nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 13:08:17 -05:00
Code

fix : add try catch blocks

Browse Source
This commit is contained in:
Ike Kottlowski 2025-03-20 13:55:11 -04:00
parent 5a8bf4c890
commit 8f25ab6d73
No known key found for this signature in database
GPG Key ID: C86308E3DCA6D76F
6 changed files with 191 additions and 167 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
src/Api/Auth/Controllers/OpaqueKeyExchangeController.cs
View File

@ -1,68 +1,50 @@
using Bit.Api.Auth.Models.Request.Opaque;
using Bit.Api.Auth.Models.Response.Opaque;
using Bit.Core;
using Bit.Core.Auth.Models.Api.Request.Opaque;
using Bit.Core.Auth.Models.Api.Response.Opaque;
using Bit.Core.Auth.Services;
using Bit.Core.Services;
using Bit.Core.Utilities;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace Bit.Api.Auth.Controllers;
[RequireFeature(FeatureFlagKeys.OpaqueKeyExchange)]
[Route("opaque")]
public class OpaqueKeyExchangeController : Controller
{
private readonly IOpaqueKeyExchangeService _opaqueKeyExchangeService;
private readonly IUserService _userService;
public OpaqueKeyExchangeController(
[Authorize("Web")]
public class OpaqueKeyExchangeController(
IOpaqueKeyExchangeService opaqueKeyExchangeService,
IUserService userService
)
) : Controller
{
_opaqueKeyExchangeService = opaqueKeyExchangeService;
_userService = userService;
}
private readonly IOpaqueKeyExchangeService _opaqueKeyExchangeService = opaqueKeyExchangeService;
private readonly IUserService _userService = userService;
[Authorize("Web")]
[HttpPost("~/opaque/start-registration")]
public async Task<OpaqueRegistrationStartResponse> StartRegistrationAsync([FromBody] OpaqueRegistrationStartRequest request)
[HttpPost("start-registration")]
public async Task<OpaqueRegistrationStartResponse> StartRegistrationAsync(
[FromBody] OpaqueRegistrationStartRequest request)
{
var user = await _userService.GetUserByPrincipalAsync(User);
var result = await _opaqueKeyExchangeService.StartRegistration(Convert.FromBase64String(request.RegistrationRequest), user, request.CipherConfiguration);
var user = await _userService.GetUserByPrincipalAsync(User)
?? throw new UnauthorizedAccessException();
var result = await _opaqueKeyExchangeService.StartRegistration(
Convert.FromBase64String(request.RegistrationRequest), user, request.CipherConfiguration);
return result;
}
[Authorize("Web")]
[HttpPost("~/opaque/finish-registration")]
public async void FinishRegistrationAsync([FromBody] OpaqueRegistrationFinishRequest request)
[HttpPost("finish-registration")]
public async Task FinishRegistrationAsync([FromBody] OpaqueRegistrationFinishRequest request)
{
var user = await _userService.GetUserByPrincipalAsync(User);
await _opaqueKeyExchangeService.FinishRegistration(request.SessionId, Convert.FromBase64String(request.RegistrationUpload), user, request.KeySet);
var user = await _userService.GetUserByPrincipalAsync(User)
?? throw new UnauthorizedAccessException();
await _opaqueKeyExchangeService.FinishRegistration(
request.SessionId, Convert.FromBase64String(request.RegistrationUpload), user, request.KeySet);
}
[Authorize("Web")]
[HttpPost("~/opaque/set-registration-active")]
public async void SetRegistrationActive([FromBody] OpaqueSetRegistrationActiveRequest request)
[HttpPost("set-registration-active")]
public async Task SetRegistrationActiveAsync([FromBody] OpaqueSetRegistrationActiveRequest request)
{
var user = await _userService.GetUserByPrincipalAsync(User);
await _opaqueKeyExchangeService.SetRegistrationActiveForAccount(request.SessionId, user);
}
// TODO: Remove and move to token endpoint
[HttpPost("~/opaque/start-login")]
public async Task<OpaqueLoginStartResponse> StartLoginAsync([FromBody] OpaqueLoginStartRequest request)
{
var result = await _opaqueKeyExchangeService.StartLogin(Convert.FromBase64String(request.CredentialRequest), request.Email);
return new OpaqueLoginStartResponse(result.Item1, Convert.ToBase64String(result.Item2));
}
// TODO: Remove and move to token endpoint
[HttpPost("~/opaque/finish-login")]
public async Task<bool> FinishLoginAsync([FromBody] OpaqueLoginFinishRequest request)
{
var result = await _opaqueKeyExchangeService.FinishLogin(request.SessionId, Convert.FromBase64String(request.CredentialFinalization));
return result;
var user = await _userService.GetUserByPrincipalAsync(User)
?? throw new UnauthorizedAccessException();
await _opaqueKeyExchangeService.WriteCacheCredentialToDatabase(request.SessionId, user);
}
}

3
src/Core/Auth/Models/Api/Request/Opaque/OpaqueLoginStartRequest.cs
View File

@ -1,6 +1,6 @@
using System.ComponentModel.DataAnnotations;
namespace Bit.Api.Auth.Models.Request.Opaque;
namespace Bit.Core.Auth.Models.Api.Request.Opaque;
public class OpaqueLoginStartRequest
{
@ -8,5 +8,4 @@ public class OpaqueLoginStartRequest
public string Email { get; set; }
[Required]
public string CredentialRequest { get; set; }
}

21
src/Core/Auth/Services/IOpaqueKeyExchangeService.cs
View File

@ -18,14 +18,15 @@ public interface IOpaqueKeyExchangeService
/// <returns>void</returns>
public Task<OpaqueRegistrationStartResponse> StartRegistration(byte[] request, User user, OpaqueKeyExchangeCipherConfiguration cipherConfiguration);
/// <summary>
/// This doesn't actually finish registration. It updates the cache with the server setup and cipher configuration so that the clearly named "SetActive" method can finish registration.
/// This updates the cache with the server setup and cipher configuration so that WriteCacheCredentialToDatabase method can finish registration
/// by writing the credential to the database.
/// </summary>
/// <param name="sessionId">Cache Id</param>
/// <param name="registrationUpload">Byte Array for Rust Magic</param>
/// <param name="user">User being acted on</param>
/// <param name="keyset">Key Pair that can be used for vault decryption</param>
/// <returns>void</returns>
public Task FinishRegistration(Guid sessionId, byte[] registrationUpload, User user, RotateableOpaqueKeyset keyset);
public Task<bool> FinishRegistration(Guid sessionId, byte[] registrationUpload, User user, RotateableOpaqueKeyset keyset);
/// <summary>
/// Returns server crypto material for the client to consume and reply with a login request to the identity/token endpoint.
/// To protect against account enumeration we will always return a deterministic response based on the user's email.
@ -52,21 +53,21 @@ public interface IOpaqueKeyExchangeService
/// <summary>
/// Clears the authentication session from the cache.
/// </summary>
/// <param name="sessionId"></param>
/// <returns></returns>
/// <param name="sessionId">session being acted on.</param>
/// <returns>void</returns>
public Task ClearAuthenticationSession(Guid sessionId);
/// <summary>
/// This is where registration really finishes. This method writes the Credential to the database. If a credential already exists then it will be removed before the new one is added.
/// This method writes the Credential to the database. If a credential already exists then it will be removed before the new one is added.
/// A user can only have one credential.
/// </summary>
/// <param name="sessionId">cache value</param>
/// <param name="user">user being acted on</param>
/// <returns>void</returns>
public Task SetRegistrationActiveForAccount(Guid sessionId, User user);
/// <returns>bool based on action result</returns>
public Task<bool> WriteCacheCredentialToDatabase(Guid sessionId, User user);
/// <summary>
/// Removes the credential for the user.
/// Removes the credential for the user. If the user does not exist then this does nothing.
/// </summary>
/// <param name="user">user being acted on</param>
/// <param name="user">User being acted on.</param>
/// <returns>void</returns>
public Task Unenroll(User user);
public Task RemoveUserOpaqueKeyExchangeCredential(User user);
}

