Merge concurrent saves on the server, with vaults created from the web
Why: the point of a sync server is that two people can work at once. Picking a winner was all this one could do while it could not read a vault. What, end to end: - A vault is created at /web or with `keeporg vault -create`: the server builds an empty KDBX 4 file, encrypts it with the password from the form, and stores it as version 1. An existing database can adopt a stored key with `keeporg db -id <id> -store-password`, which is verified against the stored file before it is accepted. - A stale push to a `merge` vault is no longer refused. The server opens the stored version and the pushed one in memory, folds them together, and stores the re-encrypted result. Clients push as usual and pull what comes back. Any failure answers 409 merge_failed and the client keeps its copy aside, so a failed merge still loses nothing. - At rest: vault contents stay KDBX-encrypted as always. A merge vault's password is kept AES-256-GCM-wrapped under a master key that lives outside the data directory, bound to the vault id, never returned by the API. A stolen data directory is ciphertext; a stolen data directory plus the master key is not. The server runs without a master key and simply refuses to create or merge vaults. This moves the server inside the trust boundary for vaults it can merge, which is inherent to merging and is stated plainly in the README, the handover notes and the web form itself. Key-less strategies are unchanged and remain the default for a database created without a password. Proved: two clients editing the same version are merged rather than refused, the newer edit of one entry wins, a merge failure leaves the stored vault untouched, `merge` is refused without a stored key, the wrapped key never appears in state.json or the API, and the web interface rejects a form without its CSRF token, withholds its cookie over plain http, and only offers groups the user administers. Checked by hand against the real thing: a vault created in a browser, edited by keepassxc-cli on two sides from the same version, merged by the server, and both entries read back out with keepassxc-cli. make check, make test-race, android lint and both .deb builds are clean.
This commit is contained in:
@@ -0,0 +1,212 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"cc.tiredsysadmin.keeporg/internal/secret"
|
||||
"cc.tiredsysadmin.keeporg/internal/store"
|
||||
)
|
||||
|
||||
// The web interface exists for one job the command line cannot do well:
|
||||
// creating a vault and setting its password in a browser. It is not a
|
||||
// password manager and never shows a vault's contents; the server does not
|
||||
// open a vault except to merge one.
|
||||
const webCookie = "keeporg_web"
|
||||
|
||||
// webSession is a signed-in browser.
|
||||
type webSession struct {
|
||||
user *store.User
|
||||
csrf string
|
||||
}
|
||||
|
||||
// webUser resolves the session cookie, or nil when the browser is not
|
||||
// signed in.
|
||||
func (s *Server) webUser(r *http.Request) *webSession {
|
||||
c, err := r.Cookie(webCookie)
|
||||
if err != nil || c.Value == "" {
|
||||
return nil
|
||||
}
|
||||
var out *webSession
|
||||
s.st.Read(func(st *store.State) {
|
||||
sess := st.Sessions[c.Value]
|
||||
if sess == nil || time.Now().After(sess.ExpiresAt) {
|
||||
return
|
||||
}
|
||||
if u := st.Users[sess.UserID]; u != nil && !u.Disabled {
|
||||
cp := *u
|
||||
out = &webSession{user: &cp, csrf: sess.CSRF}
|
||||
}
|
||||
})
|
||||
return out
|
||||
}
|
||||
|
||||
// checkCSRF verifies the form token against the session's.
|
||||
func (s *Server) checkCSRF(r *http.Request, sess *webSession) bool {
|
||||
return sess.csrf != "" && secret.Equal(sess.csrf, r.FormValue("csrf"))
|
||||
}
|
||||
|
||||
func (s *Server) setWebCookie(w http.ResponseWriter, token string, ttl time.Duration) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: webCookie,
|
||||
Value: token,
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: strings.HasPrefix(s.cfg.ExternalURL, "https://"),
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
MaxAge: int(ttl.Seconds()),
|
||||
})
|
||||
}
|
||||
|
||||
func (s *Server) handleWebHome(w http.ResponseWriter, r *http.Request) {
|
||||
if s.webUser(r) != nil {
|
||||
http.Redirect(w, r, "/web/vaults", http.StatusFound)
|
||||
return
|
||||
}
|
||||
s.renderSignIn(w, "")
|
||||
}
|
||||
|
||||
func (s *Server) handleWebSignIn(w http.ResponseWriter, r *http.Request) {
|
||||
if err := r.ParseForm(); err != nil {
|
||||
fail(w, http.StatusBadRequest, "bad_request", err.Error())
|
||||
return
|
||||
}
|
||||
var token string
|
||||
err := s.st.Update(func(st *store.State) error {
|
||||
u, err := checkPassword(st, r.FormValue("username"), r.FormValue("password"),
|
||||
r.FormValue("totp"))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
token = s.newSession(st, u.ID, "web").Token
|
||||
return nil
|
||||
})
|
||||
switch {
|
||||
case errors.Is(err, errTOTPRequired):
|
||||
s.renderSignIn(w, "This account needs its one-time code.")
|
||||
case errors.Is(err, errTOTPInvalid):
|
||||
s.renderSignIn(w, "That one-time code was rejected.")
