From b952c49bdda3307f80cd818a3a060a448930393c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Garc=C3=ADa?= Date: Tue, 12 Nov 2024 19:26:40 +0100 Subject: [PATCH] Support SSH keys on desktop 2024.12 --- src/api/core/ciphers.rs | 26 +++++++++++++++++++++++--- src/api/core/organizations.rs | 18 ++++++++++-------- src/auth.rs | 24 +++++++++++++++++++++--- src/config.rs | 11 +++++++++-- src/db/models/cipher.rs | 5 ++++- 5 files changed, 67 insertions(+), 17 deletions(-) diff --git a/src/api/core/ciphers.rs b/src/api/core/ciphers.rs index 94bdc485..57d069b8 100644 --- a/src/api/core/ciphers.rs +++ b/src/api/core/ciphers.rs @@ -10,6 +10,7 @@ use rocket::{ }; use serde_json::Value; +use crate::auth::ClientVersion; use crate::util::NumberOrString; use crate::{ api::{self, core::log_event, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType}, @@ -104,11 +105,27 @@ struct SyncData { } #[get("/sync?")] -async fn sync(data: SyncData, headers: Headers, mut conn: DbConn) -> Json { +async fn sync( + data: SyncData, + headers: Headers, + client_version: Option, + mut conn: DbConn, +) -> Json { let user_json = headers.user.to_json(&mut conn).await; // Get all ciphers which are visible by the user - let ciphers = Cipher::find_by_user_visible(&headers.user.uuid, &mut conn).await; + let mut ciphers = Cipher::find_by_user_visible(&headers.user.uuid, &mut conn).await; + + // Filter out SSH keys if the client version is less than 2024.12.0 + let show_ssh_keys = if let Some(client_version) = client_version { + let ver_match = semver::VersionReq::parse(">=2024.12.0").unwrap(); + ver_match.matches(&client_version.0) + } else { + false + }; + if !show_ssh_keys { + ciphers.retain(|c| c.atype != 5); + } let cipher_sync_data = CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &mut conn).await; @@ -216,7 +233,8 @@ pub struct CipherData { Login = 1, SecureNote = 2, Card = 3, - Identity = 4 + Identity = 4, + SshKey = 5 */ pub r#type: i32, pub name: String, @@ -228,6 +246,7 @@ pub struct CipherData { secure_note: Option, card: Option, identity: Option, + ssh_key: Option, favorite: Option, reprompt: Option, @@ -469,6 +488,7 @@ pub async fn update_cipher_from_data( 2 => data.secure_note, 3 => data.card, 4 => data.identity, + 5 => data.ssh_key, _ => err!("Invalid type"), }; diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 402e7617..551676d6 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -9,7 +9,7 @@ use crate::{ core::{log_event, two_factor, CipherSyncData, CipherSyncType}, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType, }, - auth::{decode_invite, AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OwnerHeaders}, + auth::{decode_invite, AdminHeaders, ClientVersion, Headers, ManagerHeaders, ManagerHeadersLoose, OwnerHeaders}, db::{models::*, DbConn}, error::Error, mail, @@ -2999,18 +2999,20 @@ async fn put_reset_password_enrollment( // We need to convert all keys so they have the first character to be a lowercase. // Else the export will be just an empty JSON file. #[get("/organizations//export")] -async fn get_org_export(org_id: &str, headers: AdminHeaders, mut conn: DbConn) -> Json { - use semver::{Version, VersionReq}; - +async fn get_org_export( + org_id: &str, + headers: AdminHeaders, + client_version: Option, + mut conn: DbConn, +) -> Json { // Since version v2023.1.0 the format of the export is different. // Also, this endpoint was created since v2022.9.0. // Therefore, we will check for any version smaller then v2023.1.0 and return a different response. // If we can't determine the version, we will use the latest default v2023.1.0 and higher. // https://github.com/bitwarden/server/blob/9ca93381ce416454734418c3a9f99ab49747f1b6/src/Api/Controllers/OrganizationExportController.cs#L44 - let use_list_response_model = if let Some(client_version) = headers.client_version { - let ver_match = VersionReq::parse("<2023.1.0").unwrap(); - let client_version = Version::parse(&client_version).unwrap(); - ver_match.matches(&client_version) + let use_list_response_model = if let Some(client_version) = client_version { + let ver_match = semver::VersionReq::parse("<2023.1.0").unwrap(); + ver_match.matches(&client_version.0) } else { false }; diff --git a/src/auth.rs b/src/auth.rs index b1a743da..809ef9fd 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -615,7 +615,6 @@ pub struct AdminHeaders { pub device: Device, pub user: User, pub org_user_type: UserOrgType, - pub client_version: Option, pub ip: ClientIp, } @@ -625,14 +624,12 @@ impl<'r> FromRequest<'r> for AdminHeaders { async fn from_request(request: &'r Request<'_>) -> Outcome { let headers = try_outcome!(OrgHeaders::from_request(request).await); - let client_version = request.headers().get_one("Bitwarden-Client-Version").map(String::from); if headers.org_user_type >= UserOrgType::Admin { Outcome::Success(Self { host: headers.host, device: headers.device, user: headers.user, org_user_type: headers.org_user_type, - client_version, ip: headers.ip, }) } else { @@ -900,3 +897,24 @@ impl<'r> FromRequest<'r> for WsAccessTokenHeader { }) } } + +pub struct ClientVersion(pub semver::Version); + +#[rocket::async_trait] +impl<'r> FromRequest<'r> for ClientVersion { + type Error = &'static str; + + async fn from_request(request: &'r Request<'_>) -> Outcome { + let headers = request.headers(); + + let Some(version) = headers.get_one("Bitwarden-Client-Version") else { + err_handler!("No Bitwarden-Client-Version header provided") + }; + + let Ok(version) = semver::Version::parse(version) else { + err_handler!("Invalid Bitwarden-Client-Version header provided") + }; + + Outcome::Success(ClientVersion(version)) + } +} diff --git a/src/config.rs b/src/config.rs index 61a47b76..5a8ec85b 100644 --- a/src/config.rs +++ b/src/config.rs @@ -811,8 +811,15 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> { } // TODO: deal with deprecated flags so they can be removed from this list, cf. #4263 - const KNOWN_FLAGS: &[&str] = - &["autofill-overlay", "autofill-v2", "browser-fileless-import", "extension-refresh", "fido2-vault-credentials"]; + const KNOWN_FLAGS: &[&str] = &[ + "autofill-overlay", + "autofill-v2", + "browser-fileless-import", + "extension-refresh", + "fido2-vault-credentials", + "ssh-key-vault-item", + "ssh-agent", + ]; let configured_flags = parse_experimental_client_feature_flags(&cfg.experimental_client_feature_flags); let invalid_flags: Vec<_> = configured_flags.keys().filter(|flag| !KNOWN_FLAGS.contains(&flag.as_str())).collect(); if !invalid_flags.is_empty() { diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs index 9c568284..75d54df2 100644 --- a/src/db/models/cipher.rs +++ b/src/db/models/cipher.rs @@ -30,7 +30,8 @@ db_object! { Login = 1, SecureNote = 2, Card = 3, - Identity = 4 + Identity = 4, + SshKey = 5 */ pub atype: i32, pub name: String, @@ -319,6 +320,7 @@ impl Cipher { "secureNote": null, "card": null, "identity": null, + "sshKey": null, }); // These values are only needed for user/default syncs @@ -347,6 +349,7 @@ impl Cipher { 2 => "secureNote", 3 => "card", 4 => "identity", + 5 => "sshKey", _ => panic!("Wrong type"), };