mirror of
https://github.com/keepassxreboot/keepassxc.git
synced 2024-12-25 07:19:42 -05:00
Add support to remember quick unlock on Windows and macOS
This commit is contained in:
parent
f71cca4eba
commit
0ee002d963
@ -148,7 +148,7 @@ static const QHash<Config::ConfigKey, ConfigDirective> configStrings = {
|
||||
{Config::Security_NoConfirmMoveEntryToRecycleBin,{QS("Security/NoConfirmMoveEntryToRecycleBin"), Roaming, true}},
|
||||
{Config::Security_EnableCopyOnDoubleClick,{QS("Security/EnableCopyOnDoubleClick"), Roaming, false}},
|
||||
{Config::Security_QuickUnlock, {QS("Security/QuickUnlock"), Local, true}},
|
||||
{Config::Security_DatabasePasswordMinimumQuality, {QS("Security/DatabasePasswordMinimumQuality"), Local, 0}},
|
||||
{Config::Security_QuickUnlockRemember, {QS("Security/QuickUnlockRemember"), Local, true}},
|
||||
|
||||
// Browser
|
||||
{Config::Browser_Enabled, {QS("Browser/Enabled"), Roaming, false}},
|
||||
|
@ -129,7 +129,7 @@ public:
|
||||
Security_NoConfirmMoveEntryToRecycleBin,
|
||||
Security_EnableCopyOnDoubleClick,
|
||||
Security_QuickUnlock,
|
||||
Security_DatabasePasswordMinimumQuality,
|
||||
Security_QuickUnlockRemember,
|
||||
|
||||
Browser_Enabled,
|
||||
Browser_ShowNotification,
|
||||
|
@ -147,6 +147,10 @@ ApplicationSettingsWidget::ApplicationSettingsWidget(QWidget* parent)
|
||||
m_secUi->lockDatabaseMinimizeCheckBox->setEnabled(!state);
|
||||
});
|
||||
|
||||
connect(m_secUi->quickUnlockCheckBox, &QCheckBox::toggled, this, [this](bool state) {
|
||||
m_secUi->quickUnlockRememberCheckBox->setEnabled(state);
|
||||
});
|
||||
|
||||
// Set Auto-Type shortcut when changed
|
||||
connect(
|
||||
m_generalUi->autoTypeShortcutWidget, &ShortcutWidget::shortcutChanged, this, [this](auto key, auto modifiers) {
|
||||
@ -344,6 +348,15 @@ void ApplicationSettingsWidget::loadSettings()
|
||||
|
||||
m_secUi->quickUnlockCheckBox->setEnabled(getQuickUnlock()->isAvailable());
|
||||
m_secUi->quickUnlockCheckBox->setChecked(config()->get(Config::Security_QuickUnlock).toBool());
|
||||
m_secUi->quickUnlockCheckBox->setToolTip(
|
||||
m_secUi->quickUnlockCheckBox->isEnabled() ? QString() : tr("Quick unlock is not available on your device."));
|
||||
|
||||
m_secUi->quickUnlockRememberCheckBox->setEnabled(getQuickUnlock()->isAvailable()
|
||||
&& getQuickUnlock()->canRemember());
|
||||
m_secUi->quickUnlockRememberCheckBox->setChecked(config()->get(Config::Security_QuickUnlockRemember).toBool());
|
||||
m_secUi->quickUnlockRememberCheckBox->setToolTip(m_secUi->quickUnlockRememberCheckBox->isEnabled()
|
||||
? QString()
|
||||
: tr("Quick unlock cannot be remembered on your device."));
|
||||
|
||||
for (const ExtraPage& page : asConst(m_extraPages)) {
|
||||
page.loadSettings();
|
||||
@ -460,6 +473,7 @@ void ApplicationSettingsWidget::saveSettings()
|
||||
|
||||
if (m_secUi->quickUnlockCheckBox->isEnabled()) {
|
||||
config()->set(Config::Security_QuickUnlock, m_secUi->quickUnlockCheckBox->isChecked());
|
||||
config()->set(Config::Security_QuickUnlockRemember, m_secUi->quickUnlockRememberCheckBox->isChecked());
|
||||
}
|
||||
|
||||
// Security: clear storage if related settings are disabled
|
||||
|
