/**
* This file Copyright (c) 2003-2012 Magnolia International
* Ltd. (http://www.magnolia-cms.com). All rights reserved.
*
*
* This file is dual-licensed under both the Magnolia
* Network Agreement and the GNU General Public License.
* You may elect to use one or the other of these licenses.
*
* This file is distributed in the hope that it will be
* useful, but AS-IS and WITHOUT ANY WARRANTY; without even the
* implied warranty of MERCHANTABILITY or FITNESS FOR A
* PARTICULAR PURPOSE, TITLE, or NONINFRINGEMENT.
* Redistribution, except as permitted by whichever of the GPL
* or MNA you select, is prohibited.
*
* 1. For the GPL license (GPL), you can redistribute and/or
* modify this file under the terms of the GNU General
* Public License, Version 3, as published by the Free Software
* Foundation. You should have received a copy of the GNU
* General Public License, Version 3 along with this program;
* if not, write to the Free Software Foundation, Inc., 51
* Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* 2. For the Magnolia Network Agreement (MNA), this file
* and the accompanying materials are made available under the
* terms of the MNA which accompanies this distribution, and
* is available at http://www.magnolia-cms.com/mna.html
*
* Any modifications to this file must keep this entire header
* intact.
*
*/
package info.magnolia.cms.security;
import info.magnolia.cms.core.Path;
import info.magnolia.cms.core.SystemProperty;
import info.magnolia.cms.exchange.ActivationManager;
import info.magnolia.context.MgnlContext;
import info.magnolia.objectfactory.Components;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileWriter;
import java.io.IOException;
import java.security.InvalidKeyException;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Security;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.Properties;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.jcr.RepositoryException;
import javax.jcr.Session;
import org.apache.commons.lang.StringUtils;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.mindrot.jbcrypt.BCrypt;
/**
* Utility functions required in the context of Security.
*
* @version $Id$
*/
public class SecurityUtil {
private static final String PRIVATE_KEY = "key.private";
private static final String PUBLIC_KEY = "key.public";
private static final String KEY_LOCATION_PROPERTY = "magnolia.author.key.location";
public static final String SHA1 = "SHA-1"; //$NON-NLS-1$
public static final String MD5 = "MD5"; //$NON-NLS-1$
/**
* There are five (5) FIPS-approved* algorithms for generating a condensed representation of a message (message
* digest): SHA-1, SHA-224, SHA-256,SHA-384, and SHA-512. <strong>Not supported yet</strong>
*/
public static final String SHA256 = "SHA-256"; //$NON-NLS-1$
public static final String SHA384 = "SHA-384"; //$NON-NLS-1$
public static final String SHA512 = "SHA-512"; //$NON-NLS-1$
/**
* Encryption algorithm used ... if you are ever changing this, keep in mind underlying impl relies on padding!
*/
private static final String ALGORITHM = "RSA";
static {
Security.addProvider(new BouncyCastleProvider());
}
/**
* Checks if the currently acting user is anonymous.
*/
public static boolean isAnonymous() {
User user = MgnlContext.getUser();
return (user != null && UserManager.ANONYMOUS_USER.equals(user.getName()));
}
public static boolean isAuthenticated() {
User user = MgnlContext.getUser();
return (user != null && !UserManager.ANONYMOUS_USER.equals(user.getName()));
}
public static String decrypt(String pass) throws SecurityException {
return decrypt(pass, getPublicKey());
}
public static String decrypt(String message, String encodedKey) throws SecurityException {
try {
if (StringUtils.isBlank(encodedKey)) {
throw new SecurityException("Activation key was not found. Please make sure your instance is correctly configured.");
}
// decode key
byte[] binaryKey = hexToByteArray(encodedKey);
// create RSA public key cipher
Cipher pkCipher = Cipher.getInstance(ALGORITHM, "BC");
try {
// create private key
X509EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(binaryKey);
KeyFactory kf = KeyFactory.getInstance(ALGORITHM, "BC");
PublicKey pk = kf.generatePublic(publicKeySpec);
pkCipher.init(Cipher.DECRYPT_MODE, pk);
} catch (InvalidKeySpecException e) {
// decrypting with private key?
PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(binaryKey);
KeyFactory kf = KeyFactory.getInstance(ALGORITHM, "BC");
PrivateKey pk = kf.generatePrivate(privateKeySpec);
pkCipher.init(Cipher.DECRYPT_MODE, pk);
}
// decrypt
String[] chunks = StringUtils.split(message, ";");
if (chunks == null) {
throw new SecurityException("The encrypted information is corrupted or incomplete. Please make sure someone is not trying to intercept or modify encrypted message.");
}
StringBuilder clearText = new StringBuilder();
for (String chunk : chunks) {
byte[] byteChunk = hexToByteArray(chunk);
clearText.append(new String(pkCipher.doFinal(byteChunk), "UTF-8"));
}
return clearText.toString();
} catch (NumberFormatException e) {
throw new SecurityException("The encrypted information is corrupted or incomplete. Please make sure someone is not trying to intercept or modify encrypted message.", e);
} catch (IOException e) {
throw new SecurityException("Failed to read authentication string. Please use Java version with cryptography support.", e);
} catch (NoSuchAlgorithmException e) {
throw new SecurityException("Failed to read authentication string. Please use Java version with cryptography support.", e);
} catch (NoSuchPaddingException e) {
throw new SecurityException("Failed to read authentication string. Please use Java version with cryptography support.", e);
} catch (InvalidKeySpecException e) {
throw new SecurityException("Failed to read authentication string. Please use Java version with cryptography support.", e);
} catch (InvalidKeyException e) {
throw new SecurityException("Failed to read authentication string. Please use Java version with cryptography support.", e);
} catch (NoSuchProviderException e) {
throw new SecurityException("Failed to find encryption provider. Please use Java version with cryptography support.", e);
} catch (IllegalBlockSizeException e) {
throw new SecurityException("Failed to decrypt message. It might have been corrupted during transport.", e);
} catch (BadPaddingException e) {
throw new SecurityException("Failed to decrypt message. It might have been corrupted during transport.", e);
}
}
public static String encrypt(String pass) throws SecurityException {
String encodedKey = getPrivateKey();
return encrypt(pass, encodedKey);
}
public static String encrypt(String message, String encodedKey) {
try {
// read private key
if (StringUtils.isBlank(encodedKey)) {
throw new SecurityException("Activation key was not found. Please make sure your instance is correctly configured.");
}
byte[] binaryKey = hexToByteArray(encodedKey);
// create RSA public key cipher
Cipher pkCipher = Cipher.getInstance(ALGORITHM, "BC");
try {
// create private key
PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(binaryKey);
KeyFactory kf = KeyFactory.getInstance(ALGORITHM, "BC");
PrivateKey pk = kf.generatePrivate(privateKeySpec);
pkCipher.init(Cipher.ENCRYPT_MODE, pk);
} catch (InvalidKeySpecException e) {
// encrypting with public key?
