aboutsummaryrefslogtreecommitdiff
path: root/nitrokey
diff options
context:
space:
mode:
Diffstat (limited to 'nitrokey')
-rw-r--r--nitrokey/.builds/archlinux-msrv.yml22
-rw-r--r--nitrokey/.builds/archlinux-use-system-lib.yml25
-rw-r--r--nitrokey/.builds/archlinux.yml16
-rw-r--r--nitrokey/.builds/lint.yml16
-rw-r--r--nitrokey/.gitignore7
-rw-r--r--nitrokey/CHANGELOG.md135
-rw-r--r--nitrokey/Cargo.toml27
-rw-r--r--nitrokey/LICENSES/CC0-1.0.txt121
-rw-r--r--nitrokey/LICENSES/MIT.txt24
-rw-r--r--nitrokey/README.md92
-rw-r--r--nitrokey/TODO.md26
-rw-r--r--nitrokey/src/auth.rs437
-rw-r--r--nitrokey/src/config.rs106
-rw-r--r--nitrokey/src/device/mod.rs464
-rw-r--r--nitrokey/src/device/pro.rs79
-rw-r--r--nitrokey/src/device/storage.rs735
-rw-r--r--nitrokey/src/device/wrapper.rs134
-rw-r--r--nitrokey/src/error.rs269
-rw-r--r--nitrokey/src/lib.rs465
-rw-r--r--nitrokey/src/otp.rs423
-rw-r--r--nitrokey/src/pws.rs391
-rw-r--r--nitrokey/src/util.rs99
-rw-r--r--nitrokey/tests/device.rs575
-rw-r--r--nitrokey/tests/lib.rs28
-rw-r--r--nitrokey/tests/otp.rs287
-rw-r--r--nitrokey/tests/pws.rs159
-rw-r--r--nitrokey/tests/util/mod.rs113
27 files changed, 0 insertions, 5275 deletions
diff --git a/nitrokey/.builds/archlinux-msrv.yml b/nitrokey/.builds/archlinux-msrv.yml
deleted file mode 100644
index 66c0390..0000000
--- a/nitrokey/.builds/archlinux-msrv.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: CC0-1.0
-image: archlinux
-packages:
- - rustup
- - libnitrokey
-environment:
- USE_SYSTEM_LIBNITROKEY: "1"
-sources:
- - https://git.ireas.org/nitrokey-rs
-tasks:
- - setup: |
- rustup set profile minimal
- rustup default 1.34.2
- - version: |
- rustc -V
- - build: |
- cd nitrokey-rs
- cargo build --release
- - test: |
- cd nitrokey-rs
- cargo test
diff --git a/nitrokey/.builds/archlinux-use-system-lib.yml b/nitrokey/.builds/archlinux-use-system-lib.yml
deleted file mode 100644
index 29bda19..0000000
--- a/nitrokey/.builds/archlinux-use-system-lib.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: CC0-1.0
-image: archlinux
-packages:
- - rust
- - libnitrokey
-environment:
- USE_SYSTEM_LIBNITROKEY: "1"
-sources:
- - https://git.ireas.org/nitrokey-rs
-tasks:
- - version: |
- rustc -V
- - build: |
- cd nitrokey-rs
- cargo build --release
- - test: |
- cd nitrokey-rs
- cargo test
- - format: |
- cd nitrokey-rs
- cargo fmt -- --check
- - clippy: |
- cd nitrokey-rs
- cargo clippy -- -D warnings
diff --git a/nitrokey/.builds/archlinux.yml b/nitrokey/.builds/archlinux.yml
deleted file mode 100644
index 151eb66..0000000
--- a/nitrokey/.builds/archlinux.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: CC0-1.0
-image: archlinux
-packages:
- - rust
- - hidapi
- - gcc
-sources:
- - https://git.ireas.org/nitrokey-rs
-tasks:
- - build: |
- cd nitrokey-rs
- cargo build --release
- - test: |
- cd nitrokey-rs
- cargo test
diff --git a/nitrokey/.builds/lint.yml b/nitrokey/.builds/lint.yml
deleted file mode 100644
index 678cde8..0000000
--- a/nitrokey/.builds/lint.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: CC0-1.0
-image: archlinux
-packages:
- - gnupg
- - reuse
-sources:
- - https://git.ireas.org/nitrokey-rs
-tasks:
- - verify: |
- cd nitrokey-rs
- curl -s "https://pgp.ireas.org/0x6D533958F070C57C.txt" | gpg --import
- git verify-commit HEAD
- - reuse: |
- cd nitrokey-rs
- reuse lint
diff --git a/nitrokey/.gitignore b/nitrokey/.gitignore
deleted file mode 100644
index 7ea18df..0000000
--- a/nitrokey/.gitignore
+++ /dev/null
@@ -1,7 +0,0 @@
-# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: CC0-1.0
-/target
-/nitrokey-sys/target
-**/*.rs.bk
-Cargo.lock
-*.swp
diff --git a/nitrokey/CHANGELOG.md b/nitrokey/CHANGELOG.md
deleted file mode 100644
index d4451bc..0000000
--- a/nitrokey/CHANGELOG.md
+++ /dev/null
@@ -1,135 +0,0 @@
-<!---
-Copyright (C) 2019-2020 Robin Krahl <robin.krahl@ireas.org>
-SPDX-License-Identifier: CC0-1.0
--->
-
-# v0.4.0 (2020-01-02)
-- Remove the `test-pro` and `test-storage` features.
-- Implement `Display` for `Version`.
-- Introduce `DEFAULT_ADMIN_PIN` and `DEFAULT_USER_PIN` constants.
-- Refactor the error handling code:
- - Implement `std::error::Error` for `CommandError`.
- - Add the `Error` enum.
- - Add the `LibraryError` enum and move the library error variants from
- `CommandError` to `LibraryError`.
- - Add the `CommunicationError` enum and move the communication error variants
- from `CommandError` to `CommunicationError`.
- - Return `Error` instead of `CommandError` in all public functions.
- - Move the `CommandError::RngError` variant to `Error::RandError` and the
- `CommandError::Unknown` variant to `Error::UnknownError`.
- - Return `CommunicationError::NotConnected` instead of
- `CommandError::Undefined` from the connect functions.
- - Remove the `CommandError::Undefined` variant.
-- Add a private `PhantomData` field to `Pro` and `Storage` to make direct
- instantiation impossible.
-- Refactor and clean up internal code:
- - Prefer using the `Into` trait over numeric casting.
- - Add `Pro::new` and `Storage::new` functions.
-- Implement `From<Pro>` and `From<Storage>` for `DeviceWrapper`.
-- Add `Error::Utf8Error` variant.
- - Return `Result<Version>` instead of `Version` from `get_library_version`.
- - Return `Error::Utf8Error` if libnitrokey returns an invalid UTF-8 string.
-- Implement `From<(T: Device, Error)>` for `Error`.
-- Fix timing issues with the `totp_no_pin` and `totp_pin` test cases.
-- Always return a `Result` in functions that communicate with a device.
-- Combine `get_{major,minor}_firmware_version` into `get_firmware_version`.
-- Add `set_encrypted_volume_mode` to `Storage`.
-- Use mutability to represent changes to the device status:
- - Implement `DerefMut` for `User<T>` and `Admin<T>`.
- - Add `device_mut` method to `DeviceWrapper`.
- - Require a mutable `Device` reference if a method changes the device state.
-- Update dependencies:
- - `nitrokey-sys` to 3.5
- - `nitrokey-test` to 0.3
- - `rand_core` to 0.5
- - `rand_os` to 0.2
-- Add `nitrokey-test-state` dependency in version 0.1.
-- Refactor connection management:
- - Add `ConcurrentAccessError` and `PoisonError` `Error` variants.
- - Add the `Manager` struct that manages connections to Nitrokey devices.
- - Remove `connect`, `connect_model`, `Pro::connect` and `Storage::connect`.
- - Add the `into_manager` function to the `Device` trait.
- - Add the `force_take` function that ignores a `PoisonError` when accessing
- the manager instance.
-- Internally refactor the `device` module into submodules.
-
-# v0.3.5 (2019-12-16)
-- Update the nitrokey-sys dependency version specification to ~3.4.
-
-# v0.3.4 (2019-01-20)
-- Fix authentication methods that assumed that `char` is signed.
-
-# v0.3.3 (2019-01-16)
-- Add the `get_production_info` and `clear_new_sd_card_warning` methods to the
- `Storage` struct.
-- Use `rand_os` instead of `rand` for random data creation.
- - (Re-)add `CommandError::RngError` variant.
-- Account for the possibility that an empty string returned by libnitrokey can
- not only indicate an error but also be a valid return value.
-- Make test cases more robust and avoid side effects on other test cases.
-
-# v0.3.2 (2019-01-12)
-- Make three additional error codes known: `CommandError::StringTooLong`,
- `CommandError::InvalidHexString` and `CommandError::TargetBufferTooSmall`.
-- Add the `get_library_version` function to query the libnitrokey version.
-- Add the `wink` method to the `Storage` struct.
-- Add the `set_unencrypted_volume_mode` to set the access mode of the
- unencrypted volume.
-- Add the `export_firmware` method to the `Storage` struct.
-
-# v0.3.1 (2019-01-07)
-- Use `nitrokey-test` to select and execute the unit tests.
-- Add support for the hidden volumes on a Nitrokey Storage
- (`enable_hidden_volume`, `disable_hidden_volume` and `create_hidden_volume`
- methods for the `Storage` struct).
-- Add the `connect_model` function to connect to a specific model using an enum
- variant.
-
-# v0.3.0 (2019-01-04)
-- Add a `force` argument to `ConfigureOtp::set_time`.
-- Remove the obsolete `CommandError::RngError`.
-- Add `CommandError::Undefined` to represent errors without further
- information (e. g. a method returned `NULL` unexpectedly).
-- Add error code to `CommandError::Unknown`.
-- Add the `Storage::change_update_pin` method that changes the firmware update
- PIN.
-- Add the `Device::factory_reset` method that performs a factory reset.
-- Add the `Device::build_aes_key` method that builds a new AES key on the Nitrokey.
-- Add the `Storage::enable_firmware_update` method that puts the Nitrokey
- Storage in update mode so that the firmware can be updated.
-
-# v0.2.3 (2018-12-31)
-
-- Dummy release to fix an issue with the crates.io tarball.
-
-# v0.2.2 (2018-12-30)
-
-- Update to Rust edition 2018.
-- Remove the `test-no-device` feature.
-- Update the rand dependency to version 0.6.
-- Add function `Device::get_model` that returns the connected model.
-- Derive the `Copy` and `Clone` traits for the enums `CommandError`, `LogLevel`
- and `OtpMode`
-
-# v0.2.1 (2018-12-10)
-
-- Re-export `device::{StorageStatus, VolumeStatus}` in `lib.rs`.
-
-# v0.2.0 (2018-12-10)
-
-- Update to libnitrokey v3.4.1.
-- Major refactoring of the existing code structure.
-- Add support for most of the Nitrokey Pro features and some of the Nitrokey
- Storage features. See the `TODO.md` file for more details about the missing
- functionality.
-
-# v0.1.1 (2018-05-21)
-
-- Update the `nitrokey-sys` dependency to version 3.3.0. Now `libnitrokey`
- is built from source and `bindgen` is no longer a build dependency.
-- Add `get_minor_firmware_version` to `Device`.
-- Use `NK_login_enum` instead of `NK_login` in `Device::connect`.
-
-# v0.1.0 (2018-05-19)
-
-- Initial release
diff --git a/nitrokey/Cargo.toml b/nitrokey/Cargo.toml
deleted file mode 100644
index b57591b..0000000
--- a/nitrokey/Cargo.toml
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright (C) 2019-2020 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: CC0-1.0
-
-[package]
-name = "nitrokey"
-version = "0.4.0"
-authors = ["Robin Krahl <robin.krahl@ireas.org>"]
-edition = "2018"
-homepage = "https://code.ireas.org/nitrokey-rs/"
-repository = "https://git.ireas.org/nitrokey-rs/"
-documentation = "https://docs.rs/nitrokey"
-description = "Bindings to libnitrokey for communication with Nitrokey devices"
-keywords = ["nitrokey", "otp"]
-categories = ["api-bindings"]
-readme = "README.md"
-license = "MIT"
-exclude = [".builds/*"]
-
-[dependencies]
-lazy_static = "1.2"
-libc = "0.2"
-nitrokey-sys = "3.5"
-rand_core = {version = "0.5.1", features = ["getrandom"] }
-
-[dev-dependencies]
-nitrokey-test = "0.3"
-nitrokey-test-state = "0.1"
diff --git a/nitrokey/LICENSES/CC0-1.0.txt b/nitrokey/LICENSES/CC0-1.0.txt
deleted file mode 100644
index 0e259d4..0000000
--- a/nitrokey/LICENSES/CC0-1.0.txt
+++ /dev/null
@@ -1,121 +0,0 @@
-Creative Commons Legal Code
-
-CC0 1.0 Universal
-
- CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
- LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
- ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
- INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
- REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
- PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
- THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
- HEREUNDER.
-
-Statement of Purpose
-
-The laws of most jurisdictions throughout the world automatically confer
-exclusive Copyright and Related Rights (defined below) upon the creator
-and subsequent owner(s) (each and all, an "owner") of an original work of
-authorship and/or a database (each, a "Work").
-
-Certain owners wish to permanently relinquish those rights to a Work for
-the purpose of contributing to a commons of creative, cultural and
-scientific works ("Commons") that the public can reliably and without fear
-of later claims of infringement build upon, modify, incorporate in other
-works, reuse and redistribute as freely as possible in any form whatsoever
-and for any purposes, including without limitation commercial purposes.
-These owners may contribute to the Commons to promote the ideal of a free
-culture and the further production of creative, cultural and scientific
-works, or to gain reputation or greater distribution for their Work in
-part through the use and efforts of others.
-
-For these and/or other purposes and motivations, and without any
-expectation of additional consideration or compensation, the person
-associating CC0 with a Work (the "Affirmer"), to the extent that he or she
-is an owner of Copyright and Related Rights in the Work, voluntarily
-elects to apply CC0 to the Work and publicly distribute the Work under its
-terms, with knowledge of his or her Copyright and Related Rights in the
-Work and the meaning and intended legal effect of CC0 on those rights.
-
-1. Copyright and Related Rights. A Work made available under CC0 may be
-protected by copyright and related or neighboring rights ("Copyright and
-Related Rights"). Copyright and Related Rights include, but are not
-limited to, the following:
-
- i. the right to reproduce, adapt, distribute, perform, display,
- communicate, and translate a Work;
- ii. moral rights retained by the original author(s) and/or performer(s);
-iii. publicity and privacy rights pertaining to a person's image or
- likeness depicted in a Work;
- iv. rights protecting against unfair competition in regards to a Work,
- subject to the limitations in paragraph 4(a), below;
- v. rights protecting the extraction, dissemination, use and reuse of data
- in a Work;
- vi. database rights (such as those arising under Directive 96/9/EC of the
- European Parliament and of the Council of 11 March 1996 on the legal
- protection of databases, and under any national implementation
- thereof, including any amended or successor version of such
- directive); and
-vii. other similar, equivalent or corresponding rights throughout the
- world based on applicable law or treaty, and any national
- implementations thereof.
-
-2. Waiver. To the greatest extent permitted by, but not in contravention
-of, applicable law, Affirmer hereby overtly, fully, permanently,
-irrevocably and unconditionally waives, abandons, and surrenders all of
-Affirmer's Copyright and Related Rights and associated claims and causes
-of action, whether now known or unknown (including existing as well as
-future claims and causes of action), in the Work (i) in all territories
-worldwide, (ii) for the maximum duration provided by applicable law or
-treaty (including future time extensions), (iii) in any current or future
-medium and for any number of copies, and (iv) for any purpose whatsoever,
-including without limitation commercial, advertising or promotional
-purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
-member of the public at large and to the detriment of Affirmer's heirs and
-successors, fully intending that such Waiver shall not be subject to
-revocation, rescission, cancellation, termination, or any other legal or
-equitable action to disrupt the quiet enjoyment of the Work by the public
-as contemplated by Affirmer's express Statement of Purpose.
-
-3. Public License Fallback. Should any part of the Waiver for any reason
-be judged legally invalid or ineffective under applicable law, then the
-Waiver shall be preserved to the maximum extent permitted taking into
-account Affirmer's express Statement of Purpose. In addition, to the
-extent the Waiver is so judged Affirmer hereby grants to each affected
-person a royalty-free, non transferable, non sublicensable, non exclusive,
-irrevocable and unconditional license to exercise Affirmer's Copyright and
-Related Rights in the Work (i) in all territories worldwide, (ii) for the
-maximum duration provided by applicable law or treaty (including future
-time extensions), (iii) in any current or future medium and for any number
-of copies, and (iv) for any purpose whatsoever, including without
-limitation commercial, advertising or promotional purposes (the
-"License"). The License shall be deemed effective as of the date CC0 was
-applied by Affirmer to the Work. Should any part of the License for any
-reason be judged legally invalid or ineffective under applicable law, such
-partial invalidity or ineffectiveness shall not invalidate the remainder
-of the License, and in such case Affirmer hereby affirms that he or she
-will not (i) exercise any of his or her remaining Copyright and Related
-Rights in the Work or (ii) assert any associated claims and causes of
-action with respect to the Work, in either case contrary to Affirmer's
-express Statement of Purpose.
-
-4. Limitations and Disclaimers.
-
- a. No trademark or patent rights held by Affirmer are waived, abandoned,
- surrendered, licensed or otherwise affected by this document.
- b. Affirmer offers the Work as-is and makes no representations or
- warranties of any kind concerning the Work, express, implied,
- statutory or otherwise, including without limitation warranties of
- title, merchantability, fitness for a particular purpose, non
- infringement, or the absence of latent or other defects, accuracy, or
- the present or absence of errors, whether or not discoverable, all to
- the greatest extent permissible under applicable law.
- c. Affirmer disclaims responsibility for clearing rights of other persons
- that may apply to the Work or any use thereof, including without
- limitation any person's Copyright and Related Rights in the Work.
- Further, Affirmer disclaims responsibility for obtaining any necessary
- consents, permissions or other rights required for any use of the
- Work.
- d. Affirmer understands and acknowledges that Creative Commons is not a
- party to this document and has no duty or obligation with respect to
- this CC0 or use of the Work.
diff --git a/nitrokey/LICENSES/MIT.txt b/nitrokey/LICENSES/MIT.txt
deleted file mode 100644
index 6c67cd5..0000000
--- a/nitrokey/LICENSES/MIT.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-Valid-License-Identifier: MIT
-License-Text:
-
-The MIT License (MIT)
-
-Copyright (c) 2018 Robin Krahl <robin.krahl@ireas.org>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/nitrokey/README.md b/nitrokey/README.md
deleted file mode 100644
index 12a9f6d..0000000
--- a/nitrokey/README.md
+++ /dev/null
@@ -1,92 +0,0 @@
-<!---
-Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-SPDX-License-Identifier: CC0-1.0
--->
-
-# nitrokey-rs
-
-A libnitrokey wrapper for Rust providing access to Nitrokey devices.
-
-[Documentation][]
-
-## Compatibility
-
-The required [`libnitrokey`][] version is built from source. The host system
-must provide `libhidapi-libusb0` (Linux) or `libhidapi` (non-Linux) in the
-default library search path. Depending on your system, you might also have to
-install the [Nitrokey udev rules][].
-
-Currently, this crate provides access to the common features of the Nitrokey
-Pro and the Nitrokey Storage: general configuration, OTP generation and the
-password safe. Basic support for the secure storage on the Nitrokey Storage is
-available but still under development.
-
-### Unsupported Functions
-
-The following functions provided by `libnitrokey` are deliberately not
-supported by `nitrokey-rs`:
-
-- `NK_get_device_model`. We know which model we connected to, so we can
- provide this information without calling `libnitrokey`.
-- `NK_is_AES_supported`. This method is no longer needed for Nitrokey devices
- with a recent firmware version.
-- `NK_set_unencrypted_volume_rorw_pin_type_user`,
- `NK_set_unencrypted_read_only`, `NK_set_unencrypted_read_write`. These
- methods are only relevant for older firmware versions (pre-v0.51). As the
- Nitrokey Storage firmware can be updated easily, we do not support these
- outdated versions.
-- `NK_totp_get_time`, `NK_status`. These functions are deprecated.
-- `NK_read_HOTP_slot`. This function is only available for HOTP slots, not for
- TOTP. We will support it once both types are supported by `libnitrokey`.
-- All `*_as_string` functions that return string representations of data
- returned by other functions.
-
-## Tests
-
-This crate has tests for different scenarios: Some tests require that no
-Nitrokey device is connected, others require a Nitrokey Storage or a Nitrokey
-Pro. We use the [`nitrokey-test`][] crate to select the test cases. You can
-just run `cargo test` to auto-detect connected Nitrokey devices and to run the
-appropriate tests. If you want to manually select the tests, set the
-`NITROKEY_TEST_GROUP` environment variable to `nodev` (no device connected),
-`pro` (Nitrokey Pro connected) or `storage` (Nitrokey Storage connected).
