client: Fix encrypted session fallback

Cargo.toml

@@ -16,7 +16,7 @@
 ]
 
 [workspace.package]
-version = "0.7.0-alpha"
+version = "0.8.0-alpha"
 edition = "2024"
 authors = ["Bilal Elmoussaoui", "Sophie Herold", "Maximiliano Sandoval"]
 keywords = ["keyring", "secret", "service", "portal", "keychain"]
@@ -33,7 +33,7 @@
 cbc = "0.2"
 clap = { version = "4.5", features = ["cargo", "derive"] }
 endi = "1.1"
 futures-channel = "0.3"
 futures-lite = "2.6"
 futures-util = "0.3"
 hkdf = "0.13"
@@ -41,7 +41,7 @@
 md-5 = "0.11"
 num = "0.4.0"
 num-bigint-dig = { version = "0.9", features = ["zeroize"] }
-oo7 = { path = "client", version = "0.7.0-alpha", default-features = false, features = ["unstable", "tracing"] }
+oo7 = { path = "client", version = "0.8.0-alpha", default-features = false, features = ["unstable", "tracing"] }
 openssl = "0.10"
 pbkdf2 = { version = "0.13", default-features = false }
 rpassword = "7.5"

cli/Cargo.toml

@@ -16,7 +16,7 @@ version.workspace = true
 anstyle = "1.0"
 clap.workspace = true
 hex = "0.4"
-kwallet-parser = { version = "0.7.0-alpha", path = "../kwallet/parser", optional = true }
+kwallet-parser = { version = "0.8.0-alpha", path = "../kwallet/parser", optional = true }
 oo7 = { workspace = true, features = ["tokio"] }
 rpassword.workspace = true
 serde.workspace = true

client/Cargo.toml

@@ -29,7 +29,7 @@ hkdf = { workspace = true, optional = true }
 md-5 = { workspace = true, optional = true }
 num.workspace = true
 num-bigint-dig.workspace = true
-oo7-macros = { path = "../macros", version = "0.7.0-alpha", optional = true }
+oo7-macros = { path = "../macros", version = "0.8.0-alpha", optional = true }
 openssl = { workspace = true, optional = true }
 pbkdf2 = { workspace = true, optional = true, features = ["hmac"] }
 serde.workspace = true

client/src/dbus/service.rs

@@ -63,12 +63,12 @@ impl Service {
     pub async fn new_with_connection(cnx: &zbus::Connection) -> Result<Self, Error> {
         let service = match Self::encrypted_with_connection(cnx).await {
             Ok(service) => Ok(service),
-            Err(Error::ZBus(zbus::Error::MethodError(..))) => {
-                Self::plain_with_connection(cnx).await
-            }
-            Err(Error::Service(ServiceError::ZBus(zbus::Error::MethodError(..)))) => {
-                Self::plain_with_connection(cnx).await
-            }
+            Err(
+                Error::ZBus(zbus::Error::MethodError(..) | zbus::Error::FDO(_))
+                | Error::Service(ServiceError::ZBus(
+                    zbus::Error::MethodError(..) | zbus::Error::FDO(_),
+                )),
+            ) => Self::plain_with_connection(cnx).await,
             Err(e) => Err(e),
         }?;
         Ok(service)

client/tests/dbus_service.rs

@@ -1,6 +1,65 @@
 use futures_util::StreamExt;
 use oo7::dbus::Service;
 
