Add Freedesktop.org Secret Storage Spec Server Side API (Fix #1403)

This plugin implements the Secret Storage specification version 0.2.
While running KeePassXC, it acts as a Secret Service server, registered
on DBus, so clients like seahorse, python-secretstorage, or other
implementations can connect and access the exposed database in KeePassXC.

Squashed commits:

- Initial code
- Add SessionAdaptor and fix build
- The skeletons for all dbus objects are in place
- Implement collection creation and deletion
- Emit collectionChanged signal
- Implement app-wise settings page
- Implement error message on GUI
- Implement settings
- Fix uuid to dbus path
- Implement app level settings
- Add freedesktop logo
- Implement database settings page
- Change database settings to a treeview
- Move all settings read/write to one place
- Rename SecretServiceOptionsPage to SettingsWidgetFdoSecrets
- Fix selected group can not be saved if the user hasn't click on the item
- Show selected group per database in app settings
- Disable editing of various readonly widgets
- Remove unused warning about non exposed database
- Fix method signature on dbus adaptors
- Fix type derived from DBusObject not recognized as QDBusContext
- Resolve a few TODOs around error handling
- Remove const when passing DBus exposed objects
- Move dismiss to PromptBase
- Implement per collection locking/unlocking
- Fix const correctness on Item::setSecret
- Implement SecretService::getSecrets
- Rework the signal connections around collections.
- Remove generateId from DBusObject
- Per spec, use encoded label as DBus object path for collections
- Fix some corner cases around collection name changes
- Implement alias
- Fix wrong alias dbus path
- Implement encryption per spec
- Cleanup SessionCipher
- Implement searchItems for SecretService
- Use Tools::uuidToHex
- Implement Item attributes and delete
- Implement createItem
- Always check if the database is unlocked before perform any operation
- Add missing ReadAlias/SetAlias on service
- Reorganize and fix OpenSession always returning empty output
- Overhaul error handling
- Make sure default alias is always present
- Remove collection aliases early in doDelete
- Handles all content types, fix setProperties not working
- Fix sometimes there is an extraneous leading zero when converting from MPI
- Fix session encryption negotiation
- Do not expose recycle bin
- Protect against the methods not called from DBus
- Also emit collectionChanged signal when lock state changes
- Show notification when entry secret is requested
- Add a README file
- Actually close session when client disconnects
- Gracefully return alternative label when collection is locked
- Reorganize, rename secretservice to fdosecrets
- Fix issues reported by clazy
- Unify UI strings and fix icon
- Implement a setting to skip confirmation when deleting entries from DBus
- Remove some unused debugging log
- Simply ignore errors when DBus context is not available. QtDBus won't set QDBusContext when deliver property get/set, and there is no way to get a QDBusMessage in property getter/setter.
- Simplify GcryptMPI using std::unique_ptr and add unit test
- Format code in fdosecrets
- Move DBusReturnImpl to details namespace
- Fix crash when locking a database: don't modify exposedGroup setting in customData when database is deleted
- Make sure Collection::searchItems works, whether it's locked or not
- Fix FdoSecrets::Collection becomes empty after a database reload
- Fix crash when looping while modifying the list

CMakeLists.txt

@@ -50,6 +50,9 @@ option(WITH_XC_YUBIKEY "Include YubiKey support." OFF)
 option(WITH_XC_SSHAGENT "Include SSH agent support." OFF)
 option(WITH_XC_KEESHARE "Sharing integration with KeeShare (requires quazip5 for secure containers)" OFF)
 option(WITH_XC_UPDATECHECK "Include automatic update checks; disable for controlled distributions" ON)
+if(UNIX AND NOT APPLE)
+    option(WITH_XC_FDOSECRETS "Implement freedesktop.org Secret Storage Spec server side API." OFF)
+endif()
 if(APPLE)
     option(WITH_XC_TOUCHID "Include TouchID support for macOS." OFF)
 endif()
@@ -65,6 +68,9 @@ if(WITH_XC_ALL)
     if(APPLE)
         set(WITH_XC_TOUCHID ON)
     endif()
+    if(UNIX AND NOT APPLE)
+        set(WITH_XC_FDOSECRETS ON)
+    endif()
 endif()
 
 if(WITH_XC_SSHAGENT OR WITH_XC_KEESHARE)

COPYING

@@ -241,3 +241,7 @@ License: LGPL-2.1
 Files: share/macosx/dmg-background.tiff
 Copyright: 2008-2014, Andrey Tarantsov
 License: MIT
+
+Files: share/icons/application/scalable/apps/freedesktop.svg
+Copyright: GPL-2+
+Comment: from Freedesktop.org website

