Switch CryptohomeAuthenticator from MountAsync() to MountEx()

chromeos/login/auth/cryptohome_authenticator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/login/auth/cryptohome_authenticator.h"
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "chromeos/cryptohome/async_method_caller.h"
+#include "chromeos/cryptohome/cryptohome_parameters.h"
+#include "chromeos/cryptohome/homedir_methods.h"
 #include "chromeos/cryptohome/system_salt_getter.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/login/auth/auth_status_consumer.h"
 #include "chromeos/login/auth/key.h"
 #include "chromeos/login/auth/user_context.h"
 #include "chromeos/login/login_state.h"
 #include "chromeos/login/user_names.h"
 #include "chromeos/login_event_recorder.h"
 #include "components/user_manager/user_type.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
 namespace chromeos {
 
 namespace {
 
+// The label used for the key derived from the user's GAIA credentials.
+const char kCryptohomeGAIAKeyLabel[] = "gaia";
+
 // Hashes |key| with |system_salt| if it its type is KEY_TYPE_PASSWORD_PLAIN.
 // Returns the keys unmodified otherwise.
 scoped_ptr<Key> TransformKeyIfNeeded(const Key& key,
                                      const std::string& system_salt) {
   scoped_ptr<Key> result(new Key(key));
   if (result->GetKeyType() == Key::KEY_TYPE_PASSWORD_PLAIN)
     result->Transform(Key::KEY_TYPE_SALTED_SHA256_TOP_HALF, system_salt);
 
   return result.Pass();
 }
@@ skipping 23 matching lines @@
 void TriggerResolveWithLoginTimeMarker(
     const std::string& marker_name,
     AuthAttemptState* attempt,
     scoped_refptr<CryptohomeAuthenticator> resolver,
     bool success,
     cryptohome::MountError return_code) {
   chromeos::LoginEventRecorder::Get()->AddLoginTimeMarker(marker_name, false);
   TriggerResolve(attempt, resolver, success, return_code);
 }
 
+void TriggerResolveWithHashAndLoginTimeMarker(
+    const std::string& marker_name,
+    AuthAttemptState* attempt,
+    scoped_refptr<CryptohomeAuthenticator> resolver,
+    bool success,
+    cryptohome::MountError return_code,
+    const std::string& mount_hash) {
+  chromeos::LoginEventRecorder::Get()->AddLoginTimeMarker(marker_name, false);
+  attempt->RecordCryptohomeStatus(success, return_code);
+  if (success)
+    attempt->RecordUsernameHash(mount_hash);
+  else
+    attempt->RecordUsernameHashFailed();
+  resolver->Resolve();
+}
+
 // Calls cryptohome's mount method.
 void Mount(AuthAttemptState* attempt,
            scoped_refptr<CryptohomeAuthenticator> resolver,
-           int flags,
+           bool ephemeral,
+           bool create_if_nonexistent,
            const std::string& system_salt) {
   chromeos::LoginEventRecorder::Get()->AddLoginTimeMarker(
       "CryptohomeMount-Start", false);
   // Set state that username_hash is requested here so that test implementation
   // that returns directly would not generate 2 OnLoginSucces() calls.
   attempt->UsernameHashRequested();
 
   scoped_ptr<Key> key =
       TransformKeyIfNeeded(*attempt->user_context.GetKey(), system_salt);
-  cryptohome::AsyncMethodCaller::GetInstance()->AsyncMount(
-      attempt->user_context.GetUserID(),
-      key->GetSecret(),
-      flags,
-      base::Bind(&TriggerResolveWithLoginTimeMarker,
+  // Set the authentication's key label to an empty string, which is a wildcard
+  // allowing any key to match. This is necessary because cryptohomes created by
+  // Chrome OS M38 and older will have a legacy key with no label while those
+  // created by Chrome OS M39 and newer will have a key with the label
+  // kCryptohomeGAIAKeyLabel.
+  const cryptohome::KeyDefinition auth_key(key->GetSecret(),
+                                           std::string(),
+                                           cryptohome::PRIV_DEFAULT);
+  cryptohome::MountParameters mount(ephemeral);
+  if (create_if_nonexistent) {
+    mount.create_keys.push_back(cryptohome::KeyDefinition(
+        key->GetSecret(),
+        kCryptohomeGAIAKeyLabel,
+        cryptohome::PRIV_DEFAULT));
+  }
+
+  cryptohome::HomedirMethods::GetInstance()->MountEx(
+      cryptohome::Identification(attempt->user_context.GetUserID()),
+      cryptohome::Authorization(auth_key),
+      mount,
+      base::Bind(&TriggerResolveWithHashAndLoginTimeMarker,
                  "CryptohomeMount-End",
                  attempt,
                  resolver));
-  cryptohome::AsyncMethodCaller::GetInstance()->AsyncGetSanitizedUsername(
-      attempt->user_context.GetUserID(),
-      base::Bind(&TriggerResolveHash, attempt, resolver));
 }
 
 // Calls cryptohome's mount method for guest and also get the user hash from
 // cryptohome.
 void MountGuestAndGetHash(AuthAttemptState* attempt,
                           scoped_refptr<CryptohomeAuthenticator> resolver) {
   attempt->UsernameHashRequested();
   cryptohome::AsyncMethodCaller::GetInstance()->AsyncMountGuest(
       base::Bind(&TriggerResolveWithLoginTimeMarker,
                  "CryptohomeMount-End",
@@ skipping 109 matching lines @@
                                             false,  // unlock
                                             false,  // online_complete
                                             !IsKnownUser(user_context)));
   // Reset the verified flag.
   owner_is_verified_ = false;
 
   SystemSaltGetter::Get()->GetSystemSalt(
       base::Bind(&Mount,
                  current_state_.get(),
                  scoped_refptr<CryptohomeAuthenticator>(this),
-                 cryptohome::MOUNT_FLAGS_NONE));
+                 false /* ephemeral */,
+                 false /* create_if_nonexistent */));
 }
 
 void CryptohomeAuthenticator::CompleteLogin(Profile* profile,
                                             const UserContext& user_context) {
   authentication_profile_ = profile;
   current_state_.reset(new AuthAttemptState(user_context,
                                             user_manager::USER_TYPE_REGULAR,
                                             true,   // unlock
                                             false,  // online_complete
                                             !IsKnownUser(user_context)));
 
   // Reset the verified flag.
   owner_is_verified_ = false;
 
   SystemSaltGetter::Get()->GetSystemSalt(
       base::Bind(&Mount,
                  current_state_.get(),
                  scoped_refptr<CryptohomeAuthenticator>(this),
-                 cryptohome::MOUNT_FLAGS_NONE));
+                 false /* ephemeral */,
+                 false /* create_if_nonexistent */));
 
   // For login completion from extension, we just need to resolve the current
   // auth attempt state, the rest of OAuth related tasks will be done in
   // parallel.
   task_runner_->PostTask(
       FROM_HERE,
       base::Bind(&CryptohomeAuthenticator::ResolveLoginCompletionStatus, this));
 }
 
 void CryptohomeAuthenticator::AuthenticateToUnlock(
@@ skipping 18 matching lines @@
   current_state_.reset(new AuthAttemptState(user_context,
                                             user_manager::USER_TYPE_SUPERVISED,
                                             false,    // unlock
                                             false,    // online_complete
                                             false));  // user_is_new
   remove_user_data_on_failure_ = false;
   SystemSaltGetter::Get()->GetSystemSalt(
       base::Bind(&Mount,
                  current_state_.get(),
                  scoped_refptr<CryptohomeAuthenticator>(this),
-                 cryptohome::MOUNT_FLAGS_NONE));
+                 false /* ephemeral */,
+                 false /* create_if_nonexistent */));
 }
 
 void CryptohomeAuthenticator::LoginRetailMode() {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
   // Note: |kRetailModeUserEMail| is used in other places to identify a retail
   // mode session.
   current_state_.reset(
       new AuthAttemptState(UserContext(chromeos::login::kRetailModeUserName),
                            user_manager::USER_TYPE_RETAIL_MODE,
                            false,    // unlock
@@ skipping 27 matching lines @@
                            user_manager::USER_TYPE_PUBLIC_ACCOUNT,
                            false,    // unlock
                            false,    // online_complete
                            false));  // user_is_new
   remove_user_data_on_failure_ = false;
   ephemeral_mount_attempted_ = true;
   SystemSaltGetter::Get()->GetSystemSalt(
       base::Bind(&Mount,
                  current_state_.get(),
                  scoped_refptr<CryptohomeAuthenticator>(this),
-                 cryptohome::CREATE_IF_MISSING | cryptohome::ENSURE_EPHEMERAL));
+                 true /* ephemeral */,
+                 true /* create_if_nonexistent */));
 }
 
 void CryptohomeAuthenticator::LoginAsKioskAccount(
     const std::string& app_user_id,
     bool use_guest_mount) {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
 
   const std::string user_id =
       use_guest_mount ? chromeos::login::kGuestUserName : app_user_id;
   current_state_.reset(new AuthAttemptState(UserContext(user_id),
@@ skipping 115 matching lines @@
 
 void CryptohomeAuthenticator::OnOwnershipChecked(bool is_owner) {
   // Now we can check if this user is the owner.
   user_can_login_ = is_owner;
   owner_is_verified_ = true;
   Resolve();
 }
 
 void CryptohomeAuthenticator::Resolve() {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
-  int mount_flags = cryptohome::MOUNT_FLAGS_NONE;
+  bool create_if_nonexistent = false;
   CryptohomeAuthenticator::AuthState state = ResolveState();
   VLOG(1) << "Resolved state to: " << state;
   switch (state) {
     case CONTINUE:
     case POSSIBLE_PW_CHANGE:
     case NO_MOUNT:
       // These are intermediate states; we need more info from a request that
       // is still pending.
       break;
     case FAILED_MOUNT:
@@ skipping 43 matching lines @@
                      AuthFailure(AuthFailure::USERNAME_HASH_FAILED)));
       break;
     case REMOVED_DATA_AFTER_FAILURE:
       remove_user_data_on_failure_ = false;
       task_runner_->PostTask(FROM_HERE,
                              base::Bind(&CryptohomeAuthenticator::OnAuthFailure,
                                         this,
                                         *delayed_login_failure_));
       break;
     case CREATE_NEW:
-      mount_flags |= cryptohome::CREATE_IF_MISSING;
+      create_if_nonexistent = true;
     case RECOVER_MOUNT:
       current_state_->ResetCryptohomeStatus();
       SystemSaltGetter::Get()->GetSystemSalt(
           base::Bind(&Mount,
                      current_state_.get(),
                      scoped_refptr<CryptohomeAuthenticator>(this),
-                     mount_flags));
+                     false /*ephemeral*/,
+                     create_if_nonexistent));
       break;
     case NEED_OLD_PW:
       task_runner_->PostTask(
           FROM_HERE,
           base::Bind(&CryptohomeAuthenticator::OnPasswordChangeDetected, this));
       break;
     case ONLINE_FAILED:
     case NEED_NEW_PW:
     case HAVE_NEW_PW:
       NOTREACHED() << "Using obsolete ClientLogin code path.";
@@ skipping 200 matching lines @@
   Resolve();
 }
 
 void CryptohomeAuthenticator::SetOwnerState(bool owner_check_finished,
                                             bool check_result) {
   owner_is_verified_ = owner_check_finished;
   user_can_login_ = check_result;
 }
 
 }  // namespace chromeos