X509EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(binaryKey);
KeyFactory kf = KeyFactory.getInstance(ALGORITHM, "BC");
PublicKey pk = kf.generatePublic(publicKeySpec);
pkCipher.init(Cipher.ENCRYPT_MODE, pk);
}
// encrypt
byte[] bytes = message.getBytes("UTF-8");
// split bit message in chunks
int start = 0;
StringBuilder chaos = new StringBuilder();
while (start < bytes.length) {
byte[] tmp = new byte[Math.min(bytes.length - start, binaryKey.length / 8)];
System.arraycopy(bytes, start, tmp, 0, tmp.length);
start += tmp.length;
byte[] encrypted = pkCipher.doFinal(tmp);
chaos.append(byteArrayToHex(encrypted));
chaos.append(";");
}
chaos.setLength(chaos.length() - 1);
return chaos.toString();
} catch (IOException e) {
throw new SecurityException("Failed to create authentication string. Please use Java version with cryptography support.", e);
} catch (NoSuchAlgorithmException e) {
throw new SecurityException("Failed to create authentication string. Please use Java version with cryptography support.", e);
} catch (NoSuchPaddingException e) {
throw new SecurityException("Failed to create authentication string. Please use Java version with cryptography support.", e);
} catch (InvalidKeySpecException e) {
throw new SecurityException("Failed to create authentication string. Please use Java version with cryptography support.", e);
} catch (InvalidKeyException e) {
throw new SecurityException("Failed to create authentication string. Please use Java version with cryptography support.", e);
} catch (NoSuchProviderException e) {
throw new SecurityException("Failed to find encryption provider. Please use Java version with cryptography support.", e);
} catch (IllegalBlockSizeException e) {
throw new SecurityException("Failed to encrypt string. Please use Java version with cryptography support.", e);
} catch (BadPaddingException e) {
throw new SecurityException("Failed to encrypt string. Please use Java version with cryptography support.", e);
}
}
public static String getPrivateKey() {
String path = SystemProperty.getProperty(KEY_LOCATION_PROPERTY);
checkPrivateKeyStoreExistence(path);
try {
Properties defaultProps = new Properties();
FileInputStream in = new FileInputStream(path);
defaultProps.load(in);
in.close();
return defaultProps.getProperty(PRIVATE_KEY);
} catch (FileNotFoundException e) {
throw new SecurityException("Failed to retrieve private key. Please make sure the key is located in " + path, e);
} catch (IOException e) {
throw new SecurityException("Failed to retrieve private key. Please make sure the key is located in " + path, e);
}
}
public static void updateKeys(MgnlKeyPair keys) {
// update filestore only when private key is present
if (keys.getPrivateKey() != null) {
String path = SystemProperty.getProperty(KEY_LOCATION_PROPERTY);
try {
Properties defaultProps = new Properties();
defaultProps.put(PRIVATE_KEY, keys.getPrivateKey());
defaultProps.put(PUBLIC_KEY, keys.getPublicKey());
File keystore = new File(path);
File parentFile = keystore.getParentFile();
if (parentFile != null) {
parentFile.mkdirs();
}
FileWriter writer = new FileWriter(keystore);
String date = new SimpleDateFormat("dd.MMM.yyyy hh:mm").format(new Date());
defaultProps.store(writer, "generated " + date + " by " + MgnlContext.getUser().getName());
writer.close();
} catch (FileNotFoundException e) {
throw new SecurityException("Failed to store private key. Please make sure the key is located in " + path, e);
} catch (IOException e) {
throw new SecurityException("Failed to store private key. Please make sure the key is located in " + path, e);
}
}
try {
Session session = MgnlContext.getSystemContext().getJCRSession("config");
session.getNode("/server/activation").setProperty("publicKey", keys.getPublicKey());
session.save();
} catch (RepositoryException e) {
throw new SecurityException("Failed to store public key.", e);
}
}
public static String getPublicKey() {
ActivationManager aman = Components.getComponentProvider().getComponent(ActivationManager.class);
return aman.getPublicKey();
}
private static final String HEX = "0123456789ABCDEF";
public static String byteArrayToHex(byte[] raw) {
if (raw == null) {
return null;
}
final StringBuilder hex = new StringBuilder(2 * raw.length);
for (final byte b : raw) {
hex.append(HEX.charAt((b & 0xF0) >> 4))
.append(HEX.charAt((b & 0x0F)));
}
return hex.toString();
}
public static byte[] hexToByteArray(String s) {
byte[] b = new byte[s.length() / 2];
for (int i = 0; i < b.length; i++) {
int index = i * 2;
int v = Integer.parseInt(s.substring(index, index + 2), 16);
b[i] = (byte) v;
}
return b;
}
public static MgnlKeyPair generateKeyPair(int keyLength) throws NoSuchAlgorithmException {
KeyPairGenerator kgen = KeyPairGenerator.getInstance(ALGORITHM);
kgen.initialize(keyLength);
KeyPair key = kgen.genKeyPair();
return new MgnlKeyPair(byteArrayToHex(key.getPrivate().getEncoded()), byteArrayToHex(key.getPublic().getEncoded()));
}
/**
* Used for removing password parameter from cache key.