INSTALL.md

@@ -102,6 +102,7 @@ These steps place the compiled KeePassXC binary inside the `./build/src/` direct
 	  -DWITH_XC_NETWORKING=[ON|OFF] Enable/Disable Networking support (e.g., favicon downloading) (default: OFF)
 	  -DWITH_XC_SSHAGENT=[ON|OFF] Enable/Disable SSHAgent support (default: OFF)
 	  -DWITH_XC_TOUCHID=[ON|OFF] (macOS Only) Enable/Disable Touch ID unlock (default:OFF)
+	  -DWITH_XC_FDOSECRETS=[ON|OFF] (Linux Only) Enable/Disable Freedesktop.org Secrets Service support (default:OFF)
 	  -DWITH_XC_KEESHARE=[ON|OFF] Enable/Disable KeeShare group synchronization extension (default: OFF)
 	  -DWITH_XC_KEESHARE_SECURE=[ON|OFF] Enable/Disable KeeShare signed containers, requires libquazip5 (default: OFF)
 	  -DWITH_XC_ALL=[ON|OFF] Enable/Disable compiling all plugins above (default: OFF)

src/CMakeLists.txt

@@ -194,6 +194,9 @@ add_feature_info(SSHAgent WITH_XC_SSHAGENT "SSH agent integration compatible wit
 add_feature_info(KeeShare WITH_XC_KEESHARE "Sharing integration with KeeShare (requires quazip5 for secure containers)")
 add_feature_info(YubiKey WITH_XC_YUBIKEY "YubiKey HMAC-SHA1 challenge-response")
 add_feature_info(UpdateCheck WITH_XC_UPDATECHECK "Automatic update checking")
+if(UNIX AND NOT APPLE)
+    add_feature_info(FdoSecrets WITH_XC_FDOSECRETS "Implement freedesktop.org Secret Storage Spec server side API.")
+endif()
 if(APPLE)
     add_feature_info(TouchID WITH_XC_TOUCHID "TouchID integration")
 endif()
@@ -226,6 +229,11 @@ if(WITH_XC_SSHAGENT)
     set(sshagent_LIB sshagent)
 endif()
 
+add_subdirectory(fdosecrets)
+if(WITH_XC_FDOSECRETS)
+    set(fdosecrets_LIB fdosecrets)
+endif()
+
 set(autotype_SOURCES
         core/Tools.cpp
         autotype/AutoType.cpp
@@ -270,6 +278,7 @@ target_link_libraries(keepassx_core
         autotype
         ${keepassxcbrowser_LIB}
         ${qrcode_LIB}
+        ${fdosecrets_LIB}
         Qt5::Core
         Qt5::Concurrent
         Qt5::Network

src/config-keepassx.h.cmake

@@ -22,6 +22,7 @@
 #cmakedefine WITH_XC_KEESHARE_SECURE
 #cmakedefine WITH_XC_UPDATECHECK
 #cmakedefine WITH_XC_TOUCHID
+#cmakedefine WITH_XC_FDOSECRETS
 
 #cmakedefine KEEPASSXC_BUILD_TYPE "@KEEPASSXC_BUILD_TYPE@"
 #cmakedefine KEEPASSXC_BUILD_TYPE_RELEASE

src/fdosecrets/CMakeLists.txt

@@ -0,0 +1,36 @@
+if(WITH_XC_FDOSECRETS)
+    include_directories(${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR})
+
+    add_library(fdosecrets STATIC
+        # app settings page
+        FdoSecretsPlugin.cpp
+        widgets/SettingsWidgetFdoSecrets.cpp
+
+        # per database settings page
+        DatabaseSettingsPageFdoSecrets.cpp
+        widgets/DatabaseSettingsWidgetFdoSecrets.cpp
+
+        # setting storage
+        FdoSecretsSettings.cpp
+
+        # gcrypt MPI wrapper
+        GcryptMPI.cpp
+
+        # dbus objects
+        objects/DBusObject.cpp
+        objects/Service.cpp
+        objects/Session.cpp
+        objects/SessionCipher.cpp
+        objects/Collection.cpp
+        objects/Item.cpp
+        objects/Prompt.cpp
+        objects/adaptors/ServiceAdaptor.cpp
+        objects/adaptors/SessionAdaptor.cpp
+        objects/adaptors/CollectionAdaptor.cpp
+        objects/adaptors/ItemAdaptor.cpp
+        objects/adaptors/PromptAdaptor.cpp
+        objects/DBusReturn.cpp
+        objects/DBusTypes.cpp
+    )
+    target_link_libraries(fdosecrets Qt5::Core Qt5::Widgets Qt5::DBus ${GCRYPT_LIBRARIES})
+endif()

