org.glowroot.shaded.h2.tools.ChangeFileEncryption Maven / Gradle / Ivy
The newest version!
/*
* Copyright 2004-2013 H2 Group. Multiple-Licensed under the H2 License,
* Version 1.0, and under the Eclipse Public License, Version 1.0
* (http://h2database.com/html/license.html).
* Initial Developer: H2 Group
*/
package org.glowroot.shaded.h2.tools;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.nio.channels.FileChannel;
import java.sql.SQLException;
import java.util.ArrayList;
import org.glowroot.shaded.h2.engine.Constants;
import org.glowroot.shaded.h2.message.DbException;
import org.glowroot.shaded.h2.security.SHA256;
import org.glowroot.shaded.h2.store.FileLister;
import org.glowroot.shaded.h2.store.FileStore;
import org.glowroot.shaded.h2.store.fs.FileChannelInputStream;
import org.glowroot.shaded.h2.store.fs.FileChannelOutputStream;
import org.glowroot.shaded.h2.store.fs.FilePath;
import org.glowroot.shaded.h2.store.fs.FilePathEncrypt;
import org.glowroot.shaded.h2.store.fs.FileUtils;
import org.glowroot.shaded.h2.util.Tool;
/**
* Allows changing the database file encryption password or algorithm.
*
* This tool can not be used to change a password of a user.
* The database must be closed before using this tool.
* @h2.resource
*/
public class ChangeFileEncryption extends Tool {
private String directory;
private String cipherType;
private byte[] decrypt;
private byte[] encrypt;
private byte[] decryptKey;
private byte[] encryptKey;
/**
* Options are case sensitive. Supported options are:
*
* [-help] or [-?]
* Print the list of options [-cipher type]
* The encryption type (AES) [-dir <dir>]
* The database directory (default: .) [-db <database>]
* Database name (all databases if not set) [-decrypt <pwd>]
* The decryption password (if not set: not yet encrypted) [-encrypt <pwd>]
* The encryption password (if not set: do not encrypt) [-quiet]
* Do not print progress information
* @h2.resource
*
* @param args the command line arguments
*/
public static void main(String... args) throws SQLException {
new ChangeFileEncryption().runTool(args);
}
@Override
public void runTool(String... args) throws SQLException {
String dir = ".";
String cipher = null;
char[] decryptPassword = null;
char[] encryptPassword = null;
String db = null;
boolean quiet = false;
for (int i = 0; args != null && i < args.length; i++) {
String arg = args[i];
if (arg.equals("-dir")) {
dir = args[++i];
} else if (arg.equals("-cipher")) {
cipher = args[++i];
} else if (arg.equals("-db")) {
db = args[++i];
} else if (arg.equals("-decrypt")) {
decryptPassword = args[++i].toCharArray();
} else if (arg.equals("-encrypt")) {
encryptPassword = args[++i].toCharArray();
} else if (arg.equals("-quiet")) {
quiet = true;
} else if (arg.equals("-help") || arg.equals("-?")) {
showUsage();
return;
} else {
showUsageAndThrowUnsupportedOption(arg);
}
}
if ((encryptPassword == null && decryptPassword == null) || cipher == null) {
showUsage();
throw new SQLException(
"Encryption or decryption password not set, or cipher not set");
}
try {
process(dir, db, cipher, decryptPassword, encryptPassword, quiet);
} catch (Exception e) {
throw DbException.toSQLException(e);
}
}
/**
* Get the file encryption key for a given password. The password must be
* supplied as char arrays and is cleaned in this method.
*
* @param password the password as a char array
* @return the encryption key
*/
private static byte[] getFileEncryptionKey(char[] password) {
if (password == null) {
return null;
}
return SHA256.getKeyPasswordHash("file", password);
}
/**
* Changes the password for a database. The passwords must be supplied as
* char arrays and are cleaned in this method. The database must be closed
* before calling this method.
*
* @param dir the directory (. for the current directory)
* @param db the database name (null for all databases)
* @param cipher the cipher (AES)
* @param decryptPassword the decryption password as a char array
* @param encryptPassword the encryption password as a char array
* @param quiet don't print progress information
*/
public static void execute(String dir, String db, String cipher,
char[] decryptPassword, char[] encryptPassword, boolean quiet)
throws SQLException {
try {
new ChangeFileEncryption().process(dir, db, cipher,
decryptPassword, encryptPassword, quiet);
} catch (Exception e) {
throw DbException.toSQLException(e);
}
}
private void process(String dir, String db, String cipher,
char[] decryptPassword, char[] encryptPassword, boolean quiet)
throws SQLException {
dir = FileLister.getDir(dir);
ChangeFileEncryption change = new ChangeFileEncryption();
if (encryptPassword != null) {
for (char c : encryptPassword) {
if (c == ' ') {
throw new SQLException("The file password may not contain spaces");
}
}
change.encryptKey = FilePathEncrypt.getPasswordBytes(encryptPassword);
change.encrypt = getFileEncryptionKey(encryptPassword);
}
if (decryptPassword != null) {
change.decryptKey = FilePathEncrypt.getPasswordBytes(decryptPassword);
change.decrypt = getFileEncryptionKey(decryptPassword);
}
change.out = out;
change.directory = dir;
change.cipherType = cipher;
ArrayList files = FileLister.getDatabaseFiles(dir, db, true);
FileLister.tryUnlockDatabase(files, "encryption");
files = FileLister.getDatabaseFiles(dir, db, false);
if (files.size() == 0 && !quiet) {
printNoDatabaseFilesFound(dir, db);
}
// first, test only if the file can be renamed
// (to find errors with locked files early)
for (String fileName : files) {
String temp = dir + "/temp.db";
FileUtils.delete(temp);
FileUtils.moveTo(fileName, temp);
FileUtils.moveTo(temp, fileName);
}
// if this worked, the operation will (hopefully) be successful
// TODO changeFileEncryption: this is a workaround!
// make the operation atomic (all files or none)
for (String fileName : files) {
// Don't process a lob directory, just the files in the directory.
if (!FileUtils.isDirectory(fileName)) {
change.process(fileName);
}
}
}
private void process(String fileName) {
if (fileName.endsWith(Constants.SUFFIX_MV_FILE)) {
try {
copy(fileName);
} catch (IOException e) {
throw DbException.convertIOException(e,
"Error encrypting / decrypting file " + fileName);
}
return;
}
FileStore in;
if (decrypt == null) {
in = FileStore.open(null, fileName, "r");
} else {
in = FileStore.open(null, fileName, "r", cipherType, decrypt);
}
in.init();
copy(fileName, in, encrypt);
}
private void copy(String fileName) throws IOException {
if (FileUtils.isDirectory(fileName)) {
return;
}
FileChannel fileIn = FilePath.get(fileName).open("r");
FileChannel fileOut = null;
String temp = directory + "/temp.db";
try {
if (decryptKey != null) {
fileIn = new FilePathEncrypt.FileEncrypt(fileName, decryptKey, fileIn);
}
InputStream inStream = new FileChannelInputStream(fileIn, true);
FileUtils.delete(temp);
fileOut = FilePath.get(temp).open("rw");
if (encryptKey != null) {
fileOut = new FilePathEncrypt.FileEncrypt(temp, encryptKey, fileOut);
}
OutputStream outStream = new FileChannelOutputStream(fileOut, true);
byte[] buffer = new byte[4 * 1024];
long remaining = fileIn.size();
long total = remaining;
long time = System.currentTimeMillis();
while (remaining > 0) {
if (System.currentTimeMillis() - time > 1000) {
out.println(fileName + ": " + (100 - 100 * remaining / total) + "%");
time = System.currentTimeMillis();
}
int len = (int) Math.min(buffer.length, remaining);
len = inStream.read(buffer, 0, len);
outStream.write(buffer, 0, len);
remaining -= len;
}
inStream.close();
outStream.close();
} finally {
fileIn.close();
if (fileOut != null) {
fileOut.close();
}
}
FileUtils.delete(fileName);
FileUtils.moveTo(temp, fileName);
}
private void copy(String fileName, FileStore in, byte[] key) {
if (FileUtils.isDirectory(fileName)) {
return;
}
String temp = directory + "/temp.db";
FileUtils.delete(temp);
FileStore fileOut;
if (key == null) {
fileOut = FileStore.open(null, temp, "rw");
} else {
fileOut = FileStore.open(null, temp, "rw", cipherType, key);
}
fileOut.init();
byte[] buffer = new byte[4 * 1024];
long remaining = in.length() - FileStore.HEADER_LENGTH;
long total = remaining;
in.seek(FileStore.HEADER_LENGTH);
fileOut.seek(FileStore.HEADER_LENGTH);
long time = System.currentTimeMillis();
while (remaining > 0) {
if (System.currentTimeMillis() - time > 1000) {
out.println(fileName + ": " + (100 - 100 * remaining / total) + "%");
time = System.currentTimeMillis();
}
int len = (int) Math.min(buffer.length, remaining);
in.readFully(buffer, 0, len);
fileOut.write(buffer, 0, len);
remaining -= len;
}
in.close();
fileOut.close();
FileUtils.delete(fileName);
FileUtils.moveTo(temp, fileName);
}
}