE2_P224); AddMethod(Method::THIRD_PARTY_SPAKE2_P224);
} }
AddMethod(Method::PAIRED_SPAKE2_CURVE25519);
AddMethod(Method::PAIRED_SPAKE2_P224); AddMethod(Method::PAIRED_SPAKE2_P224);
AddMethod(Method::SHARED_SECRET_SPAKE2_CURVE25519); AddMethod(Method::SHARED_SECRET_SPAKE2_CURVE25519);
...@@ -124,33 +125,55 @@ void NegotiatingClientAuthenticator::CreateAuthenticatorForCurrentMethod( ...@@ -124,33 +125,55 @@ void NegotiatingClientAuthenticator::CreateAuthenticatorForCurrentMethod(
const base::Closure& resume_callback) { const base::Closure& resume_callback) {
DCHECK_EQ(state(), PROCESSING_MESSAGE); DCHECK_EQ(state(), PROCESSING_MESSAGE);
DCHECK(current_method_ != Method::INVALID); DCHECK(current_method_ != Method::INVALID);
if (current_method_ == Method::THIRD_PARTY_SPAKE2_P224) { switch (current_method_) {
case Method::INVALID:
NOTREACHED();
break;
case Method::THIRD_PARTY_SPAKE2_P224:
current_authenticator_.reset(new ThirdPartyClientAuthenticator( current_authenticator_.reset(new ThirdPartyClientAuthenticator(
base::Bind(&V2Authenticator::CreateForClient), base::Bind(&V2Authenticator::CreateForClient),
config_.fetch_third_party_token_callback)); config_.fetch_third_party_token_callback));
resume_callback.Run(); resume_callback.Run();
} else if (current_method_ == Method::THIRD_PARTY_SPAKE2_CURVE25519) { break;
case Method::THIRD_PARTY_SPAKE2_CURVE25519:
current_authenticator_.reset(new ThirdPartyClientAuthenticator( current_authenticator_.reset(new ThirdPartyClientAuthenticator(
base::Bind(&Spake2Authenticator::CreateForClient, local_id_, base::Bind(&Spake2Authenticator::CreateForClient, local_id_,
remote_id_), remote_id_),
config_.fetch_third_party_token_callback)); config_.fetch_third_party_token_callback));
resume_callback.Run(); resume_callback.Run();
} else if (current_method_ == Method::PAIRED_SPAKE2_P224) { break;
case Method::PAIRED_SPAKE2_P224: {
PairingClientAuthenticator* pairing_authenticator = PairingClientAuthenticator* pairing_authenticator =
new PairingClientAuthenticator( new PairingClientAuthenticator(
config_, base::Bind(&V2Authenticator::CreateForClient)); config_, base::Bind(&V2Authenticator::CreateForClient));
current_authenticator_ = make_scoped_ptr(pairing_authenticator); current_authenticator_ = make_scoped_ptr(pairing_authenticator);
pairing_authenticator->Start(preferred_initial_state, resume_callback); pairing_authenticator->Start(preferred_initial_state, resume_callback);
} else { break;
DCHECK(current_method_ == Method::SHARED_SECRET_PLAIN_SPAKE2_P224 || }
current_method_ == Method::SHARED_SECRET_SPAKE2_P224 ||
current_method_ == Method::SHARED_SECRET_SPAKE2_CURVE25519); case Method::PAIRED_SPAKE2_CURVE25519: {
PairingClientAuthenticator* pairing_authenticator =
new PairingClientAuthenticator(
config_, base::Bind(&Spake2Authenticator::CreateForClient,
local_id_, remote_id_));
current_authenticator_ = make_scoped_ptr(pairing_authenticator);
pairing_authenticator->Start(preferred_initial_state, resume_callback);
break;
}
case Method::SHARED_SECRET_PLAIN_SPAKE2_P224:
case Method::SHARED_SECRET_SPAKE2_P224:
case Method::SHARED_SECRET_SPAKE2_CURVE25519:
config_.fetch_secret_callback.Run( config_.fetch_secret_callback.Run(
false, false,
base::Bind( base::Bind(
&NegotiatingClientAuthenticator::CreateSharedSecretAuthenticator, &NegotiatingClientAuthenticator::CreateSharedSecretAuthenticator,
weak_factory_.GetWeakPtr(), preferred_initial_state, weak_factory_.GetWeakPtr(), preferred_initial_state,
resume_callback)); resume_callback));
break;
} }
} }
......
remoting/protocol/negotiating_host_authenticator.cc
View file @ 410cd112
...@@ -36,8 +36,8 @@ NegotiatingHostAuthenticator::NegotiatingHostAuthenticator( ...@@ -36,8 +36,8 @@ NegotiatingHostAuthenticator::NegotiatingHostAuthenticator(
local_key_pair_(key_pair) {} local_key_pair_(key_pair) {}
// static // static
scoped_ptr<Authenticator> NegotiatingHostAuthenticator::CreateForIt2Me( scoped_ptr<NegotiatingHostAuthenticator>
const std::string& local_id, NegotiatingHostAuthenticator::CreateForIt2Me(const std::string& local_id,
const std::string& remote_id, const std::string& remote_id,
const std::string& local_cert, const std::string& local_cert,
scoped_refptr<RsaKeyPair> key_pair, scoped_refptr<RsaKeyPair> key_pair,
...@@ -47,11 +47,12 @@ scoped_ptr<Authenticator> NegotiatingHostAuthenticator::CreateForIt2Me( ...@@ -47,11 +47,12 @@ scoped_ptr<Authenticator> NegotiatingHostAuthenticator::CreateForIt2Me(
key_pair)); key_pair));
result->shared_secret_hash_ = access_code; result->shared_secret_hash_ = access_code;
result->AddMethod(Method::SHARED_SECRET_PLAIN_SPAKE2_P224); result->AddMethod(Method::SHARED_SECRET_PLAIN_SPAKE2_P224);
return std::move(result); return result;
} }
// static // static
scoped_ptr<Authenticator> NegotiatingHostAuthenticator::CreateWithPin( scoped_ptr<NegotiatingHostAuthenticator>
NegotiatingHostAuthenticator::CreateWithPin(
const std::string& local_id, const std::string& local_id,
const std::string& remote_id, const std::string& remote_id,
const std::string& local_cert, const std::string& local_cert,
...@@ -66,13 +67,14 @@ scoped_ptr<Authenticator> NegotiatingHostAuthenticator::CreateWithPin( ...@@ -66,13 +67,14 @@ scoped_ptr<Authenticator> NegotiatingHostAuthenticator::CreateWithPin(
result->AddMethod(Method::SHARED_SECRET_SPAKE2_CURVE25519); result->AddMethod(Method::SHARED_SECRET_SPAKE2_CURVE25519);
result->AddMethod(Method::SHARED_SECRET_SPAKE2_P224); result->AddMethod(Method::SHARED_SECRET_SPAKE2_P224);
if (pairing_registry.get()) { if (pairing_registry.get()) {
result->AddMethod(Method::PAIRED_SPAKE2_CURVE25519);
result->AddMethod(Method::PAIRED_SPAKE2_P224); result->AddMethod(Method::PAIRED_SPAKE2_P224);
} }
return std::move(result); return result;
} }
// static // static
scoped_ptr<Authenticator> scoped_ptr<NegotiatingHostAuthenticator>
NegotiatingHostAuthenticator::CreateWithThirdPartyAuth( NegotiatingHostAuthenticator::CreateWithThirdPartyAuth(
const std::string& local_id, const std::string& local_id,
const std::string& remote_id, const std::string& remote_id,
...@@ -85,7 +87,7 @@ NegotiatingHostAuthenticator::CreateWithThirdPartyAuth( ...@@ -85,7 +87,7 @@ NegotiatingHostAuthenticator::CreateWithThirdPartyAuth(
result->token_validator_factory_ = token_validator_factory; result->token_validator_factory_ = token_validator_factory;
result->AddMethod(Method::THIRD_PARTY_SPAKE2_CURVE25519); result->AddMethod(Method::THIRD_PARTY_SPAKE2_CURVE25519);
result->AddMethod(Method::THIRD_PARTY_SPAKE2_P224); result->AddMethod(Method::THIRD_PARTY_SPAKE2_P224);
return std::move(result); return result;
} }
