From e8690c4ce81747dbd763a34bdbb275363eb25c54 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Konrad=20Vit=C3=A9?= Date: Thu, 6 Feb 2025 22:08:19 +0100 Subject: [PATCH] ssh-agent: Add global option to enable or disable destination contraints MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Konrad Vité --- share/translations/keepassxc_en.ts | 8 +++ src/core/Config.cpp | 1 + src/core/Config.h | 1 + src/sshagent/AgentSettingsWidget.cpp | 23 +++++++ src/sshagent/AgentSettingsWidget.h | 1 + src/sshagent/AgentSettingsWidget.ui | 96 +++++++++++++++------------- src/sshagent/SSHAgent.cpp | 14 +++- src/sshagent/SSHAgent.h | 2 + 8 files changed, 101 insertions(+), 45 deletions(-) diff --git a/share/translations/keepassxc_en.ts b/share/translations/keepassxc_en.ts index 3463122c4..70a4c4864 100644 --- a/share/translations/keepassxc_en.ts +++ b/share/translations/keepassxc_en.ts @@ -156,6 +156,14 @@ SSH Agent connection is working! + + Enable destination constraints + + + + Destination contrains can have unexpected side effects. Make sure to read the <a href="https://keepassxc.org/docs/KeePassXC_UserGuide#_using_destination_constraints">documentation</a>. + + ApplicationSettingsWidget diff --git a/src/core/Config.cpp b/src/core/Config.cpp index a876b36f2..2968057e5 100644 --- a/src/core/Config.cpp +++ b/src/core/Config.cpp @@ -183,6 +183,7 @@ static const QHash configStrings = { {Config::SSHAgent_Enabled, {QS("SSHAgent/Enabled"), Roaming, false}}, {Config::SSHAgent_UseOpenSSH, {QS("SSHAgent/UseOpenSSH"), Roaming, false}}, {Config::SSHAgent_UsePageant, {QS("SSHAgent/UsePageant"), Roaming, true} }, + {Config::SSHAgent_EnableDestinationConstraints, {QS("SSHAgent/EnableDestinationConstraints"), Roaming, false} }, {Config::SSHAgent_AuthSockOverride, {QS("SSHAgent/AuthSockOverride"), Local, {}}}, {Config::SSHAgent_SecurityKeyProviderOverride, {QS("SSHAgent/SecurityKeyProviderOverride"), Local, {}}}, diff --git a/src/core/Config.h b/src/core/Config.h index 5911d78a1..f78710e14 100644 --- a/src/core/Config.h +++ b/src/core/Config.h @@ -162,6 +162,7 @@ public: SSHAgent_Enabled, SSHAgent_UseOpenSSH, SSHAgent_UsePageant, + SSHAgent_EnableDestinationConstraints, SSHAgent_AuthSockOverride, SSHAgent_SecurityKeyProviderOverride, diff --git a/src/sshagent/AgentSettingsWidget.cpp b/src/sshagent/AgentSettingsWidget.cpp index bdad6e30e..8ddccbe68 100644 --- a/src/sshagent/AgentSettingsWidget.cpp +++ b/src/sshagent/AgentSettingsWidget.cpp @@ -35,7 +35,21 @@ AgentSettingsWidget::AgentSettingsWidget(QWidget* parent) m_ui->sshAuthSockMessageWidget->setVisible(sshAgent()->isEnabled()); m_ui->sshAuthSockMessageWidget->setCloseButtonVisible(false); m_ui->sshAuthSockMessageWidget->setAutoHideTimeout(-1); + + m_ui->destinationConstraintsMessageWidget->setCloseButtonVisible(false); + m_ui->destinationConstraintsMessageWidget->setAutoHideTimeout(-1); + m_ui->destinationConstraintsMessageWidget->showMessage( + tr("Destination contrains can have unexpected side effects. " + "Make sure to read the " + "documentation."), + MessageWidget::Warning); + m_ui->destinationConstraintsMessageWidget->setVisible(sshAgent()->enableDestinationConstraints()); + connect(m_ui->enableSSHAgentCheckBox, SIGNAL(stateChanged(int)), SLOT(toggleSettingsEnabled())); + connect(m_ui->enableDestinationConstraintsCheckBox, + SIGNAL(stateChanged(int)), + SLOT(toggleDestinationConstraintsEnabled())); } AgentSettingsWidget::~AgentSettingsWidget() @@ -66,6 +80,9 @@ void AgentSettingsWidget::loadSettings() m_ui->sshAuthSockMessageWidget->setVisible(sshAgentEnabled); + auto destinationConstraintsEnabled = sshAgent()->enableDestinationConstraints(); + m_ui->enableDestinationConstraintsCheckBox->setChecked(destinationConstraintsEnabled); + if (sshAgentEnabled) { #ifndef Q_OS_WIN if (sshAuthSock.isEmpty() && sshAuthSockOverride.isEmpty()) { @@ -98,6 +115,7 @@ void AgentSettingsWidget::saveSettings() sshAgent()->setUsePageant(m_ui->usePageantRadioButton->isChecked() || m_ui->useBothRadioButton->isChecked()); sshAgent()->setUseOpenSSH(m_ui->useOpenSSHRadioButton->isChecked() || m_ui->useBothRadioButton->isChecked()); #endif + sshAgent()->setEnableDestinationConstraints(m_ui->enableDestinationConstraintsCheckBox->isChecked()); sshAgent()->setEnabled(m_ui->enableSSHAgentCheckBox->isChecked()); } @@ -105,3 +123,8 @@ void AgentSettingsWidget::toggleSettingsEnabled() { m_ui->agentConfigPageBody->setEnabled(m_ui->enableSSHAgentCheckBox->isChecked()); } + +void AgentSettingsWidget::toggleDestinationConstraintsEnabled() +{ + m_ui->destinationConstraintsMessageWidget->setVisible(m_ui->enableDestinationConstraintsCheckBox->isChecked()); +} diff --git a/src/sshagent/AgentSettingsWidget.h b/src/sshagent/AgentSettingsWidget.h index 67c41ffde..265d2c9a1 100644 --- a/src/sshagent/AgentSettingsWidget.h +++ b/src/sshagent/AgentSettingsWidget.h @@ -39,6 +39,7 @@ public slots: void loadSettings(); void saveSettings(); void toggleSettingsEnabled(); + void toggleDestinationConstraintsEnabled(); private: QScopedPointer m_ui; diff --git a/src/sshagent/AgentSettingsWidget.ui b/src/sshagent/AgentSettingsWidget.ui index abd056c8a..99ae5e062 100644 --- a/src/sshagent/AgentSettingsWidget.ui +++ b/src/sshagent/AgentSettingsWidget.ui @@ -7,7 +7,7 @@ 0 0 400 - 300 + 443 @@ -93,6 +93,16 @@ + + + + Enable destination constraints + + + + + + @@ -107,42 +117,29 @@ 8 - - + + - SSH_AUTH_SOCK override + SSH_SK_PROVIDER override Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter - - - - SSH_AUTH_SOCK value - - - Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter - - - - - - - Qt::Vertical - - - - 20 - 40 - - - - + + + + SSH_SK_PROVIDER value + + + Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter + + + @@ -158,10 +155,36 @@ - - + + + + + + + Qt::Vertical + + + + 20 + 40 + + + + + + - SSH_SK_PROVIDER value + SSH_AUTH_SOCK value + + + Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter + + + + + + + SSH_AUTH_SOCK override Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter @@ -183,19 +206,6 @@ - - - - SSH_SK_PROVIDER override - - - Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter - - - - - - diff --git a/src/sshagent/SSHAgent.cpp b/src/sshagent/SSHAgent.cpp index ead599c77..ac639d80b 100644 --- a/src/sshagent/SSHAgent.cpp +++ b/src/sshagent/SSHAgent.cpp @@ -98,6 +98,16 @@ void SSHAgent::setUsePageant(bool usePageant) } #endif +bool SSHAgent::enableDestinationConstraints() const +{ + return config()->get(Config::SSHAgent_EnableDestinationConstraints).toBool(); +} + +void SSHAgent::setEnableDestinationConstraints(bool enableDestinationConstraints) +{ + config()->set(Config::SSHAgent_EnableDestinationConstraints, enableDestinationConstraints); +} + QString SSHAgent::socketPath(bool allowOverride) const { QString socketPath; @@ -305,7 +315,7 @@ bool SSHAgent::addIdentity(OpenSSHKey& key, const KeeAgentSettings& settings, co request.writeString(securityKeyProvider()); } - if (settings.useDestinationConstraintsWhenAdding()) { + if (enableDestinationConstraints() && settings.useDestinationConstraintsWhenAdding()) { request.write(SSH_AGENT_CONSTRAIN_EXTENSION); request.writeString(QString("restrict-destination-v00@openssh.com")); encodeDestinationConstraints(settings.destinationConstraints(), request); @@ -328,7 +338,7 @@ bool SSHAgent::addIdentity(OpenSSHKey& key, const KeeAgentSettings& settings, co m_error += "\n" + tr("A confirmation request is not supported by the agent (check options)."); } - if (settings.useDestinationConstraintsWhenAdding()) { + if (enableDestinationConstraints() && settings.useDestinationConstraintsWhenAdding()) { m_error += "\n" + tr("Destination constraints are invalid or not supported by the agent (check options)."); } diff --git a/src/sshagent/SSHAgent.h b/src/sshagent/SSHAgent.h index 0001b8167..5c02dabf3 100644 --- a/src/sshagent/SSHAgent.h +++ b/src/sshagent/SSHAgent.h @@ -48,6 +48,8 @@ public: void setUseOpenSSH(bool useOpenSSH); void setUsePageant(bool usePageant); #endif + bool enableDestinationConstraints() const; + void setEnableDestinationConstraints(bool enableDestinationConstraints); const QString errorString() const; bool isAgentRunning() const;