diff options
Diffstat (limited to 'nitrokey')
27 files changed, 0 insertions, 5275 deletions
diff --git a/nitrokey/.builds/archlinux-msrv.yml b/nitrokey/.builds/archlinux-msrv.yml deleted file mode 100644 index 66c0390..0000000 --- a/nitrokey/.builds/archlinux-msrv.yml +++ /dev/null @@ -1,22 +0,0 @@ -# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -# SPDX-License-Identifier: CC0-1.0 -image: archlinux -packages: - - rustup - - libnitrokey -environment: - USE_SYSTEM_LIBNITROKEY: "1" -sources: - - https://git.ireas.org/nitrokey-rs -tasks: - - setup: | - rustup set profile minimal - rustup default 1.34.2 - - version: | - rustc -V - - build: | - cd nitrokey-rs - cargo build --release - - test: | - cd nitrokey-rs - cargo test diff --git a/nitrokey/.builds/archlinux-use-system-lib.yml b/nitrokey/.builds/archlinux-use-system-lib.yml deleted file mode 100644 index 29bda19..0000000 --- a/nitrokey/.builds/archlinux-use-system-lib.yml +++ /dev/null @@ -1,25 +0,0 @@ -# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -# SPDX-License-Identifier: CC0-1.0 -image: archlinux -packages: - - rust - - libnitrokey -environment: - USE_SYSTEM_LIBNITROKEY: "1" -sources: - - https://git.ireas.org/nitrokey-rs -tasks: - - version: | - rustc -V - - build: | - cd nitrokey-rs - cargo build --release - - test: | - cd nitrokey-rs - cargo test - - format: | - cd nitrokey-rs - cargo fmt -- --check - - clippy: | - cd nitrokey-rs - cargo clippy -- -D warnings diff --git a/nitrokey/.builds/archlinux.yml b/nitrokey/.builds/archlinux.yml deleted file mode 100644 index 151eb66..0000000 --- a/nitrokey/.builds/archlinux.yml +++ /dev/null @@ -1,16 +0,0 @@ -# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -# SPDX-License-Identifier: CC0-1.0 -image: archlinux -packages: - - rust - - hidapi - - gcc -sources: - - https://git.ireas.org/nitrokey-rs -tasks: - - build: | - cd nitrokey-rs - cargo build --release - - test: | - cd nitrokey-rs - cargo test diff --git a/nitrokey/.builds/lint.yml b/nitrokey/.builds/lint.yml deleted file mode 100644 index 678cde8..0000000 --- a/nitrokey/.builds/lint.yml +++ /dev/null @@ -1,16 +0,0 @@ -# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -# SPDX-License-Identifier: CC0-1.0 -image: archlinux -packages: - - gnupg - - reuse -sources: - - https://git.ireas.org/nitrokey-rs -tasks: - - verify: | - cd nitrokey-rs - curl -s "https://pgp.ireas.org/0x6D533958F070C57C.txt" | gpg --import - git verify-commit HEAD - - reuse: | - cd nitrokey-rs - reuse lint diff --git a/nitrokey/.gitignore b/nitrokey/.gitignore deleted file mode 100644 index 7ea18df..0000000 --- a/nitrokey/.gitignore +++ /dev/null @@ -1,7 +0,0 @@ -# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -# SPDX-License-Identifier: CC0-1.0 -/target -/nitrokey-sys/target -**/*.rs.bk -Cargo.lock -*.swp diff --git a/nitrokey/CHANGELOG.md b/nitrokey/CHANGELOG.md deleted file mode 100644 index d4451bc..0000000 --- a/nitrokey/CHANGELOG.md +++ /dev/null @@ -1,135 +0,0 @@ -<!--- -Copyright (C) 2019-2020 Robin Krahl <robin.krahl@ireas.org> -SPDX-License-Identifier: CC0-1.0 ---> - -# v0.4.0 (2020-01-02) -- Remove the `test-pro` and `test-storage` features. -- Implement `Display` for `Version`. -- Introduce `DEFAULT_ADMIN_PIN` and `DEFAULT_USER_PIN` constants. -- Refactor the error handling code: - - Implement `std::error::Error` for `CommandError`. - - Add the `Error` enum. - - Add the `LibraryError` enum and move the library error variants from - `CommandError` to `LibraryError`. - - Add the `CommunicationError` enum and move the communication error variants - from `CommandError` to `CommunicationError`. - - Return `Error` instead of `CommandError` in all public functions. - - Move the `CommandError::RngError` variant to `Error::RandError` and the - `CommandError::Unknown` variant to `Error::UnknownError`. - - Return `CommunicationError::NotConnected` instead of - `CommandError::Undefined` from the connect functions. - - Remove the `CommandError::Undefined` variant. -- Add a private `PhantomData` field to `Pro` and `Storage` to make direct - instantiation impossible. -- Refactor and clean up internal code: - - Prefer using the `Into` trait over numeric casting. - - Add `Pro::new` and `Storage::new` functions. -- Implement `From<Pro>` and `From<Storage>` for `DeviceWrapper`. -- Add `Error::Utf8Error` variant. - - Return `Result<Version>` instead of `Version` from `get_library_version`. - - Return `Error::Utf8Error` if libnitrokey returns an invalid UTF-8 string. -- Implement `From<(T: Device, Error)>` for `Error`. -- Fix timing issues with the `totp_no_pin` and `totp_pin` test cases. -- Always return a `Result` in functions that communicate with a device. -- Combine `get_{major,minor}_firmware_version` into `get_firmware_version`. -- Add `set_encrypted_volume_mode` to `Storage`. -- Use mutability to represent changes to the device status: - - Implement `DerefMut` for `User<T>` and `Admin<T>`. - - Add `device_mut` method to `DeviceWrapper`. - - Require a mutable `Device` reference if a method changes the device state. -- Update dependencies: - - `nitrokey-sys` to 3.5 - - `nitrokey-test` to 0.3 - - `rand_core` to 0.5 - - `rand_os` to 0.2 -- Add `nitrokey-test-state` dependency in version 0.1. -- Refactor connection management: - - Add `ConcurrentAccessError` and `PoisonError` `Error` variants. - - Add the `Manager` struct that manages connections to Nitrokey devices. - - Remove `connect`, `connect_model`, `Pro::connect` and `Storage::connect`. - - Add the `into_manager` function to the `Device` trait. - - Add the `force_take` function that ignores a `PoisonError` when accessing - the manager instance. -- Internally refactor the `device` module into submodules. - -# v0.3.5 (2019-12-16) -- Update the nitrokey-sys dependency version specification to ~3.4. - -# v0.3.4 (2019-01-20) -- Fix authentication methods that assumed that `char` is signed. - -# v0.3.3 (2019-01-16) -- Add the `get_production_info` and `clear_new_sd_card_warning` methods to the - `Storage` struct. -- Use `rand_os` instead of `rand` for random data creation. - - (Re-)add `CommandError::RngError` variant. -- Account for the possibility that an empty string returned by libnitrokey can - not only indicate an error but also be a valid return value. -- Make test cases more robust and avoid side effects on other test cases. - -# v0.3.2 (2019-01-12) -- Make three additional error codes known: `CommandError::StringTooLong`, - `CommandError::InvalidHexString` and `CommandError::TargetBufferTooSmall`. -- Add the `get_library_version` function to query the libnitrokey version. -- Add the `wink` method to the `Storage` struct. -- Add the `set_unencrypted_volume_mode` to set the access mode of the - unencrypted volume. -- Add the `export_firmware` method to the `Storage` struct. - -# v0.3.1 (2019-01-07) -- Use `nitrokey-test` to select and execute the unit tests. -- Add support for the hidden volumes on a Nitrokey Storage - (`enable_hidden_volume`, `disable_hidden_volume` and `create_hidden_volume` - methods for the `Storage` struct). -- Add the `connect_model` function to connect to a specific model using an enum - variant. - -# v0.3.0 (2019-01-04) -- Add a `force` argument to `ConfigureOtp::set_time`. -- Remove the obsolete `CommandError::RngError`. -- Add `CommandError::Undefined` to represent errors without further - information (e. g. a method returned `NULL` unexpectedly). -- Add error code to `CommandError::Unknown`. -- Add the `Storage::change_update_pin` method that changes the firmware update - PIN. -- Add the `Device::factory_reset` method that performs a factory reset. -- Add the `Device::build_aes_key` method that builds a new AES key on the Nitrokey. -- Add the `Storage::enable_firmware_update` method that puts the Nitrokey - Storage in update mode so that the firmware can be updated. - -# v0.2.3 (2018-12-31) - -- Dummy release to fix an issue with the crates.io tarball. - -# v0.2.2 (2018-12-30) - -- Update to Rust edition 2018. -- Remove the `test-no-device` feature. -- Update the rand dependency to version 0.6. -- Add function `Device::get_model` that returns the connected model. -- Derive the `Copy` and `Clone` traits for the enums `CommandError`, `LogLevel` - and `OtpMode` - -# v0.2.1 (2018-12-10) - -- Re-export `device::{StorageStatus, VolumeStatus}` in `lib.rs`. - -# v0.2.0 (2018-12-10) - -- Update to libnitrokey v3.4.1. -- Major refactoring of the existing code structure. -- Add support for most of the Nitrokey Pro features and some of the Nitrokey - Storage features. See the `TODO.md` file for more details about the missing - functionality. - -# v0.1.1 (2018-05-21) - -- Update the `nitrokey-sys` dependency to version 3.3.0. Now `libnitrokey` - is built from source and `bindgen` is no longer a build dependency. -- Add `get_minor_firmware_version` to `Device`. -- Use `NK_login_enum` instead of `NK_login` in `Device::connect`. - -# v0.1.0 (2018-05-19) - -- Initial release diff --git a/nitrokey/Cargo.toml b/nitrokey/Cargo.toml deleted file mode 100644 index b57591b..0000000 --- a/nitrokey/Cargo.toml +++ /dev/null @@ -1,27 +0,0 @@ -# Copyright (C) 2019-2020 Robin Krahl <robin.krahl@ireas.org> -# SPDX-License-Identifier: CC0-1.0 - -[package] -name = "nitrokey" -version = "0.4.0" -authors = ["Robin Krahl <robin.krahl@ireas.org>"] -edition = "2018" -homepage = "https://code.ireas.org/nitrokey-rs/" -repository = "https://git.ireas.org/nitrokey-rs/" -documentation = "https://docs.rs/nitrokey" -description = "Bindings to libnitrokey for communication with Nitrokey devices" -keywords = ["nitrokey", "otp"] -categories = ["api-bindings"] -readme = "README.md" -license = "MIT" -exclude = [".builds/*"] - -[dependencies] -lazy_static = "1.2" -libc = "0.2" -nitrokey-sys = "3.5" -rand_core = {version = "0.5.1", features = ["getrandom"] } - -[dev-dependencies] -nitrokey-test = "0.3" -nitrokey-test-state = "0.1" diff --git a/nitrokey/LICENSES/CC0-1.0.txt b/nitrokey/LICENSES/CC0-1.0.txt deleted file mode 100644 index 0e259d4..0000000 --- a/nitrokey/LICENSES/CC0-1.0.txt +++ /dev/null @@ -1,121 +0,0 @@ -Creative Commons Legal Code - -CC0 1.0 Universal - - CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE - LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN - ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS - INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES - REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS - PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM - THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED - HEREUNDER. - -Statement of Purpose - -The laws of most jurisdictions throughout the world automatically confer -exclusive Copyright and Related Rights (defined below) upon the creator -and subsequent owner(s) (each and all, an "owner") of an original work of -authorship and/or a database (each, a "Work"). - -Certain owners wish to permanently relinquish those rights to a Work for -the purpose of contributing to a commons of creative, cultural and -scientific works ("Commons") that the public can reliably and without fear -of later claims of infringement build upon, modify, incorporate in other -works, reuse and redistribute as freely as possible in any form whatsoever -and for any purposes, including without limitation commercial purposes. -These owners may contribute to the Commons to promote the ideal of a free -culture and the further production of creative, cultural and scientific -works, or to gain reputation or greater distribution for their Work in -part through the use and efforts of others. - -For these and/or other purposes and motivations, and without any -expectation of additional consideration or compensation, the person -associating CC0 with a Work (the "Affirmer"), to the extent that he or she -is an owner of Copyright and Related Rights in the Work, voluntarily -elects to apply CC0 to the Work and publicly distribute the Work under its -terms, with knowledge of his or her Copyright and Related Rights in the -Work and the meaning and intended legal effect of CC0 on those rights. - -1. Copyright and Related Rights. A Work made available under CC0 may be -protected by copyright and related or neighboring rights ("Copyright and -Related Rights"). Copyright and Related Rights include, but are not -limited to, the following: - - i. the right to reproduce, adapt, distribute, perform, display, - communicate, and translate a Work; - ii. moral rights retained by the original author(s) and/or performer(s); -iii. publicity and privacy rights pertaining to a person's image or - likeness depicted in a Work; - iv. rights protecting against unfair competition in regards to a Work, - subject to the limitations in paragraph 4(a), below; - v. rights protecting the extraction, dissemination, use and reuse of data - in a Work; - vi. database rights (such as those arising under Directive 96/9/EC of the - European Parliament and of the Council of 11 March 1996 on the legal - protection of databases, and under any national implementation - thereof, including any amended or successor version of such - directive); and -vii. other similar, equivalent or corresponding rights throughout the - world based on applicable law or treaty, and any national - implementations thereof. - -2. Waiver. To the greatest extent permitted by, but not in contravention -of, applicable law, Affirmer hereby overtly, fully, permanently, -irrevocably and unconditionally waives, abandons, and surrenders all of -Affirmer's Copyright and Related Rights and associated claims and causes -of action, whether now known or unknown (including existing as well as -future claims and causes of action), in the Work (i) in all territories -worldwide, (ii) for the maximum duration provided by applicable law or -treaty (including future time extensions), (iii) in any current or future -medium and for any number of copies, and (iv) for any purpose whatsoever, -including without limitation commercial, advertising or promotional -purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each -member of the public at large and to the detriment of Affirmer's heirs and -successors, fully intending that such Waiver shall not be subject to -revocation, rescission, cancellation, termination, or any other legal or -equitable action to disrupt the quiet enjoyment of the Work by the public -as contemplated by Affirmer's express Statement of Purpose. - -3. Public License Fallback. Should any part of the Waiver for any reason -be judged legally invalid or ineffective under applicable law, then the -Waiver shall be preserved to the maximum extent permitted taking into -account Affirmer's express Statement of Purpose. In addition, to the -extent the Waiver is so judged Affirmer hereby grants to each affected -person a royalty-free, non transferable, non sublicensable, non exclusive, -irrevocable and unconditional license to exercise Affirmer's Copyright and -Related Rights in the Work (i) in all territories worldwide, (ii) for the -maximum duration provided by applicable law or treaty (including future -time extensions), (iii) in any current or future medium and for any number -of copies, and (iv) for any purpose whatsoever, including without -limitation commercial, advertising or promotional purposes (the -"License"). The License shall be deemed effective as of the date CC0 was -applied by Affirmer to the Work. Should any part of the License for any -reason be judged legally invalid or ineffective under applicable law, such -partial invalidity or ineffectiveness shall not invalidate the remainder -of the License, and in such case Affirmer hereby affirms that he or she -will not (i) exercise any of his or her remaining Copyright and Related -Rights in the Work or (ii) assert any associated claims and causes of -action with respect to the Work, in either case contrary to Affirmer's -express Statement of Purpose. - -4. Limitations and Disclaimers. - - a. No trademark or patent rights held by Affirmer are waived, abandoned, - surrendered, licensed or otherwise affected by this document. - b. Affirmer offers the Work as-is and makes no representations or - warranties of any kind concerning the Work, express, implied, - statutory or otherwise, including without limitation warranties of - title, merchantability, fitness for a particular purpose, non - infringement, or the absence of latent or other defects, accuracy, or - the present or absence of errors, whether or not discoverable, all to - the greatest extent permissible under applicable law. - c. Affirmer disclaims responsibility for clearing rights of other persons - that may apply to the Work or any use thereof, including without - limitation any person's Copyright and Related Rights in the Work. - Further, Affirmer disclaims responsibility for obtaining any necessary - consents, permissions or other rights required for any use of the - Work. - d. Affirmer understands and acknowledges that Creative Commons is not a - party to this document and has no duty or obligation with respect to - this CC0 or use of the Work. diff --git a/nitrokey/LICENSES/MIT.txt b/nitrokey/LICENSES/MIT.txt deleted file mode 100644 index 6c67cd5..0000000 --- a/nitrokey/LICENSES/MIT.txt +++ /dev/null @@ -1,24 +0,0 @@ -Valid-License-Identifier: MIT -License-Text: - -The MIT License (MIT) - -Copyright (c) 2018 Robin Krahl <robin.krahl@ireas.org> - -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies -of the Software, and to permit persons to whom the Software is furnished to do -so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. diff --git a/nitrokey/README.md b/nitrokey/README.md deleted file mode 100644 index 12a9f6d..0000000 --- a/nitrokey/README.md +++ /dev/null @@ -1,92 +0,0 @@ -<!--- -Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -SPDX-License-Identifier: CC0-1.0 ---> - -# nitrokey-rs - -A libnitrokey wrapper for Rust providing access to Nitrokey devices. - -[Documentation][] - -## Compatibility - -The required [`libnitrokey`][] version is built from source. The host system -must provide `libhidapi-libusb0` (Linux) or `libhidapi` (non-Linux) in the -default library search path. Depending on your system, you might also have to -install the [Nitrokey udev rules][]. - -Currently, this crate provides access to the common features of the Nitrokey -Pro and the Nitrokey Storage: general configuration, OTP generation and the -password safe. Basic support for the secure storage on the Nitrokey Storage is -available but still under development. - -### Unsupported Functions - -The following functions provided by `libnitrokey` are deliberately not -supported by `nitrokey-rs`: - -- `NK_get_device_model`. We know which model we connected to, so we can - provide this information without calling `libnitrokey`. -- `NK_is_AES_supported`. This method is no longer needed for Nitrokey devices - with a recent firmware version. -- `NK_set_unencrypted_volume_rorw_pin_type_user`, - `NK_set_unencrypted_read_only`, `NK_set_unencrypted_read_write`. These - methods are only relevant for older firmware versions (pre-v0.51). As the - Nitrokey Storage firmware can be updated easily, we do not support these - outdated versions. -- `NK_totp_get_time`, `NK_status`. These functions are deprecated. -- `NK_read_HOTP_slot`. This function is only available for HOTP slots, not for - TOTP. We will support it once both types are supported by `libnitrokey`. -- All `*_as_string` functions that return string representations of data - returned by other functions. - -## Tests - -This crate has tests for different scenarios: Some tests require that no -Nitrokey device is connected, others require a Nitrokey Storage or a Nitrokey -Pro. We use the [`nitrokey-test`][] crate to select the test cases. You can -just run `cargo test` to auto-detect connected Nitrokey devices and to run the -appropriate tests. If you want to manually select the tests, set the -`NITROKEY_TEST_GROUP` environment variable to `nodev` (no device connected), -`pro` (Nitrokey Pro connected) or `storage` (Nitrokey Storage connected). - -Note that the tests assume that the device’s passwords are the factory defaults -(admin PIN `12345678`, user PIN `123456`, update password `12345678`) and that -an AES key has been built. Some tests will overwrite the data stored on the -Nitrokey device or perform a factory reset. Never execute the tests if you -don’t want to destroy all data on any connected Nitrokey device! - -## Acknowledgments - -Thanks to Nitrokey UG for providing two Nitrokey devices to support the -development of this crate. Thanks to Daniel Mueller for contributions to -`nitrokey-rs` and for the `nitrokey-test` crate. - -## Minimum Supported Rust Version - -This crate supports Rust 1.34.2 or later. - -## Contact - -For bug reports, patches, feature requests or other messages, please send a -mail to [nitrokey-rs-dev@ireas.org][]. - -## License - -This project is licensed under the [MIT][] license. The documentation and -configuration files contained in this repository are licensed under the -[Creative Commons Zero][CC0] license. You can find a copy of the license texts -in the `LICENSES` directory. `libnitrokey` is licensed under the [LGPL-3.0][]. - -`nitrokey-rs` complies with [version 3.0 of the REUSE specification][reuse]. - -[Documentation]: https://docs.rs/nitrokey -[Nitrokey udev rules]: https://www.nitrokey.com/documentation/frequently-asked-questions-faq#openpgp-card-not-available -[`libnitrokey`]: https://github.com/nitrokey/libnitrokey -[`nitrokey-test`]: https://github.com/d-e-s-o/nitrokey-test -[nitrokey-rs-dev@ireas.org]: mailto:nitrokey-rs-dev@ireas.org -[MIT]: https://opensource.org/licenses/MIT -[CC0]: https://creativecommons.org/publicdomain/zero/1.0/ -[LGPL-3.0]: https://opensource.org/licenses/lgpl-3.0.html -[reuse]: https://reuse.software/practices/3.0/ diff --git a/nitrokey/TODO.md b/nitrokey/TODO.md deleted file mode 100644 index 54525ef..0000000 --- a/nitrokey/TODO.md +++ /dev/null @@ -1,26 +0,0 @@ -<!