001/* 002 * Copyright (c) 2006-2014 Nuxeo SA (http://nuxeo.com/) and others. 003 * 004 * All rights reserved. This program and the accompanying materials 005 * are made available under the terms of the Eclipse Public License v1.0 006 * which accompanies this distribution, and is available at 007 * http://www.eclipse.org/legal/epl-v10.html 008 * 009 * Contributors: 010 * Florent Guillaume 011 */ 012package org.nuxeo.ecm.core.blob.binary; 013 014import java.io.BufferedInputStream; 015import java.io.BufferedOutputStream; 016import java.io.DataInputStream; 017import java.io.DataOutputStream; 018import java.io.File; 019import java.io.FileInputStream; 020import java.io.FileOutputStream; 021import java.io.FilterOutputStream; 022import java.io.IOException; 023import java.io.InputStream; 024import java.io.OutputStream; 025import java.lang.reflect.Field; 026import java.security.GeneralSecurityException; 027import java.security.Key; 028import java.security.KeyStore; 029import java.security.MessageDigest; 030import java.security.SecureRandom; 031import java.util.Arrays; 032import java.util.Map; 033import java.util.Random; 034 035import javax.crypto.BadPaddingException; 036import javax.crypto.Cipher; 037import javax.crypto.CipherInputStream; 038import javax.crypto.SecretKeyFactory; 039import javax.crypto.spec.IvParameterSpec; 040import javax.crypto.spec.PBEKeySpec; 041import javax.crypto.spec.SecretKeySpec; 042 043import org.apache.commons.io.IOUtils; 044import org.apache.commons.lang.StringUtils; 045import org.apache.commons.logging.Log; 046import org.apache.commons.logging.LogFactory; 047import org.nuxeo.ecm.core.api.NuxeoException; 048import org.nuxeo.runtime.api.Framework; 049 050/** 051 * A binary manager that encrypts binaries on the filesystem using AES. 052 * <p> 053 * The configuration holds the keystore information to retrieve the AES key, or the 054 * password that is used to generate a per-file key using PBKDF2. This configuration comes from the 055 * {@code <property name="key">...</property>} of the binary manager configuration. 056 * <p> 057 * The configuration has the form {@code key1=value1,key2=value2,...} where the possible keys are, for keystore use: 058 * <ul> 059 * <li>keyStoreType: the keystore type, for instance JCEKS 060 * <li>keyStoreFile: the path to the keystore, if applicable 061 * <li>keyStorePassword: the keystore password 062 * <li>keyAlias: the alias (name) of the key in the keystore 063 * <li>keyPassword: the key password 064 * </ul> 065 * <p> 066 * And for PBKDF2 use: 067 * <ul> 068 * <li>password: the password 069 * </ul> 070 * <p> 071 * To encrypt a binary, an AES key is needed. This key can be retrieved from a keystore, or generated from a password 072 * using PBKDF2 (in which case each stored file contains a different salt for security reasons). The file format is 073 * described in {@link #storeAndDigest(InputStream, OutputStream)}. 074 * <p> 075 * While the binary is being used by the application, a temporarily-decrypted file is held in a temporary directory. It 076 * is removed as soon as possible. 077 * <p> 078 * Note: if the Java Cryptographic Extension (JCE) is not configured for 256-bit key length, you may get an exception 079 * "java.security.InvalidKeyException: Illegal key size or default parameters". If this is the case, go to <a 080 * href="http://www.oracle.com/technetwork/java/javase/downloads/index.html" >Oracle Java SE Downloads</a> and download 081 * and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for your JDK. 082 * 083 * @since 6.0 084 */ 085public class AESBinaryManager extends LocalBinaryManager { 086 087 private static final Log log = LogFactory.getLog(AESBinaryManager.class); 088 089 protected static final byte[] FILE_MAGIC = new byte[] { 'N', 'U', 'X', 'E', 'O', 'C', 'R', 'Y', 'P', 'T' }; 090 091 protected static final int FILE_VERSION_1 = 1; 092 093 protected static final int USE_KEYSTORE = 1; 094 095 protected static final int USE_PBKDF2 = 2; 096 097 protected static final String AES = "AES"; 098 099 protected static final String AES_CBC_PKCS5_PADDING = "AES/CBC/PKCS5Padding"; 100 101 protected static final String PBKDF2_WITH_HMAC_SHA1 = "PBKDF2WithHmacSHA1"; 102 103 protected static final int PBKDF2_ITERATIONS = 10000; 104 105 // AES-256 106 protected static final int PBKDF2_KEY_LENGTH = 256; 107 108 protected static final String PARAM_PASSWORD = "password"; 109 110 protected static final String PARAM_KEY_STORE_TYPE = "keyStoreType"; 111 112 protected static final String PARAM_KEY_STORE_FILE = "keyStoreFile"; 113 114 protected static final String PARAM_KEY_STORE_PASSWORD = "keyStorePassword"; 115 116 protected static final String PARAM_KEY_ALIAS = "keyAlias"; 117 118 protected static final String PARAM_KEY_PASSWORD = "keyPassword"; 119 120 // for sanity check during reads 121 private static final int MAX_SALT_LEN = 1024; 122 123 // for sanity check during reads 124 private static final int MAX_IV_LEN = 1024; 125 126 // Random instances are thread-safe 127 protected static final Random RANDOM = new SecureRandom(); 128 129 // the digest from the root descriptor 130 protected String digestAlgorithm; 131 132 protected boolean usePBKDF2; 133 134 protected String password; 135 136 protected String keyStoreType; 137 138 protected String keyStoreFile; 139 140 protected String keyStorePassword; 141 142 protected String keyAlias; 143 144 protected String keyPassword; 145 146 public AESBinaryManager() { 147 setUnlimitedJCEPolicy(); 148 } 149 150 /** 151 * By default the JRE may ship with restricted key length. Instead of having administrators download the Java 152 * Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files from 153 * http://www.oracle.com/technetwork/java/javase/downloads/index.html, we attempt to directly unrestrict the JCE 154 * using reflection. 155 */ 156 protected static void setUnlimitedJCEPolicy() { 157 try { 158 Field field = Class.forName("javax.crypto.JceSecurity").getDeclaredField("isRestricted"); 159 field.setAccessible(true); 160 if (Boolean.TRUE.equals(field.get(null))) { 161 log.info("Setting JCE Unlimited Strength"); 162 field.set(null, Boolean.FALSE); 163 } 164 } catch (ReflectiveOperationException | SecurityException | IllegalArgumentException e) { 165 log.debug("Cannot check/set JCE Unlimited Strength", e); 166 } 167 } 168 169 @Override 170 public void initialize(String blobProviderId, Map<String, String> properties) throws IOException { 171 super.initialize(blobProviderId, properties); 172 digestAlgorithm = getDigestAlgorithm(); 173 String options = properties.get(BinaryManager.PROP_KEY); 174 // TODO parse options from properties directly 175 if (StringUtils.isBlank(options)) { 176 throw new NuxeoException("Missing key for " + getClass().getSimpleName()); 177 } 178 initializeOptions(options); 179 } 180 181 protected void initializeOptions(String options) { 182 for (String option : options.split(",")) { 183 String[] split = option.split("=", 2); 184 if (split.length != 2) { 185 throw new NuxeoException("Unrecognized option: " + option); 186 } 187 String value = StringUtils.defaultIfBlank(split[1], null); 188 switch (split[0]) { 189 case PARAM_PASSWORD: 190 password = value; 191 break; 192 case PARAM_KEY_STORE_TYPE: 193 keyStoreType = value; 194 break; 195 case PARAM_KEY_STORE_FILE: 196 keyStoreFile = value; 197 