Description: Switch from mcrypt to openssl
Author: Benjamin Zapiec <bzapiec@gonicus.de>
Abstract:
 This patch includes the following gosa-core upstream commit:
 .
    commit 8a57db04f84337903f7de202e3c897d9b76d9b5f
    Author: bzapiec <benjamin.zapiec@gonicus.de>
    Date:   Tue Feb 27 08:31:47 2018 +0100
 .
        (see #12)
        add comment so the user know how and if to use the migration script
        suppress openssl warning
        execution right is revoked to avoid user to accidentally execute this script
 .
    commit 5f946bee9495db49bd718b8430eda2745adf8b3e
    Author: bzapiec <benjamin.zapiec@gonicus.de>
    Date:   Tue Feb 27 08:25:21 2018 +0100
 .
    (see #12)
    switch to ecb mode so we don't need to save the iv
    add migration script
 .
    commit 374e19d8c7a915b8580caa1184a76240919f4f0d
    Author: bzapiec <benjamin.zapiec@gonicus.de>
    Date:   Mon Feb 26 14:48:04 2018 +0100
 .
        remove gosa-si dependencies
 .
    commit df92dc9a0d5204825594986f78baf913167ca458
    Author: bzapiec <benjamin.zapiec@gonicus.de>
    Date:   Fri Feb 23 15:37:19 2018 +0100
 .
        (see #12)
        trim decoded value
 .
    commit db98333cf2a456d108939402efcffe129740463c
    Author: bzapiec <benjamin.zapiec@gonicus.de>
    Date:   Fri Feb 23 14:48:05 2018 +0100
 .
        (see #12)
        updated Socket_Client not to use mcrypt anymore
 .
    commit 22ed57eb75b1255f70ac1926824a8dc19edd2431
    Author: bzapiec <benjamin.zapiec@gonicus.de>
    Date:   Fri Feb 23 14:09:00 2018 +0100
 .
        refs #12
        first patchset to migrate from mcrypt to openssl encryption library
 .
        - use openssl library for password encryption in gosa.conf



--- a/gosa-core/bin/gosa-encrypt-passwords
+++ b/gosa-core/bin/gosa-encrypt-passwords
@@ -1,12 +1,14 @@
 #!/usr/bin/php
 <?php
 
-function cred_encrypt($input, $password) {
-
-  $size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
-  $iv = mcrypt_create_iv($size, MCRYPT_DEV_RANDOM);
+function cred_encrypt($input, $password, $cipher = "aes-256-cbc") {
+  if (in_array($cipher, openssl_get_cipher_methods())) {
+    $ivlen = openssl_cipher_iv_length($cipher);
+    $iv = openssl_random_pseudo_bytes($ivlen);
+    return bin2hex(openssl_encrypt($input, $cipher, $password, OPENSSL_RAW_DATA, $iv));
+  }
 
-  return bin2hex(mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $password, $input, MCRYPT_MODE_ECB, $iv));
+  return null;
 }
 
 
@@ -68,7 +70,12 @@
   $user = $referral->attributes->getNamedItem("adminDn");
   echo "* encrypting GOsa password for: ".$user->nodeValue."\n";
   $pw= $referral->attributes->getNamedItem("adminPassword");
-  $pw->nodeValue= cred_encrypt($pw->nodeValue, $master_key);
+
+  $encryptedSecret = cred_encrypt($pw->nodeValue, $master_key);
+
+  if($encryptedSecret !== NULL) {
+    $pw->nodeValue = $encryptedSecret;
+  }
 }
 
 # Encrypt the snapshot passwords 
@@ -78,7 +85,10 @@
   $node = $location->attributes->getNamedItem("snapshotAdminPassword"); 
   if($node->nodeValue){
     echo "* encrypting snapshot pasword for location: ".$name->nodeValue."\n";
-    $node->nodeValue = cred_encrypt($node->nodeValue, $master_key);;
+    $encryptedSecret = cred_encrypt($node->nodeValue, $master_key);
+    if($encryptedSecret !== NULL) {
+      $node->nodeValue = $encryptedSecret;
+    }
   }
 }
 
--- /dev/null
+++ b/gosa-core/bin/gosa-mcrypt-to-openssl-passwords
@@ -0,0 +1,109 @@
+#!/usr/bin/php
+<?php
+###################################################################
+# Migration script to migrate your gosa.conf
+# from mcrypt to openssl.
+#
+# If you already updated to openssl don't execute
+# this script again!
+# Your GOsa² installation will become unusable and you need
+# to revert the passwords manually.
+# 
+# On new installations you don't need to execute this script.
+# Password encryption is done by gosa-encrypt-passwords
+###################################################################
+
+
+function cred_encrypt($input, $password, $cipher = "aes-256-ecb") {
+  if (in_array($cipher, openssl_get_cipher_methods())) {
+    $ivlen = openssl_cipher_iv_length($cipher);
+    $iv = openssl_random_pseudo_bytes($ivlen);
+    return bin2hex(openssl_encrypt($input, $cipher, $password, OPENSSL_RAW_DATA, $iv));
+  }
+
+  return null;
+}
+
+function cred_decrypt($input, $password) {
+  $size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
+  $iv = mcrypt_create_iv($size, MCRYPT_DEV_RANDOM);
+  return rtrim(@openssl_decrypt( pack("H*", $input), "aes-256-ecb" , $password, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv ), "\0\3\4\n");
+}
+
+
+# We need to have access to gosa.secrets
+if (posix_getuid() != 0){
+  die ("This program needs to be called by root!\n");
+}
+
+# Do we have a valid gosa.conf?
+if (!file_exists("/etc/gosa/gosa.conf")){
+  die ("Cannot find a valid /etc/gosa/gosa.conf!\n");
+}
+
+echo "Starting password encryption update\n";
+echo "* read master key from gosa.secrets\n";
+$master_key="";
+
+# Do we have a valid gosa.secrets, already? 
+if (!file_exists("/etc/gosa/gosa.secrets")){
+  die ("There's no /etc/gosa/gosa.secrets. No need to update passwords\n");
+} else {
+  echo "* open /etc/gosa/gosa.secrets\n";
+  $content = file_get_contents("/etc/gosa/gosa.secrets");
+  $pos = strpos($content, "GOSAKEY");
+
+  if($pos !== NULL) {
+    $master_key = trim(substr($content, $pos + strlen("GOSAKEY")));
+  } else {
+    die ("/etc/gosa/gosa.secrets maulformed\n");
+  }
+}
+
+# Locate all passwords inside the gosa.conf
+echo "* loading /etc/gosa/gosa.conf\n";
+$conf = new DOMDocument();
+$conf->load("/etc/gosa/gosa.conf") or die ("Cannot read /etc/gosa/gosa.conf - aborted\n");
+$conf->encoding = 'UTF-8';
+$referrals= $conf->getElementsByTagName("referral");
+foreach($referrals as $referral){
+  $user = $referral->attributes->getNamedItem("adminDn");
+  echo "* encrypting GOsa password for: ".$user->nodeValue."\n";
+  $pw= $referral->attributes->getNamedItem("adminPassword");
+  $encryptedSecret = cred_encrypt(cred_decrypt($pw->nodeValue, $master_key), $master_key);
+
+  if($encryptedSecret !== NULL) {
+    $pw->nodeValue = $encryptedSecret;
+  }
+}
+
+# Encrypt the snapshot passwords 
+$locations= $conf->getElementsByTagName("location");
+foreach($locations as $location){
+  $name = $location->attributes->getNamedItem("name"); 
+  $node = $location->attributes->getNamedItem("snapshotAdminPassword"); 
+  if($node->nodeValue){
+    echo "* encrypting snapshot pasword for location: ".$name->nodeValue."\n";
+    $encryptedSecret = cred_encrypt(cred_decrypt($node->nodeValue, $master_key), $master_key);
+    if($encryptedSecret !== NULL) {
+      $node->nodeValue = $encryptedSecret;
+    }
+  }
+}
+
+# Move original gosa.conf out of the way and make it unreadable for the web user
+echo "* creating backup in /etc/gosa/gosa.conf.orig\n";
+rename("/etc/gosa/gosa.conf", "/etc/gosa/gosa.conf.orig");
+chmod("/etc/gosa/gosa.conf.orig", 0600);
+chown ("/etc/gosa/gosa.conf.orig", "root");
+chgrp ("/etc/gosa/gosa.conf.orig", "root");
+
+# Save new passwords
+echo "* saving modified /etc/gosa/gosa.conf\n";
+$conf->save("/etc/gosa/gosa.conf") or die("Cannot write modified /etc/gosa/gosa.conf - aborted\n");
+chmod("/etc/gosa/gosa.conf", 0640);
+chown ("/etc/gosa/gosa.conf", "root");
+chgrp ("/etc/gosa/gosa.conf", "www-data");
+echo "OK\n\n";
+
+?>
--- a/gosa-core/html/getFAIstatus.php
+++ /dev/null
@@ -1,51 +0,0 @@
-<?php
-/*
- * This code is part of GOsa (http://www.gosa-project.org)
- * Copyright (C) 2003-2008 GONICUS GmbH
- *
- * ID: $$Id: getbin.php 9255 2008-03-03 16:04:30Z cajus $$
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-
-/* Basic setup, remove eventually registered sessions */
-@require_once ("../include/php_setup.inc");
-@require_once ("functions.inc");
-
-session_cache_limiter("private");
-session::start();
-session::global_set('errorsAlreadyPosted',array());
-
-/* Logged in? Simple security check */
-if (!session::global_is_set('ui')){
-  new log("security","unknown","",array(),"Error: getFAIstatus.php called without session") ;
-  header ("Location: index.php");
-  exit;
-}
-
-/* There must be a mac address given */
-if(!isset($_GET['mac'])){
-	return;
-}
-
-$config = session::global_get("config");
-$o =  new gosaSupportDaemon();
-header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
-header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Datum in der Vergangenheit
-$res = $o->get_entries_by_mac(explode(",", $_GET['mac']));
-foreach($res as $entry){
-	echo $entry['MACADDRESS']."|".$entry['PROGRESS']."\n";
-}
-?>
--- a/gosa-core/include/class_listing.inc
+++ b/gosa-core/include/class_listing.inc
@@ -1626,20 +1626,7 @@
 
