diff --git a/share/translations/keepassxc_en.ts b/share/translations/keepassxc_en.ts
index 3463122c4..70a4c4864 100644
--- a/share/translations/keepassxc_en.ts
+++ b/share/translations/keepassxc_en.ts
@@ -156,6 +156,14 @@
SSH Agent connection is working!
+
+ Enable destination constraints
+
+
+
+ Destination contrains can have unexpected side effects. Make sure to read the <a href="https://keepassxc.org/docs/KeePassXC_UserGuide#_using_destination_constraints">documentation</a>.
+
+
ApplicationSettingsWidget
diff --git a/src/core/Config.cpp b/src/core/Config.cpp
index a876b36f2..2968057e5 100644
--- a/src/core/Config.cpp
+++ b/src/core/Config.cpp
@@ -183,6 +183,7 @@ static const QHash configStrings = {
{Config::SSHAgent_Enabled, {QS("SSHAgent/Enabled"), Roaming, false}},
{Config::SSHAgent_UseOpenSSH, {QS("SSHAgent/UseOpenSSH"), Roaming, false}},
{Config::SSHAgent_UsePageant, {QS("SSHAgent/UsePageant"), Roaming, true} },
+ {Config::SSHAgent_EnableDestinationConstraints, {QS("SSHAgent/EnableDestinationConstraints"), Roaming, false} },
{Config::SSHAgent_AuthSockOverride, {QS("SSHAgent/AuthSockOverride"), Local, {}}},
{Config::SSHAgent_SecurityKeyProviderOverride, {QS("SSHAgent/SecurityKeyProviderOverride"), Local, {}}},
diff --git a/src/core/Config.h b/src/core/Config.h
index 5911d78a1..f78710e14 100644
--- a/src/core/Config.h
+++ b/src/core/Config.h
@@ -162,6 +162,7 @@ public:
SSHAgent_Enabled,
SSHAgent_UseOpenSSH,
SSHAgent_UsePageant,
+ SSHAgent_EnableDestinationConstraints,
SSHAgent_AuthSockOverride,
SSHAgent_SecurityKeyProviderOverride,
diff --git a/src/sshagent/AgentSettingsWidget.cpp b/src/sshagent/AgentSettingsWidget.cpp
index bdad6e30e..8ddccbe68 100644
--- a/src/sshagent/AgentSettingsWidget.cpp
+++ b/src/sshagent/AgentSettingsWidget.cpp
@@ -35,7 +35,21 @@ AgentSettingsWidget::AgentSettingsWidget(QWidget* parent)
m_ui->sshAuthSockMessageWidget->setVisible(sshAgent()->isEnabled());
m_ui->sshAuthSockMessageWidget->setCloseButtonVisible(false);
m_ui->sshAuthSockMessageWidget->setAutoHideTimeout(-1);
+
+ m_ui->destinationConstraintsMessageWidget->setCloseButtonVisible(false);
+ m_ui->destinationConstraintsMessageWidget->setAutoHideTimeout(-1);
+ m_ui->destinationConstraintsMessageWidget->showMessage(
+ tr("Destination contrains can have unexpected side effects. "
+ "Make sure to read the "
+ "documentation."),
+ MessageWidget::Warning);
+ m_ui->destinationConstraintsMessageWidget->setVisible(sshAgent()->enableDestinationConstraints());
+
connect(m_ui->enableSSHAgentCheckBox, SIGNAL(stateChanged(int)), SLOT(toggleSettingsEnabled()));
+ connect(m_ui->enableDestinationConstraintsCheckBox,
+ SIGNAL(stateChanged(int)),
+ SLOT(toggleDestinationConstraintsEnabled()));
}
AgentSettingsWidget::~AgentSettingsWidget()
@@ -66,6 +80,9 @@ void AgentSettingsWidget::loadSettings()
m_ui->sshAuthSockMessageWidget->setVisible(sshAgentEnabled);
+ auto destinationConstraintsEnabled = sshAgent()->enableDestinationConstraints();
+ m_ui->enableDestinationConstraintsCheckBox->setChecked(destinationConstraintsEnabled);
+
if (sshAgentEnabled) {
#ifndef Q_OS_WIN
if (sshAuthSock.isEmpty() && sshAuthSockOverride.isEmpty()) {
@@ -98,6 +115,7 @@ void AgentSettingsWidget::saveSettings()
sshAgent()->setUsePageant(m_ui->usePageantRadioButton->isChecked() || m_ui->useBothRadioButton->isChecked());
sshAgent()->setUseOpenSSH(m_ui->useOpenSSHRadioButton->isChecked() || m_ui->useBothRadioButton->isChecked());
#endif
+ sshAgent()->setEnableDestinationConstraints(m_ui->enableDestinationConstraintsCheckBox->isChecked());
sshAgent()->setEnabled(m_ui->enableSSHAgentCheckBox->isChecked());
}
@@ -105,3 +123,8 @@ void AgentSettingsWidget::toggleSettingsEnabled()
{
m_ui->agentConfigPageBody->setEnabled(m_ui->enableSSHAgentCheckBox->isChecked());
}
+
+void AgentSettingsWidget::toggleDestinationConstraintsEnabled()
+{
+ m_ui->destinationConstraintsMessageWidget->setVisible(m_ui->enableDestinationConstraintsCheckBox->isChecked());
+}
diff --git a/src/sshagent/AgentSettingsWidget.h b/src/sshagent/AgentSettingsWidget.h
index 67c41ffde..265d2c9a1 100644
--- a/src/sshagent/AgentSettingsWidget.h
+++ b/src/sshagent/AgentSettingsWidget.h
@@ -39,6 +39,7 @@ public slots:
void loadSettings();
void saveSettings();
void toggleSettingsEnabled();
+ void toggleDestinationConstraintsEnabled();
private:
QScopedPointer m_ui;
diff --git a/src/sshagent/AgentSettingsWidget.ui b/src/sshagent/AgentSettingsWidget.ui
index abd056c8a..99ae5e062 100644
--- a/src/sshagent/AgentSettingsWidget.ui
+++ b/src/sshagent/AgentSettingsWidget.ui
@@ -7,7 +7,7 @@
0
0
400
- 300
+ 443
@@ -93,6 +93,16 @@
+ -
+
+
+ Enable destination constraints
+
+
+
+ -
+
+
-
@@ -107,42 +117,29 @@
8
-
-
-
+
-
+
- SSH_AUTH_SOCK override
+ SSH_SK_PROVIDER override
Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
- -
-
-
- SSH_AUTH_SOCK value
-
-
- Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
-
-
-
- -
-
-
- Qt::Vertical
-
-
-
- 20
- 40
-
-
-
-
-
+ -
+
+
+ SSH_SK_PROVIDER value
+
+
+ Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
+
+
+
-
@@ -158,10 +155,36 @@
- -
-
+
-
+
+
+ -
+
+
+ Qt::Vertical
+
+
+
+ 20
+ 40
+
+
+
+
+ -
+
- SSH_SK_PROVIDER value
+ SSH_AUTH_SOCK value
+
+
+ Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
+
+
+
+ -
+
+
+ SSH_AUTH_SOCK override
Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
@@ -183,19 +206,6 @@
- -
-
-
- SSH_SK_PROVIDER override
-
-
- Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
-
-
-
- -
-
-
diff --git a/src/sshagent/SSHAgent.cpp b/src/sshagent/SSHAgent.cpp
index ead599c77..ac639d80b 100644
--- a/src/sshagent/SSHAgent.cpp
+++ b/src/sshagent/SSHAgent.cpp
@@ -98,6 +98,16 @@ void SSHAgent::setUsePageant(bool usePageant)
}
#endif
+bool SSHAgent::enableDestinationConstraints() const
+{
+ return config()->get(Config::SSHAgent_EnableDestinationConstraints).toBool();
+}
+
+void SSHAgent::setEnableDestinationConstraints(bool enableDestinationConstraints)
+{
+ config()->set(Config::SSHAgent_EnableDestinationConstraints, enableDestinationConstraints);
+}
+
QString SSHAgent::socketPath(bool allowOverride) const
{
QString socketPath;
@@ -305,7 +315,7 @@ bool SSHAgent::addIdentity(OpenSSHKey& key, const KeeAgentSettings& settings, co
request.writeString(securityKeyProvider());
}
- if (settings.useDestinationConstraintsWhenAdding()) {
+ if (enableDestinationConstraints() && settings.useDestinationConstraintsWhenAdding()) {
request.write(SSH_AGENT_CONSTRAIN_EXTENSION);
request.writeString(QString("restrict-destination-v00@openssh.com"));
encodeDestinationConstraints(settings.destinationConstraints(), request);
@@ -328,7 +338,7 @@ bool SSHAgent::addIdentity(OpenSSHKey& key, const KeeAgentSettings& settings, co
m_error += "\n" + tr("A confirmation request is not supported by the agent (check options).");
}
- if (settings.useDestinationConstraintsWhenAdding()) {
+ if (enableDestinationConstraints() && settings.useDestinationConstraintsWhenAdding()) {
m_error += "\n" + tr("Destination constraints are invalid or not supported by the agent (check options).");
}
diff --git a/src/sshagent/SSHAgent.h b/src/sshagent/SSHAgent.h
index 0001b8167..5c02dabf3 100644
--- a/src/sshagent/SSHAgent.h
+++ b/src/sshagent/SSHAgent.h
@@ -48,6 +48,8 @@ public:
void setUseOpenSSH(bool useOpenSSH);
void setUsePageant(bool usePageant);
#endif
+ bool enableDestinationConstraints() const;
+ void setEnableDestinationConstraints(bool enableDestinationConstraints);
const QString errorString() const;
bool isAgentRunning() const;