001/* 002 * (C) Copyright 2006-2014 Nuxeo SA (http://nuxeo.com/) and others. 003 * 004 * Licensed under the Apache License, Version 2.0 (the "License"); 005 * you may not use this file except in compliance with the License. 006 * You may obtain a copy of the License at 007 * 008 * http://www.apache.org/licenses/LICENSE-2.0 009 * 010 * Unless required by applicable law or agreed to in writing, software 011 * distributed under the License is distributed on an "AS IS" BASIS, 012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 013 * See the License for the specific language governing permissions and 014 * limitations under the License. 015 * 016 * Contributors: 017 * Florent Guillaume 018 */ 019package org.nuxeo.ecm.core.blob.binary; 020 021import java.io.BufferedInputStream; 022import java.io.BufferedOutputStream; 023import java.io.DataInputStream; 024import java.io.DataOutputStream; 025import java.io.File; 026import java.io.FileInputStream; 027import java.io.FileOutputStream; 028import java.io.FilterOutputStream; 029import java.io.IOException; 030import java.io.InputStream; 031import java.io.OutputStream; 032import java.lang.reflect.Field; 033import java.security.GeneralSecurityException; 034import java.security.Key; 035import java.security.KeyStore; 036import java.security.MessageDigest; 037import java.security.SecureRandom; 038import java.util.Arrays; 039import java.util.Map; 040import java.util.Random; 041 042import javax.crypto.BadPaddingException; 043import javax.crypto.Cipher; 044import javax.crypto.CipherInputStream; 045import javax.crypto.SecretKeyFactory; 046import javax.crypto.spec.IvParameterSpec; 047import javax.crypto.spec.PBEKeySpec; 048import javax.crypto.spec.SecretKeySpec; 049 050import org.apache.commons.io.IOUtils; 051import org.apache.commons.lang.StringUtils; 052import org.apache.commons.logging.Log; 053import org.apache.commons.logging.LogFactory; 054import org.nuxeo.ecm.core.api.NuxeoException; 055import org.nuxeo.runtime.api.Framework; 056 057/** 058 * A binary manager that encrypts binaries on the filesystem using AES. 059 * <p> 060 * The configuration holds the keystore information to retrieve the AES key, or the 061 * password that is used to generate a per-file key using PBKDF2. This configuration comes from the 062 * {@code <property name="key">...</property>} of the binary manager configuration. 063 * <p> 064 * The configuration has the form {@code key1=value1,key2=value2,...} where the possible keys are, for keystore use: 065 * <ul> 066 * <li>keyStoreType: the keystore type, for instance JCEKS 067 * <li>keyStoreFile: the path to the keystore, if applicable 068 * <li>keyStorePassword: the keystore password 069 * <li>keyAlias: the alias (name) of the key in the keystore 070 * <li>keyPassword: the key password 071 * </ul> 072 * <p> 073 * And for PBKDF2 use: 074 * <ul> 075 * <li>password: the password 076 * </ul> 077 * <p> 078 * To encrypt a binary, an AES key is needed. This key can be retrieved from a keystore, or generated from a password 079 * using PBKDF2 (in which case each stored file contains a different salt for security reasons). The file format is 080 * described in {@link #storeAndDigest(InputStream, OutputStream)}. 081 * <p> 082 * While the binary is being used by the application, a temporarily-decrypted file is held in a temporary directory. It 083 * is removed as soon as possible. 