-
-Note that the tests assume that the device’s passwords are the factory defaults
-(admin PIN `12345678`, user PIN `123456`, update password `12345678`) and that
-an AES key has been built. Some tests will overwrite the data stored on the
-Nitrokey device or perform a factory reset. Never execute the tests if you
-don’t want to destroy all data on any connected Nitrokey device!
-
-## Acknowledgments
-
-Thanks to Nitrokey UG for providing two Nitrokey devices to support the
-development of this crate. Thanks to Daniel Mueller for contributions to
-`nitrokey-rs` and for the `nitrokey-test` crate.
-
-## Minimum Supported Rust Version
-
-This crate supports Rust 1.34.2 or later.
-
-## Contact
-
-For bug reports, patches, feature requests or other messages, please send a
-mail to [nitrokey-rs-dev@ireas.org][].
-
-## License
-
-This project is licensed under the [MIT][] license. The documentation and
-configuration files contained in this repository are licensed under the
-[Creative Commons Zero][CC0] license. You can find a copy of the license texts
-in the `LICENSES` directory. `libnitrokey` is licensed under the [LGPL-3.0][].
-
-`nitrokey-rs` complies with [version 3.0 of the REUSE specification][reuse].
-
-[Documentation]: https://docs.rs/nitrokey
-[Nitrokey udev rules]: https://www.nitrokey.com/documentation/frequently-asked-questions-faq#openpgp-card-not-available
-[`libnitrokey`]: https://github.com/nitrokey/libnitrokey
-[`nitrokey-test`]: https://github.com/d-e-s-o/nitrokey-test
-[nitrokey-rs-dev@ireas.org]: mailto:nitrokey-rs-dev@ireas.org
-[MIT]: https://opensource.org/licenses/MIT
-[CC0]: https://creativecommons.org/publicdomain/zero/1.0/
-[LGPL-3.0]: https://opensource.org/licenses/lgpl-3.0.html
-[reuse]: https://reuse.software/practices/3.0/
diff --git a/nitrokey/TODO.md b/nitrokey/TODO.md
deleted file mode 100644
index 54525ef..0000000
--- a/nitrokey/TODO.md
+++ /dev/null
@@ -1,26 +0,0 @@
-<!---
-Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-SPDX-License-Identifier: CC0-1.0
--->
-
-- Add support for the currently unsupported commands:
- - `NK_send_startup`
- - `NK_fill_SD_card_with_random_data`
- - `NK_get_SD_usage_data`
- - `NK_get_progress_bar_value`
- - `NK_list_devices_by_cpuID`
- - `NK_connect_with_ID`
- - `NK_get_status`
- - `NK_list_devices`
- - `NK_free_device_info`
- - `NK_connect_with_path`
- - `NK_enable_firmware_update_pro`
- - `NK_change_firmware_password_pro`
-- Clear passwords from memory.
-- Lock password safe in `PasswordSafe::drop()` (see [nitrokey-storage-firmware
- issue 65][]).
-- Disable creation of multiple password safes at the same time.
-- Check timing in Storage tests.
-- Consider restructuring `device::StorageStatus`.
-
-[nitrokey-storage-firmware issue 65]: https://github.com/Nitrokey/nitrokey-storage-firmware/issues/65
diff --git a/nitrokey/src/auth.rs b/nitrokey/src/auth.rs
deleted file mode 100644
index cab1021..0000000
--- a/nitrokey/src/auth.rs
+++ /dev/null
@@ -1,437 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use std::convert::TryFrom as _;
-use std::marker;
-use std::ops;
-use std::os::raw::c_char;
-use std::os::raw::c_int;
-
-use nitrokey_sys;
-
-use crate::config::{Config, RawConfig};
-use crate::device::{Device, DeviceWrapper, Pro, Storage};
-use crate::error::Error;
-use crate::otp::{ConfigureOtp, GenerateOtp, OtpMode, OtpSlotData, RawOtpSlotData};
-use crate::util::{generate_password, get_command_result, get_cstring, result_from_string};
-
-static TEMPORARY_PASSWORD_LENGTH: usize = 25;
-
-/// Provides methods to authenticate as a user or as an admin using a PIN. The authenticated
-/// methods will consume the current device instance. On success, they return the authenticated
-/// device. Otherwise, they return the current unauthenticated device and the error code.
-pub trait Authenticate<'a> {
- /// Performs user authentication. This method consumes the device. If successful, an
- /// authenticated device is returned. Otherwise, the current unauthenticated device and the
- /// error are returned.
- ///
- /// This method generates a random temporary password that is used for all operations that
- /// require user access.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided user password contains a null byte
- /// - [`RngError`][] if the generation of the temporary password failed
- /// - [`WrongPassword`][] if the provided user password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Authenticate, DeviceWrapper, User};
- /// # use nitrokey::Error;
- ///
- /// fn perform_user_task<'a>(device: &User<'a, DeviceWrapper<'a>>) {}
- /// fn perform_other_task(device: &DeviceWrapper) {}
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let device = match device.authenticate_user("123456") {
- /// Ok(user) => {
- /// perform_user_task(&user);
- /// user.device()
- /// },
- /// Err((device, err)) => {
- /// eprintln!("Could not authenticate as user: {}", err);
- /// device
- /// },
- /// };
- /// perform_other_task(&device);
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`RngError`]: enum.CommandError.html#variant.RngError
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)>
- where
- Self: Device<'a> + Sized;
-
- /// Performs admin authentication. This method consumes the device. If successful, an
- /// authenticated device is returned. Otherwise, the current unauthenticated device and the
- /// error are returned.
- ///
- /// This method generates a random temporary password that is used for all operations that
- /// require admin access.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided admin password contains a null byte
- /// - [`RngError`][] if the generation of the temporary password failed
- /// - [`WrongPassword`][] if the provided admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Authenticate, Admin, DeviceWrapper};
- /// # use nitrokey::Error;
- ///
- /// fn perform_admin_task<'a>(device: &Admin<'a, DeviceWrapper<'a>>) {}
- /// fn perform_other_task(device: &DeviceWrapper) {}
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let device = match device.authenticate_admin("123456") {
- /// Ok(admin) => {
- /// perform_admin_task(&admin);
- /// admin.device()
- /// },
- /// Err((device, err)) => {
- /// eprintln!("Could not authenticate as admin: {}", err);
- /// device
- /// },
- /// };
- /// perform_other_task(&device);
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`RngError`]: enum.CommandError.html#variant.RngError
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)>
- where
- Self: Device<'a> + Sized;
-}
-
-trait AuthenticatedDevice<T> {
- fn new(device: T, temp_password: Vec<u8>) -> Self;
-
- fn temp_password_ptr(&self) -> *const c_char;
-}
-
-/// A Nitrokey device with user authentication.
-///
-/// To obtain an instance of this struct, use the [`authenticate_user`][] method from the
-/// [`Authenticate`][] trait. To get back to an unauthenticated device, use the [`device`][]
-/// method.
-///
-/// [`Authenticate`]: trait.Authenticate.html
-/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin
-/// [`device`]: #method.device
-#[derive(Debug)]
-pub struct User<'a, T: Device<'a>> {
- device: T,
- temp_password: Vec<u8>,
- marker: marker::PhantomData<&'a T>,
-}
-
-/// A Nitrokey device with admin authentication.
-///
-/// To obtain an instance of this struct, use the [`authenticate_admin`][] method from the
-/// [`Authenticate`][] trait. To get back to an unauthenticated device, use the [`device`][]
-/// method.
-///
-/// [`Authenticate`]: trait.Authenticate.html
-/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin
-/// [`device`]: #method.device
-#[derive(Debug)]
-pub struct Admin<'a, T: Device<'a>> {
- device: T,
- temp_password: Vec<u8>,
- marker: marker::PhantomData<&'a T>,
-}
-
-fn authenticate<'a, D, A, T>(device: D, password: &str, callback: T) -> Result<A, (D, Error)>
-where
- D: Device<'a>,
- A: AuthenticatedDevice<D>,
- T: Fn(*const c_char, *const c_char) -> c_int,
-{
- let temp_password = match generate_password(TEMPORARY_PASSWORD_LENGTH) {
- Ok(temp_password) => temp_password,
- Err(err) => return Err((device, err)),
- };
- let password = match get_cstring(password) {
- Ok(password) => password,
- Err(err) => return Err((device, err)),
- };
- let password_ptr = password.as_ptr();
- let temp_password_ptr = temp_password.as_ptr() as *const c_char;
- match callback(password_ptr, temp_password_ptr) {
- 0 => Ok(A::new(device, temp_password)),
- rv => Err((device, Error::from(rv))),
- }
-}
-
-fn authenticate_user_wrapper<'a, T, C>(
- device: T,
- constructor: C,
- password: &str,
-) -> Result<User<'a, DeviceWrapper<'a>>, (DeviceWrapper<'a>, Error)>
-where
- T: Device<'a> + 'a,
- C: Fn(T) -> DeviceWrapper<'a>,
-{
- let result = device.authenticate_user(password);
- match result {
- Ok(user) => Ok(User::new(constructor(user.device), user.temp_password)),
- Err((device, err)) => Err((constructor(device), err)),
- }
-}
-
-fn authenticate_admin_wrapper<'a, T, C>(
- device: T,
- constructor: C,
- password: &str,
-) -> Result<Admin<'a, DeviceWrapper<'a>>, (DeviceWrapper<'a>, Error)>
-where
- T: Device<'a> + 'a,
- C: Fn(T) -> DeviceWrapper<'a>,
-{
- let result = device.authenticate_admin(password);
- match result {
- Ok(user) => Ok(Admin::new(constructor(user.device), user.temp_password)),
- Err((device, err)) => Err((constructor(device), err)),
- }
-}
-
-impl<'a, T: Device<'a>> User<'a, T> {
- /// Forgets the user authentication and returns an unauthenticated device. This method
- /// consumes the authenticated device. It does not perform any actual commands on the
- /// Nitrokey.
- pub fn device(self) -> T {
- self.device
- }
-}
-
-impl<'a, T: Device<'a>> ops::Deref for User<'a, T> {
- type Target = T;
-
- fn deref(&self) -> &Self::Target {
- &self.device
- }
-}
-
-impl<'a, T: Device<'a>> ops::DerefMut for User<'a, T> {
- fn deref_mut(&mut self) -> &mut T {
- &mut self.device
- }
-}
-
-impl<'a, T: Device<'a>> GenerateOtp for User<'a, T> {
- fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe {
- nitrokey_sys::NK_get_hotp_code_PIN(slot, self.temp_password_ptr())
- })
- }
-
- fn get_totp_code(&self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe {
- nitrokey_sys::NK_get_totp_code_PIN(slot, 0, 0, 0, self.temp_password_ptr())
- })
- }
-}
-
-impl<'a, T: Device<'a>> AuthenticatedDevice<T> for User<'a, T> {
- fn new(device: T, temp_password: Vec<u8>) -> Self {
- User {
- device,
- temp_password,
- marker: marker::PhantomData,
- }
- }
-
- fn temp_password_ptr(&self) -> *const c_char {
- self.temp_password.as_ptr() as *const c_char
- }
-}
-
-impl<'a, T: Device<'a>> ops::Deref for Admin<'a, T> {
- type Target = T;
-
- fn deref(&self) -> &Self::Target {
- &self.device
- }
-}
-
-impl<'a, T: Device<'a>> ops::DerefMut for Admin<'a, T> {
- fn deref_mut(&mut self) -> &mut T {
- &mut self.device
- }
-}
-
-impl<'a, T: Device<'a>> Admin<'a, T> {
- /// Forgets the user authentication and returns an unauthenticated device. This method
- /// consumes the authenticated device. It does not perform any actual commands on the
- /// Nitrokey.
- pub fn device(self) -> T {
- self.device
- }
-
- /// Writes the given configuration to the Nitrokey device.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if the provided numlock, capslock or scrolllock slot is larger than two
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Authenticate, Config};
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let config = Config::new(None, None, None, false);
- /// match device.authenticate_admin("12345678") {
- /// Ok(mut admin) => {
- /// admin.write_config(config);
- /// ()
- /// },
- /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- pub fn write_config(&mut self, config: Config) -> Result<(), Error> {
- let raw_config = RawConfig::try_from(config)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_write_config(
- raw_config.numlock,
- raw_config.capslock,
- raw_config.scrollock,
- raw_config.user_password,
- false,
- self.temp_password_ptr(),
- )
- })
- }
-}
-
-impl<'a, T: Device<'a>> ConfigureOtp for Admin<'a, T> {
- fn write_hotp_slot(&mut self, data: OtpSlotData, counter: u64) -> Result<(), Error> {
- let raw_data = RawOtpSlotData::new(data)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_write_hotp_slot(
- raw_data.number,
- raw_data.name.as_ptr(),
- raw_data.secret.as_ptr(),
- counter,
- raw_data.mode == OtpMode::EightDigits,
- raw_data.use_enter,
- raw_data.use_token_id,
- raw_data.token_id.as_ptr(),
- self.temp_password_ptr(),
- )
- })
- }
-
- fn write_totp_slot(&mut self, data: OtpSlotData, time_window: u16) -> Result<(), Error> {
- let raw_data = RawOtpSlotData::new(data)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_write_totp_slot(
- raw_data.number,
- raw_data.name.as_ptr(),
- raw_data.secret.as_ptr(),
- time_window,
- raw_data.mode == OtpMode::EightDigits,
- raw_data.use_enter,
- raw_data.use_token_id,
- raw_data.token_id.as_ptr(),
- self.temp_password_ptr(),
- )
- })
- }
-
- fn erase_hotp_slot(&mut self, slot: u8) -> Result<(), Error> {
- get_command_result(unsafe {
- nitrokey_sys::NK_erase_hotp_slot(slot, self.temp_password_ptr())
- })
- }
-
- fn erase_totp_slot(&mut self, slot: u8) -> Result<(), Error> {
- get_command_result(unsafe {
- nitrokey_sys::NK_erase_totp_slot(slot, self.temp_password_ptr())
- })
- }
-}
-
-impl<'a, T: Device<'a>> AuthenticatedDevice<T> for Admin<'a, T> {
- fn new(device: T, temp_password: Vec<u8>) -> Self {
- Admin {
- device,
- temp_password,
- marker: marker::PhantomData,
- }
- }
-
- fn temp_password_ptr(&self) -> *const c_char {
- self.temp_password.as_ptr() as *const c_char
- }
-}
-
-impl<'a> Authenticate<'a> for DeviceWrapper<'a> {
- fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)> {
- match self {
- DeviceWrapper::Storage(storage) => {
- authenticate_user_wrapper(storage, DeviceWrapper::Storage, password)
- }
- DeviceWrapper::Pro(pro) => authenticate_user_wrapper(pro, DeviceWrapper::Pro, password),
- }
- }
-
- fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)> {
- match self {
- DeviceWrapper::Storage(storage) => {
- authenticate_admin_wrapper(storage, DeviceWrapper::Storage, password)
- }
- DeviceWrapper::Pro(pro) => {
- authenticate_admin_wrapper(pro, DeviceWrapper::Pro, password)
- }
- }
- }
-}
-
-impl<'a> Authenticate<'a> for Pro<'a> {
- fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)> {
- authenticate(self, password, |password_ptr, temp_password_ptr| unsafe {
- nitrokey_sys::NK_user_authenticate(password_ptr, temp_password_ptr)
- })
- }
-
- fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)> {
- authenticate(self, password, |password_ptr, temp_password_ptr| unsafe {
- nitrokey_sys::NK_first_authenticate(password_ptr, temp_password_ptr)
- })
- }
-}
-
-impl<'a> Authenticate<'a> for Storage<'a> {
- fn authenticate_user(self, password: &str) -> Result<User<'a, Self>, (Self, Error)> {
- authenticate(self, password, |password_ptr, temp_password_ptr| unsafe {
- nitrokey_sys::NK_user_authenticate(password_ptr, temp_password_ptr)
- })
- }
-
- fn authenticate_admin(self, password: &str) -> Result<Admin<'a, Self>, (Self, Error)> {
- authenticate(self, password, |password_ptr, temp_password_ptr| unsafe {
- nitrokey_sys::NK_first_authenticate(password_ptr, temp_password_ptr)
- })
- }
-}
diff --git a/nitrokey/src/config.rs b/nitrokey/src/config.rs
deleted file mode 100644
index cb678d7..0000000
--- a/nitrokey/src/config.rs
+++ /dev/null
@@ -1,106 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use std::convert;
-
-use crate::error::{Error, LibraryError};
-
-/// The configuration for a Nitrokey.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Config {
- /// If set, the stick will generate a code from the HOTP slot with the given number if numlock
- /// is pressed. The slot number must be 0, 1 or 2.
- pub numlock: Option<u8>,
- /// If set, the stick will generate a code from the HOTP slot with the given number if capslock
- /// is pressed. The slot number must be 0, 1 or 2.
- pub capslock: Option<u8>,
- /// If set, the stick will generate a code from the HOTP slot with the given number if
- /// scrollock is pressed. The slot number must be 0, 1 or 2.
- pub scrollock: Option<u8>,
- /// If set, OTP generation using [`get_hotp_code`][] or [`get_totp_code`][] requires user
- /// authentication. Otherwise, OTPs can be generated without authentication.
- ///
- /// [`get_hotp_code`]: trait.ProvideOtp.html#method.get_hotp_code
- /// [`get_totp_code`]: trait.ProvideOtp.html#method.get_totp_code
- pub user_password: bool,
-}
-
-#[derive(Debug)]
-pub struct RawConfig {
- pub numlock: u8,
- pub capslock: u8,
- pub scrollock: u8,
- pub user_password: bool,
-}
-
-fn config_otp_slot_to_option(value: u8) -> Option<u8> {
- if value < 3 {
- Some(value)
- } else {
- None
- }
-}
-
-fn option_to_config_otp_slot(value: Option<u8>) -> Result<u8, Error> {
- if let Some(value) = value {
- if value < 3 {
- Ok(value)
- } else {
- Err(LibraryError::InvalidSlot.into())
- }
- } else {
- Ok(255)
- }
-}
-
-impl Config {
- /// Constructs a new instance of this struct.
- pub fn new(
- numlock: Option<u8>,
- capslock: Option<u8>,
- scrollock: Option<u8>,
- user_password: bool,
- ) -> Config {
- Config {
- numlock,
- capslock,
- scrollock,
- user_password,
- }
- }
-}
-
-impl convert::TryFrom<Config> for RawConfig {
- type Error = Error;
-
- fn try_from(config: Config) -> Result<RawConfig, Error> {
- Ok(RawConfig {
- numlock: option_to_config_otp_slot(config.numlock)?,
- capslock: option_to_config_otp_slot(config.capslock)?,
- scrollock: option_to_config_otp_slot(config.scrollock)?,
- user_password: config.user_password,
- })
- }
-}
-
-impl From<[u8; 5]> for RawConfig {
- fn from(data: [u8; 5]) -> Self {
- RawConfig {
- numlock: data[0],
- capslock: data[1],
- scrollock: data[2],
- user_password: data[3] != 0,
- }
- }
-}
-
-impl Into<Config> for RawConfig {
- fn into(self) -> Config {
- Config {
- numlock: config_otp_slot_to_option(self.numlock),
- capslock: config_otp_slot_to_option(self.capslock),
- scrollock: config_otp_slot_to_option(self.scrollock),
- user_password: self.user_password,
- }
- }
-}
diff --git a/nitrokey/src/device/mod.rs b/nitrokey/src/device/mod.rs
deleted file mode 100644
index 5e15f08..0000000
--- a/nitrokey/src/device/mod.rs
+++ /dev/null
@@ -1,464 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-mod pro;
-mod storage;
-mod wrapper;
-
-use std::fmt;
-
-use libc;
-use nitrokey_sys;
-
-use crate::auth::Authenticate;
-use crate::config::{Config, RawConfig};
-use crate::error::{CommunicationError, Error};
-use crate::otp::GenerateOtp;
-use crate::pws::GetPasswordSafe;
-use crate::util::{
- get_command_result, get_cstring, get_last_error, result_from_string, result_or_error,
-};
-
-pub use pro::Pro;
-pub use storage::{
- SdCardData, Storage, StorageProductionInfo, StorageStatus, VolumeMode, VolumeStatus,
-};
-pub use wrapper::DeviceWrapper;
-
-/// Available Nitrokey models.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum Model {
- /// The Nitrokey Storage.
- Storage,
- /// The Nitrokey Pro.
- Pro,
-}
-
-impl fmt::Display for Model {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- f.write_str(match *self {
- Model::Pro => "Pro",
- Model::Storage => "Storage",
- })
- }
-}
-
-/// A firmware version for a Nitrokey device.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct FirmwareVersion {
- /// The major firmware version, e. g. 0 in v0.40.
- pub major: u8,
- /// The minor firmware version, e. g. 40 in v0.40.
- pub minor: u8,
-}
-
-impl fmt::Display for FirmwareVersion {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- write!(f, "v{}.{}", self.major, self.minor)
- }
-}
-
-/// A Nitrokey device.
-///
-/// This trait provides the commands that can be executed without authentication and that are
-/// present on all supported Nitrokey devices.
-pub trait Device<'a>: Authenticate<'a> + GetPasswordSafe<'a> + GenerateOtp + fmt::Debug {
- /// Returns the [`Manager`][] instance that has been used to connect to this device.
