Compare commits
16 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
ddaf3f9264
|
|||
|
349807a6c4
|
|||
|
4e3d799179
|
|||
|
197d9f511c
|
|||
|
11ac32d3f1
|
|||
|
f6627d887b
|
|||
|
fbbf606631
|
|||
|
7879d64e3a
|
|||
|
31ee2dcbe7
|
|||
|
79849df284
|
|||
|
f2a8e412ac
|
|||
|
985f6f664b
|
|||
|
d4094b8a6a
|
|||
|
e524996693
|
|||
|
d6f6c7c218
|
|||
|
63f29249d3
|
@@ -12,7 +12,7 @@ steps:
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
commands:
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev libpam-dev
|
||||
- cargo test --locked
|
||||
- name: publish
|
||||
image: ubuntu:focal
|
||||
@@ -22,7 +22,7 @@ steps:
|
||||
from_secret: cargo_tkn
|
||||
commands:
|
||||
- grep -E 'version ?= ?"${DRONE_TAG}"' -i Cargo.toml || (printf "incorrect crate/tag version" && exit 1)
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev
|
||||
- apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev libpam-dev
|
||||
- cargo package --all-features
|
||||
- cargo publish --all-features
|
||||
when:
|
||||
|
||||
153
Cargo.lock
generated
153
Cargo.lock
generated
@@ -86,7 +86,7 @@ dependencies = [
|
||||
"lazycell",
|
||||
"log",
|
||||
"peeking_take_while",
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"regex",
|
||||
"rustc-hash",
|
||||
@@ -100,18 +100,6 @@ version = "1.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
|
||||
|
||||
[[package]]
|
||||
name = "bstr"
|
||||
version = "0.2.13"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "31accafdb70df7871592c058eca3985b71104e15ac32f64706022c58867da931"
|
||||
dependencies = [
|
||||
"lazy_static",
|
||||
"memchr",
|
||||
"regex-automata",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "byteorder"
|
||||
version = "1.3.4"
|
||||
@@ -130,9 +118,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "cc"
|
||||
version = "1.0.60"
|
||||
version = "1.0.59"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ef611cc68ff783f18535d77ddd080185275713d852c4f5cbb6122c462a7a825c"
|
||||
checksum = "66120af515773fb005778dc07c261bd201ec8ce50bd6e7144c927753fe013381"
|
||||
|
||||
[[package]]
|
||||
name = "cexpr"
|
||||
@@ -256,19 +244,6 @@ dependencies = [
|
||||
"lazy_static",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "csv"
|
||||
version = "1.1.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "00affe7f6ab566df61b4be3ce8cf16bc2576bca0963ceb0955e45d514bf9a279"
|
||||
dependencies = [
|
||||
"bstr",
|
||||
"csv-core",
|
||||
"itoa",
|
||||
"ryu",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "csv-core"
|
||||
version = "0.1.10"
|
||||
@@ -280,14 +255,14 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "ctap_hmac"
|
||||
version = "0.4.3"
|
||||
version = "0.4.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "33ccc28f298181e943187fa63805e652bc4806ad43708beebd22c230fbe0baa3"
|
||||
checksum = "c5fec79b66e3a7bc6a7ace0f4c98f0748892b36d3c5c317fadfce0344fd185dc"
|
||||
dependencies = [
|
||||
"byteorder",
|
||||
"cbor-codec",
|
||||
"crossbeam",
|
||||
"csv",
|
||||
"csv-core",
|
||||
"derive_builder",
|
||||
"failure",
|
||||
"failure_derive",
|
||||
@@ -296,8 +271,6 @@ dependencies = [
|
||||
"rand 0.6.5",
|
||||
"ring",
|
||||
"rust-crypto",
|
||||
"serde",
|
||||
"serde_derive",
|
||||
"untrusted",
|
||||
]
|
||||
|
||||
@@ -319,10 +292,10 @@ checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
