package data import ( "crypto/aes" "crypto/cipher" "crypto/hmac" "crypto/rand" "crypto/sha256" "database/sql/driver" "encoding/base64" "encoding/json" "fmt" "io" "strings" "time" "github.com/araddon/dateparse" "github.com/ddworken/hishtory/shared" "github.com/google/uuid" "gorm.io/gorm" ) const ( KdfUserID = "user_id" KdfEncryptionKey = "encryption_key" ) type HistoryEntry struct { LocalUsername string `json:"local_username" gorm:"uniqueIndex:compositeindex"` Hostname string `json:"hostname" gorm:"uniqueIndex:compositeindex"` Command string `json:"command" gorm:"uniqueIndex:compositeindex"` CurrentWorkingDirectory string `json:"current_working_directory" gorm:"uniqueIndex:compositeindex"` HomeDirectory string `json:"home_directory" gorm:"uniqueIndex:compositeindex"` ExitCode int `json:"exit_code" gorm:"uniqueIndex:compositeindex"` StartTime time.Time `json:"start_time" gorm:"uniqueIndex:compositeindex"` EndTime time.Time `json:"end_time" gorm:"uniqueIndex:compositeindex"` DeviceId string `json:"device_id" gorm:"uniqueIndex:compositeindex"` CustomColumns CustomColumns `json:"custom_columns"` } type CustomColumns []CustomColumns type CustomColumn struct { Name string `json:"name"` Val string `json:"value"` } func (c *CustomColumns) Scan(value interface{}) error { bytes, ok := value.([]byte) if !ok { return fmt.Errorf("failed to unmarshal CustomColumns value %#v", value) } return json.Unmarshal(bytes, c) } func (c CustomColumns) Value() (driver.Value, error) { return json.Marshal(c) } func (h *HistoryEntry) GoString() string { return fmt.Sprintf("%#v", *h) } func sha256hmac(key, additionalData string) []byte { h := hmac.New(sha256.New, []byte(key)) h.Write([]byte(additionalData)) return h.Sum(nil) } func UserId(key string) string { return base64.URLEncoding.EncodeToString(sha256hmac(key, KdfUserID)) } func EncryptionKey(userSecret string) []byte { return sha256hmac(userSecret, KdfEncryptionKey) } func makeAead(userSecret string) (cipher.AEAD, error) { key := EncryptionKey(userSecret) block, err := aes.NewCipher(key) if err != nil { return nil, err } aead, err := cipher.NewGCM(block) if err != nil { return nil, err } return aead, nil } func Encrypt(userSecret string, data, additionalData []byte) ([]byte, []byte, error) { aead, err := makeAead(userSecret) if err != nil { return []byte{}, []byte{}, fmt.Errorf("failed to make AEAD: %v", err) } nonce := make([]byte, 12) if _, err := io.ReadFull(rand.Reader, nonce); err != nil { return []byte{}, []byte{}, fmt.Errorf("failed to read a nonce: %v", err) } ciphertext := aead.Seal(nil, nonce, data, additionalData) _, err = aead.Open(nil, nonce, ciphertext, additionalData) if err != nil { return []byte{}, []byte{}, fmt.Errorf("failed to open AEAD: %v", err) } return ciphertext, nonce, nil } func Decrypt(userSecret string, data, additionalData, nonce []byte) ([]byte, error) { aead, err := makeAead(userSecret) if err != nil { return []byte{}, fmt.Errorf("failed to make AEAD: %v", err) } plaintext, err := aead.Open(nil, nonce, data, additionalData) if err != nil { return []byte{}, fmt.Errorf("failed to decrypt: %v", err) } return plaintext, nil } func EncryptHistoryEntry(userSecret string, entry HistoryEntry) (shared.EncHistoryEntry, error) { data, err := json.Marshal(entry) if err != nil { return shared.EncHistoryEntry{}, err } ciphertext, nonce, err := Encrypt(userSecret, data, []byte(UserId(userSecret))) if err != nil { return shared.EncHistoryEntry{}, err } return shared.EncHistoryEntry{ EncryptedData: ciphertext, Nonce: nonce, UserId: UserId(userSecret), Date: entry.EndTime, EncryptedId: uuid.Must(uuid.NewRandom()).String(), ReadCount: 0, }, nil } func DecryptHistoryEntry(userSecret string, entry shared.EncHistoryEntry) (HistoryEntry, error) { if entry.UserId != UserId(userSecret) { return HistoryEntry{}, fmt.Errorf("refusing to decrypt history entry with mismatching UserId") } plaintext, err := Decrypt(userSecret, entry.EncryptedData, []byte(UserId(userSecret)), entry.Nonce) if err != nil { return HistoryEntry{}, nil } var decryptedEntry HistoryEntry err = json.Unmarshal(plaintext, &decryptedEntry) if err != nil { return HistoryEntry{}, nil } return decryptedEntry, nil } func parseTimeGenerously(input string) (time.Time, error) { input = strings.ReplaceAll(input, "_", " ") return dateparse.ParseLocal(input) } func MakeWhereQueryFromSearch(db *gorm.DB, query string) (*gorm.DB, error) { tokens, err := tokenize(query) if err != nil { return nil, fmt.Errorf("failed to tokenize query: %v", err) } tx := db.Model(&HistoryEntry{}).Where("true") for _, token := range tokens { if strings.HasPrefix(token, "-") { if strings.Contains(token, ":") { query, v1, v2, err := parseAtomizedToken(token[1:]) if err != nil { return nil, err } tx = tx.Where("NOT "+query, v1, v2) } else { query, v1, v2, v3, err := parseNonAtomizedToken(token[1:]) if err != nil { return nil, err } tx = tx.Where("NOT "+query, v1, v2, v3) } } else if strings.Contains(token, ":") { query, v1, v2, err := parseAtomizedToken(token) if err != nil { return nil, err } tx = tx.Where(query, v1, v2) } else { query, v1, v2, v3, err := parseNonAtomizedToken(token) if err != nil { return nil, err } tx = tx.Where(query, v1, v2, v3) } } return tx, nil } func Search(db *gorm.DB, query string, limit int) ([]*HistoryEntry, error) { tx, err := MakeWhereQueryFromSearch(db, query) if err != nil { return nil, err } tx = tx.Order("end_time DESC") if limit > 0 { tx = tx.Limit(limit) } var historyEntries []*HistoryEntry result := tx.Find(&historyEntries) if result.Error != nil { return nil, fmt.Errorf("DB query error: %v", result.Error) } return historyEntries, nil } func parseNonAtomizedToken(token string) (string, interface{}, interface{}, interface{}, error) { wildcardedToken := "%" + token + "%" return "(command LIKE ? OR hostname LIKE ? OR current_working_directory LIKE ?)", wildcardedToken, wildcardedToken, wildcardedToken, nil } func parseAtomizedToken(token string) (string, interface{}, interface{}, error) { splitToken := strings.SplitN(token, ":", 2) field := splitToken[0] val := splitToken[1] switch field { case "user": return "(local_username = ?)", val, nil, nil case "host": fallthrough case "hostname": return "(instr(hostname, ?) > 0)", val, nil, nil case "cwd": return "(instr(current_working_directory, ?) > 0 OR instr(REPLACE(current_working_directory, '~/', home_directory), ?) > 0)", strings.TrimSuffix(val, "/"), strings.TrimSuffix(val, "/"), nil case "exit_code": return "(exit_code = ?)", val, nil, nil case "before": t, err := parseTimeGenerously(val) if err != nil { return "", nil, nil, fmt.Errorf("failed to parse before:%s as a timestamp: %v", val, err) } return "(CAST(strftime(\"%s\",start_time) AS INTEGER) < ?)", t.Unix(), nil, nil case "after": t, err := parseTimeGenerously(val) if err != nil { return "", nil, nil, fmt.Errorf("failed to parse after:%s as a timestamp: %v", val, err) } return "(CAST(strftime(\"%s\",start_time) AS INTEGER) > ?)", t.Unix(), nil, nil default: return "", nil, nil, fmt.Errorf("search query contains unknown search atom %s", field) } } func tokenize(query string) ([]string, error) { if query == "" { return []string{}, nil } return strings.Split(query, " "), nil } func EntryEquals(entry1, entry2 HistoryEntry) bool { return entry1.LocalUsername == entry2.LocalUsername && entry1.Hostname == entry2.Hostname && entry1.Command == entry2.Command && entry1.CurrentWorkingDirectory == entry2.CurrentWorkingDirectory && entry1.HomeDirectory == entry2.HomeDirectory && entry1.ExitCode == entry2.ExitCode && entry1.StartTime.Format(time.RFC3339) == entry2.StartTime.Format(time.RFC3339) && entry1.EndTime.Format(time.RFC3339) == entry2.EndTime.Format(time.RFC3339) } func MakeFakeHistoryEntry(command string) HistoryEntry { return HistoryEntry{ LocalUsername: "david", Hostname: "localhost", Command: command, CurrentWorkingDirectory: "/tmp/", HomeDirectory: "/home/david/", ExitCode: 2, StartTime: time.Unix(1666068191, 0), EndTime: time.Now(), } }