- ///
- /// # Example
- ///
- /// ```
- /// use nitrokey::{Device, DeviceWrapper};
- ///
- /// fn do_something(device: DeviceWrapper) {
- /// // reconnect to any device
- /// let manager = device.into_manager();
- /// let device = manager.connect();
- /// // do something with the device
- /// // ...
- /// }
- ///
- /// match nitrokey::take()?.connect() {
- /// Ok(device) => do_something(device),
- /// Err(err) => println!("Could not connect to a Nitrokey: {}", err),
- /// }
- /// # Ok::<(), nitrokey::Error>(())
- /// ```
- fn into_manager(self) -> &'a mut crate::Manager;
-
- /// Returns the model of the connected Nitrokey device.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// println!("Connected to a Nitrokey {}", device.get_model());
- /// # Ok(())
- /// # }
- fn get_model(&self) -> Model;
-
- /// Returns the serial number of the Nitrokey device. The serial number is the string
- /// representation of a hex number.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// match device.get_serial_number() {
- /// Ok(number) => println!("serial no: {}", number),
- /// Err(err) => eprintln!("Could not get serial number: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- fn get_serial_number(&self) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_device_serial_number() })
- }
-
- /// Returns the number of remaining authentication attempts for the user. The total number of
- /// available attempts is three.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let count = device.get_user_retry_count();
- /// match device.get_user_retry_count() {
- /// Ok(count) => println!("{} remaining authentication attempts (user)", count),
- /// Err(err) => eprintln!("Could not get user retry count: {}", err),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- fn get_user_retry_count(&self) -> Result<u8, Error> {
- result_or_error(unsafe { nitrokey_sys::NK_get_user_retry_count() })
- }
-
- /// Returns the number of remaining authentication attempts for the admin. The total number of
- /// available attempts is three.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let count = device.get_admin_retry_count();
- /// match device.get_admin_retry_count() {
- /// Ok(count) => println!("{} remaining authentication attempts (admin)", count),
- /// Err(err) => eprintln!("Could not get admin retry count: {}", err),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- fn get_admin_retry_count(&self) -> Result<u8, Error> {
- result_or_error(unsafe { nitrokey_sys::NK_get_admin_retry_count() })
- }
-
- /// Returns the firmware version.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// match device.get_firmware_version() {
- /// Ok(version) => println!("Firmware version: {}", version),
- /// Err(err) => eprintln!("Could not access firmware version: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- fn get_firmware_version(&self) -> Result<FirmwareVersion, Error> {
- let major = result_or_error(unsafe { nitrokey_sys::NK_get_major_firmware_version() })?;
- let minor = result_or_error(unsafe { nitrokey_sys::NK_get_minor_firmware_version() })?;
- Ok(FirmwareVersion { major, minor })
- }
-
- /// Returns the current configuration of the Nitrokey device.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let config = device.get_config()?;
- /// println!("numlock binding: {:?}", config.numlock);
- /// println!("capslock binding: {:?}", config.capslock);
- /// println!("scrollock binding: {:?}", config.scrollock);
- /// println!("require password for OTP: {:?}", config.user_password);
- /// # Ok(())
- /// # }
- /// ```
- fn get_config(&self) -> Result<Config, Error> {
- let config_ptr = unsafe { nitrokey_sys::NK_read_config() };
- if config_ptr.is_null() {
- return Err(get_last_error());
- }
- let config_array_ptr = config_ptr as *const [u8; 5];
- let raw_config = unsafe { RawConfig::from(*config_array_ptr) };
- unsafe { libc::free(config_ptr as *mut libc::c_void) };
- Ok(raw_config.into())
- }
-
- /// Changes the administrator PIN.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if one of the provided passwords contains a null byte
- /// - [`WrongPassword`][] if the current admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.change_admin_pin("12345678", "12345679") {
- /// Ok(()) => println!("Updated admin PIN."),
- /// Err(err) => eprintln!("Failed to update admin PIN: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- fn change_admin_pin(&mut self, current: &str, new: &str) -> Result<(), Error> {
- let current_string = get_cstring(current)?;
- let new_string = get_cstring(new)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_change_admin_PIN(current_string.as_ptr(), new_string.as_ptr())
- })
- }
-
- /// Changes the user PIN.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if one of the provided passwords contains a null byte
- /// - [`WrongPassword`][] if the current user password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.change_user_pin("123456", "123457") {
- /// Ok(()) => println!("Updated admin PIN."),
- /// Err(err) => eprintln!("Failed to update admin PIN: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- fn change_user_pin(&mut self, current: &str, new: &str) -> Result<(), Error> {
- let current_string = get_cstring(current)?;
- let new_string = get_cstring(new)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_change_user_PIN(current_string.as_ptr(), new_string.as_ptr())
- })
- }
-
- /// Unlocks the user PIN after three failed login attempts and sets it to the given value.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if one of the provided passwords contains a null byte
- /// - [`WrongPassword`][] if the admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.unlock_user_pin("12345678", "123456") {
- /// Ok(()) => println!("Unlocked user PIN."),
- /// Err(err) => eprintln!("Failed to unlock user PIN: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- fn unlock_user_pin(&mut self, admin_pin: &str, user_pin: &str) -> Result<(), Error> {
- let admin_pin_string = get_cstring(admin_pin)?;
- let user_pin_string = get_cstring(user_pin)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_unlock_user_password(
- admin_pin_string.as_ptr(),
- user_pin_string.as_ptr(),
- )
- })
- }
-
- /// Locks the Nitrokey device.
- ///
- /// This disables the password store if it has been unlocked. On the Nitrokey Storage, this
- /// also disables the volumes if they have been enabled.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.lock() {
- /// Ok(()) => println!("Locked the Nitrokey device."),
- /// Err(err) => eprintln!("Could not lock the Nitrokey device: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- fn lock(&mut self) -> Result<(), Error> {
- get_command_result(unsafe { nitrokey_sys::NK_lock_device() })
- }
-
- /// Performs a factory reset on the Nitrokey device.
- ///
- /// This commands performs a factory reset on the smart card (like the factory reset via `gpg
- /// --card-edit`) and then clears the flash memory (password safe, one-time passwords etc.).
- /// After a factory reset, [`build_aes_key`][] has to be called before the password safe or the
- /// encrypted volume can be used.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided password contains a null byte
- /// - [`WrongPassword`][] if the admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.factory_reset("12345678") {
- /// Ok(()) => println!("Performed a factory reset."),
- /// Err(err) => eprintln!("Could not perform a factory reset: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`build_aes_key`]: #method.build_aes_key
- fn factory_reset(&mut self, admin_pin: &str) -> Result<(), Error> {
- let admin_pin_string = get_cstring(admin_pin)?;
- get_command_result(unsafe { nitrokey_sys::NK_factory_reset(admin_pin_string.as_ptr()) })
- }
-
- /// Builds a new AES key on the Nitrokey.
- ///
- /// The AES key is used to encrypt the password safe and the encrypted volume. You may need
- /// to call this method after a factory reset, either using [`factory_reset`][] or using `gpg
- /// --card-edit`. You can also use it to destroy the data stored in the password safe or on
- /// the encrypted volume.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided password contains a null byte
- /// - [`WrongPassword`][] if the admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::Device;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.build_aes_key("12345678") {
- /// Ok(()) => println!("New AES keys have been built."),
- /// Err(err) => eprintln!("Could not build new AES keys: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`factory_reset`]: #method.factory_reset
- fn build_aes_key(&mut self, admin_pin: &str) -> Result<(), Error> {
- let admin_pin_string = get_cstring(admin_pin)?;
- get_command_result(unsafe { nitrokey_sys::NK_build_aes_key(admin_pin_string.as_ptr()) })
- }
-}
-
-fn get_connected_model() -> Option<Model> {
- match unsafe { nitrokey_sys::NK_get_device_model() } {
- nitrokey_sys::NK_device_model_NK_PRO => Some(Model::Pro),
- nitrokey_sys::NK_device_model_NK_STORAGE => Some(Model::Storage),
- _ => None,
- }
-}
-
-pub(crate) fn create_device_wrapper(
- manager: &mut crate::Manager,
- model: Model,
-) -> DeviceWrapper<'_> {
- match model {
- Model::Pro => Pro::new(manager).into(),
- Model::Storage => Storage::new(manager).into(),
- }
-}
-
-pub(crate) fn get_connected_device(
- manager: &mut crate::Manager,
-) -> Result<DeviceWrapper<'_>, Error> {
- match get_connected_model() {
- Some(model) => Ok(create_device_wrapper(manager, model)),
- None => Err(CommunicationError::NotConnected.into()),
- }
-}
-
-pub(crate) fn connect_enum(model: Model) -> bool {
- let model = match model {
- Model::Storage => nitrokey_sys::NK_device_model_NK_STORAGE,
- Model::Pro => nitrokey_sys::NK_device_model_NK_PRO,
- };
- unsafe { nitrokey_sys::NK_login_enum(model) == 1 }
-}
diff --git a/nitrokey/src/device/pro.rs b/nitrokey/src/device/pro.rs
deleted file mode 100644
index a65345e..0000000
--- a/nitrokey/src/device/pro.rs
+++ /dev/null
@@ -1,79 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use nitrokey_sys;
-
-use crate::device::{Device, Model};
-use crate::otp::GenerateOtp;
-
-/// A Nitrokey Pro device without user or admin authentication.
-///
-/// Use the [`connect`][] method to obtain an instance wrapper or the [`connect_pro`] method to
-/// directly obtain an instance. If you want to execute a command that requires user or admin
-/// authentication, use [`authenticate_admin`][] or [`authenticate_user`][].
-///
-/// # Examples
-///
-/// Authentication with error handling:
-///
-/// ```no_run
-/// use nitrokey::{Authenticate, User, Pro};
-/// # use nitrokey::Error;
-///
-/// fn perform_user_task<'a>(device: &User<'a, Pro<'a>>) {}
-/// fn perform_other_task(device: &Pro) {}
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect_pro()?;
-/// let device = match device.authenticate_user("123456") {
-/// Ok(user) => {
-/// perform_user_task(&user);
-/// user.device()
-/// },
-/// Err((device, err)) => {
-/// eprintln!("Could not authenticate as user: {}", err);
-/// device
-/// },
-/// };
-/// perform_other_task(&device);
-/// # Ok(())
-/// # }
-/// ```
-///
-/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin
-/// [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user
-/// [`connect`]: struct.Manager.html#method.connect
-/// [`connect_pro`]: struct.Manager.html#method.connect_pro
-#[derive(Debug)]
-pub struct Pro<'a> {
- manager: Option<&'a mut crate::Manager>,
-}
-
-impl<'a> Pro<'a> {
- pub(crate) fn new(manager: &'a mut crate::Manager) -> Pro<'a> {
- Pro {
- manager: Some(manager),
- }
- }
-}
-
-impl<'a> Drop for Pro<'a> {
- fn drop(&mut self) {
- unsafe {
- nitrokey_sys::NK_logout();
- }
- }
-}
-
-impl<'a> Device<'a> for Pro<'a> {
- fn into_manager(mut self) -> &'a mut crate::Manager {
- self.manager.take().unwrap()
- }
-
- fn get_model(&self) -> Model {
- Model::Pro
- }
-}
-
-impl<'a> GenerateOtp for Pro<'a> {}
diff --git a/nitrokey/src/device/storage.rs b/nitrokey/src/device/storage.rs
deleted file mode 100644
index 370ce36..0000000
--- a/nitrokey/src/device/storage.rs
+++ /dev/null
@@ -1,735 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use std::fmt;
-
-use nitrokey_sys;
-
-use crate::device::{Device, FirmwareVersion, Model};
-use crate::error::Error;
-use crate::otp::GenerateOtp;
-use crate::util::{get_command_result, get_cstring};
-
-/// A Nitrokey Storage device without user or admin authentication.
-///
-/// Use the [`connect`][] method to obtain an instance wrapper or the [`connect_storage`] method to
-/// directly obtain an instance. If you want to execute a command that requires user or admin
-/// authentication, use [`authenticate_admin`][] or [`authenticate_user`][].
-///
-/// # Examples
-///
-/// Authentication with error handling:
-///
-/// ```no_run
-/// use nitrokey::{Authenticate, User, Storage};
-/// # use nitrokey::Error;
-///
-/// fn perform_user_task<'a>(device: &User<'a, Storage<'a>>) {}
-/// fn perform_other_task(device: &Storage) {}
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect_storage()?;
-/// let device = match device.authenticate_user("123456") {
-/// Ok(user) => {
-/// perform_user_task(&user);
-/// user.device()
-/// },
-/// Err((device, err)) => {
-/// eprintln!("Could not authenticate as user: {}", err);
-/// device
-/// },
-/// };
-/// perform_other_task(&device);
-/// # Ok(())
-/// # }
-/// ```
-///
-/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin
-/// [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user
-/// [`connect`]: struct.Manager.html#method.connect
-/// [`connect_storage`]: struct.Manager.html#method.connect_storage
-#[derive(Debug)]
-pub struct Storage<'a> {
- manager: Option<&'a mut crate::Manager>,
-}
-
-/// The access mode of a volume on the Nitrokey Storage.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum VolumeMode {
- /// A read-only volume.
- ReadOnly,
- /// A read-write volume.
- ReadWrite,
-}
-
-impl fmt::Display for VolumeMode {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- f.write_str(match *self {
- VolumeMode::ReadOnly => "read-only",
- VolumeMode::ReadWrite => "read-write",
- })
- }
-}
-
-/// The status of a volume on a Nitrokey Storage device.
-#[derive(Debug)]
-pub struct VolumeStatus {
- /// Indicates whether the volume is read-only.
- pub read_only: bool,
- /// Indicates whether the volume is active.
- pub active: bool,
-}
-
-/// Information about the SD card in a Storage device.
-#[derive(Debug)]
-pub struct SdCardData {
- /// The serial number of the SD card.
- pub serial_number: u32,
- /// The size of the SD card in GB.
- pub size: u8,
- /// The year the card was manufactured, e. g. 17 for 2017.
- pub manufacturing_year: u8,
- /// The month the card was manufactured.
- pub manufacturing_month: u8,
- /// The OEM ID.
- pub oem: u16,
- /// The manufacturer ID.
- pub manufacturer: u8,
-}
-
-/// Production information for a Storage device.
-#[derive(Debug)]
-pub struct StorageProductionInfo {
- /// The firmware version.
- pub firmware_version: FirmwareVersion,
- /// The internal firmware version.
- pub firmware_version_internal: u8,
- /// The serial number of the CPU.
- pub serial_number_cpu: u32,
- /// Information about the SD card.
- pub sd_card: SdCardData,
-}
-
-/// The status of a Nitrokey Storage device.
-#[derive(Debug)]
-pub struct StorageStatus {
- /// The status of the unencrypted volume.
- pub unencrypted_volume: VolumeStatus,
- /// The status of the encrypted volume.
- pub encrypted_volume: VolumeStatus,
- /// The status of the hidden volume.
- pub hidden_volume: VolumeStatus,
- /// The firmware version.
- pub firmware_version: FirmwareVersion,
- /// Indicates whether the firmware is locked.
- pub firmware_locked: bool,
- /// The serial number of the SD card in the Storage stick.
- pub serial_number_sd_card: u32,
- /// The serial number of the smart card in the Storage stick.
- pub serial_number_smart_card: u32,
- /// The number of remaining login attempts for the user PIN.
- pub user_retry_count: u8,
- /// The number of remaining login attempts for the admin PIN.
- pub admin_retry_count: u8,
- /// Indicates whether a new SD card was found.
- pub new_sd_card_found: bool,
- /// Indicates whether the SD card is filled with random characters.
- pub filled_with_random: bool,
- /// Indicates whether the stick has been initialized by generating
- /// the AES keys.
- pub stick_initialized: bool,
-}
-
-impl<'a> Storage<'a> {
- pub(crate) fn new(manager: &'a mut crate::Manager) -> Storage<'a> {
- Storage {
- manager: Some(manager),
- }
- }
-
- /// Changes the update PIN.
- ///
- /// The update PIN is used to enable firmware updates. Unlike the user and the admin PIN, the
- /// update PIN is not managed by the OpenPGP smart card but by the Nitrokey firmware. There is
- /// no retry counter as with the other PIN types.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if one of the provided passwords contains a null byte
- /// - [`WrongPassword`][] if the current update password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// match device.change_update_pin("12345678", "87654321") {
- /// Ok(()) => println!("Updated update PIN."),
- /// Err(err) => eprintln!("Failed to update update PIN: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- pub fn change_update_pin(&mut self, current: &str, new: &str) -> Result<(), Error> {
- let current_string = get_cstring(current)?;
- let new_string = get_cstring(new)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_change_update_password(current_string.as_ptr(), new_string.as_ptr())
- })
- }
-
- /// Enables the firmware update mode.
- ///
- /// During firmware update mode, the Nitrokey can no longer be accessed using HID commands.
- /// To resume normal operation, run `dfu-programmer at32uc3a3256s launch`. In order to enter
- /// the firmware update mode, you need the update password that can be changed using the
- /// [`change_update_pin`][] method.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if one of the provided passwords contains a null byte
- /// - [`WrongPassword`][] if the current update password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// match device.enable_firmware_update("12345678") {
- /// Ok(()) => println!("Nitrokey entered update mode."),
- /// Err(err) => eprintln!("Could not enter update mode: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- pub fn enable_firmware_update(&mut self, update_pin: &str) -> Result<(), Error> {
- let update_pin_string = get_cstring(update_pin)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_enable_firmware_update(update_pin_string.as_ptr())
- })
- }
-
- /// Enables the encrypted storage volume.
- ///
- /// Once the encrypted volume is enabled, it is presented to the operating system as a block
- /// device. The API does not provide any information on the name or path of this block device.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided password contains a null byte
- /// - [`WrongPassword`][] if the provided user password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// match device.enable_encrypted_volume("123456") {
- /// Ok(()) => println!("Enabled the encrypted volume."),
- /// Err(err) => eprintln!("Could not enable the encrypted volume: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- pub fn enable_encrypted_volume(&mut self, user_pin: &str) -> Result<(), Error> {
- let user_pin = get_cstring(user_pin)?;
- get_command_result(unsafe { nitrokey_sys::NK_unlock_encrypted_volume(user_pin.as_ptr()) })
- }
-
- /// Disables the encrypted storage volume.
- ///
- /// Once the volume is disabled, it can be no longer accessed as a block device. If the
- /// encrypted volume has not been enabled, this method still returns a success.
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// fn use_volume() {}
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// match device.enable_encrypted_volume("123456") {
- /// Ok(()) => {
- /// println!("Enabled the encrypted volume.");
- /// use_volume();
- /// match device.disable_encrypted_volume() {
- /// Ok(()) => println!("Disabled the encrypted volume."),
- /// Err(err) => {
- /// eprintln!("Could not disable the encrypted volume: {}", err);
- /// },
- /// };
- /// },
- /// Err(err) => eprintln!("Could not enable the encrypted volume: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- pub fn disable_encrypted_volume(&mut self) -> Result<(), Error> {
- get_command_result(unsafe { nitrokey_sys::NK_lock_encrypted_volume() })
- }
-
- /// Enables a hidden storage volume.
- ///
- /// This function will only succeed if the encrypted storage ([`enable_encrypted_volume`][]) or
- /// another hidden volume has been enabled previously. Once the hidden volume is enabled, it
- /// is presented to the operating system as a block device and any previously opened encrypted
- /// or hidden volumes are closed. The API does not provide any information on the name or path
- /// of this block device.
- ///
- /// Note that the encrypted and the hidden volumes operate on the same storage area, so using
- /// both at the same time might lead to data loss.
- ///
- /// The hidden volume to unlock is selected based on the provided password.
- ///
- /// # Errors
- ///
- /// - [`AesDecryptionFailed`][] if the encrypted storage has not been opened before calling
- /// this method or the AES key has not been built
- /// - [`InvalidString`][] if the provided password contains a null byte
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// device.enable_encrypted_volume("123445")?;
- /// match device.enable_hidden_volume("hidden-pw") {
- /// Ok(()) => println!("Enabled a hidden volume."),
- /// Err(err) => eprintln!("Could not enable the hidden volume: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`enable_encrypted_volume`]: #method.enable_encrypted_volume
- /// [`AesDecryptionFailed`]: enum.CommandError.html#variant.AesDecryptionFailed
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- pub fn enable_hidden_volume(&mut self, volume_password: &str) -> Result<(), Error> {
- let volume_password = get_cstring(volume_password)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_unlock_hidden_volume(volume_password.as_ptr())
- })
- }
-
- /// Disables a hidden storage volume.
- ///
- /// Once the volume is disabled, it can be no longer accessed as a block device. If no hidden
- /// volume has been enabled, this method still returns a success.
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// fn use_volume() {}
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// device.enable_encrypted_volume("123445")?;
- /// match device.enable_hidden_volume("hidden-pw") {
- /// Ok(()) => {
- /// println!("Enabled the hidden volume.");
- /// use_volume();
- /// match device.disable_hidden_volume() {
- /// Ok(()) => println!("Disabled the hidden volume."),
- /// Err(err) => {
- /// eprintln!("Could not disable the hidden volume: {}", err);
- /// },
- /// };
- /// },
- /// Err(err) => eprintln!("Could not enable the hidden volume: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- pub fn disable_hidden_volume(&mut self) -> Result<(), Error> {
- get_command_result(unsafe { nitrokey_sys::NK_lock_hidden_volume() })
- }
-
- /// Creates a hidden volume.