|
||||
dependencies = [
|
||||
"fnv",
|
||||
"ident_case",
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"strsim 0.9.3",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -333,7 +306,7 @@ checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
|
||||
dependencies = [
|
||||
"darling_core",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -344,9 +317,9 @@ checksum = "a2658621297f2cf68762a6f7dc0bb7e1ff2cfd6583daef8ee0fed6f7ec468ec0"
|
||||
dependencies = [
|
||||
"darling",
|
||||
"derive_builder_core",
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -356,16 +329,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2791ea3e372c8495c0bc2033991d76b512cd799d07491fbd6890124db9458bef"
|
||||
dependencies = [
|
||||
"darling",
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "either"
|
||||
version = "1.6.1"
|
||||
version = "1.6.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
|
||||
checksum = "cd56b59865bce947ac5958779cfa508f6c3b9497cc762b7e24a12d11ccde2c4f"
|
||||
|
||||
[[package]]
|
||||
name = "env_logger"
|
||||
@@ -396,26 +369,28 @@ version = "0.1.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
"synstructure",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "fido2luks"
|
||||
version = "0.2.14"
|
||||
version = "0.2.15"
|
||||
dependencies = [
|
||||
"ctap_hmac",
|
||||
"failure",
|
||||
"hex",
|
||||
"libcryptsetup-rs",
|
||||
"pamsm",
|
||||
"ring",
|
||||
"rpassword",
|
||||
"serde",
|
||||
"serde_derive",
|
||||
"serde_json",
|
||||
"structopt",
|
||||
"sudo",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -459,9 +434,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "hermit-abi"
|
||||
version = "0.1.16"
|
||||
version = "0.1.15"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4c30f6d0bc6b00693347368a67d41b58f2fb851215ff1da49e90fe2c5c667151"
|
||||
checksum = "3deed196b6e7f9e44a2ae8d94225d80302d81208b1bb673fd21fe634645c85a9"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
@@ -507,9 +482,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
|
||||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.77"
|
||||
version = "0.2.76"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f2f96b10ec2560088a8e76961b00d47107b3a625fecb76dedb29ee7ccbf98235"
|
||||
checksum = "755456fae044e6fa1ebbbd1b3e902ae19e73097ed4ed87bb79934a867c007bc3"
|
||||
|
||||
[[package]]
|
||||
name = "libcryptsetup-rs"
|
||||
@@ -571,21 +546,20 @@ checksum = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400"
|
||||
|
||||
[[package]]
|
||||
name = "memoffset"
|
||||
version = "0.5.6"
|
||||
version = "0.5.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
|
||||
checksum = "c198b026e1bbf08a937e94c6c60f9ec4a2267f5b0d2eec9c1b21b061ce2be55f"
|
||||
dependencies = [
|
||||
"autocfg 1.0.1",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "miniz_oxide"
|
||||
version = "0.4.2"
|
||||
version = "0.4.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c60c0dfe32c10b43a144bad8fc83538c52f58302c92300ea7ec7bf7b38d5a7b9"
|
||||
checksum = "4d7559a8a40d0f97e1edea3220f698f78b1c5ab67532e49f68fde3910323b722"
|
||||
dependencies = [
|
||||
"adler",
|
||||
"autocfg 1.0.1",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -624,6 +598,12 @@ version = "0.20.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5"
|