@ -148,7 +148,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>40</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -174,7 +174,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -210,7 +210,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -250,7 +250,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -315,7 +315,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>40</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -483,7 +483,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -513,7 +513,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>40</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -593,7 +593,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -626,7 +626,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -688,7 +688,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>40</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -890,7 +890,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -935,7 +935,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>40</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -992,7 +992,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
|
@ -138,7 +138,7 @@
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>40</width>
|
||||
<height>20</height>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
@ -168,10 +168,40 @@
|
||||
<item>
|
||||
<widget class="QCheckBox" name="quickUnlockCheckBox">
|
||||
<property name="text">
|
||||
<string>Enable database quick unlock (Touch ID / Windows Hello)</string>
|
||||
<string>Enable database quick unlock (Touch ID / Windows Hello / Polkit)</string>
|
||||
</property>
|
||||
</widget>
|
||||
</item>
|
||||
<item>
|
||||
<layout class="QHBoxLayout" name="horizontalLayout">
|
||||
<property name="spacing">
|
||||
<number>0</number>
|
||||
</property>
|
||||
<item>
|
||||
<spacer name="horizontalSpacer_2">
|
||||
<property name="orientation">
|
||||
<enum>Qt::Horizontal</enum>
|
||||
</property>
|
||||
<property name="sizeType">
|
||||
<enum>QSizePolicy::Fixed</enum>
|
||||
</property>
|
||||
<property name="sizeHint" stdset="0">
|
||||
<size>
|
||||
<width>30</width>
|
||||
<height>0</height>
|
||||
</size>
|
||||
</property>
|
||||
</spacer>
|
||||
</item>
|
||||
<item>
|
||||
<widget class="QCheckBox" name="quickUnlockRememberCheckBox">
|
||||
<property name="text">
|
||||
<string>Remember quick unlock after database is closed</string>
|
||||
</property>
|
||||
</widget>
|
||||
</item>
|
||||
</layout>
|
||||
</item>
|
||||
<item>
|
||||
<widget class="QCheckBox" name="lockDatabaseOnScreenLockCheckBox">
|
||||
<property name="text">
|
||||
|
@ -356,7 +356,10 @@ void DatabaseOpenWidget::openDatabase()
|
||||
// Save Quick Unlock credentials if available
|
||||
if (!blockQuickUnlock && isQuickUnlockAvailable()) {
|
||||
auto keyData = databaseKey->serialize();
|
||||
getQuickUnlock()->setKey(m_db->publicUuid(), keyData);
|
||||
if (!getQuickUnlock()->setKey(m_db->publicUuid(), keyData) && !getQuickUnlock()->errorString().isEmpty()) {
|
||||
getMainWindow()->displayTabMessage(getQuickUnlock()->errorString(),
|
||||
MessageWidget::MessageType::Warning);
|
||||
}
|
||||
m_ui->messageWidget->hideMessage();
|
||||
}
|
||||
|
