Add PPAPI interfaces for platform verification.

Interfaces only at this point.  Implementation to follow.  API mirrors
that which is provided to the CDMs in http://crrev.com/221019

CanChallengePlatform() can be synchronous since it will just check a
command line flag passed to the process.

BUG=270294
TEST=none
R=ddorwin@chromium.org, dmichael@chromium.org

Review URL: https://codereview.chromium.org/23569005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@222113 0039d316-1c4b-4281-b951-d872f2087c98

ppapi/api/private/ppb_platform_verification_private.idl

+/* Copyright 2013 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+/**
+ * This file defines the API for platform verification. Currently, it only
+ * supports Chrome OS.
+ */
+
+[generate_thunk]
+
+label Chrome {
+  M31 = 0.1
+};
+
+/**
+ * The <code>PPB_PlatformVerification_Private</code> interface allows authorized
+ * services to verify that the underlying platform is trusted. An example of a
+ * trusted platform is a Chrome OS device in verified boot mode.
+ */
+
+interface PPB_PlatformVerification_Private {
+  /**
+   * Create() creates a <code>PPB_PlatformVerification_Private</code> object.
+   *
+   * @pram[in] instance A <code>PP_Instance</code> identifying one instance of
+   * a module.
+   *
+   * @return A <code>PP_Resource</code> corresponding to a
+   * <code>PPB_PlatformVerification_Private</code> if successful, 0 if creation
+   * failed.
+   */
+  PP_Resource Create([in] PP_Instance instance);
+
+  /**
+   * IsPlatformVerification() determines if the provided resource is a
+   * <code>PPB_PlatformVerification_Private</code>.
+   *
+   * @param[in] resource A <code>PP_Resource</code> corresponding to a
+   * <code>PPB_PlatformVerification_Private</code>.
+   *
+   * @return <code>PP_TRUE</code> if the resource is a
+   * <code>PPB_PlatformVerification_Private</code>, <code>PP_FALSE</code> if the
+   * resource is invalid or some type other than
+   * <code>PPB_PlatformVerification_Private</code>.
+   */
+  PP_Bool IsPlatformVerification([in] PP_Resource resource);
+
+  /**
+   * Check if the underlying host platform can be challenged; i.e., verified as
+   * a trusted platform. Useful for avoiding unnecessary work on platforms
+   * which will always fail; i.e. dev mode Chrome OS.
+   *
+   * @return <code>PP_TRUE</code> if a platform challenge might pass and
+   * <code>PP_FALSE</code> if it definitely won't.
+   */
+  PP_Bool CanChallengePlatform([in] PP_Resource instance);
+
+  /**
+   * Requests a platform challenge for a given service id.
+   *
+   * @param[in] service_id A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_STRING</code> containing the service_id for the challenge.
+   *
+   * @param[in] challenge A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_ARRAY_BUFFER</code> that contains the challenge data.
+   *
+   * @param[out] signed_data A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_ARRAY_BUFFER</code> that contains the data signed by the
+   * platform.
+   *
+   * @param[out] signed_data_signature A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_ARRAY_BUFFER</code> that contains the signature of the
+   * signed data block.
+   *
+   * @param[out] platform_key_certificate A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_STRING</code> that contains the device specific
+   * certificate for the requested service_id.
+   *
+   * @param[in] callback A <code>PP_CompletionCallback</code> to be called after
+   * the platform challenge has been completed. This callback will only run if
+   * the return code is <code>PP_OK_COMPLETIONPENDING</code>.
+   *
+   * @return An int32_t containing an error code from <code>pp_errors.h</code>.
+   */
+  int32_t ChallengePlatform(
+      [in] PP_Resource instance,
+      [in] PP_Var service_id,
+      [in] PP_Var challenge,
+      [out] PP_Var signed_data,
+      [out] PP_Var signed_data_signature,
+      [out] PP_Var platform_key_certificate,
+      [in] PP_CompletionCallback callback);
+};

ppapi/c/ppb_file_system.h

@@ -3,7 +3,7 @@
  * found in the LICENSE file.
  */
 
-/* From ppb_file_system.idl modified Thu May  2 16:44:38 2013. */
+/* From ppb_file_system.idl modified Thu Jun 13 14:30:40 2013. */
 