||||
|
||||
[[package]]
|
||||
name = "pamsm"
|
||||
version = "0.4.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3580ed2ebe075c74db583233318abf4b07bc8d9a40c7691d0ae9c186e19e43dd"
|
||||
|
||||
[[package]]
|
||||
name = "peeking_take_while"
|
||||
version = "0.1.2"
|
||||
@@ -643,9 +623,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
|
||||
dependencies = [
|
||||
"proc-macro-error-attr",
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
"version_check",
|
||||
]
|
||||
|
||||
@@ -655,7 +635,7 @@ version = "1.0.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"version_check",
|
||||
]
|
||||
@@ -671,9 +651,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "proc-macro2"
|
||||
version = "1.0.21"
|
||||
version = "1.0.20"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "36e28516df94f3dd551a587da5357459d9b36d945a7c37c3557928c1c2ff2a2c"
|
||||
checksum = "175c513d55719db99da20232b06cda8bab6b83ec2d04e3283edf0213c37c1a29"
|
||||
dependencies = [
|
||||
"unicode-xid 0.2.1",
|
||||
]
|
||||
@@ -699,7 +679,7 @@ version = "1.0.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -852,15 +832,6 @@ dependencies = [
|
||||
"thread_local",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "regex-automata"
|
||||
version = "0.1.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ae1ded71d66a4a97f5e961fd0cb25a5f366a42a41570d16a763a69c092c26ae4"
|
||||
dependencies = [
|
||||
"byteorder",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "regex-syntax"
|
||||
version = "0.6.18"
|
||||
@@ -949,19 +920,19 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
|
||||
|
||||
[[package]]
|
||||
name = "serde"
|
||||
version = "1.0.116"
|
||||
version = "1.0.115"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "96fe57af81d28386a513cbc6858332abc6117cfdb5999647c6444b8f43a370a5"
|
||||
checksum = "e54c9a88f2da7238af84b5101443f0c0d0a3bbdc455e34a5c9497b1903ed55d5"
|
||||
|
||||
[[package]]
|
||||
name = "serde_derive"
|
||||
version = "1.0.116"
|
||||
version = "1.0.115"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f630a6370fd8e457873b4bd2ffdae75408bc291ba72be773772a4c2a065d9ae8"
|
||||
checksum = "609feed1d0a73cc36a0182a840a9b37b4a82f0b1150369f0536a9e3f2a31dc48"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -995,9 +966,9 @@ checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
|
||||
|
||||
[[package]]
|
||||
name = "structopt"
|
||||
version = "0.3.18"
|
||||
version = "0.3.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a33f6461027d7f08a13715659b2948e1602c31a3756aeae9378bfe7518c72e82"
|
||||
checksum = "6cc388d94ffabf39b5ed5fadddc40147cb21e605f53db6f8f36a625d27489ac5"
|
||||
dependencies = [
|
||||
"clap",
|
||||
"lazy_static",
|
||||
@@ -1006,15 +977,25 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "structopt-derive"
|
||||
version = "0.4.11"
|
||||
version = "0.4.10"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c92e775028122a4b3dd55d58f14fc5120289c69bee99df1d117ae30f84b225c9"
|
||||
checksum = "5e2513111825077552a6751dfad9e11ce0fba07d7276a3943a037d7e93e64c5f"
|
||||
dependencies = [
|
||||
"heck",
|
||||
"proc-macro-error",
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sudo"
|
||||