--- -Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -SPDX-License-Identifier: CC0-1.0 ---> - -- Add support for the currently unsupported commands: - - `NK_send_startup` - - `NK_fill_SD_card_with_random_data` - - `NK_get_SD_usage_data` - - `NK_get_progress_bar_value` - - `NK_list_devices_by_cpuID` - - `NK_connect_with_ID` - - `NK_get_status` - - `NK_list_devices` - - `NK_free_device_info` - - `NK_connect_with_path` - - `NK_enable_firmware_update_pro` - - `NK_change_firmware_password_pro` -- Clear passwords from memory. -- Lock password safe in `PasswordSafe::drop()` (see [nitrokey-storage-firmware - issue 65][]). -- Disable creation of multiple password safes at the same time. -- Check timing in Storage tests. -- Consider restructuring `device::StorageStatus`. - -[nitrokey-storage-firmware issue 65]: https://github.com/Nitrokey/nitrokey-storage-firmware/issues/65 diff --git a/nitrokey/src/auth.rs b/nitrokey/src/auth.rs deleted file mode 100644 index cab1021..0000000 --- a/nitrokey/src/auth.rs +++ /dev/null @@ -1,437 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use std::convert::TryFrom as _; -use std::marker; -use std::ops; -use std::os::raw::c_char; -use std::os::raw::c_int; - -use nitrokey_sys; - -use crate::config::{Config, RawConfig}; -use crate::device::{Device, DeviceWrapper, Pro, Storage}; -use crate::error::Error; -use crate::otp::{ConfigureOtp, GenerateOtp, OtpMode, OtpSlotData, RawOtpSlotData}; -use crate::util::{generate_password, get_command_result, get_cstring, result_from_string}; - -static TEMPORARY_PASSWORD_LENGTH: usize = 25; - -/// Provides methods to authenticate as a user or as an admin using a PIN. The authenticated -/// methods will consume the current device instance. On success, they return the authenticated -/// device. Otherwise, they return the current unauthenticated device and the error code. -pub trait Authenticate<'a> { - /// Performs user authentication. This method consumes the device. If successful, an - /// authenticated device is returned. Otherwise, the current unauthenticated device and the - /// error are returned. - /// - /// This method generates a random temporary password that is used for all operations that - /// require user access. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided user password contains a null byte - /// - [`RngError`][] if the generation of the temporary password failed - /// - [`WrongPassword`][] if the provided user password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Authenticate, DeviceWrapper, User}; - /// # use nitrokey::Error; - /// - /// fn perform_user_task<'a>(device: &User<'a, DeviceWrapper<'a>>) {} - /// fn perform_other_task(device: &DeviceWrapper) {} - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let device = match device.authenticate_user("123456") { - /// Ok(user) => { - /// perform_user_task(&user); - /// user.device() - /// }, - /// Err((device, err)) => { - /// eprintln!("Could not authenticate as user: {}", err); - /// device - /// }, - /// }; - /// perform_other_task(&device); - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`RngError`]: enum.CommandError.html#variant.RngError - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)> - where - Self: Device<'a> + Sized; - - /// Performs admin authentication. This method consumes the device. If successful, an - /// authenticated device is returned. Otherwise, the current unauthenticated device and the - /// error are returned. - /// - /// This method generates a random temporary password that is used for all operations that - /// require admin access. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided admin password contains a null byte - /// - [`RngError`][] if the generation of the temporary password failed - /// - [`WrongPassword`][] if the provided admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Authenticate, Admin, DeviceWrapper}; - /// # use nitrokey::Error; - /// - /// fn perform_admin_task<'a>(device: &Admin<'a, DeviceWrapper<'a>>) {} - /// fn perform_other_task(device: &DeviceWrapper) {} - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let device = match device.authenticate_admin("123456") { - /// Ok(admin) => { - /// perform_admin_task(&admin); - /// admin.device() - /// }, - /// Err((device, err)) => { - /// eprintln!("Could not authenticate as admin: {}", err); - /// device - /// }, - /// }; - /// perform_other_task(&device); - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`RngError`]: enum.CommandError.html#variant.RngError - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)> - where - Self: Device<'a> + Sized; -} - -trait AuthenticatedDevice<T> { - fn new(device: T, temp_password: Vec<u8>) -> Self; - - fn temp_password_ptr(&self) -> *const c_char; -} - -/// A Nitrokey device with user authentication. -/// -/// To obtain an instance of this struct, use the [`authenticate_user`][] method from the -/// [`Authenticate`][] trait. To get back to an unauthenticated device, use the [`device`][] -/// method. -/// -/// [`Authenticate`]: trait.Authenticate.html -/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin -/// [`device`]: #method.device -#[derive(Debug)] -pub struct User<'a, T: Device<'a>> { - device: T, - temp_password: Vec<u8>, - marker: marker::PhantomData<&'a T>, -} - -/// A Nitrokey device with admin authentication. -/// -/// To obtain an instance of this struct, use the [`authenticate_admin`][] method from the -/// [`Authenticate`][] trait. To get back to an unauthenticated device, use the [`device`][] -/// method. -/// -/// [`Authenticate`]: trait.Authenticate.html -/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin -/// [`device`]: #method.device -#[derive(Debug)] -pub struct Admin<'a, T: Device<'a>> { - device: T, - temp_password: Vec<u8>, - marker: marker::PhantomData<&'a T>, -} - -fn authenticate<'a, D, A, T>(device: D, password: &str, callback: T) -> Result<A, (D, Error)> -where - D: Device<'a>, - A: AuthenticatedDevice<D>, - T: Fn(*const c_char, *const c_char) -> c_int, -{ - let temp_password = match generate_password(TEMPORARY_PASSWORD_LENGTH) { - Ok(temp_password) => temp_password, - Err(err) => return Err((device, err)), - }; - let password = match get_cstring(password) { - Ok(password) => password, - Err(err) => return Err((device, err)), - }; - let password_ptr = password.as_ptr(); - let temp_password_ptr = temp_password.as_ptr() as *const c_char; - match callback(password_ptr, temp_password_ptr) { - 0 => Ok(A::new(device, temp_password)), - rv => Err((device, Error::from(rv))), - } -} - -fn authenticate_user_wrapper<'a, T, C>( - device: T, - constructor: C, - password: &str, -) -> Result<User<'a, DeviceWrapper<'a>>, (DeviceWrapper<'a>, Error)> -where - T: Device<'a> + 'a, - C: Fn(T) -> DeviceWrapper<'a>, -{ - let result = device.authenticate_user(password); - match result { - Ok(user) => Ok(User::new(constructor(user.device), user.temp_password)), - Err((device, err)) => Err((constructor(device), err)), - } -} - -fn authenticate_admin_wrapper<'a, T, C>( - device: T, - constructor: C, - password: &str, -) -> Result<Admin<'a, DeviceWrapper<'a>>, (DeviceWrapper<'a>, Error)> -where - T: Device<'a> + 'a, - C: Fn(T) -> DeviceWrapper<'a>, -{ - let result = device.authenticate_admin(password); - match result { - Ok(user) => Ok(Admin::new(constructor(user.device), user.temp_password)), - Err((device, err)) => Err((constructor(device), err)), - } -} - -impl<'a, T: Device<'a>> User<'a, T> { - /// Forgets the user authentication and returns an unauthenticated device. This method - /// consumes the authenticated device. It does not perform any actual commands on the - /// Nitrokey. - pub fn device(self) -> T { - self.device - } -} - -impl<'a, T: Device<'a>> ops::Deref for User<'a, T> { - type Target = T; - - fn deref(&self) -> &Self::Target { - &self.device - } -} - -impl<'a, T: Device<'a>> ops::DerefMut for User<'a, T> { - fn deref_mut(&mut self) -> &mut T { - &mut self.device - } -} - -impl<'a, T: Device<'a>> GenerateOtp for User<'a, T> { - fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { - nitrokey_sys::NK_get_hotp_code_PIN(slot, self.temp_password_ptr()) - }) - } - - fn get_totp_code(&self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { - nitrokey_sys::NK_get_totp_code_PIN(slot, 0, 0, 0, self.temp_password_ptr()) - }) - } -} - -impl<'a, T: Device<'a>> AuthenticatedDevice<T> for User<'a, T> { - fn new(device: T, temp_password: Vec<u8>) -> Self { - User { - device, - temp_password, - marker: marker::PhantomData, - } - } - - fn temp_password_ptr(&self) -> *const c_char { - self.temp_password.as_ptr() as *const c_char - } -} - -impl<'a, T: Device<'a>> ops::Deref for Admin<'a, T> { - type Target = T; - - fn deref(&self) -> &Self::Target { - &self.device - } -} - -impl<'a, T: Device<'a>> ops::DerefMut for Admin<'a, T> { - fn deref_mut(&mut self) -> &mut T { - &mut self.device - } -} - -impl<'a, T: Device<'a>> Admin<'a, T> { - /// Forgets the user authentication and returns an unauthenticated device. This method - /// consumes the authenticated device. It does not perform any actual commands on the - /// Nitrokey. - pub fn device(self) -> T { - self.device - } - - /// Writes the given configuration to the Nitrokey device. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if the provided numlock, capslock or scrolllock slot is larger than two - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Authenticate, Config}; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let config = Config::new(None, None, None, false); - /// match device.authenticate_admin("12345678") { - /// Ok(mut admin) => { - /// admin.write_config(config); - /// () - /// }, - /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - pub fn write_config(&mut self, config: Config) -> Result<(), Error> { - let raw_config = RawConfig::try_from(config)?; - get_command_result(unsafe { - nitrokey_sys::NK_write_config( - raw_config.numlock, - raw_config.capslock, - raw_config.scrollock, - raw_config.user_password, - false, - self.temp_password_ptr(), - ) - }) - } -} - -impl<'a, T: Device<'a>> ConfigureOtp for Admin<'a, T> { - fn write_hotp_slot(&mut self, data: OtpSlotData, counter: u64) -> Result<(), Error> { - let raw_data = RawOtpSlotData::new(data)?; - get_command_result(unsafe { - nitrokey_sys::NK_write_hotp_slot( - raw_data.number, - raw_data.name.as_ptr(), - raw_data.secret.as_ptr(), - counter, - raw_data.mode == OtpMode::EightDigits, - raw_data.use_enter, - raw_data.use_token_id, - raw_data.token_id.as_ptr(), - self.temp_password_ptr(), - ) - }) - } - - fn write_totp_slot(&mut self, data: OtpSlotData, time_window: u16) -> Result<(), Error> { - let raw_data = RawOtpSlotData::new(data)?; - get_command_result(unsafe { - nitrokey_sys::NK_write_totp_slot( - raw_data.number, - raw_data.name.as_ptr(), - raw_data.secret.as_ptr(), - time_window, - raw_data.mode == OtpMode::EightDigits, - raw_data.use_enter, - raw_data.use_token_id, - raw_data.token_id.as_ptr(), - self.temp_password_ptr(), - ) - }) - } - - fn erase_hotp_slot(&mut self, slot: u8) -> Result<(), Error> { - get_command_result(unsafe { - nitrokey_sys::NK_erase_hotp_slot(slot, self.temp_password_ptr()) - }) - } - - fn erase_totp_slot(&mut self, slot: u8) -> Result<(), Error> { - get_command_result(unsafe { - nitrokey_sys::NK_erase_totp_slot(slot, self.temp_password_ptr()) - }) - } -} - -impl<'a, T: Device<'a>> AuthenticatedDevice<T> for Admin<'a, T> { - fn new(device: T, temp_password: Vec<u8>) -> Self { - Admin { - device, - temp_password, - marker: marker::PhantomData, - } - } - - fn temp_password_ptr(&self) -> *const c_char { - self.temp_password.as_ptr() as *const c_char - } -} - -impl<'a> Authenticate<'a> for DeviceWrapper<'a> { - fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)> { - match self { - DeviceWrapper::Storage(storage) => { - authenticate_user_wrapper(storage, DeviceWrapper::Storage, password) - } - DeviceWrapper::Pro(pro) => authenticate_user_wrapper(pro, DeviceWrapper::Pro, password), - } - } - - fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)> { - match self { - DeviceWrapper::Storage(storage) => { - authenticate_admin_wrapper(storage, DeviceWrapper::Storage, password) - } - DeviceWrapper::Pro(pro) => { - authenticate_admin_wrapper(pro, DeviceWrapper::Pro, password) - } - } - } -} - -impl<'a> Authenticate<'a> for Pro<'a> { - fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)> { - authenticate(self, password, |password_ptr, temp_password_ptr| unsafe { - nitrokey_sys::NK_user_authenticate(password_ptr, temp_password_ptr) - }) - } - - fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)> { - authenticate(self, password, |password_ptr, temp_password_ptr| unsafe { - nitrokey_sys::NK_first_authenticate(password_ptr, temp_password_ptr) - }) - } -} - -impl<'a> Authenticate<'a> for Storage<'a> { - fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)> { - authenticate(self, password, |password_ptr, temp_password_ptr| unsafe { - nitrokey_sys::NK_user_authenticate(password_ptr, temp_password_ptr) - }) - } - - fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)> { - authenticate(self, password, |password_ptr, temp_password_ptr| unsafe { - nitrokey_sys::NK_first_authenticate(password_ptr, temp_password_ptr) - }) - } -} diff --git a/nitrokey/src/config.rs b/nitrokey/src/config.rs deleted file mode 100644 index cb678d7..0000000 --- a/nitrokey/src/config.rs +++ /dev/null @@ -1,106 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use std::convert; - -use crate::error::{Error, LibraryError}; - -/// The configuration for a Nitrokey. -#[derive(Clone, Copy, Debug, PartialEq)] -pub struct Config { - /// If set, the stick will generate a code from the HOTP slot with the given number if numlock - /// is pressed. The slot number must be 0, 1 or 2. - pub numlock: Option<u8>, - /// If set, the stick will generate a code from the HOTP slot with the given number if capslock - /// is pressed. The slot number must be 0, 1 or 2. - pub capslock: Option<u8>, - /// If set, the stick will generate a code from the HOTP slot with the given number if - /// scrollock is pressed. The slot number must be 0, 1 or 2. - pub scrollock: Option<u8>, - /// If set, OTP generation using [`get_hotp_code`][] or [`get_totp_code`][] requires user - /// authentication. Otherwise, OTPs can be generated without authentication. - /// - /// [`get_hotp_code`]: trait.ProvideOtp.html#method.get_hotp_code - /// [`get_totp_code`]: trait.ProvideOtp.html#method.get_totp_code - pub user_password: bool, -} - -#[derive(Debug)] -pub struct RawConfig { - pub numlock: u8, - pub capslock: u8, - pub scrollock: u8, - pub user_password: bool, -} - -fn config_otp_slot_to_option(value: u8) -> Option<u8> { - if value < 3 { - Some(value) - } else { - None - } -} - -fn option_to_config_otp_slot(value: Option<u8>) -> Result<u8, Error> { - if let Some(value) = value { - if value < 3 { - Ok(value) - } else { - Err(LibraryError::InvalidSlot.into()) - } - } else { - Ok(255) - } -} - -impl Config { - /// Constructs a new instance of this struct. - pub fn new( - numlock: Option<u8>, - capslock: Option<u8>, - scrollock: Option<u8>, - user_password: bool, - ) -> Config { - Config { - numlock, - capslock, - scrollock, - user_password, - } - } -} - -impl convert::TryFrom<Config> for RawConfig { - type Error = Error; - - fn try_from(config: Config) -> Result<RawConfig, Error> { - Ok(RawConfig { - numlock: option_to_config_otp_slot(config.numlock)?, - capslock: option_to_config_otp_slot(config.capslock)?, - scrollock: option_to_config_otp_slot(config.scrollock)?, - user_password: config.user_password, - }) - } -} - -impl From<[u8; 5]> for RawConfig { - fn from(data: [u8; 5]) -> Self { - RawConfig { - numlock: data[0], - capslock: data[1], - scrollock: data[2], - user_password: data[3] != 0, - } - } -} - -impl Into<Config> for RawConfig { - fn into(self) -> Config { - Config { - numlock: config_otp_slot_to_option(self.numlock), - capslock: config_otp_slot_to_option(self.capslock), - scrollock: config_otp_slot_to_option(self.scrollock), - user_password: self.user_password, - } - } -} diff --git a/nitrokey/src/device/mod.rs b/nitrokey/src/device/mod.rs deleted file mode 100644 index 5e15f08..0000000 --- a/nitrokey/src/device/mod.rs +++ /dev/null @@ -1,464 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -mod pro; -mod storage; -mod wrapper; - -use std::fmt; - -use libc; -use nitrokey_sys; - -use crate::auth::Authenticate; -use crate::config::{Config, RawConfig}; -use crate::error::{CommunicationError, Error}; -use crate::otp::GenerateOtp; -use crate::pws::GetPasswordSafe; -use crate::util::{ - get_command_result, get_cstring, get_last_error, result_from_string, result_or_error, -}; - -pub use pro::Pro; -pub use storage::{ - SdCardData, Storage, StorageProductionInfo, StorageStatus, VolumeMode, VolumeStatus, -}; -pub use wrapper::DeviceWrapper; - -/// Available Nitrokey models. -#[derive(Clone, Copy, Debug, PartialEq)] -pub enum Model { - /// The Nitrokey Storage. - Storage, - /// The Nitrokey Pro. - Pro, -} - -impl fmt::Display for Model { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - f.write_str(match *self { - Model::Pro => "Pro", - Model::Storage => "Storage", - }) - } -} - -/// A firmware version for a Nitrokey device. -#[derive(Clone, Copy, Debug, PartialEq)] -pub struct FirmwareVersion { - /// The major firmware version, e. g. 0 in v0.40. - pub major: u8, - /// The minor firmware version, e. g. 40 in v0.40. - pub minor: u8, -} - -impl fmt::Display for FirmwareVersion { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - write!(f, "v{}.{}", self.major, self.minor) - } -} - -/// A Nitrokey device. -/// -/// This trait provides the commands that can be executed without authentication and that are -/// present on all supported Nitrokey devices. -pub trait Device<'a>: Authenticate<'a> + GetPasswordSafe<'a> + GenerateOtp + fmt::Debug { - /// Returns the [`Manager`][] instance that has been used to connect to this device. - /// - /// # Example - /// - /// ``` - /// use nitrokey::{Device, DeviceWrapper}; - /// - /// fn do_something(device: DeviceWrapper) { - /// // reconnect to any device - /// let manager = device.into_manager(); - /// let device = manager.connect(); - /// // do something with the device - /// // ... - /// } - /// - /// match nitrokey::take()?.connect() { - /// Ok(device) => do_something(device), - /// Err(err) => println!("Could not connect to a Nitrokey: {}", err), - /// } - /// # Ok::<(), nitrokey::Error>(()) - /// ``` - fn into_manager(self) -> &'a mut crate::Manager; - - /// Returns the model of the connected Nitrokey device. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// println!("Connected to a Nitrokey {}", device.get_model()); - /// # Ok(()) - /// # } - fn get_model(&self) -> Model; - - /// Returns the serial number of the Nitrokey device. The serial number is the string - /// representation of a hex number. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// match device.get_serial_number() { - /// Ok(number) => println!