 #ifndef PPAPI_C_PPB_FILE_SYSTEM_H_
 #define PPAPI_C_PPB_FILE_SYSTEM_H_
@@ -66,9 +66,7 @@ struct PPB_FileSystem_1_0 {
    * @param[in] expected_size The expected size of the file system. Note that
    * this does not request quota; to do that, you must either invoke
    * requestQuota from JavaScript:
-
-
-    * http://www.html5rocks.com/en/tutorials/file/filesystem/#toc-requesting-quota
+   * http://www.html5rocks.com/en/tutorials/file/filesystem/#toc-requesting-quota
    * or set the unlimitedStorage permission for Chrome Web Store apps:
    * http://code.google.com/chrome/extensions/manifest.html#permissions
    *

ppapi/c/private/ppb_platform_verification_private.h

+/* Copyright 2013 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+/* From private/ppb_platform_verification_private.idl,
+ *   modified Mon Sep  9 12:54:47 2013.
+ */
+
+#ifndef PPAPI_C_PRIVATE_PPB_PLATFORM_VERIFICATION_PRIVATE_H_
+#define PPAPI_C_PRIVATE_PPB_PLATFORM_VERIFICATION_PRIVATE_H_
+
+#include "ppapi/c/pp_bool.h"
+#include "ppapi/c/pp_completion_callback.h"
+#include "ppapi/c/pp_instance.h"
+#include "ppapi/c/pp_macros.h"
+#include "ppapi/c/pp_resource.h"
+#include "ppapi/c/pp_stdint.h"
+#include "ppapi/c/pp_var.h"
+
+#define PPB_PLATFORMVERIFICATION_PRIVATE_INTERFACE_0_1 \
+    "PPB_PlatformVerification_Private;0.1"
+#define PPB_PLATFORMVERIFICATION_PRIVATE_INTERFACE \
+    PPB_PLATFORMVERIFICATION_PRIVATE_INTERFACE_0_1
+
+/**
+ * @file
+ * This file defines the API for platform verification. Currently, it only
+ * supports Chrome OS.
+ */
+
+
+/**
+ * @addtogroup Interfaces
+ * @{
+ */
+/**
+ * The <code>PPB_PlatformVerification_Private</code> interface allows authorized
+ * services to verify that the underlying platform is trusted. An example of a
+ * trusted platform is a Chrome OS device in verified boot mode.
+ */
+struct PPB_PlatformVerification_Private_0_1 {
+  /**
+   * Create() creates a <code>PPB_PlatformVerification_Private</code> object.
+   *
+   * @pram[in] instance A <code>PP_Instance</code> identifying one instance of
+   * a module.
+   *
+   * @return A <code>PP_Resource</code> corresponding to a
+   * <code>PPB_PlatformVerification_Private</code> if successful, 0 if creation
+   * failed.
+   */
+  PP_Resource (*Create)(PP_Instance instance);
+  /**
+   * IsPlatformVerification() determines if the provided resource is a
+   * <code>PPB_PlatformVerification_Private</code>.
+   *
+   * @param[in] resource A <code>PP_Resource</code> corresponding to a
+   * <code>PPB_PlatformVerification_Private</code>.
+   *
+   * @return <code>PP_TRUE</code> if the resource is a
+   * <code>PPB_PlatformVerification_Private</code>, <code>PP_FALSE</code> if the
+   * resource is invalid or some type other than
+   * <code>PPB_PlatformVerification_Private</code>.
+   */
+  PP_Bool (*IsPlatformVerification)(PP_Resource resource);
+  /**
+   * Check if the underlying host platform can be challenged; i.e., verified as
+   * a trusted platform. Useful for avoiding unnecessary work on platforms
+   * which will always fail; i.e. dev mode Chrome OS.
+   *
+   * @return <code>PP_TRUE</code> if a platform challenge might pass and
+   * <code>PP_FALSE</code> if it definitely won't.
+   */
+  PP_Bool (*CanChallengePlatform)(PP_Resource instance);
+  /**
+   * Requests a platform challenge for a given service id.
+   *
+   * @param[in] service_id A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_STRING</code> containing the service_id for the challenge.
+   *
+   * @param[in] challenge A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_ARRAY_BUFFER</code> that contains the challenge data.
+   *
+   * @param[out] signed_data A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_ARRAY_BUFFER</code> that contains the data signed by the
+   * platform.
+   *
+   * @param[out] signed_data_signature A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_ARRAY_BUFFER</code> that contains the signature of the
+   * signed data block.
+   *
+   * @param[out] platform_key_certificate A <code>PP_Var</code> of type
+   * <code>PP_VARTYPE_STRING</code> that contains the device specific
+   * certificate for the requested service_id.
+   *
+   * @param[in] callback A <code>PP_CompletionCallback</code> to be called after
+   * the platform challenge has been completed. This callback will only run if
+   * the return code is <code>PP_OK_COMPLETIONPENDING</code>.
+   *
+   * @return An int32_t containing an error code from <code>pp_errors.h</code>.
+   */
+  int32_t (*ChallengePlatform)(PP_Resource instance,
+                               struct PP_Var service_id,
+                               struct PP_Var challenge,
+                               struct PP_Var* signed_data,
+                               struct PP_Var* signed_data_signature,
+                               struct PP_Var* platform_key_certificate,
+                               struct PP_CompletionCallback callback);
+};
+
+typedef struct PPB_PlatformVerification_Private_0_1
+    PPB_PlatformVerification_Private;
+/**
+ * @}
+ */
+
+#endif  /* PPAPI_C_PRIVATE_PPB_PLATFORM_VERIFICATION_PRIVATE_H_ */
+