084 * <p> 085 * Note: if the Java Cryptographic Extension (JCE) is not configured for 256-bit key length, you may get an exception 086 * "java.security.InvalidKeyException: Illegal key size or default parameters". If this is the case, go to <a 087 * href="http://www.oracle.com/technetwork/java/javase/downloads/index.html" >Oracle Java SE Downloads</a> and download 088 * and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for your JDK. 089 * 090 * @since 6.0 091 */ 092public class AESBinaryManager extends LocalBinaryManager { 093 094 private static final Log log = LogFactory.getLog(AESBinaryManager.class); 095 096 protected static final byte[] FILE_MAGIC = new byte[] { 'N', 'U', 'X', 'E', 'O', 'C', 'R', 'Y', 'P', 'T' }; 097 098 protected static final int FILE_VERSION_1 = 1; 099 100 protected static final int USE_KEYSTORE = 1; 101 102 protected static final int USE_PBKDF2 = 2; 103 104 protected static final String AES = "AES"; 105 106 protected static final String AES_CBC_PKCS5_PADDING = "AES/CBC/PKCS5Padding"; 107 108 protected static final String PBKDF2_WITH_HMAC_SHA1 = "PBKDF2WithHmacSHA1"; 109 110 protected static final int PBKDF2_ITERATIONS = 10000; 111 112 // AES-256 113 protected static final int PBKDF2_KEY_LENGTH = 256; 114 115 protected static final String PARAM_PASSWORD = "password"; 116 117 protected static final String PARAM_KEY_STORE_TYPE = "keyStoreType"; 118 119 protected static final String PARAM_KEY_STORE_FILE = "keyStoreFile"; 120 121 protected static final String PARAM_KEY_STORE_PASSWORD = "keyStorePassword"; 122 123 protected static final String PARAM_KEY_ALIAS = "keyAlias"; 124 125 protected static final String PARAM_KEY_PASSWORD = "keyPassword"; 126 127 // for sanity check during reads 128 private static final int MAX_SALT_LEN = 1024; 129 130 // for sanity check during reads 131 private static final int MAX_IV_LEN = 1024; 132 133 // Random instances are thread-safe 134 protected static final Random RANDOM = new SecureRandom(); 135 136 // the digest from the root descriptor 137 protected String digestAlgorithm; 138 139 protected boolean usePBKDF2; 140 141 protected String password; 142 143 protected String keyStoreType; 144 145 protected String keyStoreFile; 146 147 protected String keyStorePassword; 148 149 protected String keyAlias; 150 151 protected String keyPassword; 152 153 public AESBinaryManager() { 154 setUnlimitedJCEPolicy(); 155 } 156 157 /** 158 * By default the JRE may ship with restricted key length. Instead of having administrators download the Java 159 * Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files from 160 * http://www.oracle.com/technetwork/java/javase/downloads/index.html, we attempt to directly unrestrict the JCE 161 * using reflection. 162 */ 163 protected static void setUnlimitedJCEPolicy() { 164 try { 165 Field field = Class.forName("javax.crypto.JceSecurity").getDeclaredField("isRestricted"); 166 field.setAccessible(true); 167 if (Boolean.TRUE.equals(field.get(null))) { 168 log.info("Setting JCE Unlimited Strength"); 169 field.set(null, Boolean.FALSE); 170 } 171 } catch (ReflectiveOperationException | SecurityException | IllegalArgumentException e) { 172 log.debug("Cannot check/set JCE Unlimited Strength", e); 173 } 174 } 175 176 @Override 177 public void initialize(String blobProviderId, Map<String, String> properties) throws IOException { 178 super.initialize(blobProviderId, properties); 179 digestAlgorithm = getDigestAlgorithm(); 180 String options = properties.get(BinaryManager.PROP_KEY); 181 // TODO parse options from properties directly 182 if (StringUtils.isBlank(options)) { 183 throw new NuxeoException("Missing key for " + getClass().getSimpleName()); 184 } 185 initializeOptions(options); 186 } 187 188 protected void initializeOptions(String options) { 189 for (String option : options.split(",")) { 190 String[] split = option.split("=", 2); 191 if (split.length != 2) { 192 throw new NuxeoException("Unrecognized option: " + option); 193 } 194 String value = StringUtils.defaultIfBlank(split[1], null); 195 switch (split[0]) { 196 case PARAM_PASSWORD: 197 password = value; 198 break; 199 case PARAM_KEY_STORE_TYPE: 200 keyStoreType = value; 201 break; 202 case PARAM_KEY_STORE_FILE: 203 keyStoreFile = value; 204 break; 205 case PARAM_KEY_STORE_PASSWORD: 206 keyStorePassword = value; 207 break; 208 case PARAM_KEY_ALIAS: 209 keyAlias = value; 210 break; 211 case PARAM_KEY_PASSWORD: 212 keyPassword = value; 213 break; 214 default: 215 throw new NuxeoException("Unrecognized option: " + option); 216 } 217 } 218 usePBKDF2 = password != null; 219 if (usePBKDF2) { 220 if (keyStoreType != null) { 221 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_TYPE + " with " + PARAM_PASSWORD); 222 } 223 if (keyStoreFile != null) { 224 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_FILE + " with " + PARAM_PASSWORD); 225 } 226 if (keyStorePassword != null) { 227 throw new NuxeoException("Cannot use " + PARAM_KEY_STORE_PASSWORD + " with " + PARAM_PASSWORD); 228 } 229 if (keyAlias != null) { 230 throw new NuxeoException("Cannot use " + PARAM_KEY_ALIAS + " with " + PARAM_PASSWORD); 231 } 232 if (keyPassword != null) { 233 throw new NuxeoException("Cannot use " + PARAM_KEY_PASSWORD + " with " + PARAM_PASSWORD); 234 } 235 } else { 236 if (keyStoreType == null) { 237 throw new NuxeoException("Missing " + PARAM_KEY_STORE_TYPE); 238 } 239 // keystore file is optional 240 if (keyStoreFile == null && keyStorePassword != null) { 241 throw new NuxeoException("Missing " + PARAM_KEY_STORE_PASSWORD); 242 } 243 if (keyAlias == null) { 244 throw new NuxeoException("Missing " + PARAM_KEY_ALIAS); 245 } 246 if (keyPassword == null) { 247 keyPassword = keyStorePassword; 248 } 249 } 250 } 251 252 /** 253 * Gets the password for PBKDF2. 254 * <p> 255 * The caller must clear it from memory when done with it by calling {@link #clearPassword}. 256 */ 257 protected char[] getPassword() { 258 return password.toCharArray(); 259 } 260 261 /** 262 * Clears a password from memory. 263 */ 264 protected void clearPassword(char[] password) { 265 if (password != null) { 266 Arrays.fill(password, '\0'); 267 } 268 } 269 270 /** 271 * Generates an AES key from the password using PBKDF2. 272 * 273 * @param salt the salt 274 */ 275 protected Key generateSecretKey(byte[] salt) throws GeneralSecurityException { 276 char[] password = getPassword(); 277 SecretKeyFactory factory = SecretKeyFactory.getInstance(PBKDF2_WITH_HMAC_SHA1); 278 PBEKeySpec spec = new PBEKeySpec(password, salt, PBKDF2_ITERATIONS, PBKDF2_KEY_LENGTH); 279 clearPassword(password); 280 Key derived = factory.generateSecret(spec); 281 spec.clearPassword(); 282 return new SecretKeySpec(derived.getEncoded(), AES); 283 } 284 285 /** 286 * Gets the AES key from the keystore. 287 */ 288 protected Key getSecretKey() throws GeneralSecurityException, IOException { 289 KeyStore keyStore = KeyStore.getInstance(keyStoreType); 290 char[] kspw = keyStorePassword == null ? null : keyStorePassword.toCharArray(); 291 if (keyStoreFile != null) { 292 try (InputStream in = new BufferedInputStream(new FileInputStream(keyStoreFile))) { 293 keyStore.load(in, kspw); 294 } 295 } else { 296 // some keystores are not backed by a file 297 keyStore.load(null, kspw); 298 } 299 clearPassword(kspw); 300 char[] kpw = keyPassword == null ? null : keyPassword.toCharArray(); 301 Key key = keyStore.getKey(keyAlias, kpw); 302 clearPassword(kpw); 303 return key; 304 } 305 306 @Override 307 protected Binary getBinary(InputStream in) throws IOException { 308 // write to a tmp file that will be used by the returned Binary 309 // TODO if stream source, avoid copy (no-copy optimization) 310 File tmp = File.createTempFile("bin_", ".tmp", tmpDir); 311 Framework.trackFile(tmp, tmp); 312 OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 313 