Compare commits
14 Commits
ctap-hid-f
...
master
| Author | SHA1 | Date | |
|---|---|---|---|
210da1ce0f
|
|||
|
4509cacd6d
|
|||
|
67136f2405 | ||
|
b2e4950db5
|
|||
|
5496c4e61b
|
|||
|
51fa26b7d5
|
|||
|
|
a3696962e8 | ||
|
|
7e6b33ae7f | ||
|
b3495c45f3
|
|||
|
|
17ca487b85 | ||
|
b0404f2fc1
|
|||
|
|
de21e3ef8d | ||
|
|
8a7b3addbb | ||
|
e7e44cd61b
|
10
.drone.yml
10
.drone.yml
@ -8,20 +8,22 @@ steps:
|
||||
- rustup component add rustfmt
|
||||
- cargo fmt --all -- --check
|
||||
- name: test
|
||||
image: shimun/fido2luks@sha256:6d0b4017bffbec5fac8f25d383d68671fcc9930efb02e97ce5ea81acf0060ece
|
||||
image: ubuntu:focal
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
commands:
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev
|
||||
- cargo test --locked
|
||||
- name: publish
|
||||
image: shimun/fido2luks@sha256:6d0b4017bffbec5fac8f25d383d68671fcc9930efb02e97ce5ea81acf0060ece
|
||||
image: ubuntu:focal
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
CARGO_REGISTRY_TOKEN:
|
||||
from_secret: cargo_tkn
|
||||
commands:
|
||||
- grep -E 'version ?= ?"${DRONE_TAG}"' -i Cargo.toml || (printf "incorrect crate/tag version" && exit 1)
|
||||
- cargo package --all-features --allow-dirty
|
||||
- cargo publish --all-features --allow-dirty
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev
|
||||
- cargo package --all-features
|
||||
- cargo publish --all-features
|
||||
when:
|
||||
event: tag
|
||||
|
||||
11
CHANGELOG.md
11
CHANGELOG.md
@ -1,11 +0,0 @@
|
||||
## 0.3.0
|
||||
|
||||
* LUKS2 Tokens are now supported by every subcommand
|
||||
* `<credential>` has been converted into the flag `--creds`
|
||||
credentials provided by `--creds` will be supplemented from the LUKS header unless this is disabled by `--disable-token`
|
||||
* `fido2luks add-key` will take an `--auto-cred` flag which allows for credentials to be generated and stored without having to use `fido2luks credential`
|
||||
`fido2luks replace-key` will allow for credentials to be removed using the `--remove-cred` flag respectively
|
||||
* Removed `fido2luks open-token` subcommand
|
||||
`fido2luks open` now fulfills both functions
|
||||
* Added `fido2luks open --dry-run` flag, to perform the whole procedure apart from mounting the LUKS volume
|
||||
* Added an `--verbose` flag to display additional information like credentials and keyslots used if desired
|
||||
1202
Cargo.lock
generated
1202
Cargo.lock
generated
File diff suppressed because it is too large
Load Diff
20
Cargo.toml
20
Cargo.toml
@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "fido2luks"
|
||||
version = "0.3.1-alpha"
|
||||
version = "0.2.20"
|
||||
authors = ["shimunn <shimun@shimun.net>"]
|
||||
edition = "2018"
|
||||
|
||||
@ -14,25 +14,24 @@ categories = ["command-line-utilities"]
|
||||
license = "MPL-2.0"
|
||||
|
||||
[dependencies]
|
||||
ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
|
||||
hex = "0.3.2"
|
||||
ring = "0.16.5"
|
||||
ring = "0.13.5"
|
||||
failure = "0.1.5"
|
||||
rpassword = "4.0.1"
|
||||
structopt = "0.3.2"
|
||||
libcryptsetup-rs = "0.4.1"
|
||||
serde_json = "1.0.51"
|
||||
serde_derive = "1.0.116"
|
||||
serde = "1.0.116"
|
||||
anyhow = "1.0.56"
|
||||
ctap-hid-fido2 = "3.4.1"
|
||||
libcryptsetup-rs = "0.5.1"
|
||||
serde_derive = "1.0.106"
|
||||
serde = "1.0.106"
|
||||
|
||||
[build-dependencies]
|
||||
ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
|
||||
hex = "0.3.2"
|
||||
ring = "0.16.5"
|
||||
ring = "0.13.5"
|
||||
failure = "0.1.5"
|
||||
rpassword = "4.0.1"
|
||||
anyhow = "1.0.56"
|
||||
libcryptsetup-rs = "0.5.1"
|
||||
libcryptsetup-rs = "0.4.1"
|
||||
structopt = "0.3.2"
|
||||
|
||||
[profile.release]
|
||||
@ -49,6 +48,7 @@ extended-description = "Decrypt your LUKS partition using a FIDO2 compatible aut
|
||||
assets = [
|
||||
["target/release/fido2luks", "usr/bin/", "755"],
|
||||
["fido2luks.bash", "usr/share/bash-completion/completions/fido2luks", "644"],
|
||||
["pam_mount/fido2luksmounthelper.sh", "usr/bin/", "755"],
|
||||
["initramfs-tools/keyscript.sh", "/lib/cryptsetup/scripts/fido2luks", "755" ],
|
||||
["initramfs-tools/hook/fido2luks.sh", "etc/initramfs-tools/hooks/", "755" ],
|
||||
["initramfs-tools/fido2luks.conf", "etc/", "644"],
|
||||
|
||||
161
README.md
161
README.md
@ -1,7 +1,160 @@
|
||||
# fido2luks [](https://crates.io/crates/fido2luks)
|
||||
|
||||
## 0.3.0-alpha
|
||||
This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key.
|
||||
|
||||
Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T, YubiKey(fw >= [5.2.3](https://support.yubico.com/hc/en-us/articles/360016649319-YubiKey-5-2-3-Enhancements-to-FIDO-2-Support))
|
||||
|
||||
## Setup
|
||||
|
||||
### Prerequisites
|
||||
|
||||
```
|
||||
dnf install clang cargo cryptsetup-devel -y
|
||||
```
|
||||
|
||||
### Device
|
||||
|
||||
```
|
||||
git clone https://github.com/shimunn/fido2luks.git && cd fido2luks
|
||||
|
||||
# Alternativly cargo build --release && sudo cp target/release/fido2luks /usr/bin/
|
||||
sudo -E cargo install -f --path . --root /usr
|
||||
|
||||
# Copy template
|
||||
cp dracut/96luks-2fa/fido2luks.conf /etc/
|
||||
# Name is optional but useful if your authenticator has a display
|
||||
echo FIDO2LUKS_CREDENTIAL_ID=$(fido2luks credential [NAME]) >> /etc/fido2luks.conf
|
||||
|
||||
# Load config into env
|
||||
set -a
|
||||
. /etc/fido2luks.conf
|
||||
|
||||
# Repeat for each luks volume
|
||||
# You can also use the `--token` flag when using LUKS2 which will then store the credential in the LUKS header,
|
||||
# enabling you to use `fido2luks open-token` without passing a credential as parameter
|
||||
sudo -E fido2luks -i add-key /dev/disk/by-uuid/<DISK_UUID>
|
||||
|
||||
# Test(only works if the luks container isn't active)
|
||||
sudo -E fido2luks -i open /dev/disk/by-uuid/<DISK_UUID> luks-<DISK_UUID>
|
||||
|
||||
```
|
||||
|
||||
### Dracut
|
||||
|
||||
```
|
||||
cd dracut
|
||||
|
||||
sudo make install
|
||||
```
|
||||
|
||||
### Grub
|
||||
|
||||
Add `rd.luks.2fa=<CREDENTIAL_ID>:<DISK_UUID>` to `GRUB_CMDLINE_LINUX` in /etc/default/grub
|
||||
|
||||
Note: This is only required for your root disk, systemd will try to unlock all other LUKS partions using the same key if you added it using `fido2luks add-key`
|
||||
|
||||
```
|
||||
grub2-mkconfig > /boot/grub2/grub.cfg
|
||||
```
|
||||
|
||||
I'd also recommend to copy the executable onto /boot so that it is accessible in case you have to access your disk from a rescue system
|
||||
|
||||
```
|
||||
mkdir /boot/fido2luks/
|
||||
cp /usr/bin/fido2luks /boot/fido2luks/
|
||||
cp /etc/fido2luks.conf /boot/fido2luks/
|
||||
```
|
||||
|
||||
## Testing
|
||||
|
||||
Just reboot and see if it works, if that's the case you should remove your old less secure password from your LUKS header:
|
||||
|
||||
```
|
||||
# Recommend in case you lose your authenticator, store this backupfile somewhere safe
|
||||
cryptsetup luksHeaderBackup /dev/disk/by-uuid/<DISK_UUID> --header-backup-file luks_backup_<DISK_UUID>
|
||||
# There is no turning back if you mess this up, make sure you made a backup
|
||||
# You can also pass `--token` if you're using LUKS2 which will then store the credential in the LUKS header,
|
||||
# which will enable you to use `fido2luks open-token` without passing a credential as parameter
|
||||
fido2luks -i add-key --exclusive /dev/disk/by-uuid/<DISK_UUID>
|
||||
```
|
||||
|
||||
## Addtional settings
|
||||
|
||||
### Password less
|
||||
|
||||
Remove your previous secret as described in the next section, in case you've already added one.
|
||||
|
||||
Open `/etc/fido2luks.conf` and replace `FIDO2LUKS_SALT=Ask` with `FIDO2LUKS_SALT=string:<YOUR_RANDOM_STRING>`
|
||||
but be warned that this password will be included to into your initramfs.
|
||||
|
||||
Import the new config into env:
|
||||
|
||||
```
|
||||
set -a
|
||||
. /etc/fido2luks.conf
|
||||
```
|
||||
|
||||
Then add the new secret to each device and update dracut afterwards `dracut -f`
|
||||
|
||||
### Multiple keys
|
||||
|
||||
Additional/backup keys are supported, Multiple fido2luks credentials can be added to your /etc/fido2luks.conf file. Credential tokens are comma separated.
|
||||
```
|
||||
FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL1>,<CREDENTIAL2>,<CREDENTIAL3>
|
||||
```
|
||||
|
||||
## Removal
|
||||
|
||||
Remove `rd.luks.2fa` from `GRUB_CMDLINE_LINUX` in /etc/default/grub
|
||||
|
||||
```
|
||||
set -a
|
||||
. fido2luks.conf
|
||||
sudo -E fido2luks -i replace-key /dev/disk/by-uuid/<DISK_UUID>
|
||||
|
||||
sudo rm -rf /usr/lib/dracut/modules.d/96luks-2fa /etc/dracut.conf.d/luks-2fa.conf /etc/fido2luks.conf
|
||||
```
|
||||
|
||||
## Theory of operation
|
||||
|
||||
fido2luks builds on two basic building blocks, LUKS as an abstraction over linux disk encryption and and the FIDO2 extension [`hmac-secret`](https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension).
|
||||
The `hmac-secret` extension allows for an secret to be dervied on the FIDO2 device from two inputs, the user supplied salt/password/keyfile and another secret contained within the FID2 device. The output of the `hmac-secret` function will then be used to decrypt the LUKS header which in turn is used to decrypt the disk.
