Compare commits
No commits in common. "master" and "luks2_token" have entirely different histories.
master
...
luks2_toke
37
.drone.yml
37
.drone.yml
@ -3,27 +3,32 @@ name: default
|
||||
|
||||
steps:
|
||||
- name: fmt
|
||||
image: rust:1.43.0
|
||||
image: rust:1.37.0
|
||||
commands:
|
||||
- rustup component add rustfmt
|
||||
- cargo fmt --all -- --check
|
||||
- name: test
|
||||
image: ubuntu:focal
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
image: rust:1.37.0
|
||||
commands:
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev
|
||||
- cargo test --locked
|
||||
- name: publish
|
||||
image: ubuntu:focal
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
CARGO_REGISTRY_TOKEN:
|
||||
from_secret: cargo_tkn
|
||||
- apt update && apt install -y libcryptsetup-dev libkeyutils-dev
|
||||
- cargo test
|
||||
|
||||
- name: build
|
||||
image: rust:1.37.0
|
||||
commands:
|
||||
- grep -E 'version ?= ?"${DRONE_TAG}"' -i Cargo.toml || (printf "incorrect crate/tag version" && exit 1)
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev
|
||||
- cargo package --all-features
|
||||
- cargo publish --all-features
|
||||
- apt update && apt install -y libcryptsetup-dev libkeyutils-dev
|
||||
- cargo install -f --path . --root .
|
||||
when:
|
||||
event: tag
|
||||
- name: publish
|
||||
image: plugins/github-release
|
||||
settings:
|
||||
api_key:
|
||||
from_secret: github_release
|
||||
files:
|
||||
- bin/fido2luks
|
||||
checksum:
|
||||
- md5
|
||||
- sha256
|
||||
when:
|
||||
event: tag
|
||||
|
||||
6
.gitignore
vendored
6
.gitignore
vendored
@ -2,9 +2,3 @@
|
||||
**/*.rs.bk
|
||||
.idea/
|
||||
*.iml
|
||||
fido2luks.bash
|
||||
fido2luks.elv
|
||||
fido2luks.fish
|
||||
fido2luks.zsh
|
||||
result
|
||||
result-*
|
||||
|
||||
540
Cargo.lock
generated
540
Cargo.lock
generated
File diff suppressed because it is too large
Load Diff
31
Cargo.toml
31
Cargo.toml
@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "fido2luks"
|
||||
version = "0.2.20"
|
||||
version = "0.2.8"
|
||||
authors = ["shimunn <shimun@shimun.net>"]
|
||||
edition = "2018"
|
||||
|
||||
@ -11,46 +11,23 @@ repository = "https://github.com/shimunn/fido2luks"
|
||||
readme = "README.md"
|
||||
keywords = ["luks", "fido2", "u2f"]
|
||||
categories = ["command-line-utilities"]
|
||||
license = "MPL-2.0"
|
||||
license-file = "LICENSE"
|
||||
|
||||
[dependencies]
|
||||
ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
|
||||
ctap_hmac = { version="0.4.2", features = ["request_multiple"] }
|
||||
hex = "0.3.2"
|
||||
ring = "0.13.5"
|
||||
failure = "0.1.5"
|
||||
rpassword = "4.0.1"
|
||||
structopt = "0.3.2"
|
||||
libcryptsetup-rs = "0.4.1"
|
||||
libcryptsetup-rs = "0.4.0"
|
||||
serde_json = "1.0.51"
|
||||
serde_derive = "1.0.106"
|
||||
serde = "1.0.106"
|
||||
|
||||
[build-dependencies]
|
||||
ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
|
||||
hex = "0.3.2"
|
||||
ring = "0.13.5"
|
||||
failure = "0.1.5"
|
||||
rpassword = "4.0.1"
|
||||
libcryptsetup-rs = "0.4.1"
|
||||
structopt = "0.3.2"
|
||||
|
||||
[profile.release]
|
||||
lto = true
|
||||
opt-level = 'z'
|
||||
panic = 'abort'
|
||||
incremental = false
|
||||
overflow-checks = false
|
||||
|
||||
[package.metadata.deb]
|
||||
depends = "$auto, cryptsetup"
|
||||
build-depends = "libclang-dev, libcryptsetup-dev"
|
||||
extended-description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator"
|
||||
assets = [
|
||||
["target/release/fido2luks", "usr/bin/", "755"],
|
||||
["fido2luks.bash", "usr/share/bash-completion/completions/fido2luks", "644"],
|
||||
["pam_mount/fido2luksmounthelper.sh", "usr/bin/", "755"],
|
||||
["initramfs-tools/keyscript.sh", "/lib/cryptsetup/scripts/fido2luks", "755" ],
|
||||
["initramfs-tools/hook/fido2luks.sh", "etc/initramfs-tools/hooks/", "755" ],
|
||||
["initramfs-tools/fido2luks.conf", "etc/", "644"],
|
||||
]
|
||||
conf-files = ["/etc/fido2luks.conf"]
|
||||
|
||||
37
PKGBUILD
37
PKGBUILD
@ -1,37 +0,0 @@
|
||||
# Maintainer: shimunn <shimun@shimun.net>
|
||||
|
||||
pkgname=fido2luks-git
|
||||
pkgver=0.2.16.7e6b33a
|
||||
pkgrel=1
|
||||
makedepends=('rust' 'cargo' 'cryptsetup' 'clang' 'git')
|
||||
depends=('cryptsetup')
|
||||
arch=('i686' 'x86_64' 'armv6h' 'armv7h')
|
||||
pkgdesc="Decrypt your LUKS partition using a FIDO2 compatible authenticator"
|
||||
url="https://github.com/shimunn/fido2luks"
|
||||
license=('MPL-2.0')
|
||||
source=('git+https://github.com/shimunn/fido2luks')
|
||||
sha512sums=('SKIP')
|
||||
|
||||
pkgver() {
|
||||
cd fido2luks
|
||||
|
||||
# Use tag version if possible otherwise concat project version and git ref
|
||||
git describe --exact-match --tags HEAD 2>/dev/null ||
|
||||
echo "$(cargo pkgid | cut -d'#' -f2).$(git describe --always)"
|
||||
}
|
||||
|
||||
build() {
|
||||
cd fido2luks
|
||||
cargo build --release --locked --all-features --target-dir=target
|
||||
}
|
||||
|
||||
package() {
|
||||
cd fido2luks
|
||||
|
||||
install -Dm 755 target/release/fido2luks -t "${pkgdir}/usr/bin"
|
||||
install -Dm 755 pam_mount/fido2luksmounthelper.sh -t "${pkgdir}/usr/bin"
|
||||
install -Dm 644 initcpio/hooks/fido2luks -t "${pkgdir}/usr/lib/initcpio/hooks"
|
||||
install -Dm 644 initcpio/install/fido2luks -t "${pkgdir}/usr/lib/initcpio/install"
|
||||
install -Dm 644 fido2luks.bash "${pkgdir}/usr/share/bash-completion/completions/fido2luks"
|
||||
install -Dm 644 fido2luks.fish -t "${pkgdir}/usr/share/fish/vendor_completions.d"
|
||||
}
|
||||
61
README.md
61
README.md
@ -1,8 +1,8 @@
|
||||
# fido2luks [](https://crates.io/crates/fido2luks)
|
||||
|
||||
This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key.
|
||||
This will allow you to unlock your luks encrypted disk with an fido2 compatible key
|
||||
|
||||
Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T, YubiKey(fw >= [5.2.3](https://support.yubico.com/hc/en-us/articles/360016649319-YubiKey-5-2-3-Enhancements-to-FIDO-2-Support))
|
||||
Note: This has only been tested under Fedora 31 using a Solo Key, Trezor Model T
|
||||
|
||||
## Setup
|
||||
|
||||
@ -30,8 +30,6 @@ set -a
|
||||
. /etc/fido2luks.conf
|
||||
|
||||
# Repeat for each luks volume
|
||||
# You can also use the `--token` flag when using LUKS2 which will then store the credential in the LUKS header,
|
||||
# enabling you to use `fido2luks open-token` without passing a credential as parameter
|
||||
sudo -E fido2luks -i add-key /dev/disk/by-uuid/<DISK_UUID>
|
||||
|
||||
# Test(only works if the luks container isn't active)
|
||||
@ -65,7 +63,7 @@ cp /usr/bin/fido2luks /boot/fido2luks/
|
||||
cp /etc/fido2luks.conf /boot/fido2luks/
|
||||
```
|
||||
|
||||
## Testing
|
||||
## Test
|
||||
|
||||
Just reboot and see if it works, if that's the case you should remove your old less secure password from your LUKS header:
|
||||
|
||||
@ -73,8 +71,6 @@ Just reboot and see if it works, if that's the case you should remove your old l
|
||||
# Recommend in case you lose your authenticator, store this backupfile somewhere safe
|
||||
cryptsetup luksHeaderBackup /dev/disk/by-uuid/<DISK_UUID> --header-backup-file luks_backup_<DISK_UUID>
|
||||
# There is no turning back if you mess this up, make sure you made a backup
|
||||
# You can also pass `--token` if you're using LUKS2 which will then store the credential in the LUKS header,
|
||||
# which will enable you to use `fido2luks open-token` without passing a credential as parameter
|
||||
fido2luks -i add-key --exclusive /dev/disk/by-uuid/<DISK_UUID>
|
||||
```
|
||||
|
||||
@ -96,13 +92,6 @@ set -a
|
||||
|
||||
Then add the new secret to each device and update dracut afterwards `dracut -f`
|
||||
|
||||
### Multiple keys
|
||||
|
||||
Additional/backup keys are supported, Multiple fido2luks credentials can be added to your /etc/fido2luks.conf file. Credential tokens are comma separated.
|
||||
```
|
||||
FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL1>,<CREDENTIAL2>,<CREDENTIAL3>
|
||||
```
|
||||
|
||||
## Removal
|
||||
|
||||
Remove `rd.luks.2fa` from `GRUB_CMDLINE_LINUX` in /etc/default/grub
|
||||
@ -114,47 +103,3 @@ sudo -E fido2luks -i replace-key /dev/disk/by-uuid/<DISK_UUID>
|
||||
|
||||
sudo rm -rf /usr/lib/dracut/modules.d/96luks-2fa /etc/dracut.conf.d/luks-2fa.conf /etc/fido2luks.conf
|
||||
```
|
||||
|
||||
## Theory of operation
|
||||
|
||||
fido2luks builds on two basic building blocks, LUKS as an abstraction over linux disk encryption and and the FIDO2 extension [`hmac-secret`](https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension).
|
||||
The `hmac-secret` extension allows for an secret to be dervied on the FIDO2 device from two inputs, the user supplied salt/password/keyfile and another secret contained within the FID2 device. The output of the `hmac-secret` function will then be used to decrypt the LUKS header which in turn is used to decrypt the disk.
|
||||
```
|
||||
|
||||
+-------------------------------------------------------------------------------+
|
||||
| |
|
||||
| +-----------------------------------------+ |
|
||||
| | FIDO2 device | |
|
||||
| | | |
|
||||
| | | |
|
||||
+-------+--------+ +------+ | +---------------+ | | +------------------------+
|
||||
| Salt/Password +-> |sha256+------------------------> | | | v | LUKS header |
|
||||
+----------------+ +------+ | | | | | | +---------------+
|
||||
| | | | +--------+ +------------------------+--------> |Disk master key|
|
||||
| | sha256_hmac +---------> | sha256 +-------> | Keyslot 1 | +---------------+
|
||||
+----------------+ | +----------+ | | | +--------+ +------------------------+
|
||||
| FIDO credential+---------------> |Credential| +----> | | | | Keyslot 2 |
|
||||
+----------------+ | |secret | | | | +------------------------+
|
||||
| +----------+ +---------------+ |
|
||||
| |
|
||||
| |
|
||||
+-----------------------------------------+
|
||||
|
||||
```
|
||||
Since all these components build upon each other losing or damaging just one of them will render the disk undecryptable, it's threfore of paramount importance to backup the LUKS header and ideally set an backup password
|
||||
or utilise more than one FIDO2 device. Each additional credential and password combination will require it's own LUKS keyslot since the credential secret is randomly generated for each new credential and will thus result
|
||||
in a completly different secret.
|
||||
|
||||
## License
|
||||
|
||||
Licensed under
|
||||
|
||||
* Mozilla Public License 2.0, ([LICENSE-MPL](LICENSE-MPL) or https://www.mozilla.org/en-US/MPL/2.0/)
|
||||
|
||||
### Contribution
|
||||
|
||||
Unless you explicitly state otherwise, any contribution intentionally
|
||||
submitted for inclusion in the work by you, as defined in the MPL 2.0
|
||||
license, shall be licensed as above, without any additional terms or
|
||||
conditions.
