Browse Source
fix(ocm): switching to IdentityProof
fix(ocm): switching to IdentityProof
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>pull/45979/head
Maxence Lange
1 year ago
24 changed files with 171 additions and 647 deletions
-
4apps/cloud_federation_api/lib/Capabilities.php
-
46apps/cloud_federation_api/lib/Controller/RequestHandlerController.php
-
3apps/federatedfilesharing/lib/FederatedShareProvider.php
-
3apps/federatedfilesharing/lib/Notifications.php
-
2build/integration/features/bootstrap/FederationContext.php
-
24build/integration/federation_features/cleanup-remote-storage.feature
-
2lib/composer/composer/autoload_classmap.php
-
2lib/composer/composer/autoload_static.php
-
109lib/private/Federation/CloudFederationProviderManager.php
-
7lib/private/Files/Storage/DAV.php
-
4lib/private/OCM/Model/OCMProvider.php
-
13lib/private/OCM/OCMDiscoveryService.php
-
20lib/private/OCM/OCMSignatoryManager.php
-
51lib/private/Security/IdentityProof/Manager.php
-
182lib/private/Security/PublicPrivateKeyPairs/KeyPairManager.php
-
114lib/private/Security/PublicPrivateKeyPairs/Model/KeyPair.php
-
7lib/private/Security/Signature/SignatureManager.php
-
2lib/private/Server.php
-
4lib/public/OCM/IOCMProvider.php
-
18lib/unstable/Security/PublicPrivateKeyPairs/Exceptions/KeyPairConflictException.php
-
20lib/unstable/Security/PublicPrivateKeyPairs/Exceptions/KeyPairException.php
-
16lib/unstable/Security/PublicPrivateKeyPairs/Exceptions/KeyPairNotFoundException.php
-
80lib/unstable/Security/PublicPrivateKeyPairs/IKeyPairManager.php
-
85lib/unstable/Security/PublicPrivateKeyPairs/Model/IKeyPair.php
@ -1,182 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
declare(strict_types=1); |
|
||||
|
|
||||
/** |
|
||||
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors |
|
||||
* SPDX-License-Identifier: AGPL-3.0-or-later |
|
||||
*/ |
|
||||
namespace OC\Security\PublicPrivateKeyPairs; |
|
||||
|
|
||||
use NCU\Security\PublicPrivateKeyPairs\Exceptions\KeyPairConflictException; |
|
||||
use NCU\Security\PublicPrivateKeyPairs\Exceptions\KeyPairNotFoundException; |
|
||||
use NCU\Security\PublicPrivateKeyPairs\IKeyPairManager; |
|
||||
use NCU\Security\PublicPrivateKeyPairs\Model\IKeyPair; |
|
||||
use OC\Security\PublicPrivateKeyPairs\Model\KeyPair; |
|
||||
use OCP\IAppConfig; |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* KeyPairManager store internal public/private key pair using AppConfig, taking advantage of the encryption |
|
||||
* and lazy loading. |
|
||||
* |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
class KeyPairManager implements IKeyPairManager { |
|
||||
private const CONFIG_PREFIX = 'security.keypair.'; |
|
||||
|
|
||||
public function __construct( |
|
||||
private readonly IAppConfig $appConfig, |
|
||||
) { |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param string $app appId |
|
||||
* @param string $name key name |
|
||||
* @param array $options algorithms, metadata |
|
||||
* |
|
||||
* @return IKeyPair |
|
||||
* @throws KeyPairConflictException if a key already exist |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function generateKeyPair(string $app, string $name, array $options = []): IKeyPair { |
|
||||
if ($this->hasKeyPair($app, $name)) { |
|
||||
throw new KeyPairConflictException('key pair already exist'); |
|
||||
} |
|
||||
|
|
||||
$keyPair = new KeyPair($app, $name); |
|
||||
|
|
||||
[$publicKey, $privateKey] = $this->generateKeys($options); |
|
||||
$keyPair->setPublicKey($publicKey) |
|
||||
->setPrivateKey($privateKey) |
|
||||
->setOptions($options); |
|
||||
|
|
||||
$this->appConfig->setValueArray( |
|
||||
$app, $this->generateAppConfigKey($name), |
|
||||
[ |
|
||||
'public' => $keyPair->getPublicKey(), |
|
||||
'private' => $keyPair->getPrivateKey(), |
|
||||
'options' => $keyPair->getOptions() |
|
||||
], |
|
||||
lazy: true, |
|
||||
sensitive: true |
|
||||
); |
|
||||
|
|
||||
return $keyPair; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param string $app appId |
