1
0
Fork 0

Implemented key rotation with the latest vault

Dieser Commit ist enthalten in:
Daniel García 2018-11-24 23:00:41 +01:00
Ursprung f1acc1e05a
Commit f71f10eac6
Es konnte kein GPG-Schlüssel zu dieser Signatur gefunden werden
GPG-Schlüssel-ID: FC8A7D14C3CD543A
4 geänderte Dateien mit 100 neuen und 27 gelöschten Zeilen

Datei anzeigen

@ -1,15 +1,15 @@
use rocket_contrib::json::Json; use rocket_contrib::json::Json;
use db::DbConn;
use db::models::*; use db::models::*;
use db::DbConn;
use api::{PasswordData, JsonResult, EmptyResult, JsonUpcase, NumberOrString}; use api::{EmptyResult, JsonResult, JsonUpcase, NumberOrString, PasswordData, UpdateType, WebSocketUsers};
use auth::Headers; use auth::Headers;
use mail; use mail;
use CONFIG; use CONFIG;
use rocket::Route; use rocket::{Route, State};
pub fn routes() -> Vec<Route> { pub fn routes() -> Vec<Route> {
routes![ routes![
@ -21,6 +21,7 @@ pub fn routes() -> Vec<Route> {
post_keys, post_keys,
post_password, post_password,
post_kdf, post_kdf,
post_rotatekey,
post_sstamp, post_sstamp,
post_email_token, post_email_token,
post_email, post_email,
@ -56,23 +57,22 @@ struct KeysData {
fn register(data: JsonUpcase<RegisterData>, conn: DbConn) -> EmptyResult { fn register(data: JsonUpcase<RegisterData>, conn: DbConn) -> EmptyResult {
let data: RegisterData = data.into_inner().data; let data: RegisterData = data.into_inner().data;
let mut user = match User::find_by_mail(&data.Email, &conn) { let mut user = match User::find_by_mail(&data.Email, &conn) {
Some(mut user) => { Some(user) => {
if Invitation::take(&data.Email, &conn) { if Invitation::take(&data.Email, &conn) {
for mut user_org in UserOrganization::find_invited_by_user(&user.uuid, &conn).iter_mut() { for mut user_org in UserOrganization::find_invited_by_user(&user.uuid, &conn).iter_mut() {
user_org.status = UserOrgStatus::Accepted as i32; user_org.status = UserOrgStatus::Accepted as i32;
if user_org.save(&conn).is_err() { if user_org.save(&conn).is_err() {
err!("Failed to accept user to organization") err!("Failed to accept user to organization")
} }
}; }
user user
} else if CONFIG.signups_allowed { } else if CONFIG.signups_allowed {
err!("Account with this email already exists") err!("Account with this email already exists")
} else { } else {
err!("Registration not allowed") err!("Registration not allowed")
} }
}, }
None => { None => {
if CONFIG.signups_allowed || Invitation::take(&data.Email, &conn) { if CONFIG.signups_allowed || Invitation::take(&data.Email, &conn) {
User::new(data.Email) User::new(data.Email)
@ -109,7 +109,7 @@ fn register(data: JsonUpcase<RegisterData>, conn: DbConn) -> EmptyResult {
match user.save(&conn) { match user.save(&conn) {
Ok(()) => Ok(()), Ok(()) => Ok(()),
Err(_) => err!("Failed to save user") Err(_) => err!("Failed to save user"),
} }
} }
@ -122,7 +122,7 @@ fn profile(headers: Headers, conn: DbConn) -> JsonResult {
#[allow(non_snake_case)] #[allow(non_snake_case)]
struct ProfileData { struct ProfileData {
#[serde(rename = "Culture")] #[serde(rename = "Culture")]
_Culture: String, // Ignored, always use en-US _Culture: String, // Ignored, always use en-US
MasterPasswordHint: Option<String>, MasterPasswordHint: Option<String>,
Name: String, Name: String,
} }
@ -145,7 +145,7 @@ fn post_profile(data: JsonUpcase<ProfileData>, headers: Headers, conn: DbConn) -
}; };
match user.save(&conn) { match user.save(&conn) {
Ok(()) => Ok(Json(user.to_json(&conn))), Ok(()) => Ok(Json(user.to_json(&conn))),
Err(_) => err!("Failed to save user profile") Err(_) => err!("Failed to save user profile"),
} }
} }
@ -153,7 +153,7 @@ fn post_profile(data: JsonUpcase<ProfileData>, headers: Headers, conn: DbConn) -
fn get_public_keys(uuid: String, _headers: Headers, conn: DbConn) -> JsonResult { fn get_public_keys(uuid: String, _headers: Headers, conn: DbConn) -> JsonResult {
let user = match User::find_by_uuid(&uuid, &conn) { let user = match User::find_by_uuid(&uuid, &conn) {
Some(user) => user, Some(user) => user,
None => err!("User doesn't exist") None => err!("User doesn't exist"),
}; };
Ok(Json(json!({ Ok(Json(json!({
@ -174,12 +174,10 @@ fn post_keys(data: JsonUpcase<KeysData>, headers: Headers, conn: DbConn) -> Json
match user.save(&conn) { match user.save(&conn) {
Ok(()) => Ok(Json(user.to_json(&conn))), Ok(()) => Ok(Json(user.to_json(&conn))),
Err(_) => err!("Failed to save the user's keys") Err(_) => err!("Failed to save the user's keys"),
} }
} }
#[derive(Deserialize)] #[derive(Deserialize)]
#[allow(non_snake_case)] #[allow(non_snake_case)]