|
||||
|
||||
|
||||
24
build.rs
24
build.rs
@ -1,24 +0,0 @@
|
||||
#![allow(warnings)]
|
||||
#[macro_use]
|
||||
extern crate failure;
|
||||
extern crate ctap_hmac as ctap;
|
||||
|
||||
#[path = "src/cli_args/mod.rs"]
|
||||
mod cli_args;
|
||||
#[path = "src/error.rs"]
|
||||
mod error;
|
||||
#[path = "src/util.rs"]
|
||||
mod util;
|
||||
|
||||
use cli_args::Args;
|
||||
use std::env;
|
||||
use std::str::FromStr;
|
||||
use structopt::clap::Shell;
|
||||
use structopt::StructOpt;
|
||||
|
||||
fn main() {
|
||||
// generate completion scripts, zsh does panic for some reason
|
||||
for shell in Shell::variants().iter().filter(|shell| **shell != "zsh") {
|
||||
Args::clap().gen_completions(env!("CARGO_PKG_NAME"), Shell::from_str(shell).unwrap(), ".");
|
||||
}
|
||||
}
|
||||
62
flake.lock
generated
62
flake.lock
generated
@ -1,62 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"naersk": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1639947939,
|
||||
"narHash": "sha256-pGsM8haJadVP80GFq4xhnSpNitYNQpaXk4cnA796Cso=",
|
||||
"owner": "nmattia",
|
||||
"repo": "naersk",
|
||||
"rev": "2fc8ce9d3c025d59fee349c1f80be9785049d653",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nmattia",
|
||||
"repo": "naersk",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1638109994,
|
||||
"narHash": "sha256-OpA37PTiPMIqoRJbufbl5rOLII7HeeGcA0yl7FoyCIE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a284564b7f75ac4db73607db02076e8da9d42c9d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"id": "nixpkgs",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"naersk": "naersk",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"utils": "utils"
|
||||
}
|
||||
},
|
||||
"utils": {
|
||||
"locked": {
|
||||
"lastModified": 1638122382,
|
||||
"narHash": "sha256-sQzZzAbvKEqN9s0bzWuYmRaA03v40gaJ4+iL1LXjaeI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "74f7e4319258e287b0f9cb95426c9853b282730b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
61
flake.nix
61
flake.nix
@ -1,61 +0,0 @@
|
||||
{
|
||||
description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator";
|
||||
|
||||
inputs = {
|
||||
utils.url = "github:numtide/flake-utils";
|
||||
naersk = {
|
||||
url = "github:nmattia/naersk";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, utils, naersk }:
|
||||
let
|
||||
root = ./.;
|
||||
pname = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.name;
|
||||
forPkgs = pkgs:
|
||||
let
|
||||
naersk-lib = naersk.lib."${pkgs.system}";
|
||||
buildInputs = with pkgs; [ cryptsetup ];
|
||||
LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
|
||||
nativeBuildInputs = with pkgs; [
|
||||
pkgconfig
|
||||
clang
|
||||
];
|
||||
in
|
||||
rec {
|
||||
# `nix build`
|
||||
packages.${pname} = naersk-lib.buildPackage {
|
||||
inherit pname root buildInputs nativeBuildInputs LIBCLANG_PATH;
|
||||
};
|
||||
defaultPackage = packages.${pname};
|
||||
|
||||
# `nix run`
|
||||
apps.${pname} = utils.lib.mkApp {
|
||||
drv = packages.${pname};
|
||||
};
|
||||
defaultApp = apps.${pname};
|
||||
|
||||
# `nix flake check`
|
||||
checks = {
|
||||
fmt = with pkgs; runCommandLocal "${pname}-fmt" { buildInputs = [ cargo rustfmt nixpkgs-fmt ]; } ''
|
||||
cd ${root}
|
||||
cargo fmt -- --check
|
||||
nixpkgs-fmt --check *.nix
|
||||
touch $out
|
||||
'';
|
||||
};
|
||||
|
||||
# `nix develop`
|
||||
devShell = pkgs.mkShell {
|
||||
nativeBuildInputs = with pkgs; [ rustc cargo rustfmt nixpkgs-fmt ] ++ nativeBuildInputs;
|
||||
inherit buildInputs LIBCLANG_PATH;
|
||||
};
|
||||
};
|
||||
forSystem = system: forPkgs nixpkgs.legacyPackages."${system}";
|
||||
in
|
||||
(utils.lib.eachSystem [ "aarch64-linux" "i686-linux" "x86_64-linux" ] forSystem) // {
|
||||
overlay = final: prev: (forPkgs final).packages;
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,18 +0,0 @@
|
||||
.PHONY: install remove
|
||||
|
||||
install:
|
||||
install -Dm644 hooks/fido2luks -t /usr/lib/initcpio/hooks
|
||||
install -Dm644 install/fido2luks -t /usr/lib/initcpio/install
|
||||
ifdef preset
|
||||
mkinitcpio -p $(preset)
|
||||
else
|
||||
mkinitcpio -P
|
||||
endif
|
||||
|
||||
remove:
|
||||
rm /usr/lib/initcpio/{hooks,install}/fido2luks
|
||||
ifdef preset
|
||||
mkinitcpio -p $(preset)
|
||||
else
|
||||
mkinitcpio -P
|
||||
endif
|
||||
@ -1,52 +0,0 @@
|
||||
## fido2luks hook for mkinitcpio (ArchLinux and derivatives)
|
||||
|
||||
> ⚠️ Before proceeding, it is very advised to [backup your existing LUKS2 header](https://wiki.archlinux.org/title/dm-crypt/Device_encryption#Backup_using_cryptsetup) to external storage
|
||||
|
||||
### Setup
|
||||
|
||||
1. Connect your FIDO2 authenticator
|
||||
2. Generate credential id
|
||||
|
||||
```shell
|
||||
fido2luks credential
|
||||
```
|
||||
|
||||
3. Generate salt (random string)
|
||||
|
||||
```shell
|
||||
pwgen 48 1
|
||||
```
|
||||
|
||||
4. Add key to your LUKS2 device
|
||||
|
||||
```shell
|
||||
fido2luks add-key -Pt --salt <salt> <block_device> <credential_id>
|
||||
```
|
||||
|
||||
`-P` - request PIN to unlock the authenticator
|
||||
`-t` - add token (including credential id) to the LUKS2 header
|
||||
`-e` - wipe all other keys
|
||||
|
||||
For the full list of options see `fido2luks add-key --help`
|
||||
|
||||
5. Edit [/etc/fido2luks.conf](/initcpio/fido2luks.conf)
|
||||
|
||||
Keyslot (`FIDO2LUKS_DEVICE_SLOT`) can be obtained from the output of
|
||||
|
||||
```shell
|
||||
cryptsetup luksDump <block_device>
|
||||
```
|
||||
|
||||
6. Add fido2luks hook to /etc/mkinitcpio.conf
|
||||
|
||||
Before or instead of `encrypt` hook, for example:
|
||||
|
||||
```shell
|
||||
HOOKS=(base udev autodetect modconf keyboard block fido2luks filesystems fsck)
|
||||
```
|
||||
|
||||
7. Recreate initial ramdisk
|
||||
|
||||
```shell
|
||||
mkinitcpio -p <preset>
|
||||
```
|
||||
@ -1,18 +0,0 @@
|
||||
# Set credential *ONLY IF* it's not embedded in the LUKS2 header
|
||||
FIDO2LUKS_CREDENTIAL_ID=
|
||||
|
||||
# Encrypted device and its name under /dev/mapper
|
||||
# Can be overridden by `cryptdevice` kernel parameter
|
||||
FIDO2LUKS_DEVICE=
|
||||
FIDO2LUKS_MAPPER_NAME=
|
||||
|
||||
FIDO2LUKS_SALT=string:<salt>
|
||||
|
||||
# Use specific keyslot (ignore all other slots)
|
||||
FIDO2LUKS_DEVICE_SLOT=
|
||||
|
||||
# Await for an authenticator to be connected (in seconds)
|
||||
FIDO2LUKS_DEVICE_AWAIT=
|
||||
|
||||
# Set to 1 if PIN is required to unlock the authenticator
|
||||
FIDO2LUKS_ASK_PIN=
|
||||
@ -1,55 +0,0 @@
|
||||
#!/usr/bin/ash
|
||||
|
||||
run_hook() {
|
||||
modprobe -a -q dm-crypt >/dev/null 2>&1
|
||||
. /etc/fido2luks.conf
|
||||
|
||||
if [ -z "$cryptdevice" ]; then
|
||||
device="$FIDO2LUKS_DEVICE"
|
||||
dmname="$FIDO2LUKS_MAPPER_NAME"
|
||||
else
|
||||
IFS=: read cryptdev dmname _cryptoptions <<EOF
|
||||
$cryptdevice
|
||||
EOF
|
||||
if ! device=$(resolve_device "${cryptdev}" ${rootdelay}); then
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
options="--salt $FIDO2LUKS_SALT"
|
||||
|
||||
if [ "$FIDO2LUKS_ASK_PIN" == 1 ]; then
|
||||
options="$options --pin"
|
||||
fi
|
||||
|
||||
if [ -n "$FIDO2LUKS_DEVICE_SLOT" ]; then
|
||||
options="$options --slot $FIDO2LUKS_DEVICE_SLOT"
|
||||
fi
|
||||
|
||||
if [ -n "$FIDO2LUKS_DEVICE_AWAIT" ]; then
|
||||
options="$options --await-dev $FIDO2LUKS_DEVICE_AWAIT"
|
||||
fi
|
||||
|
||||
# HACK: /dev/tty is hardcoded in rpassword, but not accessible from the ramdisk
|
||||
# Temporary link it to /dev/tty1
|
||||
mv /dev/tty /dev/tty.back
|
||||
ln -s /dev/tty1 /dev/tty
|
||||
|
||||
printf "\nAuthentication is required to access the $dmname volume at $device\n"
|
||||
|
||||
if [ -z "$FIDO2LUKS_CREDENTIAL_ID" ]; then
|
||||
fido2luks open-token $device $dmname $options
|
||||
else
|
||||
fido2luks open $device $dmname $FIDO2LUKS_CREDENTIAL_ID $options
|
||||
fi
|
||||
exit_code=$?
|
||||
|
||||
# Restore /dev/tty
|
||||
mv /dev/tty.back /dev/tty
|
||||
|
||||
if [ $exit_code -ne 0 ]; then
|
||||
printf '\n'
|
||||
read -s -p 'Press Enter to continue'
|
||||
printf '\n'
|
||||
fi
|
||||
}
|
||||
@ -1,31 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
build() {
|
||||
local mod
|
||||
|
||||
add_module dm-crypt
|
||||
add_module dm-integrity
|
||||
if [[ $CRYPTO_MODULES ]]; then
|
||||
for mod in $CRYPTO_MODULES; do
|
||||
add_module "$mod"
|
||||
done
|
||||
else
|
||||
add_all_modules /crypto/
|
||||
fi
|
||||
|
||||
add_binary fido2luks
|
||||
add_binary dmsetup
|
||||
add_file /usr/lib/udev/rules.d/10-dm.rules
|
||||
add_file /usr/lib/udev/rules.d/13-dm-disk.rules
|
||||
add_file /usr/lib/udev/rules.d/95-dm-notify.rules
|
||||
add_file /usr/lib/initcpio/udev/11-dm-initramfs.rules /usr/lib/udev/rules.d/11-dm-initramfs.rules
|
||||
add_file /etc/fido2luks.conf /etc/fido2luks.conf
|
||||
|
||||
add_runscript
|
||||
}
|
||||
|
||||
help() {
|
||||
cat <<HELPEOF
|
||||
This hook allows to decrypt LUKS2 partition using FIDO2 compatible authenticator
|
||||
HELPEOF
|
||||
}
|
||||
@ -1,11 +0,0 @@
|
||||
.PHONY: install
|
||||
install:
|
||||
chmod +x hook/fido2luks.sh keyscript.sh
|
||||
cp -f hook/fido2luks.sh /etc/initramfs-tools/hooks/
|
||||
mkdir -p /usr/share/fido2luks
|
||||
cp -f keyscript.sh /lib/cryptsetup/scripts/fido2luks
|
||||
update-initramfs -u
|
||||
remove:
|
||||
sh -c "grep 'keyscript=fido2luks' -i /etc/crypttab && ( echo 'ERROR: your system is still setup to use fido2luks during boot' && exit 1) || exit 0"
|
||||
rm /etc/initramfs-tools/hooks/fido2luks.sh /lib/cryptsetup/scripts/fido2luks
|
||||
update-initramfs -u
|
||||
@ -1,34 +0,0 @@
|
||||
## Initramfs-tools based systems(Ubuntu and derivatives)
|
||||
|
||||
For easiest installation [download and install the precompiled deb from releases.](https://github.com/shimunn/fido2luks/releases). However it is possible to build from source via the instructions on the main readme.
|
||||
|
||||
```
|
||||
sudo -s
|
||||
|
||||
# Insert FIDO key.
|
||||
fido2luks credential
|
||||
# Tap FIDO key
|
||||
# Copy returned string <CREDENTIAL>
|
||||
|
||||
nano /etc/fido2luks.conf
|
||||
# Insert <CREDENTIAL>
|
||||
# FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL>
|
||||
|
||||
set -a
|
||||
. /etc/fido2luks.conf
|
||||
fido2luks -i add-key /dev/<LUKS PARTITION>
|
||||
# Current password: <Any current LUKS password>
|
||||
# Password: <Password used as FIDO challange>
|
||||
# Tap FIDO key
|
||||
|
||||
nano /etc/crypttab
|
||||
# Append to end ",discard,initramfs,keyscript=fido2luks"
|
||||
# E.g. sda6_crypt UUID=XXXXXXXXXX none luks,discard,initramfs,keyscript=fido2luks
|
||||
|
||||
update-initramfs -u
|
||||
|
||||
|
||||
```
|
||||
|
||||
[Recording showing part of the setup](https://shimun.net/fido2luks/setup.svg)
|
||||
|
||||
@ -1,5 +0,0 @@
|
||||
FIDO2LUKS_SALT=Ask
|
||||
#FIDO2LUKS_PASSWORD_HELPER="/usr/bin/plymouth ask-for-password --prompt 'FIDO2 password salt'"
|
||||
FIDO2LUKS_CREDENTIAL_ID=
|
||||
FIDO2LUKS_USE_TOKEN=0
|
||||
FIDO2LUKS_PASSWORD_FALLBACK=1
|
||||
@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
case "$1" in
|
||||
prereqs)
|
||||
echo ""
|
||||
exit 0
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
. /usr/share/initramfs-tools/hook-functions
|
||||
copy_file config /etc/fido2luks.conf /etc/fido2luks.conf
|
||||
copy_exec /usr/bin/fido2luks
|
||||
exit 0
|
||||
@ -1,30 +0,0 @@
|
||||
#!/bin/sh
|
||||
set -a
|
||||
. /etc/fido2luks.conf
|
||||
|
||||
# Set Defaults
|
||||
if [ -z "$FIDO2LUKS_USE_TOKEN" ]; then
|
||||
FIDO2LUKS_USE_TOKEN=0
|
||||
fi
|
||||
|
||||
if [ -z "$FIDO2LUKS_PASSWORD_FALLBACK" ]; then
|
||||
FIDO2LUKS_PASSWORD_FALLBACK=1
|
||||
fi
|
||||
|
||||
|
||||
|
||||
if [ -z "$FIDO2LUKS_PASSWORD_HELPER" ]; then
|
||||
MSG="FIDO2 password salt for $CRYPTTAB_NAME"
|
||||
export FIDO2LUKS_PASSWORD_HELPER="plymouth ask-for-password --prompt '$MSG'"
|
||||
fi
|
||||
|
||||
if [ "$FIDO2LUKS_USE_TOKEN" -eq 1 ]; then
|
||||
export FIDO2LUKS_CREDENTIAL_ID="$FIDO2LUKS_CREDENTIAL_ID,$(fido2luks token list --csv $CRYPTTAB_SOURCE)"
|
||||
fi
|
||||
|
||||
fido2luks print-secret --bin
|
||||
|
||||
# Fall back to passphrase-based unlock if fido2luks fails
|
||||
if [ "$?" -gt 0 ] && [ "$FIDO2LUKS_PASSWORD_FALLBACK" -eq 1 ]; then
|
||||
plymouth ask-for-password --prompt "Password for $CRYPTTAB_SOURCE"
|
||||
fi
|
||||
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 550 KiB |
@ -1,220 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This is a rather minimal example Argbash potential
|
||||
# Example taken from http://argbash.readthedocs.io/en/stable/example.html
|
||||
#
|
||||
# ARG_POSITIONAL_SINGLE([operation],[Operation to perform (mount|umount)],[])
|
||||
# ARG_OPTIONAL_SINGLE([credentials-type],[c],[Type of the credentials to use (external|embedded)])
|
||||
# ARG_OPTIONAL_SINGLE([device],[d],[Name of the device to create])
|
||||
# ARG_OPTIONAL_SINGLE([mount-point],[m],[Path of the mount point to use])
|
||||
# ARG_OPTIONAL_BOOLEAN([ask-pin],[a],[Ask for a pin],[off])
|
||||
# ARG_OPTIONAL_SINGLE([salt],[s],[Salt to use],[""])
|
||||
# ARG_HELP([Unlocks/Locks a LUKS volume and mount/unmount it in the given mount point.])
|
||||
# ARGBASH_GO()
|
||||
# needed because of Argbash --> m4_ignore([
|
||||
### START OF CODE GENERATED BY Argbash v2.9.0 one line above ###
|
||||
# Argbash is a bash code generator used to get arguments parsing right.
|
||||
# Argbash is FREE SOFTWARE, see https://argbash.io for more info
|
||||
# Generated online by https://argbash.io/generate
|
||||
|
||||
|
||||
die()
|
||||
{
|
||||
local _ret="${2:-1}"
|
||||
test "${_PRINT_HELP:-no}" = yes && print_help >&2
|
||||
echo "$1" >&2
|
||||
exit "${_ret}"
|
||||
}
|
||||
|
||||
|
||||
begins_with_short_option()
|
||||
{
|
||||
local first_option all_short_options='cdmash'
|
||||
first_option="${1:0:1}"
|
||||
test "$all_short_options" = "${all_short_options/$first_option/}" && return 1 || return 0
|
||||
}
|
||||
|
||||
# THE DEFAULTS INITIALIZATION - POSITIONALS
|
||||
_positionals=()
|
||||
# THE DEFAULTS INITIALIZATION - OPTIONALS
|
||||
_arg_credentials_type=
|
||||
_arg_device=
|
||||
_arg_mount_point=
|
||||
_arg_ask_pin="off"
|
||||
_arg_salt=""
|
||||
|
||||
|
||||
print_help()
|
||||
{
|
||||
printf '%s\n' "Unlocks/Locks a LUKS volume and mount/unmount it in the given mount point."
|
||||
printf 'Usage: %s [-c|--credentials-type <arg>] [-d|--device <arg>] [-m|--mount-point <arg>] [-a|--(no-)ask-pin] [-s|--salt <arg>] [-h|--help] <operation>\n' "$0"
|
||||
printf '\t%s\n' "<operation>: Operation to perform (mount|umount)"
|
||||
printf '\t%s\n' "-c, --credentials-type: Type of the credentials to use (external|embedded) (no default)"
|
||||
printf '\t%s\n' "-d, --device: Name of the device to create (no default)"
|
||||
printf '\t%s\n' "-m, --mount-point: Path of the mount point to use (no default)"
|
||||
printf '\t%s\n' "-a, --ask-pin, --no-ask-pin: Ask for a pin (off by default)"
|
||||
printf '\t%s\n' "-s, --salt: Salt to use (default: '""')"
|
||||
printf '\t%s\n' "-h, --help: Prints help"
|
||||
}
|
||||
|
||||
|
||||
parse_commandline()
|
||||
{
|
||||
_positionals_count=0
|
||||
while test $# -gt 0
|
||||
do
|
||||
_key="$1"
|
||||
case "$_key" in
|
||||
-c|--credentials-type)
|
||||
test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
|
||||
_arg_credentials_type="$2"
|
||||
shift
|
||||
;;
|
||||
--credentials-type=*)
|
||||
_arg_credentials_type="${_key##--credentials-type=}"
|
||||
;;
|
||||
-c*)
|
||||
_arg_credentials_type="${_key##-c}"
|
||||
;;
|
||||
-d|--device)
|
||||
test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
|
||||
_arg_device="$2"
|
||||
shift
|
||||
;;
|
||||
--device=*)
|
||||
_arg_device="${_key##--device=}"
|
||||
;;
|
||||
-d*)
|
||||
_arg_device="${_key##-d}"
|
||||
;;
|
||||
-m|--mount-point)
|
||||
test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
|
||||
_arg_mount_point="$2"
|
||||
shift
|
||||
;;
|
||||
--mount-point=*)
|
||||
_arg_mount_point="${_key##--mount-point=}"
|
||||
;;
|
||||
-m*)
|
||||
_arg_mount_point="${_key##-m}"
|
||||
;;
|
||||
-a|--no-ask-pin|--ask-pin)
|
||||
_arg_ask_pin="on"
|
||||
test "${1:0:5}" = "--no-" && _arg_ask_pin="off"
|
||||
;;
|
||||
-a*)
|
||||
_arg_ask_pin="on"
|
||||
_next="${_key##-a}"
|
||||
if test -n "$_next" -a "$_next" != "$_key"
|
||||
then
|
||||
{ begins_with_short_option "$_next" && shift && set -- "-a" "-${_next}" "$@"; } || die "The short option '$_key' can't be decomposed to ${_key:0:2} and -${_key:2}, because ${_key:0:2} doesn't accept value and '-${_key:2:1}' doesn't correspond to a short option."
|
||||
fi
|
||||
;;
|
||||
-s|--salt)
|
||||
test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
|
||||
_arg_salt="$2"
|
||||
shift
|
||||
;;
|
||||
--salt=*)
|
||||
_arg_salt="${_key##--salt=}"
|
||||
;;
|
||||
-s*)
|
||||
_arg_salt="${_key##-s}"
|
||||
;;
|
||||
-h|--help)
|
||||
print_help
|
||||
exit 0
|
||||
;;
|
||||
-h*)
|
||||
print_help
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
_last_positional="$1"
|
||||
_positionals+=("$_last_positional")
|
||||
_positionals_count=$((_positionals_count + 1))
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
handle_passed_args_count()
|
||||
{
|
||||
local _required_args_string="'operation'"
|
||||
test "${_positionals_count}" -ge 1 || _PRINT_HELP=yes die "FATAL ERROR: Not enough positional arguments - we require exactly 1 (namely: $_required_args_string), but got only ${_positionals_count}." 1
|
||||
test "${_positionals_count}" -le 1 || _PRINT_HELP=yes die "FATAL ERROR: There were spurious positional arguments --- we expect exactly 1 (namely: $_required_args_string), but got ${_positionals_count} (the last one was: '${_last_positional}')." 1
|
||||
}
|
||||
|
||||
|
||||
assign_positional_args()
|
||||
{
|
||||
local _positional_name _shift_for=$1
|
||||
_positional_names="_arg_operation "
|
||||
|
||||
shift "$_shift_for"
|
||||
for _positional_name in ${_positional_names}
|
||||
do
|
||||
test $# -gt 0 || break
|
||||
eval "$_positional_name=\${1}" || die "Error during argument parsing, possibly an Argbash bug." 1
|
||||
shift
|
||||
done
|
||||
}
|
||||
|
||||
parse_commandline "$@"
|
||||
handle_passed_args_count
|
||||
assign_positional_args 1 "${_positionals[@]}"
|
||||
|
||||
# OTHER STUFF GENERATED BY Argbash
|
||||
|
||||
### END OF CODE GENERATED BY Argbash (sortof) ### ])
|
||||
# [ <-- needed because of Argbash
|
||||
|
||||
if [ -z ${_arg_mount_point} ]; then
|
||||
die "Missing '--mount-point' argument"
|
||||
fi
|
||||
|
||||
if [ -z ${_arg_device} ]; then
|
||||
die "Missing '--device' argument"
|
||||
fi
|
||||
|
||||
ASK_PIN=${_arg_ask_pin}
|
||||
OPERATION=${_arg_operation}
|
||||
DEVICE=${_arg_device}
|
||||
DEVICE_NAME=$(sed "s|/|_|g" <<< ${DEVICE})
|
||||
MOUNT_POINT=${_arg_mount_point}
|
||||
CREDENTIALS_TYPE=${_arg_credentials_type}
|
||||
SALT=${_arg_salt}
|
||||
CONF_FILE_PATH="/etc/fido2luksmounthelper.conf"
|
||||
|
||||
if [ "${OPERATION}" == "mount" ]; then
|
||||
if [ "${CREDENTIALS_TYPE}" == "external" ]; then
|
||||
if [ -f ${CONF_FILE_PATH} ]; then
|
||||
if [ "${ASK_PIN}" == "on" ]; then
|
||||
read PASSWORD
|
||||
fi
|
||||
CREDENTIALS=$(<${CONF_FILE_PATH})
|
||||
else
|
||||
die "The configuration file '${CONF_FILE_PATH}' is missing. Please create it or use embedded credentials."
|
||||
fi
|
||||
printf ${PASSWORD} | fido2luks open --salt string:${SALT} --pin --pin-source /dev/stdin ${DEVICE} ${DEVICE_NAME} ${CREDENTIALS}
|
||||
elif [ "${CREDENTIALS_TYPE}" == "embedded" ]; then
|
||||
if [ "${ASK_PIN}" == "on" ]; then
|
||||
read PASSWORD
|
||||
fi
|
||||
printf ${PASSWORD} | fido2luks open-token --salt string:${SALT} --pin --pin-source /dev/stdin ${DEVICE} ${DEVICE_NAME}
|
||||
else
|
||||
die "Given credential-type '${CREDENTIALS_TYPE}' is invalid. It must be 'external' or 'embedded'"
|
||||
fi
|
||||
mount /dev/mapper/${DEVICE_NAME} ${MOUNT_POINT}
|
||||
elif [ "${OPERATION}" == "umount" ]; then
|
||||
umount ${MOUNT_POINT}
|
||||
cryptsetup luksClose ${DEVICE_NAME}
|
||||
else
|
||||
die "Given operation '${OPERATION}' is invalid. It must be 'mount' or 'unmount'"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
# ] <-- needed because of Argbash
|
||||
699
src/cli.rs
699
src/cli.rs
@ -1,43 +1,147 @@
|
||||
use crate::error::*;
|
||||
use crate::luks::{Fido2LuksToken, LuksDevice};
|
||||
use crate::util::sha256;
|
||||
use crate::luks;
|
||||
use crate::*;
|
||||
use cli_args::*;
|
||||
|
||||
use structopt::clap::Shell;
|
||||
use structopt::StructOpt;
|
||||
|
||||
use ctap::{FidoCredential, FidoErrorKind};
|
||||
|
||||
use std::io::{Read, Write};
|
||||
use std::str::FromStr;
|
||||
use failure::_core::fmt::{Display, Error, Formatter};
|
||||
use failure::_core::str::FromStr;
|
||||
use failure::_core::time::Duration;
|
||||
use std::io::Write;
|
||||
use std::process::exit;
|
||||
use std::thread;
|
||||
use std::time::Duration;
|
||||
|
||||
use std::borrow::Cow;
|
||||
use std::collections::HashSet;
|
||||
use std::fs::File;
|
||||
use crate::util::read_password;
|
||||
use std::time::SystemTime;
|
||||
|
||||
pub use cli_args::Args;
|
||||
#[derive(Debug, Eq, PartialEq, Clone)]
|
||||
pub struct HexEncoded(pub Vec<u8>);
|
||||
|
||||
fn read_pin(ap: &AuthenticatorParameters) -> Fido2LuksResult<String> {
|
||||
if let Some(src) = ap.pin_source.as_ref() {
|
||||
let mut pin = String::new();
|
||||
File::open(src)?.read_to_string(&mut pin)?;
|
||||
Ok(pin.trim_end_matches("\n").to_string()) //remove trailing newline
|
||||
} else {
|
||||
util::read_password("Authenticator PIN", false)
|
||||
impl Display for HexEncoded {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
|
||||
f.write_str(&hex::encode(&self.0))
|
||||
}
|
||||
}
|
||||
|
||||
fn derive_secret(
|
||||
credentials: &[HexEncoded],
|
||||
salt: &[u8; 32],
|
||||
timeout: u64,
|
||||
pin: Option<&str>,
|
||||
impl FromStr for HexEncoded {
|
||||
type Err = hex::FromHexError;
|
||||
|
||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||
Ok(HexEncoded(hex::decode(s)?))