||||
|
@ -1917,7 +1917,10 @@ void DatabaseWidget::closeEvent(QCloseEvent* event)
|
||||
return;
|
||||
}
|
||||
|
||||
m_databaseOpenWidget->resetQuickUnlock();
|
||||
// Reset quick unlock if we are not remembering it
|
||||
if (!config()->get(Config::Security_QuickUnlockRemember).toBool()) {
|
||||
m_databaseOpenWidget->resetQuickUnlock();
|
||||
}
|
||||
event->accept();
|
||||
}
|
||||
|
||||
|
@ -110,14 +110,14 @@ bool Polkit::setKey(const QUuid& dbUuid, const QByteArray& key)
|
||||
|
||||
SymmetricCipher aes256Encrypt;
|
||||
if (!aes256Encrypt.init(SymmetricCipher::Aes256_GCM, SymmetricCipher::Encrypt, randomKey, randomIV)) {
|
||||
m_error = QObject::tr("AES initialization failed");
|
||||
m_error = QObject::tr("Failed to init KeePassXC crypto.");
|
||||
return false;
|
||||
}
|
||||
|
||||
// Encrypt the master password
|
||||
QByteArray encryptedMasterKey = key;
|
||||
if (!aes256Encrypt.finish(encryptedMasterKey)) {
|
||||
m_error = QObject::tr("AES encrypt failed");
|
||||
m_error = QObject::tr("Failed to encrypt key data.");
|
||||
qDebug() << "polkit aes encrypt failed: " << aes256Encrypt.errorString();
|
||||
return false;
|
||||
}
|
||||
@ -129,7 +129,7 @@ bool Polkit::setKey(const QUuid& dbUuid, const QByteArray& key)
|
||||
keychainKeyValue.size(),
|
||||
KEY_SPEC_PROCESS_KEYRING);
|
||||
if (key_serial < 0) {
|
||||
m_error = QObject::tr("Failed to store in Linux Keyring");
|
||||
m_error = QObject::tr("Failed to store key in Linux Keyring. Quick unlock has not been enabled.");
|
||||
qDebug() << "polkit keyring failed to store: " << errno;
|
||||
return false;
|
||||
}
|
||||
@ -181,7 +181,7 @@ bool Polkit::getKey(const QUuid& dbUuid, QByteArray& key)
|
||||
find_key_by_type_and_desc("user", getKeyName(dbUuid).toStdString().c_str(), KEY_SPEC_PROCESS_KEYRING);
|
||||
|
||||
if (keySerial == -1) {
|
||||
m_error = QObject::tr("Could not locate key in keyring");
|
||||
m_error = QObject::tr("Could not locate key in Linux Keyring.");
|
||||
qDebug() << "polkit keyring failed to find: " << errno;
|
||||
return false;
|
||||
}
|
||||
@ -190,7 +190,7 @@ bool Polkit::getKey(const QUuid& dbUuid, QByteArray& key)
|
||||
long keychainDataSize = keyctl_read_alloc(keySerial, &keychainBuffer);
|
||||
|
||||
if (keychainDataSize == -1) {
|
||||
m_error = QObject::tr("Could not read key in keyring");
|
||||
m_error = QObject::tr("Could not read key in Linux Keyring.");
|
||||
qDebug() << "polkit keyring failed to read: " << errno;
|
||||
return false;
|
||||
}
|
||||
@ -205,7 +205,7 @@ bool Polkit::getKey(const QUuid& dbUuid, QByteArray& key)
|
||||
|
||||
SymmetricCipher aes256Decrypt;
|
||||
if (!aes256Decrypt.init(SymmetricCipher::Aes256_GCM, SymmetricCipher::Decrypt, keychainKey, keychainIv)) {
|
||||
m_error = QObject::tr("AES initialization failed");
|
||||
m_error = QObject::tr("Failed to init KeePassXC crypto.");
|
||||
qDebug() << "polkit aes init failed";
|
||||
return false;
|
||||
}
|
||||
@ -213,7 +213,7 @@ bool Polkit::getKey(const QUuid& dbUuid, QByteArray& key)
|
||||
key = encryptedMasterKey;
|
||||
if (!aes256Decrypt.finish(key)) {
|
||||
key.clear();
|
||||
m_error = QObject::tr("AES decrypt failed");
|
||||
