Add one test for Cryptographer::InstallKeys

sync/util/cryptographer_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sync/util/cryptographer.h"
 
 #include <string>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_util.h"
@@ skipping 246 matching lines @@
   EXPECT_TRUE(cryptographer_clone.Encrypt(original, &encrypted_c));
 
   sync_pb::PasswordSpecificsData decrypted_c;
   EXPECT_TRUE(cryptographer_.Decrypt(encrypted_c, &decrypted_c));
   EXPECT_EQ(original.SerializeAsString(), decrypted_c.SerializeAsString());
 
   // The cloned cryptographer should be using the latest key.
   EXPECT_EQ(encrypted_c.key_name(), encrypted_k2.key_name());
 }
 
+// Test verifies that GetBootstrapToken/Bootstrap only transfers default
+// key. Additional call to GetKeys/InstallKeys is needed to transfer keybag
+// to decrypt messages encrypted with old keys.
+TEST_F(CryptographerTest, GetKeysThenInstall) {
+  sync_pb::PasswordSpecificsData original;
+  original.set_origin("http://example.com");
+  original.set_username_value("luser");
+  original.set_password_value("p4ssw0rd");
+
+  // First, encrypt the same value using two different keys.
+  KeyParams params1 = {"localhost", "dummy", "dummy"};
+  EXPECT_TRUE(cryptographer_.AddKey(params1));
+  EXPECT_TRUE(cryptographer_.is_ready());
+
+  sync_pb::EncryptedData encrypted_k1;
+  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted_k1));
+
+  KeyParams params2 = {"localhost", "dummy2", "dummy2"};
+  EXPECT_TRUE(cryptographer_.AddKey(params2));
+  EXPECT_TRUE(cryptographer_.is_ready());
+
+  sync_pb::EncryptedData encrypted_k2;
+  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted_k2));
+
+  // Then construct second cryptographer and bootstrap it from the first one.
+  Cryptographer another_cryptographer(cryptographer_.encryptor());
+  std::string bootstrap_token;
+  EXPECT_TRUE(cryptographer_.GetBootstrapToken(&bootstrap_token));
+  another_cryptographer.Bootstrap(bootstrap_token);
+
+  // Before key installation, the second cryptographer should only be able
+  // to decrypt using the last key.
+  EXPECT_FALSE(another_cryptographer.CanDecrypt(encrypted_k1));
+  EXPECT_TRUE(another_cryptographer.CanDecrypt(encrypted_k2));
+
+  sync_pb::EncryptedData keys;
+  EXPECT_TRUE(cryptographer_.GetKeys(&keys));
+  ASSERT_TRUE(another_cryptographer.CanDecrypt(keys));
+  another_cryptographer.InstallKeys(keys);
+
+  // Verify that bootstrapped cryptographer decrypts succesfully using
+  // all the keys after key installation.
+  EXPECT_TRUE(another_cryptographer.CanDecrypt(encrypted_k1));
+  EXPECT_TRUE(another_cryptographer.CanDecrypt(encrypted_k2));
+}
+
 }  // namespace syncer