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Eq, PartialEq, Clone)]
|
||||
pub struct CommaSeparated<T: FromStr + Display>(pub Vec<T>);
|
||||
|
||||
impl<T: Display + FromStr> Display for CommaSeparated<T> {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
|
||||
for i in &self.0 {
|
||||
f.write_str(&i.to_string())?;
|
||||
f.write_str(",")?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
impl<T: Display + FromStr> FromStr for CommaSeparated<T> {
|
||||
type Err = <T as FromStr>::Err;
|
||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||
Ok(CommaSeparated(
|
||||
s.split(',')
|
||||
.map(|part| <T as FromStr>::from_str(part))
|
||||
.collect::<Result<Vec<_>, _>>()?,
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct Args {
|
||||
/// Request passwords via Stdin instead of using the password helper
|
||||
#[structopt(short = "i", long = "interactive")]
|
||||
pub interactive: bool,
|
||||
#[structopt(subcommand)]
|
||||
pub command: Command,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt, Clone)]
|
||||
pub struct SecretGeneration {
|
||||
/// FIDO credential ids, seperated by ',' generate using fido2luks credential
|
||||
#[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
|
||||
pub credential_ids: CommaSeparated<HexEncoded>,
|
||||
/// Salt for secret generation, defaults to 'ask'
|
||||
///
|
||||
/// Options:{n}
|
||||
/// - ask : Prompt user using password helper{n}
|
||||
/// - file:<PATH> : Will read <FILE>{n}
|
||||
/// - string:<STRING> : Will use <STRING>, which will be handled like a password provided to the 'ask' option{n}
|
||||
#[structopt(
|
||||
name = "salt",
|
||||
long = "salt",
|
||||
env = "FIDO2LUKS_SALT",
|
||||
default_value = "ask"
|
||||
)]
|
||||
pub salt: InputSalt,
|
||||
/// Script used to obtain passwords, overridden by --interactive flag
|
||||
#[structopt(
|
||||
name = "password-helper",
|
||||
env = "FIDO2LUKS_PASSWORD_HELPER",
|
||||
default_value = "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
|
||||
)]
|
||||
pub password_helper: PasswordHelper,
|
||||
|
||||
/// Await for an authenticator to be connected, timeout after n seconds
|
||||
#[structopt(
|
||||
long = "await-dev",
|
||||
name = "await-dev",
|
||||
env = "FIDO2LUKS_DEVICE_AWAIT",
|
||||
default_value = "15"
|
||||
)]
|
||||
pub await_authenticator: u64,
|
||||
|
||||
/// Request the password twice to ensure it being correct
|
||||
#[structopt(
|
||||
long = "verify-password",
|
||||
env = "FIDO2LUKS_VERIFY_PASSWORD",
|
||||
hidden = true
|
||||
)]
|
||||
pub verify_password: Option<bool>,
|
||||
}
|
||||
|
||||
impl SecretGeneration {
|
||||
pub fn patch(&self, args: &Args, verify_password: Option<bool>) -> Self {
|
||||
let mut me = self.clone();
|
||||
if args.interactive {
|
||||
me.password_helper = PasswordHelper::Stdin;
|
||||
}
|
||||
me.verify_password = me.verify_password.or(verify_password);
|
||||
me
|
||||
}
|
||||
|
||||
pub fn obtain_secret(&self, password_query: &str) -> Fido2LuksResult<[u8; 32]> {
|
||||
self.obtain_secret_and_credential(password_query)
|
||||
.map(|(secret, _)| secret)
|
||||
}
|
||||
|
||||
pub fn obtain_secret_and_credential(
|
||||
&self,
|
||||
password_query: &str,
|
||||
) -> Fido2LuksResult<([u8; 32], FidoCredential)> {
|
||||
let timeout = Duration::from_secs(timeout);
|
||||
let mut salt = [0u8; 32];
|
||||
match self.password_helper {
|
||||
PasswordHelper::Stdin if !self.verify_password.unwrap_or(true) => {
|
||||
salt.copy_from_slice(&util::sha256(&[&read_password(
|
||||
password_query,
|
||||
self.verify_password.unwrap_or(true),
|
||||
)?
|
||||
.as_bytes()[..]]));
|
||||
}
|
||||
_ => {
|
||||
salt = self.salt.obtain(&self.password_helper)?;
|
||||
}
|
||||
}
|
||||
let timeout = Duration::from_secs(self.await_authenticator);
|
||||
let start = SystemTime::now();
|
||||
|
||||
while let Ok(el) = start.elapsed() {
|
||||
@ -52,76 +156,158 @@ fn derive_secret(
|
||||
}
|
||||
thread::sleep(Duration::from_millis(500));
|
||||
}
|
||||
|
||||
let credentials = credentials
|
||||
let credentials = &self
|
||||
.credential_ids
|
||||
.0
|
||||
.iter()
|
||||
.map(|hex| FidoCredential {
|
||||
id: hex.0.clone(),
|
||||
.map(|HexEncoded(id)| FidoCredential {
|
||||
id: id.to_vec(),
|
||||
public_key: None,
|
||||
})
|
||||
.collect::<Vec<_>>();
|
||||
let credentials = credentials.iter().collect::<Vec<_>>();
|
||||
let (unsalted, cred) =
|
||||
perform_challenge(&credentials, salt, timeout - start.elapsed().unwrap(), pin)?;
|
||||
let (secret, credential) =
|
||||
perform_challenge(&credentials[..], &salt, timeout - start.elapsed().unwrap())?;
|
||||
Ok((assemble_secret(&secret, &salt), credential.clone()))
|
||||
}
|
||||
}
|
||||
|
||||
Ok((sha256(&[salt, &unsalted[..]]), cred.clone()))
|
||||
#[derive(Debug, StructOpt, Clone)]
|
||||
pub struct LuksSettings {
|
||||
/// Number of milliseconds required to derive the volume decryption key
|
||||
/// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
|
||||
#[structopt(long = "kdf-time", name = "kdf-time")]
|
||||
kdf_time: Option<u64>,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt, Clone)]
|
||||
pub struct OtherSecret {
|
||||
/// Use a keyfile instead of a password
|
||||
#[structopt(short = "d", long = "keyfile", conflicts_with = "fido_device")]
|
||||
keyfile: Option<PathBuf>,
|
||||
/// Use another fido device instead of a password
|
||||
/// Note: this requires for the credential fot the other device to be passed as argument as well
|
||||
#[structopt(short = "f", long = "fido-device", conflicts_with = "keyfile")]
|
||||
fido_device: bool,
|
||||
}
|
||||
|
||||
impl OtherSecret {
|
||||
pub fn obtain(
|
||||
&self,
|
||||
secret_gen: &SecretGeneration,
|
||||
verify_password: bool,
|
||||
password_question: &str,
|
||||
) -> Fido2LuksResult<Vec<u8>> {
|
||||
match &self.keyfile {
|
||||
Some(keyfile) => util::read_keyfile(keyfile.clone()),
|
||||
None if self.fido_device => {
|
||||
Ok(Vec::from(&secret_gen.obtain_secret(password_question)?[..]))
|
||||
}
|
||||
None => util::read_password(password_question, verify_password)
|
||||
.map(|p| p.as_bytes().to_vec()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub enum Command {
|
||||
#[structopt(name = "print-secret")]
|
||||
PrintSecret {
|
||||
/// Prints the secret as binary instead of hex encoded
|
||||
#[structopt(short = "b", long = "bin")]
|
||||
binary: bool,
|
||||
#[structopt(flatten)]
|
||||
secret_gen: SecretGeneration,
|
||||
},
|
||||
/// Adds a generated key to the specified LUKS device
|
||||
#[structopt(name = "add-key")]
|
||||
AddKey {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
/// Will wipe all other keys
|
||||
#[structopt(short = "e", long = "exclusive")]
|
||||
exclusive: bool,
|
||||
/// Will add an token to your LUKS 2 header, including the credential id
|
||||
#[structopt(short = "t", long = "token")]
|
||||
token: bool,
|
||||
#[structopt(flatten)]
|
||||
existing_secret: OtherSecret,
|
||||
#[structopt(flatten)]
|
||||
secret_gen: SecretGeneration,
|
||||
#[structopt(flatten)]
|
||||
luks_settings: LuksSettings,
|
||||
},
|
||||
/// Replace a previously added key with a password
|
||||
#[structopt(name = "replace-key")]
|
||||
ReplaceKey {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
/// Add the password and keep the key
|
||||
#[structopt(short = "a", long = "add-password")]
|
||||
add_password: bool,
|
||||
// /// Will add an token to your LUKS 2 header, including the credential id
|
||||
// #[structopt(short = "t", long = "token")]
|
||||
// token: bool,
|
||||
#[structopt(flatten)]
|
||||
replacement: OtherSecret,
|
||||
#[structopt(flatten)]
|
||||
secret_gen: SecretGeneration,
|
||||
#[structopt(flatten)]
|
||||
luks_settings: LuksSettings,
|
||||
},
|
||||
/// Open the LUKS device
|
||||
#[structopt(name = "open")]
|
||||
Open {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
#[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
|
||||
name: String,
|
||||
#[structopt(short = "r", long = "max-retries", default_value = "0")]
|
||||
retries: i32,
|
||||
#[structopt(flatten)]
|
||||
secret_gen: SecretGeneration,
|
||||
},
|
||||
/// Open the LUKS device using information embedded into the LUKS 2 header
|
||||
#[structopt(name = "open-token")]
|
||||
OpenToken {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
#[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
|
||||
name: String,
|
||||
salt: String,
|
||||
},
|
||||
/// Generate a new FIDO credential
|
||||
#[structopt(name = "credential")]
|
||||
Credential {
|
||||
/// Name to be displayed on the authenticator if it has a display
|
||||
#[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME")]
|
||||
name: Option<String>,
|
||||
},
|
||||
/// Check if an authenticator is connected
|
||||
#[structopt(name = "connected")]
|
||||
Connected,
|
||||
}
|
||||
|
||||
pub fn parse_cmdline() -> Args {
|
||||
Args::from_args()
|
||||
}
|
||||
|
||||
pub fn prompt_interaction(interactive: bool) {
|
||||
if interactive {
|
||||
println!("Authorize using your FIDO device");
|
||||
}
|
||||
}
|
||||
|
||||
pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
let mut stdout = io::stdout();
|
||||
let args = parse_cmdline();
|
||||
let interactive = args.interactive;
|
||||
match &args.command {
|
||||
Command::Credential {
|
||||
authenticator,
|
||||
name,
|
||||
} => {
|
||||
let pin_string;
|
||||
let pin = if authenticator.pin {
|
||||
pin_string = read_pin(authenticator)?;
|
||||
Some(pin_string.as_ref())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let cred = make_credential_id(Some(name.as_ref()), pin)?;
|
||||
Command::Credential { name } => {
|
||||
let cred = make_credential_id(name.as_ref().map(|n| n.as_ref()))?;
|
||||
println!("{}", hex::encode(&cred.id));
|
||||
Ok(())
|
||||
}
|
||||
Command::PrintSecret {
|
||||
binary,
|
||||
authenticator,
|
||||
credentials,
|
||||
secret,
|
||||
ref secret_gen,
|
||||
} => {
|
||||
let pin_string;
|
||||
let pin = if authenticator.pin {
|
||||
pin_string = read_pin(authenticator)?;
|
||||
Some(pin_string.as_ref())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let salt = if interactive || secret.password_helper == PasswordHelper::Stdin {
|
||||
util::read_password_hashed("Password", false)
|
||||
} else {
|
||||
secret.salt.obtain_sha256(&secret.password_helper)
|
||||
}?;
|
||||
prompt_interaction(interactive);
|
||||
let (secret, _cred) = derive_secret(
|
||||
credentials.ids.0.as_slice(),
|
||||
&salt,
|
||||
authenticator.await_time,
|
||||
pin,
|
||||
)?;
|
||||
let secret = secret_gen
|
||||
.patch(&args, Some(false))
|
||||
.obtain_secret("Password")?;
|
||||
if *binary {
|
||||
stdout.write_all(&secret[..])?;
|
||||
} else {
|
||||
@ -130,196 +316,88 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
Ok(stdout.flush()?)
|
||||
}
|
||||
Command::AddKey {
|
||||
luks,
|
||||
authenticator,
|
||||
credentials,
|
||||
secret,
|
||||
luks_mod,
|
||||
existing_secret: other_secret,
|
||||
device,
|
||||
exclusive,
|
||||
token,
|
||||
..
|
||||
}
|
||||
| Command::ReplaceKey {
|
||||
luks,
|
||||
authenticator,
|
||||
credentials,
|
||||
secret,
|
||||
luks_mod,
|
||||
replacement: other_secret,
|
||||
token,
|
||||
..
|
||||
existing_secret,
|
||||
ref secret_gen,
|
||||
luks_settings,
|
||||
} => {
|
||||
let pin = if authenticator.pin {
|
||||
Some(read_pin(authenticator)?)
