fall back to the ownCloud default encryption module and aes128 if we read a encrypted file without a header

3 files changed, 38 insertions, 15 deletions

diff --git a/lib/private/files/storage/wrapper/encryption.php b/lib/private/files/storage/wrapper/encryption.php
index 0dc59cbb2a0..5e96f50f914 100644
--- a/lib/private/files/storage/wrapper/encryption.php
+++ b/lib/private/files/storage/wrapper/encryption.php
@@ -162,8 +162,9 @@ class Encryption extends Wrapper {
 	public function file_get_contents($path) {
 
 		$encryptionModule = $this->getEncryptionModule($path);
+		$info = $this->getCache()->get($path);
 
-		if ($encryptionModule) {
+		if ($encryptionModule || $info['encrypted'] === true) {
 			$handle = $this->fopen($path, "r");
 			if (!$handle) {
 				return false;
@@ -283,7 +284,8 @@ class Encryption extends Wrapper {
 		$encryptionEnabled = $this->encryptionManager->isEnabled();
 		$shouldEncrypt = false;
 		$encryptionModule = null;
-		$header = $this->getHeader($path);
+		$rawHeader = $this->getHeader($path);
+		$header = $this->util->readHeader($rawHeader);
 		$fullPath = $this->getFullPath($path);
 		$encryptionModuleId = $this->util->getEncryptionModuleId($header);
 
@@ -319,10 +321,18 @@ class Encryption extends Wrapper {
 					$shouldEncrypt = $encryptionModule->shouldEncrypt($fullPath);
 				}
 			} else {
+				$info = $this->getCache()->get($path);
 				// only get encryption module if we found one in the header
+				// or if file should be encrypted according to the file cache
 				if (!empty($encryptionModuleId)) {
 					$encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
 					$shouldEncrypt = true;
+				} else if(empty($encryptionModuleId) && $info['encrypted'] === true) {
+					// we come from a old installation. No header and/or no module defined
+					// but the file is encrypted. In this case we need to use the
+					// OC_DEFAULT_MODULE to read the file
+					$encryptionModule = $this->encryptionManager->getEncryptionModule('OC_DEFAULT_MODULE');
+					$shouldEncrypt = true;
 				}
 			}
 		} catch (ModuleDoesNotExistsException $e) {
@@ -341,7 +351,7 @@ class Encryption extends Wrapper {
 			$source = $this->storage->fopen($path, $mode);
 			$handle = \OC\Files\Stream\Encryption::wrap($source, $path, $fullPath, $header,
 				$this->uid, $encryptionModule, $this->storage, $this, $this->util, $this->fileHelper, $mode,
-				$size, $unencryptedSize);
+				$size, $unencryptedSize, strlen($rawHeader));
 			return $handle;
 		} else {
 			return $this->storage->fopen($path, $mode);
@@ -419,10 +429,13 @@ class Encryption extends Wrapper {
 		$header = '';
 		if ($this->storage->file_exists($path)) {
 			$handle = $this->storage->fopen($path, 'r');
-			$header = fread($handle, $this->util->getHeaderSize());
+			$firstBlock = fread($handle, $this->util->getHeaderSize());
 			fclose($handle);
+			if (substr($firstBlock, 0, strlen(Util::HEADER_START)) === Util::HEADER_START) {
+				$header = $firstBlock;
+			}
 		}
-		return $this->util->readHeader($header);
+		return $header;
 	}
 
 	/**
@@ -435,7 +448,8 @@ class Encryption extends Wrapper {
 	 */
 	protected function getEncryptionModule($path) {
 		$encryptionModule = null;
-		$header = $this->getHeader($path);
+		$rawHeader = $this->getHeader($path);
+		$header = $this->util->readHeader($rawHeader);
 		$encryptionModuleId = $this->util->getEncryptionModuleId($header);
 		if (!empty($encryptionModuleId)) {
 			try {
diff --git a/lib/private/files/stream/encryption.php b/lib/private/files/stream/encryption.php
index 5f39207db87..0262405f367 100644
--- a/lib/private/files/stream/encryption.php
+++ b/lib/private/files/stream/encryption.php
@@ -59,6 +59,9 @@ class Encryption extends Wrapper {
 	protected $unencryptedSize;
 
 	/** @var integer */
+	protected $headerSize;
+
+	/** @var integer */
 	protected $unencryptedBlockSize;
 
