Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug]: Encryption keys are not renamed when a file is renamed if encryption is disabled #31083

Closed
4 tasks done
artonge opened this issue Feb 9, 2022 · 1 comment
Closed
4 tasks done

[Bug]: Encryption keys are not renamed when a file is renamed if encryption is disabled #31083

artonge opened this issue Feb 9, 2022 · 1 comment
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap bug feature: encryption (server-side) needs info

Comments

@artonge
Copy link
Contributor

artonge commented Feb 9, 2022 •
edited
Loading

⚠️ This issue respects the following points: ⚠️

  • This is a bug, not a question or a configuration/webserver/proxy issue.
  • This issue is not already reported on Github (I've searched it).
  • Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
  • I agree to follow Nextcloud's Code of Conduct.

Bug description

When encryption is disabled, the encryption keys of encrypted files are not renamed during the rename operation. Nextcloud then fails to decrypt the files as it can't find the keys.

  • Same error if the file is moved.
  • If a parent folder is moved, the key is not moved, but the file can be opened.
  • If a parent folder is renamed, the key is not renamed, but the file can be opened.

Steps to reproduce

  1. Enable encryption
  2. Create some encrypted files
  3. Disabled encryption
  4. Rename those files
  5. Try to access the files
  6. See Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you. in nextcloud.log

Expected behaviour

Either:

  1. Block renaming encrypted files when encryption is disabled.
  2. Block access to encrypted files when encryption is disabled.
  3. Correctly move encryption keys when encryption is disabled.

Installation method

All.

Is this bug present after an update or on a fresh install?

Fresh install.

Are you using the Nextcloud Server Encryption module?

Yes.

List of activated Apps

Enabled:
...
  - encryption: 2.12.0
...

