1 // Copyright 2015 The Weave Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef LIBWEAVE_SRC_PRIVET_SECURITY_MANAGER_H_ 6 #define LIBWEAVE_SRC_PRIVET_SECURITY_MANAGER_H_ 7 8 #include <map> 9 #include <memory> 10 #include <set> 11 #include <string> 12 #include <vector> 13 14 #include <base/callback.h> 15 #include <base/gtest_prod_util.h> 16 #include <base/memory/weak_ptr.h> 17 #include <weave/error.h> 18 19 #include "src/config.h" 20 #include "src/privet/security_delegate.h" 21 22 namespace crypto { 23 class P224EncryptedKeyExchange; 24 } // namespace crypto 25 26 namespace weave { 27 28 namespace provider { 29 class TaskRunner; 30 } 31 32 namespace privet { 33 34 class AuthManager; 35 36 class SecurityManager : public SecurityDelegate { 37 public: 38 using PairingStartListener = 39 base::Callback<void(const std::string& session_id, 40 PairingType pairing_type, 41 const std::vector<uint8_t>& code)>; 42 using PairingEndListener = 43 base::Callback<void(const std::string& session_id)>; 44 45 class KeyExchanger { 46 public: ~KeyExchanger()47 virtual ~KeyExchanger() {} 48 49 virtual const std::string& GetMessage() = 0; 50 virtual bool ProcessMessage(const std::string& message, 51 ErrorPtr* error) = 0; 52 virtual const std::string& GetKey() const = 0; 53 }; 54 55 SecurityManager(const Config* config, 56 AuthManager* auth_manager, 57 // TODO(vitalybuka): Remove task_runner. 58 provider::TaskRunner* task_runner); 59 ~SecurityManager() override; 60 61 // SecurityDelegate methods 62 bool CreateAccessToken(AuthType auth_type, 63 const std::string& auth_code, 64 AuthScope desired_scope, 65 std::string* access_token, 66 AuthScope* access_token_scope, 67 base::TimeDelta* access_token_ttl, 68 ErrorPtr* error) override; 69 bool ParseAccessToken(const std::string& token, 70 UserInfo* user_info, 71 ErrorPtr* error) const override; 72 std::set<PairingType> GetPairingTypes() const override; 73 std::set<CryptoType> GetCryptoTypes() const override; 74 std::set<AuthType> GetAuthTypes() const override; 75 std::string ClaimRootClientAuthToken(ErrorPtr* error) override; 76 bool ConfirmClientAuthToken(const std::string& token, 77 ErrorPtr* error) override; 78 bool StartPairing(PairingType mode, 79 CryptoType crypto, 80 std::string* session_id, 81 std::string* device_commitment, 82 ErrorPtr* error) override; 83 84 bool ConfirmPairing(const std::string& session_id, 85 const std::string& client_commitment, 86 std::string* fingerprint, 87 std::string* signature, 88 ErrorPtr* error) override; 89 bool CancelPairing(const std::string& session_id, ErrorPtr* error) override; 90 std::string CreateSessionId() override; 91 92 void RegisterPairingListeners(const PairingStartListener& on_start, 93 const PairingEndListener& on_end); 94 95 private: 96 const Config::Settings& GetSettings() const; 97 bool IsValidPairingCode(const std::vector<uint8_t>& auth_code) const; 98 FRIEND_TEST_ALL_PREFIXES(SecurityManagerTest, ThrottlePairing); 99 // Allows limited number of new sessions without successful authorization. 100 bool CheckIfPairingAllowed(ErrorPtr* error); 101 bool ClosePendingSession(const std::string& session_id); 102 bool CloseConfirmedSession(const std::string& session_id); 103 bool CreateAccessTokenImpl(AuthType auth_type, 104 const std::vector<uint8_t>& auth_code, 105 AuthScope desired_scope, 106 std::vector<uint8_t>* access_token, 107 AuthScope* access_token_scope, 108 base::TimeDelta* access_token_ttl, 109 ErrorPtr* error); 110 bool CreateAccessTokenImpl(AuthType auth_type, 111 AuthScope desired_scope, 112 std::vector<uint8_t>* access_token, 113 AuthScope* access_token_scope, 114 base::TimeDelta* access_token_ttl); 115 bool IsAnonymousAuthSupported() const; 116 bool IsPairingAuthSupported() const; 117 bool IsLocalAuthSupported() const; 118 119 const Config* config_{nullptr}; 120 AuthManager* auth_manager_{nullptr}; 121 122 // TODO(vitalybuka): Session cleanup can be done without posting tasks. 123 provider::TaskRunner* task_runner_{nullptr}; 124 std::map<std::string, std::unique_ptr<KeyExchanger>> pending_sessions_; 125 std::map<std::string, std::unique_ptr<KeyExchanger>> confirmed_sessions_; 126 mutable int pairing_attemts_{0}; 127 mutable base::Time block_pairing_until_; 128 PairingStartListener on_start_; 129 PairingEndListener on_end_; 130 uint64_t last_user_id_{0}; 131 132 base::WeakPtrFactory<SecurityManager> weak_ptr_factory_{this}; 133 134 DISALLOW_COPY_AND_ASSIGN(SecurityManager); 135 }; 136 137 } // namespace privet 138 } // namespace weave 139 140 #endif // LIBWEAVE_SRC_PRIVET_SECURITY_MANAGER_H_ 141