("serial no: {}", number), - /// Err(err) => eprintln!("Could not get serial number: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - fn get_serial_number(&self) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_device_serial_number() }) - } - - /// Returns the number of remaining authentication attempts for the user. The total number of - /// available attempts is three. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let count = device.get_user_retry_count(); - /// match device.get_user_retry_count() { - /// Ok(count) => println!("{} remaining authentication attempts (user)", count), - /// Err(err) => eprintln!("Could not get user retry count: {}", err), - /// } - /// # Ok(()) - /// # } - /// ``` - fn get_user_retry_count(&self) -> Result<u8, Error> { - result_or_error(unsafe { nitrokey_sys::NK_get_user_retry_count() }) - } - - /// Returns the number of remaining authentication attempts for the admin. The total number of - /// available attempts is three. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let count = device.get_admin_retry_count(); - /// match device.get_admin_retry_count() { - /// Ok(count) => println!("{} remaining authentication attempts (admin)", count), - /// Err(err) => eprintln!("Could not get admin retry count: {}", err), - /// } - /// # Ok(()) - /// # } - /// ``` - fn get_admin_retry_count(&self) -> Result<u8, Error> { - result_or_error(unsafe { nitrokey_sys::NK_get_admin_retry_count() }) - } - - /// Returns the firmware version. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// match device.get_firmware_version() { - /// Ok(version) => println!("Firmware version: {}", version), - /// Err(err) => eprintln!("Could not access firmware version: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - fn get_firmware_version(&self) -> Result<FirmwareVersion, Error> { - let major = result_or_error(unsafe { nitrokey_sys::NK_get_major_firmware_version() })?; - let minor = result_or_error(unsafe { nitrokey_sys::NK_get_minor_firmware_version() })?; - Ok(FirmwareVersion { major, minor }) - } - - /// Returns the current configuration of the Nitrokey device. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let config = device.get_config()?; - /// println!("numlock binding: {:?}", config.numlock); - /// println!("capslock binding: {:?}", config.capslock); - /// println!("scrollock binding: {:?}", config.scrollock); - /// println!("require password for OTP: {:?}", config.user_password); - /// # Ok(()) - /// # } - /// ``` - fn get_config(&self) -> Result<Config, Error> { - let config_ptr = unsafe { nitrokey_sys::NK_read_config() }; - if config_ptr.is_null() { - return Err(get_last_error()); - } - let config_array_ptr = config_ptr as *const [u8; 5]; - let raw_config = unsafe { RawConfig::from(*config_array_ptr) }; - unsafe { libc::free(config_ptr as *mut libc::c_void) }; - Ok(raw_config.into()) - } - - /// Changes the administrator PIN. - /// - /// # Errors - /// - /// - [`InvalidString`][] if one of the provided passwords contains a null byte - /// - [`WrongPassword`][] if the current admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.change_admin_pin("12345678", "12345679") { - /// Ok(()) => println!("Updated admin PIN."), - /// Err(err) => eprintln!("Failed to update admin PIN: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - fn change_admin_pin(&mut self, current: &str, new: &str) -> Result<(), Error> { - let current_string = get_cstring(current)?; - let new_string = get_cstring(new)?; - get_command_result(unsafe { - nitrokey_sys::NK_change_admin_PIN(current_string.as_ptr(), new_string.as_ptr()) - }) - } - - /// Changes the user PIN. - /// - /// # Errors - /// - /// - [`InvalidString`][] if one of the provided passwords contains a null byte - /// - [`WrongPassword`][] if the current user password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.change_user_pin("123456", "123457") { - /// Ok(()) => println!("Updated admin PIN."), - /// Err(err) => eprintln!("Failed to update admin PIN: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - fn change_user_pin(&mut self, current: &str, new: &str) -> Result<(), Error> { - let current_string = get_cstring(current)?; - let new_string = get_cstring(new)?; - get_command_result(unsafe { - nitrokey_sys::NK_change_user_PIN(current_string.as_ptr(), new_string.as_ptr()) - }) - } - - /// Unlocks the user PIN after three failed login attempts and sets it to the given value. - /// - /// # Errors - /// - /// - [`InvalidString`][] if one of the provided passwords contains a null byte - /// - [`WrongPassword`][] if the admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.unlock_user_pin("12345678", "123456") { - /// Ok(()) => println!("Unlocked user PIN."), - /// Err(err) => eprintln!("Failed to unlock user PIN: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - fn unlock_user_pin(&mut self, admin_pin: &str, user_pin: &str) -> Result<(), Error> { - let admin_pin_string = get_cstring(admin_pin)?; - let user_pin_string = get_cstring(user_pin)?; - get_command_result(unsafe { - nitrokey_sys::NK_unlock_user_password( - admin_pin_string.as_ptr(), - user_pin_string.as_ptr(), - ) - }) - } - - /// Locks the Nitrokey device. - /// - /// This disables the password store if it has been unlocked. On the Nitrokey Storage, this - /// also disables the volumes if they have been enabled. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.lock() { - /// Ok(()) => println!("Locked the Nitrokey device."), - /// Err(err) => eprintln!("Could not lock the Nitrokey device: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - fn lock(&mut self) -> Result<(), Error> { - get_command_result(unsafe { nitrokey_sys::NK_lock_device() }) - } - - /// Performs a factory reset on the Nitrokey device. - /// - /// This commands performs a factory reset on the smart card (like the factory reset via `gpg - /// --card-edit`) and then clears the flash memory (password safe, one-time passwords etc.). - /// After a factory reset, [`build_aes_key`][] has to be called before the password safe or the - /// encrypted volume can be used. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided password contains a null byte - /// - [`WrongPassword`][] if the admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.factory_reset("12345678") { - /// Ok(()) => println!("Performed a factory reset."), - /// Err(err) => eprintln!("Could not perform a factory reset: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`build_aes_key`]: #method.build_aes_key - fn factory_reset(&mut self, admin_pin: &str) -> Result<(), Error> { - let admin_pin_string = get_cstring(admin_pin)?; - get_command_result(unsafe { nitrokey_sys::NK_factory_reset(admin_pin_string.as_ptr()) }) - } - - /// Builds a new AES key on the Nitrokey. - /// - /// The AES key is used to encrypt the password safe and the encrypted volume. You may need - /// to call this method after a factory reset, either using [`factory_reset`][] or using `gpg - /// --card-edit`. You can also use it to destroy the data stored in the password safe or on - /// the encrypted volume. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided password contains a null byte - /// - [`WrongPassword`][] if the admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::Device; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.build_aes_key("12345678") { - /// Ok(()) => println!("New AES keys have been built."), - /// Err(err) => eprintln!("Could not build new AES keys: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`factory_reset`]: #method.factory_reset - fn build_aes_key(&mut self, admin_pin: &str) -> Result<(), Error> { - let admin_pin_string = get_cstring(admin_pin)?; - get_command_result(unsafe { nitrokey_sys::NK_build_aes_key(admin_pin_string.as_ptr()) }) - } -} - -fn get_connected_model() -> Option<Model> { - match unsafe { nitrokey_sys::NK_get_device_model() } { - nitrokey_sys::NK_device_model_NK_PRO => Some(Model::Pro), - nitrokey_sys::NK_device_model_NK_STORAGE => Some(Model::Storage), - _ => None, - } -} - -pub(crate) fn create_device_wrapper( - manager: &mut crate::Manager, - model: Model, -) -> DeviceWrapper<'_> { - match model { - Model::Pro => Pro::new(manager).into(), - Model::Storage => Storage::new(manager).into(), - } -} - -pub(crate) fn get_connected_device( - manager: &mut crate::Manager, -) -> Result<DeviceWrapper<'_>, Error> { - match get_connected_model() { - Some(model) => Ok(create_device_wrapper(manager, model)), - None => Err(CommunicationError::NotConnected.into()), - } -} - -pub(crate) fn connect_enum(model: Model) -> bool { - let model = match model { - Model::Storage => nitrokey_sys::NK_device_model_NK_STORAGE, - Model::Pro => nitrokey_sys::NK_device_model_NK_PRO, - }; - unsafe { nitrokey_sys::NK_login_enum(model) == 1 } -} diff --git a/nitrokey/src/device/pro.rs b/nitrokey/src/device/pro.rs deleted file mode 100644 index a65345e..0000000 --- a/nitrokey/src/device/pro.rs +++ /dev/null @@ -1,79 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use nitrokey_sys; - -use crate::device::{Device, Model}; -use crate::otp::GenerateOtp; - -/// A Nitrokey Pro device without user or admin authentication. -/// -/// Use the [`connect`][] method to obtain an instance wrapper or the [`connect_pro`] method to -/// directly obtain an instance. If you want to execute a command that requires user or admin -/// authentication, use [`authenticate_admin`][] or [`authenticate_user`][]. -/// -/// # Examples -/// -/// Authentication with error handling: -/// -/// ```no_run -/// use nitrokey::{Authenticate, User, Pro}; -/// # use nitrokey::Error; -/// -/// fn perform_user_task<'a>(device: &User<'a, Pro<'a>>) {} -/// fn perform_other_task(device: &Pro) {} -/// -/// # fn try_main() -> Result<(), Error> { -/// let mut manager = nitrokey::take()?; -/// let device = manager.connect_pro()?; -/// let device = match device.authenticate_user("123456") { -/// Ok(user) => { -/// perform_user_task(&user); -/// user.device() -/// }, -/// Err((device, err)) => { -/// eprintln!("Could not authenticate as user: {}", err); -/// device -/// }, -/// }; -/// perform_other_task(&device); -/// # Ok(()) -/// # } -/// ``` -/// -/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin -/// [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user -/// [`connect`]: struct.Manager.html#method.connect -/// [`connect_pro`]: struct.Manager.html#method.connect_pro -#[derive(Debug)] -pub struct Pro<'a> { - manager: Option<&'a mut crate::Manager>, -} - -impl<'a> Pro<'a> { - pub(crate) fn new(manager: &'a mut crate::Manager) -> Pro<'a> { - Pro { - manager: Some(manager), - } - } -} - -impl<'a> Drop for Pro<'a> { - fn drop(&mut self) { - unsafe { - nitrokey_sys::NK_logout(); - } - } -} - -impl<'a> Device<'a> for Pro<'a> { - fn into_manager(mut self) -> &'a mut crate::Manager { - self.manager.take().unwrap() - } - - fn get_model(&self) -> Model { - Model::Pro - } -} - -impl<'a> GenerateOtp for Pro<'a> {} diff --git a/nitrokey/src/device/storage.rs b/nitrokey/src/device/storage.rs deleted file mode 100644 index 370ce36..0000000 --- a/nitrokey/src/device/storage.rs +++ /dev/null @@ -1,735 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use std::fmt; - -use nitrokey_sys; - -use crate::device::{Device, FirmwareVersion, Model}; -use crate::error::Error; -use crate::otp::GenerateOtp; -use crate::util::{get_command_result, get_cstring}; - -/// A Nitrokey Storage device without user or admin authentication. -/// -/// Use the [`connect`][] method to obtain an instance wrapper or the [`connect_storage`] method to -/// directly obtain an instance. If you want to execute a command that requires user or admin -/// authentication, use [`authenticate_admin`][] or [`authenticate_user`][]. -/// -/// # Examples -/// -/// Authentication with error handling: -/// -/// ```no_run -/// use nitrokey::{Authenticate, User, Storage}; -/// # use nitrokey::Error; -/// -/// fn perform_user_task<'a>(device: &User<'a, Storage<'a>>) {} -/// fn perform_other_task(device: &Storage) {} -/// -/// # fn try_main() -> Result<(), Error> { -/// let mut manager = nitrokey::take()?; -/// let device = manager.connect_storage()?; -/// let device = match device.authenticate_user("123456") { -/// Ok(user) => { -/// perform_user_task(&user); -/// user.device() -/// }, -/// Err((device, err)) => { -/// eprintln!("Could not authenticate as user: {}", err); -/// device -/// }, -/// }; -/// perform_other_task(&device); -/// # Ok(()) -/// # } -/// ``` -/// -/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin -/// [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user -/// [`connect`]: struct.Manager.html#method.connect -/// [`connect_storage`]: struct.Manager.html#method.connect_storage -#[derive(Debug)] -pub struct Storage<'a> { - manager: Option<&'a mut crate::Manager>, -} - -/// The access mode of a volume on the Nitrokey Storage. -#[derive(Clone, Copy, Debug, PartialEq)] -pub enum VolumeMode { - /// A read-only volume. - ReadOnly, - /// A read-write volume. - ReadWrite, -} - -impl fmt::Display for VolumeMode { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - f.write_str(match *self { - VolumeMode::ReadOnly => "read-only", - VolumeMode::ReadWrite => "read-write", - }) - } -} - -/// The status of a volume on a Nitrokey Storage device. -#[derive(Debug)] -pub struct VolumeStatus { - /// Indicates whether the volume is read-only. - pub read_only: bool, - /// Indicates whether the volume is active. - pub active: bool, -} - -/// Information about the SD card in a Storage device. -#[derive(Debug)] -pub struct SdCardData { - /// The serial number of the SD card. - pub serial_number: u32, - /// The size of the SD card in GB. - pub size: u8, - /// The year the card was manufactured, e. g. 17 for 2017. - pub manufacturing_year: u8, - /// The month the card was manufactured. - pub manufacturing_month: u8, - /// The OEM ID. - pub oem: u16, - /// The manufacturer ID. - pub manufacturer: u8, -} - -/// Production information for a Storage device. -#[derive(Debug)] -pub struct StorageProductionInfo { - /// The firmware version. - pub firmware_version: FirmwareVersion, - /// The internal firmware version. - pub firmware_version_internal: u8, - /// The serial number of the CPU. - pub serial_number_cpu: u32, - /// Information about the SD card. - pub sd_card: SdCardData, -} - -/// The status of a Nitrokey Storage device. -#[derive(Debug)] -pub struct StorageStatus { - /// The status of the unencrypted volume. - pub unencrypted_volume: VolumeStatus, - /// The status of the encrypted volume. - pub encrypted_volume: VolumeStatus, - /// The status of the hidden volume. - pub hidden_volume: VolumeStatus, - /// The firmware version. - pub firmware_version: FirmwareVersion, - /// Indicates whether the firmware is locked. - pub firmware_locked: bool, - /// The serial number of the SD card in the Storage stick. - pub serial_number_sd_card: u32, - /// The serial number of the smart card in the Storage stick. - pub serial_number_smart_card: u32, - /// The number of remaining login attempts for the user PIN. - pub user_retry_count: u8, - /// The number of remaining login attempts for the admin PIN. - pub admin_retry_count: u8, - /// Indicates whether a new SD card was found. - pub new_sd_card_found: bool, - /// Indicates whether the SD card is filled with random characters. - pub filled_with_random: bool, - /// Indicates whether the stick has been initialized by generating - /// the AES keys. - pub stick_initialized: bool, -} - -impl<'a> Storage<'a> { - pub(crate) fn new(manager: &'a mut crate::Manager) -> Storage<'a> { - Storage { - manager: Some(manager), - } - } - - /// Changes the update PIN. - /// - /// The update PIN is used to enable firmware updates. Unlike the user and the admin PIN, the - /// update PIN is not managed by the OpenPGP smart card but by the Nitrokey firmware. There is - /// no retry counter as with the other PIN types. - /// - /// # Errors - /// - /// - [`InvalidString`][] if one of the provided passwords contains a null byte - /// - [`WrongPassword`][] if the current update password is wrong - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// match device.change_update_pin("12345678", "87654321") { - /// Ok(()) => println!("Updated update PIN."), - /// Err(err) => eprintln!("Failed to update update PIN: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - pub fn change_update_pin(&mut self, current: &str, new: &str) -> Result<(), Error> { - let current_string = get_cstring(current)?; - let new_string = get_cstring(new)?; - get_command_result(unsafe { - nitrokey_sys::NK_change_update_password(current_string.as_ptr(), new_string.as_ptr()) - }) - } - - /// Enables the firmware update mode. - /// - /// During firmware update mode, the Nitrokey can no longer be accessed using HID commands. - /// To resume normal operation, run `dfu-programmer at32uc3a3256s launch`. In order to enter - /// the firmware update mode, you need the update password that can be changed using the - /// [`change_update_pin`][] method. - /// - /// # Errors - /// - /// - [`InvalidString`][] if one of the provided passwords contains a null byte - /// - [`WrongPassword`][] if the current update password is wrong - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// match device.enable_firmware_update("12345678") { - /// Ok(()) => println!("Nitrokey entered update mode."), - /// Err(err) => eprintln!("Could not enter update mode: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - pub fn enable_firmware_update(&mut self, update_pin: &str) -> Result<(), Error> { - let update_pin_string = get_cstring(update_pin)?; - get_command_result(unsafe { - nitrokey_sys::NK_enable_firmware_update(update_pin_string.as_ptr()) - }) - } - - /// Enables the encrypted storage volume. - /// - /// Once the encrypted volume is enabled, it is presented to the operating system as a block - /// device. The API does not provide any information on the name or path of this block device. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided password contains a null byte - /// - [`WrongPassword`][] if the provided user password is wrong - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// match device.enable_encrypted_volume("123456") { - /// Ok(()) => println!("Enabled the encrypted volume."), - /// Err(err) => eprintln!("Could not enable the encrypted volume: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - pub fn enable_encrypted_volume(&mut self, user_pin: &str) -> Result<(), Error> { - let user_pin = get_cstring(user_pin)?; - get_command_result(unsafe { nitrokey_sys::NK_unlock_encrypted_volume(user_pin.as_ptr()) }) - } - - /// Disables the encrypted storage volume. - /// - /// Once the volume is disabled, it can be no longer accessed as a block device. If the - /// encrypted volume has not been enabled, this method still returns a success. - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// fn use_volume() {} - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// match device.enable_encrypted_volume("123456") { - /// Ok(()) => { - /// println!("Enabled the encrypted volume."); - /// use_volume(); - /// match device.disable_encrypted_volume() { - /// Ok(()) => println!("Disabled the encrypted volume."), - /// Err(err) => { - /// eprintln!("Could not disable the encrypted volume: {}", err); - /// }, - /// }; - /// }, - /// Err(err) => eprintln!("Could not enable the encrypted volume: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - pub fn disable_encrypted_volume(&mut self) -> Result<(), Error> { - get_command_result(unsafe { nitrokey_sys::NK_lock_encrypted_volume() }) - } - - /// Enables a hidden storage volume. - /// - /// This function will only succeed if the encrypted storage ([`enable_encrypted_volume`][]) or - /// another hidden volume has been enabled previously. Once the hidden volume is enabled, it - /// is presented to the operating system as a block device and any previously opened encrypted - /// or hidden volumes are closed. The API does not provide any information on the name or path - /// of this block device. - /// - /// Note that the encrypted and the hidden volumes operate on the same storage area, so using - /// both at the same time might lead to data loss. - /// - /// The hidden volume to unlock is selected based on the provided password. - /// - /// # Errors - /// - /// - [`AesDecryptionFailed`][] if the encrypted storage has not been opened before calling - /// this method or the AES key has not been built - /// - [`InvalidString`][] if the provided password contains a null byte - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// device.enable_encrypted_volume("123445")?; - /// match device.enable_hidden_volume("hidden-pw") { - /// Ok(()) => println!("Enabled a hidden volume."), - /// Err(err) => eprintln!("Could not enable the hidden volume: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`enable_encrypted_volume`]: #method.enable_encrypted_volume - /// [`AesDecryptionFailed`]: enum.CommandError.html#variant.AesDecryptionFailed - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - pub fn enable_hidden_volume(&mut self, volume_password: &str) -> Result<(), Error> { - let volume_password = get_cstring(volume_password)?; - get_command_result(unsafe { - nitrokey_sys::NK_unlock_hidden_volume(volume_password.as_ptr()) - }) - } - - /// Disables a hidden storage volume. - /// - /// Once the volume is disabled, it can be no longer accessed as a block device. If no hidden - /// volume has been enabled, this method still returns a success. - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// fn use_volume() {} - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// device.enable_encrypted_volume("123445")?; - /// match device.enable_hidden_volume("hidden-pw") { - /// Ok(()) => { - /// println!("Enabled the hidden volume."); - /// use_volume(); - /// match device.disable_hidden_volume() { - /// Ok(()) => println!("Disabled the hidden volume."), - /// Err(err) => { - /// eprintln!("Could not disable the hidden volume: {}", err); - /// }, - /// }; - /// }, - /// Err(err) => eprintln!("Could not enable the hidden volume: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - pub fn disable_hidden_volume(&mut self) -> Result<(), Error> { - get_command_result(unsafe { nitrokey_sys::NK_lock_hidden_volume() }) - } - - /// Creates a hidden volume. - /// - /// The volume is crated in the given slot and in the given range of the available memory, - /// where `start` is the start position as a percentage of the available memory, and `end` is - /// the end position as a percentage of the available memory. The volume will be protected by - /// the given password. - /// - /// Note that the encrypted and the hidden volumes operate on the same storage area, so using - /// both at the same time might lead to data loss. - /// - /// According to the libnitrokey documentation, this function only works if the encrypted - /// storage has been opened. - /// - /// # Errors - /// - /// - [`AesDecryptionFailed`][] if the encrypted storage has not been opened before calling - /// this method or the AES key has not been built - /// - [`InvalidString`][] if the provided password contains a null byte - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// device.enable_encrypted_volume("123445")?; - /// device.create_hidden_volume(0, 0, 100, "hidden-pw")?; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`AesDecryptionFailed`]: enum.CommandError.html#variant.AesDecryptionFailed - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - pub fn create_hidden_volume( - &mut self, - slot: u8, - start: u8, - end: u8, - password: &str, - ) -> Result<(), Error> { - let password = get_cstring(password)?; - get_command_result(unsafe { - nitrokey_sys::NK_create_hidden_volume(slot, start, end, password.as_ptr()) - }) - } - - /// Sets the access mode of the unencrypted volume. - /// - /// This command will reconnect the unencrypted volume so buffers should be flushed before - /// calling it. Since firmware version v0.51, this command requires the admin PIN. Older - /// firmware versions are not supported. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided password contains a null byte - /// - [`WrongPassword`][] if the provided admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// use nitrokey::VolumeMode; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// match device.set_unencrypted_volume_mode("12345678", VolumeMode::ReadWrite) { - /// Ok(()) => println!("Set the unencrypted volume to read-write mode."), - /// Err(err) => eprintln!("Could not set the unencrypted volume to read-write mode: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - pub fn set_unencrypted_volume_mode( - &mut self, - admin_pin: &str, - mode: VolumeMode, - ) -> Result<(), Error> { - let admin_pin = get_cstring(admin_pin)?; - let result = match mode { - VolumeMode::ReadOnly => unsafe { - nitrokey_sys::NK_set_unencrypted_read_only_admin(admin_pin.as_ptr()) - }, - VolumeMode::ReadWrite => unsafe { - nitrokey_sys::NK_set_unencrypted_read_write_admin(admin_pin.as_ptr()) - }, - }; - get_command_result(result) - } - - /// Sets the access mode of the encrypted volume. - /// - /// This command will reconnect the encrypted volume so buffers should be flushed before - /// calling it. It is only available in firmware version 0.49. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided password contains a null byte - /// - [`WrongPassword`][] if the provided admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// use nitrokey::VolumeMode; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// match device.set_encrypted_volume_mode("12345678", VolumeMode::ReadWrite) { - /// Ok(()) => println!("Set the encrypted volume to read-write mode."), - /// Err(err) => eprintln!("Could not set the encrypted volume to read-write mode: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - pub fn set_encrypted_volume_mode( - &mut self, - admin_pin: &str, - mode: VolumeMode, - ) -> Result<(), Error> { - let admin_pin = get_cstring(admin_pin)?; - let result = match mode { - VolumeMode::ReadOnly => unsafe { - nitrokey_sys::NK_set_encrypted_read_only(admin_pin.as_ptr()) - }, - VolumeMode::ReadWrite => unsafe { - nitrokey_sys::NK_set_encrypted_read_write(admin_pin.as_ptr()) - }, - }; - get_command_result(result) - } - - /// Returns the status of the connected storage device. - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// fn use_volume() {} - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect_storage()?; - /// match device.get_status() { - /// Ok(status) => { - /// println!("SD card ID: {:#x}", status.serial_number_sd_card); - /// }, - /// Err(err) => eprintln!("Could not get Storage status: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - pub fn get_status(&self) -> Result<StorageStatus, Error> { - let mut raw_status = nitrokey_sys::NK_storage_status { - unencrypted_volume_read_only: false, - unencrypted_volume_active: false, - encrypted_volume_read_only: false, - encrypted_volume_active: false, - hidden_volume_read_only: false, - hidden_volume_active: false, - firmware_version_major: 0, - firmware_version_minor: 0, - firmware_locked: false, - serial_number_sd_card: 0, - serial_number_smart_card: 0, - user_retry_count: 0, - admin_retry_count: 0, - new_sd_card_found: false, - filled_with_random: false, - stick_initialized: false, - }; - let raw_result = unsafe { nitrokey_sys::NK_get_status_storage(&mut raw_status) }; - get_command_result(raw_result).map(|_| StorageStatus::from(raw_status)) - } - - /// Returns the production information for the connected storage device. - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// fn use_volume() {} - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect_storage()?; - /// match device.get_production_info() { - /// Ok(data) => { - /// println!("SD card ID: {:#x}", data.sd_card.serial_number); - /// println!("SD card size: {} GB", data.sd_card.size); - /// }, - /// Err(err) => eprintln!("Could not get Storage production info: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - pub fn get_production_info(&self) -> Result<StorageProductionInfo, Error> { - let mut raw_data = nitrokey_sys::NK_storage_ProductionTest { - FirmwareVersion_au8: [0, 2], - FirmwareVersionInternal_u8: 0, - SD_Card_Size_u8: 0, - CPU_CardID_u32: 0, - SmartCardID_u32: 0, - SD_CardID_u32: 0, - SC_UserPwRetryCount: 0, - SC_AdminPwRetryCount: 0, - SD_Card_ManufacturingYear_u8: 0, - SD_Card_ManufacturingMonth_u8: 0, - SD_Card_OEM_u16: 0, - SD_WriteSpeed_u16: 0, - SD_Card_Manufacturer_u8: 0, - }; - let raw_result = unsafe { nitrokey_sys::NK_get_storage_production_info(&mut raw_data) }; - get_command_result(raw_result).map(|_| StorageProductionInfo::from(raw_data)) - } - - /// Clears the warning for a new SD card. - /// - /// The Storage status contains a field for a new SD card warning. After a factory reset, the - /// field is set to true. After filling the SD card with random data, it is set to false. - /// This method can be used to set it to false without filling the SD card with random data. - /// - /// # Errors - /// - /// - [`InvalidString`][] if the provided password contains a null byte - /// - [`WrongPassword`][] if the provided admin password is wrong - /// - /// # Example - /// - /// ```no_run - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect_storage()?; - /// match device.clear_new_sd_card_warning("12345678") { - /// Ok(()) => println!("Cleared the new SD card warning."), - /// Err(err) => eprintln!("Could not set the clear the new SD card warning: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - pub fn clear_new_sd_card_warning(&mut self, admin_pin: &str) -> Result<(), Error> { - let admin_pin = get_cstring(admin_pin)?; - get_command_result(unsafe { - nitrokey_sys::NK_clear_new_sd_card_warning(admin_pin.as_ptr()) - }) - } - - /// Blinks the red and green LED alternatively and infinitely until the device is reconnected. - pub fn wink(&mut self) -> Result<(), Error> { - get_command_result(unsafe { nitrokey_sys::NK_wink() }) - } - - /// Exports the firmware to the unencrypted volume. - /// - /// This command requires the admin PIN. The unencrypted volume must be in read-write mode - /// when this command is executed. Otherwise, it will still return `Ok` but not write the - /// firmware. - /// - /// This command unmounts the unencrypted volume if it has been mounted, so all buffers should - /// be flushed. The firmware is written to the `firmware.bin` file on the unencrypted volume. - /// - /// # Errors - /// - /// - [`InvalidString`][] if one of the provided passwords contains a null byte - /// - [`WrongPassword`][] if the admin password is wrong - /// - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - pub fn export_firmware(&mut self, admin_pin: &str) -> Result<(), Error> { - let admin_pin_string = get_cstring(admin_pin)?; - get_command_result(unsafe { nitrokey_sys::NK_export_firmware(admin_pin_string.as_ptr()) }) - } -} - -impl<'a> Drop for Storage<'a> { - fn drop(&mut self) { - unsafe { - nitrokey_sys::NK_logout(); - } - } -} - -impl<'a> Device<'a> for Storage<'a> { - fn into_manager(mut self) -> &'a mut crate::Manager { - self.manager.take().unwrap() - } - - fn get_model(&self) -> Model { - Model::Storage - } -} - -impl<'a> GenerateOtp for Storage<'a> {} - -impl From<nitrokey_sys::NK_storage_ProductionTest> for StorageProductionInfo { - fn from(data: nitrokey_sys::NK_storage_ProductionTest) -> Self { - Self { - firmware_version: FirmwareVersion { - major: data.FirmwareVersion_au8[0], - minor: data.FirmwareVersion_au8[1], - }, - firmware_version_internal: data.FirmwareVersionInternal_u8, - serial_number_cpu: data.CPU_CardID_u32, - sd_card: SdCardData { - serial_number: data.SD_CardID_u32, - size: data.SD_Card_Size_u8, - manufacturing_year: data.SD_Card_ManufacturingYear_u8, - manufacturing_month: data.SD_Card_ManufacturingMonth_u8, - oem: data.SD_Card_OEM_u16, - manufacturer: data.SD_Card_Manufacturer_u8, - }, - } - } -} - -impl From<nitrokey_sys::NK_storage_status> for StorageStatus { - fn from(status: nitrokey_sys::NK_storage_status) -> Self { - StorageStatus { - unencrypted_volume: VolumeStatus { - read_only: status.unencrypted_volume_read_only, - active: status.unencrypted_volume_active, - }, - encrypted_volume: VolumeStatus { - read_only: status.encrypted_volume_read_only, - active: status.encrypted_volume_active, - }, - hidden_volume: VolumeStatus { - read_only: status.hidden_volume_read_only, - active: status.hidden_volume_active, - }, - firmware_version: FirmwareVersion { - major: status.firmware_version_major, - minor: status.firmware_version_minor, - }, - firmware_locked: status.firmware_locked, - serial_number_sd_card: status.serial_number_sd_card, - serial_number_smart_card: status.serial_number_smart_card, - user_retry_count: status.user_retry_count, - admin_retry_count: status.admin_retry_count, - new_sd_card_found: status.new_sd_card_found, - filled_with_random: status.filled_with_random, - stick_initialized: status.stick_initialized, - } - } -} diff --git a/nitrokey/src/device/wrapper.rs b/nitrokey/src/device/wrapper.rs deleted file mode 100644 index a3a18f9..0000000 --- a/nitrokey/src/device/wrapper.rs +++ /dev/null @@ -1,134 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use crate::device::{Device, Model, Pro, Storage}; -use crate::error::Error; -use crate::otp::GenerateOtp; - -/// A wrapper for a Nitrokey device of unknown type. -/// -/// Use the [`connect`][] method to obtain a wrapped instance. The wrapper implements all traits -/// that are shared between all Nitrokey devices so that the shared functionality can be used -/// without knowing the type of the underlying device. If you want to use functionality that is -/// not available for all devices, you have to extract the device. -/// -/// # Examples -/// -/// Authentication with error handling: -/// -/// ```no_run -/// use nitrokey::{Authenticate, DeviceWrapper, User}; -/// # use nitrokey::Error; -/// -/// fn perform_user_task<'a>(device: &User<'a, DeviceWrapper<'a>>) {} -/// fn perform_other_task(device: &DeviceWrapper) {} -/// -/// # fn try_main() -> Result<(), Error> { -/// let mut manager = nitrokey::take()?; -/// let device = manager.connect()?; -/// let device = match device.authenticate_user("123456") { -/// Ok(user) => { -/// perform_user_task(&user); -/// user.device() -/// }, -/// Err((device, err)) => { -/// eprintln!("Could not authenticate as user: {}", err); -/// device -/// }, -/// }; -/// perform_other_task(&device); -/// # Ok(()) -/// # } -/// ``` -/// -/// Device-specific commands: -/// -/// ```no_run -/// use nitrokey::{DeviceWrapper, Storage}; -/// # use nitrokey::Error; -/// -/// fn perform_common_task(device: &DeviceWrapper) {} -/// fn perform_storage_task(device: &Storage) {} -/// -/// # fn try_main() -> Result<(), Error> { -/// let mut manager = nitrokey::take()?; -/// let device = manager.connect()?; -/// perform_common_task(&device); -/// match device { -/// DeviceWrapper::Storage(storage) => perform_storage_task(&storage), -/// _ => (), -/// }; -/// # Ok(()) -/// # } -/// ``` -/// -/// [`connect`]: struct.Manager.html#method.connect -#[derive(Debug)] -pub enum DeviceWrapper<'a> { - /// A Nitrokey Storage device. - Storage(Storage<'a>), - /// A Nitrokey Pro device. - Pro(Pro<'a>), -} - -impl<'a> DeviceWrapper<'a> { - fn device(&self) -> &dyn Device<'a> { - match *self { - DeviceWrapper::Storage(ref storage) => storage, - DeviceWrapper::Pro(ref pro) => pro, - } - } - - fn device_mut(&mut self) -> &mut dyn Device<'a> { - match *self { - DeviceWrapper::Storage(ref mut storage) => storage, - DeviceWrapper::Pro(ref mut pro) => pro, - } - } -} - -impl<'a> From<Pro<'a>> for DeviceWrapper<'a> { - fn from(device: Pro<'a>) -> Self { - DeviceWrapper::Pro(device) - } -} - -impl<'a> From<Storage<'a>> for DeviceWrapper<'a> { - fn from(device: Storage<'a>) -> Self { - DeviceWrapper::Storage(device) - } -} - -impl<'a> GenerateOtp for DeviceWrapper<'a> { - fn get_hotp_slot_name(&self, slot: u8) -> Result<String, Error> { - self.device().get_hotp_slot_name(slot) - } - - fn get_totp_slot_name(&self, slot: u8) -> Result<String, Error> { - self.device().get_totp_slot_name(slot) - } - - fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> { - self.device_mut().get_hotp_code(slot) - } - - fn get_totp_code(&self, slot: u8) -> Result<String, Error> { - self.device().get_totp_code(slot) - } -} - -impl<'a> Device<'a> for DeviceWrapper<'a> { - fn into_manager(self) -> &'a mut crate::Manager { - match self { - DeviceWrapper::Pro(dev) => dev.into_manager(), - DeviceWrapper::Storage(dev) => dev.into_manager(), - } - } - - fn get_model(&self) -> Model { - match *self { - DeviceWrapper::Pro(_) => Model::Pro, - DeviceWrapper::Storage(_) => Model::Storage, - } - } -} diff --git a/nitrokey/src/error.rs b/nitrokey/src/error.rs deleted file mode 100644 index 9e6adc0..0000000 --- a/nitrokey/src/error.rs +++ /dev/null @@ -1,269 +0,0 @@ -// Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use std::error; -use std::fmt; -use std::os::raw; -use std::str; -use std::sync; - -use crate::device; - -/// An error returned by the nitrokey crate. -#[derive(Debug)] -pub enum Error { - /// An error reported by the Nitrokey device in the response packet. - CommandError(CommandError), - /// A device communication error. - CommunicationError(CommunicationError), - /// An error occurred due to concurrent access to the Nitrokey device. - ConcurrentAccessError, - /// A library usage error. - LibraryError(LibraryError), - /// An error that occurred due to a poisoned lock. - PoisonError(sync::PoisonError<sync::MutexGuard<'static, crate::Manager>>), - /// An error that occurred during random number generation. - RandError(Box<dyn error::Error>), - /// An error that is caused by an unexpected value returned by libnitrokey. - UnexpectedError, - /// An unknown error returned by libnitrokey. - UnknownError(i64), - /// An error occurred when interpreting a UTF-8 string. - Utf8Error(str::Utf8Error), -} - -impl From<raw::c_int> for Error { - fn from(code: raw::c_int) -> Self { - if let Some(err) = CommandError::try_from(code) { - Error::CommandError(err) - } else if let Some(err) = CommunicationError::try_from(256 - code) { - Error::CommunicationError(err) - } else if let Some(err) = LibraryError::try_from(code) { - Error::LibraryError(err) - } else { - Error::UnknownError(code.into()) - } - } -} - -impl From<CommandError> for Error { - fn from(err: CommandError) -> Self { - Error::CommandError(err) - } -} - -impl From<CommunicationError> for Error { - fn from(err: CommunicationError) -> Self { - Error::CommunicationError(err) - } -} - -impl From<LibraryError> for Error { - fn from(err: LibraryError) -> Self { - Error::LibraryError(err) - } -} - -impl From<str::Utf8Error> for Error { - fn from(error: str::Utf8Error) -> Self { - Error::Utf8Error(error) - } -} - -impl From<sync::PoisonError<sync::MutexGuard<'static, crate::Manager>>> for Error { - fn from(error: sync::PoisonError<sync::MutexGuard<'static, crate::Manager>>) -> Self { - Error::PoisonError(error) - } -} - -impl From<sync::TryLockError<sync::MutexGuard<'static, crate::Manager>>> for Error { - fn from(error: sync::TryLockError<sync::MutexGuard<'static, crate::Manager>>) -> Self { - match error { - sync::TryLockError::Poisoned(err) => err.into(), - sync::TryLockError::WouldBlock => Error::ConcurrentAccessError, - } - } -} - -impl<'a, T: device::Device<'a>> From<(T, Error)> for Error { - fn from((_, err): (T, Error)) -> Self { - err - } -} - -impl error::Error for Error { - fn source(&self) -> Option<&(dyn error::Error + 'static)> { - match *self { - Error::CommandError(ref err) => Some(err), - Error::CommunicationError(ref err) => Some(err), - Error::ConcurrentAccessError => None, - Error::LibraryError(ref err) => Some(err), - Error::PoisonError(ref err) => Some(err), - Error::RandError(ref err) => Some(err.as_ref()), - Error::UnexpectedError => None, - Error::UnknownError(_) => None, - Error::Utf8Error(ref err) => Some(err), - } - } -} - -impl fmt::Display for Error { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - match *self { - Error::CommandError(ref err) => write!(f, "Command error: {}", err), - Error::CommunicationError(ref err) => write!(f, "Communication error: {}", err), - Error::ConcurrentAccessError => write!(f, "Internal error: concurrent access"), - Error::LibraryError(ref err) => write!(f, "Library error: {}", err), - Error::PoisonError(_) => write!(f, "Internal error: poisoned lock"), - Error::RandError(ref err) => write!(f, "RNG error: {}", err), - Error::UnexpectedError => write!(f, "An unexpected error occurred"), - Error::UnknownError(ref err) => write!(f, "Unknown error: {}", err), - Error::Utf8Error(ref err) => write!