extensions/browser/api/cast_channel/cast_socket.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "extensions/browser/api/cast_channel/cast_socket.h"
   6
   7 #include <stdlib.h>
   8 #include <string.h>
   9
  10 #include "base/bind.h"
  11 #include "base/callback_helpers.h"
  12 #include "base/format_macros.h"
  13 #include "base/lazy_instance.h"
  14 #include "base/numerics/safe_conversions.h"
  15 #include "base/strings/string_number_conversions.h"
  16 #include "base/strings/stringprintf.h"
  17 #include "base/sys_byteorder.h"
  18 #include "base/time/time.h"
  19 #include "extensions/browser/api/cast_channel/cast_auth_util.h"
  20 #include "extensions/browser/api/cast_channel/cast_framer.h"
  21 #include "extensions/browser/api/cast_channel/cast_message_util.h"
  22 #include "extensions/browser/api/cast_channel/cast_transport.h"
  23 #include "extensions/browser/api/cast_channel/logger.h"
  24 #include "extensions/browser/api/cast_channel/logger_util.h"
  25 #include "extensions/common/api/cast_channel/cast_channel.pb.h"
  26 #include "net/base/address_list.h"
  27 #include "net/base/host_port_pair.h"
  28 #include "net/base/net_errors.h"
  29 #include "net/base/net_util.h"
  30 #include "net/cert/cert_verifier.h"
  31 #include "net/cert/x509_certificate.h"
  32 #include "net/http/transport_security_state.h"
  33 #include "net/socket/client_socket_factory.h"
  34 #include "net/socket/client_socket_handle.h"
  35 #include "net/socket/ssl_client_socket.h"
  36 #include "net/socket/stream_socket.h"
  37 #include "net/socket/tcp_client_socket.h"
  38 #include "net/ssl/ssl_config_service.h"
  39 #include "net/ssl/ssl_info.h"
  40
  41 // Assumes |ip_endpoint_| of type net::IPEndPoint and |channel_auth_| of enum
  42 // type ChannelAuthType are available in the current scope.
  43 #define VLOG_WITH_CONNECTION(level) VLOG(level) << "[" << \
  44     ip_endpoint_.ToString() << ", auth=" << channel_auth_ << "] "
  45
  46 namespace extensions {
  47 static base::LazyInstance<BrowserContextKeyedAPIFactory<
  48     ApiResourceManager<api::cast_channel::CastSocket>>> g_factory =
  49     LAZY_INSTANCE_INITIALIZER;
  50
  51 // static
  52 template <>
  53 BrowserContextKeyedAPIFactory<
  54     ApiResourceManager<api::cast_channel::CastSocket>>*
  55 ApiResourceManager<api::cast_channel::CastSocket>::GetFactoryInstance() {
  56   return g_factory.Pointer();
  57 }
  58
  59 namespace api {
  60 namespace cast_channel {
  61 namespace {
  62
  63 const int kMaxSelfSignedCertLifetimeInDays = 4;
  64
  65 std::string FormatTimeForLogging(base::Time time) {
  66   base::Time::Exploded exploded_time;
  67   time.UTCExplode(&exploded_time);
  68   return base::StringPrintf(
  69       "%04d-%02d-%02d %02d:%02d:%02d.%03d UTC", exploded_time.year,
  70       exploded_time.month, exploded_time.day_of_month, exploded_time.hour,
  71       exploded_time.minute, exploded_time.second, exploded_time.millisecond);
  72 }
  73
  74 bool IsTerminalState(proto::ConnectionState state) {
  75   return state == proto::CONN_STATE_FINISHED ||
  76          state == proto::CONN_STATE_ERROR || state == proto::CONN_STATE_TIMEOUT;
  77 }
  78
  79 }  // namespace
  80
  81 CastSocket::CastSocket(const std::string& owner_extension_id)
  82     : ApiResource(owner_extension_id) {
  83 }
  84
  85 bool CastSocket::IsPersistent() const {
  86   return true;
  87 }
  88
  89 CastSocketImpl::CastSocketImpl(const std::string& owner_extension_id,
  90                                const net::IPEndPoint& ip_endpoint,