|
||||
* @param string $name key name |
|
||||
* |
|
||||
* @return bool TRUE if key pair exists in database |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function hasKeyPair(string $app, string $name): bool { |
|
||||
$key = $this->generateAppConfigKey($name); |
|
||||
return $this->appConfig->hasKey($app, $key, lazy: true); |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param string $app appId |
|
||||
* @param string $name key name |
|
||||
* |
|
||||
* @return IKeyPair |
|
||||
* @throws KeyPairNotFoundException if key pair is not known |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getKeyPair(string $app, string $name): IKeyPair { |
|
||||
if (!$this->hasKeyPair($app, $name)) { |
|
||||
throw new KeyPairNotFoundException('unknown key pair'); |
|
||||
} |
|
||||
|
|
||||
$key = $this->generateAppConfigKey($name); |
|
||||
$stored = $this->appConfig->getValueArray($app, $key, lazy: true); |
|
||||
if (!array_key_exists('public', $stored) || |
|
||||
!array_key_exists('private', $stored)) { |
|
||||
throw new KeyPairNotFoundException('corrupted key pair'); |
|
||||
} |
|
||||
|
|
||||
$keyPair = new KeyPair($app, $name); |
|
||||
return $keyPair->setPublicKey($stored['public']) |
|
||||
->setPrivateKey($stored['private']) |
|
||||
->setOptions($stored['options'] ?? []); |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param string $app appid |
|
||||
* @param string $name key name |
|
||||
* |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function deleteKeyPair(string $app, string $name): void { |
|
||||
$this->appConfig->deleteKey('core', $this->generateAppConfigKey($name)); |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param IKeyPair $keyPair keypair to test |
|
||||
* |
|
||||
* @return bool |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function testKeyPair(IKeyPair $keyPair): bool { |
|
||||
$clear = md5((string)time()); |
|
||||
|
|
||||
// signing with private key
|
|
||||
openssl_sign($clear, $signed, $keyPair->getPrivateKey(), OPENSSL_ALGO_SHA256); |
|
||||
$encoded = base64_encode($signed); |
|
||||
|
|
||||
// verify with public key
|
|
||||
$signed = base64_decode($encoded); |
|
||||
return (openssl_verify($clear, $signed, $keyPair->getPublicKey(), 'sha256') === 1); |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* return appconfig key based on name of the key pair |
|
||||
* |
|
||||
* @param string $name |
|
||||
* |
|
||||
* @return string |
|
||||
*/ |
|
||||
private function generateAppConfigKey(string $name): string { |
|
||||
return self::CONFIG_PREFIX . $name; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* generate the key pair, based on $options with the following default values: |
|
||||
* [ |
|
||||
* 'algorithm' => 'rsa', |
|
||||
* 'bits' => 2048, |
|
||||
* 'type' => OPENSSL_KEYTYPE_RSA |
|
||||
* ] |
|
||||
* |
|
||||
* @param array $options |
|
||||
* |
|
||||
* @return array |
|
||||
*/ |
|
||||
private function generateKeys(array $options = []): array { |
|
||||
$res = openssl_pkey_new( |
|
||||
[ |
|
||||
'digest_alg' => $options['algorithm'] ?? 'rsa', |
|
||||
'private_key_bits' => $options['bits'] ?? 2048, |
|
||||
'private_key_type' => $options['type'] ?? OPENSSL_KEYTYPE_RSA, |
|
||||
] |
|
||||
); |
|
||||
|
|
||||
openssl_pkey_export($res, $privateKey); |
|
||||
$publicKey = openssl_pkey_get_details($res)['key']; |
|
||||
|
|
||||
return [$publicKey, $privateKey]; |
|
||||
} |
|
||||
} |
|
||||
@ -1,114 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
declare(strict_types=1); |
|
||||
|
|
||||
/** |
|
||||
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors |
|
||||
* SPDX-License-Identifier: AGPL-3.0-or-later |
|
||||
*/ |
|
||||
namespace OC\Security\PublicPrivateKeyPairs\Model; |
|
||||
|
|
||||
use NCU\Security\PublicPrivateKeyPairs\Model\IKeyPair; |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
class KeyPair implements IKeyPair { |
|
||||
private string $publicKey = ''; |
|
||||
private string $privateKey = ''; |
