Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement cipher key encryption #3990

Merged
merged 1 commit into from
Oct 22, 2023
Merged

Implement cipher key encryption #3990

merged 1 commit into from
Oct 22, 2023

Conversation

dani-garcia
Copy link
Owner

New versions of the bitwarden clients will very soon start using separate encryption keys for each cipher, so we need to handle those.

At the same time, I've noticed that the clients have started depending on the version value of the /config endpoint to do backwards compatibility checks, so I think the simplest solution for everyone would be for us to return the server version that most closely matches the features we support.

They are doing the semver checks here:
https://github.com/bitwarden/clients/blob/3e495ab082e2152284a36bb5d2b2fb7a4060cfb3/libs/common/src/platform/services/config/config.service.ts#L116-L127

For now the only check they are doing is for version 2023.9.1 for the cipher key encryption feature that this PR implements, so we report that we support that version:
https://github.com/bitwarden/clients/blob/3e495ab082e2152284a36bb5d2b2fb7a4060cfb3/libs/common/src/vault/services/cipher.service.ts#L56

Also added the section for feature flags in the config, the current ones reported on the official vault are:

"display-eu-environment": true,
"display-kdf-iteration-warning": true,
"trusted-device-encryption": true,
"sm-ga-billing": true,
"autofill-v2": true

For now as a test I've enabled autofill-v2 as that is an entirely client side change, so it won't affect us

Copy link
Collaborator

@BlackDex BlackDex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks ok too me. Not yet tested though.
But simple changes if this is all to be done.

Is there some background information for this change from upstream?

@BlackDex
Copy link
Collaborator

Doesn't seem to be in the master branch yet.
Have not looked for the specific PR yet to fully test this.

@dani-garcia
Copy link
Owner Author

The changes are in master but you need to enable them in the web vault flags before building the project:

https://github.com/bitwarden/clients/blob/3e495ab082e2152284a36bb5d2b2fb7a4060cfb3/apps/web/config/selfhosted.json#L12

After that, the new build will create new ciphers with individual keys, but it won't update the old ones just yet.

The clients PR is here, and it also links to the server changes: bitwarden/clients#6241

@dani-garcia dani-garcia merged commit cb4b683 into main Oct 22, 2023
6 checks passed
@dani-garcia dani-garcia deleted the cipher_key_encryption branch October 25, 2023 16:17
jayknyn pushed a commit to ayamsecure/secrets that referenced this pull request Oct 28, 2023
arthurgeek pushed a commit to arthurgeek/vaultwarden-fly-template that referenced this pull request Nov 12, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [vaultwarden/server](https://togithub.com/dani-garcia/vaultwarden) |
stage | minor | `1.29.2-alpine` -> `1.30.0-alpine` |

---

### Release Notes

<details>
<summary>dani-garcia/vaultwarden (vaultwarden/server)</summary>

###
[`v1.30.0`](https://togithub.com/dani-garcia/vaultwarden/releases/tag/1.30.0)

[Compare
Source](https://togithub.com/dani-garcia/vaultwarden/compare/1.29.2...1.30.0)

⚠️ **Note:** The WebSockets service for live sync has been integrated in
the main HTTP server, which means simpler proxy setups that don't
require a separate rule to redirect WS traffic to port 3012. Please
check the updated examples in the
[wiki](https://togithub.com/dani-garcia/vaultwarden/wiki/Proxy-examples).
It's recommended to migrate to this new setup as using the old server on
port 3012 is deprecated, won't receive new features and will be removed
in a future release.

#### Major changes and New Features

- Added `passkey` support, allowing the browser extensions to store and
use your `passkeys`, make sure the extension is updated to version
`2023.10.0` or newer for passkey support.
-   Updated web vault to 2023.10.0.
-   Fixed crashes in ARMv6 devices
- Fixed crashes when trying to create/edit a cipher in the mobile
applications.

