Shaving parallel authenticator yak to remove unnecessary dependency on this class from OAuth spec...

chrome/browser/chromeos/login/parallel_authenticator.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/parallel_authenticator.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/path_service.h"
-#include "base/rand_util.h"
-#include "base/string_number_conversions.h"
 #include "base/string_util.h"
 #include "base/synchronization/lock.h"
 #include "chrome/browser/chromeos/cros/cert_library.h"
 #include "chrome/browser/chromeos/cros/cryptohome_library.h"
 #include "chrome/browser/chromeos/login/auth_response_handler.h"
 #include "chrome/browser/chromeos/login/authentication_notification_details.h"
 #include "chrome/browser/chromeos/login/login_status_consumer.h"
 #include "chrome/browser/chromeos/login/ownership_service.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/net/gaia/gaia_auth_fetcher.h"
 #include "chrome/common/net/gaia/gaia_constants.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_service.h"
-#include "crypto/encryptor.h"
-#include "crypto/sha2.h"
-#include "crypto/symmetric_key.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/url_request/url_request_status.h"
 #include "third_party/libjingle/source/talk/base/urlencode.h"
 
 using base::Time;
 using base::TimeDelta;
 using content::BrowserThread;
 using file_util::GetFileSize;
 using file_util::PathExists;
 using file_util::ReadFile;
 using file_util::ReadFileToString;
 
-namespace {
-
-const int kPassHashLen = 32;
-const size_t kKeySize = 16;
-
-// Decrypts (AES) hex encoded encrypted token given |key| and |salt|.
-std::string DecryptTokenWithKey(
-    crypto::SymmetricKey* key,
-    const std::string& salt,
-    const std::string& encrypted_token_hex) {
-  std::vector<uint8> encrypted_token_bytes;
-  if (!base::HexStringToBytes(encrypted_token_hex, &encrypted_token_bytes))
-    return std::string();
-
-  std::string encrypted_token(
-      reinterpret_cast<char*>(encrypted_token_bytes.data()),
-      encrypted_token_bytes.size());
-  crypto::Encryptor encryptor;
-  if (!encryptor.Init(key, crypto::Encryptor::CTR, std::string()))
-    return std::string();
-
-  std::string nonce = salt.substr(0, kKeySize);
-  std::string token;
-  CHECK(encryptor.SetCounter(nonce));
-  if (!encryptor.Decrypt(encrypted_token, &token))
-    return std::string();
-  return token;
-}
-
-}   // namespace
-
 namespace chromeos {
 
 // static
 const char ParallelAuthenticator::kLocalaccountFile[] = "localaccount";
 
 // static
 const int ParallelAuthenticator::kClientLoginTimeoutMs = 10000;
 // static
 const int ParallelAuthenticator::kLocalaccountRetryIntervalMs = 20;
 
@@ skipping 15 matching lines @@
 
 void ParallelAuthenticator::AuthenticateToLogin(
     Profile* profile,
     const std::string& username,
     const std::string& password,
     const std::string& login_token,
     const std::string& login_captcha) {
   std::string canonicalized = Authenticator::Canonicalize(username);
   authentication_profile_ = profile;
   current_state_.reset(
-      new AuthAttemptState(canonicalized,
-                           password,
-                           HashPassword(password),
-                           login_token,
-                           login_captcha,
-                           !UserManager::Get()->IsKnownUser(canonicalized)));
+      new AuthAttemptState(
+          canonicalized,
+          password,
+          CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(password),
+          login_token,
+          login_captcha,
+          !UserManager::Get()->IsKnownUser(canonicalized)));
   mounter_ = CryptohomeOp::CreateMountAttempt(current_state_.get(),
                                               this,
                                               false /* don't create */);
   // Sadly, this MUST be on the UI thread due to sending DBus traffic :-/
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
 
       base::Bind(&CryptohomeOp::Initiate, mounter_.get()));
   // ClientLogin authentication check should happen immediately here.
   // We should not try OAuthLogin check until the profile loads.
@@ skipping 10 matching lines @@
       base::Bind(&ParallelAuthenticator::LoadLocalaccount, this,
                  std::string(kLocalaccountFile)));
 }
 
