migrate therinaldos.com data

wedding-pics/lib/private/Security/IdentityProof/Key.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Security\IdentityProof;
+
+class Key {
+	public function __construct(
+		private string $publicKey,
+		private string $privateKey,
+	) {
+	}
+
+	public function getPrivate(): string {
+		return $this->privateKey;
+	}
+
+	public function getPublic(): string {
+		return $this->publicKey;
+	}
+}

wedding-pics/lib/private/Security/IdentityProof/Manager.php

@@ -0,0 +1,156 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Security\IdentityProof;
+
+use OC\Files\AppData\Factory;
+use OCP\Files\IAppData;
+use OCP\IConfig;
+use OCP\IUser;
+use OCP\Security\ICrypto;
+use Psr\Log\LoggerInterface;
+
+class Manager {
+	private IAppData $appData;
+
+	public function __construct(
+		Factory $appDataFactory,
+		private ICrypto $crypto,
+		private IConfig $config,
+		private LoggerInterface $logger,
+	) {
+		$this->appData = $appDataFactory->get('identityproof');
+	}
+
+	/**
+	 * Calls the openssl functions to generate a public and private key.
+	 * In a separate function for unit testing purposes.
+	 *
+	 * @return array [$publicKey, $privateKey]
+	 * @throws \RuntimeException
+	 */
+	protected function generateKeyPair(): array {
+		$config = [
+			'digest_alg' => 'sha512',
+			'private_key_bits' => 2048,
+		];
+
+		// Generate new key
+		$res = openssl_pkey_new($config);
+
+		if ($res === false) {
+			$this->logOpensslError();
+			throw new \RuntimeException('OpenSSL reported a problem');
+		}
+
+		if (openssl_pkey_export($res, $privateKey, null, $config) === false) {
+			$this->logOpensslError();
+			throw new \RuntimeException('OpenSSL reported a problem');
+		}
+
+		// Extract the public key from $res to $pubKey
+		$publicKey = openssl_pkey_get_details($res);
+		$publicKey = $publicKey['key'];
+
+		return [$publicKey, $privateKey];
+	}
+
+	/**
+	 * Generate a key for a given ID
+	 * Note: If a key already exists it will be overwritten
+	 *
+	 * @param string $id key id
+	 * @throws \RuntimeException
+	 */
+	protected function generateKey(string $id): Key {
+		[$publicKey, $privateKey] = $this->generateKeyPair();
+
+		// Write the private and public key to the disk
+		try {
+			$this->appData->newFolder($id);
+		} catch (\Exception $e) {
+		}
+		$folder = $this->appData->getFolder($id);
+		$folder->newFile('private')
+			->putContent($this->crypto->encrypt($privateKey));
+		$folder->newFile('public')
+			->putContent($publicKey);
+
+		return new Key($publicKey, $privateKey);
+	}
+
+	/**
+	 * Get key for a specific id
+	 *
+	 * @throws \RuntimeException
+	 */
+	protected function retrieveKey(string $id): Key {
+		try {
+			$folder = $this->appData->getFolder($id);
+			$privateKey = $this->crypto->decrypt(
+				$folder->getFile('private')->getContent()
+			);
+			$publicKey = $folder->getFile('public')->getContent();
+			return new Key($publicKey, $privateKey);
+		} catch (\Exception $e) {
+			return $this->generateKey($id);
+		}
+	}
+
+	/**
+	 * Get public and private key for $user
+	 *
+	 * @throws \RuntimeException
+	 */
+	public function getKey(IUser $user): Key {
+		$uid = $user->getUID();
+		return $this->retrieveKey('user-' . $uid);
+	}
+
+	/**
+	 * Get instance wide public and private key
+	 *
+	 * @throws \RuntimeException
+	 */
+	public function getSystemKey(): Key {
+		$instanceId = $this->config->getSystemValue('instanceid', null);
+		if ($instanceId === null) {
+			throw new \RuntimeException('no instance id!');
+		}
+		return $this->retrieveKey('system-' . $instanceId);
+	}
+
+	private function logOpensslError(): void {
+		$errors = [];
+		while ($error = openssl_error_string()) {
+			$errors[] = $error;
+		}
+		$this->logger->critical('Something is wrong with your openssl setup: ' . implode(', ', $errors));
+	}
+}

wedding-pics/lib/private/Security/IdentityProof/Signer.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Security\IdentityProof;
+
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\IUser;
+use OCP\IUserManager;
+
+class Signer {
+	public function __construct(
+		private Manager $keyManager,
+		private ITimeFactory $timeFactory,
+		private IUserManager $userManager,
+	) {
+	}
+
+	/**
+	 * Returns a signed blob for $data
+	 *
+	 * @return array ['message', 'signature']
+	 */
+	public function sign(string $type, array $data, IUser $user): array {
+		$privateKey = $this->keyManager->getKey($user)->getPrivate();
+		$data = [
+			'data' => $data,
+			'type' => $type,
+			'signer' => $user->getCloudId(),
+			'timestamp' => $this->timeFactory->getTime(),
+		];
+		openssl_sign(json_encode($data), $signature, $privateKey, OPENSSL_ALGO_SHA512);
+
+		return [
+			'message' => $data,
+			'signature' => base64_encode($signature),
+		];
+	}
+
+	/**
+	 * Whether the data is signed properly
+	 *
+	 */
+	public function verify(array $data): bool {
+		if (isset($data['message']['signer'])
+			&& isset($data['signature'])
+		) {
+			$location = strrpos($data['message']['signer'], '@');
+			$userId = substr($data['message']['signer'], 0, $location);
+
+			$user = $this->userManager->get($userId);
+			if ($user !== null) {
+				$key = $this->keyManager->getKey($user);
+				return (bool)openssl_verify(
+					json_encode($data['message']),
+					base64_decode($data['signature']),
+					$key->getPublic(),
+					OPENSSL_ALGO_SHA512
+				);
+			}
+		}
+
+		return false;
+	}
+}