IOUtils.copy(in, out); 314 in.close(); 315 out.close(); 316 // encrypt an digest into final file 317 InputStream nin = new BufferedInputStream(new FileInputStream(tmp)); 318 String digest = storeAndDigest(nin); // calls our storeAndDigest 319 // return a binary on our tmp file 320 return new Binary(tmp, digest, blobProviderId); 321 } 322 323 @Override 324 public Binary getBinary(String digest) { 325 File file = getFileForDigest(digest, false); 326 if (file == null) { 327 log.warn("Invalid digest format: " + digest); 328 return null; 329 } 330 if (!file.exists()) { 331 return null; 332 } 333 File tmp; 334 try { 335 tmp = File.createTempFile("bin_", ".tmp", tmpDir); 336 Framework.trackFile(tmp, tmp); 337 OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 338 InputStream in = new BufferedInputStream(new FileInputStream(file)); 339 try { 340 decrypt(in, out); 341 } finally { 342 in.close(); 343 out.close(); 344 } 345 } catch (IOException e) { 346 throw new RuntimeException(e); 347 } 348 // return a binary on our tmp file 349 return new Binary(tmp, digest, blobProviderId); 350 } 351 352 @Override 353 protected String storeAndDigest(InputStream in) throws IOException { 354 File tmp = File.createTempFile("create_", ".tmp", tmpDir); 355 OutputStream out = new BufferedOutputStream(new FileOutputStream(tmp)); 356 /* 357 * First, write the input stream to a temporary file, while computing a digest. 358 */ 359 try { 360 String digest; 361 try { 362 digest = storeAndDigest(in, out); 363 } finally { 364 in.close(); 365 out.close(); 366 } 367 /* 368 * Move the tmp file to its destination. 369 */ 370 File file = getFileForDigest(digest, true); 371 atomicMove(tmp, file); 372 return digest; 373 } finally { 374 tmp.delete(); 375 } 376 } 377 378 /** 379 * Encrypts the given input stream into the given output stream, while also computing the digest of the input 380 * stream. 381 * <p> 382 * File format version 1 (values are in network order): 383 * <ul> 384 * <li>10 bytes: magic number "NUXEOCRYPT" 385 * <li>1 byte: file format version = 1 386 * <li>1 byte: use keystore = 1, use PBKDF2 = 2 387 * <li>if use PBKDF2: 388 * <ul> 389 * <li>4 bytes: salt length = n 390 * <li>n bytes: salt data 391 * </ul> 392 * <li>4 bytes: IV length = p 393 * <li>p bytes: IV data 394 * <li>x bytes: encrypted stream 395 * </ul> 396 * 397 * @param in the input stream containing the data 398 * @param file the file containing the encrypted data 399 * @return the digest of the input stream 400 */ 401 @Override 402 public String storeAndDigest(InputStream in, OutputStream out) throws IOException { 403 out.write(FILE_MAGIC); 404 DataOutputStream data = new DataOutputStream(out); 405 data.writeByte(FILE_VERSION_1); 406 407 try { 408 // get digest to use 409 MessageDigest messageDigest = MessageDigest.getInstance(digestAlgorithm); 410 411 // secret key 412 Key secret; 413 if (usePBKDF2) { 414 data.writeByte(USE_PBKDF2); 415 // generate a salt 416 byte[] salt = new byte[16]; 417 RANDOM.nextBytes(salt); 418 // generate secret key 419 secret = generateSecretKey(salt); 420 // write salt 421 data.writeInt(salt.length); 422 data.write(salt); 423 } else { 424 data.writeByte(USE_KEYSTORE); 425 // find secret key from keystore 426 secret = getSecretKey(); 427 } 428 429 // cipher 430 Cipher cipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING); 431 cipher.init(Cipher.ENCRYPT_MODE, secret); 432 433 // write IV 434 byte[] iv = cipher.getIV(); 435 data.writeInt(iv.length); 436 data.write(iv); 437 438 // digest and write the encrypted data 439 CipherAndDigestOutputStream cipherOut = new CipherAndDigestOutputStream(out, cipher, messageDigest); 440 IOUtils.copy(in, cipherOut); 441 cipherOut.close(); 442 byte[] digest = cipherOut.getDigest(); 443 return toHexString(digest); 444 } catch (GeneralSecurityException e) { 445 throw new NuxeoException(e); 446 } 447 448 } 449 450 /** 451 * Decrypts the given input stream into the given output stream. 