swaroop: encrypt decryption private key with motherboard UUID.

[dcpomatic.git] / src / lib / config.cc

diff --git a/src/lib/config.cc b/src/lib/config.cc
index 1a503addeee8ceb4faad894646335ee70b11b1dd..172890dcfbc34610a83a1d5b26ec64cdd0a6108f 100644 (file)
--- a/src/lib/config.cc
+++ b/src/lib/config.cc
@@ -32,6 +32,7 @@
 #include "film.h"
 #include "dkdm_wrapper.h"
 #include "compose.hpp"
+#include "crypto.h"
 #include <dcp/raw_convert.h>
 #include <dcp/name_format.h>
 #include <dcp/certificate_chain.h>
@@ -61,6 +62,7 @@ using boost::shared_ptr;
 using boost::optional;
 using boost::dynamic_pointer_cast;
 using boost::algorithm::trim;
+using boost::shared_array;
 using dcp::raw_convert;
 
 Config* Config::_instance = 0;
@@ -176,7 +178,6 @@ Config::set_defaults ()
        _player_watermark_theatre = "";
        _player_watermark_period = 1;
        _player_watermark_duration = 50;
-       _allow_spl_editing = true;
        _player_lock_file = boost::none;
 #endif
 
@@ -436,7 +437,19 @@ try
                BOOST_FOREACH (cxml::NodePtr i, decryption->node_children ("Certificate")) {
                        c->add (dcp::Certificate (i->content ()));
                }
-               c->set_key (decryption->string_child ("PrivateKey"));
+               optional<string> key = decryption->optional_string_child ("PrivateKey");
+#ifdef DCPOMATIC_VARIANT_SWAROOP
+               if (key) {
+                       c->set_key (*key);
+               } else {
+                       dcp::Data encrypted_key (path("private"));
+                       dcp::Data iv (path("iv"));
+                       c->set_key (dcpomatic::decrypt (encrypted_key, key_from_uuid(), iv));
+               }
+#else
+               DCPOMATIC_ASSERT (key);
+               c->set_key (*key);
+#endif
                _decryption_chain = c;
        } else {
                _decryption_chain = create_certificate_chain ();
@@ -529,7 +542,6 @@ try
        BOOST_FOREACH (cxml::ConstNodePtr i, f.node_children("RequiredMonitor")) {
                _required_monitors.push_back(Monitor(i));
        }
-       _allow_spl_editing = f.optional_bool_child("AllowSPLEditing").get_value_or(true);
        _player_lock_file = f.optional_string_child("PlayerLockFile");
 #endif
 
@@ -601,6 +613,19 @@ Config::write () const
        write_cinemas ();
 }
 
+#ifdef DCPOMATIC_VARIANT_SWAROOP
+/* Make up a key from the machine UUID */
+dcp::Data
+Config::key_from_uuid () const
+{
+       dcp::Data key (dcpomatic::crypto_key_length());
+       memset (key.data().get(), 0, key.size());
+       string const magic = command_and_read ("dcpomatic2_uuid");
+       strncpy ((char *) key.data().get(), magic.c_str(), dcpomatic::crypto_key_length());
+       return key;
+}
+#endif
+
 void
 Config::write_config () const
 {
@@ -781,7 +806,14 @@ Config::write_config () const
        BOOST_FOREACH (dcp::Certificate const & i, _decryption_chain->unordered()) {
                decryption->add_child("Certificate")->add_child_text (i.certificate (true));
        }
+#ifdef DCPOMATIC_VARIANT_SWAROOP
+       dcp::Data iv = dcpomatic::random_iv ();
+       dcp::Data encrypted_key = dcpomatic::encrypt (_decryption_chain->key().get(), key_from_uuid(), iv);
+       encrypted_key.write (path("private"));
+       iv.write (path("iv"));
+#else
        decryption->add_child("PrivateKey")->add_child_text (_decryption_chain->key().get ());
+#endif
 
        /* [XML] History Filename of DCP to present in the <guilabel>File</guilabel> menu of the GUI; there can be more than one
           of these tags.
@@ -943,18 +975,28 @@ Config::write_config () const
        BOOST_FOREACH (Monitor i, _required_monitors) {
                i.as_xml(root->add_child("RequiredMonitor"));
        }
-       root->add_child("AllowSPLEditing")->add_child_text(_allow_spl_editing ? "1" : "0");
        if (_player_lock_file) {
                root->add_child("PlayerLockFile")->add_child_text(_player_lock_file->string());
        }
 #endif
 
        try {
-               doc.write_to_file_formatted(config_file().string());
+               string const s = doc.write_to_string_formatted ();
+               boost::filesystem::path const cf = config_file ();
+               FILE* f = fopen_boost (cf, "w");
+               if (!f) {
+                       throw FileError (_("Could not open file for writing"), cf);
+               }
+               size_t const w = fwrite (s.c_str(), 1, s.length(), f);
+               if (w != s.length()) {
+                       fclose (f);
+                       throw FileError (_("Could not write whole file"), cf);
+               }
+               fclose (f);
        } catch (xmlpp::exception& e) {
                string s = e.what ();
                trim (s);
-               throw FileError (s, path("config.xml"));
+               throw FileError (s, config_file());
        }
 }