From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
plugins/enigma/lib/enigma_driver_gnupg.php | 289 +++++++++++++++++++++++++++++++++++++++++++--------------
1 files changed, 215 insertions(+), 74 deletions(-)
diff --git a/plugins/enigma/lib/enigma_driver_gnupg.php b/plugins/enigma/lib/enigma_driver_gnupg.php
index c4280a0..5ddf724 100644
--- a/plugins/enigma/lib/enigma_driver_gnupg.php
+++ b/plugins/enigma/lib/enigma_driver_gnupg.php
@@ -1,20 +1,14 @@
<?php
-/*
+
+/**
+-------------------------------------------------------------------------+
| GnuPG (PGP) driver for the Enigma Plugin |
| |
- | This program is free software; you can redistribute it and/or modify |
- | it under the terms of the GNU General Public License version 2 |
- | as published by the Free Software Foundation. |
+ | Copyright (C) 2010-2015 The Roundcube Dev Team |
| |
- | This program is distributed in the hope that it will be useful, |
- | but WITHOUT ANY WARRANTY; without even the implied warranty of |
- | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
- | GNU General Public License for more details. |
- | |
- | You should have received a copy of the GNU General Public License along |
- | with this program; if not, write to the Free Software Foundation, Inc., |
- | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
+ | Licensed under the GNU General Public License version 3 or |
+ | any later version with exceptions for skins & plugins. |
+ | See the README file for a full license statement. |
| |
+-------------------------------------------------------------------------+
| Author: Aleksander Machniak <alec@alec.pl> |
@@ -25,15 +19,15 @@
class enigma_driver_gnupg extends enigma_driver
{
- private $rc;
- private $gpg;
- private $homedir;
- private $user;
+ protected $rc;
+ protected $gpg;
+ protected $homedir;
+ protected $user;
+
function __construct($user)
{
- $rcmail = rcmail::get_instance();
- $this->rc = $rcmail;
+ $this->rc = rcmail::get_instance();
$this->user = $user;
}
@@ -45,18 +39,18 @@
*/
function init()
{
- $homedir = $this->rc->config->get('enigma_pgp_homedir', INSTALL_PATH . '/plugins/enigma/home');
+ $homedir = $this->rc->config->get('enigma_pgp_homedir', INSTALL_PATH . 'plugins/enigma/home');
if (!$homedir)
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Option 'enigma_pgp_homedir' not specified");
// check if homedir exists (create it if not) and is readable
if (!file_exists($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Keys directory doesn't exists: $homedir");
if (!is_writable($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Keys directory isn't writeable: $homedir");
$homedir = $homedir . '/' . $this->user;
@@ -66,10 +60,10 @@
mkdir($homedir, 0700);
if (!file_exists($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Unable to create keys directory: $homedir");
if (!is_writable($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Unable to write to keys directory: $homedir");
$this->homedir = $homedir;
@@ -78,7 +72,8 @@
try {
$this->gpg = new Crypt_GPG(array(
'homedir' => $this->homedir,
-// 'debug' => true,
+ // 'binary' => '/usr/bin/gpg2',
+ // 'debug' => true,
));
}
catch (Exception $e) {
@@ -86,38 +81,79 @@
}
}
+ /**
+ * Encryption.
+ *
+ * @param string Message body
+ * @param array List of key-password mapping
+ *
+ * @return mixed Encrypted message or enigma_error on failure
+ */
function encrypt($text, $keys)
{
-/*
- foreach ($keys as $key) {
- $this->gpg->addEncryptKey($key);
- }
- $enc = $this->gpg->encrypt($text);
- return $enc;
-*/
- }
-
- function decrypt($text, $key, $passwd)
- {
-// $this->gpg->addDecryptKey($key, $passwd);
try {
- $dec = $this->gpg->decrypt($text);
- return $dec;
+ foreach ($keys as $key) {
+ $this->gpg->addEncryptKey($key);
+ }
+
+ return $this->gpg->encrypt($text, true);
}
catch (Exception $e) {
return $this->get_error_from_exception($e);
}
}
- function sign($text, $key, $passwd)
+ /**
+ * Decrypt a message
+ *
+ * @param string Encrypted message
+ * @param array List of key-password mapping
+ *
+ * @return mixed Decrypted message or enigma_error on failure
+ */
+ function decrypt($text, $keys = array())
{
-/*
- $this->gpg->addSignKey($key, $passwd);
- $signed = $this->gpg->sign($text, Crypt_GPG::SIGN_MODE_DETACHED);
- return $signed;
-*/
+ try {
+ foreach ($keys as $key => $password) {
+ $this->gpg->addDecryptKey($key, $password);
+ }
+
+ return $this->gpg->decrypt($text);
+ }
+ catch (Exception $e) {
+ return $this->get_error_from_exception($e);
+ }
}
+ /**
+ * Signing.