452 */ 453 protected void decrypt(InputStream in, OutputStream out) throws IOException { 454 byte[] magic = new byte[FILE_MAGIC.length]; 455 IOUtils.read(in, magic); 456 if (!Arrays.equals(magic, FILE_MAGIC)) { 457 throw new IOException("Invalid file (bad magic)"); 458 } 459 DataInputStream data = new DataInputStream(in); 460 byte magicvers = data.readByte(); 461 if (magicvers != FILE_VERSION_1) { 462 throw new IOException("Invalid file (bad version)"); 463 } 464 465 byte usepb = data.readByte(); 466 if (usepb == USE_PBKDF2) { 467 if (!usePBKDF2) { 468 throw new NuxeoException("File requires PBKDF2 password"); 469 } 470 } else if (usepb == USE_KEYSTORE) { 471 if (usePBKDF2) { 472 throw new NuxeoException("File requires keystore"); 473 } 474 } else { 475 throw new IOException("Invalid file (bad use)"); 476 } 477 478 try { 479 // secret key 480 Key secret; 481 if (usePBKDF2) { 482 // read salt first 483 int saltLen = data.readInt(); 484 if (saltLen <= 0 || saltLen > MAX_SALT_LEN) { 485 throw new NuxeoException("Invalid salt length: " + saltLen); 486 } 487 byte[] salt = new byte[saltLen]; 488 data.read(salt, 0, saltLen); 489 secret = generateSecretKey(salt); 490 } else { 491 secret = getSecretKey(); 492 } 493 494 // read IV 495 int ivLen = data.readInt(); 496 if (ivLen <= 0 || ivLen > MAX_IV_LEN) { 497 throw new NuxeoException("Invalid IV length: " + ivLen); 498 } 499 byte[] iv = new byte[ivLen]; 500 data.read(iv, 0, ivLen); 501 502 // cipher 503 Cipher cipher; 504 cipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING); 505 cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(iv)); 506 507 // read the encrypted data 508 try (InputStream cipherIn = new CipherInputStream(in, cipher)) { 509 IOUtils.copy(cipherIn, out); 510 } catch (IOException e) { 511 Throwable cause = e.getCause(); 512 if (cause != null && cause instanceof BadPaddingException) { 513 throw new NuxeoException(cause.getMessage(), e); 514 } 515 } 516 } catch (GeneralSecurityException e) { 517 throw new NuxeoException(e); 518 } 519 } 520 521 /** 522 * A {@link javax.crypto.CipherOutputStream CipherOutputStream} that also does a digest of the original stream at 523 * the same time. 524 */ 525 public static class CipherAndDigestOutputStream extends FilterOutputStream { 526 527 protected Cipher cipher; 528 529 protected OutputStream out; 530 531 protected MessageDigest messageDigest; 532 533 protected byte[] digest; 534 535 public CipherAndDigestOutputStream(OutputStream out, Cipher cipher, MessageDigest messageDigest) { 536 super(out); 537 this.out = out; 538 this.cipher = cipher; 539 this.messageDigest = messageDigest; 540 } 541 542 public byte[] getDigest() { 543 return digest; 544 } 545 546 @Override 547 public void write(int b) throws IOException { 548 write(new byte[] { (byte) b }, 0, 1); 549 } 550 551 @Override 552 public void write(byte b[], int off, int len) throws IOException { 553 messageDigest.update(b, off, len); 554 byte[] bytes = cipher.update(b, off, len); 555 if (bytes != null) { 556 out.write(bytes); 557 bytes = null; // help GC 558 } 559 } 560 561 @Override 562 public void flush() throws IOException { 563 out.flush(); 564 } 565 566 @Override 567 public void close() throws IOException { 568 digest = messageDigest.digest(); 569 try { 570 byte[] bytes = cipher.doFinal(); 571 out.write(bytes); 572 bytes = null; // help GC 573 } catch (GeneralSecurityException e) { 574 throw new NuxeoException(e); 575 } 576 try { 577 flush(); 578 } finally { 579 out.close(); 580 } 581 } 582 } 583 584}