  91                                ChannelAuthType channel_auth,
  92                                net::NetLog* net_log,
  93                                const base::TimeDelta& timeout,
  94                                bool keep_alive,
  95                                const scoped_refptr<Logger>& logger,
  96                                uint64 device_capabilities)
  97     : CastSocket(owner_extension_id),
  98       owner_extension_id_(owner_extension_id),
  99       channel_id_(0),
 100       ip_endpoint_(ip_endpoint),
 101       channel_auth_(channel_auth),
 102       net_log_(net_log),
 103       keep_alive_(keep_alive),
 104       logger_(logger),
 105       connect_timeout_(timeout),
 106       connect_timeout_timer_(new base::OneShotTimer<CastSocketImpl>),
 107       is_canceled_(false),
 108       device_capabilities_(device_capabilities),
 109       connect_state_(proto::CONN_STATE_START_CONNECT),
 110       error_state_(CHANNEL_ERROR_NONE),
 111       ready_state_(READY_STATE_NONE),
 112       auth_delegate_(nullptr) {
 113   DCHECK(net_log_);
 114   DCHECK(channel_auth_ == CHANNEL_AUTH_TYPE_SSL ||
 115          channel_auth_ == CHANNEL_AUTH_TYPE_SSL_VERIFIED);
 116   net_log_source_.type = net::NetLog::SOURCE_SOCKET;
 117   net_log_source_.id = net_log_->NextID();
 118 }
 119
 120 CastSocketImpl::~CastSocketImpl() {
 121   // Ensure that resources are freed but do not run pending callbacks to avoid
 122   // any re-entrancy.
 123   CloseInternal();
 124 }
 125
 126 ReadyState CastSocketImpl::ready_state() const {
 127   return ready_state_;
 128 }
 129
 130 ChannelError CastSocketImpl::error_state() const {
 131   return error_state_;
 132 }
 133
 134 const net::IPEndPoint& CastSocketImpl::ip_endpoint() const {
 135   return ip_endpoint_;
 136 }
 137
 138 int CastSocketImpl::id() const {
 139   return channel_id_;
 140 }
 141
 142 void CastSocketImpl::set_id(int id) {
 143   channel_id_ = id;
 144 }
 145
 146 ChannelAuthType CastSocketImpl::channel_auth() const {
 147   return channel_auth_;
 148 }
 149
 150 bool CastSocketImpl::keep_alive() const {
 151   return keep_alive_;
 152 }
 153
 154 scoped_ptr<net::TCPClientSocket> CastSocketImpl::CreateTcpSocket() {
 155   net::AddressList addresses(ip_endpoint_);
 156   return scoped_ptr<net::TCPClientSocket>(
 157       new net::TCPClientSocket(addresses, net_log_, net_log_source_));
 158   // Options cannot be set on the TCPClientSocket yet, because the
 159   // underlying platform socket will not be created until Bind()
 160   // or Connect() is called.
 161 }
 162
 163 scoped_ptr<net::SSLClientSocket> CastSocketImpl::CreateSslSocket(
 164     scoped_ptr<net::StreamSocket> socket) {
 165   net::SSLConfig ssl_config;
 166   // If a peer cert was extracted in a previous attempt to connect, then
 167   // whitelist that cert.
 168   if (!peer_cert_.empty()) {
 169     net::SSLConfig::CertAndStatus cert_and_status;
 170     cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID;
 171     cert_and_status.der_cert = peer_cert_;
 172     ssl_config.allowed_bad_certs.push_back(cert_and_status);
 173     logger_->LogSocketEvent(channel_id_, proto::SSL_CERT_WHITELISTED);
 174   }
 175
 176   cert_verifier_ = net::CertVerifier::CreateDefault();
 177   transport_security_state_.reset(new net::TransportSecurityState);
 178   net::SSLClientSocketContext context;
 179   // CertVerifier and TransportSecurityState are owned by us, not the
 180   // context object.
