aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/api/core/accounts.rs111
-rw-r--r--src/api/core/ciphers.rs26
-rw-r--r--src/api/core/organizations.rs18
-rw-r--r--src/auth.rs24
-rw-r--r--src/config.rs11
-rw-r--r--src/db/models/cipher.rs5
6 files changed, 154 insertions, 41 deletions
diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs
index 7c3919ad..1e89ea93 100644
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -1,3 +1,5 @@
+use std::collections::HashSet;
+
use crate::db::DbPool;
use chrono::Utc;
use rocket::serde::json::Json;
@@ -477,6 +479,60 @@ struct KeyData {
private_key: String,
}
+fn validate_keydata(
+ data: &KeyData,
+ existing_ciphers: &[Cipher],
+ existing_folders: &[Folder],
+ existing_emergency_access: &[EmergencyAccess],
+ existing_user_orgs: &[UserOrganization],
+ existing_sends: &[Send],
+) -> EmptyResult {
+ // Check that we're correctly rotating all the user's ciphers
+ let existing_cipher_ids = existing_ciphers.iter().map(|c| c.uuid.as_str()).collect::<HashSet<_>>();
+ let provided_cipher_ids = data
+ .ciphers
+ .iter()
+ .filter(|c| c.organization_id.is_none())
+ .filter_map(|c| c.id.as_deref())
+ .collect::<HashSet<_>>();
+ if !provided_cipher_ids.is_superset(&existing_cipher_ids) {
+ err!("All existing ciphers must be included in the rotation")
+ }
+
+ // Check that we're correctly rotating all the user's folders
+ let existing_folder_ids = existing_folders.iter().map(|f| f.uuid.as_str()).collect::<HashSet<_>>();
+ let provided_folder_ids = data.folders.iter().filter_map(|f| f.id.as_deref()).collect::<HashSet<_>>();
+ if !provided_folder_ids.is_superset(&existing_folder_ids) {
+ err!("All existing folders must be included in the rotation")
+ }
+
+ // Check that we're correctly rotating all the user's emergency access keys
+ let existing_emergency_access_ids =
+ existing_emergency_access.iter().map(|ea| ea.uuid.as_str()).collect::<HashSet<_>>();
+ let provided_emergency_access_ids =
+ data.emergency_access_keys.iter().map(|ea| ea.id.as_str()).collect::<HashSet<_>>();
+ if !provided_emergency_access_ids.is_superset(&existing_emergency_access_ids) {
+ err!("All existing emergency access keys must be included in the rotation")
+ }
+
+ // Check that we're correctly rotating all the user's reset password keys
+ let existing_reset_password_ids = existing_user_orgs.iter().map(|uo| uo.org_uuid.as_str()).collect::<HashSet<_>>();
+ let provided_reset_password_ids =
+ data.reset_password_keys.iter().map(|rp| rp.organization_id.as_str()).collect::<HashSet<_>>();
+ if !provided_reset_password_ids.is_superset(&existing_reset_password_ids) {
+ err!("All existing reset password keys must be included in the rotation")
+ }
+
+ // Check that we're correctly rotating all the user's sends
+ let existing_send_ids = existing_sends.iter().map(|s| s.uuid.as_str()).collect::<HashSet<_>>();
+ let provided_send_ids = data.sends.iter().filter_map(|s| s.id.as_deref()).collect::<HashSet<_>>();
+ if !provided_send_ids.is_superset(&existing_send_ids) {
+ err!("All existing sends must be included in the rotation")
+ }
+
+ Ok(())
+}
+
#[post("/accounts/key", data = "<data>")]
async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
// TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
@@ -494,20 +550,35 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,
let user_uuid = &headers.user.uuid;
+ // TODO: Ideally we'd do everything after this point in a single transaction.