- ///
- /// The volume is crated in the given slot and in the given range of the available memory,
- /// where `start` is the start position as a percentage of the available memory, and `end` is
- /// the end position as a percentage of the available memory. The volume will be protected by
- /// the given password.
- ///
- /// Note that the encrypted and the hidden volumes operate on the same storage area, so using
- /// both at the same time might lead to data loss.
- ///
- /// According to the libnitrokey documentation, this function only works if the encrypted
- /// storage has been opened.
- ///
- /// # Errors
- ///
- /// - [`AesDecryptionFailed`][] if the encrypted storage has not been opened before calling
- /// this method or the AES key has not been built
- /// - [`InvalidString`][] if the provided password contains a null byte
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// device.enable_encrypted_volume("123445")?;
- /// device.create_hidden_volume(0, 0, 100, "hidden-pw")?;
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`AesDecryptionFailed`]: enum.CommandError.html#variant.AesDecryptionFailed
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- pub fn create_hidden_volume(
- &mut self,
- slot: u8,
- start: u8,
- end: u8,
- password: &str,
- ) -> Result<(), Error> {
- let password = get_cstring(password)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_create_hidden_volume(slot, start, end, password.as_ptr())
- })
- }
-
- /// Sets the access mode of the unencrypted volume.
- ///
- /// This command will reconnect the unencrypted volume so buffers should be flushed before
- /// calling it. Since firmware version v0.51, this command requires the admin PIN. Older
- /// firmware versions are not supported.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided password contains a null byte
- /// - [`WrongPassword`][] if the provided admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- /// use nitrokey::VolumeMode;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// match device.set_unencrypted_volume_mode("12345678", VolumeMode::ReadWrite) {
- /// Ok(()) => println!("Set the unencrypted volume to read-write mode."),
- /// Err(err) => eprintln!("Could not set the unencrypted volume to read-write mode: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- pub fn set_unencrypted_volume_mode(
- &mut self,
- admin_pin: &str,
- mode: VolumeMode,
- ) -> Result<(), Error> {
- let admin_pin = get_cstring(admin_pin)?;
- let result = match mode {
- VolumeMode::ReadOnly => unsafe {
- nitrokey_sys::NK_set_unencrypted_read_only_admin(admin_pin.as_ptr())
- },
- VolumeMode::ReadWrite => unsafe {
- nitrokey_sys::NK_set_unencrypted_read_write_admin(admin_pin.as_ptr())
- },
- };
- get_command_result(result)
- }
-
- /// Sets the access mode of the encrypted volume.
- ///
- /// This command will reconnect the encrypted volume so buffers should be flushed before
- /// calling it. It is only available in firmware version 0.49.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided password contains a null byte
- /// - [`WrongPassword`][] if the provided admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- /// use nitrokey::VolumeMode;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// match device.set_encrypted_volume_mode("12345678", VolumeMode::ReadWrite) {
- /// Ok(()) => println!("Set the encrypted volume to read-write mode."),
- /// Err(err) => eprintln!("Could not set the encrypted volume to read-write mode: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- pub fn set_encrypted_volume_mode(
- &mut self,
- admin_pin: &str,
- mode: VolumeMode,
- ) -> Result<(), Error> {
- let admin_pin = get_cstring(admin_pin)?;
- let result = match mode {
- VolumeMode::ReadOnly => unsafe {
- nitrokey_sys::NK_set_encrypted_read_only(admin_pin.as_ptr())
- },
- VolumeMode::ReadWrite => unsafe {
- nitrokey_sys::NK_set_encrypted_read_write(admin_pin.as_ptr())
- },
- };
- get_command_result(result)
- }
-
- /// Returns the status of the connected storage device.
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// fn use_volume() {}
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect_storage()?;
- /// match device.get_status() {
- /// Ok(status) => {
- /// println!("SD card ID: {:#x}", status.serial_number_sd_card);
- /// },
- /// Err(err) => eprintln!("Could not get Storage status: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- pub fn get_status(&self) -> Result<StorageStatus, Error> {
- let mut raw_status = nitrokey_sys::NK_storage_status {
- unencrypted_volume_read_only: false,
- unencrypted_volume_active: false,
- encrypted_volume_read_only: false,
- encrypted_volume_active: false,
- hidden_volume_read_only: false,
- hidden_volume_active: false,
- firmware_version_major: 0,
- firmware_version_minor: 0,
- firmware_locked: false,
- serial_number_sd_card: 0,
- serial_number_smart_card: 0,
- user_retry_count: 0,
- admin_retry_count: 0,
- new_sd_card_found: false,
- filled_with_random: false,
- stick_initialized: false,
- };
- let raw_result = unsafe { nitrokey_sys::NK_get_status_storage(&mut raw_status) };
- get_command_result(raw_result).map(|_| StorageStatus::from(raw_status))
- }
-
- /// Returns the production information for the connected storage device.
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// fn use_volume() {}
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect_storage()?;
- /// match device.get_production_info() {
- /// Ok(data) => {
- /// println!("SD card ID: {:#x}", data.sd_card.serial_number);
- /// println!("SD card size: {} GB", data.sd_card.size);
- /// },
- /// Err(err) => eprintln!("Could not get Storage production info: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- pub fn get_production_info(&self) -> Result<StorageProductionInfo, Error> {
- let mut raw_data = nitrokey_sys::NK_storage_ProductionTest {
- FirmwareVersion_au8: [0, 2],
- FirmwareVersionInternal_u8: 0,
- SD_Card_Size_u8: 0,
- CPU_CardID_u32: 0,
- SmartCardID_u32: 0,
- SD_CardID_u32: 0,
- SC_UserPwRetryCount: 0,
- SC_AdminPwRetryCount: 0,
- SD_Card_ManufacturingYear_u8: 0,
- SD_Card_ManufacturingMonth_u8: 0,
- SD_Card_OEM_u16: 0,
- SD_WriteSpeed_u16: 0,
- SD_Card_Manufacturer_u8: 0,
- };
- let raw_result = unsafe { nitrokey_sys::NK_get_storage_production_info(&mut raw_data) };
- get_command_result(raw_result).map(|_| StorageProductionInfo::from(raw_data))
- }
-
- /// Clears the warning for a new SD card.
- ///
- /// The Storage status contains a field for a new SD card warning. After a factory reset, the
- /// field is set to true. After filling the SD card with random data, it is set to false.
- /// This method can be used to set it to false without filling the SD card with random data.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if the provided password contains a null byte
- /// - [`WrongPassword`][] if the provided admin password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect_storage()?;
- /// match device.clear_new_sd_card_warning("12345678") {
- /// Ok(()) => println!("Cleared the new SD card warning."),
- /// Err(err) => eprintln!("Could not set the clear the new SD card warning: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- pub fn clear_new_sd_card_warning(&mut self, admin_pin: &str) -> Result<(), Error> {
- let admin_pin = get_cstring(admin_pin)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_clear_new_sd_card_warning(admin_pin.as_ptr())
- })
- }
-
- /// Blinks the red and green LED alternatively and infinitely until the device is reconnected.
- pub fn wink(&mut self) -> Result<(), Error> {
- get_command_result(unsafe { nitrokey_sys::NK_wink() })
- }
-
- /// Exports the firmware to the unencrypted volume.
- ///
- /// This command requires the admin PIN. The unencrypted volume must be in read-write mode
- /// when this command is executed. Otherwise, it will still return `Ok` but not write the
- /// firmware.
- ///
- /// This command unmounts the unencrypted volume if it has been mounted, so all buffers should
- /// be flushed. The firmware is written to the `firmware.bin` file on the unencrypted volume.
- ///
- /// # Errors
- ///
- /// - [`InvalidString`][] if one of the provided passwords contains a null byte
- /// - [`WrongPassword`][] if the admin password is wrong
- ///
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- pub fn export_firmware(&mut self, admin_pin: &str) -> Result<(), Error> {
- let admin_pin_string = get_cstring(admin_pin)?;
- get_command_result(unsafe { nitrokey_sys::NK_export_firmware(admin_pin_string.as_ptr()) })
- }
-}
-
-impl<'a> Drop for Storage<'a> {
- fn drop(&mut self) {
- unsafe {
- nitrokey_sys::NK_logout();
- }
- }
-}
-
-impl<'a> Device<'a> for Storage<'a> {
- fn into_manager(mut self) -> &'a mut crate::Manager {
- self.manager.take().unwrap()
- }
-
- fn get_model(&self) -> Model {
- Model::Storage
- }
-}
-
-impl<'a> GenerateOtp for Storage<'a> {}
-
-impl From<nitrokey_sys::NK_storage_ProductionTest> for StorageProductionInfo {
- fn from(data: nitrokey_sys::NK_storage_ProductionTest) -> Self {
- Self {
- firmware_version: FirmwareVersion {
- major: data.FirmwareVersion_au8[0],
- minor: data.FirmwareVersion_au8[1],
- },
- firmware_version_internal: data.FirmwareVersionInternal_u8,
- serial_number_cpu: data.CPU_CardID_u32,
- sd_card: SdCardData {
- serial_number: data.SD_CardID_u32,
- size: data.SD_Card_Size_u8,
- manufacturing_year: data.SD_Card_ManufacturingYear_u8,
- manufacturing_month: data.SD_Card_ManufacturingMonth_u8,
- oem: data.SD_Card_OEM_u16,
- manufacturer: data.SD_Card_Manufacturer_u8,
- },
- }
- }
-}
-
-impl From<nitrokey_sys::NK_storage_status> for StorageStatus {
- fn from(status: nitrokey_sys::NK_storage_status) -> Self {
- StorageStatus {
- unencrypted_volume: VolumeStatus {
- read_only: status.unencrypted_volume_read_only,
- active: status.unencrypted_volume_active,
- },
- encrypted_volume: VolumeStatus {
- read_only: status.encrypted_volume_read_only,
- active: status.encrypted_volume_active,
- },
- hidden_volume: VolumeStatus {
- read_only: status.hidden_volume_read_only,
- active: status.hidden_volume_active,
- },
- firmware_version: FirmwareVersion {
- major: status.firmware_version_major,
- minor: status.firmware_version_minor,
- },
- firmware_locked: status.firmware_locked,
- serial_number_sd_card: status.serial_number_sd_card,
- serial_number_smart_card: status.serial_number_smart_card,
- user_retry_count: status.user_retry_count,
- admin_retry_count: status.admin_retry_count,
- new_sd_card_found: status.new_sd_card_found,
- filled_with_random: status.filled_with_random,
- stick_initialized: status.stick_initialized,
- }
- }
-}
diff --git a/nitrokey/src/device/wrapper.rs b/nitrokey/src/device/wrapper.rs
deleted file mode 100644
index a3a18f9..0000000
--- a/nitrokey/src/device/wrapper.rs
+++ /dev/null
@@ -1,134 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use crate::device::{Device, Model, Pro, Storage};
-use crate::error::Error;
-use crate::otp::GenerateOtp;
-
-/// A wrapper for a Nitrokey device of unknown type.
-///
-/// Use the [`connect`][] method to obtain a wrapped instance. The wrapper implements all traits
-/// that are shared between all Nitrokey devices so that the shared functionality can be used
-/// without knowing the type of the underlying device. If you want to use functionality that is
-/// not available for all devices, you have to extract the device.
-///
-/// # Examples
-///
-/// Authentication with error handling:
-///
-/// ```no_run
-/// use nitrokey::{Authenticate, DeviceWrapper, User};
-/// # use nitrokey::Error;
-///
-/// fn perform_user_task<'a>(device: &User<'a, DeviceWrapper<'a>>) {}
-/// fn perform_other_task(device: &DeviceWrapper) {}
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect()?;
-/// let device = match device.authenticate_user("123456") {
-/// Ok(user) => {
-/// perform_user_task(&user);
-/// user.device()
-/// },
-/// Err((device, err)) => {
-/// eprintln!("Could not authenticate as user: {}", err);
-/// device
-/// },
-/// };
-/// perform_other_task(&device);
-/// # Ok(())
-/// # }
-/// ```
-///
-/// Device-specific commands:
-///
-/// ```no_run
-/// use nitrokey::{DeviceWrapper, Storage};
-/// # use nitrokey::Error;
-///
-/// fn perform_common_task(device: &DeviceWrapper) {}
-/// fn perform_storage_task(device: &Storage) {}
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect()?;
-/// perform_common_task(&device);
-/// match device {
-/// DeviceWrapper::Storage(storage) => perform_storage_task(&storage),
-/// _ => (),
-/// };
-/// # Ok(())
-/// # }
-/// ```
-///
-/// [`connect`]: struct.Manager.html#method.connect
-#[derive(Debug)]
-pub enum DeviceWrapper<'a> {
- /// A Nitrokey Storage device.
- Storage(Storage<'a>),
- /// A Nitrokey Pro device.
- Pro(Pro<'a>),
-}
-
-impl<'a> DeviceWrapper<'a> {
- fn device(&self) -> &dyn Device<'a> {
- match *self {
- DeviceWrapper::Storage(ref storage) => storage,
- DeviceWrapper::Pro(ref pro) => pro,
- }
- }
-
- fn device_mut(&mut self) -> &mut dyn Device<'a> {
- match *self {
- DeviceWrapper::Storage(ref mut storage) => storage,
- DeviceWrapper::Pro(ref mut pro) => pro,
- }
- }
-}
-
-impl<'a> From<Pro<'a>> for DeviceWrapper<'a> {
- fn from(device: Pro<'a>) -> Self {
- DeviceWrapper::Pro(device)
- }
-}
-
-impl<'a> From<Storage<'a>> for DeviceWrapper<'a> {
- fn from(device: Storage<'a>) -> Self {
- DeviceWrapper::Storage(device)
- }
-}
-
-impl<'a> GenerateOtp for DeviceWrapper<'a> {
- fn get_hotp_slot_name(&self, slot: u8) -> Result<String, Error> {
- self.device().get_hotp_slot_name(slot)
- }
-
- fn get_totp_slot_name(&self, slot: u8) -> Result<String, Error> {
- self.device().get_totp_slot_name(slot)
- }
-
- fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> {
- self.device_mut().get_hotp_code(slot)
- }
-
- fn get_totp_code(&self, slot: u8) -> Result<String, Error> {
- self.device().get_totp_code(slot)
- }
-}
-
-impl<'a> Device<'a> for DeviceWrapper<'a> {
- fn into_manager(self) -> &'a mut crate::Manager {
- match self {
- DeviceWrapper::Pro(dev) => dev.into_manager(),
- DeviceWrapper::Storage(dev) => dev.into_manager(),
- }
- }
-
- fn get_model(&self) -> Model {
- match *self {
- DeviceWrapper::Pro(_) => Model::Pro,
- DeviceWrapper::Storage(_) => Model::Storage,
- }
- }
-}
diff --git a/nitrokey/src/error.rs b/nitrokey/src/error.rs
deleted file mode 100644
index 9e6adc0..0000000
--- a/nitrokey/src/error.rs
+++ /dev/null
@@ -1,269 +0,0 @@
-// Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use std::error;
-use std::fmt;
-use std::os::raw;
-use std::str;
-use std::sync;
-
-use crate::device;
-
-/// An error returned by the nitrokey crate.
-#[derive(Debug)]
-pub enum Error {
- /// An error reported by the Nitrokey device in the response packet.
- CommandError(CommandError),
- /// A device communication error.
- CommunicationError(CommunicationError),
- /// An error occurred due to concurrent access to the Nitrokey device.
- ConcurrentAccessError,
- /// A library usage error.
- LibraryError(LibraryError),
- /// An error that occurred due to a poisoned lock.
- PoisonError(sync::PoisonError<sync::MutexGuard<'static, crate::Manager>>),
- /// An error that occurred during random number generation.
- RandError(Box<dyn error::Error>),
- /// An error that is caused by an unexpected value returned by libnitrokey.
- UnexpectedError,
- /// An unknown error returned by libnitrokey.
- UnknownError(i64),
- /// An error occurred when interpreting a UTF-8 string.
- Utf8Error(str::Utf8Error),
-}
-
-impl From<raw::c_int> for Error {
- fn from(code: raw::c_int) -> Self {
- if let Some(err) = CommandError::try_from(code) {
- Error::CommandError(err)
- } else if let Some(err) = CommunicationError::try_from(256 - code) {
- Error::CommunicationError(err)
- } else if let Some(err) = LibraryError::try_from(code) {
- Error::LibraryError(err)
- } else {
- Error::UnknownError(code.into())
- }
- }
-}
-
-impl From<CommandError> for Error {
- fn from(err: CommandError) -> Self {
- Error::CommandError(err)
- }
-}
-
-impl From<CommunicationError> for Error {
- fn from(err: CommunicationError) -> Self {
- Error::CommunicationError(err)
- }
-}
-
-impl From<LibraryError> for Error {
- fn from(err: LibraryError) -> Self {
- Error::LibraryError(err)
- }
-}
-
-impl From<str::Utf8Error> for Error {
- fn from(error: str::Utf8Error) -> Self {
- Error::Utf8Error(error)
- }
-}
-
-impl From<sync::PoisonError<sync::MutexGuard<'static, crate::Manager>>> for Error {
- fn from(error: sync::PoisonError<sync::MutexGuard<'static, crate::Manager>>) -> Self {
- Error::PoisonError(error)
- }
-}
-
-impl From<sync::TryLockError<sync::MutexGuard<'static, crate::Manager>>> for Error {
- fn from(error: sync::TryLockError<sync::MutexGuard<'static, crate::Manager>>) -> Self {
- match error {
- sync::TryLockError::Poisoned(err) => err.into(),
- sync::TryLockError::WouldBlock => Error::ConcurrentAccessError,
- }
- }
-}
-
-impl<'a, T: device::Device<'a>> From<(T, Error)> for Error {
- fn from((_, err): (T, Error)) -> Self {
- err
- }
-}
-
-impl error::Error for Error {
- fn source(&self) -> Option<&(dyn error::Error + 'static)> {
- match *self {
- Error::CommandError(ref err) => Some(err),
- Error::CommunicationError(ref err) => Some(err),
- Error::ConcurrentAccessError => None,
- Error::LibraryError(ref err) => Some(err),
- Error::PoisonError(ref err) => Some(err),
- Error::RandError(ref err) => Some(err.as_ref()),
- Error::UnexpectedError => None,
- Error::UnknownError(_) => None,
- Error::Utf8Error(ref err) => Some(err),
- }
- }
-}
-
-impl fmt::Display for Error {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- match *self {
- Error::CommandError(ref err) => write!(f, "Command error: {}", err),
- Error::CommunicationError(ref err) => write!(f, "Communication error: {}", err),
- Error::ConcurrentAccessError => write!(f, "Internal error: concurrent access"),
- Error::LibraryError(ref err) => write!(f, "Library error: {}", err),
- Error::PoisonError(_) => write!(f, "Internal error: poisoned lock"),
- Error::RandError(ref err) => write!(f, "RNG error: {}", err),
- Error::UnexpectedError => write!(f, "An unexpected error occurred"),
- Error::UnknownError(ref err) => write!(f, "Unknown error: {}", err),
- Error::Utf8Error(ref err) => write!(f, "UTF-8 error: {}", err),
- }
- }
-}
-
-/// An error reported by the Nitrokey device in the response packet.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum CommandError {
- /// A packet with a wrong checksum has been sent or received.
- WrongCrc,
- /// A command tried to access an OTP slot that does not exist.
- WrongSlot,
- /// A command tried to generate an OTP on a slot that is not configured.
- SlotNotProgrammed,
- /// The provided password is wrong.
- WrongPassword,
- /// You are not authorized for this command or provided a wrong temporary
- /// password.
- NotAuthorized,
- /// An error occurred when getting or setting the time.
- Timestamp,
- /// You did not provide a name for the OTP slot.
- NoName,
- /// This command is not supported by this device.
- NotSupported,
- /// This command is unknown.
- UnknownCommand,
- /// AES decryption failed.
- AesDecryptionFailed,
-}
-
-impl CommandError {
- fn try_from(value: raw::c_int) -> Option<Self> {
- match value {
- 1 => Some(CommandError::WrongCrc),
- 2 => Some(CommandError::WrongSlot),
- 3 => Some(CommandError::SlotNotProgrammed),
- 4 => Some(CommandError::WrongPassword),
- 5 => Some(CommandError::NotAuthorized),
- 6 => Some(CommandError::Timestamp),
- 7 => Some(CommandError::NoName),
- 8 => Some(CommandError::NotSupported),
- 9 => Some(CommandError::UnknownCommand),
- 10 => Some(CommandError::AesDecryptionFailed),
- _ => None,
- }
- }
-}
-
-impl error::Error for CommandError {}
-
-impl fmt::Display for CommandError {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- f.write_str(match *self {
- CommandError::WrongCrc => "A packet with a wrong checksum has been sent or received",
- CommandError::WrongSlot => "The given slot does not exist",
- CommandError::SlotNotProgrammed => "The given slot is not programmed",
- CommandError::WrongPassword => "The given password is wrong",
- CommandError::NotAuthorized => {
- "You are not authorized for this command or provided a wrong temporary \
- password"
- }
- CommandError::Timestamp => "An error occurred when getting or setting the time",
- CommandError::NoName => "You did not provide a name for the slot",
- CommandError::NotSupported => "This command is not supported by this device",
- CommandError::UnknownCommand => "This command is unknown",
- CommandError::AesDecryptionFailed => "AES decryption failed",
- })
- }
-}
-
-/// A device communication error.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum CommunicationError {
- /// Could not connect to a Nitrokey device.