 181   context.cert_verifier = cert_verifier_.get();
 182   context.transport_security_state = transport_security_state_.get();
 183
 184   scoped_ptr<net::ClientSocketHandle> connection(new net::ClientSocketHandle);
 185   connection->SetSocket(socket.Pass());
 186   net::HostPortPair host_and_port = net::HostPortPair::FromIPEndPoint(
 187       ip_endpoint_);
 188
 189   return net::ClientSocketFactory::GetDefaultFactory()->CreateSSLClientSocket(
 190       connection.Pass(), host_and_port, ssl_config, context);
 191 }
 192
 193 bool CastSocketImpl::ExtractPeerCert(std::string* cert) {
 194   DCHECK(cert);
 195   DCHECK(peer_cert_.empty());
 196   net::SSLInfo ssl_info;
 197   if (!socket_->GetSSLInfo(&ssl_info) || !ssl_info.cert.get()) {
 198     return false;
 199   }
 200
 201   logger_->LogSocketEvent(channel_id_, proto::SSL_INFO_OBTAINED);
 202
 203   // Ensure that the peer cert (which is self-signed) doesn't have an excessive
 204   // remaining life-time.
 205   base::Time expiry = ssl_info.cert->valid_expiry();
 206   base::Time lifetimeLimit =
 207       base::Time::Now() +
 208       base::TimeDelta::FromDays(kMaxSelfSignedCertLifetimeInDays);
 209   if (expiry.is_null() || expiry > lifetimeLimit) {
 210     logger_->LogSocketEventWithDetails(channel_id_,
 211                                        proto::SSL_CERT_EXCESSIVE_LIFETIME,
 212                                        FormatTimeForLogging(expiry));
 213     return false;
 214   }
 215
 216   bool result = net::X509Certificate::GetDEREncoded(
 217      ssl_info.cert->os_cert_handle(), cert);
 218   if (result) {
 219     VLOG_WITH_CONNECTION(1) << "Successfully extracted peer certificate";
 220   }
 221
 222   logger_->LogSocketEventWithRv(
 223       channel_id_, proto::DER_ENCODED_CERT_OBTAIN, result ? 1 : 0);
 224   return result;
 225 }
 226
 227 bool CastSocketImpl::VerifyChannelPolicy(const AuthResult& result) {
 228   if ((device_capabilities_ & CastDeviceCapability::VIDEO_OUT) != 0 &&
 229       (result.channel_policies & AuthResult::POLICY_AUDIO_ONLY) != 0) {
 230     LOG(ERROR) << "Audio only policy enforced";
 231     logger_->LogSocketEventWithDetails(
 232         channel_id_, proto::CHANNEL_POLICY_ENFORCED, std::string());
 233     return false;
 234   }
 235   return true;
 236 }
 237
 238 bool CastSocketImpl::VerifyChallengeReply() {
 239   AuthResult result = AuthenticateChallengeReply(*challenge_reply_, peer_cert_);
 240   logger_->LogSocketChallengeReplyEvent(channel_id_, result);
 241   if (result.success()) {
 242     VLOG(1) << result.error_message;
 243     if (!VerifyChannelPolicy(result)) {
 244       return false;
 245     }
 246   }
 247   return result.success();
 248 }
 249
 250 void CastSocketImpl::SetTransportForTesting(
 251     scoped_ptr<CastTransport> transport) {
 252   transport_ = transport.Pass();
 253 }
 254
 255 void CastSocketImpl::Connect(scoped_ptr<CastTransport::Delegate> delegate,
 256                              base::Callback<void(ChannelError)> callback) {
 257   DCHECK(CalledOnValidThread());
 258   VLOG_WITH_CONNECTION(1) << "Connect readyState = " << ready_state_;
 259   DCHECK_EQ(proto::CONN_STATE_START_CONNECT, connect_state_);
 260
 261   delegate_ = delegate.Pass();
 262
 263   if (ready_state_ != READY_STATE_NONE) {
 264     logger_->LogSocketEventWithDetails(
 265         channel_id_, proto::CONNECT_FAILED, "ReadyState not NONE");
 266     callback.Run(CHANNEL_ERROR_CONNECT_ERROR);
 267     return;
 268   }
 269
 270   connect_callback_ = callback;
 271   SetReadyState(READY_STATE_CONNECTING);
 272   SetConnectState(proto::CONN_STATE_TCP_CONNECT);
 273
 274   // Set up connection timeout.
