Feature/e2ee use hardware token secure storage #5877
Commits on Oct 2, 2024
-
add support to use PKCS#11 harware token to store certifice for e2ee
Close #5685 Signed-off-by: Matthieu Gallien <[email protected]>
-
add support to use PKCS#11 harware token to store certifice for e2ee
Close #5685 Signed-off-by: Matthieu Gallien <[email protected]>
-
temporarily do not check for the certificate fingerprints
Signed-off-by: Matthieu Gallien <[email protected]>
-
libp11 dependency for USB token is really mandatory
Signed-off-by: Matthieu Gallien <[email protected]>
-
fix compilation by exporting a newly needed function
Signed-off-by: Matthieu Gallien <[email protected]>
-
improve logs when build with NEXTCLOUD_DEV enabled
Signed-off-by: Matthieu Gallien <[email protected]>
-
better memory management and better logs for end-to-end encryption
Signed-off-by: Matthieu Gallien <[email protected]>
-
fix memory issue ibetween list of token slots and the libp11 context
Signed-off-by: Matthieu Gallien <[email protected]>
-
ensure sane error handling when trying to setup encryption
if we cannot encrypt because that is not working or because we lack keys and certificate needed to enable the feature makes no difference Signed-off-by: Matthieu Gallien <[email protected]>
-
clearly indicate in logs which is the selected certificate
Signed-off-by: Matthieu Gallien <[email protected]>
-
do not claim a certificate migration is needed when it is not the case
ensure we do not emit a "certificate migration is needed" signal when this is not the case Signed-off-by: Matthieu Gallien <[email protected]>
-
clean public API that could be misused in ClientSideEncryptionTokenSe…
…lector will prevent access to internal objects not meant for reuse outside internal code Signed-off-by: Matthieu Gallien <[email protected]>
-
improve logs when checking that encryption is working reliably
better check that PKCS11 keys can be converted to use them improve logs to be able to get a better insight on crypto operations during testing of crypto improve some API method names fix some log output that were using teh worng category Signed-off-by: Matthieu Gallien <[email protected]>
-
instead of using PKCS#11 API to get public key, read it from certificate
should avoid calling a crash prone libp11 API to get public key from hardware token Signed-off-by: Matthieu Gallien <[email protected]>
-
upload user certificate after end-to-end init with token storage
even if the certificate already exists abnd is stored on USB token hardware, we need to upload the certificate to allow sharing between users Signed-off-by: Matthieu Gallien <[email protected]>
-
remove duplicated confusing encryption helper methods
should make it clearer what is the code and encryption keys and settings in use should make the code simpler to read and follow Signed-off-by: Matthieu Gallien <[email protected]>
-
use the proper certificate when encrypting metadata when sharing
this used to rely on a QSslKey object to convey the receiving user of a shared folder encryption material because we added CertificateInformation that is more generic and can work with USB token hardware stored private keys or pure software keys, we want to use that instead of a simple QSslKey Signed-off-by: Matthieu Gallien <[email protected]>
-
fix issues reported by clazy with default configuration
Signed-off-by: Matthieu Gallien <[email protected]>
-
prevent stack overflow when creating the systray via singleton access
will fix some automated tests failing due to stack overflow when creating `ActivityListModel` instances Signed-off-by: Matthieu Gallien <[email protected]>
-
allow to start with an expired certificate: migration will be needed
I may need to ensure other parts behave as expected in case we can only decrypt but not encrypt Signed-off-by: Matthieu Gallien <[email protected]>
-
when discovering certificates: forget previously known ones
the previous certificates were linked to a now invalid libp11 context using any of them will lead to troubles Signed-off-by: Matthieu Gallien <[email protected]>
-
allow on the fly migration of encryption certificate
if you use a new certificate and access metadata of an older one, we pick up this previous certificate to access the metadata Signed-off-by: Matthieu Gallien <[email protected]>
-
fix live migration between certificates and improve logs
Signed-off-by: Matthieu Gallien <[email protected]>
-
for now remove this assert until we better understand
Signed-off-by: Matthieu Gallien <[email protected]>