break; 198 case PARAM_KEY_STORE_PASSWORD: 199 keyStorePassword = value; 200 break; 201 case PARAM_KEY_ALIAS: 202 keyAlias = value; 203 break; 204 case PARAM_KEY_PASSWORD: 205 keyPassword = value; 206 break; 207 default: 208 throw new NuxeoException("Unrecognized option: " + option); 209 } 210 } 211 usePBKDF2 = password != null; 212 if (usePBKDF2) { 213 if (keyStoreType != null) { 214 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_TYPE + " with " + PARAM_PASSWORD); 215 } 216 if (keyStoreFile != null) { 217 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_FILE + " with " + PARAM_PASSWORD); 218 } 219 if (keyStorePassword != null) { 220 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_PASSWORD + " with " + PARAM_PASSWORD); 221 } 222 if (keyAlias != null) { 223 throw new NuxeoException("Cannot use " + PARAM_KEY_ALIAS + " with " + PARAM_PASSWORD); 224 } 225 if (keyPassword != null) { 226 throw new NuxeoException("Cannot use " + PARAM_KEY_PASSWORD + " with " + PARAM_PASSWORD); 227 } 228 } else { 229 if (keyStoreType == null) { 230 throw new NuxeoException("Missing " + PARAM_KEY_STORE_TYPE); 231 } 232 // keystore file is optional 233 if (keyStoreFile == null && keyStorePassword != null) { 234 throw new NuxeoException("Missing " + PARAM_KEY_STORE_PASSWORD); 235 } 236 if (keyAlias == null) { 237 throw new NuxeoException("Missing " + PARAM_KEY_ALIAS); 238 } 239 if (keyPassword == null) { 240 keyPassword = keyStorePassword; 241 } 242 } 243 } 244 245 /** 246 * Gets the password for PBKDF2. 247 * <p> 248 * The caller must clear it from memory when done with it by calling {@link #clearPassword}. 249 */ 250 protected char[] getPassword() { 251 return password.toCharArray(); 252 } 253 254 /** 255 * Clears a password from memory. 256 */ 257 protected void clearPassword(char[] password) { 258 if (password != null) { 259 Arrays.fill(password, '\0'); 260 } 261 } 262 263 /** 264 * Generates an AES key from the password using PBKDF2. 265 * 266 * @param salt the salt 267 */ 268 protected Key generateSecretKey(byte[] salt) throws GeneralSecurityException { 269 char[] password = getPassword(); 270 SecretKeyFactory factory = SecretKeyFactory.getInstance(PBKDF2_WITH_HMAC_SHA1); 271 PBEKeySpec spec = new PBEKeySpec(password, salt, PBKDF2_ITERATIONS, PBKDF2_KEY_LENGTH); 272 clearPassword(password); 273 Key derived = factory.generateSecret(spec); 274 spec.clearPassword(); 275 return new SecretKeySpec(derived.getEncoded(), AES); 276 } 277 278 /** 279 * Gets the AES key from the keystore. 280 */ 281 protected Key getSecretKey() throws GeneralSecurityException, IOException { 282 KeyStore keyStore = KeyStore.getInstance(keyStoreType); 283 char[] kspw = keyStorePassword == null ? null : keyStorePassword.toCharArray(); 284 if (keyStoreFile != null) { 285 try (InputStream in = new BufferedInputStream(new FileInputStream(keyStoreFile))) { 286 keyStore.load(in, kspw); 287 } 288 } else { 289 // some keystores are not backed by a file 290 keyStore.load(null, kspw); 291 } 292 clearPassword(kspw); 293 char[] kpw = keyPassword == null ? null : keyPassword.toCharArray(); 294 Key key = keyStore.getKey(keyAlias, kpw); 295 clearPassword(kpw); 296 return key; 297 } 298 299 @Override 300 protected Binary getBinary(InputStream in) throws IOException { 301 // write to a tmp file that will be used by the returned Binary 302 // TODO if stream source, avoid copy (no-copy optimization) 303 File tmp = File.createTempFile("bin_", ".tmp", tmpDir); 304 Framework.trackFile(tmp, tmp); 305 OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 306 IOUtils.copy(in, out); 307 in.close(); 308 out.close(); 309 // encrypt an digest into final file 