 275   if (connect_timeout_.InMicroseconds() > 0) {
 276     DCHECK(connect_timeout_callback_.IsCancelled());
 277     connect_timeout_callback_.Reset(
 278         base::Bind(&CastSocketImpl::OnConnectTimeout, base::Unretained(this)));
 279     GetTimer()->Start(FROM_HERE,
 280                       connect_timeout_,
 281                       connect_timeout_callback_.callback());
 282   }
 283
 284   DoConnectLoop(net::OK);
 285 }
 286
 287 CastTransport* CastSocketImpl::transport() const {
 288   return transport_.get();
 289 }
 290
 291 void CastSocketImpl::OnConnectTimeout() {
 292   DCHECK(CalledOnValidThread());
 293   // Stop all pending connection setup tasks and report back to the client.
 294   is_canceled_ = true;
 295   logger_->LogSocketEvent(channel_id_, proto::CONNECT_TIMED_OUT);
 296   VLOG_WITH_CONNECTION(1) << "Timeout while establishing a connection.";
 297   SetErrorState(CHANNEL_ERROR_CONNECT_TIMEOUT);
 298   DoConnectCallback();
 299 }
 300
 301 void CastSocketImpl::PostTaskToStartConnectLoop(int result) {
 302   DCHECK(CalledOnValidThread());
 303   DCHECK(connect_loop_callback_.IsCancelled());
 304   connect_loop_callback_.Reset(base::Bind(&CastSocketImpl::DoConnectLoop,
 305                                           base::Unretained(this), result));
 306   base::MessageLoop::current()->PostTask(FROM_HERE,
 307                                          connect_loop_callback_.callback());
 308 }
 309
 310 // This method performs the state machine transitions for connection flow.
 311 // There are two entry points to this method:
 312 // 1. Connect method: this starts the flow
 313 // 2. Callback from network operations that finish asynchronously.
 314 void CastSocketImpl::DoConnectLoop(int result) {
 315   connect_loop_callback_.Cancel();
 316   if (is_canceled_) {
 317     LOG(ERROR) << "CANCELLED - Aborting DoConnectLoop.";
 318     return;
 319   }
 320
 321   // Network operations can either finish synchronously or asynchronously.
 322   // This method executes the state machine transitions in a loop so that
 323   // correct state transitions happen even when network operations finish
 324   // synchronously.
 325   int rv = result;
 326   do {
 327     proto::ConnectionState state = connect_state_;
 328     connect_state_ = proto::CONN_STATE_UNKNOWN;
 329     switch (state) {
 330       case proto::CONN_STATE_TCP_CONNECT:
 331         rv = DoTcpConnect();
 332         break;
 333       case proto::CONN_STATE_TCP_CONNECT_COMPLETE:
 334         rv = DoTcpConnectComplete(rv);
 335         break;
 336       case proto::CONN_STATE_SSL_CONNECT:
 337         DCHECK_EQ(net::OK, rv);
 338         rv = DoSslConnect();
 339         break;
 340       case proto::CONN_STATE_SSL_CONNECT_COMPLETE:
 341         rv = DoSslConnectComplete(rv);
 342         break;
 343       case proto::CONN_STATE_AUTH_CHALLENGE_SEND:
 344         rv = DoAuthChallengeSend();
 345         break;
 346       case proto::CONN_STATE_AUTH_CHALLENGE_SEND_COMPLETE:
 347         rv = DoAuthChallengeSendComplete(rv);
 348         break;
 349       case proto::CONN_STATE_AUTH_CHALLENGE_REPLY_COMPLETE:
 350         rv = DoAuthChallengeReplyComplete(rv);
 351         DCHECK(IsTerminalState(connect_state_));
 352         break;
 353       default:
 354         NOTREACHED() << "Unknown state in connect flow: " << state;
 355         SetConnectState(proto::CONN_STATE_FINISHED);
 356         SetErrorState(CHANNEL_ERROR_UNKNOWN);
 357         DoConnectCallback();
 358         return;
 359     }
 360   } while (rv != net::ERR_IO_PENDING && !IsTerminalState(connect_state_));
 361   // Exit the state machine if an asynchronous network operation is pending
 362   // or if the state machine is in the terminal "finished" state.
