Chrome-side lockbox bindings

chrome/browser/chromeos/login/enterprise_enrollment_screen.cc

Index: chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
diff --git a/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc b/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
index ec775dc7b4b8bfbb170becf21c8cabac17b4ec08..b10ca31adb32118f779e3887954504012a05e652 100644
--- a/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
+++ b/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
@@ -6,15 +6,32 @@
 
 #include "base/logging.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/cros/cros_library.h"
+#include "chrome/browser/chromeos/cros/cryptohome_library.h"
 #include "chrome/browser/chromeos/login/screen_observer.h"
 #include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/common/net/gaia/gaia_constants.h"
 
 namespace chromeos {
 
+// Retry for lockbox initialization every 500ms.
+const int kLockboxRetryIntervalMs = 500;
+
 EnterpriseEnrollmentScreen::EnterpriseEnrollmentScreen(
     WizardScreenDelegate* delegate)
-    : ViewScreen<EnterpriseEnrollmentView>(delegate) {}
+    : ViewScreen<EnterpriseEnrollmentView>(delegate),
+      ALLOW_THIS_IN_INITIALIZER_LIST(runnable_method_factory_(this)) {
+  // Init lockbox if it has not been done until now (in debug build we might
+  // have not domne that yet).

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

s/domne/done/

[pastarmovj, 2011/04/15 18:44:49]

Done.

+  chromeos::CryptohomeLibrary* cryptohome =
+      chromeos::CrosLibrary::Get()->GetCryptohomeLibrary();
+  if (cryptohome) {
+    if (cryptohome->TpmIsEnabled() && !cryptohome->TpmIsBeingOwned() &&

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

for readability ,you might want to break after the first && (your call)

[pastarmovj, 2011/04/15 18:44:49]

Done.

+        !cryptohome->TpmIsOwned()) {
+      cryptohome->TpmCanAttemptOwnership();
+    }
+  }
+}
 
 EnterpriseEnrollmentScreen::~EnterpriseEnrollmentScreen() {}
 
@@ -55,10 +72,32 @@ void EnterpriseEnrollmentScreen::CloseConfirmation() {
   observer->OnExit(ScreenObserver::ENTERPRISE_ENROLLMENT_COMPLETED);
 }
 
+bool EnterpriseEnrollmentScreen::GetInitialUser(std::string* user) {
+  chromeos::CryptohomeLibrary* cryptohome =
+      chromeos::CrosLibrary::Get()->GetCryptohomeLibrary();
+  if (cryptohome && cryptohome->InstallAttributesIsReady() &&
+        !cryptohome->InstallAttributesIsFirstInstall()) {

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

same here.

[pastarmovj, 2011/04/15 18:44:49]

Done.

+    std::string value;
+    if (cryptohome->InstallAttributesGet("enterprise.owned", &value) &&
+        0 == value.compare("true")) {

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

value == "true"?

[pastarmovj, 2011/04/15 18:44:49]

Done.

+      if (cryptohome->InstallAttributesGet("enterprise.user", &value)) {
+        // If we landed in the enrollment dialogue with a locked lockbox this
+        // would mean we might only want to reenroll with the DMServer so lock
+        // the username to what has been stored in the lockbox already.
+        *user = value;
+        view()->editable_user(false);

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

make it set_editable_user :)

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

Please wrap in if (view())

[pastarmovj, 2011/04/15 18:44:49]

Done.

[pastarmovj, 2011/04/15 18:44:49]

Done.

+        return true;
+      }
+    }
+    LOG(ERROR) << "Enrollment will not finish because the lockbox has been "
+               << "locked already but does not contain valid data.";
+  }
+  return false;
+}
+
 void EnterpriseEnrollmentScreen::OnClientLoginSuccess(
     const ClientLoginResult& result) {
-  auth_fetcher_->StartIssueAuthToken(result.sid, result.lsid,
-                                     GaiaConstants::kDeviceManagementService);
+  WriteInstallAttributesData(result);
 }
 
 void EnterpriseEnrollmentScreen::OnClientLoginFailure(
@@ -177,4 +216,77 @@ void EnterpriseEnrollmentScreen::HandleAuthError(
   NOTREACHED() << error.state();
 }
 
+void EnterpriseEnrollmentScreen::WriteInstallAttributesData(
+    const ClientLoginResult& result) {
+  // Since this method is also called directly.
+  runnable_method_factory_.RevokeAll();
+

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

if (!view())
  return;

[pastarmovj, 2011/04/15 18:44:49]

Done.