(f, "UTF-8 error: {}", err), - } - } -} - -/// An error reported by the Nitrokey device in the response packet. -#[derive(Clone, Copy, Debug, PartialEq)] -pub enum CommandError { - /// A packet with a wrong checksum has been sent or received. - WrongCrc, - /// A command tried to access an OTP slot that does not exist. - WrongSlot, - /// A command tried to generate an OTP on a slot that is not configured. - SlotNotProgrammed, - /// The provided password is wrong. - WrongPassword, - /// You are not authorized for this command or provided a wrong temporary - /// password. - NotAuthorized, - /// An error occurred when getting or setting the time. - Timestamp, - /// You did not provide a name for the OTP slot. - NoName, - /// This command is not supported by this device. - NotSupported, - /// This command is unknown. - UnknownCommand, - /// AES decryption failed. - AesDecryptionFailed, -} - -impl CommandError { - fn try_from(value: raw::c_int) -> Option<Self> { - match value { - 1 => Some(CommandError::WrongCrc), - 2 => Some(CommandError::WrongSlot), - 3 => Some(CommandError::SlotNotProgrammed), - 4 => Some(CommandError::WrongPassword), - 5 => Some(CommandError::NotAuthorized), - 6 => Some(CommandError::Timestamp), - 7 => Some(CommandError::NoName), - 8 => Some(CommandError::NotSupported), - 9 => Some(CommandError::UnknownCommand), - 10 => Some(CommandError::AesDecryptionFailed), - _ => None, - } - } -} - -impl error::Error for CommandError {} - -impl fmt::Display for CommandError { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - f.write_str(match *self { - CommandError::WrongCrc => "A packet with a wrong checksum has been sent or received", - CommandError::WrongSlot => "The given slot does not exist", - CommandError::SlotNotProgrammed => "The given slot is not programmed", - CommandError::WrongPassword => "The given password is wrong", - CommandError::NotAuthorized => { - "You are not authorized for this command or provided a wrong temporary \ - password" - } - CommandError::Timestamp => "An error occurred when getting or setting the time", - CommandError::NoName => "You did not provide a name for the slot", - CommandError::NotSupported => "This command is not supported by this device", - CommandError::UnknownCommand => "This command is unknown", - CommandError::AesDecryptionFailed => "AES decryption failed", - }) - } -} - -/// A device communication error. -#[derive(Clone, Copy, Debug, PartialEq)] -pub enum CommunicationError { - /// Could not connect to a Nitrokey device. - NotConnected, - /// Sending a packet failed. - SendingFailure, - /// Receiving a packet failed. - ReceivingFailure, - /// A packet with a wrong checksum was received. - InvalidCrc, -} - -impl CommunicationError { - fn try_from(value: raw::c_int) -> Option<Self> { - match value { - 2 => Some(CommunicationError::NotConnected), - 3 => Some(CommunicationError::SendingFailure), - 4 => Some(CommunicationError::ReceivingFailure), - 5 => Some(CommunicationError::InvalidCrc), - _ => None, - } - } -} - -impl error::Error for CommunicationError {} - -impl fmt::Display for CommunicationError { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - f.write_str(match *self { - CommunicationError::NotConnected => "Could not connect to a Nitrokey device", - CommunicationError::SendingFailure => "Sending a packet failed", - CommunicationError::ReceivingFailure => "Receiving a packet failed", - CommunicationError::InvalidCrc => "A packet with a wrong checksum was received", - }) - } -} - -/// A library usage error. -#[derive(Clone, Copy, Debug, PartialEq)] -pub enum LibraryError { - /// A supplied string exceeded a length limit. - StringTooLong, - /// You passed an invalid slot. - InvalidSlot, - /// The supplied string was not in hexadecimal format. - InvalidHexString, - /// The target buffer was smaller than the source. - TargetBufferTooSmall, - /// You passed a string containing a null byte. - InvalidString, -} - -impl LibraryError { - fn try_from(value: raw::c_int) -> Option<Self> { - match value { - 200 => Some(LibraryError::StringTooLong), - 201 => Some(LibraryError::InvalidSlot), - 202 => Some(LibraryError::InvalidHexString), - 203 => Some(LibraryError::TargetBufferTooSmall), - _ => None, - } - } -} - -impl error::Error for LibraryError {} - -impl fmt::Display for LibraryError { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - f.write_str(match *self { - LibraryError::StringTooLong => "The supplied string is too long", - LibraryError::InvalidSlot => "The given slot is invalid", - LibraryError::InvalidHexString => "The supplied string is not in hexadecimal format", - LibraryError::TargetBufferTooSmall => "The target buffer is too small", - LibraryError::InvalidString => "You passed a string containing a null byte", - }) - } -} diff --git a/nitrokey/src/lib.rs b/nitrokey/src/lib.rs deleted file mode 100644 index 059792d..0000000 --- a/nitrokey/src/lib.rs +++ /dev/null @@ -1,465 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -//! Provides access to a Nitrokey device using the native libnitrokey API. -//! -//! # Usage -//! -//! Operations on the Nitrokey require different authentication levels. Some operations can be -//! performed without authentication, some require user access, and some require admin access. -//! This is modelled using the types [`User`][] and [`Admin`][]. -//! -//! You can only connect to one Nitrokey at a time. Use the global [`take`][] function to obtain -//! an reference to the [`Manager`][] singleton that keeps track of the connections. Then use the -//! [`connect`][] method to connect to any Nitrokey device. The method will return a -//! [`DeviceWrapper`][] that abstracts over the supported Nitrokey devices. You can also use -//! [`connect_model`][], [`connect_pro`][] or [`connect_storage`][] to connect to a specific -//! device. -//! -//! You can call [`authenticate_user`][] or [`authenticate_admin`][] to get an authenticated device -//! that can perform operations that require authentication. You can use [`device`][] to go back -//! to the unauthenticated device. -//! -//! This makes sure that you can only execute a command if you have the required access rights. -//! Otherwise, your code will not compile. The only exception are the methods to generate one-time -//! passwords – [`get_hotp_code`][] and [`get_totp_code`][]. Depending on the stick configuration, -//! these operations are available without authentication or with user authentication. -//! -//! # Examples -//! -//! Connect to any Nitrokey and print its serial number: -//! -//! ```no_run -//! use nitrokey::Device; -//! # use nitrokey::Error; -//! -//! # fn try_main() -> Result<(), Error> { -//! let mut manager = nitrokey::take()?; -//! let device = manager.connect()?; -//! println!("{}", device.get_serial_number()?); -//! # Ok(()) -//! # } -//! ``` -//! -//! Configure an HOTP slot: -//! -//! ```no_run -//! use nitrokey::{Authenticate, ConfigureOtp, OtpMode, OtpSlotData}; -//! # use nitrokey::Error; -//! -//! # fn try_main() -> Result<(), Error> { -//! let mut manager = nitrokey::take()?; -//! let device = manager.connect()?; -//! let slot_data = OtpSlotData::new(1, "test", "01234567890123456689", OtpMode::SixDigits); -//! match device.authenticate_admin("12345678") { -//! Ok(mut admin) => { -//! match admin.write_hotp_slot(slot_data, 0) { -//! Ok(()) => println!("Successfully wrote slot."), -//! Err(err) => eprintln!("Could not write slot: {}", err), -//! } -//! }, -//! Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err), -//! } -//! # Ok(()) -//! # } -//! ``` -//! -//! Generate an HOTP one-time password: -//! -//! ```no_run -//! use nitrokey::{Device, GenerateOtp}; -//! # use nitrokey::Error; -//! -//! # fn try_main() -> Result<(), Error> { -//! let mut manager = nitrokey::take()?; -//! let mut device = manager.connect()?; -//! match device.get_hotp_code(1) { -//! Ok(code) => println!("Generated HOTP code: {}", code), -//! Err(err) => eprintln!("Could not generate HOTP code: {}", err), -//! } -//! # Ok(()) -//! # } -//! ``` -//! -//! [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin -//! [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user -//! [`take`]: fn.take.html -//! [`connect`]: struct.Manager.html#method.connect -//! [`connect_model`]: struct.Manager.html#method.connect_model -//! [`connect_pro`]: struct.Manager.html#method.connect_pro -//! [`connect_storage`]: struct.Manager.html#method.connect_storage -//! [`manager`]: trait.Device.html#method.manager -//! [`device`]: struct.User.html#method.device -//! [`get_hotp_code`]: trait.GenerateOtp.html#method.get_hotp_code -//! [`get_totp_code`]: trait.GenerateOtp.html#method.get_totp_code -//! [`Admin`]: struct.Admin.html -//! [`DeviceWrapper`]: enum.DeviceWrapper.html -//! [`User`]: struct.User.html - -#![warn(missing_docs, rust_2018_compatibility, rust_2018_idioms, unused)] - -#[macro_use(lazy_static)] -extern crate lazy_static; - -mod auth; -mod config; -mod device; -mod error; -mod otp; -mod pws; -mod util; - -use std::fmt; -use std::marker; -use std::sync; - -use nitrokey_sys; - -pub use crate::auth::{Admin, Authenticate, User}; -pub use crate::config::Config; -pub use crate::device::{ - Device, DeviceWrapper, Model, Pro, SdCardData, Storage, StorageProductionInfo, StorageStatus, - VolumeMode, VolumeStatus, -}; -pub use crate::error::{CommandError, CommunicationError, Error, LibraryError}; -pub use crate::otp::{ConfigureOtp, GenerateOtp, OtpMode, OtpSlotData}; -pub use crate::pws::{GetPasswordSafe, PasswordSafe, SLOT_COUNT}; -pub use crate::util::LogLevel; - -/// The default admin PIN for all Nitrokey devices. -pub const DEFAULT_ADMIN_PIN: &str = "12345678"; -/// The default user PIN for all Nitrokey devices. -pub const DEFAULT_USER_PIN: &str = "123456"; - -lazy_static! { - static ref MANAGER: sync::Mutex<Manager> = sync::Mutex::new(Manager::new()); -} - -/// A version of the libnitrokey library. -/// -/// Use the [`get_library_version`](fn.get_library_version.html) function to query the library -/// version. -#[derive(Clone, Debug, PartialEq)] -pub struct Version { - /// The Git library version as a string. - /// - /// The library version is the output of `git describe --always` at compile time, for example - /// `v3.3` or `v3.4.1`. If the library has not been built from a release, the version string - /// contains the number of commits since the last release and the hash of the current commit, for - /// example `v3.3-19-gaee920b`. If the library has not been built from a Git checkout, this - /// string may be empty. - pub git: String, - /// The major library version. - pub major: u32, - /// The minor library version. - pub minor: u32, -} - -impl fmt::Display for Version { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - if self.git.is_empty() { - write!(f, "v{}.{}", self.major, self.minor) - } else { - f.write_str(&self.git) - } - } -} - -/// A manager for connections to Nitrokey devices. -/// -/// Currently, libnitrokey only provides access to one Nitrokey device at the same time. This -/// manager struct makes sure that `nitrokey-rs` does not try to connect to two devices at the same -/// time. -/// -/// To obtain a reference to an instance of this manager, use the [`take`][] function. Use one of -/// the connect methods – [`connect`][], [`connect_model`][], [`connect_pro`][] or -/// [`connect_storage`][] – to retrieve a [`Device`][] instance. -/// -/// # Examples -/// -/// Connect to a single device: -/// -/// ```no_run -/// use nitrokey::Device; -/// # use nitrokey::Error; -/// -/// # fn try_main() -> Result<(), Error> { -/// let mut manager = nitrokey::take()?; -/// let device = manager.connect()?; -/// println!("{}", device.get_serial_number()?); -/// # Ok(()) -/// # } -/// ``` -/// -/// Connect to a Pro and a Storage device: -/// -/// ```no_run -/// use nitrokey::{Device, Model}; -/// # use nitrokey::Error; -/// -/// # fn try_main() -> Result<(), Error> { -/// let mut manager = nitrokey::take()?; -/// let device = manager.connect_model(Model::Pro)?; -/// println!("Pro: {}", device.get_serial_number()?); -/// drop(device); -/// let device = manager.connect_model(Model::Storage)?; -/// println!("Storage: {}", device.get_serial_number()?); -/// # Ok(()) -/// # } -/// ``` -/// -/// [`connect`]: #method.connect -/// [`connect_model`]: #method.connect_model -/// [`connect_pro`]: #method.connect_pro -/// [`connect_storage`]: #method.connect_storage -/// [`manager`]: trait.Device.html#method.manager -/// [`take`]: fn.take.html -/// [`Device`]: trait.Device.html -#[derive(Debug)] -pub struct Manager { - marker: marker::PhantomData<()>, -} - -impl Manager { - fn new() -> Self { - Manager { - marker: marker::PhantomData, - } - } - - /// Connects to a Nitrokey device. - /// - /// This method can be used to connect to any connected device, both a Nitrokey Pro and a - /// Nitrokey Storage. - /// - /// # Errors - /// - /// - [`NotConnected`][] if no Nitrokey device is connected - /// - /// # Example - /// - /// ``` - /// use nitrokey::DeviceWrapper; - /// - /// fn do_something(device: DeviceWrapper) {} - /// - /// let mut manager = nitrokey::take()?; - /// match manager.connect() { - /// Ok(device) => do_something(device), - /// Err(err) => println!("Could not connect to a Nitrokey: {}", err), - /// } - /// # Ok::<(), nitrokey::Error>(()) - /// ``` - /// - /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected - pub fn connect(&mut self) -> Result<DeviceWrapper<'_>, Error> { - if unsafe { nitrokey_sys::NK_login_auto() } == 1 { - device::get_connected_device(self) - } else { - Err(CommunicationError::NotConnected.into()) - } - } - - /// Connects to a Nitrokey device of the given model. - /// - /// # Errors - /// - /// - [`NotConnected`][] if no Nitrokey device of the given model is connected - /// - /// # Example - /// - /// ``` - /// use nitrokey::DeviceWrapper; - /// use nitrokey::Model; - /// - /// fn do_something(device: DeviceWrapper) {} - /// - /// match nitrokey::take()?.connect_model(Model::Pro) { - /// Ok(device) => do_something(device), - /// Err(err) => println!("Could not connect to a Nitrokey Pro: {}", err), - /// } - /// # Ok::<(), nitrokey::Error>(()) - /// ``` - /// - /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected - pub fn connect_model(&mut self, model: Model) -> Result<DeviceWrapper<'_>, Error> { - if device::connect_enum(model) { - Ok(device::create_device_wrapper(self, model)) - } else { - Err(CommunicationError::NotConnected.into()) - } - } - - /// Connects to a Nitrokey Pro. - /// - /// # Errors - /// - /// - [`NotConnected`][] if no Nitrokey device of the given model is connected - /// - /// # Example - /// - /// ``` - /// use nitrokey::Pro; - /// - /// fn use_pro(device: Pro) {} - /// - /// match nitrokey::take()?.connect_pro() { - /// Ok(device) => use_pro(device), - /// Err(err) => println!("Could not connect to the Nitrokey Pro: {}", err), - /// } - /// # Ok::<(), nitrokey::Error>(()) - /// ``` - /// - /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected - pub fn connect_pro(&mut self) -> Result<Pro<'_>, Error> { - if device::connect_enum(device::Model::Pro) { - Ok(device::Pro::new(self)) - } else { - Err(CommunicationError::NotConnected.into()) - } - } - - /// Connects to a Nitrokey Storage. - /// - /// # Errors - /// - /// - [`NotConnected`][] if no Nitrokey device of the given model is connected - /// - /// # Example - /// - /// ``` - /// use nitrokey::Storage; - /// - /// fn use_storage(device: Storage) {} - /// - /// match nitrokey::take()?.connect_storage() { - /// Ok(device) => use_storage(device), - /// Err(err) => println!("Could not connect to the Nitrokey Storage: {}", err), - /// } - /// # Ok::<(), nitrokey::Error>(()) - /// ``` - /// - /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected - pub fn connect_storage(&mut self) -> Result<Storage<'_>, Error> { - if device::connect_enum(Model::Storage) { - Ok(Storage::new(self)) - } else { - Err(CommunicationError::NotConnected.into()) - } - } -} - -/// Take an instance of the connection manager, blocking until an instance is available. -/// -/// There may only be one [`Manager`][] instance at the same time. If there already is an -/// instance, this method blocks. If you want a non-blocking version, use [`take`][]. -/// -/// # Errors -/// -/// - [`PoisonError`][] if the lock is poisoned -/// -/// [`take`]: fn.take.html -/// [`PoisonError`]: struct.Error.html#variant.PoisonError -/// [`Manager`]: struct.Manager.html -pub fn take_blocking() -> Result<sync::MutexGuard<'static, Manager>, Error> { - MANAGER.lock().map_err(Into::into) -} - -/// Try to take an instance of the connection manager. -/// -/// There may only be one [`Manager`][] instance at the same time. If there already is an -/// instance, a [`ConcurrentAccessError`][] is returned. If you want a blocking version, use -/// [`take_blocking`][]. If you want to access the manager instance even if the cache is poisoned, -/// use [`force_take`][]. -/// -/// # Errors -/// -/// - [`ConcurrentAccessError`][] if the token for the `Manager` instance cannot be locked -/// - [`PoisonError`][] if the lock is poisoned -/// -/// [`take_blocking`]: fn.take_blocking.html -/// [`force_take`]: fn.force_take.html -/// [`ConcurrentAccessError`]: struct.Error.html#variant.ConcurrentAccessError -/// [`PoisonError`]: struct.Error.html#variant.PoisonError -/// [`Manager`]: struct.Manager.html -pub fn take() -> Result<sync::MutexGuard<'static, Manager>, Error> { - MANAGER.try_lock().map_err(Into::into) -} - -/// Try to take an instance of the connection manager, ignoring a poisoned cache. -/// -/// There may only be one [`Manager`][] instance at the same time. If there already is an -/// instance, a [`ConcurrentAccessError`][] is returned. If you want a blocking version, use -/// [`take_blocking`][]. -/// -/// If a thread has previously panicked while accessing the manager instance, the cache is -/// poisoned. The default implementation, [`take`][], returns a [`PoisonError`][] on subsequent -/// calls. This implementation ignores the poisoned cache and returns the manager instance. -/// -/// # Errors -/// -/// - [`ConcurrentAccessError`][] if the token for the `Manager` instance cannot be locked -/// -/// [`take`]: fn.take.html -/// [`take_blocking`]: fn.take_blocking.html -/// [`ConcurrentAccessError`]: struct.Error.html#variant.ConcurrentAccessError -/// [`Manager`]: struct.Manager.html -pub fn force_take() -> Result<sync::MutexGuard<'static, Manager>, Error> { - match take() { - Ok(guard) => Ok(guard), - Err(err) => match err { - Error::PoisonError(err) => Ok(err.into_inner()), - err => Err(err), - }, - } -} - -/// Enables or disables debug output. Calling this method with `true` is equivalent to setting the -/// log level to `Debug`; calling it with `false` is equivalent to the log level `Error` (see -/// [`set_log_level`][]). -/// -/// If debug output is enabled, detailed information about the communication with the Nitrokey -/// device is printed to the standard output. -/// -/// [`set_log_level`]: fn.set_log_level.html -pub fn set_debug(state: bool) { - unsafe { - nitrokey_sys::NK_set_debug(state); - } -} - -/// Sets the log level for libnitrokey. All log messages are written to the standard error stream. -/// Setting the log level enables all log messages on the same or on a higher log level. -pub fn set_log_level(level: LogLevel) { - unsafe { - nitrokey_sys::NK_set_debug_level(level.into()); - } -} - -/// Returns the libnitrokey library version. -/// -/// # Errors -/// -/// - [`Utf8Error`][] if libnitrokey returned an invalid UTF-8 string -/// -/// # Example -/// -/// ``` -/// let version = nitrokey::get_library_version()?; -/// println!