+ *
+ * @param string Message body
+ * @param string Key ID
+ * @param string Key password
+ * @param int Signing mode (enigma_engine::SIGN_*)
+ *
+ * @return mixed True on success or enigma_error on failure
+ */
+ function sign($text, $key, $passwd, $mode = null)
+ {
+ try {
+ $this->gpg->addSignKey($key, $passwd);
+ return $this->gpg->sign($text, $mode, CRYPT_GPG::ARMOR_ASCII, true);
+ }
+ catch (Exception $e) {
+ return $this->get_error_from_exception($e);
+ }
+ }
+
+ /**
+ * Signature verification.
+ *
+ * @param string Message body
+ * @param string Signature, if message is of type PGP/MIME and body doesn't contain it
+ *
+ * @return mixed Signature information (enigma_signature) or enigma_error
+ */
function verify($text, $signature)
{
try {
@@ -129,6 +165,14 @@
}
}
+ /**
+ * Key file import.
+ *
+ * @param string File name or file content
+ * @param bollean True if first argument is a filename
+ *
+ * @return mixed Import status array or enigma_error
+ */
public function import($content, $isfile=false)
{
try {
@@ -142,17 +186,41 @@
}
}
+ /**
+ * Key export.
+ *
+ * @param string Key ID
+ *
+ * @return mixed Key content or enigma_error
+ */
+ public function export($keyid)
+ {
+ try {
+ return $this->gpg->exportPublicKey($keyid, true);
+ }
+ catch (Exception $e) {
+ return $this->get_error_from_exception($e);
+ }
+ }
+
+ /**
+ * Keys listing.
+ *
+ * @param string Optional pattern for key ID, user ID or fingerprint
+ *
+ * @return mixed Array of enigma_key objects or enigma_error
+ */
public function list_keys($pattern='')
{
try {
$keys = $this->gpg->getKeys($pattern);
$result = array();
-//print_r($keys);
+
foreach ($keys as $idx => $key) {
$result[] = $this->parse_key($key);
unset($keys[$idx]);
}
-//print_r($result);
+
return $result;
}
catch (Exception $e) {
@@ -160,27 +228,93 @@
}
}
+ /**
+ * Single key information.
+ *
+ * @param string Key ID, user ID or fingerprint
+ *
+ * @return mixed Key (enigma_key) object or enigma_error
+ */
public function get_key($keyid)
{
$list = $this->list_keys($keyid);
- if (is_array($list))
- return array_shift($list);
+ if (is_array($list)) {
+ return $list[key($list)];
+ }
// error
return $list;
}
+ /**
+ * Key pair generation.
+ *
+ * @param array Key/User data (user, email, password, size)
+ *
+ * @return mixed Key (enigma_key) object or enigma_error
+ */
public function gen_key($data)
{
+ try {
+ $keygen = new Crypt_GPG_KeyGenerator(array(
+ 'homedir' => $this->homedir,
+ // 'binary' => '/usr/bin/gpg2',
+ // 'debug' => true,
+ ));
+
+ $key = $keygen
+ ->setExpirationDate(0)
+ ->setPassphrase($data['password'])
+ ->generateKey($data['user'], $data['email']);
+
+ return $this->parse_key($key);
+ }
+ catch (Exception $e) {
+ return $this->get_error_from_exception($e);
+ }
}
- public function del_key($keyid)
+ /**
+ * Key deletion.