+
+ let mut existing_ciphers = Cipher::find_owned_by_user(user_uuid, &mut conn).await;
+ let mut existing_folders = Folder::find_by_user(user_uuid, &mut conn).await;
+ let mut existing_emergency_access = EmergencyAccess::find_all_by_grantor_uuid(user_uuid, &mut conn).await;
+ let mut existing_user_orgs = UserOrganization::find_by_user(user_uuid, &mut conn).await;
+ // We only rotate the reset password key if it is set.
+ existing_user_orgs.retain(|uo| uo.reset_password_key.is_some());
+ let mut existing_sends = Send::find_by_user(user_uuid, &mut conn).await;
+
+ validate_keydata(
+ &data,
+ &existing_ciphers,
+ &existing_folders,
+ &existing_emergency_access,
+ &existing_user_orgs,
+ &existing_sends,
+ )?;
+
// Update folder data
for folder_data in data.folders {
// Skip `null` folder id entries.
// See: https://github.com/bitwarden/clients/issues/8453
if let Some(folder_id) = folder_data.id {
- let mut saved_folder = match Folder::find_by_uuid(&folder_id, &mut conn).await {
+ let saved_folder = match existing_folders.iter_mut().find(|f| f.uuid == folder_id) {
Some(folder) => folder,
None => err!("Folder doesn't exist"),
};
- if &saved_folder.user_uuid != user_uuid {
- err!("The folder is not owned by the user")
- }
-
saved_folder.name = folder_data.name;
saved_folder.save(&mut conn).await?
}
@@ -515,9 +586,8 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,
// Update emergency access data
for emergency_access_data in data.emergency_access_keys {
- let mut saved_emergency_access =
- match EmergencyAccess::find_by_uuid_and_grantor_uuid(&emergency_access_data.id, user_uuid, &mut conn).await
- {
+ let saved_emergency_access =
+ match existing_emergency_access.iter_mut().find(|ea| ea.uuid == emergency_access_data.id) {
Some(emergency_access) => emergency_access,
None => err!("Emergency access doesn't exist or is not owned by the user"),
};
@@ -528,13 +598,11 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,
// Update reset password data
for reset_password_data in data.reset_password_keys {
- let mut user_org =
- match UserOrganization::find_by_user_and_org(user_uuid, &reset_password_data.organization_id, &mut conn)
- .await
- {
- Some(reset_password) => reset_password,
- None => err!("Reset password doesn't exist"),
- };
+ let user_org = match existing_user_orgs.iter_mut().find(|uo| uo.org_uuid == reset_password_data.organization_id)
+ {
+ Some(reset_password) => reset_password,
+ None => err!("Reset password doesn't exist"),
+ };
user_org.reset_password_key = Some(reset_password_data.reset_password_key);
user_org.save(&mut conn).await?
@@ -542,12 +610,12 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,
// Update send data
for send_data in data.sends {
- let mut send = match Send::find_by_uuid(send_data.id.as_ref().unwrap(), &mut conn).await {
+ let send = match existing_sends.iter_mut().find(|s| &s.uuid == send_data.id.as_ref().unwrap()) {
Some(send) => send,
None => err!("Send doesn't exist"),
};
- update_send_from_data(&mut send, send_data, &headers, &mut conn, &nt, UpdateType::None).await?;
+ update_send_from_data(send, send_data, &headers, &mut conn, &nt, UpdateType::None).await?;
}
// Update cipher data
@@ -555,20 +623,15 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,
for cipher_data in data.ciphers {
if cipher_data.organization_id.is_none() {
- let mut saved_cipher = match Cipher::find_by_uuid(cipher_data.id.as_ref().unwrap(), &mut conn).await {
+ let saved_cipher = match existing_ciphers.iter_mut().find(|c| &c.uuid == cipher_data.id.as_ref().unwrap()) {
Some(cipher) => cipher,
None => err!("Cipher doesn't exist"),
};
- if saved_cipher.user_uuid.as_ref().unwrap() != user_uuid {
- err!("The cipher is not owned by the user")
- }
-
// Prevent triggering cipher updates via WebSockets by settings UpdateType::None
// The user sessions are invalidated because all the ciphers were re-encrypted and thus triggering an update could cause issues.
// We force the users to logout after the user has been saved to try and prevent these issues.
- update_cipher_from_data(&mut saved_cipher, cipher_data, &headers, None, &mut conn, &nt, UpdateType::None)
- .await?
+ update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &mut conn, &nt, UpdateType::None).await?
}
}
diff --git a/src/api/core/ciphers.rs b/src/api/core/ciphers.rs
index 94bdc485..57d069b8 100644
--- a/src/api/core/ciphers.rs
+++ b/src/api/core/ciphers.rs
@@ -10,6 +10,7 @@ use rocket::{
};
use serde_json::Value;
+use crate::auth::ClientVersion;
use crate::util::NumberOrString;
use crate::{
api::{self, core::log_event, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType},
@@ -104,11 +105,27 @@ struct SyncData {
}
#[get("/sync?<data..>")]
-async fn sync(data: SyncData, headers: Headers, mut conn: DbConn) -> Json<Value> {
+async fn sync(
+ data: SyncData,
+ headers: Headers,
+ client_version: Option<ClientVersion>,
+ mut conn: DbConn,
+) -> Json<Value> {
let user_json = headers.user.to_json(&mut conn).await;
// Get all ciphers which are visible by the user
- let ciphers = Cipher::find_by_user_visible(&headers.user.uuid, &mut conn).await;
+ let mut ciphers = Cipher::find_by_user_visible(&headers.user.uuid, &mut conn).await;
+
+ // Filter out SSH keys if the client version is less than 2024.12.0
+ let show_ssh_keys = if let Some(client_version) = client_version {
+ let ver_match = semver::VersionReq::parse(">=2024.12.0").unwrap();
+ ver_match.matches(&client_version.0)
+ } else {
+ false
+ };
+ if !show_ssh_keys {
+ ciphers.retain(|c| c.atype != 5);
+ }
let cipher_sync_data = CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &mut conn).await;
@@ -216,7 +233,8 @@ pub struct CipherData {
Login = 1,
SecureNote = 2,
Card = 3,
- Identity = 4
+ Identity = 4,
+ SshKey = 5
*/
pub r#type: i32,
pub name: String,
@@ -228,6 +246,7 @@ pub struct CipherData {
secure_note: Option<Value>,
card: Option<Value>,
identity: Option<Value>,
+ ssh_key: Option<Value>,
favorite: Option<bool>,
reprompt: Option<i32>,
@@ -469,6 +488,7 @@ pub async fn update_cipher_from_data(
2 => data.secure_note,
3 => data.card,
4 => data.identity,
+ 5 => data.ssh_key,
_ => err!("Invalid type"),
};
diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs
index 96ff9805..7ee6a089 100644
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
@@ -9,7 +9,7 @@ use crate::{
core::{log_event, two_factor, CipherSyncData, CipherSyncType},
EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
},
- auth::{decode_invite, AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OwnerHeaders},
+ auth::{decode_invite, AdminHeaders, ClientVersion, Headers, ManagerHeaders, ManagerHeadersLoose, OwnerHeaders},
db::{models::*, DbConn},
error::Error,
mail,
@@ -2999,18 +2999,20 @@ async fn put_reset_password_enrollment(
// We need to convert all keys so they have the first character to be a lowercase.
// Else the export will be just an empty JSON file.
#[get("/organizations/<org_id>/export")]
-async fn get_org_export(org_id: &str, headers: AdminHeaders, mut conn: DbConn) -> Json<Value> {
- use semver::{Version, VersionReq};
-
+async fn get_org_export(
+ org_id: &str,
+ headers: AdminHeaders,
+ client_version: Option<ClientVersion>,
+ mut conn: DbConn,
+) -> Json<Value> {
// Since version v2023.1.0 the format of the export is different.
// Also, this endpoint was created since v2022.9.0.
// Therefore, we will check for any version smaller then v2023.1.0 and return a different response.
// If we can't determine the version, we will use the latest default v2023.1.0 and higher.