 363
 364   if (IsTerminalState(connect_state_)) {
 365     DCHECK_NE(rv, net::ERR_IO_PENDING);
 366     logger_->LogSocketConnectState(channel_id_, connect_state_);
 367     GetTimer()->Stop();
 368     DoConnectCallback();
 369   } else {
 370     DCHECK_EQ(rv, net::ERR_IO_PENDING);
 371   }
 372 }
 373
 374 int CastSocketImpl::DoTcpConnect() {
 375   DCHECK(connect_loop_callback_.IsCancelled());
 376   VLOG_WITH_CONNECTION(1) << "DoTcpConnect";
 377   SetConnectState(proto::CONN_STATE_TCP_CONNECT_COMPLETE);
 378   tcp_socket_ = CreateTcpSocket();
 379
 380   int rv = tcp_socket_->Connect(
 381       base::Bind(&CastSocketImpl::DoConnectLoop, base::Unretained(this)));
 382   logger_->LogSocketEventWithRv(channel_id_, proto::TCP_SOCKET_CONNECT, rv);
 383   return rv;
 384 }
 385
 386 int CastSocketImpl::DoTcpConnectComplete(int connect_result) {
 387   VLOG_WITH_CONNECTION(1) << "DoTcpConnectComplete: " << connect_result;
 388   logger_->LogSocketEventWithRv(channel_id_, proto::TCP_SOCKET_CONNECT_COMPLETE,
 389                                 connect_result);
 390   if (connect_result == net::OK) {
 391     SetConnectState(proto::CONN_STATE_SSL_CONNECT);
 392   } else if (connect_result == net::ERR_CONNECTION_TIMED_OUT) {
 393     SetConnectState(proto::CONN_STATE_FINISHED);
 394     SetErrorState(CHANNEL_ERROR_CONNECT_TIMEOUT);
 395   } else {
 396     SetConnectState(proto::CONN_STATE_FINISHED);
 397     SetErrorState(CHANNEL_ERROR_CONNECT_ERROR);
 398   }
 399   return connect_result;
 400 }
 401
 402 int CastSocketImpl::DoSslConnect() {
 403   DCHECK(connect_loop_callback_.IsCancelled());
 404   VLOG_WITH_CONNECTION(1) << "DoSslConnect";
 405   SetConnectState(proto::CONN_STATE_SSL_CONNECT_COMPLETE);
 406   socket_ = CreateSslSocket(tcp_socket_.Pass());
 407
 408   int rv = socket_->Connect(
 409       base::Bind(&CastSocketImpl::DoConnectLoop, base::Unretained(this)));
 410   logger_->LogSocketEventWithRv(channel_id_, proto::SSL_SOCKET_CONNECT, rv);
 411   return rv;
 412 }
 413
 414 int CastSocketImpl::DoSslConnectComplete(int result) {
 415   logger_->LogSocketEventWithRv(channel_id_, proto::SSL_SOCKET_CONNECT_COMPLETE,
 416                                 result);
 417   VLOG_WITH_CONNECTION(1) << "DoSslConnectComplete: " << result;
 418   if (result == net::ERR_CERT_AUTHORITY_INVALID &&
 419       peer_cert_.empty() && ExtractPeerCert(&peer_cert_)) {
 420     // Peer certificate fallback - try the connection again, from the top.
 421     SetConnectState(proto::CONN_STATE_TCP_CONNECT);
 422   } else if (result == net::OK) {
 423     // SSL connection succeeded.
 424     if (!transport_.get()) {
 425       // Create a channel transport if one wasn't already set (e.g. by test
 426       // code).
 427       transport_.reset(new CastTransportImpl(this->socket_.get(), channel_id_,
 428                                              ip_endpoint_, channel_auth_,
 429                                              logger_));
 430     }
 431     auth_delegate_ = new AuthTransportDelegate(this);
 432     transport_->SetReadDelegate(make_scoped_ptr(auth_delegate_));
 433     if (channel_auth_ == CHANNEL_AUTH_TYPE_SSL_VERIFIED) {
 434       // Additionally verify the connection with a handshake.