 function renderDaemonMenu($separator)
 {
-    $result= "";
-
-    // If there is a daemon registered, draw the menu entries
-    if(class_available("DaemonEvent")){
-        $events= DaemonEvent::get_event_types_by_category($this->categories);
-        if(isset($events['BY_CLASS']) && count($events['BY_CLASS'])){
-            foreach($events['BY_CLASS'] as $name => $event){
-                $result.= "<li$separator><a href='#' onClick='\$(\"act\").value=\"$name\";\$(\"exec_act\").click();'>".$event['MenuImage']."&nbsp;".$event['s_Menu_Name']."</a></li>";
-                $separator= "";
-            }
-        }
-    }
-
-    return $result;
+    return "";
 }
 
 
--- a/gosa-core/include/class_socketClient.inc
+++ b/gosa-core/include/class_socketClient.inc
@@ -35,10 +35,10 @@
   private $b_encrypt  = FALSE;
 
   /* Crypto information */
-  private $td= NULL;
   private $ckey= "";
-  private $ks;
   private $iv;
+  private $openssl_cipher = "aes-256-cbc";
+  private $iv_len = -1;
 
 
   public function __construct($host, $port, $connect = TRUE, $timeout = 3){
@@ -47,6 +47,8 @@
     $this->timeout= $timeout;
     $this->reset_error();
 
+    $this->iv_len = openssl_cipher_iv_length($openssl_cipher);
+
     /* Connect if needed */
     if($connect){
       $this->open();
@@ -56,14 +58,8 @@
 
   public function setEncryptionKey($key)
   {
-    if(!function_exists("mcrypt_get_iv_size")){
-      $this->set_error(msgPool::missingext("mcrypt"));
-      $this->ckey = "";
-      $this->b_encrypt = FALSE;
-    }
-
     if ($this->connected()){
-      $this->ckey = substr(md5($key), 0, $this->ks);
+      $this->ckey = md5($key);
       $this->b_encrypt = TRUE;
     }
 
@@ -74,8 +70,7 @@
   private function encrypt($data)
   {
     if($this->b_encrypt){
-      mcrypt_generic_init($this->td, $this->ckey, $this->iv);
-      $data = base64_encode(mcrypt_generic($this->td, $data));
+      $data = base64_encode(openssl_encrypt($data, $this->openssl_cipher, $this->ckey, OPENSSL_RAW_DATA, $this->iv));
     }
     return($data);
   }
@@ -85,9 +80,7 @@
   {
     /* decrypt data */
     if($this->b_encrypt && strlen($data)){
-      $data = base64_decode($data);
-      mcrypt_generic_init($this->td, $this->ckey, $this->iv);
-      $data = mdecrypt_generic($this->td, $data);
+      $data = openssl_decrypt(base64_decode($data), $this->openssl_cipher, $this->ckey, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $this->iv);
     }
     return($data);
   }
@@ -109,12 +102,8 @@
     }else{
       $this->b_data_send = TRUE;
 