|
||||
```
|
||||
|
||||
+-------------------------------------------------------------------------------+
|
||||
| |
|
||||
| +-----------------------------------------+ |
|
||||
| | FIDO2 device | |
|
||||
| | | |
|
||||
| | | |
|
||||
+-------+--------+ +------+ | +---------------+ | | +------------------------+
|
||||
| Salt/Password +-> |sha256+------------------------> | | | v | LUKS header |
|
||||
+----------------+ +------+ | | | | | | +---------------+
|
||||
| | | | +--------+ +------------------------+--------> |Disk master key|
|
||||
| | sha256_hmac +---------> | sha256 +-------> | Keyslot 1 | +---------------+
|
||||
+----------------+ | +----------+ | | | +--------+ +------------------------+
|
||||
| FIDO credential+---------------> |Credential| +----> | | | | Keyslot 2 |
|
||||
+----------------+ | |secret | | | | +------------------------+
|
||||
| +----------+ +---------------+ |
|
||||
| |
|
||||
| |
|
||||
+-----------------------------------------+
|
||||
|
||||
```
|
||||
Since all these components build upon each other losing or damaging just one of them will render the disk undecryptable, it's threfore of paramount importance to backup the LUKS header and ideally set an backup password
|
||||
or utilise more than one FIDO2 device. Each additional credential and password combination will require it's own LUKS keyslot since the credential secret is randomly generated for each new credential and will thus result
|
||||
in a completly different secret.
|
||||
|
||||
## License
|
||||
|
||||
Licensed under
|
||||
|
||||
* Mozilla Public License 2.0, ([LICENSE-MPL](LICENSE-MPL) or https://www.mozilla.org/en-US/MPL/2.0/)
|
||||
|
||||
### Contribution
|
||||
|
||||
Unless you explicitly state otherwise, any contribution intentionally
|
||||
submitted for inclusion in the work by you, as defined in the MPL 2.0
|
||||
license, shall be licensed as above, without any additional terms or
|
||||
conditions.
|
||||
|
||||
This is just the program itself, all intitrid scripts are mostly taylored to the latest 0.2.x version and will most likely not work with 0.3.0 due to breaking changes in the CLI interface.
|
||||
I've decided it release the version in this state since I just do not have the time now or in the forseeable future to tewak all scripts since it's quite an tedious tasks which involves rebooting VMs countless times.
|
||||
If you're interested to adapt or write scripts for an particular distro I'd be more than happy to accept pull requests.
|
||||
|
||||
12
build.rs
12
build.rs
@ -1,6 +1,7 @@
|
||||
#![allow(warnings)]
|
||||
#[macro_use]
|
||||
extern crate failure;
|
||||
extern crate ctap_hmac as ctap;
|
||||
|
||||
#[path = "src/cli_args/mod.rs"]
|
||||
mod cli_args;
|
||||
@ -11,22 +12,13 @@ mod util;
|
||||
|
||||
use cli_args::Args;
|
||||
use std::env;
|
||||
use std::fs;
|
||||
use std::path::PathBuf;
|
||||
use std::str::FromStr;
|
||||
use structopt::clap::Shell;
|
||||
use structopt::StructOpt;
|
||||
|
||||
fn main() {
|
||||
let env_outdir = env::var_os("OUT_DIR").unwrap();
|
||||
let outdir = PathBuf::from(PathBuf::from(env_outdir).ancestors().nth(3).unwrap());
|
||||
fs::create_dir_all(&outdir).unwrap();
|
||||
// generate completion scripts, zsh does panic for some reason
|
||||
for shell in Shell::variants().iter().filter(|shell| **shell != "zsh") {
|
||||
Args::clap().gen_completions(
|
||||
env!("CARGO_PKG_NAME"),
|
||||
Shell::from_str(shell).unwrap(),
|
||||
&outdir,
|
||||
);
|
||||
Args::clap().gen_completions(env!("CARGO_PKG_NAME"), Shell::from_str(shell).unwrap(), ".");
|
||||
}
|
||||
}
|
||||
|
||||
12
flake.lock
generated
12
flake.lock
generated
@ -22,11 +22,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1647282937,
|
||||
"narHash": "sha256-K8Oo6QyFCfiEWTRpQVfzcwI3YNMKlz6Tu8rr+o3rzRQ=",
|
||||
"lastModified": 1638109994,
|
||||
"narHash": "sha256-OpA37PTiPMIqoRJbufbl5rOLII7HeeGcA0yl7FoyCIE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "64fc73bd74f04d3e10cb4e70e1c65b92337e76db",
|
||||
"rev": "a284564b7f75ac4db73607db02076e8da9d42c9d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -43,11 +43,11 @@
|
||||
},
|
||||
"utils": {
|
||||
"locked": {
|
||||
"lastModified": 1644229661,
|
||||
"narHash": "sha256-1YdnJAsNy69bpcjuoKdOYQX0YxZBiCYZo4Twxerqv7k=",
|
||||
"lastModified": 1638122382,
|
||||
"narHash": "sha256-sQzZzAbvKEqN9s0bzWuYmRaA03v40gaJ4+iL1LXjaeI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "3cecb5b042f7f209c56ffd8371b2711a290ec797",
|
||||
"rev": "74f7e4319258e287b0f9cb95426c9853b282730b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
89
flake.nix
89
flake.nix
@ -9,42 +9,32 @@
|
||||
};
|
||||
};
|
||||
|
||||
outputs = inputs @ { self, nixpkgs, utils, naersk, ... }:
|
||||
outputs = { self, nixpkgs, utils, naersk }:
|
||||
let
|
||||
root = inputs.source or self;
|
||||
pname = (builtins.fromTOML (builtins.readFile (root + "/Cargo.toml"))).package.name;
|
||||
# toolchains: stable, beta, default(nightly)
|
||||
toolchain = pkgs: if inputs ? fenix then inputs.fenix.packages."${pkgs.system}".complete.toolchain
|
||||
else with pkgs; symlinkJoin { name = "rust-toolchain"; paths = [ rustc cargo ]; };
|
||||
forSystem = system:
|
||||
root = ./.;
|
||||
pname = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.name;
|
||||
forPkgs = pkgs:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages."${system}";
|
||||
naersk-lib = naersk.lib."${pkgs.system}";
|
||||
buildInputs = with pkgs; [ cryptsetup ];
|
||||
LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
|
||||
nativeBuildInputs = with pkgs; [
|
||||
pkgconfig
|
||||
clang
|
||||
];
|
||||
in
|
||||
rec {
|
||||
# `nix build`
|
||||
packages.${pname} = (self.overlay pkgs pkgs).${pname};
|
||||
|
||||
packages.dockerImage = pkgs.runCommandLocal "docker-${pname}.tar.gz" {} "${apps.streamDockerImage.program} | gzip --fast > $out";
|
||||
|
||||
packages.default = packages.${pname};
|
||||
packages.${pname} = naersk-lib.buildPackage {
|
||||
inherit pname root buildInputs nativeBuildInputs LIBCLANG_PATH;
|
||||
};
|
||||
defaultPackage = packages.${pname};
|
||||
|
||||
# `nix run`
|
||||
apps.${pname} = utils.lib.mkApp {
|
||||
drv = packages.${pname};
|
||||
};
|
||||
|
||||
# `nix run .#streamDockerImage | docker load`
|
||||
apps.streamDockerImage = utils.lib.mkApp {
|
||||
drv = with pkgs; dockerTools.streamLayeredImage {
|
||||
name = pname;
|
||||
tag = self.shortRev or "latest";
|
||||
config = {
|
||||
Entrypoint = apps.default.program;
|
||||
};
|
||||
};
|
||||
exePath = "";
|
||||
};
|
||||
apps.default = apps.${pname};
|
||||
defaultApp = apps.${pname};
|
||||
|
||||
# `nix flake check`
|
||||
checks = {
|
||||
@ -56,45 +46,16 @@ outputs = inputs @ { self, nixpkgs, utils, naersk, ... }:
|
||||
'';
|
||||
};
|
||||
|
||||
hydraJobs = checks // packages;
|
||||
|
||||
# `nix develop`
|
||||
devShell = pkgs.mkShell rec {
|
||||
RUST_SRC_PATH = "${if inputs ? fenix then "${toolchain pkgs}/lib/rustlib" else pkgs.rustPlatform.rustLibSrc}";
|
||||
nativeBuildInputs = with pkgs; [ (toolchain pkgs) cargo-edit rustfmt nixpkgs-fmt ] ++ packages.default.nativeBuildInputs;
|
||||
inherit (packages.default) buildInputs LIBCLANG_PATH;
|
||||
shellHook = ''
|
||||
printf "Rust version:"
|
||||
rustc --version
|
||||
printf "\nbuild inputs: ${pkgs.lib.concatStringsSep ", " (map (bi: bi.name) (buildInputs ++ nativeBuildInputs))}"
|
||||
'';
|
||||
devShell = pkgs.mkShell {
|
||||
nativeBuildInputs = with pkgs; [ rustc cargo rustfmt nixpkgs-fmt ] ++ nativeBuildInputs;
|
||||
inherit buildInputs LIBCLANG_PATH;
|
||||
};
|
||||
};
|
||||
forSystem = system: forPkgs nixpkgs.legacyPackages."${system}";
|
||||
in
|
||||
(utils.lib.eachSystem [ "aarch64-linux" "i686-linux" "x86_64-linux" ] forSystem) // {
|
||||
overlay = final: prev: (forPkgs final).packages;
|
||||
};
|
||||
|
||||
};
|
||||
in
|
||||
(utils.lib.eachDefaultSystem forSystem) // {
|
||||
overlays.pinned = final: prev: (self.overlay final (import nixpkgs {
|
||||
inherit (final) localSystem;
|
||||
})).packages;
|
||||
overlay = final: prev:
|
||||
let
|
||||
naersk-lib = naersk.lib."${final.system}".override {
|
||||
rustc = toolchain prev;
|
||||
cargo = toolchain prev;
|
||||
};
|
||||
buildInputs = with prev; [
|
||||
udev cryptsetup.dev
|
||||
];
|
||||
nativeBuildInputs = with prev; [
|
||||
pkg-config clang
|
||||
];
|
||||
in
|
||||
{
|
||||
"${pname}" =
|
||||
naersk-lib.buildPackage {
|
||||
LIBCLANG_PATH = "${final.llvmPackages.libclang.lib}/lib";
|
||||
inherit pname root buildInputs nativeBuildInputs;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,15 +0,0 @@
|
||||
FROM rust:bullseye
|
||||
|
||||
RUN cargo install -f cargo-deb --debug --version 1.30.0
|
||||
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
RUN apt update && apt install -y cryptsetup pkg-config libclang-dev libcryptsetup-dev && mkdir -p /build/fido2luks
|
||||
|
||||
WORKDIR /build/fido2luks
|
||||
|
||||
ENV CARGO_TARGET_DIR=/build/fido2luks/target
|
||||
|
||||
RUN cargo install fido2luks -f
|
||||
|
||||
CMD bash -xc 'cp -rf /code/* /build/fido2luks && cargo-deb && cp target/debian/*.deb /out'
|
||||
@ -1,9 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -ex
|
||||
|
||||
docker build . -t fido2luks-deb
|
||||
|
||||
mkdir -p debs
|
||||
|
||||