NegotiatingHostAuthenticator::~NegotiatingHostAuthenticator() {} NegotiatingHostAuthenticator::~NegotiatingHostAuthenticator() {}
...@@ -188,38 +190,69 @@ void NegotiatingHostAuthenticator::CreateAuthenticator( ...@@ -188,38 +190,69 @@ void NegotiatingHostAuthenticator::CreateAuthenticator(
const base::Closure& resume_callback) { const base::Closure& resume_callback) {
DCHECK(current_method_ != Method::INVALID); DCHECK(current_method_ != Method::INVALID);
if (current_method_ == Method::THIRD_PARTY_SPAKE2_P224) { switch(current_method_) {
case Method::INVALID:
NOTREACHED();
break;
case Method::THIRD_PARTY_SPAKE2_P224:
current_authenticator_.reset(new ThirdPartyHostAuthenticator( current_authenticator_.reset(new ThirdPartyHostAuthenticator(
base::Bind(&V2Authenticator::CreateForHost, local_cert_, base::Bind(&V2Authenticator::CreateForHost, local_cert_,
local_key_pair_), local_key_pair_),
token_validator_factory_->CreateTokenValidator(local_id_, remote_id_))); token_validator_factory_->CreateTokenValidator(local_id_,
} else if (current_method_ == Method::THIRD_PARTY_SPAKE2_CURVE25519) { remote_id_)));
resume_callback.Run();
break;
case Method::THIRD_PARTY_SPAKE2_CURVE25519:
current_authenticator_.reset(new ThirdPartyHostAuthenticator( current_authenticator_.reset(new ThirdPartyHostAuthenticator(
base::Bind(&Spake2Authenticator::CreateForHost, local_id_, remote_id_, base::Bind(&Spake2Authenticator::CreateForHost, local_id_, remote_id_,
local_cert_, local_key_pair_), local_cert_, local_key_pair_),
token_validator_factory_->CreateTokenValidator(local_id_, remote_id_))); token_validator_factory_->CreateTokenValidator(local_id_,
} else if (current_method_ == Method::PAIRED_SPAKE2_P224) { remote_id_)));
resume_callback.Run();
break;
case Method::PAIRED_SPAKE2_P224: {
PairingHostAuthenticator* pairing_authenticator = PairingHostAuthenticator* pairing_authenticator =
new PairingHostAuthenticator(pairing_registry_, new PairingHostAuthenticator(
base::Bind(&V2Authenticator::CreateForHost, pairing_registry_, base::Bind(&V2Authenticator::CreateForHost,
local_cert_, local_key_pair_), local_cert_, local_key_pair_),
shared_secret_hash_); shared_secret_hash_);
current_authenticator_.reset(pairing_authenticator); current_authenticator_.reset(pairing_authenticator);
pairing_authenticator->Initialize(client_id_, preferred_initial_state, pairing_authenticator->Initialize(client_id_, preferred_initial_state,
resume_callback); resume_callback);
return; break;
} else if (current_method_ == Method::SHARED_SECRET_SPAKE2_CURVE25519) { }
case Method::PAIRED_SPAKE2_CURVE25519: {
PairingHostAuthenticator* pairing_authenticator =
new PairingHostAuthenticator(
pairing_registry_,
base::Bind(&Spake2Authenticator::CreateForHost, local_id_,
remote_id_, local_cert_, local_key_pair_),
shared_secret_hash_);
current_authenticator_.reset(pairing_authenticator);
pairing_authenticator->Initialize(client_id_, preferred_initial_state,
resume_callback);
break;
}
case Method::SHARED_SECRET_SPAKE2_CURVE25519:
current_authenticator_ = Spake2Authenticator::CreateForHost( current_authenticator_ = Spake2Authenticator::CreateForHost(
local_id_, remote_id_, local_cert_, local_key_pair_, local_id_, remote_id_, local_cert_, local_key_pair_,