+  chromeos::CryptohomeLibrary* cryptohome =
+      chromeos::CrosLibrary::Get()->GetCryptohomeLibrary();
+  if (!cryptohome) {
+    LOG(ERROR) << "Enrollment can not proceed because the lockbox can not "
+               << "be accessed.";
+    view()->ShowFatalEnrollmentError();
+    return;
+  }
+
+  if (!cryptohome->InstallAttributesIsReady()) {
+    // Lockbox is not ready yet, reschedule pulling.
+    LOG(WARNING) << "Lockbox is not ready yet will retry in "
+                 << kLockboxRetryIntervalMs << "ms.";
+    MessageLoop::current()->PostDelayedTask(
+        FROM_HERE,
+        runnable_method_factory_.NewRunnableMethod(
+            &EnterpriseEnrollmentScreen::WriteInstallAttributesData, result),
+        kLockboxRetryIntervalMs);

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

early return and remove block below?

[pastarmovj, 2011/04/15 18:44:49]

Done.

+  } else {
+    // Clearing the TPM password seems to be always a good deal.
+    if (cryptohome->TpmIsEnabled() && !cryptohome->TpmIsBeingOwned() &&

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

line break condition breaking?

[pastarmovj, 2011/04/15 18:44:49]

Done.

+        cryptohome->TpmIsOwned()) {
+      cryptohome->TpmClearStoredPassword();
+    }
+    // Make sure we really have a working lockbox.
+    if (cryptohome->InstallAttributesIsInvalid()) {
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "is corrupt or failed to initialize!";
+      view()->ShowFatalEnrollmentError();

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

return;

[pastarmovj, 2011/04/15 18:44:49]

Done.

+    }
+    if (!cryptohome->InstallAttributesIsFirstInstall()) {
+      std::string  value;
+      if (cryptohome->InstallAttributesGet("enterprise.owned", &value) &&
+          0 == value.compare("true")) {

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

value == "true". Might want to introduce a char constant since you're using it a
lot :)

[pastarmovj, 2011/04/15 18:44:49]

Done the == but for now i don't see much need in introducing yet another name
for "true" :)

+        if (cryptohome->InstallAttributesGet("enterprise.user", &value)) {
+          if (value == user_) {
+            // If we landed here with a locked lockbox this would mean we might
+            // only want to reenroll with the DMServer so lock just continue.
+            auth_fetcher_->StartIssueAuthToken(
+                result.sid, result.lsid,
+                GaiaConstants::kDeviceManagementService);
+            return;
+          }
+        }
+      }
+
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "has been locked already!";
+      view()->ShowFatalEnrollmentError();

[Mattias Nissler (ping if slow), 2011/04/15 18:17:58]

early return and remove else block?

[pastarmovj, 2011/04/15 18:44:49]

Done.

+    } else {
+      // Set values in the lockbox and lock it.
+      DCHECK(cryptohome->InstallAttributesIsFirstInstall());
+      cryptohome->InstallAttributesSet("enterprise.owned", "true");
+      cryptohome->InstallAttributesSet("enterprise.user", user_);
+      DCHECK(cryptohome->InstallAttributesCount() == 2);
+      cryptohome->InstallAttributesFinalize();
+      if (cryptohome->InstallAttributesIsFirstInstall()) {
+        LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                   << "can not be sealed!";
+        view()->ShowFatalEnrollmentError();
+      } else {
+        auth_fetcher_->StartIssueAuthToken(
+            result.sid, result.lsid, GaiaConstants::kDeviceManagementService);
+      }
+    }
+  }
+}
+
 }  // namespace chromeos