struct ChangePassData { struct ChangePassData {
@ -201,7 +199,7 @@ fn post_password(data: JsonUpcase<ChangePassData>, headers: Headers, conn: DbCon
user.key = data.Key; user.key = data.Key;
match user.save(&conn) { match user.save(&conn) {
Ok(()) => Ok(()), Ok(()) => Ok(()),
Err(_) => err!("Failed to save password") Err(_) => err!("Failed to save password"),
} }
} }
@ -231,10 +229,86 @@ fn post_kdf(data: JsonUpcase<ChangeKdfData>, headers: Headers, conn: DbConn) ->
user.key = data.Key; user.key = data.Key;
match user.save(&conn) { match user.save(&conn) {
Ok(()) => Ok(()), Ok(()) => Ok(()),
Err(_) => err!("Failed to save password settings") Err(_) => err!("Failed to save password settings"),
} }
} }
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct UpdateFolderData {
Id: String,
Name: String,
}
use super::ciphers::CipherData;
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct KeyData {
Ciphers: Vec<CipherData>,
Folders: Vec<UpdateFolderData>,
Key: String,
PrivateKey: String,
MasterPasswordHash: String,
}
#[post("/accounts/key", data = "<data>")]
fn post_rotatekey(data: JsonUpcase<KeyData>, headers: Headers, conn: DbConn, ws: State<WebSocketUsers>) -> EmptyResult {
let data: KeyData = data.into_inner().data;
if !headers.user.check_valid_password(&data.MasterPasswordHash) {
err!("Invalid password")
}
let user_uuid = &headers.user.uuid;
// Update folder data
for folder_data in data.Folders {
let mut saved_folder = match Folder::find_by_uuid(&folder_data.Id, &conn) {
Some(folder) => folder,
None => err!("Folder doesn't exist"),
};
if &saved_folder.user_uuid != user_uuid {
err!("The folder is not owned by the user")
}
saved_folder.name = folder_data.Name;
if saved_folder.save(&conn).is_err() {
err!("Failed to save folder")
}
}
// Update cipher data
use super::ciphers::update_cipher_from_data;
for cipher_data in data.Ciphers {
let mut saved_cipher = match Cipher::find_by_uuid(cipher_data.Id.as_ref().unwrap(), &conn) {
Some(cipher) => cipher,
None => err!("Cipher doesn't exist"),
};
if saved_cipher.user_uuid.as_ref().unwrap() != user_uuid {
err!("The cipher is not owned by the user")
}
update_cipher_from_data(&mut saved_cipher, cipher_data, &headers, false, &conn, &ws, UpdateType::SyncCipherUpdate)?
}
// Update user data
let mut user = headers.user;
user.key = data.Key;
user.private_key = Some(data.PrivateKey);
user.reset_security_stamp();
if user.save(&conn).is_err() {
err!("Failed modify user key");
}
Ok(())
}
#[post("/accounts/security-stamp", data = "<data>")] #[post("/accounts/security-stamp", data = "<data>")]
fn post_sstamp(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> EmptyResult { fn post_sstamp(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> EmptyResult {
let data: PasswordData = data.into_inner().data; let data: PasswordData = data.into_inner().data;
@ -247,7 +321,7 @@ fn post_sstamp(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -
user.reset_security_stamp(); user.reset_security_stamp();
match user.save(&conn) { match user.save(&conn) {
Ok(()) => Ok(()), Ok(()) => Ok(()),
Err(_) => err!("Failed to reset security stamp") Err(_) => err!("Failed to reset security stamp"),
} }
} }
@ -278,7 +352,7 @@ fn post_email_token(data: JsonUpcase<EmailTokenData>, headers: Headers, conn: Db
struct ChangeEmailData { struct ChangeEmailData {
MasterPasswordHash: String, MasterPasswordHash: String,
NewEmail: String, NewEmail: String,
Key: String, Key: String,
NewMasterPasswordHash: String, NewMasterPasswordHash: String,
#[serde(rename = "Token")] #[serde(rename = "Token")]
@ -299,13 +373,13 @@ fn post_email(data: JsonUpcase<ChangeEmailData>, headers: Headers, conn: DbConn)
} }
user.email = data.NewEmail; user.email = data.NewEmail;
user.set_password(&data.NewMasterPasswordHash); user.set_password(&data.NewMasterPasswordHash);
user.key = data.Key; user.key = data.Key;
match user.save(&conn) { match user.save(&conn) {
Ok(()) => Ok(()), Ok(()) => Ok(()),
Err(_) => err!("Failed to save email address") Err(_) => err!("Failed to save email address"),
} }
} }
@ -322,10 +396,10 @@ fn delete_account(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn
if !user.check_valid_password(&data.MasterPasswordHash) { if !user.check_valid_password(&data.MasterPasswordHash) {
err!("Invalid password") err!("Invalid password")
} }
match user.delete(&conn) { match user.delete(&conn) {
Ok(()) => Ok(()), Ok(()) => Ok(()),
Err(_) => err!("Failed deleting user account, are you the only owner of some organization?") Err(_) => err!("Failed deleting user account, are you the only owner of some organization?"),
} }
} }

Datei anzeigen

@ -136,7 +136,7 @@ fn get_cipher_details(uuid: String, headers: Headers, conn: DbConn) -> JsonResul
#[allow(non_snake_case)] #[allow(non_snake_case)]
pub struct CipherData { pub struct CipherData {
// Id is optional as it is included only in bulk share // Id is optional as it is included only in bulk share
Id: Option<String>, pub Id: Option<String>,
// Folder id is not included in import // Folder id is not included in import
FolderId: Option<String>, FolderId: Option<String>,
// TODO: Some of these might appear all the time, no need for Option // TODO: Some of these might appear all the time, no need for Option

Datei anzeigen

@ -97,7 +97,6 @@ impl User {
self.password_hash = crypto::hash_password(password.as_bytes(), self.password_hash = crypto::hash_password(password.as_bytes(),
&self.salt, &self.salt,
self.password_iterations as u32); self.password_iterations as u32);
self.reset_security_stamp();
} }
pub fn reset_security_stamp(&mut self) { pub fn reset_security_stamp(&mut self) {

Datei anzeigen

@ -1,4 +1,4 @@
#![feature(proc_macro_hygiene, decl_macro, custom_derive, vec_remove_item, try_trait)] #![feature(proc_macro_hygiene, decl_macro, custom_derive, vec_remove_item, try_trait, nll)]
#![recursion_limit="128"] #![recursion_limit="128"]
#![allow(proc_macro_derive_resolution_fallback)] // TODO: Remove this when diesel update fixes warnings #![allow(proc_macro_derive_resolution_fallback)] // TODO: Remove this when diesel update fixes warnings