 	/** @var array */
@@ -104,7 +107,8 @@ class Encryption extends Wrapper {
 			'util',
 			'size',
 			'unencryptedSize',
-			'encryptionStorage'
+			'encryptionStorage',
+			'headerSize'
 		);
 	}
 
@@ -125,6 +129,7 @@ class Encryption extends Wrapper {
 	 * @param string $mode
 	 * @param int $size
 	 * @param int $unencryptedSize
+	 * @param int $headerSize
 	 * @return resource
 	 *
 	 * @throws \BadMethodCallException
@@ -138,7 +143,8 @@ class Encryption extends Wrapper {
 								 \OC\Encryption\File $file,
 								$mode,
 								$size,
-								$unencryptedSize) {
+								$unencryptedSize,
+								$headerSize) {
 
 		$context = stream_context_create(array(
 			'ocencryption' => array(
@@ -153,7 +159,8 @@ class Encryption extends Wrapper {
 				'file' => $file,
 				'size' => $size,
 				'unencryptedSize' => $unencryptedSize,
-				'encryptionStorage' => $encStorage
+				'encryptionStorage' => $encStorage,
+				'headerSize' => $headerSize
 			)
 		));
 
@@ -235,7 +242,7 @@ class Encryption extends Wrapper {
 		}
 
 		$accessList = $this->file->getAccessList($sharePath);
-		$this->newHeader = $this->encryptionModule->begin($this->fullPath, $this->uid, $this->header, $accessList);
+		$this->newHeader = $this->encryptionModule->begin($this->fullPath, $this->uid, $mode, $this->header, $accessList);
 
 		if (
 			$mode === 'w'
@@ -246,7 +253,8 @@ class Encryption extends Wrapper {
 			// We're writing a new file so start write counter with 0 bytes
 			$this->unencryptedSize = 0;
 			$this->writeHeader();
-			$this->size = $this->util->getHeaderSize();
+			$this->headerSize = $this->util->getHeaderSize();
+			$this->size = $this->headerSize;
 		} else {
 			$this->skipHeader();
 		}
@@ -300,7 +308,7 @@ class Encryption extends Wrapper {
 			// for seekable streams the pointer is moved back to the beginning of the encrypted block
 			// flush will start writing there when the position moves to another block
 			$positionInFile = (int)floor($this->position / $this->unencryptedBlockSize) *
-				$this->util->getBlockSize() + $this->util->getHeaderSize();
+				$this->util->getBlockSize() + $this->headerSize;
 			$resultFseek = parent::stream_seek($positionInFile);
 
 			// only allow writes on seekable streams, or at the end of the encrypted stream
@@ -367,7 +375,7 @@ class Encryption extends Wrapper {
 		}
 
 		$newFilePosition = floor($newPosition / $this->unencryptedBlockSize)
-			* $this->util->getBlockSize() + $this->util->getHeaderSize();
+			* $this->util->getBlockSize() + $this->headerSize;
 
 		$oldFilePosition = parent::stream_tell();
 		if (parent::stream_seek($newFilePosition)) {
@@ -440,7 +448,7 @@ class Encryption extends Wrapper {
 	 * read first block to skip the header
 	 */
 	protected function skipHeader() {
-		parent::stream_read($this->util->getHeaderSize());
+		parent::stream_read($this->headerSize);
 	}
 
 }
diff --git a/lib/public/encryption/iencryptionmodule.php b/lib/public/encryption/iencryptionmodule.php
index dc55f8939ef..0dda042d759 100644
--- a/lib/public/encryption/iencryptionmodule.php
+++ b/lib/public/encryption/iencryptionmodule.php
@@ -50,6 +50,7 @@ interface IEncryptionModule {
 	 *
 	 * @param string $path to the file
 	 * @param string $user who read/write the file (null for public access)
+	 * @param string $mode php stream open mode
 	 * @param array $header contains the header data read from the file
 	 * @param array $accessList who has access to the file contains the key 'users' and 'public'
 	 *
@@ -58,7 +59,7 @@ interface IEncryptionModule {
 	 *                       or if no additional data is needed return a empty array
 	 * @since 8.1.0
 	 */
-	public function begin($path, $user, array $header, array $accessList);
+	public function begin($path, $user, $mode, array $header, array $accessList);
 
 	/**
 	 * last chunk received. This is the place where you can perform some final