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
|
||||
if interactive || secret.password_helper == PasswordHelper::Stdin {
|
||||
util::read_password_hashed(q, verify)
|
||||
} else {
|
||||
secret.salt.obtain_sha256(&secret.password_helper)
|
||||
}
|
||||
};
|
||||
let other_secret = |salt_q: &str,
|
||||
verify: bool|
|
||||
-> Fido2LuksResult<(Vec<u8>, Option<FidoCredential>)> {
|
||||
match other_secret {
|
||||
OtherSecret {
|
||||
keyfile: Some(file),
|
||||
..
|
||||
} => Ok((util::read_keyfile(file)?, None)),
|
||||
OtherSecret {
|
||||
fido_device: true, ..
|
||||
} => {
|
||||
prompt_interaction(interactive);
|
||||
Ok(derive_secret(
|
||||
&credentials.ids.0,
|
||||
&salt(salt_q, verify)?,
|
||||
authenticator.await_time,
|
||||
pin.as_deref(),
|
||||
)
|
||||
.map(|(secret, cred)| (secret[..].to_vec(), Some(cred)))?)
|
||||
}
|
||||
_ => Ok((
|
||||
util::read_password(salt_q, verify)?.as_bytes().to_vec(),
|
||||
None,
|
||||
)),
|
||||
}
|
||||
};
|
||||
let secret = |q: &str, verify: bool| -> Fido2LuksResult<([u8; 32], FidoCredential)> {
|
||||
prompt_interaction(interactive);
|
||||
derive_secret(
|
||||
&credentials.ids.0,
|
||||
&salt(q, verify)?,
|
||||
authenticator.await_time,
|
||||
pin.as_deref(),
|
||||
)
|
||||
};
|
||||
let mut luks_dev = LuksDevice::load(&luks.device)?;
|
||||
// Non overlap
|
||||
match &args.command {
|
||||
Command::AddKey { exclusive, .. } => {
|
||||
let (existing_secret, _) = other_secret("Current password", false)?;
|
||||
let (new_secret, cred) = secret("Password to be added", true)?;
|
||||
let added_slot = luks_dev.add_key(
|
||||
&new_secret,
|
||||
&existing_secret[..],
|
||||
luks_mod.kdf_time.or(Some(10)),
|
||||
Some(&cred.id[..]).filter(|_| *token),
|
||||
let secret_gen = secret_gen.patch(&args, None);
|
||||
let old_secret = existing_secret.obtain(&secret_gen, false, "Existing password")?;
|
||||
let (secret, credential) = secret_gen.obtain_secret_and_credential("Password")?;
|
||||
let added_slot = luks::add_key(
|
||||
device.clone(),
|
||||
&secret,
|
||||
&old_secret[..],
|
||||
luks_settings.kdf_time.or(Some(10)),
|
||||
Some(&credential.id[..]).filter(|_| *token),
|
||||
)?;
|
||||
if *exclusive {
|
||||
let destroyed = luks_dev.remove_keyslots(&[added_slot])?;
|
||||
let destroyed = luks::remove_keyslots(&device, &[added_slot])?;
|
||||
println!(
|
||||
"Added to key to device {}, slot: {}\nRemoved {} old keys",
|
||||
luks.device.display(),
|
||||
device.display(),
|
||||
added_slot,
|
||||
destroyed
|
||||
);
|
||||
} else {
|
||||
println!(
|
||||
"Added to key to device {}, slot: {}",
|
||||
luks.device.display(),
|
||||
device.display(),
|
||||
added_slot
|
||||
);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
Command::ReplaceKey { add_password, .. } => {
|
||||
let (existing_secret, _) = secret("Current password", false)?;
|
||||
let (replacement_secret, cred) = other_secret("Replacement password", true)?;
|
||||
Command::ReplaceKey {
|
||||
device,
|
||||
add_password,
|
||||
//token,
|
||||
replacement,
|
||||
ref secret_gen,
|
||||
luks_settings,
|
||||
} => {
|
||||
let secret_gen = secret_gen.patch(&args, Some(false));
|
||||
let secret = secret_gen.obtain_secret("Password")?;
|
||||
let new_secret = replacement.obtain(&secret_gen, true, "Replacement password")?;
|
||||
let slot = if *add_password {
|
||||
luks_dev.add_key(
|
||||
&replacement_secret[..],
|
||||
&existing_secret,
|
||||
luks_mod.kdf_time,
|
||||
cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
|
||||
luks::add_key(
|
||||
device,
|
||||
&new_secret[..],
|
||||
&secret,
|
||||
luks_settings.kdf_time,
|
||||
None,
|
||||
)
|
||||
} else {
|
||||
luks_dev.replace_key(
|
||||
&replacement_secret[..],
|
||||
&existing_secret,
|
||||
luks_mod.kdf_time,
|
||||
cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
|
||||
luks::replace_key(
|
||||
device,
|
||||
&new_secret[..],
|
||||
&secret,
|
||||
luks_settings.kdf_time,
|
||||
None,
|
||||
)
|
||||
}?;
|
||||
println!(
|
||||
"Added to password to device {}, slot: {}",
|
||||
luks.device.display(),
|
||||
device.display(),
|
||||
slot
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
_ => unreachable!(),
|
||||
}
|
||||
}
|
||||
Command::Open {
|
||||
luks,
|
||||
authenticator,
|
||||
secret,
|
||||
device,
|
||||
name,
|
||||
retries,
|
||||
allow_discards,
|
||||
..
|
||||
}
|
||||
| Command::OpenToken {
|
||||
luks,
|
||||
authenticator,
|
||||
secret,
|
||||
name,
|
||||
retries,
|
||||
allow_discards,
|
||||
ref secret_gen,
|
||||
} => {
|
||||
let pin_string;
|
||||
let pin = if authenticator.pin {
|
||||
pin_string = read_pin(authenticator)?;
|
||||
Some(pin_string.as_ref())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
|
||||
if interactive || secret.password_helper == PasswordHelper::Stdin {
|
||||
util::read_password_hashed(q, verify)
|
||||
} else {
|
||||
secret.salt.obtain_sha256(&secret.password_helper)
|
||||
}
|
||||
};
|
||||
|
||||
// Cow shouldn't be necessary
|
||||
let secret = |credentials: Cow<'_, Vec<HexEncoded>>| {
|
||||
prompt_interaction(interactive);
|
||||
derive_secret(
|
||||
credentials.as_ref(),
|
||||
&salt("Password", false)?,
|
||||
authenticator.await_time,
|
||||
pin,
|
||||
)
|
||||
};
|
||||
|
||||
let mut retries = *retries;
|
||||
let mut luks_dev = LuksDevice::load(&luks.device)?;
|
||||
loop {
|
||||
let secret = match &args.command {
|
||||
Command::Open { credentials, .. } => secret(Cow::Borrowed(&credentials.ids.0))
|
||||
.and_then(|(secret, _cred)| {
|
||||
luks_dev.activate(&name, &secret, luks.slot, *allow_discards)
|
||||
}),
|
||||
Command::OpenToken { .. } => luks_dev.activate_token(
|
||||
&name,
|
||||
Box::new(|credentials: Vec<String>| {
|
||||
let creds = credentials
|
||||
.into_iter()
|
||||
.flat_map(|cred| HexEncoded::from_str(cred.as_ref()).ok())
|
||||
.collect::<Vec<_>>();
|
||||
secret(Cow::Owned(creds))
|
||||
.map(|(secret, cred)| (secret, hex::encode(&cred.id)))
|
||||
}),
|
||||
luks.slot,
|
||||
*allow_discards,
|
||||
),
|
||||
_ => unreachable!(),
|
||||
};
|
||||
match secret {
|
||||
match secret_gen
|
||||
.patch(&args, Some(false))
|
||||
.obtain_secret("Password")
|
||||
.and_then(|secret| luks::open_container(&device, &name, &secret))
|
||||
{
|
||||
Err(e) => {
|
||||
match e {
|
||||
Fido2LuksError::WrongSecret if retries > 0 => {}
|
||||
@ -331,10 +409,35 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
retries -= 1;
|
||||
eprintln!("{}", e);
|
||||
}
|
||||
res => break res.map(|_| ()),
|
||||
res => break res,
|
||||
}
|
||||
}
|
||||
}
|
||||
// TODO: utilise salt
|
||||
Command::OpenToken {
|
||||
device,
|
||||
name,
|
||||
salt: _,
|
||||
} => luks::open_container_token(
|
||||
device,
|
||||
&name[..],
|
||||
Box::new(|creds| {
|
||||
let (secret, cred) = SecretGeneration {
|
||||
credential_ids: CommaSeparated(
|
||||
creds
|
||||
.iter()
|
||||
.map(|c| HexEncoded::from_str(&c[..]).unwrap())
|
||||
.collect(),
|
||||
),
|
||||
salt: InputSalt::String("".into()),
|
||||
password_helper: Default::default(),
|
||||
await_authenticator: 100,
|
||||
verify_password: None,
|
||||
}
|
||||
.obtain_secret_and_credential("Password")?;
|
||||
Ok((secret, hex::encode(cred.id)))
|
||||
}),
|
||||
),
|
||||
Command::Connected => match get_devices() {
|
||||
Ok(ref devs) if !devs.is_empty() => {
|
||||
println!("Found {} devices", devs.len());
|
||||
@ -342,141 +445,5 @@ pub fn run_cli() -> Fido2LuksResult<()> {
|
||||
}
|
||||
_ => exit(1),
|
||||
},
|
||||
Command::Token(cmd) => match cmd {
|
||||
TokenCommand::List {
|
||||
device,
|
||||
csv: dump_credentials,
|
||||
} => {
|
||||
let mut dev = LuksDevice::load(device)?;
|
||||
let mut creds = Vec::new();
|
||||
for token in dev.tokens()? {
|
||||
let (id, token) = token?;
|
||||
for cred in token.credential.iter() {
|
||||
if !creds.contains(cred) {
|
||||
creds.push(cred.clone());
|
||||
if *dump_credentials {
|
||||
print!("{}{}", if creds.len() == 1 { "" } else { "," }, cred);
|
||||
}
|
||||
}
|
||||
}
|
||||
if *dump_credentials {
|
||||
continue;
|
||||
}
|
||||
println!(
|
||||
"{}:\n\tSlots: {}\n\tCredentials: {}",
|
||||
id,
|
||||
if token.keyslots.is_empty() {
|
||||
"None".into()
|
||||
} else {
|
||||
token.keyslots.iter().cloned().collect::<Vec<_>>().join(",")
|
||||
},
|
||||
token
|
||||
.credential
|
||||
.iter()
|
||||
.map(|cred| format!(
|
||||
"{} ({})",
|
||||
cred,
|
||||
creds.iter().position(|c| c == cred).unwrap().to_string()
|
||||
))
|
||||
.collect::<Vec<_>>()
|
||||
.join(",")
|
||||
);
|
||||
}
|
||||
if *dump_credentials {
|
||||
println!();
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
TokenCommand::Add {
|
||||
device,
|
||||
credentials,
|
||||
slot,
|
||||
} => {
|
||||
let mut dev = LuksDevice::load(device)?;
|
||||
let mut tokens = Vec::new();
|
||||
for token in dev.tokens()? {
|
||||
let (id, token) = token?;
|
||||
if token.keyslots.contains(&slot.to_string()) {
|
||||
tokens.push((id, token));
|
||||
}
|
||||
}
|
||||
let count = if tokens.is_empty() {
|
||||
dev.add_token(&Fido2LuksToken::with_credentials(&credentials.ids.0, *slot))?;
|
||||
1
|
||||
} else {
|
||||
tokens.len()
|
||||
};
|
||||
for (id, mut token) in tokens {
|
||||
token
|
||||
.credential
|
||||
.extend(credentials.ids.0.iter().map(|h| h.to_string()));
|
||||
dev.update_token(id, &token)?;
|
||||
}
|
||||
println!("Updated {} tokens", count);
|
||||
Ok(())
|
||||
}
|
||||
TokenCommand::Remove {
|
||||
device,
|
||||
credentials,
|
||||
token_id,
|
||||
} => {
|
||||
let mut dev = LuksDevice::load(device)?;
|
||||
let mut tokens = Vec::new();
|
||||
for token in dev.tokens()? {
|
||||
let (id, token) = token?;
|
||||
if let Some(token_id) = token_id {
|
||||
if id == *token_id {
|
||||
tokens.push((id, token));
|
||||
}
|
||||
} else {
|
||||
tokens.push((id, token));
|
||||
}
|
||||
}
|
||||
let count = tokens.len();
|
||||
for (id, mut token) in tokens {
|
||||
token.credential = token
|
||||
.credential
|
||||
.into_iter()
|
||||
.filter(|cred| !credentials.ids.0.iter().any(|h| &h.to_string() == cred))
|
||||
.collect();
|
||||
dev.update_token(id, &token)?;
|
||||
}
|
||||
println!("Updated {} tokens", count);
|
||||
Ok(())
|
||||
}
|
||||
TokenCommand::GC { device } => {
|
||||
let mut dev = LuksDevice::load(device)?;
|
||||
let mut creds: HashSet<String> = HashSet::new();
|
||||
let mut remove = Vec::new();
|
||||
for token in dev.tokens()? {
|
||||
let (id, token) = token?;
|
||||
if token.keyslots.is_empty() || token.credential.is_empty() {
|
||||
creds.extend(token.credential);
|
||||
remove.push(id);
|
||||
}
|
||||
}
|
||||
for id in remove.iter().rev() {
|
||||
dev.remove_token(*id)?;
|
||||
}
|
||||
println!(
|
||||
"Removed {} tokens, affected credentials: {}",
|
||||
remove.len(),
|
||||
creds.into_iter().collect::<Vec<_>>().join(",")
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
},
|
||||
Command::GenerateCompletions { shell, out_dir } => {
|
||||
Args::clap().gen_completions(
|
||||
env!("CARGO_PKG_NAME"),
|
||||
match shell.as_ref() {
|
||||
"bash" => Shell::Bash,
|
||||
"fish" => Shell::Fish,
|
||||
_ => unreachable!("structopt shouldn't allow us to reach this point"),
|
||||
},
|
||||
&out_dir,
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,299 +0,0 @@
|
||||
use std::fmt::{Display, Error, Formatter};
|
||||
use std::path::PathBuf;
|
||||
use std::str::FromStr;
|
||||
use structopt::clap::AppSettings;
|
||||
use structopt::StructOpt;
|
||||
|
||||
mod config;
|
||||
|
||||
pub use config::*;
|
||||
|
||||
#[derive(Debug, Eq, PartialEq, Clone)]
|
||||
pub struct HexEncoded(pub Vec<u8>);
|
||||
|
||||
impl Display for HexEncoded {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
|
||||
f.write_str(&hex::encode(&self.0))
|
||||
}
|
||||
}
|
||||
|
||||
impl AsRef<[u8]> for HexEncoded {
|
||||
fn as_ref(&self) -> &[u8] {
|
||||
&self.0[..]
|
||||
}
|
||||
}
|
||||
|
||||
impl FromStr for HexEncoded {
|
||||
type Err = hex::FromHexError;
|
||||
|
||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||
Ok(HexEncoded(hex::decode(s)?))