|
||||
case errors.Is(err, errBadCredentials):
|
||||
s.renderSignIn(w, "Unknown user or wrong password.")
|
||||
case err != nil:
|
||||
s.renderSignIn(w, err.Error())
|
||||
default:
|
||||
s.setWebCookie(w, token, s.cfg.SessionTTL)
|
||||
http.Redirect(w, r, "/web/vaults", http.StatusFound)
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Server) handleWebSignOut(w http.ResponseWriter, r *http.Request) {
|
||||
sess := s.webUser(r)
|
||||
if sess == nil {
|
||||
http.Redirect(w, r, "/web", http.StatusFound)
|
||||
return
|
||||
}
|
||||
if err := r.ParseForm(); err != nil || !s.checkCSRF(r, sess) {
|
||||
fail(w, http.StatusForbidden, "csrf", "stale form, reload the page")
|
||||
return
|
||||
}
|
||||
if c, err := r.Cookie(webCookie); err == nil {
|
||||
_ = s.st.Update(func(st *store.State) error {
|
||||
delete(st.Sessions, c.Value)
|
||||
return nil
|
||||
})
|
||||
}
|
||||
s.setWebCookie(w, "", -time.Second)
|
||||
http.Redirect(w, r, "/web", http.StatusFound)
|
||||
}
|
||||
|
||||
// webVault is one row of the vault list.
|
||||
type webVault struct {
|
||||
ID string
|
||||
Name string
|
||||
Perm string
|
||||
Strategy string
|
||||
Version int64
|
||||
Updated string
|
||||
By string
|
||||
HasKey bool
|
||||
}
|
||||
|
||||
// webGroup is one option in the owning-group selector.
|
||||
type webGroup struct {
|
||||
ID string
|
||||
Name string
|
||||
}
|
||||
|
||||
func (s *Server) handleWebVaults(w http.ResponseWriter, r *http.Request) {
|
||||
sess := s.webUser(r)
|
||||
if sess == nil {
|
||||
s.renderSignIn(w, "")
|
||||
return
|
||||
}
|
||||
s.renderVaults(w, sess, "", "")
|
||||
}
|
||||
|
||||
func (s *Server) handleWebCreateVault(w http.ResponseWriter, r *http.Request) {
|
||||
sess := s.webUser(r)
|
||||
if sess == nil {
|
||||
s.renderSignIn(w, "")
|
||||
return
|
||||
}
|
||||
if err := r.ParseForm(); err != nil || !s.checkCSRF(r, sess) {
|
||||
fail(w, http.StatusForbidden, "csrf", "stale form, reload the page")
|
||||
return
|
||||
}
|
||||
password := r.FormValue("password")
|
||||
if password != r.FormValue("password2") {
|
||||
s.renderVaults(w, sess, "The two vault passwords do not match.", "")
|
||||
return
|
||||
}
|
||||
strategy := store.Strategy(r.FormValue("strategy"))
|
||||
if strategy == "" {
|
||||
strategy = store.StrategyMerge
|
||||
}
|
||||
view, err := s.createVault(sess.user, r.FormValue("name"), r.FormValue("group"),
|
||||
strategy, password)
|
||||
if err != nil {
|
||||
s.renderVaults(w, sess, humanError(err), "")
|
||||
return
|
||||
}
|
||||
s.renderVaults(w, sess, "",
|
||||
"Created "+view.Name+". Open "+view.Name+".kdbx from your KeepOrg client "+
|
||||
"with the password you just set.")
|
||||
}
|
||||
|
||||
// humanError keeps internal wording out of the browser.
|
||||
func humanError(err error) string {
|
||||
if errors.Is(err, errForbidden) {
|
||||
return "You do not administer that group."
|
||||
}
|
||||
return err.Error()
|
||||
}
|
||||
|
||||
// vaultRows collects what the signed-in user may see, and the groups they
|
||||
// may create a vault in.
|
||||
func (s *Server) vaultRows(u *store.User) ([]webVault, []webGroup) {
|
||||
vaults := []webVault{}
|
||||
groups := []webGroup{}
|
||||
s.st.Read(func(st *store.State) {
|
||||
for _, a := range st.Assignments(u.ID) {
|
||||
updated := "never"
|
||||
if a.DB.Version > 0 {
|
||||
updated = a.DB.UpdatedAt.UTC().Format("2006-01-02 15:04 UTC")
|
||||
}
|
||||
vaults = append(vaults, webVault{
|
||||
ID: a.DB.ID, Name: a.DB.Name, Perm: string(a.Perm),
|
||||
Strategy: string(a.DB.MergeStrategy), Version: a.DB.Version,
|
||||
Updated: updated, By: a.DB.UpdatedBy, HasKey: a.DB.WrappedKey != "",
|
||||
})
|
||||
}
|
||||
for id, g := range st.Groups {
|
||||
if st.IsGroupAdmin(u.ID, id) {
|
||||
groups = append(groups, webGroup{ID: id, Name: g.Name})
|
||||
}
|
||||
}
|
||||
})
|
||||
sort.Slice(groups, func(i, j int) bool { return groups[i].Name < groups[j].Name })
|
||||
return vaults, groups
|
||||
}
|
||||
Reference in New Issue
Block a user