1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
|
// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef COMPONENTS_OS_CRYPT_ASYNC_BROWSER_FREEDESKTOP_SECRET_KEY_PROVIDER_H_
#define COMPONENTS_OS_CRYPT_ASYNC_BROWSER_FREEDESKTOP_SECRET_KEY_PROVIDER_H_
#include <map>
#include <memory>
#include <string>
#include <vector>
#include "base/files/scoped_file.h"
#include "base/gtest_prod_util.h"
#include "base/memory/raw_ptr.h"
#include "base/memory/ref_counted_memory.h"
#include "base/memory/weak_ptr.h"
#include "base/sequence_checker.h"
#include "base/types/expected.h"
#include "build/branding_buildflags.h"
#include "components/dbus/properties/types.h"
#include "components/dbus/utils/check_for_service_and_start.h"
#include "components/dbus/utils/name_has_owner.h"
#include "components/os_crypt/async/browser/key_provider.h"
#include "dbus/bus.h"
#include "dbus/object_path.h"
#include "dbus/object_proxy.h"
namespace os_crypt_async {
// FreedesktopSecretKeyProvider uses the org.freedesktop.secrets interface
// to retrieve a secret from backend (GNOME Keyring, KWallet, KeePassXC),
// which can then be used to encrypt confidential data.
class FreedesktopSecretKeyProvider : public KeyProvider {
public:
enum class InitStatus {
// These values are persisted to logs. Do not renumber or reuse.
kSuccess = 0,
kCreateCollectionFailed = 1,
kCreateItemFailed = 2,
kEmptySecret = 3,
kGetSecretFailed = 4,
kGnomeKeyringDeadlock = 5,
kNoService = 6,
kReadAliasFailed = 7,
kSearchItemsFailed = 8,
kSessionFailure = 9,
kUnlockFailed = 10,
kDisabled = 11,
kKWalletNoService = 12,
kKWalletDisabled = 13,
kKWalletNoNetworkWallet = 14,
kKWalletOpenFailed = 15,
kKWalletNoSecret = 16,
kKWalletFolderCheckFailed = 17,
kKWalletFolderCreationFailed = 18,
kKWalletEntryCheckFailed = 19,
kKWalletReadFailed = 20,
kKWalletWriteFailed = 21,
kMaxValue = kKWalletWriteFailed,
};
// Supplements InitStatus in case of errors.
enum class ErrorDetail {
// These values are persisted to logs. Do not renumber or reuse.
kNone = 0,
kDestructedBeforeComplete = 1,
kEmptyObjectPaths = 2,
kInvalidReplyFormat = 3,
kInvalidSignalFormat = 4,
kInvalidVariantFormat = 5,
kNoResponse = 6,
kPromptDismissed = 7,
kPromptFailedSignalConnection = 8,
kKWalletApiReturnedError = 9,
kKWalletApiReturnedFalse = 10,
kMaxValue = kKWalletApiReturnedFalse,
};
FreedesktopSecretKeyProvider(const std::string& password_store,
bool use_for_encryption,
const std::string& product_name,
scoped_refptr<dbus::Bus> bus);
~FreedesktopSecretKeyProvider() override;
// KeyProvider:
void GetKey(KeyCallback callback) override;
bool UseForEncryption() override;
bool IsCompatibleWithOsCryptSync() override;
private:
FRIEND_TEST_ALL_PREFIXES(FreedesktopSecretKeyProviderTest, BasicHappyPath);
FRIEND_TEST_ALL_PREFIXES(FreedesktopSecretKeyProviderTest,
CreateCollectionAndItemWithUnlockPrompt);
FRIEND_TEST_ALL_PREFIXES(FreedesktopSecretKeyProviderTest, KWallet);
FRIEND_TEST_ALL_PREFIXES(FreedesktopSecretKeyProviderTest,
KWalletCreateFolderAndPassword);
friend class FreedesktopSecretKeyProviderCompatTest;
template <typename T>
class Prompter;
using DbusSecret = DbusStruct</*session=*/DbusObjectPath,
/*parameters=*/DbusByteArray,
/*value=*/DbusByteArray,
/*content_type=*/DbusString>;
static constexpr char kSecretServiceName[] = "org.freedesktop.secrets";
static constexpr char kSecretServicePath[] = "/org/freedesktop/secrets";
static constexpr char kSecretServiceInterface[] =
"org.freedesktop.Secret.Service";
static constexpr char kSecretCollectionInterface[] =
"org.freedesktop.Secret.Collection";
static constexpr char kSecretItemInterface[] = "org.freedesktop.Secret.Item";
static constexpr char kSecretSessionInterface[] =
"org.freedesktop.Secret.Session";
static constexpr char kSecretPromptInterface[] =
"org.freedesktop.Secret.Prompt";
static constexpr char kMethodReadAlias[] = "ReadAlias";
static constexpr char kMethodCreateCollection[] = "CreateCollection";
static constexpr char kMethodGetSecret[] = "GetSecret";
static constexpr char kMethodOpenSession[] = "OpenSession";
static constexpr char kMethodCreateItem[] = "CreateItem";
static constexpr char kMethodUnlock[] = "Unlock";
static constexpr char kMethodClose[] = "Close";
static constexpr char kMethodSearchItems[] = "SearchItems";
static constexpr char kPropertiesInterface[] =
"org.freedesktop.DBus.Properties";
static constexpr char kMethodGet[] = "Get";
static constexpr char kMethodPrompt[] = "Prompt";
static constexpr char kKWalletInterface[] = "org.kde.KWallet";
static constexpr char kKWalletMethodIsEnabled[] = "isEnabled";
static constexpr char kKWalletMethodNetworkWallet[] = "networkWallet";
static constexpr char kKWalletMethodOpen[] = "open";
static constexpr char kKWalletMethodReadPassword[] = "readPassword";
static constexpr char kKWalletMethodClose[] = "close";
static constexpr char kKWalletMethodHasFolder[] = "hasFolder";
static constexpr char kKWalletMethodCreateFolder[] = "createFolder";
static constexpr char kKWalletMethodHasEntry[] = "hasEntry";
static constexpr char kKWalletMethodWritePassword[] = "writePassword";
static constexpr char kDefaultAlias[] = "default";
// These constants are duplicated from the sync backend.