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Eq, PartialEq, Clone)]
|
||||
pub struct CommaSeparated<T: FromStr + Display>(pub Vec<T>);
|
||||
|
||||
impl<T: Display + FromStr> Display for CommaSeparated<T> {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
|
||||
for i in &self.0 {
|
||||
f.write_str(&i.to_string())?;
|
||||
f.write_str(",")?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
impl<T: Display + FromStr> FromStr for CommaSeparated<T> {
|
||||
type Err = <T as FromStr>::Err;
|
||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||
Ok(CommaSeparated(
|
||||
s.split(',')
|
||||
.map(|part| <T as FromStr>::from_str(part))
|
||||
.collect::<Result<Vec<_>, _>>()?,
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct Credentials {
|
||||
/// FIDO credential ids, separated by ',' generate using fido2luks credential
|
||||
#[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
|
||||
pub ids: CommaSeparated<HexEncoded>,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct AuthenticatorParameters {
|
||||
/// Request a PIN to unlock the authenticator
|
||||
#[structopt(short = "P", long = "pin")]
|
||||
pub pin: bool,
|
||||
|
||||
/// Location to read PIN from
|
||||
#[structopt(long = "pin-source", env = "FIDO2LUKS_PIN_SOURCE")]
|
||||
pub pin_source: Option<PathBuf>,
|
||||
|
||||
/// Await for an authenticator to be connected, timeout after n seconds
|
||||
#[structopt(
|
||||
long = "await-dev",
|
||||
name = "await-dev",
|
||||
env = "FIDO2LUKS_DEVICE_AWAIT",
|
||||
default_value = "15"
|
||||
)]
|
||||
pub await_time: u64,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct LuksParameters {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
pub device: PathBuf,
|
||||
|
||||
/// Try to unlock the device using a specifc keyslot, ignore all other slots
|
||||
#[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
|
||||
pub slot: Option<u32>,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt, Clone)]
|
||||
pub struct LuksModParameters {
|
||||
/// Number of milliseconds required to derive the volume decryption key
|
||||
/// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
|
||||
#[structopt(long = "kdf-time", name = "kdf-time")]
|
||||
pub kdf_time: Option<u64>,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct SecretParameters {
|
||||
/// Salt for secret generation, defaults to 'ask'
|
||||
///
|
||||
/// Options:{n}
|
||||
/// - ask : Prompt user using password helper{n}
|
||||
/// - file:<PATH> : Will read <FILE>{n}
|
||||
/// - string:<STRING> : Will use <STRING>, which will be handled like a password provided to the 'ask' option{n}
|
||||
#[structopt(
|
||||
name = "salt",
|
||||
long = "salt",
|
||||
env = "FIDO2LUKS_SALT",
|
||||
default_value = "ask"
|
||||
)]
|
||||
pub salt: SecretInput,
|
||||
/// Script used to obtain passwords, overridden by --interactive flag
|
||||
#[structopt(
|
||||
name = "password-helper",
|
||||
env = "FIDO2LUKS_PASSWORD_HELPER",
|
||||
default_value = "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
|
||||
)]
|
||||
pub password_helper: PasswordHelper,
|
||||
}
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub struct Args {
|
||||
/// Request passwords via Stdin instead of using the password helper
|
||||
#[structopt(short = "i", long = "interactive")]
|
||||
pub interactive: bool,
|
||||
#[structopt(subcommand)]
|
||||
pub command: Command,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt, Clone)]
|
||||
pub struct OtherSecret {
|
||||
/// Use a keyfile instead of a password
|
||||
#[structopt(short = "d", long = "keyfile", conflicts_with = "fido_device")]
|
||||
pub keyfile: Option<PathBuf>,
|
||||
/// Use another fido device instead of a password
|
||||
/// Note: this requires for the credential fot the other device to be passed as argument as well
|
||||
#[structopt(short = "f", long = "fido-device", conflicts_with = "keyfile")]
|
||||
pub fido_device: bool,
|
||||
}
|
||||
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub enum Command {
|
||||
#[structopt(name = "print-secret")]
|
||||
PrintSecret {
|
||||
/// Prints the secret as binary instead of hex encoded
|
||||
#[structopt(short = "b", long = "bin")]
|
||||
binary: bool,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
secret: SecretParameters,
|
||||
},
|
||||
/// Adds a generated key to the specified LUKS device
|
||||
#[structopt(name = "add-key")]
|
||||
AddKey {
|
||||
#[structopt(flatten)]
|
||||
luks: LuksParameters,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
secret: SecretParameters,
|
||||
/// Will wipe all other keys
|
||||
#[structopt(short = "e", long = "exclusive")]
|
||||
exclusive: bool,
|
||||
/// Will add an token to your LUKS 2 header, including the credential id
|
||||
#[structopt(short = "t", long = "token")]
|
||||
token: bool,
|
||||
#[structopt(flatten)]
|
||||
existing_secret: OtherSecret,
|
||||
#[structopt(flatten)]
|
||||
luks_mod: LuksModParameters,
|
||||
},
|
||||
/// Replace a previously added key with a password
|
||||
#[structopt(name = "replace-key")]
|
||||
ReplaceKey {
|
||||
#[structopt(flatten)]
|
||||
luks: LuksParameters,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
secret: SecretParameters,
|
||||
/// Add the password and keep the key
|
||||
#[structopt(short = "a", long = "add-password")]
|
||||
add_password: bool,
|
||||
/// Will add an token to your LUKS 2 header, including the credential id
|
||||
#[structopt(short = "t", long = "token")]
|
||||
token: bool,
|
||||
#[structopt(flatten)]
|
||||
replacement: OtherSecret,
|
||||
#[structopt(flatten)]
|
||||
luks_mod: LuksModParameters,
|
||||
},
|
||||
/// Open the LUKS device
|
||||
#[structopt(name = "open")]
|
||||
Open {
|
||||
#[structopt(flatten)]
|
||||
luks: LuksParameters,
|
||||
#[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
|
||||
name: String,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
secret: SecretParameters,
|
||||
#[structopt(short = "r", long = "max-retries", default_value = "0")]
|
||||
retries: i32,
|
||||
/// Pass SSD trim instructions to the underlying block device
|
||||
#[structopt(long = "allow-discards")]
|
||||
allow_discards: bool,
|
||||
},
|
||||
/// Open the LUKS device using credentials embedded in the LUKS 2 header
|
||||
#[structopt(name = "open-token")]
|
||||
OpenToken {
|
||||
#[structopt(flatten)]
|
||||
luks: LuksParameters,
|
||||
#[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
|
||||
name: String,
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
#[structopt(flatten)]
|
||||
secret: SecretParameters,
|
||||
#[structopt(short = "r", long = "max-retries", default_value = "0")]
|
||||
retries: i32,
|
||||
/// Pass SSD trim instructions to the underlying block device
|
||||
#[structopt(long = "allow-discards")]
|
||||
allow_discards: bool,
|
||||
},
|
||||
/// Generate a new FIDO credential
|
||||
#[structopt(name = "credential")]
|
||||
Credential {
|
||||
#[structopt(flatten)]
|
||||
authenticator: AuthenticatorParameters,
|
||||
/// Name to be displayed on the authenticator display
|
||||
#[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME", default_value = "fido2luks")]
|
||||
name: String,
|
||||
},
|
||||
/// Check if an authenticator is connected
|
||||
#[structopt(name = "connected")]
|
||||
Connected,
|
||||
Token(TokenCommand),
|
||||
/// Generate bash completion scripts
|
||||
#[structopt(name = "completions", setting = AppSettings::Hidden)]
|
||||
GenerateCompletions {
|
||||
/// Shell to generate completions for: bash, fish
|
||||
#[structopt(possible_values = &["bash", "fish"])]
|
||||
shell: String,
|
||||
out_dir: PathBuf,
|
||||
},
|
||||
}
|
||||
|
||||
///LUKS2 token related operations
|
||||
#[derive(Debug, StructOpt)]
|
||||
pub enum TokenCommand {
|
||||
/// List all tokens associated with the specified device
|
||||
List {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
/// Dump all credentials as CSV
|
||||
#[structopt(long = "csv")]
|
||||
csv: bool,
|
||||
},
|
||||
/// Add credential to a keyslot
|
||||
Add {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
/// Slot to which the credentials will be added
|
||||
#[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
|
||||
slot: u32,
|
||||
},
|
||||
/// Remove credentials from token(s)
|
||||
Remove {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
#[structopt(flatten)]
|
||||
credentials: Credentials,
|
||||
/// Token from which the credentials will be removed
|
||||
#[structopt(long = "token")]
|
||||
token_id: Option<u32>,
|
||||
},
|
||||
/// Remove all unassigned tokens
|
||||
GC {
|
||||
#[structopt(env = "FIDO2LUKS_DEVICE")]
|
||||
device: PathBuf,
|
||||
},
|
||||
}
|
||||
@ -10,33 +10,33 @@ use std::process::Command;
|
||||
use std::str::FromStr;
|
||||
|
||||
#[derive(Debug, Clone, PartialEq)]
|
||||
pub enum SecretInput {
|
||||
pub enum InputSalt {
|
||||
AskPassword,
|
||||
String(String),
|
||||
File { path: PathBuf },
|
||||
}
|
||||
|
||||
impl Default for SecretInput {
|
||||
impl Default for InputSalt {
|
||||
fn default() -> Self {
|
||||
SecretInput::AskPassword
|
||||
InputSalt::AskPassword
|
||||
}
|
||||
}
|
||||
|
||||
impl From<&str> for SecretInput {
|
||||
impl From<&str> for InputSalt {
|
||||
fn from(s: &str) -> Self {
|
||||
let mut parts = s.split(':');
|
||||
match parts.next() {
|
||||
Some("ask") | Some("Ask") => SecretInput::AskPassword,
|
||||
Some("file") => SecretInput::File {
|
||||
Some("ask") | Some("Ask") => InputSalt::AskPassword,
|
||||
Some("file") => InputSalt::File {
|
||||
path: parts.collect::<Vec<_>>().join(":").into(),
|
||||
},
|
||||
Some("string") => SecretInput::String(parts.collect::<Vec<_>>().join(":")),
|
||||
Some("string") => InputSalt::String(parts.collect::<Vec<_>>().join(":")),
|
||||
_ => Self::default(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FromStr for SecretInput {
|
||||
impl FromStr for InputSalt {
|
||||
type Err = Fido2LuksError;
|
||||
|
||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||
@ -44,42 +44,21 @@ impl FromStr for SecretInput {
|
||||
}
|
||||
}
|
||||
|
||||
impl fmt::Display for SecretInput {
|
||||
impl fmt::Display for InputSalt {
|
||||
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
|
||||
f.write_str(&match self {
|
||||
SecretInput::AskPassword => "ask".to_string(),
|
||||
SecretInput::String(s) => ["string", s].join(":"),
|
||||
SecretInput::File { path } => ["file", path.display().to_string().as_str()].join(":"),
|
||||
InputSalt::AskPassword => "ask".to_string(),
|
||||
InputSalt::String(s) => ["string", s].join(":"),
|
||||
InputSalt::File { path } => ["file", path.display().to_string().as_str()].join(":"),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
impl SecretInput {
|
||||
pub fn obtain_string(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<String> {
|
||||
Ok(String::from_utf8(self.obtain(password_helper)?)?)
