2 * Copyright (c) 2015, JANET(UK)
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of JANET(UK) nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
25 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
27 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
29 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
31 * OF THE POSSIBILITY OF SUCH DAMAGE.
34 function addScript(url) {
35 var elt = document.createElement("script");
36 elt.setAttribute("src",
38 document.head.appendChild(elt);
43 var gssHostNames = {};
44 var pendingGssHostNames = {};
46 if ("undefined" != typeof(chrome) &&
47 "undefined" != typeof(chrome.extension) &&
48 "undefined" != typeof(chrome.extension.getURL))
52 gss_script_name = chrome.extension.getURL('navigator.gss.js');
53 port = chrome.runtime.connect({name: "com.painlesssecurity.gssweb"});
57 gss_script_name = 'chrome://gssweb/content/navigator.gss.js';
60 addScript( gss_script_name );
62 sendReplyToWebpage = function(gssReplyJSON) {
63 var appTag = gssReplyJSON.cookies.app_tag;
64 var csTag = gssReplyJSON.cookies.cs_tag;
66 gssReplyJSON.cookies.cs_tag = undefined;
68 /* Save off the hostnames of any reply to GSSImportName if:
70 * + The invoked method was 'gss_import_name'
71 * + The method completed successfully
72 * + There is a hostname wating in the pendingGssHostNames hash
75 if ( typeof(csTag) != 'undefined' &&
76 gssReplyJSON.method == 'gss_import_name' &&
77 typeof(gssReplyJSON.return_values) != 'undefined' &&
78 gssReplyJSON.return_values.major_status == '0' &&
79 typeof(pendingGssHostNames[csTag]) != 'undefined' )
81 gssHostNames[gssReplyJSON.return_values.gss_name] =
82 pendingGssHostNames[csTag];
83 delete pendingGssHostNames[csTag];
86 console.log("[" + appTag +
87 "] Extension port listener received message: [" +
88 JSON.stringify(gssReplyJSON) + "]"
90 window.postMessage(gssReplyJSON, "*");
94 /* When we get a message back from the extension
97 if ("Chrome" == browser)
99 port.onMessage.addListener( sendReplyToWebpage );
103 self.port.on('gss_response', sendReplyToWebpage );
106 window.addEventListener("message", function(event) {
107 // Check to see if this message's data is data we care about
108 if ( typeof(event.data.method) == 'undefined' ||
109 typeof(event.data.arguments) == 'undefined' ||
110 typeof(event.data.return_values) != 'undefined' )
113 if ( typeof(event.data.cookies) == 'undefined' )
115 event.data.cookies = {};
117 var appTag = event.data.cookies.app_tag;
119 console.log("[" + appTag +
120 "] Window message listener received message: [" +
121 JSON.stringify(event.data) + "]"
125 * Deny calls to init_sec_context where we don't know that the
126 * target has the same hostname as the origin.
128 if(event.data.method == "gss_init_sec_context" &&
129 typeof(event.data.arguments) != 'undefined' &&
130 gssHostNames[event.data.arguments.target_name] !=
131 document.location.hostname)
133 console.log("[" + appTag + "] Window message listener received " +
134 "gss_init_sec_context, but the hostname in the " +
135 "target_name could not be found to match the document " +
136 "location hostname.");
138 'method':'gss_init_sec_context',
142 'major_status_message': 'The GSS call cannot be completed',
143 'minor_status_message': 'init_sec_context requires a target ' +
144 'that matches your page origin.'
146 'cookies': event.data.cookies;
151 /* Add a content script tag, csTag */
152 var csTag = navigator.generateNonce();
153 event.data.cookies.cs_tag = csTag;
155 /* Save out the hostname from calls to import_name with an
158 if(event.data.method == 'gss_import_name')
160 if( typeof(event.data.arguments) != 'undefined' &&
161 ( event.data.arguments.input_name_type ==
162 "{1 2 840 113554 1 2 1 4 }" ||
163 event.data.arguments.input_name_type ==
164 "1.2.840.113554.1.2.1.4" ) )
166 var hostname = /[^@]*$/.exec(event.data.arguments.input_name)[0];
167 pendingGssHostNames[csTag] = hostname;
171 if ("Chrome" == browser)
173 port.postMessage(event.data);
176 self.port.emit("gss_request", event.data);