("Using libnitrokey {}", version.git); -/// # Ok::<(), nitrokey::Error>(()) -/// ``` -/// -/// [`Utf8Error`]: enum.Error.html#variant.Utf8Error -pub fn get_library_version() -> Result<Version, Error> { - // NK_get_library_version returns a static string, so we don’t have to free the pointer. - let git = unsafe { nitrokey_sys::NK_get_library_version() }; - let git = if git.is_null() { - String::new() - } else { - util::owned_str_from_ptr(git)? - }; - let major = unsafe { nitrokey_sys::NK_get_major_library_version() }; - let minor = unsafe { nitrokey_sys::NK_get_minor_library_version() }; - Ok(Version { git, major, minor }) -} diff --git a/nitrokey/src/otp.rs b/nitrokey/src/otp.rs deleted file mode 100644 index 4667aff..0000000 --- a/nitrokey/src/otp.rs +++ /dev/null @@ -1,423 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use std::ffi::CString; - -use nitrokey_sys; - -use crate::error::Error; -use crate::util::{get_command_result, get_cstring, result_from_string}; - -/// Modes for one-time password generation. -#[derive(Clone, Copy, Debug, PartialEq)] -pub enum OtpMode { - /// Generate one-time passwords with six digits. - SixDigits, - /// Generate one-time passwords with eight digits. - EightDigits, -} - -/// Provides methods to configure and erase OTP slots on a Nitrokey device. -pub trait ConfigureOtp { - /// Configure an HOTP slot with the given data and set the HOTP counter to the given value - /// (default 0). - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - [`InvalidString`][] if the provided token ID contains a null byte - /// - [`NoName`][] if the provided name is empty - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Authenticate, ConfigureOtp, OtpMode, OtpSlotData}; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let slot_data = OtpSlotData::new(1, "test", "01234567890123456689", OtpMode::SixDigits); - /// match device.authenticate_admin("12345678") { - /// Ok(mut admin) => { - /// match admin.write_hotp_slot(slot_data, 0) { - /// Ok(()) => println!("Successfully wrote slot."), - /// Err(err) => eprintln!("Could not write slot: {}", err), - /// } - /// }, - /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err), - /// } - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`NoName`]: enum.CommandError.html#variant.NoName - fn write_hotp_slot(&mut self, data: OtpSlotData, counter: u64) -> Result<(), Error>; - - /// Configure a TOTP slot with the given data and set the TOTP time window to the given value - /// (default 30). - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - [`InvalidString`][] if the provided token ID contains a null byte - /// - [`NoName`][] if the provided name is empty - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Authenticate, ConfigureOtp, OtpMode, OtpSlotData}; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// let slot_data = OtpSlotData::new(1, "test", "01234567890123456689", OtpMode::EightDigits); - /// match device.authenticate_admin("12345678") { - /// Ok(mut admin) => { - /// match admin.write_totp_slot(slot_data, 30) { - /// Ok(()) => println!("Successfully wrote slot."), - /// Err(err) => eprintln!("Could not write slot: {}", err), - /// } - /// }, - /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err), - /// } - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`NoName`]: enum.CommandError.html#variant.NoName - fn write_totp_slot(&mut self, data: OtpSlotData, time_window: u16) -> Result<(), Error>; - - /// Erases an HOTP slot. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Authenticate, ConfigureOtp}; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// match device.authenticate_admin("12345678") { - /// Ok(mut admin) => { - /// match admin.erase_hotp_slot(1) { - /// Ok(()) => println!("Successfully erased slot."), - /// Err(err) => eprintln!("Could not erase slot: {}", err), - /// } - /// }, - /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err), - /// } - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - fn erase_hotp_slot(&mut self, slot: u8) -> Result<(), Error>; - - /// Erases a TOTP slot. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Authenticate, ConfigureOtp}; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// match device.authenticate_admin("12345678") { - /// Ok(mut admin) => { - /// match admin.erase_totp_slot(1) { - /// Ok(()) => println!("Successfully erased slot."), - /// Err(err) => eprintln!("Could not erase slot: {}", err), - /// } - /// }, - /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err), - /// } - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - fn erase_totp_slot(&mut self, slot: u8) -> Result<(), Error>; -} - -/// Provides methods to generate OTP codes and to query OTP slots on a Nitrokey -/// device. -pub trait GenerateOtp { - /// Sets the time on the Nitrokey. - /// - /// `time` is the number of seconds since January 1st, 1970 (Unix timestamp). Unless `force` - /// is set to `true`, this command fails if the timestamp on the device is larger than the - /// given timestamp or if it is zero. - /// - /// The time is used for TOTP generation (see [`get_totp_code`][]). - /// - /// # Example - /// - /// ```no_run - /// use std::time; - /// use nitrokey::GenerateOtp; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let time = time::SystemTime::now().duration_since(time::UNIX_EPOCH); - /// match time { - /// Ok(time) => device.set_time(time.as_secs(), false)?, - /// Err(_) => eprintln!("The system time is before the Unix epoch!"), - /// } - /// # Ok(()) - /// # } - /// ``` - /// - /// # Errors - /// - /// - [`Timestamp`][] if the time could not be set - /// - /// [`get_totp_code`]: #method.get_totp_code - /// [`Timestamp`]: enum.CommandError.html#variant.Timestamp - fn set_time(&mut self, time: u64, force: bool) -> Result<(), Error> { - let result = if force { - unsafe { nitrokey_sys::NK_totp_set_time(time) } - } else { - unsafe { nitrokey_sys::NK_totp_set_time_soft(time) } - }; - get_command_result(result) - } - - /// Returns the name of the given HOTP slot. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - [`SlotNotProgrammed`][] if the given slot is not configured - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{CommandError, Error, GenerateOtp}; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// match device.get_hotp_slot_name(1) { - /// Ok(name) => println!("HOTP slot 1: {}", name), - /// Err(Error::CommandError(CommandError::SlotNotProgrammed)) => eprintln!("HOTP slot 1 not programmed"), - /// Err(err) => eprintln!("Could not get slot name: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed - fn get_hotp_slot_name(&self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_get_hotp_slot_name(slot) }) - } - - /// Returns the name of the given TOTP slot. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - [`SlotNotProgrammed`][] if the given slot is not configured - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{CommandError, Error, GenerateOtp}; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let device = manager.connect()?; - /// match device.get_totp_slot_name(1) { - /// Ok(name) => println!("TOTP slot 1: {}", name), - /// Err(Error::CommandError(CommandError::SlotNotProgrammed)) => eprintln!("TOTP slot 1 not programmed"), - /// Err(err) => eprintln!("Could not get slot name: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed - fn get_totp_slot_name(&self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_get_totp_slot_name(slot) }) - } - - /// Generates an HOTP code on the given slot. This operation may require user authorization, - /// depending on the device configuration (see [`get_config`][]). - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - [`NotAuthorized`][] if OTP generation requires user authentication - /// - [`SlotNotProgrammed`][] if the given slot is not configured - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::GenerateOtp; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let code = device.get_hotp_code(1)?; - /// println!("Generated HOTP code on slot 1: {}", code); - /// # Ok(()) - /// # } - /// ``` - /// - /// [`get_config`]: trait.Device.html#method.get_config - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`NotAuthorized`]: enum.CommandError.html#variant.NotAuthorized - /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed - fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_get_hotp_code(slot) }) - } - - /// Generates a TOTP code on the given slot. This operation may require user authorization, - /// depending on the device configuration (see [`get_config`][]). - /// - /// To make sure that the Nitrokey’s time is in sync, consider calling [`set_time`][] before - /// calling this method. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if there is no slot with the given number - /// - [`NotAuthorized`][] if OTP generation requires user authentication - /// - [`SlotNotProgrammed`][] if the given slot is not configured - /// - /// # Example - /// - /// ```no_run - /// use std::time; - /// use nitrokey::GenerateOtp; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let time = time::SystemTime::now().duration_since(time::UNIX_EPOCH); - /// match time { - /// Ok(time) => { - /// device.set_time(time.as_secs(), false)?; - /// let code = device.get_totp_code(1)?; - /// println!("Generated TOTP code on slot 1: {}", code); - /// }, - /// Err(_) => eprintln!("Timestamps before 1970-01-01 are not supported!"), - /// } - /// # Ok(()) - /// # } - /// ``` - /// - /// [`set_time`]: #method.set_time - /// [`get_config`]: trait.Device.html#method.get_config - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`NotAuthorized`]: enum.CommandError.html#variant.NotAuthorized - /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed - fn get_totp_code(&self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_get_totp_code(slot, 0, 0, 0) }) - } -} - -/// The configuration for an OTP slot. -#[derive(Debug)] -pub struct OtpSlotData { - /// The number of the slot – must be less than three for HOTP and less than 15 for TOTP. - pub number: u8, - /// The name of the slot – must not be empty. - pub name: String, - /// The secret for the slot. - pub secret: String, - /// The OTP generation mode. - pub mode: OtpMode, - /// If true, press the enter key after sending an OTP code using double-pressed - /// numlock, capslock or scrolllock. - pub use_enter: bool, - /// Set the token ID, see [OATH Token Identifier Specification][tokspec], section “Class A”. - /// - /// [tokspec]: https://openauthentication.org/token-specs/ - pub token_id: Option<String>, -} - -#[derive(Debug)] -pub struct RawOtpSlotData { - pub number: u8, - pub name: CString, - pub secret: CString, - pub mode: OtpMode, - pub use_enter: bool, - pub use_token_id: bool, - pub token_id: CString, -} - -impl OtpSlotData { - /// Constructs a new instance of this struct. - pub fn new<S: Into<String>, T: Into<String>>( - number: u8, - name: S, - secret: T, - mode: OtpMode, - ) -> OtpSlotData { - OtpSlotData { - number, - name: name.into(), - secret: secret.into(), - mode, - use_enter: false, - token_id: None, - } - } - - /// Enables pressing the enter key after sending an OTP code using double-pressed numlock, - /// capslock or scrollock. - pub fn use_enter(mut self) -> OtpSlotData { - self.use_enter = true; - self - } - - /// Sets the token ID, see [OATH Token Identifier Specification][tokspec], section “Class A”. - /// - /// [tokspec]: https://openauthentication.org/token-specs/ - pub fn token_id<S: Into<String>>(mut self, id: S) -> OtpSlotData { - self.token_id = Some(id.into()); - self - } -} - -impl RawOtpSlotData { - pub fn new(data: OtpSlotData) -> Result<RawOtpSlotData, Error> { - let name = get_cstring(data.name)?; - let secret = get_cstring(data.secret)?; - let use_token_id = data.token_id.is_some(); - let token_id = get_cstring(data.token_id.unwrap_or_else(String::new))?; - - Ok(RawOtpSlotData { - number: data.number, - name, - secret, - mode: data.mode, - use_enter: data.use_enter, - use_token_id, - token_id, - }) - } -} diff --git a/nitrokey/src/pws.rs b/nitrokey/src/pws.rs deleted file mode 100644 index 3398deb..0000000 --- a/nitrokey/src/pws.rs +++ /dev/null @@ -1,391 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use libc; -use nitrokey_sys; - -use crate::device::{Device, DeviceWrapper, Pro, Storage}; -use crate::error::{CommandError, Error}; -use crate::util::{get_command_result, get_cstring, get_last_error, result_from_string}; - -/// The number of slots in a [`PasswordSafe`][]. -/// -/// [`PasswordSafe`]: struct.PasswordSafe.html -pub const SLOT_COUNT: u8 = 16; - -/// A password safe on a Nitrokey device. -/// -/// The password safe stores a tuple consisting of a name, a login and a password on a slot. The -/// number of available slots is [`SLOT_COUNT`][]. The slots are addressed starting with zero. To -/// retrieve a password safe from a Nitrokey device, use the [`get_password_safe`][] method from -/// the [`GetPasswordSafe`][] trait. Note that the device must live at least as long as the -/// password safe. -/// -/// Once the password safe has been unlocked, it can be accessed without a password. Therefore it -/// is mandatory to call [`lock`][] on the corresponding device after the password store is used. -/// As this command may have side effects on the Nitrokey Storage, it cannot be called -/// automatically once the password safe is destroyed. -/// -/// # Examples -/// -/// Open a password safe and access a password: -/// -/// ```no_run -/// use nitrokey::{Device, GetPasswordSafe, PasswordSafe}; -/// # use nitrokey::Error; -/// -/// fn use_password_safe(pws: &PasswordSafe) -> Result<(), Error> { -/// let name = pws.get_slot_name(0)?; -/// let login = pws.get_slot_login(0)?; -/// let password = pws.get_slot_login(0)?; -/// println!("Credentials for {}: login {}, password {}", name, login, password); -/// Ok(()) -/// } -/// -/// # fn try_main() -> Result<(), Error> { -/// let mut manager = nitrokey::take()?; -/// let mut device = manager.connect()?; -/// let pws = device.get_password_safe("123456")?; -/// use_password_safe(&pws); -/// drop(pws); -/// device.lock()?; -/// # Ok(()) -/// # } -/// ``` -/// -/// [`SLOT_COUNT`]: constant.SLOT_COUNT.html -/// [`get_password_safe`]: trait.GetPasswordSafe.html#method.get_password_safe -/// [`lock`]: trait.Device.html#method.lock -/// [`GetPasswordSafe`]: trait.GetPasswordSafe.html -#[derive(Debug)] -pub struct PasswordSafe<'a, 'b> { - _device: &'a dyn Device<'b>, -} - -/// Provides access to a [`PasswordSafe`][]. -/// -/// The device that implements this trait must always live at least as long as a password safe -/// retrieved from it. -/// -/// [`PasswordSafe`]: struct.PasswordSafe.html -pub trait GetPasswordSafe<'a> { - /// Enables and returns the password safe. - /// - /// The underlying device must always live at least as long as a password safe retrieved from - /// it. It is mandatory to lock the underlying device using [`lock`][] after the password safe - /// has been used. Otherwise, other applications can access the password store without - /// authentication. - /// - /// If this method returns an `AesDecryptionFailed` (Nitrokey Pro) or `Unknown` (Nitrokey - /// Storage) error, the AES data object on the smart card could not be accessed. This problem - /// occurs after a factory reset using `gpg --card-edit` and can be fixed using the - /// [`Device::build_aes_key`][] command. - /// - /// # Errors - /// - /// - [`AesDecryptionFailed`][] if the secret for the password safe could not be decrypted - /// (Nitrokey Pro only) - /// - [`InvalidString`][] if one of the provided passwords contains a null byte - /// - [`Unknown`][] if the secret for the password safe could not be decrypted (Nitrokey - /// Storage only) - /// - [`WrongPassword`][] if the current user password is wrong - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{Device, GetPasswordSafe, PasswordSafe}; - /// # use nitrokey::Error; - /// - /// fn use_password_safe(pws: &PasswordSafe) {} - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.get_password_safe("123456") { - /// Ok(pws) => { - /// use_password_safe(&pws); - /// }, - /// Err(err) => eprintln!("Could not open the password safe: {}", err), - /// }; - /// device.lock()?; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`device`]: struct.PasswordSafe.html#method.device - /// [`lock`]: trait.Device.html#method.lock - /// [`AesDecryptionFailed`]: enum.CommandError.html#variant.AesDecryptionFailed - /// [`Device::build_aes_key`]: trait.Device.html#method.build_aes_key - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - /// [`Unknown`]: enum.CommandError.html#variant.Unknown - /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword - fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error>; -} - -fn get_password_safe<'a, 'b>( - device: &'a dyn Device<'b>, - user_pin: &str, -) -> Result<PasswordSafe<'a, 'b>, Error> { - let user_pin_string = get_cstring(user_pin)?; - get_command_result(unsafe { nitrokey_sys::NK_enable_password_safe(user_pin_string.as_ptr()) }) - .map(|_| PasswordSafe { _device: device }) -} - -fn get_pws_result(s: String) -> Result<String, Error> { - if s.is_empty() { - Err(CommandError::SlotNotProgrammed.into()) - } else { - Ok(s) - } -} - -impl<'a, 'b> PasswordSafe<'a, 'b> { - /// Returns the status of all password slots. - /// - /// The status indicates whether a slot is programmed or not. - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::{GetPasswordSafe, SLOT_COUNT}; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let pws = device.get_password_safe("123456")?; - /// pws.get_slot_status()?.iter().enumerate().for_each(|(slot, programmed)| { - /// let status = match *programmed { - /// true => "programmed", - /// false => "not programmed", - /// }; - /// println!("Slot {}: {}", slot, status); - /// }); - /// # Ok(()) - /// # } - /// ``` - pub fn get_slot_status(&self) -> Result<[bool; SLOT_COUNT as usize], Error> { - let status_ptr = unsafe { nitrokey_sys::NK_get_password_safe_slot_status() }; - if status_ptr.is_null() { - return Err(get_last_error()); - } - let status_array_ptr = status_ptr as *const [u8; SLOT_COUNT as usize]; - let status_array = unsafe { *status_array_ptr }; - let mut result = [false; SLOT_COUNT as usize]; - for i in 0..SLOT_COUNT { - result[i as usize] = status_array[i as usize] == 1; - } - unsafe { - libc::free(status_ptr as *mut libc::c_void); - } - Ok(result) - } - - /// Returns the name of the given slot (if it is programmed). - /// - /// This method also returns a `SlotNotProgrammed` error if the name is empty. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if the given slot is out of range - /// - [`SlotNotProgrammed`][] if the slot is not programmed - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::GetPasswordSafe; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// match device.get_password_safe("123456") { - /// Ok(pws) => { - /// let name = pws.get_slot_name(0)?; - /// let login = pws.get_slot_login(0)?; - /// let password = pws.get_slot_login(0)?; - /// println!("Credentials for {}: login {}, password {}", name, login, password); - /// }, - /// Err(err) => eprintln!("Could not open the password safe: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed - pub fn get_slot_name(&self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_get_password_safe_slot_name(slot) }) - .and_then(get_pws_result) - } - - /// Returns the login for the given slot (if it is programmed). - /// - /// This method also returns a `SlotNotProgrammed` error if the login is empty. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if the given slot is out of range - /// - [`SlotNotProgrammed`][] if the slot is not programmed - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::GetPasswordSafe; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let pws = device.get_password_safe("123456")?; - /// let name = pws.get_slot_name(0)?; - /// let login = pws.get_slot_login(0)?; - /// let password = pws.get_slot_login(0)?; - /// println!("Credentials for {}: login {}, password {}", name, login, password); - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed - pub fn get_slot_login(&self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_get_password_safe_slot_login(slot) }) - .and_then(get_pws_result) - } - - /// Returns the password for the given slot (if it is programmed). - /// - /// This method also returns a `SlotNotProgrammed` error if the password is empty. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if the given slot is out of range - /// - [`SlotNotProgrammed`][] if the slot is not programmed - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::GetPasswordSafe; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let pws = device.get_password_safe("123456")?; - /// let name = pws.get_slot_name(0)?; - /// let login = pws.get_slot_login(0)?; - /// let password = pws.get_slot_login(0)?; - /// println!("Credentials for {}: login {}, password {}", name, login, password); - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed - pub fn get_slot_password(&self, slot: u8) -> Result<String, Error> { - result_from_string(unsafe { nitrokey_sys::NK_get_password_safe_slot_password(slot) }) - .and_then(get_pws_result) - } - - /// Writes the given slot with the given name, login and password. - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if the given slot is out of range - /// - [`InvalidString`][] if the provided token ID contains a null byte - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::GetPasswordSafe; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let pws = device.get_password_safe("123456")?; - /// let name = pws.get_slot_name(0)?; - /// let login = pws.get_slot_login(0)?; - /// let password = pws.get_slot_login(0)?; - /// println!("Credentials for {}: login {}, password {}", name, login, password); - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString - pub fn write_slot( - &mut self, - slot: u8, - name: &str, - login: &str, - password: &str, - ) -> Result<(), Error> { - let name_string = get_cstring(name)?; - let login_string = get_cstring(login)?; - let password_string = get_cstring(password)?; - get_command_result(unsafe { - nitrokey_sys::NK_write_password_safe_slot( - slot, - name_string.as_ptr(), - login_string.as_ptr(), - password_string.as_ptr(), - ) - }) - } - - /// Erases the given slot. Erasing clears the stored name, login and password (if the slot was - /// programmed). - /// - /// # Errors - /// - /// - [`InvalidSlot`][] if the given slot is out of range - /// - /// # Example - /// - /// ```no_run - /// use nitrokey::GetPasswordSafe; - /// # use nitrokey::Error; - /// - /// # fn try_main() -> Result<(), Error> { - /// let mut manager = nitrokey::take()?; - /// let mut device = manager.connect()?; - /// let mut pws = device.get_password_safe("123456")?; - /// match pws.erase_slot(0) { - /// Ok(()) => println!("Erased slot 0."), - /// Err(err) => eprintln!("Could not erase slot 0: {}", err), - /// }; - /// # Ok(()) - /// # } - /// ``` - /// - /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot - pub fn erase_slot(&mut self, slot: u8) -> Result<(), Error> { - get_command_result(unsafe { nitrokey_sys::NK_erase_password_safe_slot(slot) }) - } -} - -impl<'a, 'b> Drop for PasswordSafe<'a, 'b> { - fn drop(&mut self) { - // TODO: disable the password safe -- NK_lock_device has side effects on the Nitrokey - // Storage, see https://github.com/Nitrokey/nitrokey-storage-firmware/issues/65 - } -} - -impl<'a> GetPasswordSafe<'a> for Pro<'a> { - fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error> { - get_password_safe(self, user_pin) - } -} - -impl<'a> GetPasswordSafe<'a> for Storage<'a> { - fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error> { - get_password_safe(self, user_pin) - } -} - -impl<'a> GetPasswordSafe<'a> for DeviceWrapper<'a> { - fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error> { - get_password_safe(self, user_pin) - } -} diff --git a/nitrokey/src/util.rs b/nitrokey/src/util.rs deleted file mode 100644 index 5a56c55..0000000 --- a/nitrokey/src/util.rs +++ /dev/null @@ -1,99 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -use std::ffi::{CStr, CString}; -use std::os::raw::{c_char, c_int}; - -use libc::{c_void, free}; -use rand_core::{OsRng, RngCore}; - -use crate::error::{Error, LibraryError}; - -/// Log level for libnitrokey. -/// -/// Setting the log level to a lower level enables all output from higher levels too. Currently, -/// only the log levels `Warning`, `DebugL1`, `Debug` and `DebugL2` are actually used. -#[derive(Clone, Copy, Debug, PartialEq)] -pub enum LogLevel { - /// Error messages. Currently not used. - Error, - /// Warning messages. - Warning, - /// Informational messages. Currently not used. - Info, - /// Basic debug messages, especially basic information on the sent and received packets. - DebugL1, - /// Detailed debug messages, especially detailed information on the sent and received packets. - Debug, - /// Very detailed debug messages, especially detailed information about the control flow for - /// device communication (for example function entries and exits). - DebugL2, -} - -pub fn owned_str_from_ptr(ptr: *const c_char) -> Result<String, Error> { - unsafe { CStr::from_ptr(ptr) } - .to_str() - .map(String::from) - .map_err(Error::from) -} - -pub fn result_from_string(ptr: *const c_char) -> Result<String, Error> { - if ptr.is_null() { - return Err(Error::UnexpectedError); - } - let s = owned_str_from_ptr(ptr)?; - unsafe { free(ptr as *mut c_void) }; - // An empty string can both indicate an error or be a valid return value. In this case, we - // have to check the last command status to decide what to return. - if s.is_empty() { - get_last_result().map(|_| s) - } else { - Ok(s) - } -} - -pub fn result_or_error<T>(value: T) -> Result<T, Error> { - get_last_result().and(Ok(value)) -} - -pub fn get_command_result(value: c_int) -> Result<(), Error> { - if value == 0 { - Ok(()) - } else { - Err(Error::from(value)) - } -} - -pub fn get_last_result() -> Result<(), Error> { - get_command_result(unsafe { nitrokey_sys::NK_get_last_command_status() }.into()) -} - -pub fn get_last_error() -> Error { - match get_last_result() { - Ok(()) => Error::UnexpectedError, - Err(err) => err, - } -} - -pub fn generate_password(length: usize) -> Result<Vec<u8>, Error> { - let mut data = vec![0u8; length]; - OsRng.fill_bytes(&mut data[..]); - Ok(data) -} - -pub fn get_cstring<T: Into<Vec<u8>>>(s: T) -> Result<CString, Error> { - CString::new(s).or_else(|_| Err(LibraryError::InvalidString.into())) -} - -impl Into<i32> for LogLevel { - fn into(self) -> i32 { - match self { - LogLevel::Error => 0, - LogLevel::Warning => 1, - LogLevel::Info => 2, - LogLevel::DebugL1 => 3, - LogLevel::Debug => 4, - LogLevel::DebugL2 => 5, - } - } -} diff --git a/nitrokey/tests/device.rs b/nitrokey/tests/device.rs deleted file mode 100644 index e367558..0000000 --- a/nitrokey/tests/device.rs +++ /dev/null @@ -1,575 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -mod util; - -use std::ffi::CStr; -use std::process::Command; -use std::{thread, time}; - -use nitrokey::{ - Authenticate, CommandError, CommunicationError, Config, ConfigureOtp, Device, Error, - GenerateOtp, GetPasswordSafe, LibraryError, OtpMode, OtpSlotData, Storage, VolumeMode, - DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN, -}; -use nitrokey_test::test as test_device; - -static ADMIN_NEW_PASSWORD: &str = "1234567890"; -static UPDATE_PIN: &str = "12345678"; -static UPDATE_NEW_PIN: &str = "87654321"; -static USER_NEW_PASSWORD: &str = "abcdefghij"; - -fn count_nitrokey_block_devices() -> usize { - thread::sleep(time::Duration::from_secs(2)); - let output = Command::new("lsblk") - .args(&["-o", "MODEL"]) - .output() - .expect("Could not list block devices"); - String::from_utf8_lossy(&output.stdout) - .split("\n") - .filter(|&s| s.replace("_", " ") == "Nitrokey Storage") - .count() -} - -#[test_device] -fn connect_no_device() { - let mut manager = unwrap_ok!(nitrokey::take()); - - assert_cmu_err!(CommunicationError::NotConnected, manager.connect()); - assert_cmu_err!( - CommunicationError::NotConnected, - manager.connect_model(nitrokey::Model::Pro) - ); - assert_cmu_err!( - CommunicationError::NotConnected, - manager.connect_model(nitrokey::Model::Storage) - ); - assert_cmu_err!(CommunicationError::NotConnected, manager.connect_pro()); - assert_cmu_err!(CommunicationError::NotConnected, manager.connect_storage()); -} - -#[test_device] -fn connect_pro(device: Pro) { - assert_eq!(device.get_model(), nitrokey::Model::Pro); - - let manager = device.into_manager(); - assert_any_ok!(manager.connect()); - assert_any_ok!(manager.connect_model(nitrokey::Model::Pro)); - assert_any_ok!(manager.connect_pro()); -} - -#[test_device] -fn connect_storage(device: Storage) { - assert_eq!(device.get_model(), nitrokey::Model::Storage); - - let manager = device.into_manager(); - assert_any_ok!(manager.connect()); - assert_any_ok!(manager.connect_model(nitrokey::Model::Storage)); - assert_any_ok!(manager.connect_storage()); -} - -fn assert_empty_serial_number() { - unsafe { - let ptr = nitrokey_sys::NK_device_serial_number(); - assert!(!ptr.is_null()); - let cstr = CStr::from_ptr(ptr); - assert_eq!(cstr.to_string_lossy(), ""); - } -} - -#[test_device] -fn disconnect(device: DeviceWrapper) { - drop(device); - assert_empty_serial_number(); -} - -#[test_device] -fn get_serial_number(device: DeviceWrapper) { - let serial_number = unwrap_ok!(device.get_serial_number()); - assert!(serial_number.is_ascii()); - assert!(serial_number.chars().all(|c| c.is_ascii_hexdigit())); -} -#[test_device] -fn get_firmware_version(device: Pro) { - let version = unwrap_ok!(device.get_firmware_version()); - assert_eq!(0, version.major); - assert!(version.minor > 0); -} - -fn admin_retry<'a, T>(device: T, suffix: &str, count: u8) -> T -where - T: Authenticate<'a> + Device<'a> + 'a, -{ - let result = device.authenticate_admin(&(DEFAULT_ADMIN_PIN.to_owned() + suffix)); - let device = match result { - Ok(admin) => admin.device(), - Err((device, _)) => device, - }; - assert_ok!(count, device.get_admin_retry_count()); - return device; -} - -fn user_retry<'a, T>(device: T, suffix: &str, count: u8) -> T -where - T: Authenticate<'a> + Device<'a> + 'a, -{ - let result = device.authenticate_user(&(DEFAULT_USER_PIN.to_owned() + suffix)); - let device = match result { - Ok(admin) => admin.device(), - Err((device, _)) => device, - }; - assert_ok!(count, device.get_user_retry_count()); - return device; -} - -#[test_device] -fn get_retry_count(device: DeviceWrapper) { - let device = admin_retry(device, "", 3); - let device = admin_retry(device, "123", 2); - let device = admin_retry(device, "456", 1); - let device = admin_retry(device, "", 3); - - let device = user_retry(device, "", 3); - let device = user_retry(device, "123", 2); - let device = user_retry(device, "456", 1); - user_retry(device, "", 3); -} - -#[test_device] -fn config(device: DeviceWrapper) { - let mut admin = unwrap_ok!(device.authenticate_admin(DEFAULT_ADMIN_PIN)); - - let config = Config::new(None, None, None, true); - assert_ok!((), admin.write_config(config)); - assert_ok!(config, admin.get_config()); - - let config = Config::new(None, Some(9), None, true); - assert_lib_err!(LibraryError::InvalidSlot, admin.write_config(config)); - - let config = Config::new(Some(1), None, Some(0), false); - assert_ok!((), admin.write_config(config)); - assert_ok!(config, admin.get_config()); - - let config = Config::new(None, None, None, false); - assert_ok!((), admin.write_config(config)); - assert_ok!(config, admin.get_config()); -} - -#[test_device] -fn change_user_pin(device: DeviceWrapper) { - let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device(); - let device = device.authenticate_user(USER_NEW_PASSWORD).unwrap_err().0; - - let mut device = device; - assert_ok!( - (), - device.change_user_pin(DEFAULT_USER_PIN, USER_NEW_PASSWORD) - ); - - let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap_err().0; - let device = device - .authenticate_user(USER_NEW_PASSWORD) - .unwrap() - .device(); - - let mut device = device; - let result = device.change_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN); - assert_cmd_err!(CommandError::WrongPassword, result); - - assert_ok!( - (), - device.change_user_pin(USER_NEW_PASSWORD, DEFAULT_USER_PIN) - ); - - let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device(); - assert!(device.authenticate_user(USER_NEW_PASSWORD).is_err()); -} - -#[test_device] -fn change_admin_pin(device: DeviceWrapper) { - let device = device - .authenticate_admin(DEFAULT_ADMIN_PIN) - .unwrap() - .device(); - let mut device = device.authenticate_admin(ADMIN_NEW_PASSWORD).unwrap_err().0; - - assert_ok!( - (), - device.change_admin_pin(DEFAULT_ADMIN_PIN, ADMIN_NEW_PASSWORD) - ); - - let device = device.authenticate_admin(DEFAULT_ADMIN_PIN).unwrap_err().0; - let mut device = device - .authenticate_admin(ADMIN_NEW_PASSWORD) - .unwrap() - .device(); - - assert_cmd_err!( - CommandError::WrongPassword, - device.change_admin_pin(DEFAULT_ADMIN_PIN, DEFAULT_ADMIN_PIN) - ); - - assert_ok!( - (), - device.change_admin_pin(ADMIN_NEW_PASSWORD, DEFAULT_ADMIN_PIN) - ); - - let device = device - .authenticate_admin(DEFAULT_ADMIN_PIN) - .unwrap() - .device(); - device.authenticate_admin(ADMIN_NEW_PASSWORD).unwrap_err(); -} - -fn require_failed_user_login<'a, D>(device: D, password: &str, error: CommandError) -> D -where - D: Device<'a> + Authenticate<'a> + 'a, - nitrokey::User<'a, D>: std::fmt::Debug, -{ - let result = device.authenticate_user(password); - assert!(result.is_err()); - let err = result.unwrap_err(); - match err.1 { - Error::CommandError(err) => assert_eq!(error, err), - _ => assert!(false), - }; - err.0 -} - -#[test_device] -fn unlock_user_pin(device: DeviceWrapper) { - let mut device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device(); - assert_ok!( - (), - device.unlock_user_pin(DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN) - ); - assert_cmd_err!( - CommandError::WrongPassword, - device.unlock_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN) - ); - - // block user PIN - let wrong_password = DEFAULT_USER_PIN.to_owned() + "foo"; - let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword); - let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword); - let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword); - let mut device = - require_failed_user_login(device, DEFAULT_USER_PIN, CommandError::WrongPassword); - - // unblock with current PIN - assert_cmd_err!( - CommandError::WrongPassword, - device.unlock_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN) - ); - assert_ok!( - (), - device.unlock_user_pin(DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN) - ); - let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device(); - - // block user PIN - let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword); - let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword); - let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword); - let mut device = - require_failed_user_login(device, DEFAULT_USER_PIN, CommandError::WrongPassword); - - // unblock with new PIN - assert_cmd_err!( - CommandError::WrongPassword, - device.unlock_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN) - ); - assert_ok!( - (), - device.unlock_user_pin(DEFAULT_ADMIN_PIN, USER_NEW_PASSWORD) - ); - - // reset user PIN - assert_ok!( - (), - device.change_user_pin(USER_NEW_PASSWORD, DEFAULT_USER_PIN) - ); -} - -fn assert_utf8_err_or_ne(left: &str, right: Result<String, Error>) { - match right { - Ok(s) => assert_ne!(left.to_string(), s), - Err(Error::Utf8Error(_)) => {} - Err(err) => panic!("Expected Utf8Error, got {}!", err), - } -} - -#[test_device] -fn factory_reset(device: DeviceWrapper) { - let mut admin = unwrap_ok!(device.authenticate_admin(DEFAULT_ADMIN_PIN)); - let otp_data = OtpSlotData::new(1, "test", "0123468790", OtpMode::SixDigits); - assert_ok!((), admin.write_totp_slot(otp_data, 30)); - - let mut device = admin.device(); - let mut pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN)); - assert_ok!((), pws.write_slot(0, "test", "testlogin", "testpw")); - drop(pws); - - assert_ok!( - (), - device.change_user_pin(DEFAULT_USER_PIN, USER_NEW_PASSWORD) - ); - assert_ok!( - (), - device.change_admin_pin(DEFAULT_ADMIN_PIN, ADMIN_NEW_PASSWORD) - ); - - assert_cmd_err!( - CommandError::WrongPassword, - device.factory_reset(USER_NEW_PASSWORD) - ); - assert_cmd_err!( - CommandError::WrongPassword, - device.factory_reset(DEFAULT_ADMIN_PIN) - ); - assert_ok!((), device.factory_reset(ADMIN_NEW_PASSWORD)); - - let device = device - .authenticate_admin(DEFAULT_ADMIN_PIN) - .unwrap() - .device(); - - let user = unwrap_ok!(device.authenticate_user(DEFAULT_USER_PIN)); - assert_cmd_err!(CommandError::SlotNotProgrammed, user.get_totp_slot_name(1)); - - let mut device = user.device(); - let pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN)); - assert_utf8_err_or_ne("test", pws.get_slot_name(0)); - assert_utf8_err_or_ne("testlogin", pws.get_slot_login(0)); - assert_utf8_err_or_ne("testpw", pws.get_slot_password(0)); - drop(pws); - - assert_ok!(3, device.get_user_retry_count()); - assert_ok!((), device.build_aes_key(DEFAULT_ADMIN_PIN)); -} - -#[test_device] -fn build_aes_key(device: DeviceWrapper) { - let mut device = device; - let mut pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN)); - assert_ok!((), pws.write_slot(0, "test", "testlogin", "testpw")); - drop(pws); - - assert_cmd_err!( - CommandError::WrongPassword, - device.build_aes_key(DEFAULT_USER_PIN) - ); - assert_ok!((), device.build_aes_key(DEFAULT_ADMIN_PIN)); - - let mut device = device - .authenticate_admin(DEFAULT_ADMIN_PIN) - .unwrap() - .device(); - - let pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN)); - assert_utf8_err_or_ne("test", pws.get_slot_name(0)); - assert_utf8_err_or_ne("testlogin", pws.get_slot_login(0)); - assert_utf8_err_or_ne("testpw", pws.get_slot_password(0)); -} - -#[test_device] -fn change_update_pin(device: Storage) { - let mut device = device; - assert_cmd_err!( - CommandError::WrongPassword, - device.change_update_pin(UPDATE_NEW_PIN, UPDATE_PIN) - ); - assert_ok!((), device.change_update_pin(UPDATE_PIN, UPDATE_NEW_PIN)); - assert_ok!((), device.change_update_pin(UPDATE_NEW_PIN, UPDATE_PIN)); -} - -#[test_device] -fn encrypted_volume(device: Storage) { - let mut device = device; - assert_ok!((), device.lock()); - - assert_eq!(1, count_nitrokey_block_devices()); - assert_ok!((), device.disable_encrypted_volume()); - assert_eq!(1, count_nitrokey_block_devices()); - assert_cmd_err!( - CommandError::WrongPassword, - device.enable_encrypted_volume("123") - ); - assert_eq!(1, count_nitrokey_block_devices()); - assert_ok!((), device.enable_encrypted_volume(DEFAULT_USER_PIN)); - assert_eq!(2, count_nitrokey_block_devices()); - assert_ok!((), device.disable_encrypted_volume()); - assert_eq!(1, count_nitrokey_block_devices()); -} - -#[test_device] -fn hidden_volume(device: Storage) { - let mut device = device; - assert_ok!((), device.lock()); - - assert_eq!(1, count_nitrokey_block_devices()); - assert_ok!((), device.disable_hidden_volume()); - assert_eq!(1, count_nitrokey_block_devices()); - - assert_ok!((), device.enable_encrypted_volume(DEFAULT_USER_PIN)); - assert_eq!(2, count_nitrokey_block_devices()); - - // TODO: why this error code? - assert_cmd_err!( - CommandError::WrongPassword, - device.create_hidden_volume(5, 0, 100, "hiddenpw") - ); - assert_ok!((), device.create_hidden_volume(0, 20, 21, "hidden-pw")); - assert_ok!((), device.create_hidden_volume(0, 20, 21, "hiddenpassword")); - assert_ok!((), device.create_hidden_volume(1, 0, 1, "otherpw")); - // TODO: test invalid range (not handled by libnitrokey) - assert_eq!(2, count_nitrokey_block_devices()); - - assert_cmd_err!( - CommandError::WrongPassword, - device.enable_hidden_volume("blubb") - ); - assert_ok!((), device.enable_hidden_volume("hiddenpassword")); - assert_eq!(2, count_nitrokey_block_devices()); - assert_ok!((), device.enable_hidden_volume("otherpw")); - assert_eq!(2, count_nitrokey_block_devices()); - - assert_ok!((), device.disable_hidden_volume()); - assert_eq!(1, count_nitrokey_block_devices()); -} - -#[test_device] -fn lock(device: Storage) { - let mut device = device; - assert_ok!((), device.enable_encrypted_volume(DEFAULT_USER_PIN)); - assert_ok!((), device.lock()); - assert_eq!(1, count_nitrokey_block_devices()); -} - -#[test_device] -fn set_encrypted_volume_mode(device: Storage) { - // This test case does not check the device status as the command only works with firmware - // version 0.49. For later versions, it does not do anything and always returns Ok(()). - let mut device = device; - - assert_ok!( - (), - device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly) - ); - - // TODO: re-enable once the password is checked in the firmware - // assert_cmd_err!( - // CommandError::WrongPassword, - // device.set_encrypted_volume_mode(DEFAULT_USER_PIN, VolumeMode::ReadOnly) - // ); - - assert_ok!( - (), - device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly) - ); - assert_ok!( - (), - device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadWrite) - ); - assert_ok!( - (), - device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly) - ); -} - -#[test_device] -fn set_unencrypted_volume_mode(device: Storage) { - fn assert_mode(device: &Storage, mode: VolumeMode) { - let status = unwrap_ok!(device.get_status()); - assert_eq!( - status.unencrypted_volume.read_only, - mode == VolumeMode::ReadOnly - ); - } - - fn assert_success(device: &mut Storage, mode: VolumeMode) { - assert_ok!