m_error = QObject::tr("Failed to decrypt key data.");
|
||||
qDebug() << "polkit aes decrypt failed: " << aes256Decrypt.errorString();
|
||||
return false;
|
||||
}
|
||||
@ -229,14 +229,19 @@ bool Polkit::getKey(const QUuid& dbUuid, QByteArray& key)
|
||||
|
||||
// Failed to authenticate
|
||||
if (authResult.is_challenge) {
|
||||
m_error = QObject::tr("No Polkit authentication agent was available");
|
||||
m_error = QObject::tr("No Polkit authentication agent was available.");
|
||||
} else {
|
||||
m_error = QObject::tr("Polkit authorization failed");
|
||||
m_error = QObject::tr("Polkit authorization failed.");
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
bool Polkit::canRemember() const
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
bool Polkit::hasKey(const QUuid& dbUuid) const
|
||||
{
|
||||
if (!m_encryptedMasterKeys.contains(dbUuid)) {
|
||||
|
@ -36,6 +36,8 @@ public:
|
||||
bool getKey(const QUuid& dbUuid, QByteArray& key) override;
|
||||
bool hasKey(const QUuid& dbUuid) const override;
|
||||
|
||||
bool canRemember() const override;
|
||||
|
||||
void reset(const QUuid& dbUuid) override;
|
||||
void reset() override;
|
||||
|
||||
|
@ -75,6 +75,11 @@ bool NoQuickUnlock::hasKey(const QUuid& dbUuid) const
|
||||
return false;
|
||||
}
|
||||
|
||||
bool NoQuickUnlock::canRemember() const
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
void NoQuickUnlock::reset(const QUuid& dbUuid)
|
||||
{
|
||||
Q_UNUSED(dbUuid)
|
||||
|
@ -35,6 +35,8 @@ public:
|
||||
virtual bool getKey(const QUuid& dbUuid, QByteArray& key) = 0;
|
||||
virtual bool hasKey(const QUuid& dbUuid) const = 0;
|
||||
|
||||
virtual bool canRemember() const = 0;
|
||||
|
||||
virtual void reset(const QUuid& dbUuid) = 0;
|
||||
virtual void reset() = 0;
|
||||
};
|
||||
@ -49,6 +51,8 @@ public:
|
||||
bool getKey(const QUuid& dbUuid, QByteArray& key) override;
|
||||
bool hasKey(const QUuid& dbUuid) const override;
|
||||
|
||||
bool canRemember() const override;
|
||||
|
||||
void reset(const QUuid& dbUuid) override;
|
||||
void reset() override;
|
||||
};
|
||||
|
@ -31,6 +31,8 @@ public:
|
||||
bool getKey(const QUuid& dbUuid, QByteArray& passwordKey) override;
|
||||
bool hasKey(const QUuid& dbUuid) const override;
|
||||
|
||||
bool canRemember() const override;
|
||||
|
||||
void reset(const QUuid& dbUuid = "") override;
|
||||
void reset() override;
|
||||
|
||||
|
@ -68,7 +68,7 @@ void TouchID::deleteKeyEntry(const QString& accountName)
|
||||
|
||||
// get data from the KeyChain
|
||||
OSStatus status = SecItemDelete(query);
|
||||
LogStatusError("TouchID::deleteKeyEntry - Status deleting existing entry", status);
|
||||
LogStatusError("TouchID::deleteKeyEntry - Error deleting existing entry", status);
|
||||
}
|
||||
|
||||
QString TouchID::databaseKeyName(const QUuid& dbUuid)
|
||||
@ -88,41 +88,20 @@ void TouchID::reset()
|
||||
m_encryptedMasterKeys.clear();
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
bool TouchID::setKey(const QUuid& dbUuid, const QByteArray& passwordKey, const bool ignoreTouchID)
|
||||
/**
|
||||
* Store the serialized database key into the macOS key store. The OS handles encrypt/decrypt operations.
|
||||
* https://developer.apple.com/documentation/security/keychain_services/keychain_items
|
||||
*/
|
||||
bool TouchID::setKey(const QUuid& dbUuid, const QByteArray& key, const bool ignoreTouchID)
|
||||
{
|
||||
if (passwordKey.isEmpty()) {
|
||||
if (key.isEmpty()) {
|
||||
debug("TouchID::setKey - illegal arguments");
|
||||
return false;
|
||||
}
|
||||
|
||||
if (m_encryptedMasterKeys.contains(dbUuid)) {
|
||||
debug("TouchID::setKey - Already stored key for this database");
|
||||
return true;
|
||||
}
|
||||
|
||||
// generate random AES 256bit key and IV
|
||||
QByteArray randomKey = randomGen()->randomArray(SymmetricCipher::keySize(SymmetricCipher::Aes256_GCM));
|
||||
QByteArray randomIV = randomGen()->randomArray(SymmetricCipher::defaultIvSize(SymmetricCipher::Aes256_GCM));
|
||||
|
||||
SymmetricCipher aes256Encrypt;
|
||||
if (!aes256Encrypt.init(SymmetricCipher::Aes256_GCM, SymmetricCipher::Encrypt, randomKey, randomIV)) {
|
||||
debug("TouchID::setKey - AES initialisation failed");
|
||||
return false;
|
||||
}
|
||||
|
||||
// encrypt and keep result in memory
|
||||
QByteArray encryptedMasterKey = passwordKey;
|
||||
if (!aes256Encrypt.finish(encryptedMasterKey)) {
|
||||
debug("TouchID::getKey - AES encrypt failed: %s", aes256Encrypt.errorString().toUtf8().constData());
|
||||
return false;
|
||||
}
|
||||
|
||||
const QString keyName = databaseKeyName(dbUuid);
|
||||
|
||||
deleteKeyEntry(keyName); // Try to delete the existing key entry
|
||||
const auto keyName = databaseKeyName(dbUuid);
|
||||
// Try to delete the existing key entry
|
||||
deleteKeyEntry(keyName);
|
||||
|
||||
// prepare adding secure entry to the macOS KeyChain
|
||||
CFErrorRef error = NULL;
|
||||
@ -168,30 +147,33 @@ bool TouchID::setKey(const QUuid& dbUuid, const QByteArray& passwordKey, const b
|
||||
kCFAllocatorDefault, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, accessControlFlags, &error);
|
||||
|
||||
if (sacObject == NULL || error != NULL) {
|
||||
NSError* e = (__bridge NSError*) error;
|
||||
auto e = (__bridge NSError*) error;
|
||||
debug("TouchID::setKey - Error creating security flags: %s", e.localizedDescription.UTF8String);
|
||||
return false;
|
||||
}
|
||||
|
||||
NSString *accountName = keyName.toNSString(); // The NSString is released by Qt
|
||||
auto accountName = keyName.toNSString();
|
||||
auto keyBase64 = key.toBase64();
|
||||
|
||||
// prepare data (key) to be stored
|
||||
QByteArray keychainKeyValue = (randomKey + randomIV).toHex();
|
||||
CFDataRef keychainValueData =
|
||||
CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, reinterpret_cast<UInt8 *>(keychainKeyValue.data()),
|
||||
keychainKeyValue.length(), kCFAllocatorDefault);
|
||||
auto keyValueData = CFDataCreateWithBytesNoCopy(
|
||||
kCFAllocatorDefault, reinterpret_cast<const UInt8 *>(keyBase64.data()),
|
||||
keyBase64.length(), kCFAllocatorDefault);
|
||||
|
||||
CFMutableDictionaryRef attributes = makeDictionary();
|
||||
auto attributes = makeDictionary();
|
||||
CFDictionarySetValue(attributes, kSecClass, kSecClassGenericPassword);
|
||||
CFDictionarySetValue(attributes, kSecAttrAccount, (__bridge CFStringRef) accountName);
|
||||
CFDictionarySetValue(attributes, kSecValueData, (__bridge CFDataRef) keychainValueData);
|
||||
CFDictionarySetValue(attributes, kSecValueData, (__bridge CFDataRef) keyValueData);
|
||||
CFDictionarySetValue(attributes, kSecAttrSynchronizable, kCFBooleanFalse);
|
||||
CFDictionarySetValue(attributes, kSecUseAuthenticationUI, kSecUseAuthenticationUIAllow);
|
||||
#ifndef QT_DEBUG
|
||||
// Only use TouchID when in release build, also requires application entitlements and signing
|
||||
CFDictionarySetValue(attributes, kSecAttrAccessControl, sacObject);
|
||||
#endif
|
||||
|
||||
// add to KeyChain
|
||||
OSStatus status = SecItemAdd(attributes, NULL);
|
||||
LogStatusError("TouchID::setKey - Status adding new entry", status);
|
||||
LogStatusError("TouchID::setKey - Error adding new keychain item", status);
|
||||
|
||||
CFRelease(sacObject);
|
||||
CFRelease(attributes);
|
||||
@ -226,12 +208,12 @@ bool TouchID::setKey(const QUuid& dbUuid, const QByteArray& passwordKey)
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if an encrypted PasswordKey is available for the given database, tries to
|
||||
* decrypt it using the KeyChain and if successful, returns it.
