encrypt user-uploaded payloads and decrypt on read

[uruwhy]

Description

Encrypt user-provided payloads on disk in data/payloads and have the file_svc decrypt them in memory when reading from disk. This avoids attack vectors that attempt to import user-provided python modules from disk.

The encryption methodology generates a random 32-byte AES key and 16-byte IV for each payload and prepends the ciphertext with an encryption flag (marking the file as an encrypted user-provided payload and distinguishing it from typical CALDERA-encrypted files), the key, and IV. The key is embedded in the ciphertext blob on disk because the purpose is not to secure the payload contents but rather to prevent the files on disk from being directly executed. Keys are generated separately from the caldera configuration to allow user-provided payloads to still be accessible if the crypt/salt values in the caldera config change for any reason.

Existing user payloads that were uploaded prior to this change will not be affected

Also adds additional payload API unit test coverage and addresses some warnings

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Unit tests, tested with local caldera installation (uploaded payloads via curl and UI)

# Upload
curl -s -X POST http://localhost:8888/api/v2/payloads -H "KEY: ADMIN123" -F "file=@testpythonpayload.py"

# Confirm encrypted contents
hexdump -C data/payloads/testpythonpayload.py 

# Fetch uploaded payload
curl http://localhost:8888/file/download -H "file: testpythonpayload.py" -o testdownload
diff testdownload testpythonpayload.py

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
93.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
93.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud