2012-07-11 20:51:27 +04:00
< ? php
/**
* ownCloud
*
* @ author Sam Tuke , Frank Karlitschek
* @ copyright 2012 Sam Tuke samtuke @ owncloud . com ,
* Frank Karlitschek frank @ owncloud . org
*
* This library is free software ; you can redistribute it and / or
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
* License as published by the Free Software Foundation ; either
* version 3 of the License , or any later version .
*
* This library is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU AFFERO GENERAL PUBLIC LICENSE for more details .
*
* You should have received a copy of the GNU Affero General Public
* License along with this library . If not , see < http :// www . gnu . org / licenses />.
*
*/
// Todo:
// - Crypt/decrypt button in the userinterface
// - Setting if crypto should be on by default
// - Add a setting "Don´ t encrypt files larger than xx because of performance reasons"
// - Transparent decrypt/encrypt in filesystem.php. Autodetect if a file is encrypted (.encrypted extension)
// - Don't use a password directly as encryption key. but a key which is stored on the server and encrypted with the user password. -> password change faster
// - IMPORTANT! Check if the block lenght of the encrypted data stays the same
2012-10-17 19:35:19 +04:00
namespace OCA\Encryption ;
2012-07-11 20:51:27 +04:00
/**
2012-07-25 18:33:25 +04:00
* @ brief Class for utilities relating to encrypted file storage system
* @ param $view OC_FilesystemView object , expected to have OC '/' as root path
* @ param $client flag indicating status of client side encryption . Currently
* unused , likely to become obsolete shortly
2012-07-11 20:51:27 +04:00
*/
class Util {
2012-07-24 20:53:12 +04:00
# DONE: add method to check if file is encrypted using new system
# DONE: add method to check if file is encrypted using old system
2012-07-25 15:38:40 +04:00
# DONE: add method to fetch legacy key
# DONE: add method to decrypt legacy encrypted data
2012-07-31 22:28:11 +04:00
# DONE: fix / test the crypt stream proxy class
2012-10-17 19:35:19 +04:00
# DONE: replace cryptstream wrapper new AES based system
2012-07-25 18:33:25 +04:00
2012-07-24 20:53:12 +04:00
# TODO: add support for optional recovery user in case of lost passphrase / keys
# TODO: add admin optional required long passphrase for users
# TODO: implement flag system to allow user to specify encryption by folder, subfolder, etc.
# TODO: add UI buttons for encrypt / decrypt everything?
2012-07-31 22:28:11 +04:00
# TODO: add method to encrypt all user files using new system
# TODO: add method to decrypt all user files using new system
# TODO: add method to encrypt all user files using old system
# TODO: add method to decrypt all user files using old system
2012-07-24 20:53:12 +04:00
# TODO: test new encryption with webdav
# TODO: test new encryption with versioning
# TODO: test new encryption with sharing
# TODO: test new encryption with proxies
2012-07-11 20:51:27 +04:00
private $view ; // OC_FilesystemView object for filesystem operations
private $pwd ; // User Password
private $client ; // Client side encryption mode flag
2012-11-16 22:31:37 +04:00
private $publicKeyDir ; // Directory containing all public user keys
private $encryptionDir ; // Directory containing user's files_encryption
private $keyfilesPath ; // Directory containing user's keyfiles
private $publicKeyPath ; // Path to user's public key
private $privateKeyPath ; // Path to user's private key
2012-07-11 20:51:27 +04:00
2012-07-25 18:33:25 +04:00
public function __construct ( \OC_FilesystemView $view , $userId , $client = false ) {
2012-07-11 20:51:27 +04:00
$this -> view = $view ;
2012-07-25 18:33:25 +04:00
$this -> userId = $userId ;
2012-07-11 20:51:27 +04:00
$this -> client = $client ;
2012-07-25 18:33:25 +04:00
$this -> publicKeyDir = '/' . 'public-keys' ;
$this -> encryptionDir = '/' . $this -> userId . '/' . 'files_encryption' ;
$this -> keyfilesPath = $this -> encryptionDir . '/' . 'keyfiles' ;
$this -> publicKeyPath = $this -> publicKeyDir . '/' . $this -> userId . '.public.key' ; // e.g. data/public-keys/admin.public.key
$this -> privateKeyPath = $this -> encryptionDir . '/' . $this -> userId . '.private.key' ; // e.g. data/admin/admin.private.key
2012-07-11 20:51:27 +04:00
}
public function ready () {
if (
2012-07-25 18:33:25 +04:00
! $this -> view -> file_exists ( $this -> keyfilesPath )
or ! $this -> view -> file_exists ( $this -> publicKeyPath )
or ! $this -> view -> file_exists ( $this -> privateKeyPath )
2012-07-11 20:51:27 +04:00
) {
return false ;
} else {
return true ;
}
}
2012-07-24 20:53:12 +04:00
/**
2012-07-25 18:33:25 +04:00
* @ brief Sets up user folders and keys for serverside encryption
2012-07-24 20:53:12 +04:00
* @ param $passphrase passphrase to encrypt server - stored private key with
*/
2012-07-25 18:33:25 +04:00
public function setupServerSide ( $passphrase = null ) {
2012-07-11 20:51:27 +04:00
2012-07-25 18:33:25 +04:00
// Create shared public key directory
if ( ! $this -> view -> file_exists ( $this -> publicKeyDir ) ) {
2012-07-11 20:51:27 +04:00
2012-07-25 18:33:25 +04:00
$this -> view -> mkdir ( $this -> publicKeyDir );
2012-07-11 20:51:27 +04:00
}
2012-07-25 18:33:25 +04:00
// Create encryption app directory
if ( ! $this -> view -> file_exists ( $this -> encryptionDir ) ) {
2012-07-11 20:51:27 +04:00
2012-07-25 18:33:25 +04:00
$this -> view -> mkdir ( $this -> encryptionDir );
}
// Create mirrored keyfile directory
if ( ! $this -> view -> file_exists ( $this -> keyfilesPath ) ) {
$this -> view -> mkdir ( $this -> keyfilesPath );
2012-07-11 20:51:27 +04:00
}
// Create user keypair
if (
2012-07-25 18:33:25 +04:00
! $this -> view -> file_exists ( $this -> publicKeyPath )
or ! $this -> view -> file_exists ( $this -> privateKeyPath )
2012-07-11 20:51:27 +04:00
) {
// Generate keypair
$keypair = Crypt :: createKeypair ();
2012-07-25 18:33:25 +04:00
\OC_FileProxy :: $enabled = false ;
2012-07-11 20:51:27 +04:00
// Save public key
2012-07-25 18:33:25 +04:00
$this -> view -> file_put_contents ( $this -> publicKeyPath , $keypair [ 'publicKey' ] );
2012-07-11 20:51:27 +04:00
2012-07-25 18:33:25 +04:00
// Encrypt private key with user pwd as passphrase
$encryptedPrivateKey = Crypt :: symmetricEncryptFileContent ( $keypair [ 'privateKey' ], $passphrase );
2012-07-11 20:51:27 +04:00
2012-07-25 18:33:25 +04:00
// Save private key
$this -> view -> file_put_contents ( $this -> privateKeyPath , $encryptedPrivateKey );
2012-07-11 20:51:27 +04:00
2012-07-25 18:33:25 +04:00
\OC_FileProxy :: $enabled = true ;
2012-07-11 20:51:27 +04:00
}
2012-11-16 22:31:37 +04:00
return true ;
2012-07-11 20:51:27 +04:00
}
2012-07-24 20:53:12 +04:00
2012-07-31 22:28:11 +04:00
public function findFiles ( $directory , $type = 'plain' ) {
# TODO: test finding non plain content
if ( $handle = $this -> view -> opendir ( $directory ) ) {
while ( false !== ( $file = readdir ( $handle ) ) ) {
if (
$file != " . "
&& $file != " .. "
) {
$filePath = $directory . '/' . $this -> view -> getRelativePath ( '/' . $file );
var_dump ( $filePath );
if ( $this -> view -> is_dir ( $filePath ) ) {
$this -> findFiles ( $filePath );
} elseif ( $this -> view -> is_file ( $filePath ) ) {
if ( $type == 'plain' ) {
$this -> files [] = array ( 'name' => $file , 'path' => $filePath );
} elseif ( $type == 'encrypted' ) {
if ( Crypt :: isEncryptedContent ( $this -> view -> file_get_contents ( $filePath ) ) ) {
$this -> files [] = array ( 'name' => $file , 'path' => $filePath );
}
} elseif ( $type == 'legacy' ) {
if ( Crypt :: isLegacyEncryptedContent ( $this -> view -> file_get_contents ( $filePath ) ) ) {
$this -> files [] = array ( 'name' => $file , 'path' => $filePath );
}
}
}
}
}
if ( ! empty ( $this -> files ) ) {
return $this -> files ;
} else {
return false ;
}
}
return false ;
}
2012-10-17 19:35:19 +04:00
/**
* @ brief Check if a given path identifies an encrypted file
* @ return true / false
*/
public function isEncryptedPath ( $path ) {
$data = $this -> view -> file_get_contents ( $path );
return Crypt :: isEncryptedContent ( $data );
}
2012-08-15 21:49:53 +04:00
public function encryptAll ( $directory ) {
2012-07-31 22:28:11 +04:00
2012-08-15 21:49:53 +04:00
$plainFiles = $this -> findFiles ( $this -> view , 'plain' );
2012-07-31 22:28:11 +04:00
if ( $this -> encryptFiles ( $plainFiles ) ) {
return true ;
} else {
return false ;
}
}
2012-07-24 20:53:12 +04:00
/**
2012-07-25 15:38:40 +04:00
* @ brief Get the blowfish encryption handeler for a key
* @ param $key string ( optional )
* @ return Crypt_Blowfish blowfish object
2012-07-24 20:53:12 +04:00
*
* if the key is left out , the default handeler will be used
*/
2012-07-25 15:38:40 +04:00
public function getBlowfish ( $key = '' ) {
if ( $key ) {
2012-07-24 20:53:12 +04:00
2012-07-25 15:38:40 +04:00
return new \Crypt_Blowfish ( $key );
2012-07-24 20:53:12 +04:00
} else {
return false ;
2012-07-25 15:38:40 +04:00
2012-07-24 20:53:12 +04:00
}
}
/**
2012-07-25 15:38:40 +04:00
* @ brief Fetch the legacy encryption key from user files
* @ param string $login used to locate the legacy key
* @ param string $passphrase used to decrypt the legacy key
* @ return true / false
2012-07-24 20:53:12 +04:00
*
* if the key is left out , the default handeler will be used
*/
2012-07-25 15:38:40 +04:00
public function getLegacyKey ( $passphrase ) {
2012-07-25 21:28:56 +04:00
// Disable proxies to prevent attempt to automatically decrypt key
OC_FileProxy :: $enabled = false ;
2012-07-25 15:38:40 +04:00
if (
$passphrase
and $key = $this -> view -> file_get_contents ( '/encryption.key' )
) {
2012-07-24 20:53:12 +04:00
2012-07-25 21:28:56 +04:00
OC_FileProxy :: $enabled = true ;
2012-07-24 20:53:12 +04:00
2012-07-25 15:38:40 +04:00
if ( $this -> legacyKey = $this -> legacyDecrypt ( $key , $passphrase ) ) {
return true ;
} else {
return false ;
}
2012-07-24 20:53:12 +04:00
} else {
2012-07-25 21:28:56 +04:00
OC_FileProxy :: $enabled = true ;
2012-07-24 20:53:12 +04:00
return false ;
}
}
/**
* @ brief encrypts content using legacy blowfish system
* @ param $content the cleartext message you want to encrypt
* @ param $key the encryption key ( optional )
* @ returns encrypted content
*
* This function encrypts an content
*/
2012-07-25 15:38:40 +04:00
public function legacyEncrypt ( $content , $passphrase = '' ) {
$bf = $this -> getBlowfish ( $passphrase );
return $bf -> encrypt ( $content );
2012-07-24 20:53:12 +04:00
}
/**
* @ brief decryption of an content
* @ param $content the cleartext message you want to decrypt
* @ param $key the encryption key ( optional )
* @ returns cleartext content
*
* This function decrypts an content
*/
2012-07-25 15:38:40 +04:00
public function legacyDecrypt ( $content , $passphrase = '' ) {
2012-07-24 20:53:12 +04:00
2012-07-25 15:38:40 +04:00
$bf = $this -> getBlowfish ( $passphrase );
2012-07-24 20:53:12 +04:00
$data = $bf -> decrypt ( $content );
return $data ;
}
/**
* @ brief Re - encryptes a legacy blowfish encrypted file using AES with integrated IV
* @ param $legacyContent the legacy encrypted content to re - encrypt
* @ returns cleartext content
*
* This function decrypts an content
*/
public function legacyRecrypt ( $legacyContent ) {
# TODO: write me
}
2012-11-16 22:31:37 +04:00
public function getPath ( $pathName ) {
switch ( $pathName ) {
case 'publicKeyDir' :
return $this -> publicKeyDir ;
break ;
case 'encryptionDir' :
return $this -> encryptionDir ;
break ;
case 'keyfilesPath' :
return $this -> keyfilesPath ;
break ;
case 'publicKeyPath' :
return $this -> publicKeyPath ;
break ;
case 'privateKeyPath' :
return $this -> privateKeyPath ;
break ;
}
}
2012-07-11 20:51:27 +04:00
}