|
||||
* Retrieve serialized key data from the macOS Keychain after successful authentication
|
||||
* with TouchID or Watch interface.
|
||||
*/
|
||||
bool TouchID::getKey(const QUuid& dbUuid, QByteArray& passwordKey)
|
||||
bool TouchID::getKey(const QUuid& dbUuid, QByteArray& key)
|
||||
{
|
||||
passwordKey.clear();
|
||||
key.clear();
|
||||
|
||||
if (!hasKey(dbUuid)) {
|
||||
debug("TouchID::getKey - No stored key found");
|
||||
@ -266,39 +248,30 @@ bool TouchID::getKey(const QUuid& dbUuid, QByteArray& passwordKey)
|
||||
return false;
|
||||
}
|
||||
|
||||
// Convert value returned to serialized key
|
||||
CFDataRef valueData = static_cast<CFDataRef>(dataTypeRef);
|
||||
QByteArray dataBytes = QByteArray::fromHex(QByteArray(reinterpret_cast<const char*>(CFDataGetBytePtr(valueData)),
|
||||
CFDataGetLength(valueData)));
|
||||
key = QByteArray::fromBase64(QByteArray(reinterpret_cast<const char*>(CFDataGetBytePtr(valueData)),
|
||||
CFDataGetLength(valueData)));
|
||||
CFRelease(dataTypeRef);
|
||||
|
||||
// extract AES key and IV from data bytes
|
||||
QByteArray key = dataBytes.left(SymmetricCipher::keySize(SymmetricCipher::Aes256_GCM));
|
||||
QByteArray iv = dataBytes.right(SymmetricCipher::defaultIvSize(SymmetricCipher::Aes256_GCM));
|
||||
|
||||
SymmetricCipher aes256Decrypt;
|
||||
if (!aes256Decrypt.init(SymmetricCipher::Aes256_GCM, SymmetricCipher::Decrypt, key, iv)) {
|
||||
debug("TouchID::getKey - AES initialization failed");
|
||||
return false;
|
||||
}
|
||||
|
||||
// decrypt PasswordKey from memory using AES
|
||||
passwordKey = m_encryptedMasterKeys[dbUuid];
|
||||
if (!aes256Decrypt.finish(passwordKey)) {
|
||||
passwordKey.clear();
|
||||
debug("TouchID::getKey - AES decrypt failed: %s", aes256Decrypt.errorString().toUtf8().constData());
|
||||
return false;
|
||||
}
|
||||
|
||||
// Cleanse the key information from the memory
|
||||
Botan::secure_scrub_memory(key.data(), key.size());
|
||||
Botan::secure_scrub_memory(iv.data(), iv.size());
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool TouchID::hasKey(const QUuid& dbUuid) const
|
||||
{
|
||||
return m_encryptedMasterKeys.contains(dbUuid);
|
||||
const QString keyName = databaseKeyName(dbUuid);
|
||||
NSString* accountName = keyName.toNSString(); // The NSString is released by Qt
|
||||
|
||||
CFMutableDictionaryRef query = makeDictionary();
|
||||
CFDictionarySetValue(query, kSecClass, kSecClassGenericPassword);
|
||||
CFDictionarySetValue(query, kSecAttrAccount, (__bridge CFStringRef) accountName);
|
||||
CFDictionarySetValue(query, kSecReturnData, kCFBooleanFalse);
|
||||
|
||||
CFTypeRef item = NULL;
|
||||
OSStatus status = SecItemCopyMatching(query, &item);
|
||||
CFRelease(query);
|
||||
|
||||
return status == errSecSuccess;
|
||||
}
|
||||
|
||||
// TODO: Both functions below should probably handle the returned errors to
|
||||
@ -320,11 +293,7 @@ bool TouchID::isWatchAvailable()
|
||||
bool canAuthenticate = [context canEvaluatePolicy:policyCode error:&error];
|
||||
[context release];
|
||||
if (error) {
|
||||
debug("Apple Wach available: %d (%ld / %s / %s)", canAuthenticate,