static constexpr char kApplicationAttributeKey[] = "application";
static constexpr char kSchemaAttributeKey[] = "xdg:schema";
static constexpr char kSchemaAttributeValue[] =
"chrome_libsecret_os_crypt_password_v2";
static constexpr char kAlgorithmPlain[] = "plain";
static constexpr char kInputPlain[] = "";
static constexpr char kMimePlain[] = "text/plain";
static constexpr char kSecretCollectionLabelProperty[] =
"org.freedesktop.Secret.Collection.Label";
static constexpr char kSecretItemAttributesProperty[] =
"org.freedesktop.Secret.Item.Attributes";
static constexpr char kSecretItemLabelProperty[] =
"org.freedesktop.Secret.Item.Label";
static constexpr char kDefaultCollectionLabel[] = "Default Keyring";
static constexpr char kLabelProperty[] = "Label";
static constexpr char kKWalletDService[] = "org.kde.kwalletd";
static constexpr char kKWalletDPath[] = "/modules/kwalletd";
static constexpr char kKWalletD5Service[] = "org.kde.kwalletd5";
static constexpr char kKWalletD5Path[] = "/modules/kwalletd5";
static constexpr char kKWalletD6Service[] = "org.kde.kwalletd6";
static constexpr char kKWalletD6Path[] = "/modules/kwalletd6";
static constexpr int kKWalletInvalidHandle = -1;
#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
static constexpr char kKWalletFolder[] = "Chrome Keys";
static constexpr char kKeyName[] = "Chrome Safe Storage";
static constexpr char kAppName[] = "chrome";
#else
static constexpr char kKWalletFolder[] = "Chromium Keys";
static constexpr char kKeyName[] = "Chromium Safe Storage";
static constexpr char kAppName[] = "chromium";
#endif
void InitializeFreedesktopSecretService();
void OnServiceStarted(std::optional<bool> service_started);
void OnReadAliasDefault(
base::expected<DbusObjectPath, ErrorDetail> collection_path);
void OnGetCollectionLabelResponse(
base::expected<DbusVariant, ErrorDetail> variant);
void OnCreateCollection(
base::expected<DbusObjectPath, ErrorDetail> create_collection_reply);
void OnUnlock(base::expected<DbusArray<DbusObjectPath>, ErrorDetail>
unlocked_collection);
void OnOpenSession(base::expected<DbusParameters<DbusVariant, DbusObjectPath>,
ErrorDetail> session_reply);
void OnSearchItems(
base::expected<DbusArray<DbusObjectPath>, ErrorDetail> results);
void OnGetSecret(base::expected<DbusSecret, ErrorDetail> secret_reply);
// KWallet password storage
void InitializeKWallet(const char* kwallet_service, const char* kwallet_path);
void OnKWalletServiceStarted(std::optional<bool> has_owner);
void OnKWalletIsEnabled(base::expected<DbusBoolean, ErrorDetail> is_enabled);
void OnKWalletNetworkWallet(
base::expected<DbusString, ErrorDetail> wallet_name);
void OnKWalletOpen(base::expected<DbusInt32, ErrorDetail> handle_reply);
void OnKWalletHasFolder(base::expected<DbusBoolean, ErrorDetail> has_folder);
void OnKWalletCreateFolder(base::expected<DbusBoolean, ErrorDetail> success);
void OnKWalletHasEntry(base::expected<DbusBoolean, ErrorDetail> has_entry);
void OnKWalletReadPassword(
base::expected<DbusString, ErrorDetail> secret_reply);
void GenerateAndWriteKWalletPassword();
void OnKWalletWritePassword(
scoped_refptr<base::RefCountedMemory> generated_secret,
base::expected<DbusInt32, ErrorDetail> return_code);
void UnlockDefaultCollection();
void OpenSession();
void CreateItem(scoped_refptr<base::RefCountedMemory> secret);
void OnCreateItem(scoped_refptr<base::RefCountedMemory> secret,
base::expected<DbusObjectPath, ErrorDetail> created_item);
void DeriveKeyFromSecret(base::span<const uint8_t> secret);
void FinalizeSuccess(Encryptor::Key key);
void FinalizeFailure(InitStatus status, ErrorDetail detail);
void RecordInitStatus(InitStatus status, ErrorDetail detail);
void CloseSession();
raw_ptr<dbus::ObjectProxy> default_collection_proxy_ = nullptr;
raw_ptr<dbus::ObjectProxy> session_proxy_ = nullptr;
bool session_opened_ = false;
// For KWallet password storage
raw_ptr<dbus::ObjectProxy> kwallet_proxy_ = nullptr;
int32_t kwallet_handle_ = kKWalletInvalidHandle;
const std::string password_store_;
const bool use_for_encryption_;
const std::string product_name_;
scoped_refptr<dbus::Bus> bus_;
KeyCallback key_callback_;
std::string secret_for_testing_;
SEQUENCE_CHECKER(sequence_checker_);
base::WeakPtrFactory<FreedesktopSecretKeyProvider> weak_ptr_factory_{this};
};
} // namespace os_crypt_async
#endif // COMPONENTS_OS_CRYPT_ASYNC_BROWSER_FREEDESKTOP_SECRET_KEY_PROVIDER_H_
|