|
||||
private array $options = []; |
|
||||
|
|
||||
public function __construct( |
|
||||
private readonly string $app, |
|
||||
private readonly string $name, |
|
||||
) { |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getApp(): string { |
|
||||
return $this->app; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getName(): string { |
|
||||
return $this->name; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param string $publicKey |
|
||||
* @return IKeyPair |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function setPublicKey(string $publicKey): IKeyPair { |
|
||||
$this->publicKey = $publicKey; |
|
||||
return $this; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getPublicKey(): string { |
|
||||
return $this->publicKey; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param string $privateKey |
|
||||
* @return IKeyPair |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function setPrivateKey(string $privateKey): IKeyPair { |
|
||||
$this->privateKey = $privateKey; |
|
||||
return $this; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getPrivateKey(): string { |
|
||||
return $this->privateKey; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @param array $options |
|
||||
* @return IKeyPair |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function setOptions(array $options): IKeyPair { |
|
||||
$this->options = $options; |
|
||||
return $this; |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* @inheritDoc |
|
||||
* |
|
||||
* @return array |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getOptions(): array { |
|
||||
return $this->options; |
|
||||
} |
|
||||
} |
|
||||
@ -1,18 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
declare(strict_types=1); |
|
||||
|
|
||||
/** |
|
||||
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors |
|
||||
* SPDX-License-Identifier: AGPL-3.0-or-later |
|
||||
*/ |
|
||||
namespace NCU\Security\PublicPrivateKeyPairs\Exceptions; |
|
||||
|
|
||||
/** |
|
||||
* conflict between public and private key pair |
|
||||
* |
|
||||
* @experimental 31.0.0 |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
class KeyPairConflictException extends KeyPairException { |
|
||||
} |
|
||||
@ -1,20 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
declare(strict_types=1); |
|
||||
|
|
||||
/** |
|
||||
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors |
|
||||
* SPDX-License-Identifier: AGPL-3.0-or-later |
|
||||
*/ |
|
||||
namespace NCU\Security\PublicPrivateKeyPairs\Exceptions; |
|
||||
|
|
||||
use Exception; |
|
||||
|
|
||||
/** |
|
||||
* global exception related to key pairs |
|
||||
* |
|
||||
* @experimental 31.0.0 |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
class KeyPairException extends Exception { |
|
||||
} |
|
||||
@ -1,16 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
declare(strict_types=1); |
|
||||
|
|
||||
/** |
|
||||
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors |
|
||||
* SPDX-License-Identifier: AGPL-3.0-or-later |
|
||||
*/ |
|
||||
namespace NCU\Security\PublicPrivateKeyPairs\Exceptions; |
|
||||
|
|
||||
/** |
|
||||
* @experimental 31.0.0 |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
class KeyPairNotFoundException extends KeyPairException { |
|
||||
} |
|
||||
@ -1,80 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
declare(strict_types=1); |
|
||||
|
|
||||
/** |
|
||||
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors |
|
||||
* SPDX-License-Identifier: AGPL-3.0-or-later |
|
||||
*/ |
|
||||
namespace NCU\Security\PublicPrivateKeyPairs; |
|
||||
|
|
||||
use NCU\Security\PublicPrivateKeyPairs\Exceptions\KeyPairConflictException; |
|
||||
use NCU\Security\PublicPrivateKeyPairs\Exceptions\KeyPairNotFoundException; |
|
||||
use NCU\Security\PublicPrivateKeyPairs\Model\IKeyPair; |
|
||||
|
|
||||
/** |
|
||||
* IKeyPairManager contains a group of method to create/manage/store internal public/private key pair. |
|
||||
* |
|
||||