-      /* Open the cipher */
-      $this->td = mcrypt_module_open('rijndael-128', '', 'cbc', '');
-
       /* Create the IV and determine the keysize length */
-      $this->iv = substr(md5('GONICUS GmbH'),0, mcrypt_enc_get_iv_size($this->td));
-      $this->ks = mcrypt_enc_get_key_size($this->td);
+      $this->iv = substr(md5('GONICUS GmbH'),0, $this->iv_len);
     }
   }
 
@@ -210,9 +199,6 @@
     if($this->handle){
       fclose($this->handle);
     }
-
-    /* Terminate decryption handle and close module */
-    @mcrypt_generic_deinit($this->td);
   }
 }
 // vim:tabstop=2:expandtab:shiftwidth=2:filetype=php:syntax:ruler:
--- a/gosa-core/include/functions.inc
+++ b/gosa-core/include/functions.inc
@@ -3071,20 +3071,6 @@
         return(array());
     }
 
-  }elseif ($config->get_cfg_value("core","gosaSupportURI") != ""){
-
-    // Try using gosa-si
-  	$res= gosaSupportDaemon::send("gosa_gen_smb_hash", "GOSA", array("password" => $password), TRUE);
-    if (isset($res['XML']['HASH'])){
-    	$hash= $res['XML']['HASH'];
-    } else {
-      $hash= "";
-    }
-
-    if ($hash == "") {
-      msg_dialog::display(_("Configuration error"), _("Cannot generate SAMBA hash!"), ERROR_DIALOG);
-      return ("");
-    }
   } else {
       $password = addcslashes($password, '$'); // <- Escape "$" once to be able to use it in pw strings in Perl scripts
       $tmp = $config->get_cfg_value("core",'sambaHashHook');
@@ -3322,24 +3308,26 @@
 }
 
 
-function cred_encrypt($input, $password) {
-
-  $size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
-  $iv = mcrypt_create_iv($size, MCRYPT_DEV_RANDOM);
-
-  return bin2hex(mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $password, $input, MCRYPT_MODE_ECB, $iv));
+function cred_encrypt($input, $password, $cipher = "aes-256-ecb") {
+  if (in_array($cipher, openssl_get_cipher_methods())) {
+    $ivlen = openssl_cipher_iv_length($cipher);
+    $iv = openssl_random_pseudo_bytes($ivlen);
+    return bin2hex(openssl_encrypt($input, $cipher, $password, OPENSSL_RAW_DATA, $iv));
+  }
 
+  return null;
 }
 
+function cred_decrypt($input, $password, $cipher = "aes-256-ecb") {
+  if (in_array($cipher, openssl_get_cipher_methods())) {
+    $ivlen = openssl_cipher_iv_length($cipher);
+    $iv = openssl_random_pseudo_bytes($ivlen);
+    return rtrim(openssl_decrypt(pack("H*", $input), $cipher, $password, OPENSSL_RAW_DATA, $iv ), "\0\3\4\n");
+  }
 
-function cred_decrypt($input,$password) {
-  $size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
-  $iv = mcrypt_create_iv($size, MCRYPT_DEV_RANDOM);
-
-  return rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $password, pack("H*", $input), MCRYPT_MODE_ECB, $iv), "\0\3\4\n");
+  return null;
 }
 
-
 function get_object_info()
 {
   return(session::get('objectinfo'));
--- a/gosa-core/plugins/admin/groups/class_groupManagement.inc
+++ b/gosa-core/plugins/admin/groups/class_groupManagement.inc
@@ -93,13 +93,6 @@
         $msgs = $this->dialogObject->check();
         if(count($msgs)){
             msg_dialog::displayChecks($msgs);
-        }else{
-            $o_queue = new gosaSupportDaemon();
-            $o_queue->append($this->dialogObject);
-            if($o_queue->is_error()){
-                msg_dialog::display(_("Infrastructure error"), msgPool::siError($o_queue->get_error()),ERROR_DIALOG);
-            }
-            $this->closeDialogs();
         }
     }
 
@@ -118,16 +111,6 @@
                 $uids[] = $attrs['cn'][0];
             }
         }
-        if(count($uids)){
-            $events = DaemonEvent::get_event_types(USER_EVENT);
-            $event = "DaemonEvent_notify";
-            if(isset($events['BY_CLASS'][$event])){
-                $type = $events['BY_CLASS'][$event];
-                $this->dialogObject = new $type['CLASS_NAME']($this->config);
-                $this->dialogObject->add_groups($uids);
-                $this->dialogObject->set_type(SCHEDULED_EVENT);
-            }
-        }
     }
 
