001/* 002 * (C) Copyright 2006-2018 Nuxeo (http://nuxeo.com/) and others. 003 * 004 * Licensed under the Apache License, Version 2.0 (the "License"); 005 * you may not use this file except in compliance with the License. 006 * You may obtain a copy of the License at 007 * 008 * http://www.apache.org/licenses/LICENSE-2.0 009 * 010 * Unless required by applicable law or agreed to in writing, software 011 * distributed under the License is distributed on an "AS IS" BASIS, 012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 013 * See the License for the specific language governing permissions and 014 * limitations under the License. 015 * 016 * Contributors: 017 * Florent Guillaume 018 */ 019package org.nuxeo.ecm.core.blob.binary; 020 021import java.io.BufferedInputStream; 022import java.io.BufferedOutputStream; 023import java.io.DataInputStream; 024import java.io.DataOutputStream; 025import java.io.File; 026import java.io.FileInputStream; 027import java.io.FileOutputStream; 028import java.io.FilterOutputStream; 029import java.io.IOException; 030import java.io.InputStream; 031import java.io.OutputStream; 032import java.lang.reflect.Field; 033import java.security.GeneralSecurityException; 034import java.security.Key; 035import java.security.KeyStore; 036import java.security.MessageDigest; 037import java.security.SecureRandom; 038import java.util.Arrays; 039import java.util.Map; 040import java.util.Random; 041 042import javax.crypto.BadPaddingException; 043import javax.crypto.Cipher; 044import javax.crypto.CipherInputStream; 045import javax.crypto.SecretKeyFactory; 046import javax.crypto.spec.IvParameterSpec; 047import javax.crypto.spec.PBEKeySpec; 048import javax.crypto.spec.SecretKeySpec; 049 050import org.apache.commons.io.IOUtils; 051import org.apache.commons.lang3.StringUtils; 052import org.apache.commons.logging.Log; 053import org.apache.commons.logging.LogFactory; 054import org.nuxeo.ecm.core.api.NuxeoException; 055import org.nuxeo.runtime.api.Framework; 056 057/** 058 * A binary manager that encrypts binaries on the filesystem using AES. 059 * <p> 060 * The configuration holds the keystore information to retrieve the AES key, or the password that is used to generate a 061 * per-file key using PBKDF2. This configuration comes from the {@code <property name="key">...</property>} of the 062 * binary manager configuration. 063 * <p> 064 * The configuration has the form {@code key1=value1,key2=value2,...} where the possible keys are, for keystore use: 065 * <ul> 066 * <li>keyStoreType: the keystore type, for instance JCEKS 067 * <li>keyStoreFile: the path to the keystore, if applicable 068 * <li>keyStorePassword: the keystore password 069 * <li>keyAlias: the alias (name) of the key in the keystore 070 * <li>keyPassword: the key password 071 * </ul> 072 * <p> 073 * And for PBKDF2 use: 074 * <ul> 075 * <li>password: the password 076 * </ul> 077 * <p> 078 * To encrypt a binary, an AES key is needed. This key can be retrieved from a keystore, or generated from a password 079 * using PBKDF2 (in which case each stored file contains a different salt for security reasons). The file format is 080 * described in {@link #storeAndDigest(InputStream, OutputStream)}. 081 * <p> 082 * While the binary is being used by the application, a temporarily-decrypted file is held in a temporary directory. It 083 * is removed as soon as possible. 084 * <p> 085 * Note: if the Java Cryptographic Extension (JCE) is not configured for 256-bit key length, you may get an exception 086 * "java.security.InvalidKeyException: Illegal key size or default parameters". If this is the case, go to 087 * <a href="http://www.oracle.com/technetwork/java/javase/downloads/index.html" >Oracle Java SE Downloads</a> and 088 * download and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for your JDK. 089 * 090 * @since 6.0 091 */ 092public class AESBinaryManager extends LocalBinaryManager { 093 094 private static final Log log = LogFactory.getLog(AESBinaryManager.class); 095 096 protected static final byte[] FILE_MAGIC = new byte[] { 'N', 'U', 'X', 'E', 'O', 'C', 'R', 'Y', 'P', 'T' }; 097 098 protected static final int FILE_VERSION_1 = 1; 099 100 protected static final int USE_KEYSTORE = 1; 101 102 protected static final int USE_PBKDF2 = 2; 103 104 protected static final String AES = "AES"; 105 106 protected static final String AES_CBC_PKCS5_PADDING = "AES/CBC/PKCS5Padding"; 107 108 protected static final String PBKDF2_WITH_HMAC_SHA1 = "PBKDF2WithHmacSHA1"; 109 110 protected static final int PBKDF2_ITERATIONS = 10000; 111 112 // AES-256 113 protected static final int PBKDF2_KEY_LENGTH = 256; 114 115 protected static final String PARAM_PASSWORD = "password"; 116 117 protected static final String PARAM_KEY_STORE_TYPE = "keyStoreType"; 118 119 protected static final String PARAM_KEY_STORE_FILE = "keyStoreFile"; 120 121 protected static final String PARAM_KEY_STORE_PASSWORD = "keyStorePassword"; 122 123 protected static final String PARAM_KEY_ALIAS = "keyAlias"; 124 125 protected static final String PARAM_KEY_PASSWORD = "keyPassword"; 126 127 // for sanity check during reads 128 private static final int MAX_SALT_LEN = 1024; 129 130 // for sanity check during reads 131 private static final int MAX_IV_LEN = 1024; 132 133 // Random instances are thread-safe 134 protected static final Random RANDOM = new SecureRandom(); 135 136 // the digest from the root descriptor 137 protected String digestAlgorithm; 138 139 protected boolean usePBKDF2; 140 141 protected String password; 142 143 protected String keyStoreType; 144 145 protected String keyStoreFile; 146 147 protected String keyStorePassword; 148 149 protected String keyAlias; 150 151 protected String keyPassword; 152 153 public AESBinaryManager() { 154 setUnlimitedJCEPolicy(); 155 } 156 157 /** 158 * By default the JRE may ship with restricted key length. Instead of having administrators download the Java 159 * Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files from 160 * http://www.oracle.com/technetwork/java/javase/downloads/index.html, we attempt to directly unrestrict the JCE 161 * using reflection. 162 * <p> 163 * This is not possible anymore since 8u102 and https://bugs.openjdk.java.net/browse/JDK-8149417 164 */ 165 protected static boolean setUnlimitedJCEPolicy() { 166 try { 167 Field field = Class.forName("javax.crypto.JceSecurity").getDeclaredField("isRestricted"); 168 field.setAccessible(true); 169 if (Boolean.TRUE.equals(field.get(null))) { 170 log.info("Setting JCE Unlimited Strength"); 171 field.set(null, Boolean.FALSE); 172 } 173 return true; 174 } catch (ReflectiveOperationException | SecurityException | IllegalArgumentException e) { 175 log.debug("Cannot check/set JCE Unlimited Strength", e); 176 return false; 177 } 178 } 179 180 @Override 181 public void initialize(String blobProviderId, Map<String, String> properties) throws IOException { 182 super.initialize(blobProviderId, properties); 183 digestAlgorithm = getDigestAlgorithm(); 184 String options = properties.get(BinaryManager.PROP_KEY); 185 // TODO parse options from properties directly 186 if (StringUtils.isBlank(options)) { 187 throw new NuxeoException("Missing key for " + getClass().getSimpleName()); 188 } 189 initializeOptions(options); 190 } 191 192 protected void initializeOptions(String options) { 193 for (String option : options.split(",")) { 194 String[] split = option.split("=", 2); 195 if (split.length != 2) { 196 throw new NuxeoException("Unrecognized option: " + option); 197 } 198 String value = StringUtils.defaultIfBlank(split[1], null); 199 switch (split[0]) { 200 case PARAM_PASSWORD: 201 password = value; 202 break; 203 case PARAM_KEY_STORE_TYPE: 204 keyStoreType = value; 205 break; 206 case PARAM_KEY_STORE_FILE: 207 keyStoreFile = value; 208 break; 209 case PARAM_KEY_STORE_PASSWORD: 210 keyStorePassword = value; 211 break; 212 case PARAM_KEY_ALIAS: 213 keyAlias = value; 214 break; 215 case PARAM_KEY_PASSWORD: 216 keyPassword = value; 217 break; 218 default: 219 throw new NuxeoException("Unrecognized option: " + option); 220 } 221 } 222 usePBKDF2 = password != null; 223 if (usePBKDF2) { 224 if (keyStoreType != null) { 225 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_TYPE + " with " + PARAM_PASSWORD); 226 } 227 if (keyStoreFile != null) { 228 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_FILE + " with " + PARAM_PASSWORD); 229 } 230 if (keyStorePassword != null) { 231 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_PASSWORD + " with " + PARAM_PASSWORD); 232 } 233 if (keyAlias != null) { 234 throw new NuxeoException("Cannot use " + PARAM_KEY_ALIAS + " with " + PARAM_PASSWORD); 235 } 236 if (keyPassword != null) { 237 throw new NuxeoException("Cannot use " + PARAM_KEY_PASSWORD + " with " + PARAM_PASSWORD); 238 } 239 } else { 240 if (keyStoreType == null) { 241 throw new NuxeoException("Missing " + PARAM_KEY_STORE_TYPE); 242 } 243 // keystore file is optional 244 if (keyStoreFile == null && keyStorePassword != null) { 245 throw new NuxeoException("Missing " + PARAM_KEY_STORE_PASSWORD); 246 } 247 if (keyAlias == null) { 248 throw new NuxeoException("Missing " + PARAM_KEY_ALIAS); 249 } 250 if (keyPassword == null) { 251 keyPassword = keyStorePassword; 252 } 253 } 254 } 255 256 /** 257 * Gets the password for PBKDF2. 258 * <p> 259 * The caller must clear it from memory when done with it by calling {@link #clearPassword}. 260 */ 261 protected char[] getPassword() { 262 return password.toCharArray(); 263 } 264 265 /** 266 * Clears a password from memory. 267 */ 268 protected void clearPassword(char[] password) { 269 if (password != null) { 270 Arrays.fill(password, '\0'); 271 } 272 } 273 274 /** 275 * Generates an AES key from the password using PBKDF2. 276 * 277 * @param salt the salt 278 */ 279 protected Key generateSecretKey(byte[] salt) throws GeneralSecurityException { 280 char[] password = getPassword(); 281 SecretKeyFactory factory = SecretKeyFactory.getInstance(PBKDF2_WITH_HMAC_SHA1); 282 PBEKeySpec spec = new PBEKeySpec(password, salt, PBKDF2_ITERATIONS, PBKDF2_KEY_LENGTH); 283 clearPassword(password); 284 Key derived = factory.generateSecret(spec); 285 spec.clearPassword(); 286 return new SecretKeySpec(derived.getEncoded(), AES); 287 } 288 289 /** 290 * Gets the AES key from the keystore. 291 */ 292 protected Key getSecretKey() throws GeneralSecurityException, IOException { 293 KeyStore keyStore = KeyStore.getInstance(keyStoreType); 294 char[] kspw = keyStorePassword == null ? null : keyStorePassword.toCharArray(); 295 if (keyStoreFile != null) { 296 try (InputStream in = new BufferedInputStream(new FileInputStream(keyStoreFile))) { 297 keyStore.load(in, kspw); 298 } 299 } else { 300 // some keystores are not backed by a file 301 keyStore.load(null, kspw); 302 } 303 clearPassword(kspw); 304 char[] kpw = keyPassword == null ? null : keyPassword.toCharArray(); 305 Key key = keyStore.getKey(keyAlias, kpw); 306 clearPassword(kpw); 307 return key; 308 } 309 310 @Override 311 protected Binary getBinary(InputStream in) throws IOException { 312 // write to a tmp file that will be used by the returned Binary 313 // TODO if stream source, avoid copy (no-copy optimization) 314 File tmp = File.createTempFile("bin_", ".tmp", tmpDir); 315 Framework.trackFile(tmp, tmp); 316 OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 317 IOUtils.copy(in, out); 318 in.close(); 319 out.close(); 320 // encrypt an digest into final file 321 InputStream nin = new BufferedInputStream(new FileInputStream(tmp)); 322 String digest = storeAndDigest(nin); // calls our storeAndDigest 323 // return a binary on our tmp file 324 return new Binary(tmp, digest, blobProviderId); 325 } 326 327 @Override 328 public Binary getBinary(String digest) { 329 File file = getFileForDigest(digest, false); 330 if (file == null) { 331 log.warn("Invalid digest format: " + digest); 332 return null; 333 } 334 if (!file.exists()) { 335 return null; 336 } 337 File tmp; 338 try { 339 tmp = File.createTempFile("bin_", ".tmp", tmpDir); 340 Framework.trackFile(tmp, tmp); 341 try (OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 342 InputStream in = new BufferedInputStream(new FileInputStream(file))) { 343 decrypt(in, out); 344 } 345 } catch (IOException e) { 346 throw new RuntimeException(e); 347 } 348 // return a binary on our tmp file 349 return new Binary(tmp, digest, blobProviderId); 350 } 351 352 @Override 353 protected String storeAndDigest(InputStream in) throws IOException { 354 File tmp = File.createTempFile("create_", ".tmp", tmpDir); 355 /* 356 * First, write the input stream to a temporary file, while computing a digest. 357 */ 358 try { 359 String digest; 360 try (OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp))) { 361 digest = storeAndDigest(in, out); 362 } finally { 363 in.close(); 364 } 365 /* 366 * Move the tmp file to its destination. 367 */ 368 File file = getFileForDigest(digest, true); 369 atomicMove(tmp, file); 370 return digest; 371 } finally { 372 tmp.delete(); 373 } 374 } 375 376 /** 377 * Encrypts the given input stream into the given output stream, while also computing the digest of the input 378 * stream. 379 * <p> 380 * File format version 1 (values are in network order): 381 * <ul> 382 * <li>10 bytes: magic number "NUXEOCRYPT" 383 * <li>1 byte: file format version = 1 384 * <li>1 byte: use keystore = 1, use PBKDF2 = 2 385 * <li>if use PBKDF2: 386 * <ul> 387 * <li>4 bytes: salt length = n 388 * <li>n bytes: salt data 389 * </ul> 390 * <li>4 bytes: IV length = p 391 * <li>p bytes: IV data 392 * <li>x bytes: encrypted stream 393 * </ul> 394 * 395 * @param in the input stream containing the data 396 * @param out the output stream into write 397 * @return the digest of the input stream 398 */ 399 @Override 400 public String storeAndDigest(InputStream in, OutputStream out) throws IOException { 401 out.write(FILE_MAGIC); 402 DataOutputStream data = new DataOutputStream(out); 403 data.writeByte(FILE_VERSION_1); 404 405 try { 406 // get digest to use 407 MessageDigest messageDigest = MessageDigest.getInstance(digestAlgorithm); 408 409 // secret key 410 Key secret; 411 if (usePBKDF2) { 412 data.writeByte(USE_PBKDF2); 413 // generate a salt 414 byte[] salt = new byte[16]; 415 RANDOM.nextBytes(salt); 416 // generate secret key 417 secret = generateSecretKey(salt); 418 // write salt 419 data.writeInt(salt.length); 420 data.write(salt); 421 } else { 422 data.writeByte(USE_KEYSTORE); 423 // find secret key from keystore 424 secret = getSecretKey(); 425 } 426 427 // cipher 428 Cipher cipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING); 429 cipher.init(Cipher.ENCRYPT_MODE, secret); 430 431 // write IV 432 byte[] iv = cipher.getIV(); 433 data.writeInt(iv.length); 434 data.write(iv); 435 436 // digest and write the encrypted data 437 CipherAndDigestOutputStream cipherOut = new CipherAndDigestOutputStream(out, cipher, messageDigest); 438 IOUtils.copy(in, cipherOut); 439 cipherOut.close(); 440 byte[] digest = cipherOut.getDigest(); 441 return toHexString(digest); 442 } catch (GeneralSecurityException e) { 443 throw new NuxeoException(e); 444 } 445 446 } 447 448 /** 449 * Decrypts the given input stream into the given output stream. 