ppapi/generators/idl_c_proto.py

@@ -606,8 +606,14 @@ class CGen(object):
     for line in data.split('\n'):
       # Add indentation
       line = tab + line
-      if len(line) <= 80:
+      space_break = line.rfind(' ', 0, 80)
+      if len(line) <= 80 or 'http' in line:
+        # Ignore normal line and URLs permitted by the style guide.
         lines.append(line.rstrip())
+      elif not '(' in line and space_break >= 0:
+        # Break long typedefs on nearest space.
+        lines.append(line[0:space_break])
+        lines.append('    ' + line[space_break + 1:])
       else:
         left = line.rfind('(') + 1
         args = line[left:].split(',')

ppapi/native_client/src/untrusted/pnacl_irt_shim/pnacl_shim.c

@@ -102,6 +102,7 @@
 #include "ppapi/c/private/ppb_network_list_private.h"
 #include "ppapi/c/private/ppb_network_monitor_private.h"
 #include "ppapi/c/private/ppb_output_protection_private.h"
+#include "ppapi/c/private/ppb_platform_verification_private.h"
 #include "ppapi/c/private/ppb_talk_private.h"
 #include "ppapi/c/private/ppb_tcp_server_socket_private.h"
 #include "ppapi/c/private/ppb_tcp_socket_private.h"
@@ -211,6 +212,7 @@ static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_NetAddress_Private_1_1;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_NetworkList_Private_0_3;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_NetworkMonitor_Private_0_3;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_OutputProtection_Private_0_1;
+static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_PlatformVerification_Private_0_1;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Talk_Private_1_0;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Talk_Private_2_0;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_TCPServerSocket_Private_0_1;
@@ -3152,6 +3154,30 @@ static int32_t Pnacl_M31_PPB_OutputProtection_Private_EnableProtection(PP_Resour
 
 /* End wrapper methods for PPB_OutputProtection_Private_0_1 */
 
+/* Begin wrapper methods for PPB_PlatformVerification_Private_0_1 */
+
+static PP_Resource Pnacl_M31_PPB_PlatformVerification_Private_Create(PP_Instance instance) {
+  const struct PPB_PlatformVerification_Private_0_1 *iface = Pnacl_WrapperInfo_PPB_PlatformVerification_Private_0_1.real_iface;
+  return iface->Create(instance);
+}
+
+static PP_Bool Pnacl_M31_PPB_PlatformVerification_Private_IsPlatformVerification(PP_Resource resource) {
+  const struct PPB_PlatformVerification_Private_0_1 *iface = Pnacl_WrapperInfo_PPB_PlatformVerification_Private_0_1.real_iface;
+  return iface->IsPlatformVerification(resource);
+}
+
+static PP_Bool Pnacl_M31_PPB_PlatformVerification_Private_CanChallengePlatform(PP_Resource instance) {
+  const struct PPB_PlatformVerification_Private_0_1 *iface = Pnacl_WrapperInfo_PPB_PlatformVerification_Private_0_1.real_iface;
+  return iface->CanChallengePlatform(instance);
+}
+
+static int32_t Pnacl_M31_PPB_PlatformVerification_Private_ChallengePlatform(PP_Resource instance, struct PP_Var* service_id, struct PP_Var* challenge, struct PP_Var* signed_data, struct PP_Var* signed_data_signature, struct PP_Var* platform_key_certificate, struct PP_CompletionCallback* callback) {
+  const struct PPB_PlatformVerification_Private_0_1 *iface = Pnacl_WrapperInfo_PPB_PlatformVerification_Private_0_1.real_iface;
+  return iface->ChallengePlatform(instance, *service_id, *challenge, signed_data, signed_data_signature, platform_key_certificate, *callback);
+}
+
+/* End wrapper methods for PPB_PlatformVerification_Private_0_1 */
+
 /* Begin wrapper methods for PPB_Talk_Private_1_0 */
 
 static PP_Resource Pnacl_M19_PPB_Talk_Private_Create(PP_Instance instance) {
@@ -4833,6 +4859,13 @@ struct PPB_OutputProtection_Private_0_1 Pnacl_Wrappers_PPB_OutputProtection_Priv
     .EnableProtection = (int32_t (*)(PP_Resource resource, uint32_t desired_protection_mask, struct PP_CompletionCallback callback))&Pnacl_M31_PPB_OutputProtection_Private_EnableProtection
 };
 
+struct PPB_PlatformVerification_Private_0_1 Pnacl_Wrappers_PPB_PlatformVerification_Private_0_1 = {
+    .Create = (PP_Resource (*)(PP_Instance instance))&Pnacl_M31_PPB_PlatformVerification_Private_Create,
+    .IsPlatformVerification = (PP_Bool (*)(PP_Resource resource))&Pnacl_M31_PPB_PlatformVerification_Private_IsPlatformVerification,
+    .CanChallengePlatform = (PP_Bool (*)(PP_Resource instance))&Pnacl_M31_PPB_PlatformVerification_Private_CanChallengePlatform,
+    .ChallengePlatform = (int32_t (*)(PP_Resource instance, struct PP_Var service_id, struct PP_Var challenge, struct PP_Var* signed_data, struct PP_Var* signed_data_signature, struct PP_Var* platform_key_certificate, struct PP_CompletionCallback callback))&Pnacl_M31_PPB_PlatformVerification_Private_ChallengePlatform
+};
+
 struct PPB_Talk_Private_1_0 Pnacl_Wrappers_PPB_Talk_Private_1_0 = {
     .Create = (PP_Resource (*)(PP_Instance instance))&Pnacl_M19_PPB_Talk_Private_Create,
     .GetPermission = (int32_t (*)(PP_Resource talk_resource, struct PP_CompletionCallback callback))&Pnacl_M19_PPB_Talk_Private_GetPermission
@@ -5506,6 +5539,12 @@ static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_OutputProtection_Private_
   .real_iface = NULL
 };
 
+static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_PlatformVerification_Private_0_1 = {
+  .iface_macro = PPB_PLATFORMVERIFICATION_PRIVATE_INTERFACE_0_1,
+  .wrapped_iface = (void *) &Pnacl_Wrappers_PPB_PlatformVerification_Private_0_1,
+  .real_iface = NULL
+};
+
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Talk_Private_1_0 = {
   .iface_macro = PPB_TALK_PRIVATE_INTERFACE_1_0,
   .wrapped_iface = (void *) &Pnacl_Wrappers_PPB_Talk_Private_1_0,
@@ -5702,6 +5741,7 @@ static struct __PnaclWrapperInfo *s_ppb_wrappers[] = {
   &Pnacl_WrapperInfo_PPB_NetworkList_Private_0_3,
   &Pnacl_WrapperInfo_PPB_NetworkMonitor_Private_0_3,
   &Pnacl_WrapperInfo_PPB_OutputProtection_Private_0_1,
+  &Pnacl_WrapperInfo_PPB_PlatformVerification_Private_0_1,
   &Pnacl_WrapperInfo_PPB_Talk_Private_1_0,
   &Pnacl_WrapperInfo_PPB_Talk_Private_2_0,
   &Pnacl_WrapperInfo_PPB_TCPServerSocket_Private_0_1,

ppapi/thunk/ppb_platform_verification_private_thunk.cc

+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// From private/ppb_platform_verification_private.idl,
+//   modified Thu Sep  5 17:37:17 2013.
+
+#include "ppapi/c/pp_completion_callback.h"
+#include "ppapi/c/pp_errors.h"
+#include "ppapi/c/private/ppb_platform_verification_private.h"
+#include "ppapi/shared_impl/tracked_callback.h"
+#include "ppapi/thunk/enter.h"
+#include "ppapi/thunk/ppb_instance_api.h"
+#include "ppapi/thunk/ppb_platform_verification_api.h"
+#include "ppapi/thunk/resource_creation_api.h"
+#include "ppapi/thunk/thunk.h"
+
+namespace ppapi {
+namespace thunk {
+
+namespace {
+
+PP_Resource Create(PP_Instance instance) {
+  VLOG(4) << "PPB_PlatformVerification_Private::Create()";
+  EnterResourceCreation enter(instance);
+  if (enter.failed())
+    return 0;
+  return enter.functions()->CreatePlatformVerificationPrivate(instance);
+}
+
+PP_Bool IsPlatformVerification(PP_Resource resource) {
+  VLOG(4) << "PPB_PlatformVerification_Private::IsPlatformVerification()";
+  EnterResource<PPB_PlatformVerification_API> enter(resource, false);
+  return PP_FromBool(enter.succeeded());
+}
+
+PP_Bool CanChallengePlatform(PP_Resource instance) {
+  VLOG(4) << "PPB_PlatformVerification_Private::CanChallengePlatform()";
+  EnterResource<PPB_PlatformVerification_API> enter(instance, true);
+  if (enter.failed())
+    return PP_FALSE;
+  return enter.object()->CanChallengePlatform();
+}
+
+int32_t ChallengePlatform(PP_Resource instance,
+                          struct PP_Var service_id,
+                          struct PP_Var challenge,
+                          struct PP_Var* signed_data,
+                          struct PP_Var* signed_data_signature,
+                          struct PP_Var* platform_key_certificate,
+                          struct PP_CompletionCallback callback) {
+  VLOG(4) << "PPB_PlatformVerification_Private::ChallengePlatform()";
+  EnterResource<PPB_PlatformVerification_API> enter(instance, callback, true);
+  if (enter.failed())
+    return enter.retval();
+  return enter.SetResult(enter.object()->ChallengePlatform(
+      service_id,
+      challenge,
+      signed_data,
+      signed_data_signature,
+      platform_key_certificate,
+      enter.callback()));
+}
+
+const PPB_PlatformVerification_Private_0_1
+    g_ppb_platformverification_private_thunk_0_1 = {
+  &Create,
+  &IsPlatformVerification,
+  &CanChallengePlatform,
+  &ChallengePlatform
+};
+
+}  // namespace
+
+const PPB_PlatformVerification_Private_0_1*
+    GetPPB_PlatformVerification_Private_0_1_Thunk() {
+  return &g_ppb_platformverification_private_thunk_0_1;
+}
+
+}  // namespace thunk
+}  // namespace ppapi