 
--- a/gosa-core/plugins/admin/ogroups/class_ogroupManagement.inc
+++ b/gosa-core/plugins/admin/ogroups/class_ogroupManagement.inc
@@ -108,13 +108,6 @@
         $msgs = $this->dialogObject->check();
         if(count($msgs)){
             msg_dialog::displayChecks($msgs);
-        }else{
-            $o_queue = new gosaSupportDaemon();
-            $o_queue->append($this->dialogObject);
-            if($o_queue->is_error()){
-                msg_dialog::display(_("Infrastructure error"), msgPool::siError($o_queue->get_error()),ERROR_DIALOG);
-            }
-            $this->closeDialogs();
         }
     }
 
@@ -123,56 +116,7 @@
      */
     function sendMessage($action="",$target=array(),$all=array())
     {
-
-        if(class_available("DaemonEvent_notify")){
-
-            // Resolv targets  
-            $targets = array();
-            $m_list  = array();
-            $ldap = $this->config->get_ldap_link();
-
-            // Collect selected ogroups
-            foreach($target as $dn){
-                $ldap->cat($dn, array('member'));
-                while ($entry = $ldap->fetch()) {
-                    $m_list[] = $entry;
-                }
-            }
-
-            // Collect object group member dns
-            foreach($m_list as $entry){
-                $members = $entry['member'];
-                for($i=0;$i<$members['count'];$i++) {
-
-                    // Fetch member object
-                    $ldap->cat($members[$i], array('uid','cn','objectClass'));
-                    if ($ldap->count() > 0) {
-
-                        // Determine which type the object has
-                        $attrs = $ldap->fetch();
-                        if (array_search('gosaAccount', $attrs['objectClass'])) {
-                            $uid = $attrs['uid'][0];
-                            $targets['USERS'][] = $uid;
-                        }elseif (array_search('posixGroup', $attrs['objectClass'])) {
-                            $group = $attrs['cn'][0];
-                            $targets['GROUPS'][] = $group;
-                        }
-                    }
-                }
-            }
-
-            // We've at least one recipient
-            if(count($targets)){
-                $events = DaemonEvent::get_event_types(USER_EVENT);
-                if(isset($events['BY_CLASS']['DaemonEvent_notify'])){
-                    $type = $events['BY_CLASS']['DaemonEvent_notify'];
-                    $this->dialogObject = new $type['CLASS_NAME']($this->config);
-                    $this->dialogObject->add_targets($targets);
-                    $this->dialogObject->set_type(TRIGGERED_EVENT);
-                }
-            }
-
-        }
+      return;
     }
 
     static function filterProperties($row, $gosaGroupObjects)
--- a/gosa-core/plugins/admin/users/class_userManagement.inc
+++ b/gosa-core/plugins/admin/users/class_userManagement.inc
@@ -163,28 +163,7 @@
      */ 
     function sendMessage($action="",$target=array(),$all=array())
     {
-        if(class_available("DaemonEvent")){
-            $uids = array();
-            $ldap = $this->config->get_ldap_link();
-            $ldap->cd($this->config->current['BASE']);
-            foreach($target as $dn){
-                $ldap->cat($dn,array('uid'));
-                $attrs = $ldap->fetch();
-                if(isset($attrs['uid'][0])){
-                    $uids[] = $attrs['uid'][0];
-                }
-            }
-            if(count($uids)){
-                $events = DaemonEvent::get_event_types(USER_EVENT);
-                $event = "DaemonEvent_notify";
-                if(isset($events['BY_CLASS'][$event])){
-                    $type = $events['BY_CLASS'][$event];
-                    $this->dialogObject = new $type['CLASS_NAME']($this->config);
-                    $this->dialogObject->add_users($uids);
-                    $this->dialogObject->set_type(SCHEDULED_EVENT);
-                }
-            }
-        }
+      return;
     }
 
 
@@ -196,13 +175,6 @@
         $msgs = $this->dialogObject->check();
         if(count($msgs)){
             msg_dialog::displayChecks($msgs);
-        }else{
-            $o_queue = new gosaSupportDaemon();
-            $o_queue->append($this->dialogObject);
-            if($o_queue->is_error()){
-                msg_dialog::display(_("Infrastructure error"), msgPool::siError($o_queue->get_error()),ERROR_DIALOG);
-            }
-            $this->closeDialogs();
         }
     }