|
||||
}
|
||||
|
||||
pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<Vec<u8>> {
|
||||
let mut secret = Vec::new();
|
||||
match self {
|
||||
SecretInput::File { path } => {
|
||||
//TODO: replace with try_blocks
|
||||
let mut do_io = || File::open(path)?.read_to_end(&mut secret);
|
||||
do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
|
||||
}
|
||||
SecretInput::AskPassword => {
|
||||
secret.extend_from_slice(password_helper.obtain()?.as_bytes())
|
||||
}
|
||||
|
||||
SecretInput::String(s) => secret.extend_from_slice(s.as_bytes()),
|
||||
}
|
||||
Ok(secret)
|
||||
}
|
||||
|
||||
pub fn obtain_sha256(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
|
||||
impl InputSalt {
|
||||
pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
|
||||
let mut digest = digest::Context::new(&digest::SHA256);
|
||||
match self {
|
||||
SecretInput::File { path } => {
|
||||
InputSalt::File { path } => {
|
||||
let mut do_io = || {
|
||||
let mut reader = File::open(path)?;
|
||||
let mut buf = [0u8; 512];
|
||||
@ -94,7 +73,10 @@ impl SecretInput {
|
||||
};
|
||||
do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
|
||||
}
|
||||
_ => digest.update(self.obtain(password_helper)?.as_slice()),
|
||||
InputSalt::AskPassword => {
|
||||
digest.update(password_helper.obtain()?.as_bytes());
|
||||
}
|
||||
InputSalt::String(s) => digest.update(s.as_bytes()),
|
||||
}
|
||||
let mut salt = [0u8; 32];
|
||||
salt.as_mut().copy_from_slice(digest.finish().as_ref());
|
||||
@ -102,7 +84,7 @@ impl SecretInput {
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, PartialEq, Eq)]
|
||||
#[derive(Debug, Clone)]
|
||||
pub enum PasswordHelper {
|
||||
Script(String),
|
||||
#[allow(dead_code)]
|
||||
@ -153,9 +135,10 @@ impl PasswordHelper {
|
||||
Systemd => unimplemented!(),
|
||||
Stdin => Ok(util::read_password("Password", true)?),
|
||||
Script(password_helper) => {
|
||||
let password = Command::new("sh")
|
||||
.arg("-c")
|
||||
.arg(&password_helper)
|
||||
let mut helper_parts = password_helper.split(' ');
|
||||
|
||||
let password = Command::new((&mut helper_parts).next().unwrap())
|
||||
.args(helper_parts)
|
||||
.output()
|
||||
.map_err(|e| Fido2LuksError::AskPassError {
|
||||
cause: error::AskPassError::IO(e),
|
||||
@ -175,30 +158,24 @@ mod test {
|
||||
#[test]
|
||||
fn input_salt_from_str() {
|
||||
assert_eq!(
|
||||
"file:/tmp/abc".parse::<SecretInput>().unwrap(),
|
||||
SecretInput::File {
|
||||
"file:/tmp/abc".parse::<InputSalt>().unwrap(),
|
||||
InputSalt::File {
|
||||
path: "/tmp/abc".into()
|
||||
}
|
||||
);
|
||||
assert_eq!(
|
||||
"string:abc".parse::<SecretInput>().unwrap(),
|
||||
SecretInput::String("abc".into())
|
||||
);
|
||||
assert_eq!(
|
||||
"ask".parse::<SecretInput>().unwrap(),
|
||||
SecretInput::AskPassword
|
||||
);
|
||||
assert_eq!(
|
||||
"lol".parse::<SecretInput>().unwrap(),
|
||||
SecretInput::default()
|
||||
"string:abc".parse::<InputSalt>().unwrap(),
|
||||
InputSalt::String("abc".into())
|
||||
);
|
||||
assert_eq!("ask".parse::<InputSalt>().unwrap(), InputSalt::AskPassword);
|
||||
assert_eq!("lol".parse::<InputSalt>().unwrap(), InputSalt::default());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn input_salt_obtain() {
|
||||
assert_eq!(
|
||||
SecretInput::String("abc".into())
|
||||
.obtain_sha256(&PasswordHelper::Stdin)
|
||||
InputSalt::String("abc".into())
|
||||
.obtain(&PasswordHelper::Stdin)
|
||||
.unwrap(),
|
||||
[
|
||||
186, 120, 22, 191, 143, 1, 207, 234, 65, 65, 64, 222, 93, 174, 34, 35, 176, 3, 97,
|
||||
@ -9,21 +9,13 @@ use std::time::Duration;
|
||||
|
||||
const RP_ID: &str = "fido2luks";
|
||||
|
||||
pub fn make_credential_id(
|
||||
name: Option<&str>,
|
||||
pin: Option<&str>,
|
||||
) -> Fido2LuksResult<FidoCredential> {
|
||||
pub fn make_credential_id(name: Option<&str>) -> Fido2LuksResult<FidoCredential> {
|
||||
let mut request = FidoCredentialRequestBuilder::default().rp_id(RP_ID);
|
||||
if let Some(user_name) = name {
|
||||
request = request.user_name(user_name);
|
||||
}
|
||||
let request = request.build().unwrap();
|
||||
let make_credential = |device: &mut FidoDevice| {
|
||||
if let Some(pin) = pin {
|
||||
device.unlock(pin)?;
|
||||
}
|
||||
device.make_hmac_credential(&request)
|
||||
};
|
||||
let make_credential = |device: &mut FidoDevice| device.make_hmac_credential(&request);
|
||||
Ok(request_multiple_devices(
|
||||
get_devices()?
|
||||
.iter_mut()
|
||||
@ -36,7 +28,6 @@ pub fn perform_challenge<'a>(
|
||||
credentials: &'a [&'a FidoCredential],
|
||||
salt: &[u8; 32],
|
||||
timeout: Duration,
|
||||
pin: Option<&str>,
|
||||
) -> Fido2LuksResult<([u8; 32], &'a FidoCredential)> {
|
||||
let request = FidoAssertionRequestBuilder::default()
|
||||
.rp_id(RP_ID)
|
||||
@ -44,9 +35,6 @@ pub fn perform_challenge<'a>(
|
||||
.build()
|
||||
.unwrap();
|
||||
let get_assertion = |device: &mut FidoDevice| {
|
||||
if let Some(pin) = pin {
|
||||
device.unlock(pin)?;
|
||||
}
|
||||
device.get_hmac_assertion(&request, &util::sha256(&[&salt[..]]), None)
|
||||
};
|
||||
let (credential, (secret, _)) = request_multiple_devices(
|
||||
|
||||
13
src/error.rs
13
src/error.rs
@ -1,9 +1,5 @@
|
||||
use ctap::FidoError;
|
||||
use libcryptsetup_rs::LibcryptErr;
|
||||
use std::io;
|
||||
use std::io::ErrorKind;
|
||||
use std::string::FromUtf8Error;
|
||||
use Fido2LuksError::*;
|
||||
|
||||
pub type Fido2LuksResult<T> = Result<T, Fido2LuksError>;
|
||||
|
||||
@ -79,11 +75,10 @@ impl LuksError {
|
||||
}
|
||||
}
|
||||
|
||||
impl From<LuksError> for Fido2LuksError {
|
||||
fn from(e: LuksError) -> Self {
|
||||
Fido2LuksError::LuksError { cause: e }
|
||||
}
|
||||
}
|
||||
use libcryptsetup_rs::LibcryptErr;
|
||||
use std::io::ErrorKind;
|
||||
use std::string::FromUtf8Error;
|
||||
use Fido2LuksError::*;
|
||||
|
||||
impl From<FidoError> for Fido2LuksError {
|
||||
fn from(e: FidoError) -> Self {
|
||||
|
||||
445
src/luks.rs
445
src/luks.rs
@ -1,263 +1,90 @@
|
||||
use crate::error::*;
|
||||
|
||||
use libcryptsetup_rs::{
|
||||
CryptActivateFlag, CryptActivateFlags, CryptDevice, CryptInit, CryptTokenInfo,
|
||||
EncryptionFormat, KeyslotInfo, TokenInput,
|
||||
CryptActivateFlags, CryptDevice, CryptInit, CryptTokenInfo, EncryptionFormat, KeyslotInfo,
|
||||
TokenInput,
|
||||
};
|
||||
use std::collections::{HashMap, HashSet};
|
||||
use std::path::Path;
|
||||
|
||||
pub struct LuksDevice {
|
||||
device: CryptDevice,
|
||||
luks2: Option<bool>,
|
||||
}
|
||||
|
||||
impl LuksDevice {
|
||||
pub fn load<P: AsRef<Path>>(path: P) -> Fido2LuksResult<LuksDevice> {
|
||||
fn load_device_handle<P: AsRef<Path>>(path: P) -> Fido2LuksResult<CryptDevice> {
|
||||
let mut device = CryptInit::init(path.as_ref())?;
|
||||
device.context_handle().load::<()>(None, None)?;
|
||||
Ok(Self {
|
||||
device,
|
||||
luks2: None,
|
||||
})
|
||||
Ok(device)
|
||||
}
|
||||
|
||||
pub fn is_luks2(&mut self) -> Fido2LuksResult<bool> {
|
||||
if let Some(luks2) = self.luks2 {
|
||||
Ok(luks2)
|
||||
} else {
|
||||
self.luks2 = Some(match self.device.format_handle().get_type()? {
|
||||
EncryptionFormat::Luks2 => true,
|
||||
_ => false,
|
||||
});
|
||||
self.is_luks2()
|
||||
fn check_luks2(device: &mut CryptDevice) -> Fido2LuksResult<()> {
|
||||
match device.format_handle().get_type()? {
|
||||
EncryptionFormat::Luks2 => Ok(()),
|
||||
_ => Err(Fido2LuksError::LuksError {
|
||||
cause: LuksError::Luks2Required,
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
||||
fn require_luks2(&mut self) -> Fido2LuksResult<()> {
|
||||
if !self.is_luks2()? {
|
||||
return Err(LuksError::Luks2Required.into());
|
||||
}
|
||||
Ok(())
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
struct Fido2LuksToken {
|
||||
#[serde(rename = "type")]
|
||||
type_: String,
|
||||
credential: Vec<String>,
|
||||
keyslots: Vec<String>,
|
||||
}
|
||||
|
||||
pub fn tokens<'a>(
|
||||
&'a mut self,
|
||||
) -> Fido2LuksResult<Box<dyn Iterator<Item = Fido2LuksResult<(u32, Fido2LuksToken)>> + 'a>>
|
||||
{
|
||||
self.require_luks2()?;
|
||||
Ok(Box::new(
|
||||
(0..32)
|
||||
.map(move |i| {
|
||||
let status = match self.device.token_handle().status(i) {
|
||||
Ok(status) => status,
|
||||
Err(err) => return Some(Err(Fido2LuksError::from(err))),
|
||||
};
|
||||
impl Fido2LuksToken {
|
||||
fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self {
|
||||
Self {
|
||||
type_: "fido2luks\0".into(), // Doubles as c style string
|
||||
credential: vec![hex::encode(credential_id)],
|
||||
keyslots: vec![slot.to_string()],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn open_container<P: AsRef<Path>>(path: P, name: &str, secret: &[u8]) -> Fido2LuksResult<()> {
|
||||
let mut device = load_device_handle(path)?;
|
||||
device
|
||||
.activate_handle()
|
||||
.activate_by_passphrase(Some(name), None, secret, CryptActivateFlags::empty())
|
||||
.map(|_slot| ())
|
||||
.map_err(|_e| Fido2LuksError::WrongSecret)
|
||||
}
|
||||
|
||||
pub fn open_container_token<P: AsRef<Path>>(
|
||||
path: P,
|
||||
name: &str,
|
||||
secret: Box<dyn Fn(Vec<String>) -> Fido2LuksResult<([u8; 32], String)>>,
|
||||
) -> Fido2LuksResult<()> {
|
||||
let mut device = load_device_handle(path)?;
|
||||
check_luks2(&mut device)?;
|
||||
|
||||
let mut creds = HashMap::new();
|
||||
for i in 0..256 {
|
||||
let status = device.token_handle().status(i)?;
|
||||
match status {
|
||||
CryptTokenInfo::Inactive => return None,
|
||||
CryptTokenInfo::Inactive => break,
|
||||
CryptTokenInfo::Internal(s)
|
||||
| CryptTokenInfo::InternalUnknown(s)
|
||||
| CryptTokenInfo::ExternalUnknown(s)
|
||||
| CryptTokenInfo::External(s)
|
||||
if &s != Fido2LuksToken::default_type() =>
|
||||
if &s != "fido2luks" =>
|
||||
{
|
||||
return None
|
||||
continue
|
||||
}
|
||||
_ => (),
|
||||
};
|
||||
let json = match self.device.token_handle().json_get(i) {
|
||||
Ok(json) => json,
|
||||
Err(err) => return Some(Err(Fido2LuksError::from(err))),
|
||||
};
|
||||
let json = device.token_handle().json_get(i)?;
|
||||
let info: Fido2LuksToken =
|
||||
match serde_json::from_value(json.clone()).map_err(|_| {
|
||||
Fido2LuksError::LuksError {
|
||||
serde_json::from_value(json.clone()).map_err(|_| Fido2LuksError::LuksError {
|
||||
cause: LuksError::InvalidToken(json.to_string()),
|
||||
}
|
||||
}) {
|
||||
Ok(info) => info,
|
||||
Err(err) => return Some(Err(Fido2LuksError::from(err))),
|
||||
};
|
||||
Some(Ok((i, info)))
|
||||
})
|
||||
.filter_map(|o| o),
|
||||
))
|
||||
}
|
||||
|
||||
pub fn find_token(&mut self, slot: u32) -> Fido2LuksResult<Option<(u32, Fido2LuksToken)>> {
|
||||
let slot_str = slot.to_string();
|
||||
for token in self.tokens()? {
|
||||
let (id, token) = token?;
|
||||
if token.keyslots.contains(&slot_str) {
|
||||
return Ok(Some((id, token)));
|
||||
}
|
||||
}
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
pub fn add_token(&mut self, data: &Fido2LuksToken) -> Fido2LuksResult<()> {
|
||||
self.require_luks2()?;
|
||||
self.device
|
||||
.token_handle()
|
||||
.json_set(TokenInput::AddToken(&serde_json::to_value(&data).unwrap()))?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn remove_token(&mut self, token: u32) -> Fido2LuksResult<()> {
|
||||
self.require_luks2()?;
|
||||
self.device
|
||||
.token_handle()
|
||||
.json_set(TokenInput::RemoveToken(token))?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn update_token(&mut self, token: u32, data: &Fido2LuksToken) -> Fido2LuksResult<()> {
|
||||
self.require_luks2()?;
|
||||
self.device
|
||||
.token_handle()
|
||||
.json_set(TokenInput::ReplaceToken(
|
||||
token,
|
||||
&serde_json::to_value(&data).unwrap(),
|
||||
))?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn add_key(
|
||||
&mut self,
|
||||
secret: &[u8],
|
||||
old_secret: &[u8],
|
||||
iteration_time: Option<u64>,
|
||||
credential_id: Option<&[u8]>,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
if let Some(millis) = iteration_time {
|
||||
self.device.settings_handle().set_iteration_time(millis)
|
||||
}
|
||||
let slot = self
|
||||
.device
|
||||
.keyslot_handle()
|
||||
.add_by_passphrase(None, old_secret, secret)?;
|
||||
if let Some(id) = credential_id {
|
||||
self.device.token_handle().json_set(TokenInput::AddToken(
|
||||
&serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
|
||||
))?;
|
||||
}
|
||||
|
||||
Ok(slot)
|
||||
}
|
||||
|
||||
pub fn remove_keyslots(&mut self, exclude: &[u32]) -> Fido2LuksResult<u32> {
|
||||
let mut destroyed = 0;
|
||||
let mut tokens = Vec::new();
|
||||
for slot in 0..256 {
|
||||
match self.device.keyslot_handle().status(slot)? {
|
||||
KeyslotInfo::Inactive => continue,
|
||||
KeyslotInfo::Active | KeyslotInfo::ActiveLast if !exclude.contains(&slot) => {
|
||||
if self.is_luks2()? {
|
||||
if let Some((id, _token)) = self.find_token(slot)? {
|
||||
tokens.push(id);
|
||||
}
|
||||
}
|
||||
self.device.keyslot_handle().destroy(slot)?;
|
||||
destroyed += 1;
|
||||
}
|
||||
KeyslotInfo::ActiveLast => break,
|
||||
_ => (),
|
||||
}
|
||||
if self.device.keyslot_handle().status(slot)? == KeyslotInfo::ActiveLast {
|
||||
break;
|
||||
}
|
||||
}
|
||||
// Ensure indices stay valid
|
||||
tokens.sort();
|
||||
for token in tokens.iter().rev() {
|
||||
self.remove_token(*token)?;
|
||||
}
|
||||
Ok(destroyed)
|
||||
}
|
||||
|
||||
pub fn replace_key(
|
||||
&mut self,
|
||||
secret: &[u8],
|
||||
old_secret: &[u8],
|
||||
iteration_time: Option<u64>,
|
||||
credential_id: Option<&[u8]>,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
if let Some(millis) = iteration_time {
|
||||
self.device.settings_handle().set_iteration_time(millis)
|
||||
}
|
||||
// Use activate dry-run to locate keyslot
|
||||
let slot = self.device.activate_handle().activate_by_passphrase(
|
||||
None,
|
||||
None,
|
||||
old_secret,
|
||||
CryptActivateFlags::empty(),
|
||||
)?;
|
||||
self.device.keyslot_handle().change_by_passphrase(
|
||||
Some(slot),
|
||||
Some(slot),
|
||||
old_secret,
|
||||
secret,
|
||||
)? as u32;
|
||||
if let Some(id) = credential_id {
|
||||
if self.is_luks2()? {
|
||||
let token = self.find_token(slot)?.map(|(t, _)| t);
|
||||
let json = serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap();
|
||||
if let Some(token) = token {
|
||||
self.device
|
||||
.token_handle()
|
||||
.json_set(TokenInput::ReplaceToken(token, &json))?;
|
||||
} else {
|
||||
self.device
|
||||
.token_handle()
|
||||
.json_set(TokenInput::AddToken(&json))?;
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(slot)
|
||||
}
|
||||
|
||||
pub fn activate(
|
||||
&mut self,
|
||||
name: &str,
|
||||
secret: &[u8],
|
||||
slot_hint: Option<u32>,
|
||||
allow_discard: bool,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
let mut flags = CryptActivateFlags::empty();
|
||||
if allow_discard {
|
||||
flags = CryptActivateFlags::new(vec![CryptActivateFlag::AllowDiscards]);
|
||||
}
|
||||
self.device
|
||||
.activate_handle()
|
||||
.activate_by_passphrase(Some(name), slot_hint, secret, flags)
|
||||
.map_err(LuksError::activate)
|
||||
}
|
||||
|
||||
pub fn activate_token(
|
||||
&mut self,
|
||||
name: &str,
|
||||
secret: impl Fn(Vec<String>) -> Fido2LuksResult<([u8; 32], String)>,
|
||||
slot_hint: Option<u32>,
|
||||
allow_discard: bool,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
if !self.is_luks2()? {
|
||||
return Err(LuksError::Luks2Required.into());
|
||||
}
|
||||
let mut creds: HashMap<String, HashSet<u32>> = HashMap::new();
|
||||
for token in self.tokens()? {
|
||||
let token = match token {
|
||||
Ok((_id, t)) => t,
|
||||
_ => continue, // An corrupted token should't lock the user out
|
||||
};
|
||||
})?;
|
||||
let slots = || {
|
||||
token
|
||||
.keyslots
|
||||
info.keyslots
|
||||
.iter()
|
||||
.filter_map(|slot| slot.parse::<u32>().ok())
|
||||
};
|
||||
for cred in token.credential.iter() {
|
||||
for cred in info.credential.iter().cloned() {
|
||||
creds
|
||||
.entry(cred.clone())
|
||||
.entry(cred)
|
||||
.or_insert_with(|| slots().collect::<HashSet<u32>>())
|
||||
.extend(slots());
|
||||
}
|
||||
@ -268,66 +95,140 @@ impl LuksDevice {
|
||||
});
|
||||
}
|
||||
let (secret, credential) = secret(creds.keys().cloned().collect())?;
|
||||
let empty;
|
||||
let slots = if let Some(slots) = creds.get(&credential) {
|
||||
slots
|
||||
} else {
|
||||
empty = HashSet::new();
|
||||
&empty
|
||||
};
|
||||
//Try slots associated with the credential used
|
||||
let slots = slots.iter().cloned().map(Option::Some).chain(
|
||||
std::iter::once(slot_hint) // Try slot hint if there is one
|
||||
.take(slot_hint.is_some() as usize)
|
||||
.chain(std::iter::once(None).take(slots.is_empty() as usize)), // Try all slots as last resort
|
||||
);
|
||||
let slots = creds.get(&credential).unwrap();
|
||||
let slots = slots
|
||||
.iter()
|
||||
.cloned()
|
||||
.map(Option::Some)
|
||||
.chain(std::iter::once(None).take(slots.is_empty() as usize));
|
||||
for slot in slots {
|
||||
match self.activate(name, &secret, slot, allow_discard) {
|
||||
match device
|
||||
.activate_handle()
|
||||
.activate_by_passphrase(Some(name), slot, &secret, CryptActivateFlags::empty())
|
||||
.map(|_slot| ())
|
||||
.map_err(LuksError::activate)
|
||||
{
|
||||
Err(Fido2LuksError::WrongSecret) => (),
|
||||
res => return res,
|
||||
}
|
||||
}
|
||||
Err(Fido2LuksError::WrongSecret)
|
||||
}
|
||||
|
||||
pub fn add_key<P: AsRef<Path>>(
|
||||
path: P,
|
||||
secret: &[u8],
|
||||
old_secret: &[u8],
|
||||
iteration_time: Option<u64>,
|
||||
credential_id: Option<&[u8]>,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
let mut device = load_device_handle(path)?;
|
||||
if let Some(millis) = iteration_time {
|
||||
device.settings_handle().set_iteration_time(millis)
|
||||
}
|
||||
let slot = device
|
||||
.keyslot_handle()
|
||||
.add_by_passphrase(None, old_secret, secret)?;
|
||||
if let Some(id) = credential_id {
|
||||
/* if let e @ Err(_) = check_luks2(&mut device) {
|
||||
//rollback
|
||||
device.keyslot_handle(Some(slot)).destroy()?;
|
||||
return e.map(|_| 0u32);
|
||||
}*/
|
||||
device.token_handle().json_set(TokenInput::AddToken(
|
||||
&serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
|
||||
))?;
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct Fido2LuksToken {
|
||||
#[serde(rename = "type")]
|
||||
pub type_: String,
|
||||
pub credential: HashSet<String>,
|
||||
pub keyslots: HashSet<String>,
|
||||
Ok(slot)
|
||||
}
|
||||
|
||||
impl Fido2LuksToken {
|
||||
pub fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self {
|
||||
Self::with_credentials(std::iter::once(credential_id), slot)
|
||||
}
|
||||
|
||||
pub fn with_credentials<I: IntoIterator<Item = B>, B: AsRef<[u8]>>(
|
||||
credentials: I,
|
||||
fn find_token(
|
||||
device: &mut CryptDevice,
|
||||
slot: u32,
|
||||
) -> Self {
|
||||
Self {
|
||||
credential: credentials
|
||||
.into_iter()
|
||||
.map(|cred| hex::encode(cred.as_ref()))
|
||||
.collect(),
|
||||
keyslots: vec![slot.to_string()].into_iter().collect(),
|
||||
..Default::default()
|
||||
) -> Fido2LuksResult<Option<(u32, Fido2LuksToken)>> {
|
||||
for i in 0..256 {
|
||||
let status = device.token_handle().status(i)?;
|
||||
match status {
|
||||
CryptTokenInfo::Inactive => break,
|
||||
CryptTokenInfo::Internal(s)
|
||||
| CryptTokenInfo::InternalUnknown(s)
|
||||
| CryptTokenInfo::ExternalUnknown(s)
|
||||
| CryptTokenInfo::External(s)
|
||||
if &s != "fido2luks" =>
|
||||
{
|
||||
continue
|
||||
}
|
||||
_ => (),
|
||||
};
|
||||
let json = device.token_handle().json_get(i)?;
|
||||
let info: Fido2LuksToken =
|
||||
serde_json::from_value(json.clone()).map_err(|_| Fido2LuksError::LuksError {
|
||||
cause: LuksError::InvalidToken(json.to_string()),
|
||||
})?;
|
||||
if info.keyslots.contains(&slot.to_string()) {
|
||||
return Ok(Some((i, info)));
|
||||
}
|
||||
}
|
||||
pub fn default_type() -> &'static str {
|
||||
"fido2luks"
|
||||
}
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
impl Default for Fido2LuksToken {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
type_: Self::default_type().into(),
|
||||
credential: HashSet::new(),
|
||||
keyslots: HashSet::new(),
|
||||
pub fn remove_keyslots<P: AsRef<Path>>(path: P, exclude: &[u32]) -> Fido2LuksResult<u32> {
|
||||
let mut device = load_device_handle(path)?;
|
||||
let mut destroyed = 0;
|
||||
let mut tokens = Vec::new();
|
||||
for slot in 0..256 {
|
||||
match device.keyslot_handle().status(slot)? {
|
||||
KeyslotInfo::Inactive => continue,
|
||||
KeyslotInfo::Active | KeyslotInfo::ActiveLast if !exclude.contains(&slot) => {
|
||||
if let Ok(_) = check_luks2(&mut device) {
|
||||
if let Some((token, _)) = dbg!(find_token(&mut device, slot))? {
|
||||
tokens.push(token);
|
||||
}
|
||||
}
|
||||
device.keyslot_handle().destroy(slot)?;
|
||||
destroyed += 1;
|
||||
}
|
||||
KeyslotInfo::ActiveLast => break,
|
||||
_ => (),
|
||||
}
|
||||
if device.keyslot_handle().status(slot)? == KeyslotInfo::ActiveLast {
|
||||
break;
|
||||
}
|
||||
}
|
||||
for token in tokens.iter() {
|
||||
device
|
||||
.token_handle()
|
||||
.json_set(TokenInput::RemoveToken(*token))?;
|
||||
}
|
||||
Ok(destroyed)
|
||||
}
|
||||
|
||||
pub fn replace_key<P: AsRef<Path>>(
|
||||
path: P,
|
||||
secret: &[u8],
|
||||
old_secret: &[u8],
|
||||
iteration_time: Option<u64>,
|
||||
credential_id: Option<&[u8]>,
|
||||
) -> Fido2LuksResult<u32> {
|
||||
let mut device = load_device_handle(path)?;
|
||||
// Set iteration time not sure wether this applies to luks2 as well
|
||||
if let Some(millis) = iteration_time {
|
||||
device.settings_handle().set_iteration_time(millis)
|
||||
}
|
||||
let slot = device
|
||||
.keyslot_handle()
|
||||
.change_by_passphrase(None, None, old_secret, secret)? as u32;
|
||||
if let Some(id) = credential_id {
|
||||
if check_luks2(&mut device).is_ok() {
|
||||
let token = find_token(&mut device, slot)?.map(|(t, _)| t);
|
||||
if let Some(token) = token {
|
||||
device.token_handle().json_set(TokenInput::ReplaceToken(
|
||||
token,
|
||||
&serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
|
||||
))?;
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(slot)
|
||||
}
|
||||
|
||||
28
src/main.rs
28
src/main.rs
@ -4,24 +4,50 @@ extern crate ctap_hmac as ctap;
|
||||
#[macro_use]
|
||||
extern crate serde_derive;
|
||||
use crate::cli::*;
|
||||
use crate::config::*;
|
||||
use crate::device::*;
|
||||
use crate::error::*;
|
||||
use std::io;
|
||||
use std::path::PathBuf;
|
||||
use std::process::exit;
|
||||
|
||||
mod cli;
|
||||
pub mod cli_args;
|
||||
mod config;
|
||||
mod device;
|
||||
mod error;
|
||||
mod luks;
|
||||
mod util;
|
||||
|
||||
fn assemble_secret(hmac_result: &[u8], salt: &[u8]) -> [u8; 32] {
|
||||
util::sha256(&[salt, hmac_result])
|
||||
}
|
||||
|
||||
fn main() -> Fido2LuksResult<()> {
|
||||
match run_cli() {
|
||||
Err(e) => {
|
||||
#[cfg(debug_assertions)]
|
||||
eprintln!("{:?}", e);
|
||||
#[cfg(not(debug_assertions))]
|
||||
eprintln!("{}", e);
|
||||
exit(e.exit_code())
|
||||
}
|
||||
_ => exit(0),
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod test {
|
||||
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn test_assemble_secret() {
|
||||
assert_eq!(
|
||||
assemble_secret(b"abc", b"def"),
|
||||
[
|
||||
46, 82, 82, 140, 142, 159, 249, 196, 227, 160, 142, 72, 151, 77, 59, 62, 180, 36,
|
||||
33, 47, 241, 94, 17, 232, 133, 103, 247, 32, 152, 253, 43, 19
|
||||
]
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@ -29,10 +29,6 @@ pub fn read_password(q: &str, verify: bool) -> Fido2LuksResult<String> {
|
||||
}
|
||||
}
|
||||
|
||||
pub fn read_password_hashed(q: &str, verify: bool) -> Fido2LuksResult<[u8; 32]> {
|
||||
read_password(q, verify).map(|pass| sha256(&[pass.as_bytes()]))
|
||||
}
|
||||
|
||||
pub fn read_keyfile<P: Into<PathBuf>>(path: P) -> Fido2LuksResult<Vec<u8>> {
|
||||
let mut file = File::open(path.into())?;
|
||||
let mut key = Vec::new();
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user