Nextcloud Logs

{
	"reqId": "I4zkqkCFJP0RidwsCj42",
	"level": 3,
	"time": "2022-02-09T11:46:30+00:00",
	"remoteAddr": "127.0.0.1",
	"user": "admin",
	"app": "no app in context",
	"method": "MOVE",
	"url": "/remote.php/dav/files/admin/welcome.txt",
	"message": "Couldn't re-calculate unencrypted size for files_versions/welcome.txt.v1644404571",
	"userAgent": "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0",
	"version": "24.0.0.4"
}
{
	"reqId": "I4zkqkCFJP0RidwsCj42",
	"level": 3,
	"time": "2022-02-09T11:46:30+00:00",
	"remoteAddr": "127.0.0.1",
	"user": "admin",
	"app": "no app in context",
	"method": "MOVE",
	"url": "/remote.php/dav/files/admin/welcome.txt",
	"message": "Legacy cipher is no longer supported!",
	"userAgent": "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0",
	"version": "24.0.0.4",
	"exception": {
		"Exception": "OC\\ServerNotAvailableException",
		"Message": "Legacy cipher is no longer supported!",
		"Code": 0,
		"Trace": [
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/encryption/lib/Crypto/Encryption.php",
				"line": 237,
				"function": "getLegacyCipher",
				"class": "OCA\\Encryption\\Crypto\\Crypt",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/Storage/Wrapper/Encryption.php",
				"line": 583,
				"function": "begin",
				"class": "OCA\\Encryption\\Crypto\\Encryption",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/Storage/Wrapper/Encryption.php",
				"line": 504,
				"function": "fixUnencryptedSize",
				"class": "OC\\Files\\Storage\\Wrapper\\Encryption",
				"type": "->",
				"args": [
					"*** sensitive parameters replaced ***"
				]
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/Storage/Wrapper/Encryption.php",
				"line": 168,
				"function": "verifyUnencryptedSize",
				"class": "OC\\Files\\Storage\\Wrapper\\Encryption",
				"type": "->",
				"args": [
					"*** sensitive parameters replaced ***"
				]
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/Storage/Wrapper/Wrapper.php",
				"line": 156,
				"function": "filesize",
				"class": "OC\\Files\\Storage\\Wrapper\\Encryption",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/View.php",
				"line": 1171,
				"function": "filesize",
				"class": "OC\\Files\\Storage\\Wrapper\\Wrapper",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/View.php",
				"line": 414,
				"function": "basicOperation",
				"class": "OC\\Files\\View",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/files_versions/lib/Storage.php",
				"line": 491,
				"function": "filesize",
				"class": "OC\\Files\\View",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/files_versions/lib/Storage.php",
				"line": 311,
				"function": "getVersions",
				"class": "OCA\\Files_Versions\\Storage",
				"type": "::"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/files_versions/lib/Hooks.php",
				"line": 97,
				"function": "renameOrCopy",
				"class": "OCA\\Files_Versions\\Storage",
				"type": "::"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/legacy/OC_Hook.php",
				"line": 106,
				"function": "rename_hook",
				"class": "OCA\\Files_Versions\\Hooks",
				"type": "::"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/View.php",
				"line": 861,
				"function": "emit",
				"class": "OC_Hook",
				"type": "::"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/dav/lib/Connector/Sabre/Node.php",
				"line": 140,
				"function": "rename",
				"class": "OC\\Files\\View",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/sabre/dav/lib/DAV/Tree.php",
				"line": 153,
				"function": "setName",
				"class": "OCA\\DAV\\Connector\\Sabre\\Node",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",
				"line": 612,
				"function": "move",
				"class": "Sabre\\DAV\\Tree",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
				"line": 89,
				"function": "httpMove",
				"class": "Sabre\\DAV\\CorePlugin",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 472,
				"function": "emit",
				"class": "Sabre\\DAV\\Server",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 253,
				"function": "invokeMethod",
				"class": "Sabre\\DAV\\Server",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 321,
				"function": "start",
				"class": "Sabre\\DAV\\Server",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/dav/lib/Server.php",
				"line": 341,
				"function": "exec",
				"class": "Sabre\\DAV\\Server",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/dav/appinfo/v2/remote.php",
				"line": 35,
				"function": "exec",
				"class": "OCA\\DAV\\Server",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/remote.php",
				"line": 166,
				"args": [
					"/home/louis/workspace/nextcloud/instances/server2/apps/dav/appinfo/v2/remote.php"
				],
				"function": "require_once"
			}
		],
		"File": "/home/louis/workspace/nextcloud/instances/server2/apps/encryption/lib/Crypto/Crypt.php",
		"Line": 319,
		"CustomMessage": "--"
	}
}
{
	"reqId": "sN10GhQ2eCVtsg0Vb1nE",
	"level": 3,
	"time": "2022-02-09T11:46:33+00:00",
	"remoteAddr": "127.0.0.1",
	"user": "admin",
	"app": "no app in context",
	"method": "PUT",
	"url": "/apps/text/session/create",
	"message": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",
	"userAgent": "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0",
	"version": "24.0.0.4"
}
{
	"reqId": "sN10GhQ2eCVtsg0Vb1nE",
	"level": 3,
	"time": "2022-02-09T11:46:33+00:00",
	"remoteAddr": "127.0.0.1",
	"user": "admin",
	"app": "text",
	"method": "PUT",
	"url": "/apps/text/session/create",
	"message": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",
	"userAgent": "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0",
	"version": "24.0.0.4",
	"exception": {
		"Exception": "OC\\Encryption\\Exceptions\\DecryptionFailedException",
		"Message": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",
		"Code": 0,
		"Trace": [
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/Stream/Encryption.php",
				"line": 519,
				"function": "decrypt",
				"class": "OCA\\Encryption\\Crypto\\Encryption",
				"type": "->",
				"args": [
					"*** sensitive parameters replaced ***"
				]
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/Stream/Encryption.php",
				"line": 317,
				"function": "readCache",
				"class": "OC\\Files\\Stream\\Encryption",
				"type": "->"
			},
			{
				"function": "stream_read",
				"class": "OC\\Files\\Stream\\Encryption",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/icewind/streams/src/Wrapper.php",
				"line": 55,
				"function": "fread"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/3rdparty/icewind/streams/src/CallbackWrapper.php",
				"line": 96,
				"function": "stream_read",
				"class": "Icewind\\Streams\\Wrapper",
				"type": "->"
			},
			{
				"function": "stream_read",
				"class": "Icewind\\Streams\\CallbackWrapper",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/legacy/OC_Helper.php",
				"line": 259,
				"function": "fread"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/View.php",
				"line": 684,
				"function": "streamCopy",
				"class": "OC_Helper",
				"type": "::"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/Node/Folder.php",
				"line": 198,
				"function": "file_put_contents",
				"class": "OC\\Files\\View",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Files/SimpleFS/NewSimpleFile.php",
				"line": 133,
				"function": "newFile",
				"class": "OC\\Files\\Node\\Folder",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/text/lib/Service/DocumentService.php",
				"line": 164,
				"function": "putContent",
				"class": "OC\\Files\\SimpleFS\\NewSimpleFile",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/text/lib/Service/ApiService.php",
				"line": 102,
				"function": "createDocument",
				"class": "OCA\\Text\\Service\\DocumentService",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/apps/text/lib/Controller/SessionController.php",
				"line": 50,
				"function": "create",
				"class": "OCA\\Text\\Service\\ApiService",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/AppFramework/Http/Dispatcher.php",
				"line": 217,
				"function": "create",
				"class": "OCA\\Text\\Controller\\SessionController",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/AppFramework/Http/Dispatcher.php",
				"line": 126,
				"function": "executeController",
				"class": "OC\\AppFramework\\Http\\Dispatcher",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/AppFramework/App.php",
				"line": 157,
				"function": "dispatch",
				"class": "OC\\AppFramework\\Http\\Dispatcher",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/private/Route/Router.php",
				"line": 302,
				"function": "main",
				"class": "OC\\AppFramework\\App",
				"type": "::"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/lib/base.php",
				"line": 1009,
				"function": "match",
				"class": "OC\\Route\\Router",
				"type": "->"
			},
			{
				"file": "/home/louis/workspace/nextcloud/instances/server2/index.php",
				"line": 36,
				"function": "handleRequest",
				"class": "OC",
				"type": "::"
			}
		],
		"File": "/home/louis/workspace/nextcloud/instances/server2/apps/encryption/lib/Crypto/Encryption.php",
		"Line": 374,
		"Hint": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",
		"CustomMessage": "--"
	}
}
@artonge artonge changed the title [Bug]: Encryption keys are not copied on rename if encryption is disabled [Bug]: Encryption keys are not renamed when a file is renamed if encryption is disabled Feb 9, 2022
artonge added a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge
Warn about disabling encryption withou decrypting all the files
260b2e3 
See: nextcloud/server#31083
@artonge artonge mentioned this issue Feb 9, 2022
Merged
artonge added a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge
Warn about disabling encryption without decrypting all the files
8967381 
See: nextcloud/server#31083
Signed-off-by: Louis Chemineau <louis@chmn.me>
artonge added a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge
Warn about disabling encryption without decrypting all the files
612f801 
See: nextcloud/server#31083
Signed-off-by: Louis Chemineau <louis@chmn.me>
artonge added a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge
Warn about disabling encryption without decrypting all the files
925cec6 
See: nextcloud/server#31083
Signed-off-by: Louis Chemineau <louis@chmn.me>
artonge added a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge
Warn about disabling encryption without decrypting all the files
01a746a 
See: nextcloud/server#31083
Signed-off-by: Louis Chemineau <louis@chmn.me>
backportbot-nextcloud bot pushed a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge @backportbot
Warn about disabling encryption without decrypting all the files
6eee1f5 
See: nextcloud/server#31083
Signed-off-by: Louis Chemineau <louis@chmn.me>
backportbot-nextcloud bot pushed a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge @backportbot
Warn about disabling encryption without decrypting all the files
eea761b 
See: nextcloud/server#31083
Signed-off-by: Louis Chemineau <louis@chmn.me>
backportbot-nextcloud bot pushed a commit to nextcloud/documentation that referenced this issue Feb 9, 2022
@artonge @backportbot
Warn about disabling encryption without decrypting all the files
e50cce8 
See: nextcloud/server#31083
Signed-off-by: Louis Chemineau <louis@chmn.me>
@szaimen
Copy link
Contributor

szaimen commented Jan 23, 2023

Hi, please update to 24.0.9 or better 25.0.3 and report back if it fixes the issue. Thank you!

My goal is to add a label like e.g. 25-feedback to this ticket of an up-to-date major Nextcloud version where the bug could be reproduced. However this is not going to work without your help. So thanks for all your effort!

If you don't manage to reproduce the issue in time and the issue gets closed but you can reproduce the issue afterwards, feel free to create a new bug report with up-to-date information by following this link: https://github.com/nextcloud/server/issues/new?assignees=&labels=bug%2C0.+Needs+triage&template=BUG_REPORT.yml&title=%5BBug%5D%3A+

@szaimen szaimen added needs info 0. Needs triage Pending check for reproducibility or if it fits our roadmap labels Jan 23, 2023
@szaimen szaimen closed this as completed Mar 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap bug feature: encryption (server-side) needs info
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@artonge @szaimen