nigori_sync_bridge_impl.h 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174
  1. // Copyright 2019 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_SYNC_NIGORI_NIGORI_SYNC_BRIDGE_IMPL_H_
  5. #define COMPONENTS_SYNC_NIGORI_NIGORI_SYNC_BRIDGE_IMPL_H_
  6. #include <list>
  7. #include <memory>
  8. #include <string>
  9. #include <vector>
  10. #include "base/sequence_checker.h"
  11. #include "base/time/time.h"
  12. #include "components/sync/engine/nigori/key_derivation_params.h"
  13. #include "components/sync/engine/nigori/keystore_keys_handler.h"
  14. #include "components/sync/engine/sync_encryption_handler.h"
  15. #include "components/sync/model/conflict_resolution.h"
  16. #include "components/sync/model/model_error.h"
  17. #include "components/sync/nigori/cryptographer_impl.h"
  18. #include "components/sync/nigori/nigori_local_change_processor.h"
  19. #include "components/sync/nigori/nigori_state.h"
  20. #include "components/sync/nigori/nigori_sync_bridge.h"
  21. #include "components/sync/protocol/nigori_specifics.pb.h"
  22. #include "third_party/abseil-cpp/absl/types/optional.h"
  23. namespace sync_pb {
  24. class NigoriLocalData;
  25. } // namespace sync_pb
  26. namespace syncer {
  27. class KeyDerivationParams;
  28. class NigoriStorage;
  29. class PendingLocalNigoriCommit;
  30. // USS implementation of SyncEncryptionHandler.
  31. // This class holds the current Nigori state and processes incoming changes and
  32. // queries:
  33. // 1. Serves observers of SyncEncryptionHandler interface.
  34. // 2. Allows the passphrase manipulations (via SyncEncryptionHandler).
  35. // 3. Communicates local and remote changes with a processor (via
  36. // NigoriSyncBridge).
  37. // 4. Handles keystore keys from a sync server (via KeystoreKeysHandler).
  38. class NigoriSyncBridgeImpl : public KeystoreKeysHandler,
  39. public NigoriSyncBridge,
  40. public SyncEncryptionHandler {
  41. public:
  42. NigoriSyncBridgeImpl(std::unique_ptr<NigoriLocalChangeProcessor> processor,
  43. std::unique_ptr<NigoriStorage> storage);
  44. NigoriSyncBridgeImpl(const NigoriSyncBridgeImpl&) = delete;
  45. NigoriSyncBridgeImpl& operator=(const NigoriSyncBridgeImpl&) = delete;
  46. ~NigoriSyncBridgeImpl() override;
  47. // SyncEncryptionHandler implementation.
  48. void AddObserver(Observer* observer) override;
  49. void RemoveObserver(Observer* observer) override;
  50. void NotifyInitialStateToObservers() override;
  51. ModelTypeSet GetEncryptedTypes() override;
  52. Cryptographer* GetCryptographer() override;
  53. PassphraseType GetPassphraseType() override;
  54. void SetEncryptionPassphrase(
  55. const std::string& passphrase,
  56. const KeyDerivationParams& key_derivation_params) override;
  57. void SetExplicitPassphraseDecryptionKey(std::unique_ptr<Nigori> key) override;
  58. void AddTrustedVaultDecryptionKeys(
  59. const std::vector<std::vector<uint8_t>>& keys) override;
  60. base::Time GetKeystoreMigrationTime() override;
  61. KeystoreKeysHandler* GetKeystoreKeysHandler() override;
  62. const sync_pb::NigoriSpecifics::TrustedVaultDebugInfo&
  63. GetTrustedVaultDebugInfo() override;
  64. // KeystoreKeysHandler implementation.
  65. bool NeedKeystoreKey() const override;
  66. bool SetKeystoreKeys(const std::vector<std::vector<uint8_t>>& keys) override;
  67. // NigoriSyncBridge implementation.
  68. absl::optional<ModelError> MergeSyncData(
  69. absl::optional<EntityData> data) override;
  70. absl::optional<ModelError> ApplySyncChanges(
  71. absl::optional<EntityData> data) override;
  72. std::unique_ptr<EntityData> GetData() override;
  73. void ApplyDisableSyncChanges() override;
  74. const CryptographerImpl& GetCryptographerImplForTesting() const;
  75. bool HasPendingKeysForTesting() const;
  76. KeyDerivationParams GetCustomPassphraseKeyDerivationParamsForTesting() const;
  77. private:
  78. absl::optional<ModelError> UpdateLocalState(
  79. const sync_pb::NigoriSpecifics& specifics);
  80. absl::optional<sync_pb::NigoriKey> TryDecryptPendingKeystoreDecryptorToken(
  81. const sync_pb::EncryptedData& keystore_decryptor_token);
  82. // Builds NigoriKeyBag, which contains keys acceptable for decryption of
  83. // |encryption_keybag| from remote NigoriSpecifics. Its content depends on
  84. // current passphrase type and available keys: for KEYSTORE_PASSPHRASE it
  85. // contains only |keystore_decryptor_key|, for all other passphrase types
  86. // it contains deserialized |explicit_passphrase_key_| and current default
  87. // encryption key.
  88. NigoriKeyBag BuildDecryptionKeyBagForRemoteKeybag(
  89. const absl::optional<sync_pb::NigoriKey>& keystore_decryptor_key) const;
  90. // Uses |key_bag| to try to decrypt pending keys as represented in
  91. // |state_.pending_keys| (which must be set).
  92. //
  93. // If decryption is possible, the newly decrypted keys are put in the
  94. // |state_.cryptographer|'s keybag and the default key is updated. In that
  95. // case pending keys are cleared.
  96. //
  97. // If |key_bag| is not capable of decrypting pending keys,
  98. // |state_.pending_keys| stays set. Such outcome is not itself considered
  99. // and error and returns absl::nullopt.
  100. //
  101. // Errors may be returned, in rare cases, for fatal protocol violations.
  102. absl::optional<ModelError> TryDecryptPendingKeysWith(
  103. const NigoriKeyBag& key_bag);
  104. base::Time GetExplicitPassphraseTime() const;
  105. // Returns key derivation params based on |passphrase_type_| and
  106. // |custom_passphrase_key_derivation_params_|. Should be called only if
  107. // |passphrase_type_| is an explicit passphrase.
  108. KeyDerivationParams GetKeyDerivationParamsForPendingKeys() const;
  109. // If there are pending keys and depending on the passphrase type, it invokes
  110. // the appropriate observer methods (if any).
  111. void MaybeNotifyOfPendingKeys() const;
  112. // Queues keystore rotation or full keystore migration if current state
  113. // assumes it should happen.
  114. void MaybeTriggerKeystoreReencryption();
  115. // Serializes state of the bridge and sync metadata into the proto.
  116. sync_pb::NigoriLocalData SerializeAsNigoriLocalData() const;
  117. // Appends |local_commit| to |pending_local_commit_queue_| and if appropriate
  118. // calls Put() to trigger the commit.
  119. void QueuePendingLocalCommit(
  120. std::unique_ptr<PendingLocalNigoriCommit> local_commit);
  121. // Processes |pending_local_commit_queue_| FIFO such that all non-applicable
  122. // pending commits issue a failure, until the first one that is applicable is
  123. // found (if any). If such applicable commit is found, the corresponding Put()
  124. // call is issued.
  125. void PutNextApplicablePendingLocalCommit();
  126. // Populates keystore keys into |cryptographer| in case it doesn't contain
  127. // them already and |passphrase_type| isn't KEYSTORE_PASSPHRASE. This
  128. // function only updates local state and doesn't trigger a commit.
  129. void MaybePopulateKeystoreKeysIntoCryptographer();
  130. const std::unique_ptr<NigoriLocalChangeProcessor> processor_;
  131. const std::unique_ptr<NigoriStorage> storage_;
  132. syncer::NigoriState state_;
  133. std::list<std::unique_ptr<PendingLocalNigoriCommit>>
  134. pending_local_commit_queue_;
  135. // Observer that owns the list of actual observers, and broadcasts
  136. // notifications to all observers in the list.
  137. class BroadcastingObserver;
  138. const std::unique_ptr<BroadcastingObserver> broadcasting_observer_;
  139. SEQUENCE_CHECKER(sequence_checker_);
  140. };
  141. } // namespace syncer
  142. #endif // COMPONENTS_SYNC_NIGORI_NIGORI_SYNC_BRIDGE_IMPL_H_