docker run -ti -v "$(pwd)/..:/code:ro" -v "$(pwd)/debs:/out" fido2luks-deb
|
||||
@ -1,3 +1,5 @@
|
||||
FIDO2LUKS_SALT=Ask
|
||||
#FIDO2LUKS_PASSWORD_HELPER="/usr/bin/plymouth ask-for-password --prompt 'FIDO2 password salt'"
|
||||
FIDO2LUKS_CREDENTIAL_ID=
|
||||
FIDO2LUKS_USE_TOKEN=0
|
||||
FIDO2LUKS_PASSWORD_FALLBACK=1
|
||||
|
||||
@ -2,9 +2,29 @@
|
||||
set -a
|
||||
. /etc/fido2luks.conf
|
||||
|
||||
# Set Defaults
|
||||
if [ -z "$FIDO2LUKS_USE_TOKEN" ]; then
|
||||
FIDO2LUKS_USE_TOKEN=0
|
||||
fi
|
||||
|
||||
if [ -z "$FIDO2LUKS_PASSWORD_FALLBACK" ]; then
|
||||
FIDO2LUKS_PASSWORD_FALLBACK=1
|
||||
fi
|
||||
|
||||
|
||||
|
||||
if [ -z "$FIDO2LUKS_PASSWORD_HELPER" ]; then
|
||||
MSG="FIDO2 password salt for $CRYPTTAB_NAME"
|
||||
export FIDO2LUKS_PASSWORD_HELPER="plymouth ask-for-password --prompt '$MSG'"
|
||||
fi
|
||||
|
||||
fido2luks print-secret --bin "$CRYPTTAB_SOURCE" $([ "$FIDO2LUKS_USE_TOKEN" -eq 0 ] && printf "--disable-token")
|
||||
if [ "$FIDO2LUKS_USE_TOKEN" -eq 1 ]; then
|
||||
export FIDO2LUKS_CREDENTIAL_ID="$FIDO2LUKS_CREDENTIAL_ID,$(fido2luks token list --csv $CRYPTTAB_SOURCE)"
|
||||
fi
|
||||
|
||||
fido2luks print-secret --bin
|
||||
|
||||
# Fall back to passphrase-based unlock if fido2luks fails
|
||||
if [ "$?" -gt 0 ] && [ "$FIDO2LUKS_PASSWORD_FALLBACK" -eq 1 ]; then
|
||||
plymouth ask-for-password --prompt "Password for $CRYPTTAB_SOURCE"
|
||||
fi
|
||||
|
||||
532
src/cli.rs
532
src/cli.rs
@ -2,22 +2,33 @@ use crate::error::*;
|
||||
use crate::luks::{Fido2LuksToken, LuksDevice};
|
||||
use crate::util::sha256;
|
||||
use crate::*;
|
||||
pub use cli_args::Args;
|
||||
use cli_args::*;
|
||||
use ctap_hid_fido2::public_key_credential_descriptor::PublicKeyCredentialDescriptor;
|
||||
use std::borrow::Cow;
|
||||
use std::collections::HashSet;
|
||||
use std::io::Write;
|
||||
use std::iter::FromIterator;
|
||||
use std::path::Path;
|
||||
use std::str::FromStr;
|
||||
use std::time::Duration;
|
||||
use std::time::SystemTime;
|
||||
|
||||
use structopt::clap::Shell;
|
||||
use structopt::StructOpt;
|
||||
|
||||
fn read_pin() -> Fido2LuksResult<String> {
|
||||
util::read_password_tty("Authenticator PIN", false)
|
||||
use ctap::{FidoCredential, FidoErrorKind};
|
||||
|
||||
use std::io::{Read, Write};
|
||||
use std::str::FromStr;
|
||||
use std::thread;
|
||||
use std::time::Duration;
|
||||
|
||||
use std::borrow::Cow;
|
||||
use std::collections::HashSet;
|
||||
use std::fs::File;
|
||||
use std::time::SystemTime;
|
||||
|
||||
pub use cli_args::Args;
|
||||
|
||||
fn read_pin(ap: &AuthenticatorParameters) -> Fido2LuksResult<String> {
|
||||
if let Some(src) = ap.pin_source.as_ref() {
|
||||
let mut pin = String::new();
|
||||
File::open(src)?.read_to_string(&mut pin)?;
|
||||
Ok(pin.trim_end_matches("\n").to_string()) //remove trailing newline
|
||||
} else {
|
||||
util::read_password("Authenticator PIN", false)
|
||||
}
|
||||
}
|
||||
|
||||
fn derive_secret(
|
||||
@ -25,129 +36,35 @@ fn derive_secret(
|
||||
salt: &[u8; 32],
|
||||
timeout: u64,
|
||||
pin: Option<&str>,
|
||||
) -> Fido2LuksResult<([u8; 32], PublicKeyCredentialDescriptor)> {
|
||||
if credentials.is_empty() {
|
||||
return Err(Fido2LuksError::InsufficientCredentials);
|
||||
}
|
||||
) -> Fido2LuksResult<([u8; 32], FidoCredential)> {
|
||||
let timeout = Duration::from_secs(timeout);
|
||||
let start = SystemTime::now();
|
||||
|
||||
//while let Ok(el) = start.elapsed() {
|
||||
// if el > timeout {
|
||||
// return Err(error::Fido2LuksError::NoAuthenticatorError);
|
||||
// }
|
||||
// if get_devices()
|
||||
// .map(|devices| !devices.is_empty())
|
||||
// .unwrap_or(false)
|
||||
// {
|
||||
// break;
|
||||
// }
|
||||
// thread::sleep(Duration::from_millis(500));
|
||||
//}
|
||||
while let Ok(el) = start.elapsed() {
|
||||
if el > timeout {
|
||||
return Err(error::Fido2LuksError::NoAuthenticatorError);
|
||||
}
|
||||
if get_devices()
|
||||
.map(|devices| !devices.is_empty())
|
||||
.unwrap_or(false)
|
||||
{
|
||||
break;
|
||||
}
|
||||
thread::sleep(Duration::from_millis(500));
|
||||
}
|
||||
|
||||
let credentials = credentials
|
||||
.iter()
|
||||
.map(|hex| PublicKeyCredentialDescriptor {
|
||||
.map(|hex| FidoCredential {
|
||||
id: hex.0.clone(),
|
||||
ctype: Default::default(),
|
||||
public_key: None,
|
||||
})
|
||||
.collect::<Vec<_>>();
|
||||
let credentials = credentials.iter().collect::<Vec<_>>();
|
||||
let (unsalted, cred) =
|
||||
perform_challenge(&credentials, salt, timeout - start.elapsed().unwrap(), pin)?;
|
||||
|
||||
let binary = sha256(&[salt, &unsalted[..]]);
|
||||
Ok((binary, cred.clone()))
|
||||
}
|
||||
|
||||
pub fn extend_creds_device(
|
||||
creds: &[HexEncoded],
|
||||
luks_dev: &mut LuksDevice,
|
||||
) -> Fido2LuksResult<Vec<HexEncoded>> {
|
||||
let mut additional = HashSet::new();
|
||||
additional.extend(creds.iter().cloned());
|
||||
for token in luks_dev.tokens()? {
|
||||
for cred in token?.1.credential {
|
||||
let parsed = HexEncoded::from_str(cred.as_str()).map_err(|_e| {
|
||||
Fido2LuksError::HexEncodingError {
|
||||
string: cred.clone(),
|
||||
}
|
||||
})?;
|
||||
additional.insert(parsed);
|
||||
}
|
||||
}
|
||||
Ok(Vec::from_iter(additional.into_iter()))
|
||||
}
|
||||
|
||||
pub fn get_input(
|
||||
secret: &SecretParameters,
|
||||
authenticator: &AuthenticatorParameters,
|
||||
interactive: bool,
|
||||
q: &str,
|
||||
verify: bool,
|
||||
) -> Fido2LuksResult<(Option<String>, [u8; 32])> {
|
||||
let password_helper = secret
|
||||
.password_helper
|
||||
.as_ref()
|
||||
.map(|helper| move || helper.obtain());
|
||||
let salt = &secret.salt;
|
||||
Ok(if interactive {
|
||||
(
|
||||
if authenticator.pin && may_require_pin()? {
|
||||
Some(read_pin()?)
|
||||
} else {
|
||||
None
|
||||
},
|
||||
salt.obtain_sha256(Some(|| util::read_password_tty(q, verify)))?,
|
||||
)
|
||||
} else {
|
||||
match (
|
||||
authenticator.pin && may_require_pin()?,
|
||||
authenticator.pin_prefixed,
|
||||
) {
|
||||
(true, false) => (Some(read_pin()?), salt.obtain_sha256(password_helper)?),
|
||||
(true, true) => read_password_pin_prefixed(|| {
|
||||
salt.obtain(password_helper).and_then(|secret| {
|
||||
String::from_utf8(secret).map_err(|e| Fido2LuksError::from(e))
|
||||
})
|
||||
})?,
|
||||
(false, _) => (None, salt.obtain_sha256(password_helper)?),
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
pub fn read_password_pin_prefixed(
|
||||
prefixed: impl Fn() -> Fido2LuksResult<String>,
|
||||
) -> Fido2LuksResult<(Option<String>, [u8; 32])> {
|
||||
let read = prefixed()?;
|
||||
let separator = ':';
|
||||
let mut parts = read.split(separator);
|
||||
let pin = parts.next().filter(|p| p.len() > 0).map(|p| p.to_string());
|
||||
let password = match pin {
|
||||
Some(ref pin) if read.len() > pin.len() => {
|
||||
read.chars().skip(pin.len() + 1).collect::<String>()
|
||||
}
|
||||
Some(_) => String::new(),
|
||||
_ => read
|
||||
.chars()
|
||||
.skip(read.chars().next().map(|c| c == separator).unwrap_or(false) as usize)
|
||||
.collect::<String>(),
|
||||
};
|
||||
Ok((pin, util::sha256(&[password.as_bytes()])))
|
||||
}
|
||||
|
||||
/// generate an more readable name from common paths
|
||||
pub fn derive_credential_name(path: &Path) -> String {
|
||||
match path.file_name() {
|
||||
Some(name)
|
||||
if path
|
||||
.iter()
|
||||
.any(|p| p == "by-label" || p == "by-partlabel" || p == "by-uuid") =>
|
||||
{
|
||||
name.to_string_lossy().as_ref().to_string()
|
||||
}
|
||||
_ => path.display().to_string(),
|
||||
}
|
||||
Ok((sha256(&[salt, &unsalted[..]]), cred.clone()))
|
||||
}
|
||||
|
||||
pub fn parse_cmdline() -> Args {
|
||||
@ -163,11 +80,6 @@ pub fn prompt_interaction(interactive: bool) {
|
||||
pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
let mut stdout = io::stdout();
|
||||
let args = parse_cmdline();
|
||||
let log = |message: &dyn Fn() -> String| {
|
||||
if args.verbose {
|
||||
eprintln!("{}", &*message());
|
||||
}
|
||||
};
|
||||
let interactive = args.interactive;
|
||||
match &args.command {
|
||||
Command::Credential {
|
||||
@ -175,14 +87,13 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
name,
|
||||
} => {
|
||||
let pin_string;
|
||||
let pin = if authenticator.pin && may_require_pin()? {
|
||||
pin_string = read_pin()?;
|
||||
let pin = if authenticator.pin {
|
||||
pin_string = read_pin(authenticator)?;
|
||||
Some(pin_string.as_ref())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let cred =
|
||||
make_credential_id(Some(name.as_str()).filter(|name| name.len() > 0), pin, &[])?;
|
||||
let cred = make_credential_id(Some(name.as_ref()), pin)?;
|
||||
println!("{}", hex::encode(&cred.id));
|
||||
Ok(())
|
||||
}
|
||||
@ -191,44 +102,26 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
authenticator,
|
||||
credentials,
|
||||
secret,
|
||||
device,
|
||||
} => {
|
||||
let (pin, salt) =
|
||||
get_input(&secret, &authenticator, args.interactive, "Password", false)?;
|
||||
let credentials = if let Some(path) = device {
|
||||
let mut dev = LuksDevice::load(path)?;
|
||||
let luks2 = dev.is_luks2()?;
|
||||
log(&|| format!("luks2 supported: {}", luks2));
|
||||
extend_creds_device(
|
||||
credentials
|
||||
.ids
|
||||
.clone()
|
||||
.map(|cs| cs.0)
|
||||
.unwrap_or_default()
|
||||
.as_slice(),
|
||||
&mut dev,
|
||||
)?
