diff options
author | Roeland Jago Douma <roeland@famdouma.nl> | 2020-08-12 14:22:24 +0300 |
---|---|---|
committer | Roeland Jago Douma <roeland@famdouma.nl> | 2020-08-19 16:45:45 +0300 |
commit | 8928bbe96901b9374ecd42cb6cf9e3e7914ebafa (patch) | |
tree | 9af1f497be8502c74da6f3bcb02482764f5fa7df /apps/encryption | |
parent | bc2b42250820197c3f71518299c401515f6ee1cc (diff) |
Make legacy cipher opt in
* Systems that upgrade have this enabled by default
* New systems disable it
* We'll have to add some wargning in the setup checks if this is enabled
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Diffstat (limited to 'apps/encryption')
-rw-r--r-- | apps/encryption/lib/Crypto/Crypt.php | 17 | ||||
-rw-r--r-- | apps/encryption/tests/Crypto/CryptTest.php | 10 | ||||
-rw-r--r-- | apps/encryption/tests/Settings/AdminTest.php | 23 |
3 files changed, 38 insertions, 12 deletions
diff --git a/apps/encryption/lib/Crypto/Crypt.php b/apps/encryption/lib/Crypto/Crypt.php index 7723b63a66b..02059f632f1 100644 --- a/apps/encryption/lib/Crypto/Crypt.php +++ b/apps/encryption/lib/Crypto/Crypt.php @@ -32,6 +32,7 @@ namespace OCA\Encryption\Crypto; use OC\Encryption\Exceptions\DecryptionFailedException; use OC\Encryption\Exceptions\EncryptionFailedException; +use OC\ServerNotAvailableException; use OCA\Encryption\Exceptions\MultiKeyDecryptException; use OCA\Encryption\Exceptions\MultiKeyEncryptException; use OCP\Encryption\Exceptions\GenericEncryptionException; @@ -89,6 +90,9 @@ class Crypt { 'AES-128-CFB' => 16, ]; + /** @var bool */ + private $supportLegacy; + /** * @param ILogger $logger * @param IUserSession $userSession @@ -101,6 +105,8 @@ class Crypt { $this->config = $config; $this->l = $l; $this->supportedKeyFormats = ['hash', 'password']; + + $this->supportLegacy = $this->config->getSystemValueBool('encryption.legacy_format_support', false); } /** @@ -299,6 +305,10 @@ class Crypt { * @return string */ public function getLegacyCipher() { + if (!$this->supportLegacy) { + throw new ServerNotAvailableException('Legacy cipher is no longer supported!'); + } + return self::LEGACY_CIPHER; } @@ -391,7 +401,7 @@ class Crypt { if (isset($header['cipher'])) { $cipher = $header['cipher']; } else { - $cipher = self::LEGACY_CIPHER; + $cipher = $this->getLegacyCipher(); } if (isset($header['keyFormat'])) { @@ -570,6 +580,11 @@ class Crypt { $meta = substr($catFile, -93); $signaturePosition = strpos($meta, '00sig00'); + // If we no longer support the legacy format then everything needs a signature + if (!$skipSignatureCheck && !$this->supportLegacy && $signaturePosition === false) { + throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature')); + } + // enforce signature for the new 'CTR' ciphers if (!$skipSignatureCheck && $signaturePosition === false && stripos($cipher, 'ctr') !== false) { throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature')); diff --git a/apps/encryption/tests/Crypto/CryptTest.php b/apps/encryption/tests/Crypto/CryptTest.php index 4af41a9aac0..a49a37bea08 100644 --- a/apps/encryption/tests/Crypto/CryptTest.php +++ b/apps/encryption/tests/Crypto/CryptTest.php @@ -209,6 +209,9 @@ class CryptTest extends TestCase { * @dataProvider dataTestSplitMetaData */ public function testSplitMetaData($data, $expected) { + $this->config->method('getSystemValue') + ->with('encryption_skip_signature_check', false) + ->willReturn(true); $result = self::invokePrivate($this->crypt, 'splitMetaData', [$data, 'AES-256-CFB']); $this->assertTrue(is_array($result)); $this->assertSame(3, count($result)); @@ -233,6 +236,9 @@ class CryptTest extends TestCase { * @dataProvider dataTestHasSignature */ public function testHasSignature($data, $expected) { + $this->config->method('getSystemValue') + ->with('encryption_skip_signature_check', false) + ->willReturn(true); $this->assertSame($expected, $this->invokePrivate($this->crypt, 'hasSignature', [$data, 'AES-256-CFB']) ); @@ -385,6 +391,10 @@ class CryptTest extends TestCase { * @dataProvider dataTestDecryptPrivateKey */ public function testDecryptPrivateKey($header, $privateKey, $expectedCipher, $isValidKey, $expected) { + $this->config->method('getSystemValueBool') + ->with('encryption.legacy_format_support', false) + ->willReturn(true); + /** @var \OCA\Encryption\Crypto\Crypt | \PHPUnit\Framework\MockObject\MockObject $crypt */ $crypt = $this->getMockBuilder(Crypt::class) ->setConstructorArgs( diff --git a/apps/encryption/tests/Settings/AdminTest.php b/apps/encryption/tests/Settings/AdminTest.php index 78ea6158fd2..82eed2d78a9 100644 --- a/apps/encryption/tests/Settings/AdminTest.php +++ b/apps/encryption/tests/Settings/AdminTest.php @@ -74,20 +74,21 @@ class AdminTest extends TestCase { public function testGetForm() { $this->config - ->expects($this->at(0)) ->method('getAppValue') - ->with('encryption', 'recoveryAdminEnabled', '0') - ->willReturn(1); - $this->config - ->expects($this->at(1)) - ->method('getAppValue') - ->with('encryption', 'encryptHomeStorage', '1') - ->willReturn(1); + ->will($this->returnCallback(function ($app, $key, $default) { + if ($app === 'encryption' && $key === 'recoveryAdminEnabled' && $default === '0') { + return '1'; + } + if ($app === 'encryption' && $key === 'encryptHomeStorage' && $default === '1') { + return '1'; + } + return $default; + })); $params = [ - 'recoveryEnabled' => 1, + 'recoveryEnabled' => '1', 'initStatus' => '0', - 'encryptHomeStorage' => false, - 'masterKeyEnabled' => false + 'encryptHomeStorage' => true, + 'masterKeyEnabled' => true ]; $expected = new TemplateResponse('encryption', 'settings-admin', $params, ''); $this->assertEquals($expected, $this->admin->getForm()); |