* @experimental 31.0.0 |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
interface IKeyPairManager { |
|
||||
|
|
||||
/** |
|
||||
* generate and store public/private key pair. |
|
||||
* throws exception if key pair already exist |
|
||||
* |
|
||||
* @param string $app appId |
|
||||
* @param string $name key name |
|
||||
* @param array $options algorithms, metadata |
|
||||
* |
|
||||
* @return IKeyPair |
|
||||
* @throws KeyPairConflictException if a key already exist |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function generateKeyPair(string $app, string $name, array $options = []): IKeyPair; |
|
||||
|
|
||||
/** |
|
||||
* returns if key pair is known. |
|
||||
* |
|
||||
* @param string $app appId |
|
||||
* @param string $name key name |
|
||||
* |
|
||||
* @return bool TRUE if key pair exists in database |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function hasKeyPair(string $app, string $name): bool; |
|
||||
|
|
||||
/** |
|
||||
* return key pair from database based on $app and $name. |
|
||||
* throws exception if key pair does not exist |
|
||||
* |
|
||||
* @param string $app appId |
|
||||
* @param string $name key name |
|
||||
* |
|
||||
* @return IKeyPair |
|
||||
* @throws KeyPairNotFoundException if key pair is not known |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getKeyPair(string $app, string $name): IKeyPair; |
|
||||
|
|
||||
/** |
|
||||
* delete key pair from database |
|
||||
* |
|
||||
* @param string $app appid |
|
||||
* @param string $name key name |
|
||||
* |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function deleteKeyPair(string $app, string $name): void; |
|
||||
|
|
||||
/** |
|
||||
* test key pair by encrypting/decrypting a string |
|
||||
* |
|
||||
* @param IKeyPair $keyPair keypair to test |
|
||||
* |
|
||||
* @return bool |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function testKeyPair(IKeyPair $keyPair): bool; |
|
||||
} |
|
||||
@ -1,85 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
declare(strict_types=1); |
|
||||
|
|
||||
/** |
|
||||
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors |
|
||||
* SPDX-License-Identifier: AGPL-3.0-or-later |
|
||||
*/ |
|
||||
namespace NCU\Security\PublicPrivateKeyPairs\Model; |
|
||||
|
|
||||
/** |
|
||||
* simple model that store key pair, its name, its origin (app) |
|
||||
* and the options used during its creation |
|
||||
* |
|
||||
* @experimental 31.0.0 |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
interface IKeyPair { |
|
||||
/** |
|
||||
* returns id of the app owning the key pair |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getApp(): string; |
|
||||
|
|
||||
/** |
|
||||
* returns name of the key pair |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getName(): string; |
|
||||
|
|
||||
/** |
|
||||
* set public key |
|
||||
* |
|
||||
* @param string $publicKey |
|
||||
* @return IKeyPair |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function setPublicKey(string $publicKey): IKeyPair; |
|
||||
|
|
||||
/** |
|
||||
* returns public key |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getPublicKey(): string; |
|
||||
|
|
||||
/** |
|
||||
* set private key |
|
||||
* |
|
||||
* @param string $privateKey |
|
||||
* @return IKeyPair |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function setPrivateKey(string $privateKey): IKeyPair; |
|
||||
|
|
||||
/** |
|
||||
* returns private key |
|
||||
* |
|
||||
* @return string |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getPrivateKey(): string; |
|
||||
|
|
||||
/** |
|
||||
* set options |
|
||||
* |
|
||||
* @param array $options |
|
||||
* @return IKeyPair |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function setOptions(array $options): IKeyPair; |
|
||||
|
|
||||
/** |
|
||||
* returns options |
|
||||
* |
|
||||
* @return array |
|
||||
* @since 31.0.0 |
|
||||
*/ |
|
||||
public function getOptions(): array; |
|
||||
} |
|
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue