Commit Graph

256 Commits

Author SHA1 Message Date
Lukas Reschke 4971015544 Add code integrity check
This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository.

Furthermore, there is a basic implementation to display problems with the code integrity on the update screen.

Code signing basically happens the following way:

- There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release 😉). This certificate is not intended to be used for signing directly and only is used to sign new certificates.
- Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`,  apps need to be signed with a certificate that either has a CN of `core` (shipped apps!)  or the AppID.
- The command generates a signature.json file of the following format:
```json
{
    "hashes": {
        "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d",
        "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9"
    },
    "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----",
    "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl"
}
```
`hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the  certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`.

Steps to do in other PRs, this is already a quite huge one:
- Add nag screen in case the code check fails to ensure that administrators are aware of this.
- Add code verification also to OCC upgrade and unify display code more.
- Add enforced code verification to apps shipped from the appstore with a level of "official"
- Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release
- Add some developer documentation on how devs can request their own certificate
- Check when installing ownCloud
- Add support for CRLs to allow revoking certificates

**Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature:

```
➜  master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt
Successfully signed "core"
```

Then increase the version and you should see something like the following:

![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png)

As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen.

For packaging stable releases this requires the following additional steps as a last action before zipping:
1. Run `./occ integrity:sign-core` once
2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
2015-12-01 11:55:20 +01:00
Morris Jobke f46d531a4f Replace some OC_Config calls with ILogger methods 2015-10-30 09:51:16 +01:00
Lukas Reschke a6f180f24e Remove invalid type-cast
This is an `is_array` operation and not a `in_array` one. Thus this typecast is not required.

Fixes https://github.com/owncloud/core/issues/20095
2015-10-29 15:19:02 +01:00
Morris Jobke 3b249f1967 Revert "setting to skip migration tests by default"
This reverts commit 7cbdd9b90b.
2015-10-27 21:25:11 +01:00
Lukas Reschke 8f09d5b67c Update license headers 2015-10-26 14:04:01 +01:00
Roeland Jago Douma 9071e756a1 Fix for broken ajax/share.php endpoint
Even more code mess :(
All tests pass again. But I'm really not happy with this endpoint.
2015-10-23 09:24:03 +02:00
Thomas Müller f7f2a160dd Merge pull request #19918 from owncloud/send-begin-message
Update: state which step we are going to start and warn if it might b…
2015-10-21 14:52:19 +02:00
Joas Schilling e66e67567f Update - Only add one section for disabled apps 2015-10-21 10:39:56 +02:00
Joas Schilling 9200bbeaba Update: state which step we are going to start and warn if it might be slow 2015-10-21 09:17:38 +02:00
Morris Jobke b945d71384 update licence headers via script 2015-10-05 21:15:52 +02:00
Thomas Müller d0f6bfe7b6 Merge pull request #19508 from owncloud/setting-to-skip-migration-tests
setting to skip migration tests by default
2015-10-02 12:15:23 +02:00
Morris Jobke 7cbdd9b90b setting to skip migration tests by default
* if you install owncloud via package it is not
  possible to skip migration tests
* this also allows to disable migration tests for
  an instance by default
2015-10-01 14:23:25 +02:00
Robin Appelman f4d180ee5c allow passing the fileinfo to the preview manager 2015-10-01 13:14:47 +02:00
Morris Jobke 1051a3c6f5 Change small thumbnails to 32 px
* fixes #16913
* fixes issues in IE8 where the thumbnail is too big
2015-09-30 10:49:48 +02:00
Morris Jobke 5acb38b5b3 [upgrade] switch to debug logging on upgrade
* resets afterwards
* adds output about the previous log level
2015-09-29 14:35:32 +02:00
Thomas Müller 2c37d5f7d8 Merge pull request #13145 from owncloud/issue/11951-activity-sharing-email
Publish an activity when sending a share link via email
2015-09-25 13:48:33 +02:00
Morris Jobke 6636605ea6 Add option to disable autocomplete in share dialog 2015-09-23 15:06:28 +02:00
Joas Schilling 2e1cfe03e9 Publish an activity when sending a share link via email 2015-09-22 13:09:21 +02:00
Robin Appelman 0f6df2e0b6 Allow creating previewss that cover the specified dimensions 2015-09-02 10:32:39 +02:00
Vincent Petry ce6045f84b Properly show update exception 2015-08-26 10:56:27 +02:00
Vincent Petry 90ed32ebc5 Properly show token errors in ajax/update.php event source 2015-08-26 10:52:43 +02:00
Roeland Douma 695af190f6 Merge pull request #17565 from owncloud/fix/remote_share
allow remote shares for users with email as usernames
2015-07-13 21:22:09 +02:00
Felix Böhm c9917e4cd6 allow remote shares for users with email as usernames 2015-07-10 14:58:32 +02:00
Vincent Petry a64652e12a Remove 3rd party text for disabled apps on update 2015-07-07 15:00:19 +02:00
Thomas Müller d3ac73c0c9 Remove OC_Log 2015-07-03 18:00:16 +02:00
Lukas Reschke d1f0ff372e Merge pull request #17163 from owncloud/update-licenses
Update license headers
2015-06-27 20:22:23 +02:00
Björn Schießle b318b9cf17 Merge pull request #17008 from owncloud/fix-17006
Improve splitting of username and remote adress when username contains an `@`
2015-06-26 16:01:16 +02:00
Thomas Müller 6c3a4282e5 Merge pull request #17165 from owncloud/federated_cloud_sharing_search_address_book
Search address book for federated cloud id
2015-06-26 10:53:02 +02:00
Roeland Jago Douma 27d5838fb7 Fix for #17178
If no array of arrays is submitted make sure we still keep $sharedUsers
and $sharedGroups as arrays so the rest of the code keeps functioning as
it should.
2015-06-25 21:16:18 +02:00
Morris Jobke f63915d0c8 update license headers and authors 2015-06-25 14:13:49 +02:00
Bjoern Schiessle f9dcb559e9 search address book for federated cloud id 2015-06-25 11:57:03 +02:00
Joas Schilling 738b78f1b0 Use \OC\HintException and translate the hint 2015-06-22 15:34:06 +02:00
Thomas Müller 739c3f01aa Merge pull request #16434 from owncloud/persist-maintenance-state
Persist the state of the maintenance after an upgrade
2015-06-03 13:56:17 +02:00
Morris Jobke 064f5204cc Persist the state of the maintenance after an upgrade
* if maintenance mode was enabled before an upgrade
  it will be enabled afterwards too
* fixes #16429
2015-05-19 10:56:04 +02:00
Craig Morrissey ca341a8d59 add support for limit request parameter to getShareWith 2015-05-15 18:03:18 +02:00
Morris Jobke fbba7a61cb Use internally \OCP\ILogger instead of \OC\Log
* this is the preparation for some upcoming logger related changes
* also fixes an issue in the public interface where we request
  an internal class as parameter
2015-04-30 11:52:30 +02:00
Lukas Reschke e3ad99d252 Add "Reply-To" support to sharing mails and refactor code 2015-04-10 17:30:07 +02:00
Thomas Müller 20eaadd72b Merge pull request #15182 from rullzer/fix-8231
ajax/share.php should return correct list of suggestions
2015-04-10 00:05:11 +02:00
Morris Jobke bf17ac929d Merge pull request #15169 from rullzer/fix_displayNamesInGroup
Groupmanagers displayNamesInGroup should actually search in displaynames
2015-03-30 17:04:09 +02:00
Jenkins for ownCloud b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Roeland Jago Douma 9c19a5dbcc Make sure we do not return people that we already shared with
We should use the provided list of users and groups that we already
shared with to filter suggestions.
2015-03-25 09:13:51 +01:00
Roeland Jago Douma 4163a5efad Call the proper function
* Fix for #6967
2015-03-24 21:45:31 +01:00
Joas Schilling 4c4c0fa120 Use the PreviewManager where possible 2015-03-16 12:44:10 +01:00
Morris Jobke ad97ceb787 Merge pull request #13513 from owncloud/repair-legacystoragenofatalfail
Do not abort when meeting unfixable legacy storages
2015-03-11 13:32:33 +01:00
Lukas Reschke c0a02f1615 Verify CSRF token already in update.php and not the EventSource code
Issue report:
> Hum, well I upgraded the package then visited the web interface to
trigger the update and it failed; the UI would say there was a
possible CSRF attack and after that it'd be stuck in maintenance mode.
Tried a few times (by editing maintenance to false in owncloud.conf)
and same result each time.

That smells partially like an issue caused by our EventSource implementation, due to legacy concerns the CSRF verification happens within the EventSource handling and not when the actual endpoint is called, what happens here then is:

1. User has somehow an invalid CSRF token in session (or none at all)
2. User clicks the update button
3. Invalid CSRF token is sent to update.php - no CSRF check there => Instance gets set in maintenance mode
4. Invalid CSRF token is processed by the EventSource code => Code Execution is stopped and ownCloud is stuck in maintenance mode

I have a work-around for this problem, basically it verifies the CSRF token already in step 3 and cancels execution then. The same error will be shown to the user however he can work around it by refreshing the page – as stated by the error. I think that’s an acceptable behaviour for now: INSERT LINK

To verify this test:

1. Delete your ownCloud cookies
2. Increment the version in version.php
3. Try to upgrade
=> Before the patch: Instance shows an error, is set to upgrade mode and a refresh does not help
=> After the patch: Instance shows an error, a refresh helps though.

This is not really the best fix as a better solution would be to catch such situations when bootstrapping ownCloud, however, I don’t dare to touch base.php for this sake only, you never know what breaks then…

That said: There might be other bugs as well, especially the stacktrace is somewhat confusing but then again it installing ownCloud under /usr/share/owncloud/ and I bet that is part of the whole issue ;-)
2015-03-09 10:07:30 +01:00
Vincent Petry 22bc37cb82 Properly forward repair errors and warnings
This makes repair errors and warnings visible for the user when
upgrading on the command line or in the web UI.
2015-02-27 12:44:04 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Thomas Müller bbf7f56f94 3rd-party apps are disabled on upgrade - refs #14026 2015-02-24 12:02:36 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Lukas Reschke a7df23ceba Manually type-case all AJAX files
This enforces proper types on POST and GET arguments where I considered it sensible. I didn't update some as I don't know what kind of values they would support 🙈

Fixes https://github.com/owncloud/core/issues/14196 for core
2015-02-13 13:33:20 +01:00