 435       SetConnectState(proto::CONN_STATE_AUTH_CHALLENGE_SEND);
 436     } else {
 437       SetConnectState(proto::CONN_STATE_FINISHED);
 438       transport_->Start();
 439     }
 440   } else if (result == net::ERR_CONNECTION_TIMED_OUT) {
 441     SetConnectState(proto::CONN_STATE_FINISHED);
 442     SetErrorState(CHANNEL_ERROR_CONNECT_TIMEOUT);
 443   } else {
 444     SetConnectState(proto::CONN_STATE_FINISHED);
 445     SetErrorState(CHANNEL_ERROR_AUTHENTICATION_ERROR);
 446   }
 447   return result;
 448 }
 449
 450 int CastSocketImpl::DoAuthChallengeSend() {
 451   VLOG_WITH_CONNECTION(1) << "DoAuthChallengeSend";
 452   SetConnectState(proto::CONN_STATE_AUTH_CHALLENGE_SEND_COMPLETE);
 453
 454   CastMessage challenge_message;
 455   CreateAuthChallengeMessage(&challenge_message);
 456   VLOG_WITH_CONNECTION(1) << "Sending challenge: "
 457                           << CastMessageToString(challenge_message);
 458
 459   transport_->SendMessage(
 460       challenge_message,
 461       base::Bind(&CastSocketImpl::DoConnectLoop, base::Unretained(this)));
 462
 463   // Always return IO_PENDING since the result is always asynchronous.
 464   return net::ERR_IO_PENDING;
 465 }
 466
 467 int CastSocketImpl::DoAuthChallengeSendComplete(int result) {
 468   VLOG_WITH_CONNECTION(1) << "DoAuthChallengeSendComplete: " << result;
 469   if (result < 0) {
 470     SetConnectState(proto::CONN_STATE_ERROR);
 471     SetErrorState(CHANNEL_ERROR_SOCKET_ERROR);
 472     logger_->LogSocketEventWithRv(channel_id_,
 473                                   proto::SEND_AUTH_CHALLENGE_FAILED, result);
 474     return result;
 475   }
 476   transport_->Start();
 477   SetConnectState(proto::CONN_STATE_AUTH_CHALLENGE_REPLY_COMPLETE);
 478   return net::ERR_IO_PENDING;
 479 }
 480
 481 CastSocketImpl::AuthTransportDelegate::AuthTransportDelegate(
 482     CastSocketImpl* socket)
 483     : socket_(socket), error_state_(CHANNEL_ERROR_NONE) {
 484   DCHECK(socket);
 485 }
 486
 487 ChannelError CastSocketImpl::AuthTransportDelegate::error_state() const {
 488   return error_state_;
 489 }
 490
 491 LastErrors CastSocketImpl::AuthTransportDelegate::last_errors() const {
 492   return last_errors_;
 493 }
 494
 495 void CastSocketImpl::AuthTransportDelegate::OnError(ChannelError error_state) {
 496   error_state_ = error_state;
 497   socket_->PostTaskToStartConnectLoop(net::ERR_CONNECTION_FAILED);
 498 }
 499
 500 void CastSocketImpl::AuthTransportDelegate::OnMessage(
 501     const CastMessage& message) {
 502   if (!IsAuthMessage(message)) {
 503     error_state_ = CHANNEL_ERROR_TRANSPORT_ERROR;
 504     socket_->logger_->LogSocketEvent(socket_->channel_id_,
 505                                      proto::AUTH_CHALLENGE_REPLY_INVALID);
 506     socket_->PostTaskToStartConnectLoop(net::ERR_INVALID_RESPONSE);
 507   } else {
 508     socket_->challenge_reply_.reset(new CastMessage(message));
 509     socket_->logger_->LogSocketEvent(socket_->channel_id_,
 510                                      proto::RECEIVED_CHALLENGE_REPLY);
 511     socket_->PostTaskToStartConnectLoop(net::OK);
 512   }
 513 }
 514
 515 void CastSocketImpl::AuthTransportDelegate::Start() {
 516 }
 517
 518 int CastSocketImpl::DoAuthChallengeReplyComplete(int result) {
 519   VLOG_WITH_CONNECTION(1) << "DoAuthChallengeReplyComplete: " << result;
 520
 521   if (auth_delegate_->error_state() != CHANNEL_ERROR_NONE) {
 522     SetErrorState(auth_delegate_->error_state());
 523     SetConnectState(proto::CONN_STATE_ERROR);
 524     return net::ERR_CONNECTION_FAILED;
 525   }
 526   auth_delegate_ = nullptr;
 527
 528   if (result < 0) {
 529     SetConnectState(proto::CONN_STATE_ERROR);
 530     return result;
 531   }
 532
 533   if (!VerifyChallengeReply()) {
 534     SetErrorState(CHANNEL_ERROR_AUTHENTICATION_ERROR);
 535     SetConnectState(proto::CONN_STATE_ERROR);
 536     return net::ERR_CONNECTION_FAILED;
 537   }
 538   VLOG_WITH_CONNECTION(1) << "Auth challenge verification succeeded";
 539
 540   SetConnectState(proto::CONN_STATE_FINISHED);
 541   return net::OK;
 542 }
 543
 544 void CastSocketImpl::DoConnectCallback() {
 545   VLOG(1) << "DoConnectCallback (error_state = " << error_state_ << ")";
 546   if (connect_callback_.is_null()) {
 547     DLOG(FATAL) << "Connection callback invoked multiple times.";
 548     return;
 549   }
 550
 551   if (error_state_ == CHANNEL_ERROR_NONE) {
 552     SetReadyState(READY_STATE_OPEN);
 553     transport_->SetReadDelegate(delegate_.Pass());
 554   } else {
 555     CloseInternal();
 556   }
 557
 558   base::ResetAndReturn(&connect_callback_).Run(error_state_);
 559 }
 560
 561 void CastSocketImpl::Close(const net::CompletionCallback& callback) {
 562   DCHECK(CalledOnValidThread());
 563   CloseInternal();
 564   // Run this callback last.  It may delete the socket.
 565   callback.Run(net::OK);
 566 }
 567
 568 void CastSocketImpl::CloseInternal() {
 569   // TODO(mfoltz): Enforce this when CastChannelAPITest is rewritten to create
 570   // and free sockets on the same thread.  crbug.com/398242
 571   DCHECK(CalledOnValidThread());
 572   if (ready_state_ == READY_STATE_CLOSED) {
 573     return;
 574   }
 575
 576   VLOG_WITH_CONNECTION(1) << "Close ReadyState = " << ready_state_;
 577   transport_.reset();
 578   tcp_socket_.reset();
 579   socket_.reset();
 580   transport_security_state_.reset();
 581   if (GetTimer()) {
 582     GetTimer()->Stop();
 583   }
 584
 585   // Cancel callbacks that we queued ourselves to re-enter the connect or read
 586   // loops.
 587   connect_loop_callback_.Cancel();
 588   send_auth_challenge_callback_.Cancel();
 589   connect_timeout_callback_.Cancel();
 590   SetReadyState(READY_STATE_CLOSED);
 591   logger_->LogSocketEvent(channel_id_, proto::SOCKET_CLOSED);
 592 }
 593
 594 bool CastSocketImpl::CalledOnValidThread() const {
 595   return thread_checker_.CalledOnValidThread();
 596 }
 597
 598 base::Timer* CastSocketImpl::GetTimer() {
 599   return connect_timeout_timer_.get();
 600 }
 601
 602 void CastSocketImpl::SetConnectState(proto::ConnectionState connect_state) {
 603   if (connect_state_ != connect_state) {
 604     connect_state_ = connect_state;
 605     logger_->LogSocketConnectState(channel_id_, connect_state_);
 606   }
 607 }
 608
 609 void CastSocketImpl::SetReadyState(ReadyState ready_state) {
 610   if (ready_state_ != ready_state) {
 611     ready_state_ = ready_state;
 612     logger_->LogSocketReadyState(channel_id_, ReadyStateToProto(ready_state_));
 613   }
 614 }
 615
 616 void CastSocketImpl::SetErrorState(ChannelError error_state) {
 617   VLOG_WITH_CONNECTION(1) << "SetErrorState " << error_state;
 618   DCHECK_EQ(CHANNEL_ERROR_NONE, error_state_);
 619   error_state_ = error_state;
 620   logger_->LogSocketErrorState(channel_id_, ErrorStateToProto(error_state_));
 621   delegate_->OnError(error_state_);
 622 }
 623 }  // namespace cast_channel
 624 }  // namespace api
 625 }  // namespace extensions
 626 #undef VLOG_WITH_CONNECTION