+// https://github.com/linux-credentials/oo7/issues/643
+#[tokio::test]
+#[cfg(feature = "tokio")]
+async fn encrypted_not_supported_falls_back_to_plain() {
+    let setup = oo7_daemon::tests::TestServiceSetup::plain_session_no_encrypted()
+        .await
+        .unwrap();
+
+    // new_with_connection tries encrypted first, should fall back to plain.
+    let service = Service::new_with_connection(&setup.client_conn).await;
+    assert!(
+        service.is_ok(),
+        "Should fall back to plain session, got: {service:?}"
+    );
+}
+
+#[tokio::test]
+#[cfg(feature = "tokio")]
+async fn encrypted_on_plain_only_server_errors() {
+    let setup = oo7_daemon::tests::TestServiceSetup::plain_session_no_encrypted()
+        .await
+        .unwrap();
+
+    let result = Service::encrypted_with_connection(&setup.client_conn).await;
+    assert!(
+        result.is_err(),
+        "encrypted_with_connection should fail on a plain-only server"
+    );
+}
+
+#[tokio::test]
+#[cfg(feature = "tokio")]
+async fn plain_on_plain_only_server() {
+    let setup = oo7_daemon::tests::TestServiceSetup::plain_session_no_encrypted()
+        .await
+        .unwrap();
+
+    let service = Service::plain_with_connection(&setup.client_conn).await;
+    assert!(
+        service.is_ok(),
+        "plain_with_connection should work on a plain-only server, got: {service:?}"
+    );
+}
+
+#[tokio::test]
+#[cfg(feature = "tokio")]
+async fn new_with_connection_on_full_server() {
+    let setup = oo7_daemon::tests::TestServiceSetup::encrypted_session(true)
+        .await
+        .unwrap();
+
+    // Should succeed with encrypted (no fallback needed).
+    let service = Service::new_with_connection(&setup.client_conn).await;
+    assert!(
+        service.is_ok(),
+        "new_with_connection should work on a full server, got: {service:?}"
+    );
+}
+
 #[tokio::test]
 #[cfg(feature = "tokio")]
 async fn create_collection() {

kwallet/cli/Cargo.toml

@@ -11,7 +11,7 @@ rust-version.workspace = true
 
 [dependencies]
 clap.workspace = true
-kwallet-parser = { version = "0.7.0-alpha", path = "../parser" }
+kwallet-parser = { version = "0.8.0-alpha", path = "../parser" }
 oo7 = { workspace = true, features = ["tokio", "native_crypto"] }
 rpassword.workspace = true
 serde.workspace = true

python/Cargo.toml

@@ -16,7 +16,7 @@ name = "oo7"
 crate-type = ["cdylib"]
 
 [dependencies]
-oo7_rs = { package = "oo7", path = "../client", version = "0.7.0-alpha" }
+oo7_rs = { package = "oo7", path = "../client", version = "0.8.0-alpha" }
 pyo3 = { version = "0.29", features = ["extension-module", "abi3-py38"] }
 pyo3-async-runtimes = { version = "0.29", features = ["tokio-runtime"] }
 tokio = { workspace = true, features = ["rt-multi-thread"] }

server/Cargo.toml

@@ -30,7 +30,7 @@ clap.workspace = true
 formatx = "0.4"
 gettext-rs = { version = "0.8", features = ["gettext-system"] }
 hkdf = { workspace = true, optional = true }
-kwallet-parser = { version = "0.7.0-alpha", path = "../kwallet/parser", optional = true }
+kwallet-parser = { version = "0.8.0-alpha", path = "../kwallet/parser", optional = true }
 libc.workspace = true
 num.workspace = true
 num-bigint-dig.workspace = true

server/src/service/mod.rs

@@ -71,6 +71,8 @@ pub struct Service {
     pub(crate) pam_socket: Option<std::path::PathBuf>,
     // Override for prompter type (mainly for tests)
     pub(crate) prompter_type_override: Arc<Mutex<Option<PrompterType>>>,
+    // Whether encrypted sessions are supported
+    encrypted_supported: bool,
 }
 