|
||||
let pin_string;
|
||||
let pin = if authenticator.pin {
|
||||
pin_string = read_pin(authenticator)?;
|
||||
Some(pin_string.as_ref())
|
||||
} else {
|
||||
credentials.ids.clone().map(|cs| cs.0).unwrap_or_default()
|
||||
None
|
||||
};
|
||||
log(&|| {
|
||||
format!(
|
||||
"credentials: {}",
|
||||
credentials
|
||||
.iter()
|
||||
.map(ToString::to_string)
|
||||
.collect::<Vec<_>>()
|
||||
.join(", ")
|
||||
)
|
||||
});
|
||||
let salt = if interactive || secret.password_helper == PasswordHelper::Stdin {
|
||||
util::read_password_hashed("Password", false)
|
||||
} else {
|
||||
secret.salt.obtain_sha256(&secret.password_helper)
|
||||
}?;
|
||||
prompt_interaction(interactive);
|
||||
let (secret, cred) = derive_secret(
|
||||
&credentials,
|
||||
let (secret, _cred) = derive_secret(
|
||||
credentials.ids.0.as_slice(),
|
||||
&salt,
|
||||
authenticator.await_time,
|
||||
pin.as_deref(),
|
||||
pin,
|
||||
)?;
|
||||
log(&|| format!("credential used: {}", hex::encode(&cred.id)));
|
||||
if *binary {
|
||||
stdout.write_all(&secret[..])?;
|
||||
} else {
|
||||
@ -243,6 +136,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
secret,
|
||||
luks_mod,
|
||||
existing_secret: other_secret,
|
||||
token,
|
||||
..
|
||||
}
|
||||
| Command::ReplaceKey {
|
||||
@ -252,47 +146,24 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
secret,
|
||||
luks_mod,
|
||||
replacement: other_secret,
|
||||
token,
|
||||
..
|
||||
} => {
|
||||
let mut luks_dev = LuksDevice::load(&luks.device)?;
|
||||
|
||||
let luks2 = luks_dev.is_luks2()?;
|
||||
|
||||
log(&|| format!("luks2 supported: {}", luks2));
|
||||
|
||||
let credentials = if !luks.disable_token && luks2 {
|
||||
extend_creds_device(
|
||||
credentials
|
||||
.ids
|
||||
.clone()
|
||||
.map(|cs| cs.0)
|
||||
.unwrap_or_default()
|
||||
.as_slice(),
|
||||
&mut luks_dev,
|
||||
)?
|
||||
let pin = if authenticator.pin {
|
||||
Some(read_pin(authenticator)?)
|
||||
} else {
|
||||
credentials.ids.clone().map(|cs| cs.0).unwrap_or_default()
|
||||
None
|
||||
};
|
||||
log(&|| {
|
||||
format!(
|
||||
"credentials: {}",
|
||||
credentials
|
||||
.iter()
|
||||
.map(ToString::to_string)
|
||||
.collect::<Vec<_>>()
|
||||
.join(", ")
|
||||
)
|
||||
});
|
||||
let inputs = |q: &str, verify: bool| -> Fido2LuksResult<(Option<String>, [u8; 32])> {
|
||||
get_input(&secret, &authenticator, args.interactive, q, verify)
|
||||
let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
|
||||
if interactive || secret.password_helper == PasswordHelper::Stdin {
|
||||
util::read_password_hashed(q, verify)
|
||||
} else {
|
||||
secret.salt.obtain_sha256(&secret.password_helper)
|
||||
}
|
||||
};
|
||||
|
||||
let other_secret = |salt_q: &str,
|
||||
verify: bool|
|
||||
-> Fido2LuksResult<(
|
||||
Vec<u8>,
|
||||
Option<PublicKeyCredentialDescriptor>,
|
||||
)> {
|
||||
-> Fido2LuksResult<(Vec<u8>, Option<FidoCredential>)> {
|
||||
match other_secret {
|
||||
OtherSecret {
|
||||
keyfile: Some(file),
|
||||
@ -301,87 +172,41 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
OtherSecret {
|
||||
fido_device: true, ..
|
||||
} => {
|
||||
let (pin, salt) = inputs(salt_q, verify)?;
|
||||
prompt_interaction(interactive);
|
||||
Ok(derive_secret(
|
||||
&credentials,
|
||||
&salt,
|
||||
&credentials.ids.0,
|
||||
&salt(salt_q, verify)?,
|
||||
authenticator.await_time,
|
||||
pin.as_deref(),
|
||||
)
|
||||
.map(|(secret, cred)| (secret[..].to_vec(), Some(cred)))?)
|
||||
}
|
||||
_ => Ok((
|
||||
util::read_password_tty(salt_q, verify)?.as_bytes().to_vec(),
|
||||
util::read_password(salt_q, verify)?.as_bytes().to_vec(),
|
||||
None,
|
||||
)),
|
||||
}
|
||||
};
|
||||
let secret =
|
||||
|q: &str,
|
||||
verify: bool,
|
||||
credentials: &[HexEncoded]|
|
||||
-> Fido2LuksResult<([u8; 32], PublicKeyCredentialDescriptor)> {
|
||||
let (pin, salt) = inputs(q, verify)?;
|
||||
let secret = |q: &str, verify: bool| -> Fido2LuksResult<([u8; 32], FidoCredential)> {
|
||||
prompt_interaction(interactive);
|
||||
derive_secret(credentials, &salt, authenticator.await_time, pin.as_deref())
|
||||
derive_secret(
|
||||
&credentials.ids.0,
|
||||
&salt(q, verify)?,
|
||||
authenticator.await_time,
|
||||
pin.as_deref(),
|
||||
)
|
||||
};
|
||||
let mut luks_dev = LuksDevice::load(&luks.device)?;
|
||||
// Non overlap
|
||||
match &args.command {
|
||||
Command::AddKey {
|
||||
exclusive,
|
||||
generate_credential,
|
||||
comment,
|
||||
..
|
||||
} => {
|
||||
let (existing_secret, existing_credential) =
|
||||
other_secret("Current password", false)?;
|
||||
let excluded_credential = existing_credential.as_ref();
|
||||
let exclude_list = excluded_credential
|
||||
.as_ref()
|
||||
.map(core::slice::from_ref)
|
||||
.unwrap_or_default();
|
||||
existing_credential.iter().for_each(|cred| {
|
||||
log(&|| {
|
||||
format!(
|
||||
"using credential to unlock container: {}",
|
||||
hex::encode(&cred.id)
|
||||
)
|
||||
})
|
||||
});
|
||||
let (new_secret, cred) = if *generate_credential && luks2 {
|
||||
let cred = make_credential_id(
|
||||
Some(derive_credential_name(luks.device.as_path()).as_str()),
|
||||
(if authenticator.pin && may_require_pin()? {
|
||||
//TODO: not ideal since it ignores pin-prefixed
|
||||
Some(read_pin()?)
|
||||
} else {
|
||||
None
|
||||
})
|
||||
.as_deref(),
|
||||
dbg!(exclude_list),
|
||||
)?;
|
||||
log(&|| {
|
||||
format!(
|
||||
"generated credential: {}\ncredential username: {:?}",
|
||||
hex::encode(&cred.id),
|
||||
derive_credential_name(luks.device.as_path())
|
||||
)
|
||||
});
|
||||
let creds = vec![HexEncoded(cred.id)];
|
||||
secret("Password to be added", true, &creds)
|
||||
} else {
|
||||
secret("Password to be added", true, &credentials)
|
||||
}?;
|
||||
log(&|| format!("credential used: {}", hex::encode(&cred.id)));
|
||||
Command::AddKey { exclusive, .. } => {
|
||||
let (existing_secret, _) = other_secret("Current password", false)?;
|
||||
let (new_secret, cred) = secret("Password to be added", true)?;
|
||||
let added_slot = luks_dev.add_key(
|
||||
&new_secret,
|
||||
&existing_secret[..],
|
||||
luks_mod.kdf_time.or(Some(10)),
|
||||
Some(&cred.id[..])
|
||||
.filter(|_| !luks.disable_token || *generate_credential)
|
||||
.filter(|_| luks2),
|
||||
comment.as_deref().map(String::from),
|
||||
Some(&cred.id[..]).filter(|_| *token),
|
||||
)?;
|
||||
if *exclusive {
|
||||
let destroyed = luks_dev.remove_keyslots(&[added_slot])?;
|
||||
@ -400,43 +225,24 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
Command::ReplaceKey {
|
||||
add_password,
|
||||
remove_cred,
|
||||
..
|
||||
} => {
|
||||
let (existing_secret, _prev_cred) =
|
||||
secret("Current password", false, &credentials)?;
|
||||
Command::ReplaceKey { add_password, .. } => {
|
||||
let (existing_secret, _) = secret("Current password", false)?;
|
||||
let (replacement_secret, cred) = other_secret("Replacement password", true)?;
|
||||
let slot = if *add_password {
|
||||
luks_dev.add_key(
|
||||
&replacement_secret[..],
|
||||
&existing_secret,
|
||||
luks_mod.kdf_time,
|
||||
cred.as_ref()
|
||||
.filter(|_| !luks.disable_token)
|
||||
.filter(|_| luks2)
|
||||
.map(|cred| &cred.id[..]),
|
||||
None,
|
||||
cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
|
||||
)
|
||||
} else {
|
||||
let slot = luks_dev.replace_key(
|
||||
luks_dev.replace_key(
|
||||
&replacement_secret[..],
|
||||
&existing_secret,
|
||||
luks_mod.kdf_time,
|
||||
cred.as_ref()
|
||||
.filter(|_| !luks.disable_token)
|
||||
.filter(|_| luks2)
|
||||
.map(|cred| &cred.id[..]),
|
||||
)?;
|
||||
if *remove_cred && cred.is_none() {
|
||||
luks_dev.remove_token_slot(slot)?;
|
||||
}
|
||||
Ok(slot)
|
||||
cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
|
||||
)
|
||||
}?;
|
||||
if let Some(cred) = cred {
|
||||
log(&|| format!("credential used: {}", hex::encode(&cred.id)));
|
||||
}
|
||||
println!(
|
||||
"Added to password to device {}, slot: {}",
|
||||
luks.device.display(),
|
||||
@ -452,88 +258,80 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
authenticator,
|
||||
secret,
|
||||
name,
|
||||
credentials,
|
||||
retries,
|
||||
dry_run,
|
||||
allow_discards,
|
||||
..
|
||||
}
|
||||
| Command::OpenToken {
|
||||
luks,
|
||||
authenticator,
|
||||
secret,
|
||||
name,
|
||||
retries,
|
||||
allow_discards,
|
||||
} => {
|
||||
let inputs = |q: &str, verify: bool| -> Fido2LuksResult<(Option<String>, [u8; 32])> {
|
||||
get_input(&secret, &authenticator, args.interactive, q, verify)
|
||||
let pin_string;
|
||||
let pin = if authenticator.pin {
|
||||
pin_string = read_pin(authenticator)?;
|
||||
Some(pin_string.as_ref())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
|
||||
if interactive || secret.password_helper == PasswordHelper::Stdin {
|
||||
util::read_password_hashed(q, verify)
|
||||
} else {
|
||||
secret.salt.obtain_sha256(&secret.password_helper)
|
||||
}
|
||||
};
|
||||
|
||||
// Cow shouldn't be necessary
|
||||
let secret = |credentials: Cow<'_, Vec<HexEncoded>>| {
|
||||
let (pin, salt) = inputs("Password", false)?;
|
||||
prompt_interaction(interactive);
|
||||
derive_secret(
|
||||
credentials.as_ref(),
|
||||
&salt,
|
||||
&salt("Password", false)?,
|
||||
authenticator.await_time,
|
||||
pin.as_deref(),
|
||||
pin,
|
||||
)
|
||||
};
|
||||
|
||||
let mut retries = *retries;
|
||||
let mut luks_dev = LuksDevice::load(&luks.device)?;
|
||||
let luks2 = luks_dev.is_luks2()?;
|
||||
log(&|| format!("luks2 supported: {}", luks2));
|
||||
loop {
|
||||
let slot = if let Some(ref credentials) = credentials.ids {
|
||||
log(&|| {
|
||||
format!(
|
||||
"credentials: {}",
|
||||
credentials
|
||||
.0
|
||||
.iter()
|
||||
.map(ToString::to_string)
|
||||
.collect::<Vec<_>>()
|
||||
.join(", ")
|
||||
)
|
||||
});
|
||||
secret(Cow::Borrowed(&credentials.0)).and_then(|(secret, cred)| {
|
||||
log(&|| format!("credential used: {}", hex::encode(&cred.id)));
|
||||
luks_dev.activate(&name, &secret, luks.slot, *dry_run, *allow_discards)
|
||||
})
|
||||
} else if luks2 && !luks.disable_token {
|
||||
luks_dev.activate_token(
|
||||
let secret = match &args.command {
|
||||
Command::Open { credentials, .. } => secret(Cow::Borrowed(&credentials.ids.0))
|
||||
.and_then(|(secret, _cred)| {
|
||||
luks_dev.activate(&name, &secret, luks.slot, *allow_discards)
|
||||
}),
|
||||
Command::OpenToken { .. } => luks_dev.activate_token(
|
||||
&name,
|
||||
Box::new(|credentials: Vec<String>| {
|
||||
log(&|| format!("credentials: {}", credentials.join(", ")));
|
||||
let creds = credentials
|
||||
.into_iter()
|
||||
.flat_map(|cred| HexEncoded::from_str(cred.as_ref()).ok())
|
||||
.collect::<Vec<_>>();
|
||||
secret(Cow::Owned(creds)).map(|(secret, cred)| {
|
||||
log(&|| format!("credential used: {}", hex::encode(&cred.id)));
|
||||
(secret, hex::encode(&cred.id))
|
||||
})
|
||||
secret(Cow::Owned(creds))
|
||||
.map(|(secret, cred)| (secret, hex::encode(&cred.id)))
|
||||
}),
|
||||
luks.slot,
|
||||
*dry_run,
|
||||
*allow_discards,
|
||||
)
|
||||
} else if luks_dev.is_luks2()? && luks.disable_token {
|
||||
// disable-token is mostly cosmetic in this instance
|
||||
return Err(Fido2LuksError::InsufficientCredentials);
|
||||
} else {
|
||||
return Err(Fido2LuksError::WrongSecret);
|
||||
),
|
||||
_ => unreachable!(),
|
||||
};
|
||||
match slot {
|
||||
match secret {
|
||||
Err(e) => {
|
||||
match e {
|
||||
Fido2LuksError::WrongSecret if retries > 0 => {}
|
||||
//Fido2LuksError::AuthenticatorError { ref cause }
|
||||
// if cause.kind() == FidoErrorKind::Timeout && retries > 0 => {}
|
||||
Fido2LuksError::AuthenticatorError { ref cause }
|
||||
if cause.kind() == FidoErrorKind::Timeout && retries > 0 => {}
|
||||
|
||||
e => return Err(e),
|
||||
};
|
||||
}
|
||||
retries -= 1;
|
||||
eprintln!("{}", e);
|
||||
}
|
||||
Ok(slot) => {
|
||||
log(&|| format!("keyslot: {}", slot));
|
||||
break Ok(());
|
||||
}
|
||||
res => break res.map(|_| ()),
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -565,13 +363,8 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
continue;
|
||||
}
|
||||
println!(
|
||||
"{}{}:\n\tSlots: {}\n\tCredentials: {}",
|
||||
"{}:\n\tSlots: {}\n\tCredentials: {}",
|
||||
id,
|
||||
token
|
||||
.comment
|
||||
.as_deref()
|
||||
.map(|comment| format!(" - {}", comment))
|
||||
.unwrap_or_default(),
|
||||
if token.keyslots.is_empty() {
|
||||
"None".into()
|
||||
} else {
|
||||
@ -597,7 +390,6 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
TokenCommand::Add {
|
||||
device,
|
||||
credentials,
|
||||
comment,
|
||||
slot,
|
||||
} => {
|
||||
let mut dev = LuksDevice::load(device)?;
|
||||
@ -609,11 +401,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
}
|
||||
}
|
||||
let count = if tokens.is_empty() {
|
||||
dev.add_token(&Fido2LuksToken::with_credentials(
|
||||
&credentials.0,
|
||||
*slot,
|
||||
comment.as_deref().map(String::from),
|
||||
))?;
|
||||
dev.add_token(&Fido2LuksToken::with_credentials(&credentials.ids.0, *slot))?;
|
||||
1
|
||||
} else {
|
||||
tokens.len()
|
||||
@ -621,7 +409,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
for (id, mut token) in tokens {
|
||||
token
|
||||
.credential
|
||||
.extend(credentials.0.iter().map(|h| h.to_string()));
|
||||
.extend(credentials.ids.0.iter().map(|h| h.to_string()));
|
||||
dev.update_token(id, &token)?;
|
||||
}
|
||||
println!("Updated {} tokens", count);
|
||||
@ -649,7 +437,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
token.credential = token
|
||||
.credential
|
||||
.into_iter()
|
||||
.filter(|cred| !credentials.0.iter().any(|h| &h.to_string() == cred))
|
||||
.filter(|cred| !credentials.ids.0.iter().any(|h| &h.to_string() == cred))
|
||||
.collect();
|
||||
dev.update_token(id, &token)?;
|
||||
}
|
||||
@ -679,64 +467,16 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
}
|
||||
},
|
||||
Command::GenerateCompletions { shell, out_dir } => {
|
||||
// zsh won't work atm https://github.com/clap-rs/clap/issues/1822
|
||||
if let Some(s) = shell {
|
||||
if s.as_str() == "zsh" {
|
||||
unimplemented!("zsh completions are broken atm: see https://github.com/clap-rs/clap/issues/1822")
|
||||
}
|
||||
}
|
||||
for variant in Shell::variants().iter().filter(|v| *v != &"zsh") {
|
||||
if let Some(s) = shell {
|
||||
if *variant != s.as_str() {
|
||||
break;
|
||||
}
|
||||
}
|
||||
Args::clap().gen_completions(
|
||||
env!("CARGO_PKG_NAME"),
|
||||
Shell::from_str(variant)
|
||||
.expect("structopt shouldn't allow us to reach this point"),
|
||||
match shell.as_ref() {
|
||||
"bash" => Shell::Bash,
|
||||
"fish" => Shell::Fish,
|
||||
_ => unreachable!("structopt shouldn't allow us to reach this point"),
|
||||
},
|
||||
&out_dir,
|
||||
);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod test {
|
||||
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn test_read_password_pin_prefixed() {
|
||||
// 1234:test -> PIN: 1234, password: test
|
||||
assert_eq!(
|
||||
read_password_pin_prefixed(|| Ok("1234:test".into())).unwrap(),
|
||||
(Some("1234".to_string()), util::sha256(&["test".as_bytes()]))
|
||||
);
|
||||
// :test -> PIN: None, password: test
|
||||
assert_eq!(
|
||||
read_password_pin_prefixed(|| Ok(":test".into())).unwrap(),
|
||||
(None, util::sha256(&["test".as_bytes()]))
|
||||
);
|
||||
// 1234::test -> PIN: 1234, password: :test
|
||||
assert_eq!(
|
||||
read_password_pin_prefixed(|| Ok("1234::test".into())).unwrap(),
|
||||
(
|
||||
Some("1234".to_string()),
|
||||
util::sha256(&[":test".as_bytes()])
|
||||
)
|
||||
);
|
||||
// 1234 -> PIN: 1234, password: empty
|
||||
assert_eq!(
|
||||
read_password_pin_prefixed(|| Ok("1234".into())).unwrap(),
|
||||
(Some("1234".to_string()), util::sha256(&["".as_bytes()]))
|
||||
);
|
||||
// 1234:test -> PIN: None, password: test
|
||||
assert_eq!(
|
||||
read_password_pin_prefixed(|| Ok(":test".into())).unwrap(),
|
||||
(None, util::sha256(&["test".as_bytes()]))
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@ -7,7 +7,6 @@ use std::fs::File;
|
||||
use std::io::Read;
|
||||
use std::path::PathBuf;
|
||||
use std::process::Command;
|
||||
use std::process::Stdio;
|
||||
use std::str::FromStr;
|
||||
|
||||
#[derive(Debug, Clone, PartialEq)]
|
||||
@ -56,17 +55,11 @@ impl fmt::Display for SecretInput {
|
||||
}
|
||||
|
||||
impl SecretInput {
|
||||
pub fn obtain_string(
|
||||
&self,
|
||||
password_helper: Option<impl FnOnce() -> Fido2LuksResult<String>>,
|
||||
) -> Fido2LuksResult<String> {
|
||||
pub fn obtain_string(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<String> {
|
||||
Ok(String::from_utf8(self.obtain(password_helper)?)?)
|
||||
}
|
||||
|
||||
pub fn obtain(
|
||||
&self,
|
||||
password_helper: Option<impl FnOnce() -> Fido2LuksResult<String>>,
|
||||
) -> Fido2LuksResult<Vec<u8>> {
|
||||
pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<Vec<u8>> {
|
||||
let mut secret = Vec::new();
|
||||
match self {
|
||||
SecretInput::File { path } => {
|
||||
@ -74,22 +67,16 @@ impl SecretInput {
|
||||
let mut do_io = || File::open(path)?.read_to_end(&mut secret);
|
||||
do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
|
||||
}
|
||||
SecretInput::AskPassword => secret.extend_from_slice(
|
||||
password_helper.ok_or_else(|| Fido2LuksError::AskPassError {
|
||||
cause: AskPassError::FailedHelper,
|
||||
})?()?
|
||||
.as_bytes(),
|
||||
),
|
||||
SecretInput::AskPassword => {
|
||||
secret.extend_from_slice(password_helper.obtain()?.as_bytes())
|
||||
}
|
||||
|
||||
SecretInput::String(s) => secret.extend_from_slice(s.as_bytes()),
|
||||
}
|
||||
Ok(secret)
|
||||
}
|
||||
|
||||
pub fn obtain_sha256(
|
||||
&self,
|
||||
password_helper: Option<impl FnOnce() -> Fido2LuksResult<String>>,
|
||||
) -> Fido2LuksResult<[u8; 32]> {
|
||||
pub fn obtain_sha256(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
|
||||
let mut digest = digest::Context::new(&digest::SHA256);
|
||||
match self {
|
||||
SecretInput::File { path } => {
|
||||
@ -164,13 +151,11 @@ impl PasswordHelper {
|
||||
use PasswordHelper::*;
|
||||
match self {
|
||||
Systemd => unimplemented!(),
|
||||
Stdin => Ok(util::read_password("Password", true, false)?),
|
||||
Stdin => Ok(util::read_password("Password", true)?),
|
||||
Script(password_helper) => {
|
||||
let password = Command::new("sh")
|
||||
.arg("-c")
|
||||
.arg(&password_helper)
|
||||
.stdin(Stdio::inherit())
|
||||
.stderr(Stdio::inherit())
|
||||
.output()
|
||||
.map_err(|e| Fido2LuksError::AskPassError {
|
||||
cause: error::AskPassError::IO(e),
|
||||
@ -213,7 +198,7 @@ mod test {
|
||||
fn input_salt_obtain() {
|
||||
assert_eq!(
|
||||
SecretInput::String("abc".into())
|
||||
.obtain_sha256(Some(|| Ok("123456".to_string())))
|
||||
.obtain_sha256(&PasswordHelper::Stdin)
|
||||
.unwrap(),
|
||||
[
|
||||
186, 120, 22, 191, 143, 1, 207, 234, 65, 65, 64, 222, 93, 174, 34, 35, 176, 3, 97,
|
||||
|
||||
@ -1,8 +1,7 @@
|
||||
use std::fmt::{Display, Error, Formatter};
|
||||
use std::hash::{Hash, Hasher};
|
||||
use std::path::PathBuf;
|
||||
use std::str::FromStr;
|
||||
use structopt::clap::{AppSettings, Shell};
|
||||
use structopt::clap::AppSettings;
|
||||
use structopt::StructOpt;
|
||||
|
||||
mod config;
|
||||
@ -32,12 +31,6 @@ impl FromStr for HexEncoded {
|
||||
}
|
||||
}
|
||||
|
||||
impl Hash for HexEncoded {
|
||||
fn hash<H: Hasher>(&self, state: &mut H) {
|
||||
self.0.hash(state)
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Eq, PartialEq, Clone)]
|
||||
pub struct CommaSeparated<T: FromStr + Display>(pub Vec<T>);
|
||||
|
||||
@ -65,24 +58,19 @@ impl<T: Display + FromStr> FromStr for CommaSeparated<T> {
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct Credentials {
|
||||
/// FIDO credential ids, separated by ',' generate using fido2luks credential
|
||||
#[structopt(
|
||||
name = "credential-ids",
|
||||
env = "FIDO2LUKS_CREDENTIAL_ID",
|
||||
short = "c",
|
||||
long = "creds"
|
||||
)]
|
||||
pub ids: Option<CommaSeparated<HexEncoded>>,
|
||||
#[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
|
||||
pub ids: CommaSeparated<HexEncoded>,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct AuthenticatorParameters {
|
||||
/// Request a PIN to unlock the authenticator if required
|
||||
/// Request a PIN to unlock the authenticator
|
||||
#[structopt(short = "P", long = "pin")]
|
||||
pub pin: bool,
|
||||
|
||||
/// Request PIN and password combined `pin:password` when using an password helper
|
||||
#[structopt(long = "pin-prefixed")]
|
||||
pub pin_prefixed: bool,
|
||||
/// Location to read PIN from
|
||||
#[structopt(long = "pin-source", env = "FIDO2LUKS_PIN_SOURCE")]
|
||||
pub pin_source: Option<PathBuf>,
|
||||
|
||||
/// Await for an authenticator to be connected, timeout after n seconds
|
||||
#[structopt(
|
||||
@ -102,20 +90,13 @@ pub struct LuksParameters {
|
||||
/// Try to unlock the device using a specifc keyslot, ignore all other slots
|
||||
#[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
|
||||
pub slot: Option<u32>,
|
||||
|
||||
/// Disable implicit use of LUKS2 tokens
|
||||
#[structopt(
|
||||
long = "disable-token",
|
||||
// env = "FIDO2LUKS_DISABLE_TOKEN" // unfortunately clap will convert flags into args if they have an env attribute
|
||||
)]
|
||||
pub disable_token: bool,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt, Clone)]
|
||||
pub struct LuksModParameters {
|
||||
/// Number of milliseconds required to derive the volume decryption key
|
||||
/// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
|
||||
#[structopt(long = "kdf-time", name = "kdf-time", env = "FIDO2LUKS_KDF_TIME")]
|
||||
#[structopt(long = "kdf-time", name = "kdf-time")]
|
||||
pub kdf_time: Option<u64>,
|
||||
}
|
||||
|
||||
@ -138,17 +119,15 @@ pub struct SecretParameters {
|
||||
#[structopt(
|
||||
name = "password-helper",
|
||||
env = "FIDO2LUKS_PASSWORD_HELPER",
|
||||
long = "password-helper"
|
||||
default_value = "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
|
||||
)]
|
||||
pub password_helper: Option<PasswordHelper>,
|
||||
pub password_helper: PasswordHelper,
|
||||
}
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct Args {
|
||||
/// Request passwords via Stdin instead of using the password helper
|
||||
#[structopt(short = "i", long = "interactive")]
|
||||
pub interactive: bool,
|
||||
#[structopt(short = "v", long = "verbose")]
|
||||
pub verbose: bool,
|
||||
#[structopt(subcommand)]
|
||||
pub command: Command,
|
||||
}
|
||||
@ -159,7 +138,7 @@ pub struct OtherSecret {
|
||||
#[structopt(short = "d", long = "keyfile", conflicts_with = "fido_device")]
|
||||
pub keyfile: Option<PathBuf>,
|
||||
/// Use another fido device instead of a password
|
||||
/// Note: this requires for the credential for the other device to be passed as argument as well
|
||||
/// Note: this requires for the credential fot the other device to be passed as argument as well
|
||||
#[structopt(short = "f", long = "fido-device", conflicts_with = "keyfile")]
|
||||
pub fido_device: bool,
|
||||
}
|
||||
@ -168,9 +147,8 @@ pub struct OtherSecret {
|
||||
pub enum Command {
|
||||
#[structopt(name = "print-secret")]
|
||||
PrintSecret {
|
||||
// version 0.3.0 will store use the lower case ascii encoded hex string making binary output unnecessary
|
||||
/// Prints the secret as binary instead of hex encoded
|
||||
#[structopt(hidden = true, short = "b", long = "bin")]
|
||||
#[structopt(short = "b", long = "bin")]
|
||||
binary: bool,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
@ -178,9 +156,6 @@ pub enum Command {
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
secret: SecretParameters,
|
||||
/// Load credentials from LUKS header
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: Option<PathBuf>,
|
||||
},
|
||||
/// Adds a generated key to the specified LUKS device
|
||||
#[structopt(name = "add-key")]
|
||||
@ -189,9 +164,6 @@ pub enum Command {
|
||||
luks: LuksParameters,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
/// Comment to be associated with this credential
|
||||
#[structopt(long = "comment")]
|
||||
comment: Option<String>,
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
@ -199,9 +171,9 @@ pub enum Command {
|
||||
/// Will wipe all other keys
|
||||
#[structopt(short = "e", long = "exclusive")]
|
||||
exclusive: bool,
|
||||
/// Will generate an credential while adding a new key to this LUKS device if supported
|
||||
#[structopt(short = "g", long = "gen-cred")]
|
||||
generate_credential: bool,
|
||||
/// Will add an token to your LUKS 2 header, including the credential id
|
||||
#[structopt(short = "t", long = "token")]
|
||||
token: bool,
|
||||
#[structopt(flatten)]
|
||||
existing_secret: OtherSecret,
|
||||
#[structopt(flatten)]
|
||||
@ -221,16 +193,16 @@ pub enum Command {
|
||||
/// Add the password and keep the key
|
||||
#[structopt(short = "a", long = "add-password")]
|
||||
add_password: bool,
|
||||
/// Remove the affected credential from LUKS header
|
||||
#[structopt(short = "r", long = "remove-cred")]
|
||||
remove_cred: bool,
|
||||
/// Will add an token to your LUKS 2 header, including the credential id
|
||||
#[structopt(short = "t", long = "token")]
|
||||
token: bool,
|
||||
#[structopt(flatten)]
|
||||
replacement: OtherSecret,
|
||||
#[structopt(flatten)]
|
||||
luks_mod: LuksModParameters,
|
||||
},
|
||||
/// Open the LUKS device
|
||||
#[structopt(name = "open", alias = "open-token")]
|
||||
#[structopt(name = "open")]
|
||||
Open {
|
||||
#[structopt(flatten)]
|
||||
luks: LuksParameters,
|
||||
@ -244,9 +216,23 @@ pub enum Command {
|
||||
secret: SecretParameters,
|
||||
#[structopt(short = "r", long = "max-retries", default_value = "0")]
|
||||
retries: i32,
|
||||
/// Perform the whole procedure without mounting the LUKS volume on success
|
||||
#[structopt(long = "dry-run")]
|
||||
dry_run: bool,
|
||||
/// Pass SSD trim instructions to the underlying block device
|
||||
#[structopt(long = "allow-discards")]
|
||||
allow_discards: bool,
|
||||
},
|
||||
/// Open the LUKS device using credentials embedded in the LUKS 2 header
|
||||
#[structopt(name = "open-token")]
|
||||
OpenToken {
|
||||
#[structopt(flatten)]
|
||||
luks: LuksParameters,
|
||||
#[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
|
||||
name: String,
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
secret: SecretParameters,
|
||||
#[structopt(short = "r", long = "max-retries", default_value = "0")]
|
||||
retries: i32,
|
||||
/// Pass SSD trim instructions to the underlying block device
|
||||
#[structopt(long = "allow-discards")]
|
||||
allow_discards: bool,
|
||||
@ -257,7 +243,7 @@ pub enum Command {
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
/// Name to be displayed on the authenticator display
|
||||
#[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME", default_value = "")]
|
||||
#[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME", default_value = "fido2luks")]
|
||||
name: String,
|
||||
},
|
||||
/// Check if an authenticator is connected
|
||||
@ -265,12 +251,11 @@ pub enum Command {
|
||||
Connected,
|
||||
Token(TokenCommand),
|
||||
/// Generate bash completion scripts
|
||||
/// Example: fido2luks completions --shell bash /usr/share/bash-completion/completions
|
||||
#[structopt(name = "completions", setting = AppSettings::Hidden)]
|
||||
GenerateCompletions {
|
||||
/// Shell to generate completions for
|
||||
#[structopt(short = "s", long = "shell",possible_values = &Shell::variants()[..])]
|
||||
shell: Option<String>,
|
||||
/// Shell to generate completions for: bash, fish
|
||||
#[structopt(possible_values = &["bash", "fish"])]
|
||||
shell: String,
|
||||
out_dir: PathBuf,
|
||||
},
|
||||
}
|
||||
@ -290,17 +275,8 @@ pub enum TokenCommand {
|
||||
Add {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
/// FIDO credential ids, separated by ',' generate using fido2luks credential
|
||||
#[structopt(
|
||||
name = "credential-ids",
|
||||
env = "FIDO2LUKS_CREDENTIAL_ID",
|
||||
short = "c",
|
||||
long = "creds"
|
||||
)]
|
||||
credentials: CommaSeparated<HexEncoded>,
|
||||
/// Comment to be associated with this credential
|
||||
#[structopt(long = "comment")]
|
||||
comment: Option<String>,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
/// Slot to which the credentials will be added
|
||||
#[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
|
||||
slot: u32,
|
||||
@ -309,14 +285,8 @@ pub enum TokenCommand {
|
||||
Remove {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
/// FIDO credential ids, separated by ',' generate using fido2luks credential
|
||||
#[structopt(
|
||||
name = "credential-ids",
|
||||
env = "FIDO2LUKS_CREDENTIAL_ID",
|
||||
short = "c",
|
||||
long = "creds"
|
||||
)]
|
||||
credentials: CommaSeparated<HexEncoded>,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
/// Token from which the credentials will be removed
|
||||
#[structopt(long = "token")]
|
||||
token_id: Option<u32>,
|
||||
|
||||
156
src/device.rs
156
src/device.rs
@ -1,133 +1,73 @@
|
||||
use crate::error::*;
|
||||
|
||||
use crate::util;
|
||||
use ctap_hid_fido2;
|
||||
use ctap_hid_fido2::fidokey::get_assertion::get_assertion_params;
|
||||
use ctap_hid_fido2::fidokey::make_credential::make_credential_params;
|
||||
use ctap_hid_fido2::fidokey::GetAssertionArgsBuilder;
|
||||
use ctap_hid_fido2::fidokey::MakeCredentialArgsBuilder;
|
||||
use ctap_hid_fido2::get_fidokey_devices;
|
||||
use ctap_hid_fido2::public_key_credential_descriptor::PublicKeyCredentialDescriptor;
|
||||
use ctap_hid_fido2::public_key_credential_user_entity::PublicKeyCredentialUserEntity;
|
||||
use ctap_hid_fido2::FidoKeyHidFactory;
|
||||
use ctap_hid_fido2::HidInfo;
|
||||
use ctap_hid_fido2::LibCfg;
|
||||
use ctap::{
|
||||
self, extensions::hmac::HmacExtension, request_multiple_devices, FidoAssertionRequestBuilder,
|
||||
FidoCredential, FidoCredentialRequestBuilder, FidoDevice, FidoError, FidoErrorKind,
|
||||
};
|
||||
use std::time::Duration;
|
||||
|
||||
const RP_ID: &str = "fido2luks";
|
||||
|
||||
fn lib_cfg() -> LibCfg {
|
||||
let mut cfg = LibCfg::init();
|
||||
cfg.enable_log = false;
|
||||
cfg.keep_alive_msg = String::new();
|
||||
cfg
|
||||
}
|
||||
|
||||
pub fn make_credential_id(
|
||||
name: Option<&str>,
|
||||
pin: Option<&str>,
|
||||
exclude: &[&PublicKeyCredentialDescriptor],
|
||||
) -> Fido2LuksResult<PublicKeyCredentialDescriptor> {
|
||||
let mut req = MakeCredentialArgsBuilder::new(RP_ID, &[])
|
||||
.extensions(&[make_credential_params::Extension::HmacSecret(Some(true))]);
|
||||
) -> Fido2LuksResult<FidoCredential> {
|
||||
let mut request = FidoCredentialRequestBuilder::default().rp_id(RP_ID);
|
||||
if let Some(user_name) = name {
|
||||
request = request.user_name(user_name);
|
||||
}
|
||||
let request = request.build().unwrap();
|
||||
let make_credential = |device: &mut FidoDevice| {
|
||||
if let Some(pin) = pin {
|
||||
req = req.pin(pin);
|
||||
} else {
|
||||
req = req.without_pin_and_uv();
|
||||
device.unlock(pin)?;
|
||||
}
|
||||
for cred in exclude {
|
||||
req = req.exclude_authenticator(cred.id.as_ref());
|
||||
}
|
||||
if let Some(_) = name {
|
||||
req = req.user_entity(&PublicKeyCredentialUserEntity::new(
|
||||
Some(b"00"),
|
||||
name.clone(),
|
||||
name,
|
||||
));
|
||||
}
|
||||
let devices = get_devices()?;
|
||||
let mut err: Option<Fido2LuksError> = None;
|
||||
let req = req.build();
|
||||
for dev in devices {
|
||||
let handle = FidoKeyHidFactory::create_by_params(&vec![dev.param], &lib_cfg()).unwrap();
|
||||
match handle.make_credential_with_args(&req) {
|
||||
Ok(resp) => return Ok(resp.credential_descriptor),
|
||||
Err(e) => err = Some(e.into()),
|
||||
}
|
||||
}
|
||||
Err(err.unwrap_or(Fido2LuksError::NoAuthenticatorError))
|
||||
device.make_hmac_credential(&request)
|
||||
};
|
||||
Ok(request_multiple_devices(
|
||||
get_devices()?
|
||||
.iter_mut()
|
||||
.map(|device| (device, &make_credential)),
|
||||
None,
|
||||
)?)
|
||||
}
|
||||
|
||||
pub fn perform_challenge<'a>(
|
||||
credentials: &'a [&'a PublicKeyCredentialDescriptor],
|
||||
credentials: &'a [&'a FidoCredential],
|
||||
salt: &[u8; 32],
|
||||
_timeout: Duration,
|
||||
timeout: Duration,
|
||||
pin: Option<&str>,
|
||||
) -> Fido2LuksResult<([u8; 32], &'a PublicKeyCredentialDescriptor)> {
|
||||
if credentials.is_empty() {
|
||||
return Err(Fido2LuksError::InsufficientCredentials);
|
||||
}
|
||||
let mut req = GetAssertionArgsBuilder::new(RP_ID, &[]).extensions(&[
|
||||
get_assertion_params::Extension::HmacSecret(Some(util::sha256(&[&salt[..]]))),
|
||||
]);
|
||||
for cred in credentials {
|
||||
req = req.add_credential_id(&cred.id);
|
||||
}
|
||||
if let Some(pin) = pin {
|
||||
req = req.pin(pin);
|
||||
} else {
|
||||
req = req.without_pin_and_uv();
|
||||
}
|
||||
let process_response = |resp: Vec<get_assertion_params::Assertion>| -> Fido2LuksResult<([u8; 32], &'a PublicKeyCredentialDescriptor)> {
|
||||
for att in resp {
|
||||
for ext in att.extensions.iter() {
|
||||
match ext {
|
||||
get_assertion_params::Extension::HmacSecret(Some(secret)) => {
|
||||
//TODO: eliminate unwrap
|
||||
let cred_used = credentials
|
||||
.iter()
|
||||
.copied()
|
||||
.find(|cred| {
|
||||
att.credential_id == cred.id
|
||||
})
|
||||
) -> Fido2LuksResult<([u8; 32], &'a FidoCredential)> {
|
||||
let request = FidoAssertionRequestBuilder::default()
|
||||
.rp_id(RP_ID)
|
||||
.credentials(credentials)
|
||||
.build()
|
||||
.unwrap();
|
||||
return Ok((secret.clone(), cred_used));
|
||||
let get_assertion = |device: &mut FidoDevice| {
|
||||
if let Some(pin) = pin {
|
||||
device.unlock(pin)?;
|
||||
}
|
||||
_ => continue,
|
||||
}
|
||||
}
|
||||
}
|
||||
Err(Fido2LuksError::WrongSecret)
|
||||
device.get_hmac_assertion(&request, &util::sha256(&[&salt[..]]), None)
|
||||
};
|
||||
|
||||
let devices = get_devices()?;
|
||||
let mut err: Option<Fido2LuksError> = None;
|
||||
let req = req.build();
|
||||
for dev in devices {
|
||||
let handle = FidoKeyHidFactory::create_by_params(&vec![dev.param], &lib_cfg()).unwrap();
|
||||
match handle.get_assertion_with_args(&req) {
|
||||
Ok(resp) => return process_response(resp),
|
||||
Err(e) => err = Some(e.into()),
|
||||
}
|
||||
}
|
||||
Err(err.unwrap_or(Fido2LuksError::NoAuthenticatorError))
|
||||
let (credential, (secret, _)) = request_multiple_devices(
|
||||
get_devices()?