127
src/Core/Auth/Services/Implementations/OpaqueKeyExchangeService.cs
View File

@ -10,6 +10,7 @@ using Bit.Core.Entities;
using Bit.Core.Repositories;
using Bitwarden.Opaque;
using Microsoft.Extensions.Caching.Distributed;
using Microsoft.Extensions.Logging;
namespace Bit.Core.Auth.Services;
@ -21,6 +22,7 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
private readonly IOpaqueKeyExchangeCredentialRepository _opaqueKeyExchangeCredentialRepository;
private readonly IDistributedCache _distributedCache;
private readonly IUserRepository _userRepository;
private readonly ILogger<OpaqueKeyExchangeService> _logger;
const string REGISTER_SESSION_KEY = "opaque_register_session_{0}";
const string LOGIN_SESSION_KEY = "opaque_login_session_{0}";
@ -28,71 +30,80 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
public OpaqueKeyExchangeService(
IOpaqueKeyExchangeCredentialRepository opaqueKeyExchangeCredentialRepository,
IDistributedCache distributedCache,
IUserRepository userRepository
IUserRepository userRepository,
ILogger<OpaqueKeyExchangeService> logger
)
{
_bitwardenOpaque = new BitwardenOpaqueServer();
_opaqueKeyExchangeCredentialRepository = opaqueKeyExchangeCredentialRepository;
_distributedCache = distributedCache;
_userRepository = userRepository;
_logger = logger;
}
public async Task<OpaqueRegistrationStartResponse> StartRegistration(byte[] request, User user, OpaqueKeyExchangeCipherConfiguration cipherConfiguration)
public async Task<OpaqueRegistrationStartResponse> StartRegistration(
byte[] request, User user, OpaqueKeyExchangeCipherConfiguration cipherConfiguration)
{
var registrationRequest = _bitwardenOpaque.StartRegistration(cipherConfiguration.ToNativeConfiguration(), null, request, user.Id.ToString());
var registrationRequest = _bitwardenOpaque.StartRegistration(
cipherConfiguration.ToNativeConfiguration(), null, request, user.Id.ToString());
var sessionId = Guid.NewGuid();
var registerSession = new OpaqueKeyExchangeRegisterSession() { SessionId = sessionId, ServerSetup = registrationRequest.serverSetup, CipherConfiguration = cipherConfiguration, UserId = user.Id };
await _distributedCache.SetAsync(string.Format(REGISTER_SESSION_KEY, sessionId), Encoding.ASCII.GetBytes(JsonSerializer.Serialize(registerSession)));
var registerSession = new OpaqueKeyExchangeRegisterSession()
{
SessionId = sessionId,
ServerSetup = registrationRequest.serverSetup,
CipherConfiguration = cipherConfiguration,
UserId = user.Id
};
await _distributedCache.SetAsync(
string.Format(REGISTER_SESSION_KEY, sessionId),
Encoding.ASCII.GetBytes(JsonSerializer.Serialize(registerSession)));
return new OpaqueRegistrationStartResponse(sessionId, Convert.ToBase64String(registrationRequest.registrationResponse));
return new OpaqueRegistrationStartResponse(
sessionId, Convert.ToBase64String(registrationRequest.registrationResponse));
}
public async Task FinishRegistration(Guid sessionId, byte[] registrationUpload, User user, RotateableOpaqueKeyset keyset)
public async Task<bool> FinishRegistration(Guid sessionId, byte[] registrationUpload, User user, RotateableOpaqueKeyset keyset)
{
var serializedRegisterSession = await _distributedCache.GetAsync(string.Format(REGISTER_SESSION_KEY, sessionId));
if (serializedRegisterSession == null)
{
throw new InvalidOperationException("Session not found");
}
try
{
var serializedRegisterSession = await _distributedCache.GetAsync(string.Format(REGISTER_SESSION_KEY, sessionId))
?? throw new Exception("Session not found");
var registerSession = JsonSerializer.Deserialize<OpaqueKeyExchangeRegisterSession>(Encoding.ASCII.GetString(serializedRegisterSession))!;
var registrationFinish = _bitwardenOpaque.FinishRegistration(registerSession.CipherConfiguration.ToNativeConfiguration(), registrationUpload);
registerSession.PasswordFile = registrationFinish.serverRegistration;
registerSession.KeySet = Encoding.ASCII.GetBytes(JsonSerializer.Serialize(keyset));
await _distributedCache.SetAsync(string.Format(REGISTER_SESSION_KEY, sessionId), Encoding.ASCII.GetBytes(JsonSerializer.Serialize(registerSession)));
return true;
}
catch (Exception e)
{
await _distributedCache.RemoveAsync(string.Format(REGISTER_SESSION_KEY, sessionId));
throw new Exception(e.Message);
_logger.LogError(e, "Error finishing registration for user {UserId}", user.Id);
return false;
}
}
public async Task<(Guid, byte[])> StartLogin(byte[] request, string email)
{
var user = await _userRepository.GetByEmailAsync(email);
if (user == null)
try
{
// todo don't allow user enumeration
throw new InvalidOperationException("User not found");
}
// todo: don't allow user enumeration
var user = await _userRepository.GetByEmailAsync(email)
?? throw new InvalidOperationException("User not found");
var credential = await _opaqueKeyExchangeCredentialRepository.GetByUserIdAsync(user.Id);
if (credential == null)
{
// generate fake credential
throw new InvalidOperationException("Credential not found");
}
// todo: generate fake credential
var credential = await _opaqueKeyExchangeCredentialRepository.GetByUserIdAsync(user.Id)
?? throw new InvalidOperationException("Credential not found");
var cipherConfiguration = JsonSerializer.Deserialize<OpaqueKeyExchangeCipherConfiguration>(credential.CipherConfiguration)!;
var credentialBlob = JsonSerializer.Deserialize<OpaqueKeyExchangeCredentialBlob>(credential.CredentialBlob)!;
var serverSetup = credentialBlob.ServerSetup;
var serverRegistration = credentialBlob.PasswordFile;
var loginResponse = _bitwardenOpaque.StartLogin(cipherConfiguration.ToNativeConfiguration(), serverSetup, serverRegistration, request, user.Id.ToString());
var loginResponse = _bitwardenOpaque.StartLogin(
cipherConfiguration.ToNativeConfiguration(), serverSetup, serverRegistration, request, user.Id.ToString());
var sessionId = MakeCryptoGuid();
var loginSession = new OpaqueKeyExchangeLoginSession()
{
@ -104,8 +115,16 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
await _distributedCache.SetAsync(string.Format(LOGIN_SESSION_KEY, sessionId), Encoding.ASCII.GetBytes(JsonSerializer.Serialize(loginSession)));
return (sessionId, loginResponse.credentialResponse);
}
catch (InvalidOperationException e)
{
_logger.LogError(e, "Error starting login for user {Email}", email);
return (Guid.Empty, []);
}
}
public async Task<bool> FinishLogin(Guid sessionId, byte[] credentialFinalization)
{
try
{
var serializedLoginSession = await _distributedCache.GetAsync(string.Format(LOGIN_SESSION_KEY, sessionId));
if (serializedLoginSession == null)
@ -124,8 +143,6 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
var cipherConfiguration = loginSession.CipherConfiguration;
await _distributedCache.RemoveAsync(string.Format(LOGIN_SESSION_KEY, sessionId));
try
{
var success = _bitwardenOpaque.FinishLogin(cipherConfiguration.ToNativeConfiguration(), loginState, credentialFinalization);
loginSession.IsAuthenticated = true;
await _distributedCache.SetAsync(string.Format(LOGIN_SESSION_KEY, sessionId), Encoding.ASCII.GetBytes(JsonSerializer.Serialize(loginSession)));
@ -141,11 +158,11 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
public async Task<User?> GetUserForAuthenticatedSession(Guid sessionId)
{
var serializedLoginSession = await _distributedCache.GetAsync(string.Format(LOGIN_SESSION_KEY, sessionId));
if (serializedLoginSession == null)
try
{
throw new InvalidOperationException("Session not found");
}
var serializedLoginSession = await _distributedCache.GetAsync(string.Format(LOGIN_SESSION_KEY, sessionId))
?? throw new InvalidOperationException("Session not found");
var loginSession = JsonSerializer.Deserialize<OpaqueKeyExchangeLoginSession>(Encoding.ASCII.GetString(serializedLoginSession))!;
if (!loginSession.IsAuthenticated)
@ -155,16 +172,21 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
return await _userRepository.GetByIdAsync(loginSession.UserId!)!;
}
public async Task SetRegistrationActiveForAccount(Guid sessionId, User user)
catch (InvalidOperationException e)
{
var serializedRegisterSession = await _distributedCache.GetAsync(string.Format(REGISTER_SESSION_KEY, sessionId));
if (serializedRegisterSession == null)
{
throw new InvalidOperationException("Session not found");
_logger.LogError(e, "Error authenticating user session {SessionId}", sessionId);
return null;
}
}
var session = JsonSerializer.Deserialize<OpaqueKeyExchangeRegisterSession>(Encoding.ASCII.GetString(serializedRegisterSession))!;
public async Task<bool> WriteCacheCredentialToDatabase(Guid sessionId, User user)
{
try
{
var serializedRegisterSession = await _distributedCache.GetAsync(string.Format(REGISTER_SESSION_KEY, sessionId))
?? throw new InvalidOperationException("Session not found");
var session = JsonSerializer.Deserialize<OpaqueKeyExchangeRegisterSession>(Encoding.ASCII.GetString(serializedRegisterSession))!;
if (session.UserId != user.Id)
{
throw new InvalidOperationException("Session does not belong to user");
@ -196,11 +218,18 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
CreationDate = DateTime.UtcNow
};
await Unenroll(user);
await RemoveUserOpaqueKeyExchangeCredential(user);
await _opaqueKeyExchangeCredentialRepository.CreateAsync(credential);
return true;
}
catch (InvalidOperationException e)
{
_logger.LogError(e, "Error writing cache opaque credential to database for user {UserId}", user.Id);
return false;
}
}
public async Task Unenroll(User user)
public async Task RemoveUserOpaqueKeyExchangeCredential(User user)
{
var credential = await _opaqueKeyExchangeCredentialRepository.GetByUserIdAsync(user.Id);
if (credential != null)
@ -209,10 +238,14 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
}
}
/// <summary>
/// Makes a cryptographically secure GUID to use as a session Id.
/// </summary>
/// <returns>GUID</returns>
private static Guid MakeCryptoGuid()
{
// Get 16 cryptographically random bytes
byte[] data = RandomNumberGenerator.GetBytes(16);
var data = RandomNumberGenerator.GetBytes(16);
// Mark it as a version 4 GUID
data[7] = (byte)((data[7] | (byte)0x40) & (byte)0x4f);
@ -227,6 +260,11 @@ public class OpaqueKeyExchangeService : IOpaqueKeyExchangeService
}
}
/// <summary>
/// Object saved to the cache for a registration session. We store the registration object in
/// the cache so we can maintain key material separation between the client and server.
/// If we used a Tokenable then it could expose the Server Key material to the client.
/// </summary>
public class OpaqueKeyExchangeRegisterSession
{
public required Guid SessionId { get; set; }
@ -237,6 +275,11 @@ public class OpaqueKeyExchangeRegisterSession
public byte[]? KeySet { get; set; }
}
/// <summary>
/// This object is used to accomplish a Pushed Authorization Request (PAR) "adjacent" type action. Where we
/// track authentication state in the cache so when a user finishes authentication they only need
/// the Cryptographically secure GUID sessionId.
/// </summary>
public class OpaqueKeyExchangeLoginSession
{
public required Guid UserId { get; set; }

