Skip to content

GUACAMOLE-1286: Add support for providing a custom IV. #1153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
necouchman wants to merge 1 commit into
base: main
Choose a base branch
from
Open

GUACAMOLE-1286: Add support for providing a custom IV. #1153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions ...sions/guacamole-auth-json/src/main/java/org/apache/guacamole/auth/json/CryptoService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@

package org.apache.guacamole.auth.json;

import com.google.common.io.BaseEncoding;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.Key;
Expand Down Expand Up @@ -73,7 +74,7 @@ public class CryptoService {
* HMAC signature itself as the IV. For our purposes, where the encrypted
* value becomes an authentication token, this is OK.
*/
private static final IvParameterSpec NULL_IV = new IvParameterSpec(new byte[] {
public static final IvParameterSpec NULL_IV = new IvParameterSpec(new byte[] {
0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0
});
Expand Down Expand Up @@ -125,6 +126,9 @@ public SecretKey createSignatureKey(byte[] keyBytes) {
*
* @param cipherText
* The ciphertext to decrypt.
*
* @param ivStr
* The IV to use for decrypting the ciphertext.
*
* @return
* The plaintext which results from decrypting the ciphertext with the
Expand All @@ -133,13 +137,25 @@ public SecretKey createSignatureKey(byte[] keyBytes) {
* @throws GuacamoleException
* If any error at all occurs during decryption.
*/
public byte[] decrypt(Key key, byte[] cipherText) throws GuacamoleException {
public byte[] decrypt(Key key, byte[] cipherText, String ivStr)
throws GuacamoleException {

try {

// Use NULL_IV by default, but, if an IV has been provided as
// part of the request, use that, instead.
IvParameterSpec iv = NULL_IV;
if (ivStr != null && !ivStr.isEmpty()) {
byte[] ivBytes = BaseEncoding.base64().decode(ivStr);

@eugen-keeper eugen-keeper Jun 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can throw IllegalArgumentException for malformed ivStr base64, but that exception is not handled here. It propagates to UserDataService.fromCredentials(), where the existing catch (IllegalArgumentException) logs Submitted data is not proper base64, which is misleading when only iv is invalid. Maybe consider catching IllegalArgumentException here and rethrowing as GuacamoleServerException("Invalid IV provided.").

if (ivBytes.length == 16)
iv = new IvParameterSpec(ivBytes);
else
throw new GuacamoleServerException("Invalid IV provided.");
}

// Init cipher for descryption using secret key
Cipher cipher = Cipher.getInstance(DECRYPTION_CIPHER_NAME);
cipher.init(Cipher.DECRYPT_MODE, key, NULL_IV);
cipher.init(Cipher.DECRYPT_MODE, key, iv);

// Perform decryption
return cipher.doFinal(cipherText);
Expand Down
13 changes: 12 additions & 1 deletion ...uacamole-auth-json/src/main/java/org/apache/guacamole/auth/json/user/UserDataService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,13 @@ public class UserDataService {
* HMAC/SHA-256.
*/
public static final String ENCRYPTED_DATA_PARAMETER = "data";

/**
* The name of the HTTP parameter from which the cryptographic IV should be
* read, if provided with the query. If this parameter is not provided, the
* {@link CryptoService#NULL_IV} will be used.
*/
public static final String ENCRYPTED_IV_PARAMETER = "iv";

/**
* Derives a new UserData object from the data contained within the given
Expand Down Expand Up @@ -129,14 +136,18 @@ public UserData fromCredentials(Credentials credentials) {
String base64 = credentials.getParameter(ENCRYPTED_DATA_PARAMETER);
if (base64 == null)
return null;

// Get the IV string from the credentials
String ivStr = credentials.getParameter(ENCRYPTED_IV_PARAMETER);

// Decrypt base64-encoded parameter
try {

// Decrypt using defined encryption key
byte[] decrypted = cryptoService.decrypt(
cryptoService.createEncryptionKey(confService.getSecretKey()),
BaseEncoding.base64().decode(base64)
BaseEncoding.base64().decode(base64),
ivStr
);

// Abort if decrypted value cannot possibly have a signature AND data
Expand Down