- NotConnected,
- /// Sending a packet failed.
- SendingFailure,
- /// Receiving a packet failed.
- ReceivingFailure,
- /// A packet with a wrong checksum was received.
- InvalidCrc,
-}
-
-impl CommunicationError {
- fn try_from(value: raw::c_int) -> Option<Self> {
- match value {
- 2 => Some(CommunicationError::NotConnected),
- 3 => Some(CommunicationError::SendingFailure),
- 4 => Some(CommunicationError::ReceivingFailure),
- 5 => Some(CommunicationError::InvalidCrc),
- _ => None,
- }
- }
-}
-
-impl error::Error for CommunicationError {}
-
-impl fmt::Display for CommunicationError {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- f.write_str(match *self {
- CommunicationError::NotConnected => "Could not connect to a Nitrokey device",
- CommunicationError::SendingFailure => "Sending a packet failed",
- CommunicationError::ReceivingFailure => "Receiving a packet failed",
- CommunicationError::InvalidCrc => "A packet with a wrong checksum was received",
- })
- }
-}
-
-/// A library usage error.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum LibraryError {
- /// A supplied string exceeded a length limit.
- StringTooLong,
- /// You passed an invalid slot.
- InvalidSlot,
- /// The supplied string was not in hexadecimal format.
- InvalidHexString,
- /// The target buffer was smaller than the source.
- TargetBufferTooSmall,
- /// You passed a string containing a null byte.
- InvalidString,
-}
-
-impl LibraryError {
- fn try_from(value: raw::c_int) -> Option<Self> {
- match value {
- 200 => Some(LibraryError::StringTooLong),
- 201 => Some(LibraryError::InvalidSlot),
- 202 => Some(LibraryError::InvalidHexString),
- 203 => Some(LibraryError::TargetBufferTooSmall),
- _ => None,
- }
- }
-}
-
-impl error::Error for LibraryError {}
-
-impl fmt::Display for LibraryError {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- f.write_str(match *self {
- LibraryError::StringTooLong => "The supplied string is too long",
- LibraryError::InvalidSlot => "The given slot is invalid",
- LibraryError::InvalidHexString => "The supplied string is not in hexadecimal format",
- LibraryError::TargetBufferTooSmall => "The target buffer is too small",
- LibraryError::InvalidString => "You passed a string containing a null byte",
- })
- }
-}
diff --git a/nitrokey/src/lib.rs b/nitrokey/src/lib.rs
deleted file mode 100644
index 059792d..0000000
--- a/nitrokey/src/lib.rs
+++ /dev/null
@@ -1,465 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-//! Provides access to a Nitrokey device using the native libnitrokey API.
-//!
-//! # Usage
-//!
-//! Operations on the Nitrokey require different authentication levels. Some operations can be
-//! performed without authentication, some require user access, and some require admin access.
-//! This is modelled using the types [`User`][] and [`Admin`][].
-//!
-//! You can only connect to one Nitrokey at a time. Use the global [`take`][] function to obtain
-//! an reference to the [`Manager`][] singleton that keeps track of the connections. Then use the
-//! [`connect`][] method to connect to any Nitrokey device. The method will return a
-//! [`DeviceWrapper`][] that abstracts over the supported Nitrokey devices. You can also use
-//! [`connect_model`][], [`connect_pro`][] or [`connect_storage`][] to connect to a specific
-//! device.
-//!
-//! You can call [`authenticate_user`][] or [`authenticate_admin`][] to get an authenticated device
-//! that can perform operations that require authentication. You can use [`device`][] to go back
-//! to the unauthenticated device.
-//!
-//! This makes sure that you can only execute a command if you have the required access rights.
-//! Otherwise, your code will not compile. The only exception are the methods to generate one-time
-//! passwords – [`get_hotp_code`][] and [`get_totp_code`][]. Depending on the stick configuration,
-//! these operations are available without authentication or with user authentication.
-//!
-//! # Examples
-//!
-//! Connect to any Nitrokey and print its serial number:
-//!
-//! ```no_run
-//! use nitrokey::Device;
-//! # use nitrokey::Error;
-//!
-//! # fn try_main() -> Result<(), Error> {
-//! let mut manager = nitrokey::take()?;
-//! let device = manager.connect()?;
-//! println!("{}", device.get_serial_number()?);
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! Configure an HOTP slot:
-//!
-//! ```no_run
-//! use nitrokey::{Authenticate, ConfigureOtp, OtpMode, OtpSlotData};
-//! # use nitrokey::Error;
-//!
-//! # fn try_main() -> Result<(), Error> {
-//! let mut manager = nitrokey::take()?;
-//! let device = manager.connect()?;
-//! let slot_data = OtpSlotData::new(1, "test", "01234567890123456689", OtpMode::SixDigits);
-//! match device.authenticate_admin("12345678") {
-//! Ok(mut admin) => {
-//! match admin.write_hotp_slot(slot_data, 0) {
-//! Ok(()) => println!("Successfully wrote slot."),
-//! Err(err) => eprintln!("Could not write slot: {}", err),
-//! }
-//! },
-//! Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err),
-//! }
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! Generate an HOTP one-time password:
-//!
-//! ```no_run
-//! use nitrokey::{Device, GenerateOtp};
-//! # use nitrokey::Error;
-//!
-//! # fn try_main() -> Result<(), Error> {
-//! let mut manager = nitrokey::take()?;
-//! let mut device = manager.connect()?;
-//! match device.get_hotp_code(1) {
-//! Ok(code) => println!("Generated HOTP code: {}", code),
-//! Err(err) => eprintln!("Could not generate HOTP code: {}", err),
-//! }
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin
-//! [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user
-//! [`take`]: fn.take.html
-//! [`connect`]: struct.Manager.html#method.connect
-//! [`connect_model`]: struct.Manager.html#method.connect_model
-//! [`connect_pro`]: struct.Manager.html#method.connect_pro
-//! [`connect_storage`]: struct.Manager.html#method.connect_storage
-//! [`manager`]: trait.Device.html#method.manager
-//! [`device`]: struct.User.html#method.device
-//! [`get_hotp_code`]: trait.GenerateOtp.html#method.get_hotp_code
-//! [`get_totp_code`]: trait.GenerateOtp.html#method.get_totp_code
-//! [`Admin`]: struct.Admin.html
-//! [`DeviceWrapper`]: enum.DeviceWrapper.html
-//! [`User`]: struct.User.html
-
-#![warn(missing_docs, rust_2018_compatibility, rust_2018_idioms, unused)]
-
-#[macro_use(lazy_static)]
-extern crate lazy_static;
-
-mod auth;
-mod config;
-mod device;
-mod error;
-mod otp;
-mod pws;
-mod util;
-
-use std::fmt;
-use std::marker;
-use std::sync;
-
-use nitrokey_sys;
-
-pub use crate::auth::{Admin, Authenticate, User};
-pub use crate::config::Config;
-pub use crate::device::{
- Device, DeviceWrapper, Model, Pro, SdCardData, Storage, StorageProductionInfo, StorageStatus,
- VolumeMode, VolumeStatus,
-};
-pub use crate::error::{CommandError, CommunicationError, Error, LibraryError};
-pub use crate::otp::{ConfigureOtp, GenerateOtp, OtpMode, OtpSlotData};
-pub use crate::pws::{GetPasswordSafe, PasswordSafe, SLOT_COUNT};
-pub use crate::util::LogLevel;
-
-/// The default admin PIN for all Nitrokey devices.
-pub const DEFAULT_ADMIN_PIN: &str = "12345678";
-/// The default user PIN for all Nitrokey devices.
-pub const DEFAULT_USER_PIN: &str = "123456";
-
-lazy_static! {
- static ref MANAGER: sync::Mutex<Manager> = sync::Mutex::new(Manager::new());
-}
-
-/// A version of the libnitrokey library.
-///
-/// Use the [`get_library_version`](fn.get_library_version.html) function to query the library
-/// version.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Version {
- /// The Git library version as a string.
- ///
- /// The library version is the output of `git describe --always` at compile time, for example
- /// `v3.3` or `v3.4.1`. If the library has not been built from a release, the version string
- /// contains the number of commits since the last release and the hash of the current commit, for
- /// example `v3.3-19-gaee920b`. If the library has not been built from a Git checkout, this
- /// string may be empty.
- pub git: String,
- /// The major library version.
- pub major: u32,
- /// The minor library version.
- pub minor: u32,
-}
-
-impl fmt::Display for Version {
- fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
- if self.git.is_empty() {
- write!(f, "v{}.{}", self.major, self.minor)
- } else {
- f.write_str(&self.git)
- }
- }
-}
-
-/// A manager for connections to Nitrokey devices.
-///
-/// Currently, libnitrokey only provides access to one Nitrokey device at the same time. This
-/// manager struct makes sure that `nitrokey-rs` does not try to connect to two devices at the same
-/// time.
-///
-/// To obtain a reference to an instance of this manager, use the [`take`][] function. Use one of
-/// the connect methods – [`connect`][], [`connect_model`][], [`connect_pro`][] or
-/// [`connect_storage`][] – to retrieve a [`Device`][] instance.
-///
-/// # Examples
-///
-/// Connect to a single device:
-///
-/// ```no_run
-/// use nitrokey::Device;
-/// # use nitrokey::Error;
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect()?;
-/// println!("{}", device.get_serial_number()?);
-/// # Ok(())
-/// # }
-/// ```
-///
-/// Connect to a Pro and a Storage device:
-///
-/// ```no_run
-/// use nitrokey::{Device, Model};
-/// # use nitrokey::Error;
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect_model(Model::Pro)?;
-/// println!("Pro: {}", device.get_serial_number()?);
-/// drop(device);
-/// let device = manager.connect_model(Model::Storage)?;
-/// println!("Storage: {}", device.get_serial_number()?);
-/// # Ok(())
-/// # }
-/// ```
-///
-/// [`connect`]: #method.connect
-/// [`connect_model`]: #method.connect_model
-/// [`connect_pro`]: #method.connect_pro
-/// [`connect_storage`]: #method.connect_storage
-/// [`manager`]: trait.Device.html#method.manager
-/// [`take`]: fn.take.html
-/// [`Device`]: trait.Device.html
-#[derive(Debug)]
-pub struct Manager {
- marker: marker::PhantomData<()>,
-}
-
-impl Manager {
- fn new() -> Self {
- Manager {
- marker: marker::PhantomData,
- }
- }
-
- /// Connects to a Nitrokey device.
- ///
- /// This method can be used to connect to any connected device, both a Nitrokey Pro and a
- /// Nitrokey Storage.
- ///
- /// # Errors
- ///
- /// - [`NotConnected`][] if no Nitrokey device is connected
- ///
- /// # Example
- ///
- /// ```
- /// use nitrokey::DeviceWrapper;
- ///
- /// fn do_something(device: DeviceWrapper) {}
- ///
- /// let mut manager = nitrokey::take()?;
- /// match manager.connect() {
- /// Ok(device) => do_something(device),
- /// Err(err) => println!("Could not connect to a Nitrokey: {}", err),
- /// }
- /// # Ok::<(), nitrokey::Error>(())
- /// ```
- ///
- /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
- pub fn connect(&mut self) -> Result<DeviceWrapper<'_>, Error> {
- if unsafe { nitrokey_sys::NK_login_auto() } == 1 {
- device::get_connected_device(self)
- } else {
- Err(CommunicationError::NotConnected.into())
- }
- }
-
- /// Connects to a Nitrokey device of the given model.
- ///
- /// # Errors
- ///
- /// - [`NotConnected`][] if no Nitrokey device of the given model is connected
- ///
- /// # Example
- ///
- /// ```
- /// use nitrokey::DeviceWrapper;
- /// use nitrokey::Model;
- ///
- /// fn do_something(device: DeviceWrapper) {}
- ///
- /// match nitrokey::take()?.connect_model(Model::Pro) {
- /// Ok(device) => do_something(device),
- /// Err(err) => println!("Could not connect to a Nitrokey Pro: {}", err),
- /// }
- /// # Ok::<(), nitrokey::Error>(())
- /// ```
- ///
- /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
- pub fn connect_model(&mut self, model: Model) -> Result<DeviceWrapper<'_>, Error> {
- if device::connect_enum(model) {
- Ok(device::create_device_wrapper(self, model))
- } else {
- Err(CommunicationError::NotConnected.into())
- }
- }
-
- /// Connects to a Nitrokey Pro.
- ///
- /// # Errors
- ///
- /// - [`NotConnected`][] if no Nitrokey device of the given model is connected
- ///
- /// # Example
- ///
- /// ```
- /// use nitrokey::Pro;
- ///
- /// fn use_pro(device: Pro) {}
- ///
- /// match nitrokey::take()?.connect_pro() {
- /// Ok(device) => use_pro(device),
- /// Err(err) => println!("Could not connect to the Nitrokey Pro: {}", err),
- /// }
- /// # Ok::<(), nitrokey::Error>(())
- /// ```
- ///
- /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
- pub fn connect_pro(&mut self) -> Result<Pro<'_>, Error> {
- if device::connect_enum(device::Model::Pro) {
- Ok(device::Pro::new(self))
- } else {
- Err(CommunicationError::NotConnected.into())
- }
- }
-
- /// Connects to a Nitrokey Storage.
- ///
- /// # Errors
- ///
- /// - [`NotConnected`][] if no Nitrokey device of the given model is connected
- ///
- /// # Example
- ///
- /// ```
- /// use nitrokey::Storage;
- ///
- /// fn use_storage(device: Storage) {}
- ///
- /// match nitrokey::take()?.connect_storage() {
- /// Ok(device) => use_storage(device),
- /// Err(err) => println!("Could not connect to the Nitrokey Storage: {}", err),
- /// }
- /// # Ok::<(), nitrokey::Error>(())
- /// ```
- ///
- /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
- pub fn connect_storage(&mut self) -> Result<Storage<'_>, Error> {
- if device::connect_enum(Model::Storage) {
- Ok(Storage::new(self))
- } else {
- Err(CommunicationError::NotConnected.into())
- }
- }
-}
-
-/// Take an instance of the connection manager, blocking until an instance is available.
-///
-/// There may only be one [`Manager`][] instance at the same time. If there already is an
-/// instance, this method blocks. If you want a non-blocking version, use [`take`][].
-///
-/// # Errors
-///
-/// - [`PoisonError`][] if the lock is poisoned
-///
-/// [`take`]: fn.take.html
-/// [`PoisonError`]: struct.Error.html#variant.PoisonError
-/// [`Manager`]: struct.Manager.html
-pub fn take_blocking() -> Result<sync::MutexGuard<'static, Manager>, Error> {
- MANAGER.lock().map_err(Into::into)
-}
-
-/// Try to take an instance of the connection manager.
-///
-/// There may only be one [`Manager`][] instance at the same time. If there already is an
-/// instance, a [`ConcurrentAccessError`][] is returned. If you want a blocking version, use
-/// [`take_blocking`][]. If you want to access the manager instance even if the cache is poisoned,
-/// use [`force_take`][].
-///
-/// # Errors
-///
-/// - [`ConcurrentAccessError`][] if the token for the `Manager` instance cannot be locked
-/// - [`PoisonError`][] if the lock is poisoned
-///
-/// [`take_blocking`]: fn.take_blocking.html
-/// [`force_take`]: fn.force_take.html
-/// [`ConcurrentAccessError`]: struct.Error.html#variant.ConcurrentAccessError
-/// [`PoisonError`]: struct.Error.html#variant.PoisonError
-/// [`Manager`]: struct.Manager.html
-pub fn take() -> Result<sync::MutexGuard<'static, Manager>, Error> {
- MANAGER.try_lock().map_err(Into::into)
-}
-
-/// Try to take an instance of the connection manager, ignoring a poisoned cache.
-///
-/// There may only be one [`Manager`][] instance at the same time. If there already is an
-/// instance, a [`ConcurrentAccessError`][] is returned. If you want a blocking version, use
-/// [`take_blocking`][].
-///
-/// If a thread has previously panicked while accessing the manager instance, the cache is
-/// poisoned. The default implementation, [`take`][], returns a [`PoisonError`][] on subsequent
-/// calls. This implementation ignores the poisoned cache and returns the manager instance.
-///
-/// # Errors
-///
-/// - [`ConcurrentAccessError`][] if the token for the `Manager` instance cannot be locked
-///
-/// [`take`]: fn.take.html
-/// [`take_blocking`]: fn.take_blocking.html
-/// [`ConcurrentAccessError`]: struct.Error.html#variant.ConcurrentAccessError
-/// [`Manager`]: struct.Manager.html
-pub fn force_take() -> Result<sync::MutexGuard<'static, Manager>, Error> {
- match take() {
- Ok(guard) => Ok(guard),
- Err(err) => match err {
- Error::PoisonError(err) => Ok(err.into_inner()),
- err => Err(err),
- },
- }
-}
-
-/// Enables or disables debug output. Calling this method with `true` is equivalent to setting the
-/// log level to `Debug`; calling it with `false` is equivalent to the log level `Error` (see
-/// [`set_log_level`][]).
-///
-/// If debug output is enabled, detailed information about the communication with the Nitrokey
-/// device is printed to the standard output.
-///
-/// [`set_log_level`]: fn.set_log_level.html
-pub fn set_debug(state: bool) {
- unsafe {
- nitrokey_sys::NK_set_debug(state);
- }
-}
-
-/// Sets the log level for libnitrokey. All log messages are written to the standard error stream.
-/// Setting the log level enables all log messages on the same or on a higher log level.
-pub fn set_log_level(level: LogLevel) {
- unsafe {
- nitrokey_sys::NK_set_debug_level(level.into());
- }
-}
-
-/// Returns the libnitrokey library version.
-///
-/// # Errors
-///
-/// - [`Utf8Error`][] if libnitrokey returned an invalid UTF-8 string
-///
-/// # Example
-///
-/// ```
-/// let version = nitrokey::get_library_version()?;
-/// println!("Using libnitrokey {}", version.git);
-/// # Ok::<(), nitrokey::Error>(())
-/// ```
-///
-/// [`Utf8Error`]: enum.Error.html#variant.Utf8Error
-pub fn get_library_version() -> Result<Version, Error> {
- // NK_get_library_version returns a static string, so we don’t have to free the pointer.
- let git = unsafe { nitrokey_sys::NK_get_library_version() };
- let git = if git.is_null() {
- String::new()
- } else {
- util::owned_str_from_ptr(git)?
- };
- let major = unsafe { nitrokey_sys::NK_get_major_library_version() };
- let minor = unsafe { nitrokey_sys::NK_get_minor_library_version() };
- Ok(Version { git, major, minor })
-}
diff --git a/nitrokey/src/otp.rs b/nitrokey/src/otp.rs
deleted file mode 100644
index 4667aff..0000000
--- a/nitrokey/src/otp.rs
+++ /dev/null
@@ -1,423 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use std::ffi::CString;
-
-use nitrokey_sys;
-
-use crate::error::Error;
-use crate::util::{get_command_result, get_cstring, result_from_string};
-
-/// Modes for one-time password generation.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum OtpMode {
- /// Generate one-time passwords with six digits.
- SixDigits,
- /// Generate one-time passwords with eight digits.
- EightDigits,
-}
-
-/// Provides methods to configure and erase OTP slots on a Nitrokey device.
-pub trait ConfigureOtp {
- /// Configure an HOTP slot with the given data and set the HOTP counter to the given value
- /// (default 0).
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- /// - [`InvalidString`][] if the provided token ID contains a null byte
- /// - [`NoName`][] if the provided name is empty
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Authenticate, ConfigureOtp, OtpMode, OtpSlotData};
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let slot_data = OtpSlotData::new(1, "test", "01234567890123456689", OtpMode::SixDigits);
- /// match device.authenticate_admin("12345678") {
- /// Ok(mut admin) => {
- /// match admin.write_hotp_slot(slot_data, 0) {
- /// Ok(()) => println!("Successfully wrote slot."),
- /// Err(err) => eprintln!("Could not write slot: {}", err),
- /// }
- /// },
- /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`NoName`]: enum.CommandError.html#variant.NoName
- fn write_hotp_slot(&mut self, data: OtpSlotData, counter: u64) -> Result<(), Error>;
-
- /// Configure a TOTP slot with the given data and set the TOTP time window to the given value
- /// (default 30).