// https://github.com/bitwarden/server/blob/9ca93381ce416454734418c3a9f99ab49747f1b6/src/Api/Controllers/OrganizationExportController.cs#L44
- let use_list_response_model = if let Some(client_version) = headers.client_version {
- let ver_match = VersionReq::parse("<2023.1.0").unwrap();
- let client_version = Version::parse(&client_version).unwrap();
- ver_match.matches(&client_version)
+ let use_list_response_model = if let Some(client_version) = client_version {
+ let ver_match = semver::VersionReq::parse("<2023.1.0").unwrap();
+ ver_match.matches(&client_version.0)
} else {
false
};
diff --git a/src/auth.rs b/src/auth.rs
index b1a743da..809ef9fd 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -615,7 +615,6 @@ pub struct AdminHeaders {
pub device: Device,
pub user: User,
pub org_user_type: UserOrgType,
- pub client_version: Option<String>,
pub ip: ClientIp,
}
@@ -625,14 +624,12 @@ impl<'r> FromRequest<'r> for AdminHeaders {
async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
let headers = try_outcome!(OrgHeaders::from_request(request).await);
- let client_version = request.headers().get_one("Bitwarden-Client-Version").map(String::from);
if headers.org_user_type >= UserOrgType::Admin {
Outcome::Success(Self {
host: headers.host,
device: headers.device,
user: headers.user,
org_user_type: headers.org_user_type,
- client_version,
ip: headers.ip,
})
} else {
@@ -900,3 +897,24 @@ impl<'r> FromRequest<'r> for WsAccessTokenHeader {
})
}
}
+
+pub struct ClientVersion(pub semver::Version);
+
+#[rocket::async_trait]
+impl<'r> FromRequest<'r> for ClientVersion {
+ type Error = &'static str;
+
+ async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
+ let headers = request.headers();
+
+ let Some(version) = headers.get_one("Bitwarden-Client-Version") else {
+ err_handler!("No Bitwarden-Client-Version header provided")
+ };
+
+ let Ok(version) = semver::Version::parse(version) else {
+ err_handler!("Invalid Bitwarden-Client-Version header provided")
+ };
+
+ Outcome::Success(ClientVersion(version))
+ }
+}
diff --git a/src/config.rs b/src/config.rs
index 244499d0..e4e80927 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -811,8 +811,15 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
}
// TODO: deal with deprecated flags so they can be removed from this list, cf. #4263
- const KNOWN_FLAGS: &[&str] =
- &["autofill-overlay", "autofill-v2", "browser-fileless-import", "extension-refresh", "fido2-vault-credentials"];
+ const KNOWN_FLAGS: &[&str] = &[
+ "autofill-overlay",
+ "autofill-v2",
+ "browser-fileless-import",
+ "extension-refresh",
+ "fido2-vault-credentials",
+ "ssh-key-vault-item",
+ "ssh-agent",
+ ];
let configured_flags = parse_experimental_client_feature_flags(&cfg.experimental_client_feature_flags);
let invalid_flags: Vec<_> = configured_flags.keys().filter(|flag| !KNOWN_FLAGS.contains(&flag.as_str())).collect();
if !invalid_flags.is_empty() {
diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs
index 9c568284..75d54df2 100644
--- a/src/db/models/cipher.rs
+++ b/src/db/models/cipher.rs
@@ -30,7 +30,8 @@ db_object! {
Login = 1,
SecureNote = 2,
Card = 3,
- Identity = 4
+ Identity = 4,
+ SshKey = 5
*/
pub atype: i32,
pub name: String,
@@ -319,6 +320,7 @@ impl Cipher {
"secureNote": null,
"card": null,
"identity": null,
+ "sshKey": null,
});
// These values are only needed for user/default syncs
@@ -347,6 +349,7 @@ impl Cipher {
2 => "secureNote",
3 => "card",
4 => "identity",
+ 5 => "sshKey",
_ => panic!("Wrong type"),
};
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 02:03:18 +0000