310 InputStream nin = new BufferedInputStream(new FileInputStream(tmp)); 311 String digest = storeAndDigest(nin); // calls our storeAndDigest 312 // return a binary on our tmp file 313 return new Binary(tmp, digest, blobProviderId); 314 } 315 316 @Override 317 public Binary getBinary(String digest) { 318 File file = getFileForDigest(digest, false); 319 if (file == null) { 320 log.warn("Invalid digest format: " + digest); 321 return null; 322 } 323 if (!file.exists()) { 324 return null; 325 } 326 File tmp; 327 try { 328 tmp = File.createTempFile("bin_", ".tmp", tmpDir); 329 OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 330 InputStream in = new BufferedInputStream(new FileInputStream(file)); 331 try { 332 decrypt(in, out); 333 } finally { 334 in.close(); 335 out.close(); 336 } 337 } catch (IOException e) { 338 throw new RuntimeException(e); 339 } 340 // return a binary on our tmp file 341 return new Binary(tmp, digest, blobProviderId); 342 } 343 344 @Override 345 protected String storeAndDigest(InputStream in) throws IOException { 346 File tmp = File.createTempFile("create_", ".tmp", tmpDir); 347 OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 348 /* 349 * First, write the input stream to a temporary file, while computing a digest. 350 */ 351 try { 352 String digest; 353 try { 354 digest = storeAndDigest(in, out); 355 } finally { 356 in.close(); 357 out.close(); 358 } 359 /* 360 * Move the tmp file to its destination. 361 */ 362 File file = getFileForDigest(digest, true); 363 atomicMove(tmp, file); 364 return digest; 365 } finally { 366 tmp.delete(); 367 } 368 } 369 370 /** 371 * Encrypts the given input stream into the given output stream, while also computing the digest of the input 372 * stream. 373 * <p> 374 * File format version 1 (values are in network order): 375 * <ul> 376 * <li>10 bytes: magic number "NUXEOCRYPT" 377 * <li>1 byte: file format version = 1 378 * <li>1 byte: use keystore = 1, use PBKDF2 = 2 379 * <li>if use PBKDF2: 380 * <ul> 381 * <li>4 bytes: salt length = n 382 * <li>n bytes: salt data 383 * </ul> 384 * <li>4 bytes: IV length = p 385 * <li>p bytes: IV data 386 * <li>x bytes: encrypted stream 387 * </ul> 388 * 389 * @param in the input stream containing the data 390 * @param file the file containing the encrypted data 391 * @return the digest of the input stream 392 */ 393 @Override 394 public String storeAndDigest(InputStream in, OutputStream out) throws IOException { 395 out.write(FILE_MAGIC); 396 DataOutputStream data = new DataOutputStream(out); 397 data.writeByte(FILE_VERSION_1); 398 399 try { 400 // get digest to use 401 MessageDigest messageDigest = MessageDigest.getInstance(digestAlgorithm); 402 403 // secret key 404 Key secret; 405 if (usePBKDF2) { 406 data.writeByte(USE_PBKDF2); 407 // generate a salt 408 byte[] salt = new byte[16]; 409 RANDOM.nextBytes(salt); 410 // generate secret key 411 secret = generateSecretKey(salt); 412 // write salt 413 data.writeInt(salt.length); 414 data.write(salt); 415 } else { 416 data.writeByte(USE_KEYSTORE); 417 // find secret key from keystore 418 secret = getSecretKey(); 419 } 420 421 // cipher 422 Cipher cipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING); 423 cipher.init(Cipher.ENCRYPT_MODE, secret); 424 425 // write IV 426 byte[] iv = cipher.getIV(); 427 data.writeInt(iv.length); 428 data.write(iv); 429 430 // digest and write the encrypted data 431 CipherAndDigestOutputStream cipherOut = new CipherAndDigestOutputStream(out, cipher, messageDigest); 432 IOUtils.copy(in, cipherOut); 433 cipherOut.close(); 434 byte[] digest = cipherOut.getDigest(); 435 return toHexString(digest); 436 } catch (GeneralSecurityException e) { 437 throw new NuxeoException(e); 438 } 439 440 } 441 442 /** 443 * Decrypts the given input stream into the given output stream. 444 */ 445 protected void decrypt(InputStream in, OutputStream out) throws IOException { 446 byte[] magic = new byte[FILE_MAGIC.length]; 447 IOUtils.read(in, magic); 448 if (!Arrays.equals(magic, FILE_MAGIC)) { 449 throw new IOException("Invalid file (bad magic)"); 450 } 451 DataInputStream data = new DataInputStream(in); 452 byte magicvers = data.readByte(); 453 if (magicvers != FILE_VERSION_1) { 454 throw new IOException("Invalid file (bad version)"); 455 } 456 457 byte usepb = data.readByte(); 458 if (usepb == USE_PBKDF2) { 459 if (!usePBKDF2) { 460 throw new NuxeoException("File requires PBKDF2 password"); 461 } 462 } else if (usepb == USE_KEYSTORE) { 463 if (usePBKDF2) { 464 throw new NuxeoException("File requires keystore"); 465 } 466 } else { 467 throw new IOException("Invalid file (bad use)"); 468 } 469 470 try { 471 // secret key 472 Key secret; 473 if (usePBKDF2) { 474 // read salt first 475 int saltLen = data.readInt(); 476 if (saltLen <= 0 || saltLen > MAX_SALT_LEN) { 477 throw new NuxeoException("Invalid salt length: " + saltLen); 478 } 479 byte[] salt = new byte[saltLen]; 480 data.read(salt, 0, saltLen); 481 secret = generateSecretKey(salt); 482 } else { 483 secret = getSecretKey(); 484 } 485 486 // read IV 487 int ivLen = data.readInt(); 488 if (ivLen <= 0 || ivLen > MAX_IV_LEN) { 489 throw new NuxeoException("Invalid IV length: " + ivLen); 490 } 491 byte[] iv = new byte[ivLen]; 492 data.read(iv, 0, ivLen); 493 494 // cipher 495 Cipher cipher; 496 cipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING); 497 cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(iv)); 498 499 // read the encrypted data 500 try (InputStream cipherIn = new CipherInputStream(in, cipher)) { 501 IOUtils.copy(cipherIn, out); 502 } catch (IOException e) { 503 Throwable cause = e.getCause(); 504 if (cause != null && cause instanceof BadPaddingException) { 505 throw new NuxeoException(cause.getMessage(), e); 506 } 507 } 508 } catch (GeneralSecurityException e) { 509 throw new NuxeoException(e); 510 } 511 } 512 513 /** 514 * A {@link javax.crypto.CipherOutputStream CipherOutputStream} that also does a digest of the original stream at 515 * the same time. 516 */ 517 public static class CipherAndDigestOutputStream extends FilterOutputStream { 518 519 protected Cipher cipher; 520 521 protected OutputStream out; 522 523 protected MessageDigest messageDigest; 524 525 protected byte[] digest; 526 527 public CipherAndDigestOutputStream(OutputStream out, Cipher cipher, MessageDigest messageDigest) { 528 super(out); 529 this.out = out; 530 this.cipher = cipher; 531 this.messageDigest = messageDigest; 532 } 533 534 public byte[] getDigest() { 535 return digest; 536 } 537 538 @Override 539 public void write(int b) throws IOException { 540 write(new byte[] { (byte) b }, 0, 1); 541 } 542 543 @Override 544 public void write(byte b[], int off, int len) throws IOException { 545 messageDigest.update(b, off, len); 546 byte[] bytes = cipher.update(b, off, len); 547 if (bytes != null) { 548 out.write(bytes); 549 bytes = null; // help GC 550 } 551 } 552 553 @Override 554 public void flush() throws IOException { 555 out.flush(); 556 } 557 558 @Override 559 public void close() throws IOException { 560 digest = messageDigest.digest(); 561 try { 562 byte[] bytes = cipher.doFinal(); 563 out.write(bytes); 564 bytes = null; // help GC 565 } catch (GeneralSecurityException e) { 566 throw new NuxeoException(e); 567 } 568 try { 569 flush(); 570 } finally { 571 out.close(); 572 } 573 } 574 } 575 576}