Merge concurrent saves on the server, with vaults created from the web
Why: the point of a sync server is that two people can work at once. Picking a winner was all this one could do while it could not read a vault. What, end to end: - A vault is created at /web or with `keeporg vault -create`: the server builds an empty KDBX 4 file, encrypts it with the password from the form, and stores it as version 1. An existing database can adopt a stored key with `keeporg db -id <id> -store-password`, which is verified against the stored file before it is accepted. - A stale push to a `merge` vault is no longer refused. The server opens the stored version and the pushed one in memory, folds them together, and stores the re-encrypted result. Clients push as usual and pull what comes back. Any failure answers 409 merge_failed and the client keeps its copy aside, so a failed merge still loses nothing. - At rest: vault contents stay KDBX-encrypted as always. A merge vault's password is kept AES-256-GCM-wrapped under a master key that lives outside the data directory, bound to the vault id, never returned by the API. A stolen data directory is ciphertext; a stolen data directory plus the master key is not. The server runs without a master key and simply refuses to create or merge vaults. This moves the server inside the trust boundary for vaults it can merge, which is inherent to merging and is stated plainly in the README, the handover notes and the web form itself. Key-less strategies are unchanged and remain the default for a database created without a password. Proved: two clients editing the same version are merged rather than refused, the newer edit of one entry wins, a merge failure leaves the stored vault untouched, `merge` is refused without a stored key, the wrapped key never appears in state.json or the API, and the web interface rejects a form without its CSRF token, withholds its cookie over plain http, and only offers groups the user administers. Checked by hand against the real thing: a vault created in a browser, edited by keepassxc-cli on two sides from the same version, merged by the server, and both entries read back out with keepassxc-cli. make check, make test-race, android lint and both .deb builds are clean.
This commit is contained in:
@@ -0,0 +1,110 @@
|
||||
package secret
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// Keyring wraps the per-vault secrets the server must keep in order to merge
|
||||
// a vault: it can decrypt a vault, so it holds that vault's key.
|
||||
//
|
||||
// The wrapped secrets live in the server's state document; the key that
|
||||
// unwraps them does not. It comes from the environment or from a file
|
||||
// outside the data directory, so a copy of the data directory alone yields
|
||||
// ciphertext. Whoever holds both holds the vaults.
|
||||
type Keyring struct {
|
||||
aead cipher.AEAD
|
||||
}
|
||||
|
||||
// MasterKeyEnv names the environment variable holding a base64 master key,
|
||||
// which takes precedence over the key file.
|
||||
const MasterKeyEnv = "KEEPORG_MASTER_KEY"
|
||||
|
||||
// LoadKeyring reads the master key from the environment or from path,
|
||||
// creating one at path if neither exists.
|
||||
func LoadKeyring(path string) (*Keyring, error) {
|
||||
if v := strings.TrimSpace(os.Getenv(MasterKeyEnv)); v != "" {
|
||||
key, err := base64.StdEncoding.DecodeString(v)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("secret: %s is not valid base64: %w", MasterKeyEnv, err)
|
||||
}
|
||||
return NewKeyring(key)
|
||||
}
|
||||
if path == "" {
|
||||
return nil, errors.New("secret: no master key: set " + MasterKeyEnv +
|
||||
" or configure master_key_file")
|
||||
}
|
||||
b, err := os.ReadFile(path)
|
||||
switch {
|
||||
case err == nil:
|
||||
key, derr := base64.StdEncoding.DecodeString(strings.TrimSpace(string(b)))
|
||||
if derr != nil {
|
||||
return nil, fmt.Errorf("secret: master key file %s is not valid base64: %w", path, derr)
|
||||
}
|
||||
return NewKeyring(key)
|
||||
case !os.IsNotExist(err):
|
||||
return nil, err
|
||||
}
|
||||
// First run: mint one. It is written with owner-only permissions and is
|
||||
// the one file an operator must back up separately from the data.
|
||||
key := randBytes(32)
|
||||
if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
enc := base64.StdEncoding.EncodeToString(key)
|
||||
if err := os.WriteFile(path, []byte(enc+"\n"), 0o600); err != nil {
|
||||
return nil, fmt.Errorf("secret: write master key %s: %w", path, err)
|
||||
}
|
||||
return NewKeyring(key)
|
||||
}
|
||||
|
||||
// NewKeyring builds a keyring from a 32-byte key.