version = "0.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2a88e74edf206f281aff2820aa2066c781331044c770626dcafe19491f214e05"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"log",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1030,11 +1011,11 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "1.0.41"
|
||||
version = "1.0.40"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6690e3e9f692504b941dc6c3b188fd28df054f7fb8469ab40680df52fdcc842b"
|
||||
checksum = "963f7d3cc59b59b9325165add223142bbf1df27655d07789f109896d353d8350"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"unicode-xid 0.2.1",
|
||||
]
|
||||
@@ -1045,9 +1026,9 @@ version = "0.12.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b834f2d66f734cb897113e34aaff2f1ab4719ca946f9a7358dba8f8064148701"
|
||||
dependencies = [
|
||||
"proc-macro2 1.0.21",
|
||||
"proc-macro2 1.0.20",
|
||||
"quote 1.0.7",
|
||||
"syn 1.0.41",
|
||||
"syn 1.0.40",
|
||||
"unicode-xid 0.2.1",
|
||||
]
|
||||
|
||||
|
||||
17
Cargo.toml
17
Cargo.toml
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "fido2luks"
|
||||
version = "0.2.14"
|
||||
version = "0.2.15"
|
||||
authors = ["shimunn <shimun@shimun.net>"]
|
||||
edition = "2018"
|
||||
|
||||
@@ -24,6 +24,8 @@ libcryptsetup-rs = "0.4.1"
|
||||
serde_json = "1.0.51"
|
||||
serde_derive = "1.0.106"
|
||||
serde = "1.0.106"
|
||||
pamsm = { version = "0.4.1", features = ["libpam"] }
|
||||
sudo = "0.5.0"
|
||||
|
||||
[build-dependencies]
|
||||
ctap_hmac = { version="0.4.2", features = ["request_multiple"] }
|
||||
@@ -32,6 +34,7 @@ ring = "0.13.5"
|
||||
failure = "0.1.5"
|
||||
rpassword = "4.0.1"
|
||||
libcryptsetup-rs = "0.4.1"
|
||||
pamsm = { version = "0.4.1", features = ["libpam"] }
|
||||
structopt = "0.3.2"
|
||||
|
||||
[profile.release]
|
||||
@@ -41,12 +44,22 @@ panic = 'abort'
|
||||
incremental = false
|
||||
overflow-checks = false
|
||||
|
||||
[[bin]]
|
||||
name = "fido2luks"
|
||||
path = "src/main.rs"
|
||||
|
||||
[lib]
|
||||
name = "fido2luks_pam"
|
||||
path = "src/lib.rs"
|
||||
crate-type = ["cdylib"]
|
||||
|
||||
[package.metadata.deb]
|
||||
depends = "$auto, cryptsetup"
|
||||
build-depends = "libclang-dev, libcryptsetup-dev"
|
||||
build-depends = "libclang-dev, libcryptsetup-dev, libpam-dev"
|
||||
extended-description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator"
|
||||
assets = [
|
||||
["target/release/fido2luks", "usr/bin/", "755"],
|
||||
["target/release/libfido2luks_pam.so", "usr/lib/x86_64-linux-gnu/security/pam_fido2luks.so", "755"],
|
||||
["fido2luks.bash", "usr/share/bash-completion/completions/fido2luks", "644"],
|
||||
["initramfs-tools/keyscript.sh", "/lib/cryptsetup/scripts/fido2luks", "755" ],
|
||||
["initramfs-tools/hook/fido2luks.sh", "etc/initramfs-tools/hooks/", "755" ],
|
||||
|
||||
@@ -5,8 +5,6 @@ use structopt::clap::AppSettings;
|
||||
use structopt::StructOpt;
|
||||
|
||||
mod config;
|
||||
#[cfg(any(feature = "setup", test))]
|
||||
mod setup;
|
||||
|
||||
pub use config::*;
|
||||
|
||||
|
||||
@@ -1,94 +0,0 @@
|
||||
use crate::cli_args::SecretInput;
|
||||
use crate::error::Fido2LuksResult;
|
||||
use crate::luks::LuksDevice;
|
||||
use std::io::{stdin, BufRead, BufReader};
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
enum Setup {
|
||||
Welcome,
|
||||
Disks {
|
||||
disks: Vec<PathBuf>,
|
||||
},
|
||||
Unlocked {
|
||||
disks: Vec<LuksDevice>,
|
||||
current_secrets: Vec<Vec<u8>>,