shared_secret_hash_, preferred_initial_state); shared_secret_hash_, preferred_initial_state);
} else { resume_callback.Run();
DCHECK(current_method_ == Method::SHARED_SECRET_PLAIN_SPAKE2_P224 || break;
current_method_ == Method::SHARED_SECRET_SPAKE2_P224);
case Method::SHARED_SECRET_PLAIN_SPAKE2_P224:
case Method::SHARED_SECRET_SPAKE2_P224:
current_authenticator_ = V2Authenticator::CreateForHost( current_authenticator_ = V2Authenticator::CreateForHost(
local_cert_, local_key_pair_, shared_secret_hash_, local_cert_, local_key_pair_, shared_secret_hash_,
preferred_initial_state); preferred_initial_state);
}
resume_callback.Run(); resume_callback.Run();
break;
}
} }
} // namespace protocol } // namespace protocol
......
remoting/protocol/negotiating_host_authenticator.h
View file @ 410cd112
...@@ -31,7 +31,7 @@ class NegotiatingHostAuthenticator : public NegotiatingAuthenticatorBase { ...@@ -31,7 +31,7 @@ class NegotiatingHostAuthenticator : public NegotiatingAuthenticatorBase {
~NegotiatingHostAuthenticator() override; ~NegotiatingHostAuthenticator() override;
// Creates a host authenticator for It2Me host. // Creates a host authenticator for It2Me host.
static scoped_ptr<Authenticator> CreateForIt2Me( static scoped_ptr<NegotiatingHostAuthenticator> CreateForIt2Me(
const std::string& local_id, const std::string& local_id,
const std::string& remote_id, const std::string& remote_id,
const std::string& local_cert, const std::string& local_cert,
...@@ -41,7 +41,7 @@ class NegotiatingHostAuthenticator : public NegotiatingAuthenticatorBase { ...@@ -41,7 +41,7 @@ class NegotiatingHostAuthenticator : public NegotiatingAuthenticatorBase {
// Creates a host authenticator, using a fixed PIN. If |pairing_registry| is // Creates a host authenticator, using a fixed PIN. If |pairing_registry| is
// non-nullptr then the paired methods will be offered, supporting // non-nullptr then the paired methods will be offered, supporting
// PIN-less authentication. // PIN-less authentication.
static scoped_ptr<Authenticator> CreateWithPin( static scoped_ptr<NegotiatingHostAuthenticator> CreateWithPin(
const std::string& local_id, const std::string& local_id,
const std::string& remote_id, const std::string& remote_id,
const std::string& local_cert, const std::string& local_cert,
...@@ -50,7 +50,7 @@ class NegotiatingHostAuthenticator : public NegotiatingAuthenticatorBase { ...@@ -50,7 +50,7 @@ class NegotiatingHostAuthenticator : public NegotiatingAuthenticatorBase {
scoped_refptr<PairingRegistry> pairing_registry); scoped_refptr<PairingRegistry> pairing_registry);
// Creates a host authenticator, using third party authentication. // Creates a host authenticator, using third party authentication.
static scoped_ptr<Authenticator> CreateWithThirdPartyAuth( static scoped_ptr<NegotiatingHostAuthenticator> CreateWithThirdPartyAuth(
const std::string& local_id, const std::string& local_id,
const std::string& remote_id, const std::string& remote_id,
const std::string& local_cert, const std::string& local_cert,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment