[Sync] Persist keystore key across restarts

sync/util/cryptographer.cc

Index: sync/util/cryptographer.cc
diff --git a/sync/util/cryptographer.cc b/sync/util/cryptographer.cc
index d63166bb4c7d21c741b321bba7aedb34ba118d29..c512ab6bf24c7c10a80b166c9b96ec8367b675da 100644
--- a/sync/util/cryptographer.cc
+++ b/sync/util/cryptographer.cc
@@ -49,7 +49,19 @@ void Cryptographer::Bootstrap(const std::string& restored_bootstrap_token) {
 
   scoped_ptr<Nigori> nigori(UnpackBootstrapToken(restored_bootstrap_token));
   if (nigori.get())
-    AddKeyImpl(nigori.release());
+    AddKeyImpl(nigori.release(), false);
+}
+
+void Cryptographer::BootstrapKeystoreKey(
+    const std::string& restored_bootstrap_token) {
+  if (keystore_nigori_) {
+    NOTREACHED();
+    return;
+  }
+
+  scoped_ptr<Nigori> nigori(UnpackBootstrapToken(restored_bootstrap_token));
+  if (nigori.get())
+    AddKeyImpl(nigori.release(), true);
 }
 
 bool Cryptographer::CanDecrypt(const sync_pb::EncryptedData& data) const {
@@ -145,7 +157,7 @@ bool Cryptographer::AddKey(const KeyParams& params) {
     NOTREACHED();  // Invalid username or password.
     return false;
   }
-  return AddKeyImpl(nigori.release());
+  return AddKeyImpl(nigori.release(), false);
 }
 
 bool Cryptographer::AddKeyFromBootstrapToken(
@@ -154,10 +166,11 @@ bool Cryptographer::AddKeyFromBootstrapToken(
   scoped_ptr<Nigori> nigori(UnpackBootstrapToken(restored_bootstrap_token));
   if (!nigori.get())
     return false;
-  return AddKeyImpl(nigori.release());
+  return AddKeyImpl(nigori.release(), false);
 }
 
-bool Cryptographer::AddKeyImpl(Nigori* initialized_nigori) {
+bool Cryptographer::AddKeyImpl(Nigori* initialized_nigori,
+                               bool is_keystore_key) {
   scoped_ptr<Nigori> nigori(initialized_nigori);
   std::string name;
   if (!nigori->Permute(Nigori::Password, kNigoriKeyName, &name)) {
@@ -165,7 +178,10 @@ bool Cryptographer::AddKeyImpl(Nigori* initialized_nigori) {
     return false;
   }
   nigoris_[name] = make_linked_ptr(nigori.release());
-  default_nigori_ = &*nigoris_.find(name);
+  if (is_keystore_key)
+    keystore_nigori_ = &*nigoris_.find(name);
+  else
+    default_nigori_ = &*nigoris_.find(name);
   return true;
 }
 
@@ -222,6 +238,15 @@ bool Cryptographer::GetBootstrapToken(std::string* token) const {
   return PackBootstrapToken(default_nigori_->second.get(), token);
 }
 
+bool Cryptographer::GetKeystoreKeyBootstrapToken(
+    std::string* token) const {
+  DCHECK(token);
+  if (!HasKeystoreKey())
+    return false;
+
+  return PackBootstrapToken(keystore_nigori_->second.get(), token);
+}
+
 bool Cryptographer::PackBootstrapToken(const Nigori* nigori,
                                        std::string* pack_into) const {
   DCHECK(pack_into);
@@ -314,18 +339,19 @@ bool Cryptographer::SetKeystoreKey(const std::string& keystore_key) {
     return false;
   KeyParams params = {"localhost", "dummy", keystore_key};
 
-  // AddKey updates the default nigori, so we save the current default and
-  // make sure the keystore_nigori_ gets updated instead.
-  NigoriMap::value_type* old_default = default_nigori_;
-  if (AddKey(params)) {
-    keystore_nigori_ = default_nigori_;
-    default_nigori_ = old_default;
-    return true;
+  // Create the new Nigori and make it the default keystore encryptor.
+  scoped_ptr<Nigori> nigori(new Nigori);
+  if (!nigori->InitByDerivation(params.hostname,
+                                params.username,
+                                params.password)) {
+    NOTREACHED();  // Invalid username or password.
+    return false;
   }
-  return false;
+
+  return AddKeyImpl(nigori.release(), true);
 }
 
-bool Cryptographer::HasKeystoreKey() {
+bool Cryptographer::HasKeystoreKey() const {
   return keystore_nigori_ != NULL;
 }