|
||||
func NewKeyring(key []byte) (*Keyring, error) {
|
||||
if len(key) != 32 {
|
||||
return nil, fmt.Errorf("secret: master key must be 32 bytes, got %d", len(key))
|
||||
}
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
aead, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &Keyring{aead: aead}, nil
|
||||
}
|
||||
|
||||
// Wrap encrypts a vault secret. The vault's own id is authenticated with it,
|
||||
// so a wrapped secret moved to another vault's record fails to open rather
|
||||
// than unlocking the wrong database.
|
||||
func (k *Keyring) Wrap(vaultID, plaintext string) (string, error) {
|
||||
if vaultID == "" {
|
||||
return "", errors.New("secret: wrapping needs a vault id")
|
||||
}
|
||||
nonce := randBytes(k.aead.NonceSize())
|
||||
out := k.aead.Seal(nonce, nonce, []byte(plaintext), []byte(vaultID))
|
||||
return base64.StdEncoding.EncodeToString(out), nil
|
||||
}
|
||||
|
||||
// Unwrap decrypts a vault secret wrapped for this vault.
|
||||
func (k *Keyring) Unwrap(vaultID, wrapped string) (string, error) {
|
||||
raw, err := base64.StdEncoding.DecodeString(wrapped)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("secret: wrapped value is not base64: %w", err)
|
||||
}
|
||||
n := k.aead.NonceSize()
|
||||
if len(raw) < n {
|
||||
return "", errors.New("secret: wrapped value is too short")
|
||||
}
|
||||
plain, err := k.aead.Open(nil, raw[:n], raw[n:], []byte(vaultID))
|
||||
if err != nil {
|
||||
return "", errors.New("secret: wrapped value does not open with this master key")
|
||||
}
|
||||
return string(plain), nil
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
package secret
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestKeyringWrapRoundTrip(t *testing.T) {
|
||||
k, err := NewKeyring(randBytes(32))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
wrapped, err := k.Wrap("vault-1", "the-vault-password")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if wrapped == "the-vault-password" {
|
||||
t.Fatal("the secret was stored in the clear")
|
||||
}
|
||||
got, err := k.Unwrap("vault-1", wrapped)
|
||||
if err != nil || got != "the-vault-password" {
|
||||
t.Fatalf("unwrap = %q, %v", got, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWrappedSecretIsBoundToItsVault(t *testing.T) {
|
||||
k, _ := NewKeyring(randBytes(32))
|
||||
wrapped, _ := k.Wrap("vault-1", "secret")
|
||||
if _, err := k.Unwrap("vault-2", wrapped); err == nil {
|
||||
t.Fatal("a secret wrapped for one vault opened under another id")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAnotherMasterKeyCannotUnwrap(t *testing.T) {
|
||||
a, _ := NewKeyring(randBytes(32))
|
||||
b, _ := NewKeyring(randBytes(32))
|
||||
wrapped, _ := a.Wrap("v", "secret")
|
||||
if _, err := b.Unwrap("v", wrapped); err == nil {
|
||||
t.Fatal("a different master key opened the secret")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadKeyringCreatesThenReusesTheKeyFile(t *testing.T) {
|
||||
t.Setenv(MasterKeyEnv, "")
|
||||
path := filepath.Join(t.TempDir(), "keys", "master.key")
|
||||
first, err := LoadKeyring(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
fi, err := os.Stat(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if fi.Mode().Perm() != 0o600 {
|
||||
t.Fatalf("master key file mode = %v", fi.Mode().Perm())
|
||||
}
|
||||
wrapped, _ := first.Wrap("v", "secret")
|
||||
second, err := LoadKeyring(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got, err := second.Unwrap("v", wrapped); err != nil || got != "secret" {
|
||||
t.Fatalf("reloaded keyring: %q, %v", got, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadKeyringPrefersTheEnvironment(t *testing.T) {
|
||||
key := randBytes(32)
|
||||
t.Setenv(MasterKeyEnv, base64.StdEncoding.EncodeToString(key))
|
||||
path := filepath.Join(t.TempDir(), "master.key")
|
||||
k, err := LoadKeyring(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := os.Stat(path); !os.IsNotExist(err) {
|
||||
t.Fatal("a key file was written although the environment supplied the key")
|
||||
}
|
||||
direct, _ := NewKeyring(key)
|
||||
wrapped, _ := direct.Wrap("v", "secret")
|
||||
if got, _ := k.Unwrap("v", wrapped); got != "secret" {
|
||||
t.Fatal("the environment key was not the one used")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadKeyringRejectsAShortKey(t *testing.T) {
|
||||
t.Setenv(MasterKeyEnv, base64.StdEncoding.EncodeToString([]byte("too short")))
|
||||
if _, err := LoadKeyring(""); err == nil {
|
||||
t.Fatal("a short master key was accepted")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user