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- /// - [`InvalidString`][] if the provided token ID contains a null byte
- /// - [`NoName`][] if the provided name is empty
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Authenticate, ConfigureOtp, OtpMode, OtpSlotData};
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// let slot_data = OtpSlotData::new(1, "test", "01234567890123456689", OtpMode::EightDigits);
- /// match device.authenticate_admin("12345678") {
- /// Ok(mut admin) => {
- /// match admin.write_totp_slot(slot_data, 30) {
- /// Ok(()) => println!("Successfully wrote slot."),
- /// Err(err) => eprintln!("Could not write slot: {}", err),
- /// }
- /// },
- /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`NoName`]: enum.CommandError.html#variant.NoName
- fn write_totp_slot(&mut self, data: OtpSlotData, time_window: u16) -> Result<(), Error>;
-
- /// Erases an HOTP slot.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Authenticate, ConfigureOtp};
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// match device.authenticate_admin("12345678") {
- /// Ok(mut admin) => {
- /// match admin.erase_hotp_slot(1) {
- /// Ok(()) => println!("Successfully erased slot."),
- /// Err(err) => eprintln!("Could not erase slot: {}", err),
- /// }
- /// },
- /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- fn erase_hotp_slot(&mut self, slot: u8) -> Result<(), Error>;
-
- /// Erases a TOTP slot.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Authenticate, ConfigureOtp};
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// match device.authenticate_admin("12345678") {
- /// Ok(mut admin) => {
- /// match admin.erase_totp_slot(1) {
- /// Ok(()) => println!("Successfully erased slot."),
- /// Err(err) => eprintln!("Could not erase slot: {}", err),
- /// }
- /// },
- /// Err((_, err)) => eprintln!("Could not authenticate as admin: {}", err),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- fn erase_totp_slot(&mut self, slot: u8) -> Result<(), Error>;
-}
-
-/// Provides methods to generate OTP codes and to query OTP slots on a Nitrokey
-/// device.
-pub trait GenerateOtp {
- /// Sets the time on the Nitrokey.
- ///
- /// `time` is the number of seconds since January 1st, 1970 (Unix timestamp). Unless `force`
- /// is set to `true`, this command fails if the timestamp on the device is larger than the
- /// given timestamp or if it is zero.
- ///
- /// The time is used for TOTP generation (see [`get_totp_code`][]).
- ///
- /// # Example
- ///
- /// ```no_run
- /// use std::time;
- /// use nitrokey::GenerateOtp;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let time = time::SystemTime::now().duration_since(time::UNIX_EPOCH);
- /// match time {
- /// Ok(time) => device.set_time(time.as_secs(), false)?,
- /// Err(_) => eprintln!("The system time is before the Unix epoch!"),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// # Errors
- ///
- /// - [`Timestamp`][] if the time could not be set
- ///
- /// [`get_totp_code`]: #method.get_totp_code
- /// [`Timestamp`]: enum.CommandError.html#variant.Timestamp
- fn set_time(&mut self, time: u64, force: bool) -> Result<(), Error> {
- let result = if force {
- unsafe { nitrokey_sys::NK_totp_set_time(time) }
- } else {
- unsafe { nitrokey_sys::NK_totp_set_time_soft(time) }
- };
- get_command_result(result)
- }
-
- /// Returns the name of the given HOTP slot.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- /// - [`SlotNotProgrammed`][] if the given slot is not configured
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{CommandError, Error, GenerateOtp};
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// match device.get_hotp_slot_name(1) {
- /// Ok(name) => println!("HOTP slot 1: {}", name),
- /// Err(Error::CommandError(CommandError::SlotNotProgrammed)) => eprintln!("HOTP slot 1 not programmed"),
- /// Err(err) => eprintln!("Could not get slot name: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed
- fn get_hotp_slot_name(&self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_get_hotp_slot_name(slot) })
- }
-
- /// Returns the name of the given TOTP slot.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- /// - [`SlotNotProgrammed`][] if the given slot is not configured
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{CommandError, Error, GenerateOtp};
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let device = manager.connect()?;
- /// match device.get_totp_slot_name(1) {
- /// Ok(name) => println!("TOTP slot 1: {}", name),
- /// Err(Error::CommandError(CommandError::SlotNotProgrammed)) => eprintln!("TOTP slot 1 not programmed"),
- /// Err(err) => eprintln!("Could not get slot name: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed
- fn get_totp_slot_name(&self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_get_totp_slot_name(slot) })
- }
-
- /// Generates an HOTP code on the given slot. This operation may require user authorization,
- /// depending on the device configuration (see [`get_config`][]).
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- /// - [`NotAuthorized`][] if OTP generation requires user authentication
- /// - [`SlotNotProgrammed`][] if the given slot is not configured
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::GenerateOtp;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let code = device.get_hotp_code(1)?;
- /// println!("Generated HOTP code on slot 1: {}", code);
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`get_config`]: trait.Device.html#method.get_config
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`NotAuthorized`]: enum.CommandError.html#variant.NotAuthorized
- /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed
- fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_get_hotp_code(slot) })
- }
-
- /// Generates a TOTP code on the given slot. This operation may require user authorization,
- /// depending on the device configuration (see [`get_config`][]).
- ///
- /// To make sure that the Nitrokey’s time is in sync, consider calling [`set_time`][] before
- /// calling this method.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if there is no slot with the given number
- /// - [`NotAuthorized`][] if OTP generation requires user authentication
- /// - [`SlotNotProgrammed`][] if the given slot is not configured
- ///
- /// # Example
- ///
- /// ```no_run
- /// use std::time;
- /// use nitrokey::GenerateOtp;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let time = time::SystemTime::now().duration_since(time::UNIX_EPOCH);
- /// match time {
- /// Ok(time) => {
- /// device.set_time(time.as_secs(), false)?;
- /// let code = device.get_totp_code(1)?;
- /// println!("Generated TOTP code on slot 1: {}", code);
- /// },
- /// Err(_) => eprintln!("Timestamps before 1970-01-01 are not supported!"),
- /// }
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`set_time`]: #method.set_time
- /// [`get_config`]: trait.Device.html#method.get_config
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`NotAuthorized`]: enum.CommandError.html#variant.NotAuthorized
- /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed
- fn get_totp_code(&self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_get_totp_code(slot, 0, 0, 0) })
- }
-}
-
-/// The configuration for an OTP slot.
-#[derive(Debug)]
-pub struct OtpSlotData {
- /// The number of the slot – must be less than three for HOTP and less than 15 for TOTP.
- pub number: u8,
- /// The name of the slot – must not be empty.
- pub name: String,
- /// The secret for the slot.
- pub secret: String,
- /// The OTP generation mode.
- pub mode: OtpMode,
- /// If true, press the enter key after sending an OTP code using double-pressed
- /// numlock, capslock or scrolllock.
- pub use_enter: bool,
- /// Set the token ID, see [OATH Token Identifier Specification][tokspec], section “Class A”.
- ///
- /// [tokspec]: https://openauthentication.org/token-specs/
- pub token_id: Option<String>,
-}
-
-#[derive(Debug)]
-pub struct RawOtpSlotData {
- pub number: u8,
- pub name: CString,
- pub secret: CString,
- pub mode: OtpMode,
- pub use_enter: bool,
- pub use_token_id: bool,
- pub token_id: CString,
-}
-
-impl OtpSlotData {
- /// Constructs a new instance of this struct.
- pub fn new<S: Into<String>, T: Into<String>>(
- number: u8,
- name: S,
- secret: T,
- mode: OtpMode,
- ) -> OtpSlotData {
- OtpSlotData {
- number,
- name: name.into(),
- secret: secret.into(),
- mode,
- use_enter: false,
- token_id: None,
- }
- }
-
- /// Enables pressing the enter key after sending an OTP code using double-pressed numlock,
- /// capslock or scrollock.
- pub fn use_enter(mut self) -> OtpSlotData {
- self.use_enter = true;
- self
- }
-
- /// Sets the token ID, see [OATH Token Identifier Specification][tokspec], section “Class A”.
- ///
- /// [tokspec]: https://openauthentication.org/token-specs/
- pub fn token_id<S: Into<String>>(mut self, id: S) -> OtpSlotData {
- self.token_id = Some(id.into());
- self
- }
-}
-
-impl RawOtpSlotData {
- pub fn new(data: OtpSlotData) -> Result<RawOtpSlotData, Error> {
- let name = get_cstring(data.name)?;
- let secret = get_cstring(data.secret)?;
- let use_token_id = data.token_id.is_some();
- let token_id = get_cstring(data.token_id.unwrap_or_else(String::new))?;
-
- Ok(RawOtpSlotData {
- number: data.number,
- name,
- secret,
- mode: data.mode,
- use_enter: data.use_enter,
- use_token_id,
- token_id,
- })
- }
-}
diff --git a/nitrokey/src/pws.rs b/nitrokey/src/pws.rs
deleted file mode 100644
index 3398deb..0000000
--- a/nitrokey/src/pws.rs
+++ /dev/null
@@ -1,391 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use libc;
-use nitrokey_sys;
-
-use crate::device::{Device, DeviceWrapper, Pro, Storage};
-use crate::error::{CommandError, Error};
-use crate::util::{get_command_result, get_cstring, get_last_error, result_from_string};
-
-/// The number of slots in a [`PasswordSafe`][].
-///
-/// [`PasswordSafe`]: struct.PasswordSafe.html
-pub const SLOT_COUNT: u8 = 16;
-
-/// A password safe on a Nitrokey device.
-///
-/// The password safe stores a tuple consisting of a name, a login and a password on a slot. The
-/// number of available slots is [`SLOT_COUNT`][]. The slots are addressed starting with zero. To
-/// retrieve a password safe from a Nitrokey device, use the [`get_password_safe`][] method from
-/// the [`GetPasswordSafe`][] trait. Note that the device must live at least as long as the
-/// password safe.
-///
-/// Once the password safe has been unlocked, it can be accessed without a password. Therefore it
-/// is mandatory to call [`lock`][] on the corresponding device after the password store is used.
-/// As this command may have side effects on the Nitrokey Storage, it cannot be called
-/// automatically once the password safe is destroyed.
-///
-/// # Examples
-///
-/// Open a password safe and access a password:
-///
-/// ```no_run
-/// use nitrokey::{Device, GetPasswordSafe, PasswordSafe};
-/// # use nitrokey::Error;
-///
-/// fn use_password_safe(pws: &PasswordSafe) -> Result<(), Error> {
-/// let name = pws.get_slot_name(0)?;
-/// let login = pws.get_slot_login(0)?;
-/// let password = pws.get_slot_login(0)?;
-/// println!("Credentials for {}: login {}, password {}", name, login, password);
-/// Ok(())
-/// }
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let mut device = manager.connect()?;
-/// let pws = device.get_password_safe("123456")?;
-/// use_password_safe(&pws);
-/// drop(pws);
-/// device.lock()?;
-/// # Ok(())
-/// # }
-/// ```
-///
-/// [`SLOT_COUNT`]: constant.SLOT_COUNT.html
-/// [`get_password_safe`]: trait.GetPasswordSafe.html#method.get_password_safe
-/// [`lock`]: trait.Device.html#method.lock
-/// [`GetPasswordSafe`]: trait.GetPasswordSafe.html
-#[derive(Debug)]
-pub struct PasswordSafe<'a, 'b> {
- _device: &'a dyn Device<'b>,
-}
-
-/// Provides access to a [`PasswordSafe`][].
-///
-/// The device that implements this trait must always live at least as long as a password safe
-/// retrieved from it.
-///
-/// [`PasswordSafe`]: struct.PasswordSafe.html
-pub trait GetPasswordSafe<'a> {
- /// Enables and returns the password safe.
- ///
- /// The underlying device must always live at least as long as a password safe retrieved from
- /// it. It is mandatory to lock the underlying device using [`lock`][] after the password safe
- /// has been used. Otherwise, other applications can access the password store without
- /// authentication.
- ///
- /// If this method returns an `AesDecryptionFailed` (Nitrokey Pro) or `Unknown` (Nitrokey
- /// Storage) error, the AES data object on the smart card could not be accessed. This problem
- /// occurs after a factory reset using `gpg --card-edit` and can be fixed using the
- /// [`Device::build_aes_key`][] command.
- ///
- /// # Errors
- ///
- /// - [`AesDecryptionFailed`][] if the secret for the password safe could not be decrypted
- /// (Nitrokey Pro only)
- /// - [`InvalidString`][] if one of the provided passwords contains a null byte
- /// - [`Unknown`][] if the secret for the password safe could not be decrypted (Nitrokey
- /// Storage only)
- /// - [`WrongPassword`][] if the current user password is wrong
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{Device, GetPasswordSafe, PasswordSafe};
- /// # use nitrokey::Error;
- ///
- /// fn use_password_safe(pws: &PasswordSafe) {}
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.get_password_safe("123456") {
- /// Ok(pws) => {
- /// use_password_safe(&pws);
- /// },
- /// Err(err) => eprintln!("Could not open the password safe: {}", err),
- /// };
- /// device.lock()?;
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`device`]: struct.PasswordSafe.html#method.device
- /// [`lock`]: trait.Device.html#method.lock
- /// [`AesDecryptionFailed`]: enum.CommandError.html#variant.AesDecryptionFailed
- /// [`Device::build_aes_key`]: trait.Device.html#method.build_aes_key
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- /// [`Unknown`]: enum.CommandError.html#variant.Unknown
- /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
- fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error>;
-}
-
-fn get_password_safe<'a, 'b>(
- device: &'a dyn Device<'b>,
- user_pin: &str,
-) -> Result<PasswordSafe<'a, 'b>, Error> {
- let user_pin_string = get_cstring(user_pin)?;
- get_command_result(unsafe { nitrokey_sys::NK_enable_password_safe(user_pin_string.as_ptr()) })
- .map(|_| PasswordSafe { _device: device })
-}
-
-fn get_pws_result(s: String) -> Result<String, Error> {
- if s.is_empty() {
- Err(CommandError::SlotNotProgrammed.into())
- } else {
- Ok(s)
- }
-}
-
-impl<'a, 'b> PasswordSafe<'a, 'b> {
- /// Returns the status of all password slots.
- ///
- /// The status indicates whether a slot is programmed or not.
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::{GetPasswordSafe, SLOT_COUNT};
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let pws = device.get_password_safe("123456")?;
- /// pws.get_slot_status()?.iter().enumerate().for_each(|(slot, programmed)| {
- /// let status = match *programmed {
- /// true => "programmed",
- /// false => "not programmed",
- /// };
- /// println!("Slot {}: {}", slot, status);
- /// });
- /// # Ok(())
- /// # }
- /// ```
- pub fn get_slot_status(&self) -> Result<[bool; SLOT_COUNT as usize], Error> {
- let status_ptr = unsafe { nitrokey_sys::NK_get_password_safe_slot_status() };
- if status_ptr.is_null() {
- return Err(get_last_error());
- }
- let status_array_ptr = status_ptr as *const [u8; SLOT_COUNT as usize];
- let status_array = unsafe { *status_array_ptr };
- let mut result = [false; SLOT_COUNT as usize];
- for i in 0..SLOT_COUNT {
- result[i as usize] = status_array[i as usize] == 1;
- }
- unsafe {
- libc::free(status_ptr as *mut libc::c_void);
- }
- Ok(result)
- }
-
- /// Returns the name of the given slot (if it is programmed).
- ///
- /// This method also returns a `SlotNotProgrammed` error if the name is empty.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if the given slot is out of range
- /// - [`SlotNotProgrammed`][] if the slot is not programmed
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::GetPasswordSafe;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// match device.get_password_safe("123456") {
- /// Ok(pws) => {
- /// let name = pws.get_slot_name(0)?;
- /// let login = pws.get_slot_login(0)?;
- /// let password = pws.get_slot_login(0)?;
- /// println!("Credentials for {}: login {}, password {}", name, login, password);
- /// },
- /// Err(err) => eprintln!("Could not open the password safe: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed
- pub fn get_slot_name(&self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_get_password_safe_slot_name(slot) })
- .and_then(get_pws_result)
- }
-
- /// Returns the login for the given slot (if it is programmed).
- ///
- /// This method also returns a `SlotNotProgrammed` error if the login is empty.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if the given slot is out of range
- /// - [`SlotNotProgrammed`][] if the slot is not programmed
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::GetPasswordSafe;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let pws = device.get_password_safe("123456")?;
- /// let name = pws.get_slot_name(0)?;
- /// let login = pws.get_slot_login(0)?;
- /// let password = pws.get_slot_login(0)?;
- /// println!("Credentials for {}: login {}, password {}", name, login, password);
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed
- pub fn get_slot_login(&self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_get_password_safe_slot_login(slot) })
- .and_then(get_pws_result)
- }
-
- /// Returns the password for the given slot (if it is programmed).
- ///
- /// This method also returns a `SlotNotProgrammed` error if the password is empty.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if the given slot is out of range
- /// - [`SlotNotProgrammed`][] if the slot is not programmed
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::GetPasswordSafe;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let pws = device.get_password_safe("123456")?;
- /// let name = pws.get_slot_name(0)?;
- /// let login = pws.get_slot_login(0)?;
- /// let password = pws.get_slot_login(0)?;
- /// println!("Credentials for {}: login {}, password {}", name, login, password);
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed
- pub fn get_slot_password(&self, slot: u8) -> Result<String, Error> {
- result_from_string(unsafe { nitrokey_sys::NK_get_password_safe_slot_password(slot) })
- .and_then(get_pws_result)
- }
-
- /// Writes the given slot with the given name, login and password.
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if the given slot is out of range
- /// - [`InvalidString`][] if the provided token ID contains a null byte
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::GetPasswordSafe;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let pws = device.get_password_safe("123456")?;
- /// let name = pws.get_slot_name(0)?;
- /// let login = pws.get_slot_login(0)?;
- /// let password = pws.get_slot_login(0)?;
- /// println!("Credentials for {}: login {}, password {}", name, login, password);
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
- pub fn write_slot(
- &mut self,
- slot: u8,
- name: &str,
- login: &str,
- password: &str,
- ) -> Result<(), Error> {
- let name_string = get_cstring(name)?;
- let login_string = get_cstring(login)?;
- let password_string = get_cstring(password)?;
- get_command_result(unsafe {
- nitrokey_sys::NK_write_password_safe_slot(
- slot,
- name_string.as_ptr(),
- login_string.as_ptr(),
- password_string.as_ptr(),
- )
- })
- }
-
- /// Erases the given slot. Erasing clears the stored name, login and password (if the slot was
- /// programmed).
- ///
- /// # Errors
- ///
- /// - [`InvalidSlot`][] if the given slot is out of range
- ///
- /// # Example
- ///
- /// ```no_run
- /// use nitrokey::GetPasswordSafe;
- /// # use nitrokey::Error;
- ///
- /// # fn try_main() -> Result<(), Error> {
- /// let mut manager = nitrokey::take()?;
- /// let mut device = manager.connect()?;
- /// let mut pws = device.get_password_safe("123456")?;
- /// match pws.erase_slot(0) {
- /// Ok(()) => println!("Erased slot 0."),
- /// Err(err) => eprintln!("Could not erase slot 0: {}", err),
- /// };
- /// # Ok(())
- /// # }
- /// ```
- ///
- /// [`InvalidSlot`]: enum.LibraryError.html#variant.InvalidSlot
- pub fn erase_slot(&mut self, slot: u8) -> Result<(), Error> {
- get_command_result(unsafe { nitrokey_sys::NK_erase_password_safe_slot(slot) })
- }
-}
-
-impl<'a, 'b> Drop for PasswordSafe<'a, 'b> {
- fn drop(&mut self) {
- // TODO: disable the password safe -- NK_lock_device has side effects on the Nitrokey
- // Storage, see https://github.com/Nitrokey/nitrokey-storage-firmware/issues/65
- }
-}
-
-impl<'a> GetPasswordSafe<'a> for Pro<'a> {
- fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error> {
- get_password_safe(self, user_pin)
- }
-}
-
-impl<'a> GetPasswordSafe<'a> for Storage<'a> {
- fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error> {
- get_password_safe(self, user_pin)
- }
-}
-
-impl<'a> GetPasswordSafe<'a> for DeviceWrapper<'a> {
- fn get_password_safe(&mut self, user_pin: &str) -> Result<PasswordSafe<'_, 'a>, Error> {
- get_password_safe(self, user_pin)
- }
-}
diff --git a/nitrokey/src/util.rs b/nitrokey/src/util.rs
deleted file mode 100644
index 5a56c55..0000000
--- a/nitrokey/src/util.rs
+++ /dev/null
@@ -1,99 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-use std::ffi::{CStr, CString};
-use std::os::raw::{c_char, c_int};
-
-use libc::{c_void, free};
-use rand_core::{OsRng, RngCore};
-
-use crate::error::{Error, LibraryError};
-
-/// Log level for libnitrokey.
-///
-/// Setting the log level to a lower level enables all output from higher levels too. Currently,
-/// only the log levels `Warning`, `DebugL1`, `Debug` and `DebugL2` are actually used.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum LogLevel {
- /// Error messages. Currently not used.
- Error,
- /// Warning messages.
- Warning,
- /// Informational messages. Currently not used.
- Info,
- /// Basic debug messages, especially basic information on the sent and received packets.
- DebugL1,
- /// Detailed debug messages, especially detailed information on the sent and received packets.
- Debug,
- /// Very detailed debug messages, especially detailed information about the control flow for
- /// device communication (for example function entries and exits).
- DebugL2,
-}
-
-pub fn owned_str_from_ptr(ptr: *const c_char) -> Result<String, Error> {
- unsafe { CStr::from_ptr(ptr) }
- .to_str()
- .map(String::from)
- .map_err(Error::from)
-}
-
-pub fn result_from_string(ptr: *const c_char) -> Result<String, Error> {
- if ptr.is_null() {
- return Err(Error::UnexpectedError);
- }
- let s = owned_str_from_ptr(ptr)?;
- unsafe { free(ptr as *mut c_void) };
- // An empty string can both indicate an error or be a valid return value. In this case, we
- // have to check the last command status to decide what to return.
- if s.is_empty() {
- get_last_result().map(|_| s)
- } else {
- Ok(s)
- }
-}
-
-pub fn result_or_error<T>(value: T) -> Result<T, Error> {
- get_last_result().and(Ok(value))
-}
-
-pub fn get_command_result(value: c_int) -> Result<(), Error> {
- if value == 0 {
- Ok(())
- } else {
- Err(Error::from(value))
- }
-}
-
-pub fn get_last_result() -> Result<(), Error> {
- get_command_result(unsafe { nitrokey_sys::NK_get_last_command_status() }.into())
-}
-
-pub fn get_last_error() -> Error {
- match get_last_result() {
- Ok(()) => Error::UnexpectedError,
- Err(err) => err,
- }
-}
-
-pub fn generate_password(length: usize) -> Result<Vec<u8>, Error> {
- let mut data = vec![0u8; length];
- OsRng.fill_bytes(&mut data[..]);
- Ok(data)
-}
-
-pub fn get_cstring<T: Into<Vec<u8>>>(s: T) -> Result<CString, Error> {
- CString::new(s).or_else(|_| Err(LibraryError::InvalidString.into()))
-}
-
-impl Into<i32> for LogLevel {
- fn into(self) -> i32 {
- match self {
- LogLevel::Error => 0,
- LogLevel::Warning => 1,
- LogLevel::Info => 2,
- LogLevel::DebugL1 => 3,
- LogLevel::Debug => 4,
- LogLevel::DebugL2 => 5,
- }
- }
-}
diff --git a/nitrokey/tests/device.rs b/nitrokey/tests/device.rs
deleted file mode 100644
index e367558..0000000
--- a/nitrokey/tests/device.rs
+++ /dev/null
@@ -1,575 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-mod util;
-
-use std::ffi::CStr;
-use std::process::Command;
-use std::{thread, time};
-
-use nitrokey::{
- Authenticate, CommandError, CommunicationError, Config, ConfigureOtp, Device, Error,
- GenerateOtp, GetPasswordSafe, LibraryError, OtpMode, OtpSlotData, Storage, VolumeMode,
- DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN,
-};
-use nitrokey_test::test as test_device;
-
-static ADMIN_NEW_PASSWORD: &str = "1234567890";
-static UPDATE_PIN: &str = "12345678";
-static UPDATE_NEW_PIN: &str = "87654321";
-static USER_NEW_PASSWORD: &str = "abcdefghij";
-
-fn count_nitrokey_block_devices() -> usize {
- thread::sleep(time::Duration::from_secs(2));
- let output = Command::new("lsblk")
- .args(&["-o", "MODEL"])
- .output()
- .expect("Could not list block devices");
- String::from_utf8_lossy(&output.stdout)
- .split("\n")
- .filter(|&s| s.replace("_", " ") == "Nitrokey Storage")
- .count()
-}
-
-#[test_device]
-fn connect_no_device() {
- let mut manager = unwrap_ok!(nitrokey::take());
-
- assert_cmu_err!(CommunicationError::NotConnected, manager.connect());
- assert_cmu_err!(
- CommunicationError::NotConnected,
- manager.connect_model(nitrokey::Model::Pro)
- );
- assert_cmu_err!(
- CommunicationError::NotConnected,
- manager.connect_model(nitrokey::Model::Storage)
- );
- assert_cmu_err!(CommunicationError::NotConnected, manager.connect_pro());
- assert_cmu_err!(CommunicationError::NotConnected, manager.connect_storage());
-}
-
-#[test_device]
-fn connect_pro(device: Pro) {
- assert_eq!(device.get_model(), nitrokey::Model::Pro);
-
- let manager = device.into_manager();
- assert_any_ok!(manager.connect());
- assert_any_ok!(manager.connect_model(nitrokey::Model::Pro));
- assert_any_ok!(manager.connect_pro());
-}
-
-#[test_device]
-fn connect_storage(device: Storage) {
- assert_eq!(device.get_model(), nitrokey::Model::Storage);
-
- let manager = device.into_manager();
- assert_any_ok!(manager.connect());
- assert_any_ok!(manager.connect_model(nitrokey::Model::Storage));
- assert_any_ok!(manager.connect_storage());
-}
-
-fn assert_empty_serial_number() {
- unsafe {
- let ptr = nitrokey_sys::NK_device_serial_number();
- assert!(!ptr.is_null());
- let cstr = CStr::from_ptr(ptr);
- assert_eq!(cstr.to_string_lossy(), "");
- }
-}
-
-#[test_device]
-fn disconnect(device: DeviceWrapper) {
- drop(device);
- assert_empty_serial_number();
-}
-
-#[test_device]
-fn get_serial_number(device: DeviceWrapper) {
- let serial_number = unwrap_ok!(device.get_serial_number());
- assert!(serial_number.is_ascii());
- assert!(serial_number.chars().all(|c| c.is_ascii_hexdigit()));
-}
-#[test_device]
-fn get_firmware_version(device: Pro) {
- let version = unwrap_ok!(device.get_firmware_version());
- assert_eq!(0, version.major);
- assert!(version.minor > 0);
-}
-
-fn admin_retry<'a, T>(device: T, suffix: &str, count: u8) -> T
-where
- T: Authenticate<'a> + Device<'a> + 'a,
-{
- let result = device.authenticate_admin(&(DEFAULT_ADMIN_PIN.to_owned() + suffix));
- let device = match result {
- Ok(admin) => admin.device(),
- Err((device, _)) => device,
- };
- assert_ok!(count, device.get_admin_retry_count());
- return device;
-}
-
-fn user_retry<'a, T>(device: T, suffix: &str, count: u8) -> T
-where
- T: Authenticate<'a> + Device<'a> + 'a,
-{
- let result = device.authenticate_user(&(DEFAULT_USER_PIN.to_owned() + suffix));
- let device = match result {
- Ok(admin) => admin.device(),
- Err((device, _)) => device,
- };
- assert_ok!(count, device.get_user_retry_count());
- return device;
-}
-
-#[test_device]
-fn get_retry_count(device: DeviceWrapper) {
- let device = admin_retry(device, "", 3);
- let device = admin_retry(device, "123", 2);
- let device = admin_retry(device, "456", 1);
- let device = admin_retry(device, "", 3);
-
- let device = user_retry(device, "", 3);
- let device = user_retry(device, "123", 2);
- let device = user_retry(device, "456", 1);
- user_retry(device, "", 3);
-}
-
-#[test_device]
-fn config(device: DeviceWrapper) {
- let mut admin = unwrap_ok!(device.authenticate_admin(DEFAULT_ADMIN_PIN));
-
- let config = Config::new(None, None, None, true);
- assert_ok!((), admin.write_config(config));
- assert_ok!(config, admin.get_config());
-
- let config = Config::new(None, Some(9), None, true);
- assert_lib_err!(LibraryError::InvalidSlot, admin.write_config(config));
-
- let config = Config::new(Some(1), None, Some(0), false);
- assert_ok!((), admin.write_config(config));
- assert_ok!(config, admin.get_config());
-
- let config = Config::new(None, None, None, false);
- assert_ok!((), admin.write_config(config));
- assert_ok!(config, admin.get_config());
-}
-
-#[test_device]
-fn change_user_pin(device: DeviceWrapper) {
- let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device();
- let device = device.authenticate_user(USER_NEW_PASSWORD).unwrap_err().0;
-
- let mut device = device;
- assert_ok!(
- (),
- device.change_user_pin(DEFAULT_USER_PIN, USER_NEW_PASSWORD)
- );
-
- let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap_err().0;
- let device = device
- .authenticate_user(USER_NEW_PASSWORD)
- .unwrap()
- .device();
-
- let mut device = device;
- let result = device.change_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN);
- assert_cmd_err!(CommandError::WrongPassword, result);
-
- assert_ok!(
- (),
- device.change_user_pin(USER_NEW_PASSWORD, DEFAULT_USER_PIN)
- );
-
- let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device();
- assert!(device.authenticate_user(USER_NEW_PASSWORD).is_err());
-}
-
-#[test_device]
-fn change_admin_pin(device: DeviceWrapper) {
- let device = device
- .authenticate_admin(DEFAULT_ADMIN_PIN)
- .unwrap()
- .device();
- let mut device = device.authenticate_admin(ADMIN_NEW_PASSWORD).unwrap_err().0;
-
- assert_ok!(
- (),
- device.change_admin_pin(DEFAULT_ADMIN_PIN, ADMIN_NEW_PASSWORD)
- );
-
- let device = device.authenticate_admin(DEFAULT_ADMIN_PIN).unwrap_err().0;
- let mut device = device
- .authenticate_admin(ADMIN_NEW_PASSWORD)
- .unwrap()
- .device();
-
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.change_admin_pin(DEFAULT_ADMIN_PIN, DEFAULT_ADMIN_PIN)
- );
-
- assert_ok!(
- (),
- device.change_admin_pin(ADMIN_NEW_PASSWORD, DEFAULT_ADMIN_PIN)
- );
-
- let device = device
- .authenticate_admin(DEFAULT_ADMIN_PIN)
- .unwrap()
- .device();
- device.authenticate_admin(ADMIN_NEW_PASSWORD).unwrap_err();
-}
-
-fn require_failed_user_login<'a, D>(device: D, password: &str, error: CommandError) -> D
-where
- D: Device<'a> + Authenticate<'a> + 'a,
- nitrokey::User<'a, D>: std::fmt::Debug,
-{
- let result = device.authenticate_user(password);
- assert!(result.is_err());
- let err = result.unwrap_err();
- match err.1 {
- Error::CommandError(err) => assert_eq!(error, err),
- _ => assert!(false),
- };
- err.0
-}
-
-#[test_device]
-fn unlock_user_pin(device: DeviceWrapper) {
- let mut device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device();
- assert_ok!(
- (),
- device.unlock_user_pin(DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN)
- );
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.unlock_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN)
- );
-
- // block user PIN
- let wrong_password = DEFAULT_USER_PIN.to_owned() + "foo";
- let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword);
- let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword);
- let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword);
- let mut device =
- require_failed_user_login(device, DEFAULT_USER_PIN, CommandError::WrongPassword);
-
- // unblock with current PIN
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.unlock_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN)
- );
- assert_ok!(
- (),
- device.unlock_user_pin(DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN)
- );
- let device = device.authenticate_user(DEFAULT_USER_PIN).unwrap().device();
-
- // block user PIN
- let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword);
- let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword);
- let device = require_failed_user_login(device, &wrong_password, CommandError::WrongPassword);
- let mut device =
- require_failed_user_login(device, DEFAULT_USER_PIN, CommandError::WrongPassword);
-
- // unblock with new PIN
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.unlock_user_pin(DEFAULT_USER_PIN, DEFAULT_USER_PIN)
- );
- assert_ok!(
- (),
- device.unlock_user_pin(DEFAULT_ADMIN_PIN, USER_NEW_PASSWORD)
- );
-
- // reset user PIN
- assert_ok!(
- (),
- device.change_user_pin(USER_NEW_PASSWORD, DEFAULT_USER_PIN)
- );
-}
-
-fn assert_utf8_err_or_ne(left: &str, right: Result<String, Error>) {
- match right {
- Ok(s) => assert_ne!(left.to_string(), s),
- Err(Error::Utf8Error(_)) => {}
- Err(err) => panic!("Expected Utf8Error, got {}!", err),
- }
-}
-
-#[test_device]
-fn factory_reset(device: DeviceWrapper) {
- let mut admin = unwrap_ok!(device.authenticate_admin(DEFAULT_ADMIN_PIN));
- let otp_data = OtpSlotData::new(1, "test", "0123468790", OtpMode::SixDigits);
- assert_ok!((), admin.write_totp_slot(otp_data, 30));
-
- let mut device = admin.device();
- let mut pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN));
- assert_ok!((), pws.write_slot(0, "test", "testlogin", "testpw"));
- drop(pws);
-
- assert_ok!(
- (),
- device.change_user_pin(DEFAULT_USER_PIN, USER_NEW_PASSWORD)
- );
- assert_ok!(
- (),
- device.change_admin_pin(DEFAULT_ADMIN_PIN, ADMIN_NEW_PASSWORD)
- );
-
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.factory_reset(USER_NEW_PASSWORD)
- );
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.factory_reset(DEFAULT_ADMIN_PIN)
- );
- assert_ok!((), device.factory_reset(ADMIN_NEW_PASSWORD));
-
- let device = device
- .authenticate_admin(DEFAULT_ADMIN_PIN)
- .unwrap()
- .device();
-
- let user = unwrap_ok!(device.authenticate_user(DEFAULT_USER_PIN));
- assert_cmd_err!(CommandError::SlotNotProgrammed, user.get_totp_slot_name(1));
-
- let mut device = user.device();
- let pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN));
- assert_utf8_err_or_ne("test", pws.get_slot_name(0));
- assert_utf8_err_or_ne("testlogin", pws.get_slot_login(0));
- assert_utf8_err_or_ne("testpw", pws.get_slot_password(0));
- drop(pws);
-
- assert_ok!(3, device.get_user_retry_count());
- assert_ok!((), device.build_aes_key(DEFAULT_ADMIN_PIN));
-}
-
-#[test_device]
-fn build_aes_key(device: DeviceWrapper) {
- let mut device = device;
- let mut pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN));
- assert_ok!((), pws.write_slot(0, "test", "testlogin", "testpw"));
- drop(pws);
-
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.build_aes_key(DEFAULT_USER_PIN)
- );
- assert_ok!((), device.build_aes_key(DEFAULT_ADMIN_PIN));
-
- let mut device = device
- .authenticate_admin(DEFAULT_ADMIN_PIN)
- .unwrap()
- .device();
-
- let pws = unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN));
- assert_utf8_err_or_ne("test", pws.get_slot_name(0));
- assert_utf8_err_or_ne("testlogin", pws.get_slot_login(0));
- assert_utf8_err_or_ne("testpw", pws.get_slot_password(0));
-}
-
-#[test_device]
-fn change_update_pin(device: Storage) {
- let mut device = device;
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.change_update_pin(UPDATE_NEW_PIN, UPDATE_PIN)
- );
- assert_ok!((), device.change_update_pin(UPDATE_PIN, UPDATE_NEW_PIN));
- assert_ok!((), device.change_update_pin(UPDATE_NEW_PIN, UPDATE_PIN));
-}
-
-#[test_device]
-fn encrypted_volume(device: Storage) {
- let mut device = device;
- assert_ok!((), device.lock());
-
- assert_eq!(1, count_nitrokey_block_devices());
- assert_ok!((), device.disable_encrypted_volume());
- assert_eq!(1, count_nitrokey_block_devices());
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.enable_encrypted_volume("123")
- );
- assert_eq!(1, count_nitrokey_block_devices());
- assert_ok!((), device.enable_encrypted_volume(DEFAULT_USER_PIN));
- assert_eq!(2, count_nitrokey_block_devices());
- assert_ok!((), device.disable_encrypted_volume());
- assert_eq!(1, count_nitrokey_block_devices());
-}
-
-#[test_device]
-fn hidden_volume(device: Storage) {
- let mut device = device;
- assert_ok!((), device.lock());
-
- assert_eq!(1, count_nitrokey_block_devices());
- assert_ok!((), device.disable_hidden_volume());
- assert_eq!(1, count_nitrokey_block_devices());
-
- assert_ok!((), device.enable_encrypted_volume(DEFAULT_USER_PIN));
- assert_eq!(2, count_nitrokey_block_devices());
-
- // TODO: why this error code?
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.create_hidden_volume(5, 0, 100, "hiddenpw")
- );
- assert_ok!((), device.create_hidden_volume(0, 20, 21, "hidden-pw"));
- assert_ok!((), device.create_hidden_volume(0, 20, 21, "hiddenpassword"));
- assert_ok!((), device.create_hidden_volume(1, 0, 1, "otherpw"));
- // TODO: test invalid range (not handled by libnitrokey)
- assert_eq!(2, count_nitrokey_block_devices());
-
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.enable_hidden_volume("blubb")
- );
- assert_ok!((), device.enable_hidden_volume("hiddenpassword"));
- assert_eq!(2, count_nitrokey_block_devices());
- assert_ok!((), device.enable_hidden_volume("otherpw"));
- assert_eq!(2, count_nitrokey_block_devices());
-
- assert_ok!((), device.disable_hidden_volume());
- assert_eq!(1, count_nitrokey_block_devices());
-}
-
-#[test_device]
-fn lock(device: Storage) {
- let mut device = device;
- assert_ok!((), device.enable_encrypted_volume(DEFAULT_USER_PIN));
- assert_ok!((), device.lock());
- assert_eq!(1, count_nitrokey_block_devices());
-}
-
-#[test_device]
-fn set_encrypted_volume_mode(device: Storage) {
- // This test case does not check the device status as the command only works with firmware
- // version 0.49. For later versions, it does not do anything and always returns Ok(()).
- let mut device = device;
-
- assert_ok!(
- (),
- device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly)
- );
-
- // TODO: re-enable once the password is checked in the firmware
- // assert_cmd_err!(
- // CommandError::WrongPassword,
- // device.set_encrypted_volume_mode(DEFAULT_USER_PIN, VolumeMode::ReadOnly)
- // );
-
- assert_ok!(
- (),
- device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly)
- );
- assert_ok!(
- (),
- device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadWrite)
- );
- assert_ok!(
- (),
- device.set_encrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly)
- );
-}
-
-#[test_device]
-fn set_unencrypted_volume_mode(device: Storage) {
- fn assert_mode(device: &Storage, mode: VolumeMode) {
- let status = unwrap_ok!(device.get_status());
- assert_eq!(
- status.unencrypted_volume.read_only,
- mode == VolumeMode::ReadOnly
- );
- }
-
- fn assert_success(device: &mut Storage, mode: VolumeMode) {
- assert_ok!(
- (),
- device.set_unencrypted_volume_mode(DEFAULT_ADMIN_PIN, mode)
- );
- assert_mode(&device, mode);
- }
-
- let mut device = device;
- assert_success(&mut device, VolumeMode::ReadOnly);
-
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.set_unencrypted_volume_mode(DEFAULT_USER_PIN, VolumeMode::ReadOnly)
- );
- assert_mode(&device, VolumeMode::ReadOnly);
-
- assert_success(&mut device, VolumeMode::ReadWrite);
- assert_success(&mut device, VolumeMode::ReadWrite);
- assert_success(&mut device, VolumeMode::ReadOnly);
-}
-
-#[test_device]
-fn get_storage_status(device: Storage) {
- let status = unwrap_ok!(device.get_status());
- assert!(status.serial_number_sd_card > 0);
- assert!(status.serial_number_smart_card > 0);
-}
-
-#[test_device]
-fn get_production_info(device: Storage) {
- let info = unwrap_ok!(device.get_production_info());
- assert_eq!(0, info.firmware_version.major);
- assert!(info.firmware_version.minor != 0);
- assert!(info.serial_number_cpu != 0);
- assert!(info.sd_card.serial_number != 0);
- assert!(info.sd_card.size > 0);
- assert!(info.sd_card.manufacturing_year > 10);
- assert!(info.sd_card.manufacturing_year < 100);
- // TODO: month value is not valid atm
- // assert!(info.sd_card.manufacturing_month < 12);
- assert!(info.sd_card.oem != 0);
- assert!(info.sd_card.manufacturer != 0);
-
- let status = unwrap_ok!(device.get_status());
- assert_eq!(status.firmware_version, info.firmware_version);
- assert_eq!(status.serial_number_sd_card, info.sd_card.serial_number);
-}
-
-#[test_device]
-fn clear_new_sd_card_warning(device: Storage) {
- let mut device = device;
- assert_ok!((), device.factory_reset(DEFAULT_ADMIN_PIN));
- thread::sleep(time::Duration::from_secs(3));
- assert_ok!((), device.build_aes_key(DEFAULT_ADMIN_PIN));
-
- // We have to perform an SD card operation to reset the new_sd_card_found field
- assert_ok!((), device.lock());
-
- let status = unwrap_ok!(device.get_status());
- assert!(status.new_sd_card_found);
-
- assert_ok!((), device.clear_new_sd_card_warning(DEFAULT_ADMIN_PIN));
-
- let status = unwrap_ok!(device.get_status());
- assert!(!status.new_sd_card_found);
-}
-
-#[test_device]
-fn export_firmware(device: Storage) {
- let mut device = device;
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.export_firmware("someadminpn")
- );
- assert_ok!((), device.export_firmware(DEFAULT_ADMIN_PIN));
- assert_ok!(
- (),
- device.set_unencrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadWrite)
- );
- assert_ok!((), device.export_firmware(DEFAULT_ADMIN_PIN));
- assert_ok!(
- (),
- device.set_unencrypted_volume_mode(DEFAULT_ADMIN_PIN, VolumeMode::ReadOnly)
- );
-}
diff --git a/nitrokey/tests/lib.rs b/nitrokey/tests/lib.rs
deleted file mode 100644
index 25aae0f..0000000
--- a/nitrokey/tests/lib.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-mod util;
-
-#[test]
-fn get_library_version() {
- let version = unwrap_ok!(nitrokey::get_library_version());
-
- assert!(version.git.is_empty() || version.git.starts_with("v"));
- assert!(version.major > 0);
-}
-
-#[test]
-fn take_manager() {
- assert!(nitrokey::take().is_ok());
-
- let result = nitrokey::take();
- assert!(result.is_ok());
- let result2 = nitrokey::take();
- match result2 {
- Ok(_) => panic!("Expected error, got Ok(_)!"),
- Err(nitrokey::Error::ConcurrentAccessError) => {}
- Err(err) => panic!("Expected ConcurrentAccessError, got {}", err),
- }
- drop(result);
- assert!(nitrokey::take().is_ok());
-}
diff --git a/nitrokey/tests/otp.rs b/nitrokey/tests/otp.rs
deleted file mode 100644
index 38cd8a9..0000000
--- a/nitrokey/tests/otp.rs
+++ /dev/null
@@ -1,287 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-mod util;
-
-use std::fmt::Debug;
-use std::ops::DerefMut;
-
-use nitrokey::{
- Admin, Authenticate, CommandError, Config, ConfigureOtp, Device, GenerateOtp, LibraryError,
- OtpMode, OtpSlotData, DEFAULT_ADMIN_PIN, DEFAULT_USER_PIN,
-};
-use nitrokey_test::test as test_device;
-
-// test suite according to RFC 4226, Appendix D
-static HOTP_SECRET: &str = "3132333435363738393031323334353637383930";
-static HOTP_CODES: &[&str] = &[
- "755224", "287082", "359152", "969429", "338314", "254676", "287922", "162583", "399871",
- "520489",
-];
-
-// test suite according to RFC 6238, Appendix B
-static TOTP_SECRET: &str = "3132333435363738393031323334353637383930";
-static TOTP_CODES: &[(u64, &[&str])] = &[
- (59, &["94287082", "37359152"]),
- (1111111109, &["07081804"]),
- (1111111111, &["14050471"]),
- (1234567890, &["89005924"]),
- (2000000000, &["69279037"]),
- (20000000000, &["65353130"]),
-];
-
-#[derive(PartialEq)]
-enum TotpTimestampSize {
- U32,
- U64,
-}
-
-fn make_admin_test_device<'a, T>(device: T) -> Admin<'a, T>
-where
- T: Device<'a>,
- (T, nitrokey::Error): Debug,
-{
- unwrap_ok!(device.authenticate_admin(DEFAULT_ADMIN_PIN))
-}
-
-fn configure_hotp(admin: &mut dyn ConfigureOtp, counter: u8) {
- let slot_data = OtpSlotData::new(1, "test-hotp", HOTP_SECRET, OtpMode::SixDigits);
- assert_ok!((), admin.write_hotp_slot(slot_data, counter.into()));
-}
-
-fn check_hotp_codes(device: &mut dyn GenerateOtp, offset: u8) {
- HOTP_CODES.iter().enumerate().for_each(|(i, code)| {
- if i >= offset as usize {
- assert_ok!(code.to_string(), device.get_hotp_code(1));
- }
- });
-}
-
-#[test_device]
-fn set_time(device: DeviceWrapper) {
- let mut device = device;
- assert_ok!((), device.set_time(1546385382, true));
- assert_ok!((), device.set_time(1546385392, false));
- assert_cmd_err!(CommandError::Timestamp, device.set_time(1546385292, false));
- assert_ok!((), device.set_time(1546385382, true));
-}
-
-#[test_device]
-fn hotp_no_pin(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, false);
- assert_ok!((), admin.write_config(config));
-
- configure_hotp(&mut admin, 0);
- check_hotp_codes(admin.deref_mut(), 0);
-
- configure_hotp(&mut admin, 5);
- check_hotp_codes(admin.deref_mut(), 5);
-
- configure_hotp(&mut admin, 0);
- check_hotp_codes(&mut admin.device(), 0);
-}
-
-#[test_device]
-fn hotp_pin(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, true);
- assert_ok!((), admin.write_config(config));
-
- configure_hotp(&mut admin, 0);
- let mut user = unwrap_ok!(admin.device().authenticate_user(DEFAULT_USER_PIN));
- check_hotp_codes(&mut user, 0);
-
- assert_cmd_err!(CommandError::NotAuthorized, user.device().get_hotp_code(1));
-}
-
-#[test_device]
-fn hotp_slot_name(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let slot_data = OtpSlotData::new(1, "test-hotp", HOTP_SECRET, OtpMode::SixDigits);
- assert_ok!((), admin.write_hotp_slot(slot_data, 0));
-
- let device = admin.device();
- assert_ok!("test-hotp".to_string(), device.get_hotp_slot_name(1));
- assert_lib_err!(LibraryError::InvalidSlot, device.get_hotp_slot_name(4));
-}
-
-#[test_device]
-fn hotp_error(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let slot_data = OtpSlotData::new(1, "", HOTP_SECRET, OtpMode::SixDigits);
- assert_cmd_err!(CommandError::NoName, admin.write_hotp_slot(slot_data, 0));
- let slot_data = OtpSlotData::new(4, "test", HOTP_SECRET, OtpMode::SixDigits);
- assert_lib_err!(
- LibraryError::InvalidSlot,
- admin.write_hotp_slot(slot_data, 0)
- );
- let slot_data = OtpSlotData::new(1, "test", "foobar", OtpMode::SixDigits);
- assert_lib_err!(
- LibraryError::InvalidHexString,
- admin.write_hotp_slot(slot_data, 0)
- );
- let code = admin.get_hotp_code(4);
- assert_lib_err!(LibraryError::InvalidSlot, code);
-}
-
-#[test_device]
-fn hotp_erase(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, false);
- assert_ok!((), admin.write_config(config));
- let slot_data = OtpSlotData::new(1, "test1", HOTP_SECRET, OtpMode::SixDigits);
- assert_ok!((), admin.write_hotp_slot(slot_data, 0));
- let slot_data = OtpSlotData::new(2, "test2", HOTP_SECRET, OtpMode::SixDigits);
- assert_ok!((), admin.write_hotp_slot(slot_data, 0));
-
- assert_ok!((), admin.erase_hotp_slot(1));
-
- let mut device = admin.device();
- let result = device.get_hotp_slot_name(1);
- assert_cmd_err!(CommandError::SlotNotProgrammed, result);
- let result = device.get_hotp_code(1);
- assert_cmd_err!(CommandError::SlotNotProgrammed, result);
-
- assert_ok!("test2".to_string(), device.get_hotp_slot_name(2));
-}
-
-fn configure_totp(admin: &mut dyn ConfigureOtp, factor: u64) {
- let slot_data = OtpSlotData::new(1, "test-totp", TOTP_SECRET, OtpMode::EightDigits);
- let time_window = 30u64.checked_mul(factor).unwrap();
- assert_ok!((), admin.write_totp_slot(slot_data, time_window as u16));
-}
-
-fn check_totp_codes(device: &mut dyn GenerateOtp, factor: u64, timestamp_size: TotpTimestampSize) {
- for (base_time, codes) in TOTP_CODES {
- let time = base_time.checked_mul(factor).unwrap();
- let is_u64 = time > u32::max_value() as u64;
- if is_u64 != (timestamp_size == TotpTimestampSize::U64) {
- continue;
- }
-
- assert_ok!((), device.set_time(time, true));
- let code = unwrap_ok!(device.get_totp_code(1));
- assert!(
- code.contains(&code),
- "Generated TOTP code {} for {}, but expected one of {}",
- code,
- base_time,
- codes.join(", ")
- );
- }
-}
-
-#[test_device]
-fn totp_no_pin(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, false);
- assert_ok!((), admin.write_config(config));
-
- configure_totp(&mut admin, 1);
- check_totp_codes(admin.deref_mut(), 1, TotpTimestampSize::U32);
-
- configure_totp(&mut admin, 2);
- check_totp_codes(admin.deref_mut(), 2, TotpTimestampSize::U32);
-
- configure_totp(&mut admin, 1);
- check_totp_codes(&mut admin.device(), 1, TotpTimestampSize::U32);
-}
-
-#[test_device]
-// Nitrokey Storage does only support timestamps that fit in a 32-bit
-// unsigned integer, so don't test with it.
-fn totp_no_pin_64(device: Pro) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, false);
- assert_ok!((), admin.write_config(config));
-
- configure_totp(&mut admin, 1);
- check_totp_codes(admin.deref_mut(), 1, TotpTimestampSize::U64);
-
- configure_totp(&mut admin, 2);
- check_totp_codes(admin.deref_mut(), 2, TotpTimestampSize::U64);
-
- configure_totp(&mut admin, 1);
- check_totp_codes(&mut admin.device(), 1, TotpTimestampSize::U64);
-}
-
-#[test_device]
-fn totp_pin(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, true);
- assert_ok!((), admin.write_config(config));
-
- configure_totp(&mut admin, 1);
- let mut user = unwrap_ok!(admin.device().authenticate_user(DEFAULT_USER_PIN));
- check_totp_codes(&mut user, 1, TotpTimestampSize::U32);
-
- assert_cmd_err!(CommandError::NotAuthorized, user.device().get_totp_code(1));
-}
-
-#[test_device]
-// See comment for totp_no_pin_64.
-fn totp_pin_64(device: Pro) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, true);
- assert_ok!((), admin.write_config(config));
-
- configure_totp(&mut admin, 1);
- let mut user = unwrap_ok!(admin.device().authenticate_user(DEFAULT_USER_PIN));
- check_totp_codes(&mut user, 1, TotpTimestampSize::U64);
-
- assert_cmd_err!(CommandError::NotAuthorized, user.device().get_totp_code(1));
-}
-
-#[test_device]
-fn totp_slot_name(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let slot_data = OtpSlotData::new(1, "test-totp", TOTP_SECRET, OtpMode::EightDigits);
- assert_ok!((), admin.write_totp_slot(slot_data, 0));
-
- let device = admin.device();
- let result = device.get_totp_slot_name(1);
- assert_ok!("test-totp", result);
- let result = device.get_totp_slot_name(16);
- assert_lib_err!(LibraryError::InvalidSlot, result);
-}
-
-#[test_device]
-fn totp_error(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let slot_data = OtpSlotData::new(1, "", TOTP_SECRET, OtpMode::SixDigits);
- assert_cmd_err!(CommandError::NoName, admin.write_totp_slot(slot_data, 0));
- let slot_data = OtpSlotData::new(20, "test", TOTP_SECRET, OtpMode::SixDigits);
- assert_lib_err!(
- LibraryError::InvalidSlot,
- admin.write_totp_slot(slot_data, 0)
- );
- let slot_data = OtpSlotData::new(4, "test", "foobar", OtpMode::SixDigits);
- assert_lib_err!(
- LibraryError::InvalidHexString,
- admin.write_totp_slot(slot_data, 0)
- );
- let code = admin.get_totp_code(20);
- assert_lib_err!(LibraryError::InvalidSlot, code);
-}
-
-#[test_device]
-fn totp_erase(device: DeviceWrapper) {
- let mut admin = make_admin_test_device(device);
- let config = Config::new(None, None, None, false);
- assert_ok!((), admin.write_config(config));
- let slot_data = OtpSlotData::new(1, "test1", TOTP_SECRET, OtpMode::SixDigits);
- assert_ok!((), admin.write_totp_slot(slot_data, 0));
- let slot_data = OtpSlotData::new(2, "test2", TOTP_SECRET, OtpMode::SixDigits);
- assert_ok!((), admin.write_totp_slot(slot_data, 0));
-
- assert_ok!((), admin.erase_totp_slot(1));
-
- let device = admin.device();
- let result = device.get_totp_slot_name(1);
- assert_cmd_err!(CommandError::SlotNotProgrammed, result);
- let result = device.get_totp_code(1);
- assert_cmd_err!(CommandError::SlotNotProgrammed, result);
-
- assert_ok!("test2".to_string(), device.get_totp_slot_name(2));
-}
diff --git a/nitrokey/tests/pws.rs b/nitrokey/tests/pws.rs
deleted file mode 100644
index 7169695..0000000
--- a/nitrokey/tests/pws.rs
+++ /dev/null
@@ -1,159 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-mod util;
-
-use std::ffi::CStr;
-
-use libc::{c_int, c_void, free};
-use nitrokey::{
- CommandError, Device, Error, GetPasswordSafe, LibraryError, PasswordSafe, DEFAULT_ADMIN_PIN,
- DEFAULT_USER_PIN, SLOT_COUNT,
-};
-use nitrokey_sys;
-use nitrokey_test::test as test_device;
-
-fn get_slot_name_direct(slot: u8) -> Result<String, Error> {
- let ptr = unsafe { nitrokey_sys::NK_get_password_safe_slot_name(slot) };
- if ptr.is_null() {
- return Err(Error::UnexpectedError);
- }
- let s = unsafe { CStr::from_ptr(ptr).to_string_lossy().into_owned() };
- unsafe { free(ptr as *mut c_void) };
- match s.is_empty() {
- true => {
- let error = unsafe { nitrokey_sys::NK_get_last_command_status() } as c_int;
- match error {
- 0 => Ok(s),
- other => Err(Error::from(other)),
- }
- }
- false => Ok(s),
- }
-}
-
-fn get_pws<'a, T>(device: &mut T) -> PasswordSafe<'_, 'a>
-where
- T: Device<'a>,
-{
- unwrap_ok!(device.get_password_safe(DEFAULT_USER_PIN))
-}
-
-#[test_device]
-fn enable(device: DeviceWrapper) {
- let mut device = device;
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.get_password_safe(&(DEFAULT_USER_PIN.to_owned() + "123"))
- );
- assert_any_ok!(device.get_password_safe(DEFAULT_USER_PIN));
- assert_cmd_err!(
- CommandError::WrongPassword,
- device.get_password_safe(DEFAULT_ADMIN_PIN)
- );
- assert_any_ok!(device.get_password_safe(DEFAULT_USER_PIN));
-}
-
-#[test_device]
-fn drop(device: DeviceWrapper) {
- let mut device = device;
- {
- let mut pws = get_pws(&mut device);
- assert_ok!((), pws.write_slot(1, "name", "login", "password"));
- assert_ok!("name".to_string(), pws.get_slot_name(1));
- let result = get_slot_name_direct(1);
- assert_ok!(String::from("name"), result);
- }
- let result = get_slot_name_direct(1);
- assert_ok!(String::from("name"), result);
- assert_ok!((), device.lock());
- let result = get_slot_name_direct(1);
- assert_cmd_err!(CommandError::NotAuthorized, result);
-}
-
-#[test_device]
-fn get_status(device: DeviceWrapper) {
- let mut device = device;
- let mut pws = get_pws(&mut device);
- for i in 0..SLOT_COUNT {
- assert_ok!((), pws.erase_slot(i));
- }
- let status = unwrap_ok!(pws.get_slot_status());
- assert_eq!(status, [false; SLOT_COUNT as usize]);
-
- assert_ok!((), pws.write_slot(1, "name", "login", "password"));
- let status = unwrap_ok!(pws.get_slot_status());
- for i in 0..SLOT_COUNT {
- assert_eq!(i == 1, status[i as usize]);
- }
-
- for i in 0..SLOT_COUNT {
- assert_ok!((), pws.write_slot(i, "name", "login", "password"));
- }
- assert_ok!([true; SLOT_COUNT as usize], pws.get_slot_status());
-}
-
-#[test_device]
-fn get_data(device: DeviceWrapper) {
- let mut device = device;
- let mut pws = get_pws(&mut device);
- assert_ok!((), pws.write_slot(1, "name", "login", "password"));
- assert_ok!("name".to_string(), pws.get_slot_name(1));
- assert_ok!("login".to_string(), pws.get_slot_login(1));
- assert_ok!("password".to_string(), pws.get_slot_password(1));
-
- assert_ok!((), pws.erase_slot(1));
- assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_name(1));
- assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_login(1));
- assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_password(1));
-
- let name = "with å";
- let login = "pär@test.com";
- let password = "'i3lJc[09?I:,[u7dWz9";
- assert_ok!((), pws.write_slot(1, name, login, password));
- assert_ok!(name.to_string(), pws.get_slot_name(1));
- assert_ok!(login.to_string(), pws.get_slot_login(1));
- assert_ok!(password.to_string(), pws.get_slot_password(1));
-
- assert_lib_err!(LibraryError::InvalidSlot, pws.get_slot_name(SLOT_COUNT));
- assert_lib_err!(LibraryError::InvalidSlot, pws.get_slot_login(SLOT_COUNT));
- assert_lib_err!(LibraryError::InvalidSlot, pws.get_slot_password(SLOT_COUNT));
-}
-
-#[test_device]
-fn write(device: DeviceWrapper) {
- let mut device = device;
- let mut pws = get_pws(&mut device);
-
- assert_lib_err!(
- LibraryError::InvalidSlot,
- pws.write_slot(SLOT_COUNT, "name", "login", "password")
- );
-
- assert_ok!((), pws.write_slot(0, "", "login", "password"));
- assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_name(0));
- assert_ok!(String::from("login"), pws.get_slot_login(0));
- assert_ok!(String::from("password"), pws.get_slot_password(0));
-
- assert_ok!((), pws.write_slot(0, "name", "", "password"));
- assert_ok!(String::from("name"), pws.get_slot_name(0));
- assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_login(0));
- assert_ok!(String::from("password"), pws.get_slot_password(0));
-
- assert_ok!((), pws.write_slot(0, "name", "login", ""));
- assert_ok!(String::from("name"), pws.get_slot_name(0));
- assert_ok!(String::from("login"), pws.get_slot_login(0));
- assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_password(0));
-}
-
-#[test_device]
-fn erase(device: DeviceWrapper) {
- let mut device = device;
- let mut pws = get_pws(&mut device);
- assert_lib_err!(LibraryError::InvalidSlot, pws.erase_slot(SLOT_COUNT));
-
- assert_ok!((), pws.write_slot(0, "name", "login", "password"));
- assert_ok!((), pws.erase_slot(0));
- assert_ok!((), pws.erase_slot(0));
- assert_cmd_err!(CommandError::SlotNotProgrammed, pws.get_slot_name(0));
-}
diff --git a/nitrokey/tests/util/mod.rs b/nitrokey/tests/util/mod.rs
deleted file mode 100644
index f2b20ec..0000000
--- a/nitrokey/tests/util/mod.rs
+++ /dev/null
@@ -1,113 +0,0 @@
-// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
-// SPDX-License-Identifier: MIT
-
-#[macro_export]
-macro_rules! unwrap_ok {
- ($val:expr) => {{
- match $val {
- Ok(val) => val,
- Err(err) => panic!(
- r#"assertion failed: `(left == right)`
- left: `Ok(_)`,
- right: `Err({:?})`"#,
- err
- ),
- }
- }};
-}
-
-#[macro_export]
-macro_rules! assert_any_ok {
- ($val:expr) => {{
- match &$val {
- Ok(_) => {}
- Err(err) => panic!(
- r#"assertion failed: `(left == right)`
- left: `Ok(_)`,
- right: `Err({:?})`"#,
- err
- ),
- }
- }};
-}
-
-#[macro_export]
-macro_rules! assert_ok {
- ($left:expr, $right:expr) => {{
- match &$right {
- Ok(right) => match &$left {
- left => {
- if !(*left == *right) {
- panic!(
- r#"assertion failed: `(left == right)`
- left: `{:?}`,
- right: `{:?}`"#,
- left, right
- )
- }
- }
- },
- Err(right_err) => panic!(
- r#"assertion failed: `(left == right)`
- left: `Ok({:?})`,
- right: `Err({:?})`"#,
- $left, right_err
- ),
- }
- }};
-}
-
-#[macro_export]
-macro_rules! assert_err {
- ($err:path, $left:expr, $right:expr) => {
- match &$right {
- Err($err(ref right_err)) => match &$left {
- left_err => {
- if !(*left_err == *right_err) {
- panic!(
- r#"assertion failed: `(left == right)`
- left: `{:?}`,
- right: `{:?}`"#,
- left_err, right_err
- )
- }
- }
- },
- Err(ref right_err) => panic!(
- r#"assertion failed: `(left == right)`
- left: `{:?}`,
- right: `{:?}`"#,
- $err($left),
- right_err
- ),
- Ok(right_ok) => panic!(
- r#"assertion failed: `(left == right)`
- left: `Err({:?})`,
- right: `Ok({:?})`"#,
- $err($left),
- right_ok
- ),
- }
- };
-}
-
-#[macro_export]
-macro_rules! assert_cmd_err {
- ($left:expr, $right:expr) => {
- assert_err!(::nitrokey::Error::CommandError, $left, $right);
- };
-}
-
-#[macro_export]
-macro_rules! assert_cmu_err {
- ($left:expr, $right:expr) => {
- assert_err!(::nitrokey::Error::CommunicationError, $left, $right);
- };
-}
-
-#[macro_export]
-macro_rules! assert_lib_err {
- ($left:expr, $right:expr) => {
- assert_err!(::nitrokey::Error::LibraryError, $left, $right);
- };
-}