shimun/fido2luks
1
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

broaden luks api

Browse Source
This commit is contained in:
shimun 2020-06-21 19:11:04 +02:00
parent 8f47f7a556
commit 6c2f5fc7ec
Signed by: shimun
GPG Key ID: E81D8382DC2F971B
1 changed files with 61 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

100
src/luks.rs
View File

@ -7,7 +7,7 @@ use libcryptsetup_rs::{
use std::collections::{HashMap, HashSet}; use std::collections::{HashMap, HashSet};
use std::path::Path; use std::path::Path;
struct LuksDevice { pub struct LuksDevice {
device: CryptDevice, device: CryptDevice,
luks2: Option<bool>, luks2: Option<bool>,
} }
@ -38,36 +38,42 @@ impl LuksDevice {
&'a mut self, &'a mut self,
) -> Fido2LuksResult<Box<dyn Iterator<Item = Fido2LuksResult<(u32, Fido2LuksToken)>> + 'a>> ) -> Fido2LuksResult<Box<dyn Iterator<Item = Fido2LuksResult<(u32, Fido2LuksToken)>> + 'a>>
{ {
Ok(Box::new((0..32).filter_map(move |i| { Ok(Box::new(
let status = match self.device.token_handle().status(i) { (0..32)
Ok(status) => status, .map(move |i| {
Err(err) => return Some(Err(Fido2LuksError::from(err))), let status = match self.device.token_handle().status(i) {
}; Ok(status) => status,
match status { Err(err) => return Some(Err(Fido2LuksError::from(err))),
CryptTokenInfo::Inactive => return None, };
CryptTokenInfo::Internal(s) match status {
| CryptTokenInfo::InternalUnknown(s) CryptTokenInfo::Inactive => return None,
| CryptTokenInfo::ExternalUnknown(s) CryptTokenInfo::Internal(s)
| CryptTokenInfo::External(s) | CryptTokenInfo::InternalUnknown(s)
if &s != "fido2luks" => | CryptTokenInfo::ExternalUnknown(s)
{ | CryptTokenInfo::External(s)
return None if &s != Fido2LuksToken::default_type() =>
} {
_ => (), return None
}; }
let json = match self.device.token_handle().json_get(i) { _ => (),
Ok(json) => json, };
Err(err) => return Some(Err(Fido2LuksError::from(err))), let json = match self.device.token_handle().json_get(i) {
}; Ok(json) => json,
let info: Fido2LuksToken = Err(err) => return Some(Err(Fido2LuksError::from(err))),
match serde_json::from_value(json.clone()).map_err(|_| Fido2LuksError::LuksError { };
cause: LuksError::InvalidToken(json.to_string()), let info: Fido2LuksToken =
}) { match serde_json::from_value(json.clone()).map_err(|_| {
Ok(info) => info, Fido2LuksError::LuksError {
Err(err) => return Some(Err(Fido2LuksError::from(err))), cause: LuksError::InvalidToken(json.to_string()),
}; }
Some(Ok((i, info))) }) {
}))) Ok(info) => info,
Err(err) => return Some(Err(Fido2LuksError::from(err))),
};
Some(Ok((i, info)))
})
.filter_map(|o| o),
))
} }
pub fn find_token(&mut self, slot: u32) -> Fido2LuksResult<Option<(u32, Fido2LuksToken)>> { pub fn find_token(&mut self, slot: u32) -> Fido2LuksResult<Option<(u32, Fido2LuksToken)>> {
@ -81,6 +87,11 @@ impl LuksDevice {
Ok(None) Ok(None)
} }
pub fn remove_token(&mut self, token: u32) -> Fido2LuksResult<()> {
self.device.token_handle().json_set(TokenInput::RemoveToken(token))?;
Ok(())
}
pub fn add_key( pub fn add_key(
&mut self, &mut self,
secret: &[u8], secret: &[u8],
@ -129,9 +140,7 @@ impl LuksDevice {
// Ensure indices stay valid // Ensure indices stay valid
tokens.sort(); tokens.sort();
for token in tokens.iter().rev() { for token in tokens.iter().rev() {
self.device self.remove_token(*token)?;
.token_handle()
.json_set(TokenInput::RemoveToken(*token))?;
} }
Ok(destroyed) Ok(destroyed)
} }
@ -245,19 +254,32 @@ impl LuksDevice {
} }
#[derive(Debug, Clone, Serialize, Deserialize)] #[derive(Debug, Clone, Serialize, Deserialize)]
struct Fido2LuksToken { pub struct Fido2LuksToken {
#[serde(rename = "type")] #[serde(rename = "type")]
type_: String, pub type_: String,
credential: Vec<String>, pub credential: Vec<String>,
keyslots: Vec<String>, pub keyslots: Vec<String>,
} }
impl Fido2LuksToken { impl Fido2LuksToken {
fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self { fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self {
Self { Self {
type_: "fido2luks\0".into(), // Doubles as c style string
credential: vec![hex::encode(credential_id)], credential: vec![hex::encode(credential_id)],
keyslots: vec![slot.to_string()], keyslots: vec![slot.to_string()],
..Default::default()
}
}
fn default_type() -> &'static str {
"fido2luks"
}
}
impl Default for Fido2LuksToken {
fn default() -> Self {
Self {
type_: Self::default_type().into(),
credential: Vec::new(),
keyslots: Vec::new(),
} }
} }
} }