|
||||
(long)error.code, error.description.UTF8String,
|
||||
error.localizedDescription.UTF8String);
|
||||
} else {
|
||||
debug("Apple Wach available: %d", canAuthenticate);
|
||||
debug("Apple Watch is not available: %s", error.localizedDescription.UTF8String);
|
||||
}
|
||||
return canAuthenticate;
|
||||
} @catch (NSException *) {
|
||||
@ -348,11 +317,7 @@ bool TouchID::isTouchIdAvailable()
|
||||
bool canAuthenticate = [context canEvaluatePolicy:policyCode error:&error];
|
||||
[context release];
|
||||
if (error) {
|
||||
debug("Touch ID available: %d (%ld / %s / %s)", canAuthenticate,
|
||||
(long)error.code, error.description.UTF8String,
|
||||
error.localizedDescription.UTF8String);
|
||||
} else {
|
||||
debug("Touch ID available: %d", canAuthenticate);
|
||||
debug("Touch ID is not available: %s", error.localizedDescription.UTF8String);
|
||||
}
|
||||
return canAuthenticate;
|
||||
} @catch (NSException *) {
|
||||
@ -399,10 +364,15 @@ bool TouchID::isAvailable() const
|
||||
return isWatchAvailable() || isTouchIdAvailable() || isPasswordFallbackPossible();
|
||||
}
|
||||
|
||||
bool TouchID::canRemember() const
|
||||
{
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resets the inner state either for all or for the given database
|
||||
*/
|
||||
void TouchID::reset(const QUuid& dbUuid)
|
||||
{
|
||||
m_encryptedMasterKeys.remove(dbUuid);
|
||||
deleteKeyEntry(databaseKeyName(dbUuid));
|
||||
}
|
||||
|
@ -19,6 +19,7 @@
|
||||
|
||||
#include <Userconsentverifierinterop.h>
|
||||
#include <winrt/base.h>
|
||||
#include <winrt/windows.foundation.collections.h>
|
||||
#include <winrt/windows.foundation.h>
|
||||
#include <winrt/windows.security.credentials.h>
|
||||
#include <winrt/windows.security.cryptography.h>
|
||||
@ -34,6 +35,7 @@
|
||||
|
||||
using namespace winrt;
|
||||
using namespace Windows::Foundation;
|
||||
using namespace Windows::Foundation::Collections;
|
||||
using namespace Windows::Security::Credentials;
|
||||
using namespace Windows::Security::Cryptography;
|
||||
using namespace Windows::Storage::Streams;
|
||||
@ -97,6 +99,47 @@ namespace
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
void storeCredential(const QUuid& uuid, const QByteArray& data)
|
||||
{
|
||||
auto vault = PasswordVault();
|
||||
vault.Add({s_winHelloKeyName,
|
||||
winrt::to_hstring(uuid.toString().toStdString()),
|
||||
winrt::to_hstring(data.toBase64().toStdString())});
|
||||
}
|
||||
|
||||
void removeCredential(const QUuid& uuid)
|
||||
{
|
||||
try {
|
||||
auto vault = PasswordVault();
|
||||
vault.Remove({s_winHelloKeyName, winrt::to_hstring(uuid.toString().toStdString()), L"blah"});
|
||||
} catch (winrt::hresult_error const& ex) {
|
||||
}
|
||||
}
|
||||
|
||||
void resetCredentials()
|
||||
{
|
||||
auto vault = PasswordVault();
|
||||
auto credentials = vault.FindAllByResource(s_winHelloKeyName);
|
||||
for (const auto& credential : credentials) {
|
||||
try {
|
||||
vault.Remove(credential);
|
||||
} catch (winrt::hresult_error const& ex) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
QByteArray loadCredential(const QUuid& uuid)
