mirrors/cryptomator
1
0
Fork 0
mirror of https://github.com/cryptomator/cryptomator.git synced 2026-05-23 21:21:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

- always check HMAC before decryption

Browse Source 
- separating AES and CMAC key during SIV mode
This commit is contained in:
Sebastian Stenzel
2015-02-20 19:47:45 +01:00
parent 5569ecbfc7
commit b68cf71494
16 changed files with 107 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
main/core/src/main/java/org/cryptomator/webdav/WebDavServer.java
View File

@@ -86,7 +86,7 @@ public final class WebDavServer {
* _ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
* @return servlet
*/
public ServletLifeCycleAdapter createServlet(final Path workDir, final boolean checkFileIntegrity, final Cryptor cryptor, String name) {
public ServletLifeCycleAdapter createServlet(final Path workDir, final Cryptor cryptor, String name) {
try {
if (StringUtils.isEmpty(name)) {
throw new IllegalArgumentException("name empty");
@@ -97,7 +97,7 @@ public final class WebDavServer {
final URI uri = new URI(null, null, localConnector.getHost(), localConnector.getLocalPort(), "/" + UUID.randomUUID().toString() + "/" + name, null, null);
final ServletContextHandler servletContext = new ServletContextHandler(servletCollection, uri.getRawPath(), ServletContextHandler.SESSIONS);
final ServletHolder servlet = getWebDavServletHolder(workDir.toString(), checkFileIntegrity, cryptor);
final ServletHolder servlet = getWebDavServletHolder(workDir.toString(), cryptor);
servletContext.addServlet(servlet, "/*");
servletCollection.mapContexts();
@@ -109,10 +109,9 @@ public final class WebDavServer {
}
}
private ServletHolder getWebDavServletHolder(final String workDir, final boolean checkFileIntegrity, final Cryptor cryptor) {
private ServletHolder getWebDavServletHolder(final String workDir, final Cryptor cryptor) {
final ServletHolder result = new ServletHolder("Cryptomator-WebDAV-Servlet", new WebDavServlet(cryptor));
result.setInitParameter(WebDavServlet.CFG_FS_ROOT, workDir);
result.setInitParameter(WebDavServlet.CFG_CHECK_FILE_INTEGRITY, Boolean.toString(checkFileIntegrity));
return result;
}

8
main/core/src/main/java/org/cryptomator/webdav/jackrabbit/DavResourceFactoryImpl.java
View File

@@ -34,11 +34,9 @@ class DavResourceFactoryImpl implements DavResourceFactory {
private final LockManager lockManager = new SimpleLockManager();
private final Cryptor cryptor;
private final boolean checkFileIntegrity;
DavResourceFactoryImpl(Cryptor cryptor, boolean checkFileIntegrity) {
DavResourceFactoryImpl(Cryptor cryptor) {
this.cryptor = cryptor;
this.checkFileIntegrity = checkFileIntegrity;
}
@Override
@@ -72,11 +70,11 @@ class DavResourceFactoryImpl implements DavResourceFactory {
}
private EncryptedFile createFilePart(DavResourceLocator locator, DavSession session, DavServletRequest request) {
return new EncryptedFilePart(this, locator, session, request, lockManager, cryptor, checkFileIntegrity);
return new EncryptedFilePart(this, locator, session, request, lockManager, cryptor);
}
private EncryptedFile createFile(DavResourceLocator locator, DavSession session) {
return new EncryptedFile(this, locator, session, lockManager, cryptor, checkFileIntegrity);
return new EncryptedFile(this, locator, session, lockManager, cryptor);
}
private EncryptedDir createDirectory(DavResourceLocator locator, DavSession session) {

4
main/core/src/main/java/org/cryptomator/webdav/jackrabbit/WebDavServlet.java
View File