 void ParallelAuthenticator::CompleteLogin(Profile* profile,
                                           const std::string& username,
                                           const std::string& password) {
   std::string canonicalized = Authenticator::Canonicalize(username);
   authentication_profile_ = profile;
   current_state_.reset(
-      new AuthAttemptState(canonicalized,
-                           password,
-                           HashPassword(password),
-                           !UserManager::Get()->IsKnownUser(canonicalized)));
+      new AuthAttemptState(
+          canonicalized,
+          password,
+          CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(password),
+          !UserManager::Get()->IsKnownUser(canonicalized)));
   mounter_ = CryptohomeOp::CreateMountAttempt(current_state_.get(),
                                               this,
                                               false /* don't create */);
   // Sadly, this MUST be on the UI thread due to sending DBus traffic :-/
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CryptohomeOp::Initiate, mounter_.get()));
 
   if (!using_oauth_) {
     // Test automation needs to disable oauth, but that leads to other
@@ skipping 15 matching lines @@
 
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(&ParallelAuthenticator::LoadLocalaccount, this,
                  std::string(kLocalaccountFile)));
 }
 
 void ParallelAuthenticator::AuthenticateToUnlock(const std::string& username,
                                                  const std::string& password) {
   current_state_.reset(
-      new AuthAttemptState(Authenticator::Canonicalize(username),
-                           HashPassword(password)));
+      new AuthAttemptState(
+          Authenticator::Canonicalize(username),
+          CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(password)));
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(&ParallelAuthenticator::LoadLocalaccount, this,
                  std::string(kLocalaccountFile)));
   key_checker_ = CryptohomeOp::CreateCheckKeyAttempt(current_state_.get(),
                                                      this);
   // Sadly, this MUST be on the UI thread due to sending DBus traffic :-/
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CryptohomeOp::Initiate, key_checker_.get()));
@@ skipping 98 matching lines @@
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   DCHECK(using_oauth_);
   // Mark this account's OAuth token state as invalid in the local state.
   UserManager::Get()->SaveUserOAuthStatus(user_name,
                                           User::OAUTH_TOKEN_STATUS_INVALID);
 }
 
 void ParallelAuthenticator::RecoverEncryptedData(
     const std::string& old_password,
     const GaiaAuthConsumer::ClientLoginResult& credentials) {
-  std::string old_hash = HashPassword(old_password);
+  std::string old_hash =
+      CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(old_password);
   key_migrator_ = CryptohomeOp::CreateMigrateAttempt(current_state_.get(),
                                                      this,
                                                      true,
                                                      old_hash);
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&ParallelAuthenticator::ResyncRecoverHelper, this,
                  key_migrator_));
 }
 
@@ skipping 14 matching lines @@
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CryptohomeOp::Initiate, to_initiate));
 }
 
 void ParallelAuthenticator::RetryAuth(Profile* profile,
                                       const std::string& username,
                                       const std::string& password,
                                       const std::string& login_token,
                                       const std::string& login_captcha) {
   reauth_state_.reset(
-      new AuthAttemptState(Authenticator::Canonicalize(username),
-                           password,
-                           HashPassword(password),
-                           login_token,
-                           login_captcha,
-                           false /* not a new user */));
+      new AuthAttemptState(
+          Authenticator::Canonicalize(username),
+          password,
+          CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(password),
+          login_token,
+          login_captcha,
+          false /* not a new user */));
   // Always use ClientLogin regardless of using_oauth flag. This is because
   // we are unable to renew oauth token on lock screen currently and will
   // stuck with lock screen if we use OAuthLogin here.
   // TODO(xiyuan): Revisit this after we support Gaia in lock screen.
   current_online_ = new OnlineAttempt(false /* using_oauth */,
                                       reauth_state_.get(),
                                       this);
   current_online_->Initiate(profile);
 }
 