|
||||
.iter_mut()
|
||||
.map(|device| (device, &get_assertion)),
|
||||
Some(timeout),
|
||||
)?;
|
||||
Ok((secret, credential))
|
||||
}
|
||||
|
||||
pub fn may_require_pin() -> Fido2LuksResult<bool> {
|
||||
for dev in get_devices()? {
|
||||
let handle = FidoKeyHidFactory::create_by_params(&vec![dev.param], &lib_cfg()).unwrap();
|
||||
let info = handle.get_info()?;
|
||||
let needs_pin = info
|
||||
.options
|
||||
.iter()
|
||||
.any(|(name, val)| &name[..] == "clientPin" && *val);
|
||||
if needs_pin {
|
||||
return Ok(true);
|
||||
pub fn get_devices() -> Fido2LuksResult<Vec<FidoDevice>> {
|
||||
let mut devices = Vec::with_capacity(2);
|
||||
for di in ctap::get_devices()? {
|
||||
match FidoDevice::new(&di) {
|
||||
Err(e) => match e.kind() {
|
||||
FidoErrorKind::ParseCtap | FidoErrorKind::DeviceUnsupported => (),
|
||||
err => return Err(FidoError::from(err).into()),
|
||||
},
|
||||
Ok(dev) => devices.push(dev),
|
||||
}
|
||||
}
|
||||
Ok(false)
|
||||
}
|
||||
|
||||
pub fn get_devices() -> Fido2LuksResult<Vec<HidInfo>> {
|
||||
Ok(get_fidokey_devices())
|
||||
Ok(devices)
|
||||
}
|
||||
|
||||
22
src/error.rs
22
src/error.rs
@ -1,4 +1,4 @@
|
||||
use anyhow;
|
||||
use ctap::FidoError;
|
||||
use libcryptsetup_rs::LibcryptErr;
|
||||
use std::io;
|
||||
use std::io::ErrorKind;
|
||||
@ -14,7 +14,7 @@ pub enum Fido2LuksError {
|
||||
#[fail(display = "unable to read keyfile: {}", cause)]
|
||||
KeyfileError { cause: io::Error },
|
||||
#[fail(display = "authenticator error: {}", cause)]
|
||||
AuthenticatorError { cause: anyhow::Error },
|
||||
AuthenticatorError { cause: ctap::FidoError },
|
||||
#[fail(display = "no authenticator found, please ensure your device is plugged in")]
|
||||
NoAuthenticatorError,
|
||||
#[fail(display = " {}", cause)]
|
||||
@ -29,16 +29,6 @@ pub enum Fido2LuksError {
|
||||
WrongSecret,
|
||||
#[fail(display = "not an utf8 string")]
|
||||
StringEncodingError { cause: FromUtf8Error },
|
||||
#[fail(display = "not an hex string: {}", string)]
|
||||
HexEncodingError { string: String },
|
||||
#[fail(display = "couldn't obtain at least one credential")]
|
||||
InsufficientCredentials,
|
||||
}
|
||||
|
||||
impl From<anyhow::Error> for Fido2LuksError {
|
||||
fn from(cause: anyhow::Error) -> Self {
|
||||
Fido2LuksError::AuthenticatorError { cause }
|
||||
}
|
||||
}
|
||||
|
||||
impl Fido2LuksError {
|
||||
@ -60,8 +50,6 @@ pub enum AskPassError {
|
||||
IO(io::Error),
|
||||
#[fail(display = "provided passwords don't match")]
|
||||
Mismatch,
|
||||
#[fail(display = "failed to call password helper")]
|
||||
FailedHelper,
|
||||
}
|
||||
|
||||
#[derive(Debug, Fail)]
|
||||
@ -97,6 +85,12 @@ impl From<LuksError> for Fido2LuksError {
|
||||
}
|
||||
}
|
||||
|
||||
impl From<FidoError> for Fido2LuksError {
|
||||
fn from(e: FidoError) -> Self {
|
||||
AuthenticatorError { cause: e }
|
||||
}
|
||||
}
|
||||
|
||||
impl From<LibcryptErr> for Fido2LuksError {
|
||||
fn from(e: LibcryptErr) -> Self {
|
||||
match e {
|
||||
|
||||
51
src/luks.rs
51
src/luks.rs
@ -111,20 +111,6 @@ impl LuksDevice {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn remove_token_slot(&mut self, slot: u32) -> Fido2LuksResult<()> {
|
||||
let mut remove = HashSet::new();
|
||||
for token in self.tokens()? {
|
||||
let (id, token) = token?;
|
||||
if token.keyslots.contains(&slot.to_string()) {
|
||||
remove.insert(id);
|
||||
}
|
||||
}
|
||||
for rm in remove {
|
||||
self.remove_token(rm)?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn update_token(&mut self, token: u32, data: &Fido2LuksToken) -> Fido2LuksResult<()> {
|
||||
self.require_luks2()?;
|
||||
self.device
|
||||
@ -142,7 +128,6 @@ impl LuksDevice {
|
||||
old_secret: &[u8],
|
||||
iteration_time: Option<u64>,
|
||||
credential_id: Option<&[u8]>,
|
||||
comment: Option<String>,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
if let Some(millis) = iteration_time {
|
||||
self.device.settings_handle().set_iteration_time(millis)
|
||||
@ -153,7 +138,7 @@ impl LuksDevice {
|
||||
.add_by_passphrase(None, old_secret, secret)?;
|
||||
if let Some(id) = credential_id {
|
||||
self.device.token_handle().json_set(TokenInput::AddToken(
|
||||
&serde_json::to_value(&Fido2LuksToken::new(id, slot, comment)).unwrap(),
|
||||
&serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
|
||||
))?;
|
||||
}
|
||||
|
||||
@ -207,9 +192,7 @@ impl LuksDevice {
|
||||
old_secret,
|
||||
CryptActivateFlags::empty(),
|
||||
)?;
|
||||
|
||||
// slot should stay the same but better be safe than sorry
|
||||
let slot = self.device.keyslot_handle().change_by_passphrase(
|
||||
self.device.keyslot_handle().change_by_passphrase(
|
||||
Some(slot),
|
||||
Some(slot),
|
||||
old_secret,
|
||||
@ -217,18 +200,9 @@ impl LuksDevice {
|
||||
)? as u32;
|
||||
if let Some(id) = credential_id {
|
||||
if self.is_luks2()? {
|
||||
let (token_id, token_data) = match self.find_token(slot)? {
|
||||
Some((id, data)) => (Some(id), Some(data)),
|
||||
_ => (None, None),
|
||||
};
|
||||
let json = serde_json::to_value(&Fido2LuksToken::new(
|
||||
id,
|
||||
slot,
|
||||
// retain comment on replace
|
||||
token_data.map(|data| data.comment).flatten(),
|
||||
))
|
||||
.unwrap();
|
||||
if let Some(token) = token_id {
|
||||
let token = self.find_token(slot)?.map(|(t, _)| t);
|
||||
let json = serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap();
|
||||
if let Some(token) = token {
|
||||
self.device
|
||||
.token_handle()
|
||||
.json_set(TokenInput::ReplaceToken(token, &json))?;
|
||||
@ -247,7 +221,6 @@ impl LuksDevice {
|
||||
name: &str,
|
||||
secret: &[u8],
|
||||
slot_hint: Option<u32>,
|
||||
dry_run: bool,
|
||||
allow_discard: bool,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
let mut flags = CryptActivateFlags::empty();
|
||||
@ -256,7 +229,7 @@ impl LuksDevice {
|
||||
}
|
||||
self.device
|
||||
.activate_handle()
|
||||
.activate_by_passphrase(Some(name).filter(|_| !dry_run), slot_hint, secret, flags)
|
||||
.activate_by_passphrase(Some(name), slot_hint, secret, flags)
|
||||
.map_err(LuksError::activate)
|
||||
}
|
||||
|
||||
@ -265,7 +238,6 @@ impl LuksDevice {
|
||||
name: &str,
|
||||
secret: impl Fn(Vec<String>) -> Fido2LuksResult<([u8; 32], String)>,
|
||||
slot_hint: Option<u32>,
|
||||
dry_run: bool,
|
||||
allow_discard: bool,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
if !self.is_luks2()? {
|
||||
@ -310,7 +282,7 @@ impl LuksDevice {
|
||||
.chain(std::iter::once(None).take(slots.is_empty() as usize)), // Try all slots as last resort
|
||||
);
|
||||
for slot in slots {
|
||||
match self.activate(name, &secret, slot, dry_run, allow_discard) {
|
||||
match self.activate(name, &secret, slot, allow_discard) {
|
||||
Err(Fido2LuksError::WrongSecret) => (),
|
||||
res => return res,
|
||||
}
|
||||
@ -325,19 +297,16 @@ pub struct Fido2LuksToken {
|
||||
pub type_: String,
|
||||
pub credential: HashSet<String>,
|
||||
pub keyslots: HashSet<String>,
|
||||
#[serde(skip_serializing_if = "Option::is_none")]
|
||||
pub comment: Option<String>,
|
||||
}
|
||||
|
||||
impl Fido2LuksToken {
|
||||
pub fn new(credential_id: impl AsRef<[u8]>, slot: u32, comment: Option<String>) -> Self {
|
||||
Self::with_credentials(std::iter::once(credential_id), slot, comment)
|
||||
pub fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self {
|
||||
Self::with_credentials(std::iter::once(credential_id), slot)
|
||||
}
|
||||
|
||||
pub fn with_credentials<I: IntoIterator<Item = B>, B: AsRef<[u8]>>(
|
||||
credentials: I,
|
||||
slot: u32,
|
||||
comment: Option<String>,
|
||||
) -> Self {
|
||||
Self {
|
||||
credential: credentials
|
||||
@ -345,7 +314,6 @@ impl Fido2LuksToken {
|
||||
.map(|cred| hex::encode(cred.as_ref()))
|
||||
.collect(),
|
||||
keyslots: vec![slot.to_string()].into_iter().collect(),
|
||||
comment,
|
||||
..Default::default()
|
||||
}
|
||||
}
|
||||
@ -360,7 +328,6 @@ impl Default for Fido2LuksToken {
|
||||
type_: Self::default_type().into(),
|
||||
credential: HashSet::new(),
|
||||
keyslots: HashSet::new(),
|
||||
comment: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
#[macro_use]
|
||||
extern crate failure;
|
||||
extern crate ctap_hmac as ctap;
|
||||
#[macro_use]
|
||||
extern crate serde_derive;
|
||||
use crate::cli::*;
|
||||
|
||||
18
src/util.rs
18
src/util.rs
@ -13,17 +13,9 @@ pub fn sha256(messages: &[&[u8]]) -> [u8; 32] {
|
||||
secret.as_mut().copy_from_slice(digest.finish().as_ref());
|
||||
secret
|
||||
}
|
||||
pub fn read_password_tty(q: &str, verify: bool) -> Fido2LuksResult<String> {
|
||||
read_password(q, verify, true)
|
||||
}
|
||||
pub fn read_password(q: &str, verify: bool, tty: bool) -> Fido2LuksResult<String> {
|
||||
let res = if tty {
|
||||
rpassword::read_password_from_tty(Some(&[q, ": "].join("")))
|
||||
} else {
|
||||
print!("{}: ", q);
|
||||
rpassword::read_password()
|
||||
}?;
|
||||
match res {
|
||||
|
||||
pub fn read_password(q: &str, verify: bool) -> Fido2LuksResult<String> {
|
||||
match rpassword::read_password_from_tty(Some(&[q, ": "].join("")))? {
|
||||
ref pass
|
||||
if verify
|
||||
&& &rpassword::read_password_from_tty(Some(&[q, "(again): "].join(" ")))?
|
||||
@ -37,6 +29,10 @@ pub fn read_password(q: &str, verify: bool, tty: bool) -> Fido2LuksResult<String
|
||||
}
|
||||
}
|
||||
|
||||
pub fn read_password_hashed(q: &str, verify: bool) -> Fido2LuksResult<[u8; 32]> {
|
||||
read_password(q, verify).map(|pass| sha256(&[pass.as_bytes()]))
|
||||
}
|
||||
|
||||
pub fn read_keyfile<P: Into<PathBuf>>(path: P) -> Fido2LuksResult<Vec<u8>> {
|
||||
let mut file = File::open(path.into())?;
|
||||
let mut key = Vec::new();
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user