@@ -23,7 +23,6 @@ public class WebDavServlet extends AbstractWebdavServlet {
private static final long serialVersionUID = 7965170007048673022L;
public static final String CFG_FS_ROOT = "cfg.fs.root";
public static final String CFG_CHECK_FILE_INTEGRITY = "cfg.checkFileIntegrity";
private DavSessionProvider davSessionProvider;
private DavLocatorFactory davLocatorFactory;
private DavResourceFactory davResourceFactory;
@@ -41,10 +40,9 @@ public class WebDavServlet extends AbstractWebdavServlet {
davSessionProvider = new DavSessionProviderImpl();
final String fsRoot = config.getInitParameter(CFG_FS_ROOT);
final boolean checkFileIntegrity = Boolean.parseBoolean(config.getInitParameter(CFG_CHECK_FILE_INTEGRITY));
this.davLocatorFactory = new DavLocatorFactoryImpl(fsRoot, cryptor);
this.davResourceFactory = new DavResourceFactoryImpl(cryptor, checkFileIntegrity);
this.davResourceFactory = new DavResourceFactoryImpl(cryptor);
}
@Override

8
main/core/src/main/java/org/cryptomator/webdav/jackrabbit/resources/EncryptedFile.java
View File

@@ -40,11 +40,8 @@ public class EncryptedFile extends AbstractEncryptedNode {
private static final Logger LOG = LoggerFactory.getLogger(EncryptedFile.class);
protected final boolean checkIntegrity;
public EncryptedFile(DavResourceFactory factory, DavResourceLocator locator, DavSession session, LockManager lockManager, Cryptor cryptor, boolean checkIntegrity) {
public EncryptedFile(DavResourceFactory factory, DavResourceLocator locator, DavSession session, LockManager lockManager, Cryptor cryptor) {
super(factory, locator, session, lockManager, cryptor);
this.checkIntegrity = checkIntegrity;
}
@Override
@@ -76,9 +73,6 @@ public class EncryptedFile extends AbstractEncryptedNode {
SeekableByteChannel channel = null;
try {
channel = Files.newByteChannel(path, StandardOpenOption.READ);
if (checkIntegrity && !cryptor.authenticateContent(channel)) {
throw new DecryptFailedException("File content compromised: " + path.toString());
}
outputContext.setContentLength(cryptor.decryptedContentLength(channel));
if (outputContext.hasStream()) {
cryptor.decryptedFile(channel, outputContext.getOutputStream());

7
main/core/src/main/java/org/cryptomator/webdav/jackrabbit/resources/EncryptedFilePart.java
View File

@@ -50,8 +50,8 @@ public class EncryptedFilePart extends EncryptedFile {
private final Set<Pair<Long, Long>> requestedContentRanges = new HashSet<Pair<Long, Long>>();
public EncryptedFilePart(DavResourceFactory factory, DavResourceLocator locator, DavSession session, DavServletRequest request, LockManager lockManager, Cryptor cryptor, boolean checkIntegrity) {
super(factory, locator, session, lockManager, cryptor, checkIntegrity);
public EncryptedFilePart(DavResourceFactory factory, DavResourceLocator locator, DavSession session, DavServletRequest request, LockManager lockManager, Cryptor cryptor) {
super(factory, locator, session, lockManager, cryptor);
final String rangeHeader = request.getHeader(HttpHeader.RANGE.asString());
if (rangeHeader == null) {
throw new IllegalArgumentException("HTTP request doesn't contain a range header");
@@ -116,9 +116,6 @@ public class EncryptedFilePart extends EncryptedFile {
SeekableByteChannel channel = null;
try {
channel = Files.newByteChannel(path, StandardOpenOption.READ);
if (checkIntegrity && !cryptor.authenticateContent(channel)) {
throw new DecryptFailedException("File content compromised: " + path.toString());
}
final Long fileSize = cryptor.decryptedContentLength(channel);
final Pair<Long, Long> range = getUnionRange(fileSize);
final Long rangeLength = range.getRight() - range.getLeft() + 1;