* @param cacheKey.toString()
* @return
*/
public static String stripPasswordFromCacheLog(String log){
String value = stripParameterFromCacheLog(log, "mgnlUserPSWD");
value = stripParameterFromCacheLog(value, "passwordConfirmation");
value = stripParameterFromCacheLog(value, "password");
return value;
}
public static String stripPasswordFromUrl(String url){
if(StringUtils.isBlank(url)){
return null;
}
String value = null;
value = StringUtils.substringBefore(url, "mgnlUserPSWD");
value = value + StringUtils.substringAfter(StringUtils.substringAfter(url, "mgnlUserPSWD"), "&");
return StringUtils.removeEnd(value, "&");
}
public static String stripParameterFromCacheLog(String log, String parameter){
if(StringUtils.isBlank(log)){
return null;
}else if(!StringUtils.contains(log, parameter)){
return log;
}
String value = null;
value = StringUtils.substringBefore(log, parameter);
String afterString = StringUtils.substringAfter(log, parameter);
if(StringUtils.indexOf(afterString, " ") < StringUtils.indexOf(afterString, "}")){
value = value + StringUtils.substringAfter(afterString, " ");
}else{
value = value + "}" + StringUtils.substringAfter(afterString, "}");
}
return value;
}
private static void checkPrivateKeyStoreExistence(final String path) throws SecurityException {
if(StringUtils.isBlank(path)) {
throw new SecurityException("Private key store path is either null or empty. Please, check [" + KEY_LOCATION_PROPERTY + "] value in magnolia.properties");
}
String absPath = Path.getAbsoluteFileSystemPath(path);
File keypair = new File(absPath);
if(!keypair.exists()) {
throw new SecurityException("Private key store doesn't exist at [" + keypair.getAbsolutePath() + "]. Please, ensure that [" + KEY_LOCATION_PROPERTY + "] actually points to the correct location");
}
}
public static String getBCrypt(String text) {
// gensalt's log_rounds parameter determines the complexity
// the work factor is 2^log_rounds, and the default is 10
String hashed = BCrypt.hashpw(text, BCrypt.gensalt(12));
return hashed;
}
public static boolean matchBCrypted(String candidate, String hash) {
// Check that an unencrypted password matches one that has
// previously been hashed
return BCrypt.checkpw(candidate, hash);
}
/**
* Message Digesting function.
*
*/
public static String getDigest(String data, String algorithm) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance(algorithm);
md.reset();
return new String(md.digest(data.getBytes()));
}
/**
* Message Digesting function.
*
*/
public static byte[] getDigest(byte[] data, String algorithm) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance(algorithm);
md.reset();
return md.digest(data);
}
/**
* Gets SHA-1 encoded -> hex string.
*/
public static String getSHA1Hex(byte[] data) {
try {
return byteArrayToHex(getDigest(data, SecurityUtil.SHA1));
}
catch (NoSuchAlgorithmException e) {
throw new SecurityException("Couldn't digest with " + SecurityUtil.SHA1 + " algorithm!");
}
}
public static String getSHA1Hex(String data) {
return getSHA1Hex(data.getBytes());
}
/**
* Gets MD5 encoded -> hex string.
*/
public static String getMD5Hex(byte[] data) {
try {
return byteArrayToHex(getDigest(data, SecurityUtil.MD5));
}
catch (NoSuchAlgorithmException e) {
throw new SecurityException("Couldn't digest with " + SecurityUtil.MD5 + " algorithm!");
}
}
public static String getMD5Hex(String data) {
return getMD5Hex(data.getBytes());
}
}