 #[zbus::interface(name = "org.freedesktop.Secret.Service")]
@@ -85,6 +87,14 @@ impl Service {
     ) -> Result<(OwnedVariant, OwnedObjectPath), ServiceError> {
         let (public_key, aes_key) = match algorithm {
             Algorithm::Plain => (None, None),
+            Algorithm::Encrypted if !self.encrypted_supported => {
+                return Err(ServiceError::ZBus(zbus::Error::FDO(Box::new(
+                    zbus::fdo::Error::NotSupported(
+                        "Algorithm dh-ietf1024-sha256-aes128-cbc-pkcs7 is not supported"
+                            .to_string(),
+                    ),
+                ))));
+            }
             Algorithm::Encrypted => {
                 let client_public_key = Key::try_from(input).map_err(|err| {
                     custom_service_error(&format!(
@@ -598,6 +608,7 @@ impl Service {
     pub(crate) fn new(
         data_dir: std::path::PathBuf,
         pam_socket: Option<std::path::PathBuf>,
+        encrypted_supported: bool,
     ) -> Self {
         Self {
             collections: Arc::new(Mutex::new(HashMap::new())),
@@ -612,6 +623,7 @@ impl Service {
             data_dir,
             pam_socket,
             prompter_type_override: Arc::new(Mutex::new(None)),
+            encrypted_supported,
         }
     }
 
@@ -640,7 +652,7 @@ impl Service {
         // Compute PAM socket path from environment variable
         let pam_socket = std::env::var_os("OO7_PAM_SOCKET").map(std::path::PathBuf::from);
 
-        let service = Self::new(data_dir, pam_socket);
+        let service = Self::new(data_dir, pam_socket, true);
 
         // Start PAM listener early so it can buffer secrets arriving before
         // D-Bus is ready (e.g. during PAM-initiated login startup).
@@ -709,8 +721,9 @@ impl Service {
         data_dir: std::path::PathBuf,
         pam_socket: Option<std::path::PathBuf>,
         secret: Option<Secret>,
+        encrypted_supported: bool,
     ) -> Result<Self, Error> {
-        let service = Self::new(data_dir, pam_socket);
+        let service = Self::new(data_dir, pam_socket, encrypted_supported);
 
         // Serve the service at the standard path
         connection

server/src/service/tests.rs

@@ -1086,7 +1086,7 @@ async fn complete_collection_creation_no_pending() -> Result<(), Box<dyn std::er
 async fn discover_v1_keyrings() -> Result<(), Box<dyn std::error::Error>> {
     // Set up a temporary data directory
     let temp_dir = tempfile::tempdir()?;
-    let service = Service::new(temp_dir.path().to_path_buf(), None);
+    let service = Service::new(temp_dir.path().to_path_buf(), None, true);
 
     // Create v1 keyrings directory
     let v1_dir = temp_dir.path().join("keyrings/v1");
@@ -1314,7 +1314,7 @@ async fn unlock_pending_v0_migration_impl(
 #[tokio::test]
 async fn discover_v0_keyrings() -> Result<(), Box<dyn std::error::Error>> {
     let temp_dir = tempfile::tempdir()?;
-    let service = Service::new(temp_dir.path().to_path_buf(), None);
+    let service = Service::new(temp_dir.path().to_path_buf(), None, true);
 
     let keyrings_dir = temp_dir.path().join("keyrings");
     let v1_dir = keyrings_dir.join("v1");
@@ -1401,7 +1401,7 @@ async fn discover_v0_keyrings() -> Result<(), Box<dyn std::error::Error>> {
 #[tokio::test]
 async fn discover_plain_v0_keyrings() -> Result<(), Box<dyn std::error::Error>> {
     let temp_dir = tempfile::tempdir()?;
-    let service = Service::new(temp_dir.path().to_path_buf(), None);
+    let service = Service::new(temp_dir.path().to_path_buf(), None, true);
 
     let keyrings_dir = temp_dir.path().join("keyrings");
     tokio::fs::create_dir_all(keyrings_dir.join("v1")).await?;
@@ -1434,7 +1434,7 @@ async fn discover_plain_v0_keyrings() -> Result<(), Box<dyn std::error::Error>>
 #[tokio::test]
 async fn discover_kwallet_keyrings() -> Result<(), Box<dyn std::error::Error>> {
     let temp_dir = tempfile::tempdir()?;
-    let service = Service::new(temp_dir.path().to_path_buf(), None);
+    let service = Service::new(temp_dir.path().to_path_buf(), None, true);
 
     let kwallet_dir = temp_dir.path().join("kwalletd");
     let v1_dir = temp_dir.path().join("keyrings/v1");