src/fdosecrets/DatabaseSettingsPageFdoSecrets.cpp

@@ -0,0 +1,49 @@
+/*
+ *  Copyright (C) 2019 Aetf <aetf@unlimitedcodeworks.xyz>
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 2 or (at your option)
+ *  version 3 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "DatabaseSettingsPageFdoSecrets.h"
+
+#include "fdosecrets/widgets/DatabaseSettingsWidgetFdoSecrets.h"
+
+#include "core/FilePath.h"
+
+QString DatabaseSettingsPageFdoSecrets::name()
+{
+    return QObject::tr("Secret Service Integration");
+}
+
+QIcon DatabaseSettingsPageFdoSecrets::icon()
+{
+    return filePath()->icon(QStringLiteral("apps"), QStringLiteral("freedesktop"));
+}
+
+QWidget* DatabaseSettingsPageFdoSecrets::createWidget()
+{
+    return new DatabaseSettingsWidgetFdoSecrets;
+}
+
+void DatabaseSettingsPageFdoSecrets::loadSettings(QWidget* widget, QSharedPointer<Database> db)
+{
+    auto settingsWidget = qobject_cast<DatabaseSettingsWidgetFdoSecrets*>(widget);
+    settingsWidget->loadSettings(db);
+}
+
+void DatabaseSettingsPageFdoSecrets::saveSettings(QWidget* widget)
+{
+    auto settingsWidget = qobject_cast<DatabaseSettingsWidgetFdoSecrets*>(widget);
+    settingsWidget->saveSettings();
+}

src/fdosecrets/DatabaseSettingsPageFdoSecrets.h

@@ -0,0 +1,36 @@
+/*
+ *  Copyright (C) 2019 Aetf <aetf@unlimitedcodeworks.xyz>
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 2 or (at your option)
+ *  version 3 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef KEEPASSXC_DATABASESETTINGSPAGEFDOSECRETS_H
+#define KEEPASSXC_DATABASESETTINGSPAGEFDOSECRETS_H
+
+#include "gui/dbsettings/DatabaseSettingsDialog.h"
+
+class DatabaseSettingsPageFdoSecrets : public IDatabaseSettingsPage
+{
+    Q_DISABLE_COPY(DatabaseSettingsPageFdoSecrets)
+public:
+    DatabaseSettingsPageFdoSecrets() = default;
+
+    QString name() override;
+    QIcon icon() override;
+    QWidget* createWidget() override;
+    void loadSettings(QWidget* widget, QSharedPointer<Database> db) override;
+    void saveSettings(QWidget* widget) override;
+};
+
+#endif // KEEPASSXC_DATABASESETTINGSPAGEFDOSECRETS_H

src/fdosecrets/FdoSecretsPlugin.cpp

@@ -0,0 +1,88 @@
+/*
+ *  Copyright (C) 2018 Aetf <aetf@unlimitedcodeworks.xyz>
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 2 or (at your option)
+ *  version 3 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "FdoSecretsPlugin.h"
+
+#include "fdosecrets/FdoSecretsSettings.h"
+#include "fdosecrets/objects/DBusTypes.h"
+#include "fdosecrets/objects/Service.h"
+#include "fdosecrets/widgets/SettingsWidgetFdoSecrets.h"
+
+#include "gui/DatabaseTabWidget.h"
+
+#include <utility>
+
+using FdoSecrets::Service;
+
+FdoSecretsPlugin::FdoSecretsPlugin(DatabaseTabWidget* tabWidget)
+    : m_dbTabs(tabWidget)
+{
+    FdoSecrets::registerDBusTypes();
+}
+
+QWidget* FdoSecretsPlugin::createWidget()
+{
+    return new SettingsWidgetFdoSecrets(this);
+}
+
+void FdoSecretsPlugin::loadSettings(QWidget* widget)
+{
+    qobject_cast<SettingsWidgetFdoSecrets*>(widget)->loadSettings();
+}
+
+void FdoSecretsPlugin::saveSettings(QWidget* widget)
+{
+    qobject_cast<SettingsWidgetFdoSecrets*>(widget)->saveSettings();
+    updateServiceState();
+}
+
+void FdoSecretsPlugin::updateServiceState()
+{
+    if (FdoSecrets::settings()->isEnabled()) {
+        if (!m_secretService && m_dbTabs) {
+            m_secretService.reset(new Service(this, m_dbTabs));
+            connect(m_secretService.data(), &Service::error, this, [this](const QString& msg) {
+                emit error(tr("Fdo Secret Service: %1").arg(msg));
+            });
+            if (!m_secretService->initialize()) {
+                m_secretService.reset();
+            }
+        }
+    } else {
+        if (m_secretService) {
+            m_secretService.reset();
+        }
+    }
+}
+
+Service* FdoSecretsPlugin::serviceInstance() const
+{
+    return m_secretService.data();
+}
+
+void FdoSecretsPlugin::emitRequestSwitchToDatabases()
+{
+    emit requestSwitchToDatabases();
+}
+
+void FdoSecretsPlugin::emitRequestShowNotification(const QString& msg, const QString& title)
+{
+    if (!FdoSecrets::settings()->showNotification()) {
+        return;
+    }
+    emit requestShowNotification(msg, title, 10000);
+}