#### What's Changed

- Update Rust and Crates by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3808
- update web-vault to v2023.8.2 by
[@&#8203;stefan0xC](https://togithub.com/stefan0xC) in
[dani-garcia/vaultwarden#3821
- Fix Login With Device without MasterPassword by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3831
- Update GitHub Workflow by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3910
- Fix arm builds by [@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3911
- Fix typos by [@&#8203;tuhanayim](https://togithub.com/tuhanayim) in
[dani-garcia/vaultwarden#3959
- csp: rename anonaddy.com to addy.io by
[@&#8203;stefan0xC](https://togithub.com/stefan0xC) in
[dani-garcia/vaultwarden#3950
- filter handlebars logs by
[@&#8203;stefan0xC](https://togithub.com/stefan0xC) in
[dani-garcia/vaultwarden#3859
- Remove unnecessary variable clone by
[@&#8203;mvalois](https://togithub.com/mvalois) in
[dani-garcia/vaultwarden#3981
- README.md: Fix grammar nit by
[@&#8203;AndreasHGK](https://togithub.com/AndreasHGK) in
[dani-garcia/vaultwarden#3965
- Fix small issues by [@&#8203;BlackDex](https://togithub.com/BlackDex)
in
[dani-garcia/vaultwarden#3964
- Adds LastActive on /admin/users API route by
[@&#8203;mvalois](https://togithub.com/mvalois) in
[dani-garcia/vaultwarden#3951
- Reopen log file on SIGHUP by
[@&#8203;tobiasmboelz](https://togithub.com/tobiasmboelz) in
[dani-garcia/vaultwarden#3909
- Fix External ID not set during DC Sync by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3804
- New config option disable email change by
[@&#8203;admav](https://togithub.com/admav) in
[dani-garcia/vaultwarden#3986
- 2FA Confirmation Code Email subject line change to fix triggering
Google spam blocker by
[@&#8203;aureateflux](https://togithub.com/aureateflux) in
[dani-garcia/vaultwarden#3572
- Implement cipher key encryption by
[@&#8203;dani-garcia](https://togithub.com/dani-garcia) in
[dani-garcia/vaultwarden#3990
- Container building changes by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3958
- Fix issue with MariaDB/MySQL migrations by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3994
- feat: Working passkeys storage by
[@&#8203;GeekCornerGH](https://togithub.com/GeekCornerGH) in
[dani-garcia/vaultwarden#4025
- ci: add trivy workflow by
[@&#8203;mightyBroccoli](https://togithub.com/mightyBroccoli) in
[dani-garcia/vaultwarden#3997
- Fix importing Bitwarden exports by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#4030

#### New Contributors

- [@&#8203;tuhanayim](https://togithub.com/tuhanayim) made their first
contribution in
[dani-garcia/vaultwarden#3959
- [@&#8203;mvalois](https://togithub.com/mvalois) made their first
contribution in
[dani-garcia/vaultwarden#3981
- [@&#8203;AndreasHGK](https://togithub.com/AndreasHGK) made their first
contribution in
[dani-garcia/vaultwarden#3965
- [@&#8203;tobiasmboelz](https://togithub.com/tobiasmboelz) made their
first contribution in
[dani-garcia/vaultwarden#3909
- [@&#8203;admav](https://togithub.com/admav) made their first
contribution in
[dani-garcia/vaultwarden#3986
- [@&#8203;aureateflux](https://togithub.com/aureateflux) made their
first contribution in
[dani-garcia/vaultwarden#3572
- [@&#8203;mightyBroccoli](https://togithub.com/mightyBroccoli) made
their first contribution in
[dani-garcia/vaultwarden#3997

**Full Changelog**:
dani-garcia/vaultwarden@1.29.2...1.30.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on saturday" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/arthurgeek/vaultwarden-fly-template).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40Ni4wIiwidXBkYXRlZEluVmVyIjoiMzcuNDYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
arthurgeek pushed a commit to arthurgeek/vaultwarden-fly that referenced this pull request Nov 12, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [vaultwarden/server](https://togithub.com/dani-garcia/vaultwarden) |
stage | minor | `1.29.2-alpine` -> `1.30.0-alpine` |

---

### Release Notes

<details>
<summary>dani-garcia/vaultwarden (vaultwarden/server)</summary>

###
[`v1.30.0`](https://togithub.com/dani-garcia/vaultwarden/releases/tag/1.30.0)

[Compare
Source](https://togithub.com/dani-garcia/vaultwarden/compare/1.29.2...1.30.0)

⚠️ **Note:** The WebSockets service for live sync has been integrated in
the main HTTP server, which means simpler proxy setups that don't
require a separate rule to redirect WS traffic to port 3012. Please
check the updated examples in the
[wiki](https://togithub.com/dani-garcia/vaultwarden/wiki/Proxy-examples).
It's recommended to migrate to this new setup as using the old server on
port 3012 is deprecated, won't receive new features and will be removed
in a future release.