|
||||
},
|
||||
Salt {
|
||||
disks: Vec<PathBuf>,
|
||||
current_secrets: Vec<Vec<u8>>,
|
||||
salt: SecretInput,
|
||||
},
|
||||
Config {
|
||||
salt: SecretInput,
|
||||
},
|
||||
}
|
||||
|
||||
impl Setup {
|
||||
fn description(&self) -> String {
|
||||
match self {
|
||||
Self::Welcome => {
|
||||
"Please enter the device path for all disks you want to protect".into()
|
||||
}
|
||||
_ => "".into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn next(self) -> Fido2LuksResult<Self> {
|
||||
println!("{}", self.description());
|
||||
Ok(match self {
|
||||
Self::Welcome => {
|
||||
let mut disks = Vec::new();
|
||||
for path in BufReader::new(stdin()).lines() {
|
||||
let path_string = path?;
|
||||
let path = match path_string.as_str() {
|
||||
"" => break,
|
||||
path => Path::new(path),
|
||||
};
|
||||
if path.exists() {
|
||||
disks.push(path.to_path_buf());
|
||||
} else {
|
||||
eprintln!(
|
||||
"{} does not exist, try again or hit enter to finish",
|
||||
path.display()
|
||||
);
|
||||
}
|
||||
}
|
||||
Self::Disks { disks }
|
||||
}
|
||||
Self::Disks { disks } => {
|
||||
let mut luks_devs = Vec::new();
|
||||
let add_dev = |path: &Path| -> Fido2LuksResult<Option<LuksDevice>> {
|
||||
match LuksDevice::load(path) {
|
||||
Ok(luks) => return Ok(Some(luks)),
|
||||
Err(dev) => {
|
||||
let mut ans = String::new();
|
||||
loop {
|
||||
eprint!("Failed to open {}\nIs it an LUKS device or could it be the mounted block device? Skip/Replace (s,r): ");
|
||||
stdin().read_line(&mut ans)?;
|
||||
match ans.as_str() {
|
||||
"s" => return Ok(None),
|
||||
"r" => {
|
||||
print!("Enter an new device path: ");
|
||||
stdin().read_line(&mut ans)?;
|
||||
let path = PathBuf::from(&ans);
|
||||
return add_dev(path.as_path());
|
||||
}
|
||||
_ => (),
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(None)
|
||||
};
|
||||
for dev in disks.iter() {
|
||||
let path = PathBuf::from(&dev);
|
||||
if let Some(luks) = add_dev(path.as_path()) {
|
||||
luks_devs.push(luks);
|
||||
}
|
||||
}
|
||||
unreachable!()
|
||||
}
|
||||
_ => unreachable!(),
|
||||
})
|
||||
}
|
||||
}
|
||||
39
src/error.rs
39
src/error.rs
@@ -1,10 +1,10 @@
|
||||
use ctap::FidoError;
|
||||
use libcryptsetup_rs::LibcryptErr;
|
||||
use pamsm::PamError;
|
||||
use std::io;
|
||||
use std::io::ErrorKind;
|
||||
use std::string::FromUtf8Error;
|
||||
use Fido2LuksError::*;
|
||||
|
||||
pub type Fido2LuksResult<T> = Result<T, Fido2LuksError>;
|
||||
|
||||
#[derive(Debug, Fail)]
|
||||
@@ -29,6 +29,10 @@ pub enum Fido2LuksError {
|
||||
WrongSecret,
|
||||
#[fail(display = "not an utf8 string")]
|
||||
StringEncodingError { cause: FromUtf8Error },
|
||||
#[fail(display = "elevated privileges required")]
|
||||
MissingPrivileges,
|
||||
#[fail(display = "{}", cause)]
|
||||
Configuration { cause: ConfigurationError },
|
||||
}
|
||||
|
||||
impl Fido2LuksError {
|
||||
@@ -50,6 +54,26 @@ pub enum AskPassError {
|
||||
IO(io::Error),
|
||||
#[fail(display = "provided passwords don't match")]
|
||||
Mismatch,
|
||||
#[fail(display = "unable to retrieve password: {}", _0)]
|
||||
Pam(PamError),
|
||||
}
|
||||
|
||||
impl From<PamError> for AskPassError {
|
||||
fn from(e: PamError) -> Self {
|
||||
AskPassError::Pam(e)
|
||||
}
|
||||
}
|
||||
|
||||
impl From<io::Error> for AskPassError {
|
||||
fn from(e: io::Error) -> Self {
|
||||
AskPassError::IO(e)
|
||||
}
|
||||
}
|
||||
|
||||
impl From<AskPassError> for Fido2LuksError {
|
||||
fn from(cause: AskPassError) -> Self {
|
||||
Fido2LuksError::AskPassError { cause }
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Fail)]
|
||||
@@ -112,3 +136,16 @@ impl From<FromUtf8Error> for Fido2LuksError {
|
||||
StringEncodingError { cause: e }
|
||||
}
|
||||
}
|
||||
#[derive(Debug, Fail)]
|
||||
pub enum ConfigurationError {
|
||||
#[fail(display = "config is missing some values: {:?}", _0)]
|
||||
Missing(Vec<String>),
|
||||
#[fail(display = "config attribute {} contains an invalid value: {}", _1, _0)]
|
||||
InvalidValue(String, String),
|
||||
}
|
||||
|
||||
impl From<ConfigurationError> for Fido2LuksError {
|
||||
fn from(cause: ConfigurationError) -> Fido2LuksError {
|
||||
Fido2LuksError::Configuration { cause }
|
||||
}
|
||||
}
|
||||
|
||||
183
src/lib.rs
Normal file
183
src/lib.rs
Normal file
@@ -0,0 +1,183 @@
|
||||
#[macro_use]
|
||||
extern crate failure;
|
||||
extern crate ctap_hmac as ctap;
|
||||
#[macro_use]
|
||||
extern crate serde_derive;
|
||||
use crate::cli_args::{CommaSeparated, HexEncoded};
|
||||
use crate::device::*;
|
||||
use crate::error::*;
|
||||
use crate::luks::*;
|
||||
use ctap::FidoCredential;
|
||||
use failure::_core::time::Duration;
|
||||
use pamsm::PamLibExt;
|
||||
use pamsm::*;
|
||||
use std::collections::{HashMap, HashSet};
|
||||
use std::path::Path;
|
||||
use std::str::FromStr;
|
||||
use sudo::{self, RunningAs};
|
||||
|
||||
pub mod cli_args;
|
||||
pub mod device;
|
||||
pub mod error;
|
||||
pub mod luks;
|
||||
pub mod util;
|
||||
|
||||
struct PamFido2Luks;
|
||||
|
||||
impl PamFido2Luks {
|
||||
fn open(
|
||||
&self,
|
||||
user: String,
|
||||
mut password: impl FnMut(&str) -> PamResult<String>,
|
||||
args: Vec<String>,
|
||||
) -> Fido2LuksResult<()> {
|
||||
let args: HashMap<String, String> = args
|
||||
.into_iter()
|
||||
.filter_map(|arg| {
|
||||
let mut parts = arg.split("=");
|
||||
parts
|
||||
.by_ref()
|
||||
.next()
|
||||
.map(|key| (key.to_string(), parts.collect::<Vec<_>>().join("=")))
|
||||
})
|
||||
.collect();
|
||||
|
||||
let credentials = match args.get("credentials").map(|creds| {
|
||||
<CommaSeparated<String>>::from_str(creds)
|
||||
.map(|cs| cs.0)
|
||||
.map_err(|_| ConfigurationError::InvalidValue("credentials".into(), creds.into()))
|
||||
}) {
|
||||
Some(creds) => creds?,
|
||||
_ => Vec::new(),
|
||||
};
|
||||
let pin = args.get("pin");
|
||||
let pin_prefix = args
|
||||
.get("pin-prefix")
|
||||
.map(|p| p.parse::<bool>().unwrap_or_default())
|
||||
.unwrap_or_default();
|
||||
let device = args
|
||||
.get("device")
|
||||
.map(|device| device.replace("%user%", user.as_str()));
|
||||
let name = args
|
||||
.get("name")
|
||||
.map(|name| name.replace("%user%", user.as_str()));
|
||||
|
||||
let mut attempts = args
|
||||
.get("attempts")
|
||||
.and_then(|a| a.parse::<usize>().ok())
|
||||
.unwrap_or(3);
|
||||
|
||||
if let (Some(device), Some(name)) = (device, name) {
|
||||
if !Path::new(&device).exists() || Path::new(&format!("/dev/mapper/{}", name)).exists()
|
||||
{
|
||||
return Ok(());
|
||||
}
|
||||
// root required to mount luks
|
||||
match sudo::check() {
|
||||
