New issue
Advanced search Search tips

Issue 646944 link

Starred by 2 users
Status: Fixed
Owner:
yuweih@chromium.org
Closed: Sep 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug



Sign in to add a comment

[remoting host] Improve certificate selection during third-party-auth token verification.

Project Member Reported by lambroslambrou@chromium.org, Sep 14 2016 
We have some evidence (internal bug b/31399440) that the Chromoting host selects an incorrect certificate during SSL handshake when attempting third-party token verification.

The Chromoting code for choosing a certificate is here:
https://cs.chromium.org/chromium/src/remoting/host/token_validator_base.cc?q=OnCertificatesSelected&l=169

It looks like we are given a list of candidate certs and we simply go through the list looking for the first one that matches the cert-issuer defined by system policy settings. If policy defines
RemoteAccessHostTokenValidationCertificateIssuer
to be "*", then we always pick the first cert in the list.

Perhaps we can be more intelligent in selecting the cert - for example, select the most-recently-issued cert that matches the criteria?

Comment 1 by jamiewa...@chromium.org, Sep 15 2016

Labels: -Pri-3 Pri-2
Owner: yuweih@chromium.org
Status: Assigned (was: Untriaged)
It looks like we can get the creation and expiry times for each certificate. How about we pick the most recently created cert from an acceptable issuer that has not yet expired? That should ignore certs for which a replacement has been issued, but which have not yet expired.

As an aside, does it ever make sense for the issuer policy to be '*'? It seems like that's very fragile and should be called out as an error case.
Project Member

Comment 2 by bugdroid1@chromium.org, Sep 30 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e4807badb80cef2a24ffd3fdb3b8c28859c65a5c

commit e4807badb80cef2a24ffd3fdb3b8c28859c65a5c
Author: yuweih <yuweih@chromium.org>
Date: Fri Sep 30 00:56:54 2016

[Remoting Host] Select Latest Valid Cert

Currently TokenValidatorBase will always select the first certificate for
third-party authentication that matches the issuer but sometimes an incorrect
certificate will be selected.

This CL tries to improve this by:
* Not selecting certificate that is obviously expired (now > valid_expiry).
* Selecting the certificate with latest |valid_start| time.
* Selecting the certifiacte with latest |valid_expiry| time when |valid_start|
  is the same.

BUG= 646944 

Review-Url: https://codereview.chromium.org/2369193002
Cr-Commit-Position: refs/heads/master@{#422001}

[modify] https://crrev.com/e4807badb80cef2a24ffd3fdb3b8c28859c65a5c/remoting/host/BUILD.gn
[modify] https://crrev.com/e4807badb80cef2a24ffd3fdb3b8c28859c65a5c/remoting/host/token_validator_base.cc
[modify] https://crrev.com/e4807badb80cef2a24ffd3fdb3b8c28859c65a5c/remoting/host/token_validator_base.h
[add] https://crrev.com/e4807badb80cef2a24ffd3fdb3b8c28859c65a5c/remoting/host/token_validator_base_unittest.cc

Comment 3 by yuweih@chromium.org, Sep 30 2016

Status: Fixed (was: Assigned)
►

Sign in to add a comment