( - (), - device.set_unencrypted_volume_mode(DEFAULT_ADMIN_PIN, mode) - ); - assert_mode(&device, mode); - } - - let mut device = device; - assert_success(&mut device, VolumeMode::ReadOnly); - - assert_cmd_err!( - CommandError::WrongPassword, - device.set_unencrypted_volume_mode(DEFAULT_USER_PIN, VolumeMode::ReadOnly) - ); - assert_mode(&device, VolumeMode::ReadOnly); - - assert_success(&mut device, VolumeMode::ReadWrite); - assert_success(&mut device, VolumeMode::ReadWrite); - assert_success(&mut device, VolumeMode::ReadOnly); -} - -#[test_device] -fn get_storage_status(device: Storage) { - let status = unwrap_ok!(device.get_status()); - assert!(status.serial_number_sd_card > 0); - assert!(status.serial_number_smart_card > 0); -} - -#[test_device] -fn get_production_info(device: Storage) { - let info = unwrap_ok!(device.get_production_info()); - assert_eq!(0, info.firmware_version.major); - assert!(info.firmware_version.minor != 0); - assert!(info.serial_number_cpu != 0); - assert!(info.sd_card.serial_number != 0); - assert!(info.sd_card.size > 0); - assert!(info.sd_card.manufacturing_year > 10); - assert!(info.sd_card.manufacturing_year < 100); - // TODO: month value is not valid atm - // assert!(info.sd_card.manufacturing_month < 12); - assert!(info.sd_card.oem != 0); - assert!(info.sd_card.manufacturer != 0); - - let status = unwrap_ok!(device.get_status()); - assert_eq!(status.firmware_version, info.firmware_version); - assert_eq!(status.serial_number_sd_card, info.sd_card.serial_number); -} - -#[test_device] -fn clear_new_sd_card_warning(device: Storage) { - let mut device = device; - assert_ok!((), device.factory_reset(DEFAULT_ADMIN_PIN)); - thread::sleep(time::Duration::from_secs(3)); - assert_ok!((), device.build_aes_key(DEFAULT_ADMIN_PIN)); - - // We have to perform an SD card operation to reset the new_sd_card_found field - assert_ok!((), device.lock()); - - let status = unwrap_ok!(device.get_status()); - assert!(status.new_sd_card_found); - - assert_ok!((), device.clear_new_sd_card_warning(DEFAULT_ADMIN_PIN)); - - let status = unwrap_ok!(device.get_status()); - assert!(!status.new_sd_card_found); -} - -#[test_device] -fn export_firmware(device: Storage) { - let mut device = device; - assert_cmd_err!( - CommandError::WrongPassword, - device.export_firmware("someadminpn") - ); - assert_ok!((), device.export_firmware(DEFAULT_ADMIN_PIN)); - assert_ok!( - (), - device.set_unencrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadWrite) - ); - assert_ok!((), device.export_firmware(DEFAULT_ADMIN_PIN)); - assert_ok!( - (), - device.set_unencrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly) - ); -} diff --git a/nitrokey/tests/lib.rs b/nitrokey/tests/lib.rs deleted file mode 100644 index 25aae0f..0000000 --- a/nitrokey/tests/lib.rs +++ /dev/null @@ -1,28 +0,0 @@ -// Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -mod util; - -#[test] -fn get_library_version() { - let version = unwrap_ok!(nitrokey::get_library_version()); - - assert!(version.git.is_empty() || version.git.starts_with("v")); - assert!(version.major > 0); -} - -#[test] -fn take_manager() { - assert!(nitrokey::take().is_ok()); - - let result = nitrokey::take(); - assert!(result.is_ok()); - let result2 = nitrokey::take(); - match result2 { - Ok(_) => panic!("Expected error, got Ok(_)!"), - Err(nitrokey::Error::ConcurrentAccessError) => {} - Err(err) => panic!("Expected ConcurrentAccessError, got {}", err), - } - drop(result); - assert!(nitrokey::take().is_ok()); -} diff --git a/nitrokey/tests/otp.rs b/nitrokey/tests/otp.rs deleted file mode 100644 index 38cd8a9..0000000 --- a/nitrokey/tests/otp.rs +++ /dev/null @@ -1,287 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -mod util; - -use std::fmt::Debug; -use std::ops::DerefMut; - -use nitrokey::{ - Admin, Authenticate, CommandError, Config, ConfigureOtp, Device, GenerateOtp, LibraryError, - OtpMode, OtpSlotData, DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN, -}; -use nitrokey_test::test as test_device; - -// test suite according to RFC 4226, Appendix D -static HOTP_SECRET: &str = "3132333435363738393031323334353637383930"; -static HOTP_CODES: &[&str] = &[ - "755224", "287082", "359152", "969429", "338314", "254676", "287922", "162583", "399871", - "520489", -]; - -// test suite according to RFC 6238, Appendix B -static TOTP_SECRET: &str = "3132333435363738393031323334353637383930"; -static TOTP_CODES: &[(u64, &[&str])] = &[ - (59, &["94287082", "37359152"]), - (1111111109, &["07081804"]), - (1111111111, &["14050471"]), - (1234567890, &["89005924"]), - (2000000000, &["69279037"]), - (20000000000, &["65353130"]), -]; - -#[derive(PartialEq)] -enum TotpTimestampSize { - U32, - U64, -} - -fn make_admin_test_device<'a, T>(device: T) -> Admin<'a, T> -where - T: Device<'a>, - (T, nitrokey::Error): Debug, -{ - unwrap_ok!(device.authenticate_admin(DEFAULT_ADMIN_PIN)) -} - -fn configure_hotp(admin: &mut dyn ConfigureOtp, counter: u8) { - let slot_data = OtpSlotData::new(1, "test-hotp", HOTP_SECRET, OtpMode::SixDigits); - assert_ok!((), admin.write_hotp_slot(slot_data, counter.into())); -} - -fn check_hotp_codes(device: &mut dyn GenerateOtp, offset: u8) { - HOTP_CODES.iter().enumerate().for_each(|(i, code)| { - if i >= offset as usize { - assert_ok!(code.to_string(), device.get_hotp_code(1)); - } - }); -} - -#[test_device] -fn set_time(device: DeviceWrapper) { - let mut device = device; - assert_ok!((), device.set_time(1546385382, true)); - assert_ok!((), device.set_time(1546385392, false)); - assert_cmd_err!(CommandError::Timestamp, device.set_time(1546385292, false)); - assert_ok!((), device.set_time(1546385382, true)); -} - -#[test_device] -fn hotp_no_pin(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, false); - assert_ok!((), admin.write_config(config)); - - configure_hotp(&mut admin, 0); - check_hotp_codes(admin.deref_mut(), 0); - - configure_hotp(&mut admin, 5); - check_hotp_codes(admin.deref_mut(), 5); - - configure_hotp(&mut admin, 0); - check_hotp_codes(&mut admin.device(), 0); -} - -#[test_device] -fn hotp_pin(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, true); - assert_ok!((), admin.write_config(config)); - - configure_hotp(&mut admin, 0); - let mut user = unwrap_ok!(admin.device().authenticate_user(DEFAULT_USER_PIN)); - check_hotp_codes(&mut user, 0); - - assert_cmd_err!(CommandError::NotAuthorized, user.device().get_hotp_code(1)); -} - -#[test_device] -fn hotp_slot_name(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let slot_data = OtpSlotData::new(1, "test-hotp", HOTP_SECRET, OtpMode::SixDigits); - assert_ok!((), admin.write_hotp_slot(slot_data, 0)); - - let device = admin.device(); - assert_ok!("test-hotp".to_string(), device.get_hotp_slot_name(1)); - assert_lib_err!(LibraryError::InvalidSlot, device.get_hotp_slot_name(4)); -} - -#[test_device] -fn hotp_error(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let slot_data = OtpSlotData::new(1, "", HOTP_SECRET, OtpMode::SixDigits); - assert_cmd_err!(CommandError::NoName, admin.write_hotp_slot(slot_data, 0)); - let slot_data = OtpSlotData::new(4, "test", HOTP_SECRET, OtpMode::SixDigits); - assert_lib_err!( - LibraryError::InvalidSlot, - admin.write_hotp_slot(slot_data, 0) - ); - let slot_data = OtpSlotData::new(1, "test", "foobar", OtpMode::SixDigits); - assert_lib_err!( - LibraryError::InvalidHexString, - admin.write_hotp_slot(slot_data, 0) - ); - let code = admin.get_hotp_code(4); - assert_lib_err!(LibraryError::InvalidSlot, code); -} - -#[test_device] -fn hotp_erase(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, false); - assert_ok!((), admin.write_config(config)); - let slot_data = OtpSlotData::new(1, "test1", HOTP_SECRET, OtpMode::SixDigits); - assert_ok!((), admin.write_hotp_slot(slot_data, 0)); - let slot_data = OtpSlotData::new(2, "test2", HOTP_SECRET, OtpMode::SixDigits); - assert_ok!((), admin.write_hotp_slot(slot_data, 0)); - - assert_ok!((), admin.erase_hotp_slot(1)); - - let mut device = admin.device(); - let result = device.get_hotp_slot_name(1); - assert_cmd_err!(CommandError::SlotNotProgrammed, result); - let result = device.get_hotp_code(1); - assert_cmd_err!(CommandError::SlotNotProgrammed, result); - - assert_ok!("test2".to_string(), device.get_hotp_slot_name(2)); -} - -fn configure_totp(admin: &mut dyn ConfigureOtp, factor: u64) { - let slot_data = OtpSlotData::new(1, "test-totp", TOTP_SECRET, OtpMode::EightDigits); - let time_window = 30u64.checked_mul(factor).unwrap(); - assert_ok!((), admin.write_totp_slot(slot_data, time_window as u16)); -} - -fn check_totp_codes(device: &mut dyn GenerateOtp, factor: u64, timestamp_size: TotpTimestampSize) { - for (base_time, codes) in TOTP_CODES { - let time = base_time.checked_mul(factor).unwrap(); - let is_u64 = time > u32::max_value() as u64; - if is_u64 != (timestamp_size == TotpTimestampSize::U64) { - continue; - } - - assert_ok!((), device.set_time(time, true)); - let code = unwrap_ok!(device.get_totp_code(1)); - assert!( - code.contains(&code), - "Generated TOTP code {} for {}, but expected one of {}", - code, - base_time, - codes.join(", ") - ); - } -} - -#[test_device] -fn totp_no_pin(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, false); - assert_ok!((), admin.write_config(config)); - - configure_totp(&mut admin, 1); - check_totp_codes(admin.deref_mut(), 1, TotpTimestampSize::U32); - - configure_totp(&mut admin, 2); - check_totp_codes(admin.deref_mut(), 2, TotpTimestampSize::U32); - - configure_totp(&mut admin, 1); - check_totp_codes(&mut admin.device(), 1, TotpTimestampSize::U32); -} - -#[test_device] -// Nitrokey Storage does only support timestamps that fit in a 32-bit -// unsigned integer, so don't test with it. -fn totp_no_pin_64(device: Pro) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, false); - assert_ok!((), admin.write_config(config)); - - configure_totp(&mut admin, 1); - check_totp_codes(admin.deref_mut(), 1, TotpTimestampSize::U64); - - configure_totp(&mut admin, 2); - check_totp_codes(admin.deref_mut(), 2, TotpTimestampSize::U64); - - configure_totp(&mut admin, 1); - check_totp_codes(&mut admin.device(), 1, TotpTimestampSize::U64); -} - -#[test_device] -fn totp_pin(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, true); - assert_ok!((), admin.write_config(config)); - - configure_totp(&mut admin, 1); - let mut user = unwrap_ok!(admin.device().authenticate_user(DEFAULT_USER_PIN)); - check_totp_codes(&mut user, 1, TotpTimestampSize::U32); - - assert_cmd_err!(CommandError::NotAuthorized, user.device().get_totp_code(1)); -} - -#[test_device] -// See comment for totp_no_pin_64. -fn totp_pin_64(device: Pro) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, true); - assert_ok!((), admin.write_config(config)); - - configure_totp(&mut admin, 1); - let mut user = unwrap_ok!(admin.device().authenticate_user(DEFAULT_USER_PIN)); - check_totp_codes(&mut user, 1, TotpTimestampSize::U64); - - assert_cmd_err!(CommandError::NotAuthorized, user.device().get_totp_code(1)); -} - -#[test_device] -fn totp_slot_name(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let slot_data = OtpSlotData::new(1, "test-totp", TOTP_SECRET, OtpMode::EightDigits); - assert_ok!((), admin.write_totp_slot(slot_data, 0)); - - let device = admin.device(); - let result = device.get_totp_slot_name(1); - assert_ok!("test-totp", result); - let result = device.get_totp_slot_name(16); - assert_lib_err!(LibraryError::InvalidSlot, result); -} - -#[test_device] -fn totp_error(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let slot_data = OtpSlotData::new(1, "", TOTP_SECRET, OtpMode::SixDigits); - assert_cmd_err!(CommandError::NoName, admin.write_totp_slot(slot_data, 0)); - let slot_data = OtpSlotData::new(20, "test", TOTP_SECRET, OtpMode::SixDigits); - assert_lib_err!( - LibraryError::InvalidSlot, - admin.write_totp_slot(slot_data, 0) - ); - let slot_data = OtpSlotData::new(4, "test", "foobar", OtpMode::SixDigits); - assert_lib_err!( - LibraryError::InvalidHexString, - admin.write_totp_slot(slot_data, 0) - ); - let code = admin.get_totp_code(20); - assert_lib_err!(LibraryError::InvalidSlot, code); -} - -#[test_device] -fn totp_erase(device: DeviceWrapper) { - let mut admin = make_admin_test_device(device); - let config = Config::new(None, None, None, false); - assert_ok!((), admin.write_config(config)); - let slot_data = OtpSlotData::new(1, "test1", TOTP_SECRET, OtpMode::SixDigits); - assert_ok!((), admin.write_totp_slot(slot_data, 0)); - let slot_data = OtpSlotData::new(2, "test2", TOTP_SECRET, OtpMode::SixDigits); - assert_ok!((), admin.write_totp_slot(slot_data, 0)); - - assert_ok!((), admin.erase_totp_slot(1)); - - let device = admin.device(); - let result = device.get_totp_slot_name(1); - assert_cmd_err!(CommandError::SlotNotProgrammed, result); - let result = device.get_totp_code(1); - assert_cmd_err!(CommandError::SlotNotProgrammed, result); - - assert_ok!("test2".to_string(), device.get_totp_slot_name(2)); -} diff --git a/nitrokey/tests/pws.rs b/nitrokey/tests/pws.rs deleted file mode 100644 index 7169695..0000000 --- a/nitrokey/tests/pws.rs +++ /dev/null @@ -1,159 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -mod util; - -use std::ffi::CStr; - -use libc::{c_int, c_void, free}; -use nitrokey::{ - CommandError, Device, Error, GetPasswordSafe, LibraryError, PasswordSafe, DEFAULT_ADMIN_PIN, - DEFAULT_USER_PIN, SLOT_COUNT, -}; -use nitrokey_sys; -use nitrokey_test::test as test_device; - -fn get_slot_name_direct(slot: u8) -> Result<String, Error> { - let ptr = unsafe { nitrokey_sys::NK_get_password_safe_slot_name(slot) }; - if ptr.is_null() { - return Err(Error::UnexpectedError); - } - let s = unsafe { CStr::from_ptr(ptr).to_string_lossy().into_owned() }; - unsafe { free(ptr as *mut c_void) }; - match s.is_empty() { - true => { - let error = unsafe { nitrokey_sys::NK_get_last_command_status() } as c_int; - match error { - 0 => Ok(s), - other => Err(Error::from(other)), - } - } - false => Ok(s), - } -} - -fn get_pws<'a, T>(device: &mut T) -> PasswordSafe<'_, 'a> -where - T: Device<'a>, -{ - unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN)) -} - -#[test_device] -fn enable(device: DeviceWrapper) { - let mut device = device; - assert_cmd_err!( - CommandError::WrongPassword, - device.get_password_safe(&(DEFAULT_USER_PIN.to_owned() + "123")) - ); - assert_any_ok!(device.get_password_safe(DEFAULT_USER_PIN)); - assert_cmd_err!( - CommandError::WrongPassword, - device.get_password_safe(DEFAULT_ADMIN_PIN) - ); - assert_any_ok!(device.get_password_safe(DEFAULT_USER_PIN)); -} - -#[test_device] -fn drop(device: DeviceWrapper) { - let mut device = device; - { - let mut pws = get_pws(&mut device); - assert_ok!((), pws.write_slot(1, "name", "login", "password")); - assert_ok!("name".to_string(), pws.get_slot_name(1)); - let result = get_slot_name_direct(1); - assert_ok!(String::from("name"), result); - } - let result = get_slot_name_direct(1); - assert_ok!(String::from("name"), result); - assert_ok!((), device.lock()); - let result = get_slot_name_direct(1); - assert_cmd_err!(CommandError::NotAuthorized, result); -} - -#[test_device] -fn get_status(device: DeviceWrapper) { - let mut device = device; - let mut pws = get_pws(&mut device); - for i in 0..SLOT_COUNT { - assert_ok!((), pws.erase_slot(i)); - } - let status = unwrap_ok!(pws.get_slot_status()); - assert_eq!(status, [false; SLOT_COUNT as usize]); - - assert_ok!((), pws.write_slot(1, "name", "login", "password")); - let status = unwrap_ok!(pws.get_slot_status()); - for i in 0..SLOT_COUNT { - assert_eq!(i == 1, status[i as usize]); - } - - for i in 0..SLOT_COUNT { - assert_ok!((), pws.write_slot(i, "name", "login", "password")); - } - assert_ok!([true; SLOT_COUNT as usize], pws.get_slot_status()); -} - -#[test_device] -fn get_data(device: DeviceWrapper) { - let mut device = device; - let mut pws = get_pws(&mut device); - assert_ok!((), pws.write_slot(1, "name", "login", "password")); - assert_ok!("name".to_string(), pws.get_slot_name(1)); - assert_ok!("login".to_string(), pws.get_slot_login(1)); - assert_ok!("password".to_string(), pws.get_slot_password(1)); - - assert_ok!((), pws.erase_slot(1)); - assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_name(1)); - assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_login(1)); - assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_password(1)); - - let name = "with å"; - let login = "pär@test.com"; - let password = "'i3lJc[09?I:,[u7dWz9"; - assert_ok!((), pws.write_slot(1, name, login, password)); - assert_ok!(name.to_string(), pws.get_slot_name(1)); - assert_ok!(login.to_string(), pws.get_slot_login(1)); - assert_ok!(password.to_string(), pws.get_slot_password(1)); - - assert_lib_err!(LibraryError::InvalidSlot, pws.get_slot_name(SLOT_COUNT)); - assert_lib_err!(LibraryError::InvalidSlot, pws.get_slot_login(SLOT_COUNT)); - assert_lib_err!(LibraryError::InvalidSlot, pws.get_slot_password(SLOT_COUNT)); -} - -#[test_device] -fn write(device: DeviceWrapper) { - let mut device = device; - let mut pws = get_pws(&mut device); - - assert_lib_err!( - LibraryError::InvalidSlot, - pws.write_slot(SLOT_COUNT, "name", "login", "password") - ); - - assert_ok!((), pws.write_slot(0, "", "login", "password")); - assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_name(0)); - assert_ok!(String::from("login"), pws.get_slot_login(0)); - assert_ok!(String::from("password"), pws.get_slot_password(0)); - - assert_ok!((), pws.write_slot(0, "name", "", "password")); - assert_ok!(String::from("name"), pws.get_slot_name(0)); - assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_login(0)); - assert_ok!(String::from("password"), pws.get_slot_password(0)); - - assert_ok!((), pws.write_slot(0, "name", "login", "")); - assert_ok!(String::from("name"), pws.get_slot_name(0)); - assert_ok!(String::from("login"), pws.get_slot_login(0)); - assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_password(0)); -} - -#[test_device] -fn erase(device: DeviceWrapper) { - let mut device = device; - let mut pws = get_pws(&mut device); - assert_lib_err!(LibraryError::InvalidSlot, pws.erase_slot(SLOT_COUNT)); - - assert_ok!((), pws.write_slot(0, "name", "login", "password")); - assert_ok!((), pws.erase_slot(0)); - assert_ok!((), pws.erase_slot(0)); - assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_name(0)); -} diff --git a/nitrokey/tests/util/mod.rs b/nitrokey/tests/util/mod.rs deleted file mode 100644 index f2b20ec..0000000 --- a/nitrokey/tests/util/mod.rs +++ /dev/null @@ -1,113 +0,0 @@ -// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org> -// SPDX-License-Identifier: MIT - -#[macro_export] -macro_rules! unwrap_ok { - ($val:expr) => {{ - match $val { - Ok(val) => val, - Err(err) => panic!( - r#"assertion failed: `(left == right)` - left: `Ok(_)`, - right: `Err({:?})`"#, - err - ), - } - }}; -} - -#[macro_export] -macro_rules! assert_any_ok { - ($val:expr) => {{ - match &$val { - Ok(_) => {} - Err(err) => panic!( - r#"assertion failed: `(left == right)` - left: `Ok(_)`, - right: `Err({:?})`"#, - err - ), - } - }}; -} - -#[macro_export] -macro_rules! assert_ok { - ($left:expr, $right:expr) => {{ - match &$right { - Ok(right) => match &$left { - left => { - if !(*left == *right) { - panic!( - r#"assertion failed: `(left == right)` - left: `{:?}`, - right: `{:?}`"#, - left, right - ) - } - } - }, - Err(right_err) => panic!( - r#"assertion failed: `(left == right)` - left: `Ok({:?})`, - right: `Err({:?})`"#, - $left, right_err - ), - } - }}; -} - -#[macro_export] -macro_rules! assert_err { - ($err:path, $left:expr, $right:expr) => { - match &$right { - Err($err(ref right_err)) => match &$left { - left_err => { - if !(*left_err == *right_err) { - panic!( - r#"assertion failed: `(left == right)` - left: `{:?}`, - right: `{:?}`"#, - left_err, right_err - ) - } - } - }, - Err(ref right_err) => panic!( - r#"assertion failed: `(left == right)` - left: `{:?}`, - right: `{:?}`"#, - $err($left), - right_err - ), - Ok(right_ok) => panic!( - r#"assertion failed: `(left == right)` - left: `Err({:?})`, - right: `Ok({:?})`"#, - $err($left), - right_ok - ), - } - }; -} - -#[macro_export] -macro_rules! assert_cmd_err { - ($left:expr, $right:expr) => { - assert_err!(::nitrokey::Error::CommandError, $left, $right); - }; -} - -#[macro_export] -macro_rules! assert_cmu_err { - ($left:expr, $right:expr) => { - assert_err!(::nitrokey::Error::CommunicationError, $left, $right); - }; -} - -#[macro_export] -macro_rules! assert_lib_err { - ($left:expr, $right:expr) => { - assert_err!(::nitrokey::Error::LibraryError, $left, $right); - }; -} |