First stab at a recrypter for legacy mcrypt conversion

app/Console/Commands/RecryptFromMcrypt.php

@@ -0,0 +1,150 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\CustomField;
+use Illuminate\Console\Command;
+use App\LegacyEncrypter\McryptEncrypter;
+use App\Models\Setting;
+use App\Models\Asset;
+use Illuminate\Support\Facades\Storage;
+
+class RecryptFromMcrypt extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:legacy-recrypt';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command allows upgrading users to de-encrypt their deprecated mcrypt encrypted fields and re-encrypt them using the current OpenSSL encryption.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+
+
+        // Check and see if they have a legacy app key listed in their .env
+        // If not, we can try to use the current APP_KEY if looks like it's old
+        $legacy_key = env('LEGACY_APP_KEY');
+
+        if (!$legacy_key) {
+            $this->error('ERROR: You do not have a LEGACY_APP_KEY set in your .env file. Please locate your old APP_KEY and ADD a line to your .env file like: LEGACY_APP_KEY=YOUR_OLD_APP_KEY');
+            return false;
+        }
+
+        // Check that the app key is 32 characters
+        if (strlen($legacy_key) == 32) {
+            $this->comment('INFO: Your LEGACY_APP_KEY is 32 characters. Okay to continue.');
+        } else {
+            $this->error('ERROR: Your LEGACY_APP_KEY is not the correct length (32 characters). Please locate your old APP_KEY and use that as your LEGACY_APP_KEY in your .env file to continue.');
+            return false;
+        }
+
+        $this->error('================================!!!! WARNING !!!!================================');
+        $this->error('================================!!!! WARNING !!!!================================');
+        $this->comment("This tool will attempt to decrypt your old Snipe-IT (mcrypt, now deprecated) encrypted data and re-encrypt it using OpenSSL. \n\nYou should only continue if you have backed up any and all old APP_KEYs and have backed up your data.");
+
+        if ($this->confirm("Are you SURE you wish to continue?")) {
+
+            $backup_file = 'backups/env-backups/'.'app_key-'.date('Y-m-d-gis');
+
+            try {
+                Storage::disk('local')->put($backup_file, 'APP_KEY: '.config('app.key'));
+                Storage::disk('local')->append($backup_file, 'LEGACY_APP_KEY: '.$legacy_key);
+            } catch (\Exception $e) {
+                $this->info('WARNING: Could not backup app keys');
+            }
+
+
+            $mcrypter = new McryptEncrypter($legacy_key);
+            $settings = Setting::getSettings();
+
+            if ($settings->ldap_password=='') {
+                $this->comment('INFO: No LDAP password found. Skipping... ');
+            }
+
+            $custom_fields = CustomField::where('field_encrypted','=', 1)->get();
+            $this->comment('INFO: Retrieving encrypted custom fields...');
+
+            $query = Asset::withTrashed();
+
+            foreach ($custom_fields as $custom_field) {
+                $this->comment('FIELD TO RECRYPT:  '.$custom_field->name .' ('.$custom_field->db_column.')');
+                $query->orWhereNotNull($custom_field->db_column);
+            }
+
+
+            // Get all assets with a value in any of the fields that were encrypted
+            $assets = $query->get();
+
+            $bar = $this->output->createProgressBar(count($assets));
+
+            foreach ($custom_fields as $encrypted_field) {
+
+                // Try to decrypt the payload using the legacy app key
+                try {
+                    $decrypted_field = $mcrypter->decrypt($encrypted_field);
+                    $this->comment($decrypted_field);
+                } catch (\Exception $e) {
+                    $errors[] = ' - ERROR: Could not decrypt field ['.$encrypted_field->name.']: '.$e->getMessage();
+                }
+                $bar->advance();
+            }
+
+
+            foreach ($assets as $asset) {
+                foreach ($custom_fields as $encrypted_field) {
+
+                    // Make sure the value isn't null
+                    if ($asset->{$encrypted_field}!='') {
+                        // Try to decrypt the payload using the legacy app key
+                        try {
+                            $decrypted_field = $mcrypter->decrypt($asset->{$encrypted_field});
+                            $asset->{$encrypted_field} = \Crypt::encrypt($decrypted_field);
+                            $this->comment($decrypted_field);
+                        } catch (\Exception $e) {
+                            $errors[] = ' - ERROR: Could not decrypt field ['.$encrypted_field->name.']: '.$e->getMessage();
+                        }
+                    }
+
+                }
+                $asset->save();
+                $bar->advance();
+            }
+
+
+
+            $bar->finish();
+
+            if (count($errors) > 0) {
+                $this->comment("\n\n");
+                $this->error("The decrypter encountered some errors: \n");
+                foreach ($errors as $error) {
+                    $this->error($error);
+                }
+            }
+        }
+
+    }
+}

app/Console/Kernel.php

@@ -23,7 +23,8 @@ class Kernel extends ConsoleKernel
         Commands\DisableLDAP::class,
         Commands\Purge::class,
         Commands\LdapSync::class,
-        Commands\FixDoubleEscape::class
+        Commands\FixDoubleEscape::class,
+        Commands\RecryptFromMcrypt::class
     ];
 
     /**

app/LegacyEncrypter/BaseEncrypter.php

@@ -0,0 +1,81 @@
+<?php
+
+namespace App\LegacyEncrypter;
+
+use Illuminate\Contracts\Encryption\DecryptException;
+
+abstract class BaseEncrypter
+{
+    /**
+     * The encryption key.
+     *
+     * @var string
+     */
+    protected $key;
+
+    /**
+     * Create a MAC for the given value.
+     *
+     * @param  string  $iv
+     * @param  string  $value
+     * @return string
+     */
+    protected function hash($iv, $value)
+    {
+        return hash_hmac('sha256', $iv.$value, $this->key);
+    }
+
+    /**
+     * Get the JSON array from the given payload.
+     *
+     * @param  string  $payload
+     * @return array
+     *
+     * @throws \Illuminate\Contracts\Encryption\DecryptException
+     */
+    protected function getJsonPayload($payload)
+    {
+        $payload = json_decode(base64_decode($payload), true);
+
+        // If the payload is not valid JSON or does not have the proper keys set we will
+        // assume it is invalid and bail out of the routine since we will not be able
+        // to decrypt the given value. We'll also check the MAC for this encryption.
+        if (! $payload || $this->invalidPayload($payload)) {
+            throw new DecryptException('The payload is invalid.');
+        }
+
+        if (! $this->validMac($payload)) {
+            throw new DecryptException('The MAC is invalid.');
+        }
+
+        return $payload;
+    }
+
+    /**
+     * Verify that the encryption payload is valid.
+     *
+     * @param  array|mixed  $data
+     * @return bool
+     */
+    protected function invalidPayload($data)
+    {
+        return ! is_array($data) || ! isset($data['iv']) || ! isset($data['value']) || ! isset($data['mac']);
+    }
+
+    /**
+     * Determine if the MAC for the given payload is valid.
+     *
+     * @param  array  $payload
+     * @return bool
+     *
+     * @throws \RuntimeException
+     */
+    protected function validMac(array $payload)
+    {
+        $bytes = random_bytes(16);
+
+        $calcMac = hash_hmac('sha256', $this->hash($payload['iv'], $payload['value']), $bytes, true);
+
+        return hash_equals(hash_hmac('sha256', $payload['mac'], $bytes, true), $calcMac);
+    }
+}

app/LegacyEncrypter/McryptEncrypter.php

@@ -0,0 +1,214 @@
+<?php
+
+namespace App\LegacyEncrypter;
+
+use Exception;
+use RuntimeException;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Contracts\Encryption\EncryptException;
+use Illuminate\Contracts\Encryption\Encrypter as EncrypterContract;
+
+/**
+ * @deprecated since version 5.1. Use Illuminate\Encryption\Encrypter.
+ */
+class McryptEncrypter extends BaseEncrypter implements EncrypterContract
+{
+    /**
+     * The algorithm used for encryption.
+     *
+     * @var string
+     */
+    protected $cipher;
+
+    /**
+     * The block size of the cipher.
+     *
+     * @var int
+     */
+    protected $block;
+
+    /**
+     * Create a new encrypter instance.
+     *
+     * @param  string  $key
+     * @param  string  $cipher
+     * @return void
+     *
+     * @throws \RuntimeException
+     */
+    public function __construct($key, $cipher = MCRYPT_RIJNDAEL_128)
+    {
+        $key = (string) $key;
+
+        if (static::supported($key, $cipher)) {
+            $this->key = $key;
+            $this->cipher = $cipher;
+            $this->block = mcrypt_get_iv_size($this->cipher, MCRYPT_MODE_CBC);
+        } else {
+            throw new RuntimeException('The only supported ciphers are MCRYPT_RIJNDAEL_128 and MCRYPT_RIJNDAEL_256.');
+        }
+    }
+
+    /**
+     * Determine if the given key and cipher combination is valid.
+     *
+     * @param  string  $key
+     * @param  string  $cipher
+     * @return bool
+     */
+    public static function supported($key, $cipher)
+    {
+        return defined('MCRYPT_RIJNDAEL_128') &&
+                ($cipher === MCRYPT_RIJNDAEL_128 || $cipher === MCRYPT_RIJNDAEL_256);
+    }
+
+    /**
+     * Encrypt the given value.
+     *
+     * @param  string  $value
+     * @return string
+     *
+     * @throws \Illuminate\Contracts\Encryption\EncryptException
+     */
+    public function encrypt($value, $serialize = true)
+    {
+        $iv = mcrypt_create_iv($this->getIvSize(), $this->getRandomizer());
+
+        $value = base64_encode($this->padAndMcrypt($value, $iv));
+
+        // Once we have the encrypted value we will go ahead base64_encode the input
+        // vector and create the MAC for the encrypted value so we can verify its
+        // authenticity. Then, we'll JSON encode the data in a "payload" array.
+        $mac = $this->hash($iv = base64_encode($iv), $value);
+
+        $json = json_encode(compact('iv', 'value', 'mac'));
+
+        if (! is_string($json)) {
+            throw new EncryptException('Could not encrypt the data.');
+        }
+
+        return base64_encode($json);
+    }
+
+    /**
+     * Pad and use mcrypt on the given value and input vector.
+     *
+     * @param  string  $value
+     * @param  string  $iv
+     * @return string
+     */
+    protected function padAndMcrypt($value, $iv)
+    {
+        $value = $this->addPadding(serialize($value));
+
+        return mcrypt_encrypt($this->cipher, $this->key, $value, MCRYPT_MODE_CBC, $iv);
+    }
+
+    /**
+     * Decrypt the given value.
+     *
+     * @param  string  $payload
+     * @return string
+     */
+    public function decrypt($payload, $unserialize = true)
+    {
+        $payload = $this->getJsonPayload($payload);
+
+        // We'll go ahead and remove the PKCS7 padding from the encrypted value before
+        // we decrypt it. Once we have the de-padded value, we will grab the vector
+        // and decrypt the data, passing back the unserialized from of the value.
+        $value = base64_decode($payload['value']);
+
+        $iv = base64_decode($payload['iv']);
+
+        return unserialize($this->stripPadding($this->mcryptDecrypt($value, $iv)));
+    }
+
+    /**
+     * Run the mcrypt decryption routine for the value.
+     *
+     * @param  string  $value
+     * @param  string  $iv
+     * @return string
+     *
+     * @throws \Illuminate\Contracts\Encryption\DecryptException
+     */
+    protected function mcryptDecrypt($value, $iv)
+    {
+        try {
+            return mcrypt_decrypt($this->cipher, $this->key, $value, MCRYPT_MODE_CBC, $iv);
+        } catch (Exception $e) {
+            throw new DecryptException($e->getMessage());
+        }
+    }
+
+    /**
+     * Add PKCS7 padding to a given value.
+     *
+     * @param  string  $value
+     * @return string
+     */
+    protected function addPadding($value)
+    {
+        $pad = $this->block - (strlen($value) % $this->block);
+
+        return $value.str_repeat(chr($pad), $pad);
+    }
+
+    /**
+     * Remove the padding from the given value.
+     *
+     * @param  string  $value
+     * @return string
+     */
+    protected function stripPadding($value)
+    {
+        $pad = ord($value[($len = strlen($value)) - 1]);
+
+        return $this->paddingIsValid($pad, $value) ? substr($value, 0, $len - $pad) : $value;
+    }
+
+    /**
+     * Determine if the given padding for a value is valid.
+     *
+     * @param  string  $pad
+     * @param  string  $value
+     * @return bool
+     */
+    protected function paddingIsValid($pad, $value)
+    {
+        $beforePad = strlen($value) - $pad;
+
+        return substr($value, $beforePad) == str_repeat(substr($value, -1), $pad);
+    }
+
+    /**
+     * Get the IV size for the cipher.
+     *
+     * @return int
+     */
+    protected function getIvSize()
+    {
+        return mcrypt_get_iv_size($this->cipher, MCRYPT_MODE_CBC);
+    }
+
+    /**
+     * Get the random data source available for the OS.
+     *
+     * @return int
+     */
+    protected function getRandomizer()
+    {
+        if (defined('MCRYPT_DEV_URANDOM')) {
+            return MCRYPT_DEV_URANDOM;
+        }
+
+        if (defined('MCRYPT_DEV_RANDOM')) {
+            return MCRYPT_DEV_RANDOM;
+        }
+
+        mt_srand();
+
+        return MCRYPT_RAND;
+    }
+}

storage/app/backups/.gitignore

@@ -1,2 +1,3 @@
 *
 !.gitignore
+!env-backups

storage/app/backups/env-backups/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore