From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
plugins/enigma/lib/enigma_driver_gnupg.php | 205 ++++++++++++++++++++++++++++++++++++++++-----------
1 files changed, 161 insertions(+), 44 deletions(-)
diff --git a/plugins/enigma/lib/enigma_driver_gnupg.php b/plugins/enigma/lib/enigma_driver_gnupg.php
index d0b854c..5ddf724 100644
--- a/plugins/enigma/lib/enigma_driver_gnupg.php
+++ b/plugins/enigma/lib/enigma_driver_gnupg.php
@@ -19,10 +19,10 @@
class enigma_driver_gnupg extends enigma_driver
{
- private $rc;
- private $gpg;
- private $homedir;
- private $user;
+ protected $rc;
+ protected $gpg;
+ protected $homedir;
+ protected $user;
function __construct($user)
@@ -42,15 +42,15 @@
$homedir = $this->rc->config->get('enigma_pgp_homedir', INSTALL_PATH . 'plugins/enigma/home');
if (!$homedir)
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Option 'enigma_pgp_homedir' not specified");
// check if homedir exists (create it if not) and is readable
if (!file_exists($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Keys directory doesn't exists: $homedir");
if (!is_writable($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Keys directory isn't writeable: $homedir");
$homedir = $homedir . '/' . $this->user;
@@ -60,10 +60,10 @@
mkdir($homedir, 0700);
if (!file_exists($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Unable to create keys directory: $homedir");
if (!is_writable($homedir))
- return new enigma_error(enigma_error::E_INTERNAL,
+ return new enigma_error(enigma_error::INTERNAL,
"Unable to write to keys directory: $homedir");
$this->homedir = $homedir;
@@ -82,10 +82,12 @@
}
/**
- * Encrypt a message
+ * Encryption.
*
- * @param string The message
- * @param array List of keys
+ * @param string Message body
+ * @param array List of key-password mapping
+ *
+ * @return mixed Encrypted message or enigma_error on failure
*/
function encrypt($text, $keys)
{
@@ -94,8 +96,7 @@
$this->gpg->addEncryptKey($key);
}
- $dec = $this->gpg->encrypt($text, true);
- return $dec;
+ return $this->gpg->encrypt($text, true);
}
catch (Exception $e) {
return $this->get_error_from_exception($e);
@@ -107,6 +108,8 @@
*
* @param string Encrypted message
* @param array List of key-password mapping
+ *
+ * @return mixed Decrypted message or enigma_error on failure
*/
function decrypt($text, $keys = array())
{
@@ -115,14 +118,23 @@
$this->gpg->addDecryptKey($key, $password);
}
- $dec = $this->gpg->decrypt($text);
- return $dec;
+ return $this->gpg->decrypt($text);
}
catch (Exception $e) {
return $this->get_error_from_exception($e);
}
}
+ /**
+ * Signing.
+ *
+ * @param string Message body
+ * @param string Key ID
+ * @param string Key password
+ * @param int Signing mode (enigma_engine::SIGN_*)
+ *
+ * @return mixed True on success or enigma_error on failure
+ */
function sign($text, $key, $passwd, $mode = null)
{
try {
@@ -134,6 +146,14 @@
}
}
+ /**
+ * Signature verification.
+ *
+ * @param string Message body
+ * @param string Signature, if message is of type PGP/MIME and body doesn't contain it
+ *
+ * @return mixed Signature information (enigma_signature) or enigma_error
+ */
function verify($text, $signature)
{
try {
@@ -145,6 +165,14 @@
}
}
+ /**
+ * Key file import.
+ *
+ * @param string File name or file content
+ * @param bollean True if first argument is a filename
+ *
+ * @return mixed Import status array or enigma_error
+ */
public function import($content, $isfile=false)
{
try {
@@ -158,6 +186,30 @@
}
}
+ /**
+ * Key export.
+ *
+ * @param string Key ID
+ *
+ * @return mixed Key content or enigma_error
+ */
+ public function export($keyid)
+ {
+ try {
+ return $this->gpg->exportPublicKey($keyid, true);
+ }
+ catch (Exception $e) {
+ return $this->get_error_from_exception($e);
+ }
+ }
+
+ /**
+ * Keys listing.
+ *
+ * @param string Optional pattern for key ID, user ID or fingerprint
+ *
+ * @return mixed Array of enigma_key objects or enigma_error
+ */
public function list_keys($pattern='')
{
try {
@@ -176,35 +228,93 @@
}
}
+ /**
+ * Single key information.
+ *
+ * @param string Key ID, user ID or fingerprint
+ *
+ * @return mixed Key (enigma_key) object or enigma_error
+ */
public function get_key($keyid)
{
$list = $this->list_keys($keyid);
- if (is_array($list))
- return array_shift($list);
+ if (is_array($list)) {
+ return $list[key($list)];
+ }
// error
return $list;
}
+ /**
+ * Key pair generation.
+ *
+ * @param array Key/User data (user, email, password, size)
+ *
+ * @return mixed Key (enigma_key) object or enigma_error
+ */
public function gen_key($data)
{
+ try {
+ $keygen = new Crypt_GPG_KeyGenerator(array(
+ 'homedir' => $this->homedir,
+ // 'binary' => '/usr/bin/gpg2',
+ // 'debug' => true,
+ ));
+
+ $key = $keygen
+ ->setExpirationDate(0)
+ ->setPassphrase($data['password'])
+ ->generateKey($data['user'], $data['email']);
+
+ return $this->parse_key($key);
+ }
+ catch (Exception $e) {
+ return $this->get_error_from_exception($e);
+ }
}
+ /**
+ * Key deletion.
+ *
+ * @param string Key ID
+ *
+ * @return mixed True on success or enigma_error
+ */
public function delete_key($keyid)
{
// delete public key
$result = $this->delete_pubkey($keyid);
- // if not found, delete private key
- if ($result !== true && $result->getCode() == enigma_error::E_KEYNOTFOUND) {
- $result = $this->delete_privkey($keyid);
+ // error handling
+ if ($result !== true) {
+ $code = $result->getCode();
+
+ // if not found, delete private key
+ if ($code == enigma_error::KEYNOTFOUND) {
+ $result = $this->delete_privkey($keyid);
+ }
+ // need to delete private key first
+ else if ($code == enigma_error::DELKEY) {
+ $key = $this->get_key($keyid);
+ for ($i = count($key->subkeys) - 1; $i >= 0; $i--) {
+ $type = ($key->subkeys[$i]->usage & enigma_key::CAN_ENCRYPT) ? 'priv' : 'pub';
+ $result = $this->{'delete_' . $type . 'key'}($key->subkeys[$i]->id);
+ if ($result !== true) {
+ return $result;
+ }
+ }
+ }
}
return $result;
}
- public function delete_privkey($keyid)
+ /**
+ * Private key deletion.
+ */
+ protected function delete_privkey($keyid)
{
try {
$this->gpg->deletePrivateKey($keyid);
@@ -215,7 +325,10 @@
}
}
- public function delete_pubkey($keyid)
+ /**
+ * Public key deletion.
+ */
+ protected function delete_pubkey($keyid)
{
try {
$this->gpg->deletePublicKey($keyid);
@@ -233,25 +346,28 @@
*
* @return enigma_error Error object
*/
- private function get_error_from_exception($e)
+ protected function get_error_from_exception($e)
{
$data = array();
if ($e instanceof Crypt_GPG_KeyNotFoundException) {
- $error = enigma_error::E_KEYNOTFOUND;
+ $error = enigma_error::KEYNOTFOUND;
$data['id'] = $e->getKeyId();
}
else if ($e instanceof Crypt_GPG_BadPassphraseException) {
- $error = enigma_error::E_BADPASS;
+ $error = enigma_error::BADPASS;
$data['bad'] = $e->getBadPassphrases();
$data['missing'] = $e->getMissingPassphrases();
}
- else if ($e instanceof Crypt_GPG_NoDataException)
- $error = enigma_error::E_NODATA;
- else if ($e instanceof Crypt_GPG_DeletePrivateKeyException)
- $error = enigma_error::E_DELKEY;
- else
- $error = enigma_error::E_INTERNAL;
+ else if ($e instanceof Crypt_GPG_NoDataException) {
+ $error = enigma_error::NODATA;
+ }
+ else if ($e instanceof Crypt_GPG_DeletePrivateKeyException) {
+ $error = enigma_error::DELKEY;
+ }
+ else {
+ $error = enigma_error::INTERNAL;
+ }
$msg = $e->getMessage();
@@ -265,7 +381,7 @@
*
* @return enigma_signature Signature object
*/
- private function parse_signature($sig)
+ protected function parse_signature($sig)
{
$user = $sig->getUserId();
@@ -289,7 +405,7 @@
*
* @return enigma_key Key object
*/
- private function parse_key($key)
+ protected function parse_key($key)
{
$ekey = new enigma_key();
@@ -307,17 +423,18 @@
$ekey->name = trim($ekey->users[0]->name . ' <' . $ekey->users[0]->email . '>');
foreach ($key->getSubKeys() as $idx => $subkey) {
- $skey = new enigma_subkey();
- $skey->id = $subkey->getId();
- $skey->revoked = $subkey->isRevoked();
- $skey->created = $subkey->getCreationDate();
- $skey->expires = $subkey->getExpirationDate();
- $skey->fingerprint = $subkey->getFingerprint();
- $skey->has_private = $subkey->hasPrivate();
- $skey->can_sign = $subkey->canSign();
- $skey->can_encrypt = $subkey->canEncrypt();
+ $skey = new enigma_subkey();
+ $skey->id = $subkey->getId();
+ $skey->revoked = $subkey->isRevoked();
+ $skey->created = $subkey->getCreationDate();
+ $skey->expires = $subkey->getExpirationDate();
+ $skey->fingerprint = $subkey->getFingerprint();
+ $skey->has_private = $subkey->hasPrivate();
+ $skey->algorithm = $subkey->getAlgorithm();
+ $skey->length = $subkey->getLength();
+ $skey->usage = $subkey->usage();
- $ekey->subkeys[$idx] = $skey;
+ $ekey->subkeys[$idx] = $skey;
};
$ekey->id = $ekey->subkeys[0]->id;
--
Gitblit v1.9.1