+ *
+ * @param string Key ID
+ *
+ * @return mixed True on success or enigma_error
+ */
+ public function delete_key($keyid)
{
-// $this->get_key($keyid);
+ // delete public key
+ $result = $this->delete_pubkey($keyid);
+
+ // error handling
+ if ($result !== true) {
+ $code = $result->getCode();
+
+ // if not found, delete private key
+ if ($code == enigma_error::KEYNOTFOUND) {
+ $result = $this->delete_privkey($keyid);
+ }
+ // need to delete private key first
+ else if ($code == enigma_error::DELKEY) {
+ $key = $this->get_key($keyid);
+ for ($i = count($key->subkeys) - 1; $i >= 0; $i--) {
+ $type = ($key->subkeys[$i]->usage & enigma_key::CAN_ENCRYPT) ? 'priv' : 'pub';
+ $result = $this->{'delete_' . $type . 'key'}($key->subkeys[$i]->id);
+ if ($result !== true) {
+ return $result;
+ }
+ }
+ }
+ }
+
+ return $result;
}
- public function del_privkey($keyid)
+ /**
+ * Private key deletion.
+ */
+ protected function delete_privkey($keyid)
{
try {
$this->gpg->deletePrivateKey($keyid);
@@ -191,7 +325,10 @@
}
}
- public function del_pubkey($keyid)
+ /**
+ * Public key deletion.
+ */
+ protected function delete_pubkey($keyid)
{
try {
$this->gpg->deletePublicKey($keyid);
@@ -209,25 +346,28 @@
*
* @return enigma_error Error object
*/
- private function get_error_from_exception($e)
+ protected function get_error_from_exception($e)
{
$data = array();
if ($e instanceof Crypt_GPG_KeyNotFoundException) {
- $error = enigma_error::E_KEYNOTFOUND;
+ $error = enigma_error::KEYNOTFOUND;
$data['id'] = $e->getKeyId();
}
else if ($e instanceof Crypt_GPG_BadPassphraseException) {
- $error = enigma_error::E_BADPASS;
+ $error = enigma_error::BADPASS;
$data['bad'] = $e->getBadPassphrases();
$data['missing'] = $e->getMissingPassphrases();
}
- else if ($e instanceof Crypt_GPG_NoDataException)
- $error = enigma_error::E_NODATA;
- else if ($e instanceof Crypt_GPG_DeletePrivateKeyException)
- $error = enigma_error::E_DELKEY;
- else
- $error = enigma_error::E_INTERNAL;
+ else if ($e instanceof Crypt_GPG_NoDataException) {
+ $error = enigma_error::NODATA;
+ }
+ else if ($e instanceof Crypt_GPG_DeletePrivateKeyException) {
+ $error = enigma_error::DELKEY;
+ }
+ else {
+ $error = enigma_error::INTERNAL;
+ }
$msg = $e->getMessage();
@@ -241,7 +381,7 @@
*
* @return enigma_signature Signature object
*/
- private function parse_signature($sig)
+ protected function parse_signature($sig)
{
$user = $sig->getUserId();
@@ -265,7 +405,7 @@
*
* @return enigma_key Key object
*/
- private function parse_key($key)
+ protected function parse_key($key)
{
$ekey = new enigma_key();
@@ -283,17 +423,18 @@
$ekey->name = trim($ekey->users[0]->name . ' <' . $ekey->users[0]->email . '>');
foreach ($key->getSubKeys() as $idx => $subkey) {
- $skey = new enigma_subkey();
- $skey->id = $subkey->getId();
- $skey->revoked = $subkey->isRevoked();
- $skey->created = $subkey->getCreationDate();
- $skey->expires = $subkey->getExpirationDate();
- $skey->fingerprint = $subkey->getFingerprint();
- $skey->has_private = $subkey->hasPrivate();
- $skey->can_sign = $subkey->canSign();
- $skey->can_encrypt = $subkey->canEncrypt();
+ $skey = new enigma_subkey();
+ $skey->id = $subkey->getId();
+ $skey->revoked = $subkey->isRevoked();
+ $skey->created = $subkey->getCreationDate();
+ $skey->expires = $subkey->getExpirationDate();
+ $skey->fingerprint = $subkey->getFingerprint();
+ $skey->has_private = $subkey->hasPrivate();
+ $skey->algorithm = $subkey->getAlgorithm();
+ $skey->length = $subkey->getLength();
+ $skey->usage = $subkey->usage();
- $ekey->subkeys[$idx] = $skey;
+ $ekey->subkeys[$idx] = $skey;
};
$ekey->id = $ekey->subkeys[0]->id;
--
Gitblit v1.9.1