450 */ 451 protected void decrypt(InputStream in, OutputStream out) throws IOException { 452 byte[] magic = new byte[FILE_MAGIC.length]; 453 IOUtils.read(in, magic); 454 if (!Arrays.equals(magic, FILE_MAGIC)) { 455 throw new IOException("Invalid file (bad magic)"); 456 } 457 DataInputStream data = new DataInputStream(in); 458 byte magicvers = data.readByte(); 459 if (magicvers != FILE_VERSION_1) { 460 throw new IOException("Invalid file (bad version)"); 461 } 462 463 byte usepb = data.readByte(); 464 if (usepb == USE_PBKDF2) { 465 if (!usePBKDF2) { 466 throw new NuxeoException("File requires PBKDF2 password"); 467 } 468 } else if (usepb == USE_KEYSTORE) { 469 if (usePBKDF2) { 470 throw new NuxeoException("File requires keystore"); 471 } 472 } else { 473 throw new IOException("Invalid file (bad use)"); 474 } 475 476 try { 477 // secret key 478 Key secret; 479 if (usePBKDF2) { 480 // read salt first 481 int saltLen = data.readInt(); 482 if (saltLen <= 0 || saltLen > MAX_SALT_LEN) { 483 throw new NuxeoException("Invalid salt length: " + saltLen); 484 } 485 byte[] salt = new byte[saltLen]; 486 data.read(salt, 0, saltLen); 487 secret = generateSecretKey(salt); 488 } else { 489 secret = getSecretKey(); 490 } 491 492 // read IV 493 int ivLen = data.readInt(); 494 if (ivLen <= 0 || ivLen > MAX_IV_LEN) { 495 throw new NuxeoException("Invalid IV length: " + ivLen); 496 } 497 byte[] iv = new byte[ivLen]; 498 data.read(iv, 0, ivLen); 499 500 // cipher 501 Cipher cipher; 502 cipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING); 503 cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(iv)); 504 505 // read the encrypted data 506 try (InputStream cipherIn = new CipherInputStream(in, cipher)) { 507 IOUtils.copy(cipherIn, out); 508 } catch (IOException e) { 509 Throwable cause = e.getCause(); 510 if (cause != null && cause instanceof BadPaddingException) { 511 throw new NuxeoException(cause.getMessage(), e); 512 } 513 } 514 } catch (GeneralSecurityException e) { 515 throw new NuxeoException(e); 516 } 517 } 518 519 /** 520 * A {@link javax.crypto.CipherOutputStream CipherOutputStream} that also does a digest of the original stream at 521 * the same time. 522 */ 523 public static class CipherAndDigestOutputStream extends FilterOutputStream { 524 525 protected Cipher cipher; 526 527 protected OutputStream out; 528 529 protected MessageDigest messageDigest; 530 531 protected byte[] digest; 532 533 public CipherAndDigestOutputStream(OutputStream out, Cipher cipher, MessageDigest messageDigest) { 534 super(out); 535 this.out = out; 536 this.cipher = cipher; 537 this.messageDigest = messageDigest; 538 } 539 540 public byte[] getDigest() { 541 return digest; 542 } 543 544 @Override 545 public void write(int b) throws IOException { 546 write(new byte[] { (byte) b }, 0, 1); 547 } 548 549 @Override 550 public void write(byte b[], int off, int len) throws IOException { 551 messageDigest.update(b, off, len); 552 byte[] bytes = cipher.update(b, off, len); 553 if (bytes != null) { 554 out.write(bytes); 555 bytes = null; // help GC 556 } 557 } 558 559 @Override 560 public void flush() throws IOException { 561 out.flush(); 562 } 563 564 @Override 565 public void close() throws IOException { 566 digest = messageDigest.digest(); 567 try { 568 byte[] bytes = cipher.doFinal(); 569 out.write(bytes); 570 bytes = null; // help GC 571 } catch (GeneralSecurityException e) { 572 throw new NuxeoException(e); 573 } 574 try { 575 flush(); 576 } finally { 577 out.close(); 578 } 579 } 580 } 581 582}