|
||||
{
|
||||
QByteArray data;
|
||||
try {
|
||||
auto vault = PasswordVault();
|
||||
auto credential = vault.Retrieve(s_winHelloKeyName, winrt::to_hstring(uuid.toString().toStdString()));
|
||||
data = QByteArray::fromBase64(QByteArray::fromStdString(winrt::to_string(credential.Password())));
|
||||
} catch (winrt::hresult_error const& ex) {
|
||||
}
|
||||
return data;
|
||||
}
|
||||
} // namespace
|
||||
|
||||
bool WindowsHello::isAvailable() const
|
||||
@ -120,6 +163,7 @@ bool WindowsHello::setKey(const QUuid& dbUuid, const QByteArray& data)
|
||||
auto challenge = Random::instance()->randomArray(ivSize);
|
||||
QByteArray key;
|
||||
if (!deriveEncryptionKey(challenge, key, m_error)) {
|
||||
m_error = QObject::tr("Windows Hello setup was canceled or failed. Quick unlock has not been enabled.");
|
||||
return false;
|
||||
}
|
||||
|
||||
@ -137,7 +181,7 @@ bool WindowsHello::setKey(const QUuid& dbUuid, const QByteArray& data)
|
||||
|
||||
// Prepend the challenge/IV to the encrypted data
|
||||
encrypted.prepend(challenge);
|
||||
m_encryptedKeys.insert(dbUuid, encrypted);
|
||||
storeCredential(dbUuid, encrypted);
|
||||
return true;
|
||||
}
|
||||
|
||||
@ -153,7 +197,7 @@ bool WindowsHello::getKey(const QUuid& dbUuid, QByteArray& data)
|
||||
|
||||
// Read the previously used challenge and encrypted data
|
||||
auto ivSize = SymmetricCipher::defaultIvSize(SymmetricCipher::Aes256_GCM);
|
||||
const auto& keydata = m_encryptedKeys.value(dbUuid);
|
||||
const auto& keydata = loadCredential(dbUuid);
|
||||
auto challenge = keydata.left(ivSize);
|
||||
auto encrypted = keydata.mid(ivSize);
|
||||
QByteArray key;
|
||||
@ -182,15 +226,20 @@ bool WindowsHello::getKey(const QUuid& dbUuid, QByteArray& data)
|
||||
|
||||
void WindowsHello::reset(const QUuid& dbUuid)
|
||||
{
|
||||
m_encryptedKeys.remove(dbUuid);
|
||||
removeCredential(dbUuid);
|
||||
}
|
||||
|
||||
bool WindowsHello::hasKey(const QUuid& dbUuid) const
|
||||
{
|
||||
return m_encryptedKeys.contains(dbUuid);
|
||||
return !loadCredential(dbUuid).isEmpty();
|
||||
}
|
||||
|
||||
bool WindowsHello::canRemember() const
|
||||
{
|
||||
return true;
|
||||
}
|
||||
|
||||
void WindowsHello::reset()
|
||||
{
|
||||
m_encryptedKeys.clear();
|
||||
resetCredentials();
|
||||
}
|
||||
|
@ -27,18 +27,21 @@ class WindowsHello : public QuickUnlockInterface
|
||||
{
|
||||
public:
|
||||
WindowsHello() = default;
|
||||
|
||||
bool isAvailable() const override;
|
||||
QString errorString() const override;
|
||||
void reset() override;
|
||||
|
||||
bool setKey(const QUuid& dbUuid, const QByteArray& key) override;
|
||||
bool getKey(const QUuid& dbUuid, QByteArray& key) override;
|
||||
bool hasKey(const QUuid& dbUuid) const override;
|
||||
void reset(const QUuid& dbUuid) override;
|
||||
|
||||
bool canRemember() const override;
|
||||
|
||||
void reset(const QUuid& dbUuid) override;
|
||||
void reset() override;
|
||||
|
||||
private:
|
||||
QString m_error;
|
||||
QHash<QUuid, QByteArray> m_encryptedKeys;
|
||||
Q_DISABLE_COPY(WindowsHello);
|
||||
};
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user