Add support to GCMKeyStore for multiple keys per app_id

components/gcm_driver/crypto/gcm_encryption_provider.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/gcm_driver/crypto/gcm_encryption_provider.h"
 
 #include <vector>
 
 #include "base/base64.h"
 #include "base/bind.h"
@@ skipping 59 matching lines @@
   // be created in memory rather than on-disk.
   if (!store_path.empty())
     encryption_store_path = store_path.Append(kEncryptionDirectoryName);
 
   key_store_.reset(
       new GCMKeyStore(encryption_store_path, blocking_task_runner));
 }
 
 void GCMEncryptionProvider::GetEncryptionInfo(
     const std::string& app_id,
+    const std::string& instance_id_authorized_entity,
     const EncryptionInfoCallback& callback) {
   DCHECK(key_store_);
-  key_store_->GetKeys(
-      app_id, base::Bind(&GCMEncryptionProvider::DidGetEncryptionInfo,
-                         weak_ptr_factory_.GetWeakPtr(), app_id, callback));
+  key_store_->GetKeys(app_id, instance_id_authorized_entity,
+                      false /* fallback_to_empty_authorized_entity */,
+                      base::Bind(&GCMEncryptionProvider::DidGetEncryptionInfo,
+                                 weak_ptr_factory_.GetWeakPtr(), app_id,
+                                 instance_id_authorized_entity, callback));
 }
 
 void GCMEncryptionProvider::RemoveEncryptionInfo(
     const std::string& app_id,
+    const std::string& instance_id_authorized_entity,
     const base::Closure& callback) {
   DCHECK(key_store_);
-  key_store_->RemoveKeys(app_id, callback);
+  key_store_->RemoveKeys(app_id, instance_id_authorized_entity, callback);
 }
 
 bool GCMEncryptionProvider::IsEncryptedMessage(const IncomingMessage& message)
     const {
   // The Web Push protocol requires the encryption and crypto-key properties to
   // be set, and the raw_data field to be populated with the payload.
   if (message.data.find(kEncryptionProperty) == message.data.end() ||
       message.data.find(kCryptoKeyProperty) == message.data.end())
     return false;
 
@@ skipping 46 matching lines @@
   }
 
   if (crypto_key_header_values.size() != 1u ||
       !crypto_key_header_values[0].dh.size()) {
     DLOG(ERROR) << "Invalid values supplied in the Crypto-Key header";
     callback.Run(DECRYPTION_RESULT_INVALID_CRYPTO_KEY_HEADER,
                  IncomingMessage());
     return;
   }
 
-  key_store_->GetKeys(
-      app_id, base::Bind(&GCMEncryptionProvider::DecryptMessageWithKey,
-                         weak_ptr_factory_.GetWeakPtr(), message,
-                         callback, encryption_header_values[0].salt,
-                         crypto_key_header_values[0].dh,
-                         encryption_header_values[0].rs));
+  // At this point we don't know whether this message is for an InstanceID token
+  // (key store owner = app_id + ',' + sender_id) or a legacy GCM registration

[Peter Beverloo, 2016/05/09 14:10:09]

Mentioning the key store owner and its format has no added value here; also
please try to avoid mentioning "we". What about:

  // The message that is to be decrypted could be associated with either a v3
  // or v4 (InstanceID) registration, which store encryption keys differently,
  // but the used version is not known at this point.

[johnme, 2016/05/09 18:15:54]

I changed this to: "
  // Use |fallback_to_empty_authorized_entity|, since this message might have
  // been sent to either an InstanceID token or a non-InstanceID registration."

+  // (key store owner = app_id). Try the more specific one first; if that fails,
+  // DecryptMessageWithKey will fall back to the other.
+  key_store_->GetKeys(app_id,
+                      message.sender_id /* instance_id_authorized_entity */,
+                      true /* fallback_to_empty_authorized_entity */,
+                      base::Bind(&GCMEncryptionProvider::DecryptMessageWithKey,
+                                 weak_ptr_factory_.GetWeakPtr(), message,
+                                 callback, encryption_header_values[0].salt,
+                                 crypto_key_header_values[0].dh,
+                                 encryption_header_values[0].rs));
 }
 
 void GCMEncryptionProvider::DidGetEncryptionInfo(
     const std::string& app_id,
+    const std::string& instance_id_authorized_entity,
     const EncryptionInfoCallback& callback,
     const KeyPair& pair,
     const std::string& auth_secret) {
   if (!pair.IsInitialized()) {
     key_store_->CreateKeys(
-        app_id, base::Bind(&GCMEncryptionProvider::DidCreateEncryptionInfo,
-                           weak_ptr_factory_.GetWeakPtr(), callback));
+        app_id, instance_id_authorized_entity,
+        base::Bind(&GCMEncryptionProvider::DidCreateEncryptionInfo,
+                   weak_ptr_factory_.GetWeakPtr(), callback));
     return;
   }
 
   DCHECK_EQ(KeyPair::ECDH_P256, pair.type());
   callback.Run(pair.public_key(), auth_secret);
 }
 
 void GCMEncryptionProvider::DidCreateEncryptionInfo(
     const EncryptionInfoCallback& callback,
     const KeyPair& pair,
@@ skipping 50 matching lines @@
   decrypted_message.decrypted = true;
 
   // There must be no data associated with the decrypted message at this point,
   // to make sure that we don't end up in an infinite decryption loop.
   DCHECK_EQ(0u, decrypted_message.data.size());
 
   callback.Run(DECRYPTION_RESULT_DECRYPTED, decrypted_message);
 }
 
 }  // namespace gcm