RunningAs::User => return Err(Fido2LuksError::MissingPrivileges),
|
||||
_ => {
|
||||
sudo::escalate_if_needed().map_err(|_| Fido2LuksError::MissingPrivileges)?;
|
||||
}
|
||||
}
|
||||
let mut device = LuksDevice::load(device)?;
|
||||
let mut additional_credentials: HashSet<String> = HashSet::new();
|
||||
if device.is_luks2()? {
|
||||
for token in device.tokens()? {
|
||||
let (_, token) = token?;
|
||||
additional_credentials.extend(token.credential.into_iter());
|
||||
}
|
||||
}
|
||||
let credentials: Vec<FidoCredential> = credentials
|
||||
.into_iter()
|
||||
.chain(additional_credentials.into_iter())
|
||||
.map(|cred| HexEncoded::from_str(cred.as_str()))
|
||||
.map(|cred| FidoCredential {
|
||||
id: cred.unwrap().0,
|
||||
public_key: None,
|
||||
})
|
||||
.collect();
|
||||
let credentials: Vec<&FidoCredential> = credentials.iter().collect();
|
||||
if !credentials.is_empty() {
|
||||
loop {
|
||||
let (pin, pass) = if pin_prefix {
|
||||
let password = password("PIN + FIDO2 salt (pin:password):")
|
||||
.map_err(|e| Fido2LuksError::AskPassError { cause: e.into() })?;
|
||||
let mut parts = password.split(":");
|
||||
(
|
||||
parts.next().map(|p| p.to_string()).or(pin.cloned()),
|
||||
parts.collect::<Vec<_>>().join(":"),
|
||||
)
|
||||
} else {
|
||||
(
|
||||
pin.cloned(),
|
||||
password("FIDO2 salt: ")
|
||||
.map_err(|e| Fido2LuksError::AskPassError { cause: e.into() })?,
|
||||
)
|
||||
};
|
||||
|
||||
let salt = util::sha256(&[pass.as_bytes()]);
|
||||
let secret = util::sha256(&[
|
||||
&salt,
|
||||
&perform_challenge(
|
||||
&credentials[..],
|
||||
&salt,
|
||||
Duration::from_secs(15),
|
||||
pin.as_ref().map(String::as_str),
|
||||
)?
|
||||
.0[..],
|
||||
]);
|
||||
match device.activate(name.as_str(), &secret[..], None) {
|
||||
Ok(_) => return Ok(()),
|
||||
_ if attempts > 0 => {
|
||||
attempts -= 1;
|
||||
continue;
|
||||
}
|
||||
Err(e) => break Err(e),
|
||||
}
|
||||
}
|
||||
} else {
|
||||
Err(ConfigurationError::Missing(vec!["credentials".into()]).into())
|
||||
}
|
||||
} else {
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl PamServiceModule for PamFido2Luks {
|
||||
fn authenticate(pamh: Pam, _flag: PamFlag, args: Vec<String>) -> PamError {
|
||||
let perfrom_authenticate = move || -> Fido2LuksResult<()> {
|
||||
let user = match pamh.get_cached_user() {
|
||||
Err(e) => Err(AskPassError::Pam(e))?,
|
||||
Ok(p) => p.map(|s| s.to_str().map(str::to_string).unwrap()),
|
||||
};
|
||||
let mut password = match pamh.get_authtok(None) {
|
||||
Err(e) => Err(AskPassError::Pam(e))?,
|
||||
Ok(p) => p.map(|s| s.to_str().map(str::to_string).unwrap()),
|
||||
};
|
||||
if let Some(user) = user {
|
||||
PamFido2Luks.open(
|
||||
user,
|
||||
move |q: &str| match password.take() {
|
||||
Some(pass) => Ok(pass),
|
||||
None => pamh
|
||||
.conv(Some(q), PamMsgStyle::PROMPT_ECHO_OFF)
|
||||
.map(|s| s.map(|s| s.to_str().unwrap()).unwrap_or("").to_string()),
|
||||
},
|
||||
args,
|
||||
)
|
||||
} else {
|
||||
Err(AskPassError::Pam(PamError::AUTH_ERR))?
|
||||
}
|
||||
};
|
||||
match perfrom_authenticate() {
|
||||
Ok(_) => PamError::SUCCESS,
|
||||
Err(e) => {
|
||||
eprintln!("{}", e);
|
||||
PamError::AUTH_ERR
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pam_module!(PamFido2Luks);
|
||||
Reference in New Issue
Block a user