8
src/Core/Services/Implementations/UserService.cs
View File

@ -670,11 +670,11 @@ public class UserService : UserManager<User>, IUserService, IDisposable
if (opaqueSessionId != null)
{
await _opaqueKeyExchangeService.SetRegistrationActiveForAccount((Guid)opaqueSessionId, user);
await _opaqueKeyExchangeService.WriteCacheCredentialToDatabase((Guid)opaqueSessionId, user);
}
else
{
await _opaqueKeyExchangeService.Unenroll(user);
await _opaqueKeyExchangeService.RemoveUserOpaqueKeyExchangeCredential(user);
}
await _userRepository.ReplaceAsync(user);
await _eventService.LogUserEventAsync(user.Id, EventType.User_ChangedPassword);
@ -817,7 +817,7 @@ public class UserService : UserManager<User>, IUserService, IDisposable
user.Key = key;
// TODO: Add Opaque-KE support
await _opaqueKeyExchangeService.Unenroll(user);
await _opaqueKeyExchangeService.RemoveUserOpaqueKeyExchangeCredential(user);
await _userRepository.ReplaceAsync(user);
await _mailService.SendAdminResetPasswordEmailAsync(user.Email, user.Name, org.DisplayName());
await _eventService.LogOrganizationUserEventAsync(orgUser, EventType.OrganizationUser_AdminResetPassword);
@ -845,7 +845,7 @@ public class UserService : UserManager<User>, IUserService, IDisposable
user.MasterPasswordHint = hint;
// TODO: Add Opaque-KE support
await _opaqueKeyExchangeService.Unenroll(user);
await _opaqueKeyExchangeService.RemoveUserOpaqueKeyExchangeCredential(user);
await _userRepository.ReplaceAsync(user);
await _mailService.SendUpdatedTempPasswordEmailAsync(user.Email, user.Name);
await _eventService.LogUserEventAsync(user.Id, EventType.User_UpdatedTempPassword);

1
src/Identity/Controllers/AccountsController.cs
View File

@ -1,7 +1,6 @@
using System.Diagnostics;
using System.Text;
using System.Text.Json;
using Bit.Api.Auth.Models.Request.Opaque;
using Bit.Api.Auth.Models.Response.Opaque;
using Bit.Core;
using Bit.Core.Auth.Enums;