 
-void ParallelAuthenticator::VerifyOAuth1AccessToken(
-    const std::string& oauth1_access_token, const std::string& oauth1_secret) {
-  DCHECK(using_oauth_);
-  current_state_->SetOAuth1Token(oauth1_access_token, oauth1_secret);
-  // Initiate ClientLogin-based post authentication.
-  current_online_ = new OnlineAttempt(using_oauth_,
-                                      current_state_.get(),
-                                      this);
-  current_online_->Initiate(authentication_profile());
-}
-
-
 void ParallelAuthenticator::Resolve() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   bool request_pending = false;
   bool create = false;
   ParallelAuthenticator::AuthState state = ResolveState();
   VLOG(1) << "Resolved state to: " << state;
   switch (state) {
     case CONTINUE:
     case POSSIBLE_PW_CHANGE:
     case NO_MOUNT:
@@ skipping 283 matching lines @@
     case NO_MOUNT:
       return CREATE_NEW;
     case OFFLINE_LOGIN:
       return ONLINE_LOGIN;
     default:
       NOTREACHED();
       return offline_state;
   }
 }
 
-void ParallelAuthenticator::LoadSystemSalt() {
-  if (!system_salt_.empty())
-    return;
-  system_salt_ = CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt();
-  CHECK(!system_salt_.empty());
-  CHECK_EQ(system_salt_.size() % 2, 0U);
-}
-
-bool ParallelAuthenticator::LoadSupplementalUserKey() {
-  if (!supplemental_user_key_.get()) {
-    supplemental_user_key_.reset(
-        CrosLibrary::Get()->GetCertLibrary()->GetSupplementalUserKey());
-  }
-  return supplemental_user_key_.get() != NULL;
-}
-
-
 void ParallelAuthenticator::LoadLocalaccount(const std::string& filename) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
   {
     base::AutoLock for_this_block(localaccount_lock_);
     if (checked_for_localaccount_)
       return;
   }
   FilePath localaccount_file;
   std::string localaccount;
   if (PathService::Get(base::DIR_EXE, &localaccount_file)) {
@@ skipping 10 matching lines @@
 }
 
 void ParallelAuthenticator::SetLocalaccount(const std::string& new_name) {
   localaccount_ = new_name;
   {  // extra braces for clarity about AutoLock scope.
     base::AutoLock for_this_block(localaccount_lock_);
     checked_for_localaccount_ = true;
   }
 }
 
-std::string ParallelAuthenticator::EncryptToken(const std::string& token) {
-  if (!LoadSupplementalUserKey())
-    return std::string();
-  crypto::Encryptor encryptor;
-  if (!encryptor.Init(supplemental_user_key_.get(), crypto::Encryptor::CTR,
-                      std::string()))
-    return std::string();
-
-  std::string nonce = SaltAsAscii().substr(0, kKeySize);
-  std::string encoded_token;
-  CHECK(encryptor.SetCounter(nonce));
-  if (!encryptor.Encrypt(token, &encoded_token))
-    return std::string();
-
-  return StringToLowerASCII(base::HexEncode(
-      reinterpret_cast<const void*>(encoded_token.data()),
-      encoded_token.size()));
-}
-std::string ParallelAuthenticator::DecryptToken(
-    const std::string& encrypted_token_hex) {
-  if (!LoadSupplementalUserKey())
-    return std::string();
-  return DecryptTokenWithKey(supplemental_user_key_.get(),
-                             SaltAsAscii(),
-                             encrypted_token_hex);
-}
-
-std::string ParallelAuthenticator::HashPassword(const std::string& password) {
-  // Get salt, ascii encode, update sha with that, then update with ascii
-  // of password, then end.
-  std::string ascii_salt = SaltAsAscii();
-  char passhash_buf[kPassHashLen];
-
-  // Hash salt and password
-  crypto::SHA256HashString(ascii_salt + password,
-                           &passhash_buf, sizeof(passhash_buf));
-
-  return StringToLowerASCII(base::HexEncode(
-      reinterpret_cast<const void*>(passhash_buf),
-      sizeof(passhash_buf) / 2));
-}
-
-std::string ParallelAuthenticator::SaltAsAscii() {
-  LoadSystemSalt();  // no-op if it's already loaded.
-  return StringToLowerASCII(base::HexEncode(
-      reinterpret_cast<const void*>(system_salt_.data()),
-      system_salt_.size()));
-}
-
 void ParallelAuthenticator::ResolveLoginCompletionStatus() {
   // Shortcut online state resolution process.
   current_state_->RecordOnlineLoginStatus(GaiaAuthConsumer::ClientLoginResult(),
                                           LoginFailure::None());
   Resolve();
 }
 
 }  // namespace chromeos