#### Major changes and New Features

- Added `passkey` support, allowing the browser extensions to store and
use your `passkeys`, make sure the extension is updated to version
`2023.10.0` or newer for passkey support.
-   Updated web vault to 2023.10.0.
-   Fixed crashes in ARMv6 devices
- Fixed crashes when trying to create/edit a cipher in the mobile
applications.

#### What's Changed

- Update Rust and Crates by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3808
- update web-vault to v2023.8.2 by
[@&#8203;stefan0xC](https://togithub.com/stefan0xC) in
[dani-garcia/vaultwarden#3821
- Fix Login With Device without MasterPassword by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3831
- Update GitHub Workflow by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3910
- Fix arm builds by [@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3911
- Fix typos by [@&#8203;tuhanayim](https://togithub.com/tuhanayim) in
[dani-garcia/vaultwarden#3959
- csp: rename anonaddy.com to addy.io by
[@&#8203;stefan0xC](https://togithub.com/stefan0xC) in
[dani-garcia/vaultwarden#3950
- filter handlebars logs by
[@&#8203;stefan0xC](https://togithub.com/stefan0xC) in
[dani-garcia/vaultwarden#3859
- Remove unnecessary variable clone by
[@&#8203;mvalois](https://togithub.com/mvalois) in
[dani-garcia/vaultwarden#3981
- README.md: Fix grammar nit by
[@&#8203;AndreasHGK](https://togithub.com/AndreasHGK) in
[dani-garcia/vaultwarden#3965
- Fix small issues by [@&#8203;BlackDex](https://togithub.com/BlackDex)
in
[dani-garcia/vaultwarden#3964
- Adds LastActive on /admin/users API route by
[@&#8203;mvalois](https://togithub.com/mvalois) in
[dani-garcia/vaultwarden#3951
- Reopen log file on SIGHUP by
[@&#8203;tobiasmboelz](https://togithub.com/tobiasmboelz) in
[dani-garcia/vaultwarden#3909
- Fix External ID not set during DC Sync by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3804
- New config option disable email change by
[@&#8203;admav](https://togithub.com/admav) in
[dani-garcia/vaultwarden#3986
- 2FA Confirmation Code Email subject line change to fix triggering
Google spam blocker by
[@&#8203;aureateflux](https://togithub.com/aureateflux) in
[dani-garcia/vaultwarden#3572
- Implement cipher key encryption by
[@&#8203;dani-garcia](https://togithub.com/dani-garcia) in
[dani-garcia/vaultwarden#3990
- Container building changes by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3958
- Fix issue with MariaDB/MySQL migrations by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#3994
- feat: Working passkeys storage by
[@&#8203;GeekCornerGH](https://togithub.com/GeekCornerGH) in
[dani-garcia/vaultwarden#4025
- ci: add trivy workflow by
[@&#8203;mightyBroccoli](https://togithub.com/mightyBroccoli) in
[dani-garcia/vaultwarden#3997
- Fix importing Bitwarden exports by
[@&#8203;BlackDex](https://togithub.com/BlackDex) in
[dani-garcia/vaultwarden#4030

#### New Contributors

- [@&#8203;tuhanayim](https://togithub.com/tuhanayim) made their first
contribution in
[dani-garcia/vaultwarden#3959
- [@&#8203;mvalois](https://togithub.com/mvalois) made their first
contribution in
[dani-garcia/vaultwarden#3981
- [@&#8203;AndreasHGK](https://togithub.com/AndreasHGK) made their first
contribution in
[dani-garcia/vaultwarden#3965
- [@&#8203;tobiasmboelz](https://togithub.com/tobiasmboelz) made their
first contribution in
[dani-garcia/vaultwarden#3909
- [@&#8203;admav](https://togithub.com/admav) made their first
contribution in
[dani-garcia/vaultwarden#3986
- [@&#8203;aureateflux](https://togithub.com/aureateflux) made their
first contribution in
[dani-garcia/vaultwarden#3572
- [@&#8203;mightyBroccoli](https://togithub.com/mightyBroccoli) made
their first contribution in
[dani-garcia/vaultwarden#3997

**Full Changelog**:
dani-garcia/vaultwarden@1.29.2...1.30.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on saturday" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/arthurgeek/vaultwarden-fly).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40Ni4wIiwidXBkYXRlZEluVmVyIjoiMzcuNDYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants