| Commit message (Collapse) | Author | Age |
|
|
|
|
|
|
| |
As we no longer have to implement the Display and AsRef traits for the
enums generated with the Command! macro, we don’t have to set a string
representation either. So we can drop this argument from the Command!
macro.
|
|
|
|
|
|
| |
In the previous patches, we replaced argparse with structopt and removed
the argparse dependency. This patch removes the code that was only
needed for argparse.
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch changes the argument handling code to use structopt instead
of argparse using the data structures we introduced in the last patch.
As part of that transition we replace the old Error::ArgparseError
variant with ClapError that stores a structopt::clap::Error.
Because of that replacement, the format of the help messages changed,
breaking some of the tests. Hence, this change adapts them accordingly.
Also clap currently prints the version output to stdout, so we ignore
the version_option test case for now.
|
|
|
|
|
|
| |
This patch introduces new structs that can be used with structopt to
store the options and arguments parsed from the command line. These
structs use the existing enums and command structs.
|
|
|
|
|
|
| |
As a preparation for the structopt transition, we derive StructOpt for
the enums generated by Command! so that they can be used as a
subcommand.
|
|
|
|
|
|
|
| |
For the transition to structopt, we have to be able to easily construct
enum variants once we have added fields to them. Therefore we implement
the Default trait in the generated macros by choosing the first variant
as the default.
|
|
|
|
|
|
| |
To be able to use the enums generated by Command! with structopt, we
have to be able to add fields to them. This patch adds a new variant to
the Command! macro that supports fields.
|
|
|
|
|
| |
For easier refactoring, we remove the internal enum_int! macro and
instead copy its code to the Enum! and Command! macros.
|
|
|
|
|
|
|
|
|
| |
In one of the next patches, we will add fields to some Command variants
to be able to use them with structopt. Then we will no longer be able
to instantiate them directly, so we replace these instances for the
transition.
This patch also removes the cmd_help! macro that is no longer needed.
|
|
|
|
|
| |
structopt requires that FromStr::Err implements std::fmt::Display.
Therefore we now return a String that contains a list of allowed values.
|
|
|
|
|
|
| |
For an easier transition to structopt, this patch splits the two cases
of the Enum! macro into two separate macros (that internally both call
the new enum_int! macro).
|
|
|
|
|
|
|
|
|
| |
This change updates the minimum required version of Rust to 1.35.0. The
motivation for doing so is at least two fold. First, next we want to
bump the nitrokey crate to version 0.4.0 and it requires Rust 1.34.0 as
a minimum. Second, and perhaps more importantly, though, in 1.34.0 a
clippy lint regressed, breaking our pipeline. That is the reason why we
are going to 1.35.0 instead.
|
|
|
|
|
| |
With Rust 1.40 the unions_with_drop_fields lint has been removed. This
change removes it from our list of lints as well.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This change updates the version of the nitrokey crate that we use to
0.4.0-alpha.3. This version is the supposedly last pre-release before
0.4.0, with no further major anticipated changes.
In order to integrate with this new version we have to adjust the way we
connect to a Nitrokey device by funneling those connection requests
through a global manager object. The rationale behind that step being
that the underlying libnitrokey actually cannot handle access of
multiple devices at the same time, and so the manager object is used to
prevent accidental wrong concurrent usage.
Because a device object now effectively keeps a reference to the
manager, we need to provide an additional lifetime to that and derived
objects.
Lastly, the use of a manager is also the reason why the tests had to be
adjusted to no longer accept device objects in their signatures, but
only the respective model for which to invoke the test. That is required
because, as elaborated earlier on, having a device object implies having
taken a reference to a manager (in that case owned by nitrokey-test),
and that reference clashes with the nitrocli code itself attempting to
take the manager. We side step this problem by merely accepting a Model
object, which can be passed around independently of the manager itself,
meaning that nitrokey-test does not need to hold such a reference while
the test is run.
Import subrepo nitrokey/:nitrokey at f150d59410eefdec2ae69b2422906a3d1d88aa07
Import subrepo nitrokey-sys/:nitrokey-sys at 8695e2c762807e033a86c8d03974b686d20cdd72
Import subrepo lazy-static/:lazy-static at b4b2b16aaa79dd7548e288455a0dbe4065bf4e1a
|
|
|
|
|
|
|
|
|
|
| |
This change updates the dependency to nitrokey to version 0.4.0-alpha.2.
In addition to minor interface changes for the get_*_firmware_version
and get_*_retry_count functions, several functions that change the
device state now require a mutable handle to the nitrokey. Hence, this
patch a number of function signatures to accept mutable device objects.
Import subrepo nitrokey/:nitrokey at 34efcfadf1436102e42144f710edabaa2c4b55cd
|
|
|
|
|
|
| |
Since version 0.4.0, nitrokey provides the default admin and user PIN as
constants. This patch removes the constants from nitrocli and uses
nitrokey's constant instead.
|
|
|
|
|
|
|
|
| |
With nitrokey-test up to version 0.2.0 we required a work around to make
device tests work across different modules.
With this patch we bump the consumed version of the crate to 0.2.1, as
part which the underlying problem got fixed. Hence, with this change we
remove this hack as it is no longer needed.
|
|
|
|
|
|
|
|
|
|
|
| |
This is patch marks the first step in the process of updating the
nitrokey dependency to version 0.4. In particular, it integrates with
the first alpha version.
The main change on the nitrocli side accompanying the version bump is
that the nitrokey::CommandError got replaced by a more general
nitrokey::Error which includes the former variant.
Import subrepo nitrokey/:nitrokey at d433189caefe6bd6c88da7fbb1d6e9304353eb83
|
|
|
|
|
|
|
|
|
|
| |
The library ultimately taking care of communicating with the Nitrokey
device, libnitrokey, unconditionally expects hexadecimal strings
supplied as part of the configuration of an OTP slot to have an even
number of bytes.
Users should not be aware of this detail and so with this change we take
care of padding the supplied string with a leading zero to make such a
configuration go through without an error.
|
|
|
|
|
|
|
|
|
|
|
|
| |
When reading a secret in ascii or base32 format from the user, we
perform a conversion of the potentially decoded string into hexadecimal
bytes, because that is what libnitrokey expects.
The format string we used in the conversion, however, did not account
for padding with a leading zero for single digit results. E.g., the
newline/line feed symbol '\n', which has a decimal value of 10 would
result in the string 'a' being produced, whereas '0a' would be the
correct result.
This change corrects the format string to fix this problem.
|
|
|
|
|
|
|
|
|
| |
The otp set subcommand allows for three different formats in which the
user may pass in the secret, with the default being hexadecimal. By
convention we convey the default being used in the help text to the
respective command, but that default was missing here.
To that end, this change makes sure to include the default format being
used in corresponding help text.
|
|
|
|
|
|
| |
This change introduces a constant for the frequently used string
"nitrocli" to the program and replaces usages of those strings with
references to the constant.
|
|
|
|
|
|
|
|
|
|
|
| |
Subcommands of the encrypted and unencrypted commands were found to have
a wrong help text displayed. The reason for that behavior was that the
subargs were are constructing as part of the argument parsing process
were missing the command being requested and instead containing only the
subcommand.
This change fixes this deficiency. It also adds a test ensuring that the
"Usage" string displayed in the help text of each command and subcommand
contains the proper arguments.
|
|
|
|
|
|
|
|
|
|
| |
Similar to the with_*device functions introduced in a previous change,
this change introduces a with_password_safe function that is a short
hand for opening the Nitrokey, retrieving a handle to the password safe,
and invoking a user-supplied function on it.
This function will allow us to prevent life time inference problems
caused by passing around a PasswordSafe object, which will contain an
additional reference (and with that, lifetime) in nitrokey version 0.4.
|
|
|
|
|
|
|
| |
With an upcoming change we will require an ExecCtx in one of the
op functions passed to the with_* and try_with_* functionality. To
allow for such cases, this change adjusts the signature of those
functions to provide a reference to such a context.
|
|
|
|
|
|
|
|
|
|
|
| |
This change introduces a new trait, TryInto, to the crate. In the future
this trait will allow us to keep a flexible set of error result types
from the various try_with_* functions, which use a certain nitrokey
error variant to check for the entry of a wrong secret.
Note that while a TryInto trait exists in Rust's standard library, that
was not found to be helpful because we have no way to define it for
nitrkey crate's error type. Because of that, we will always have a
mismatch between our internal error and std::convert::Infallible.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The upcoming nitrokey 0.4 release changes the way a device handle can be
acquired, requiring a manager instance for doing so in an attempt to
prevent users from opening multiple sessions (which is not something
that libnitrokey supports).
A straight integration of the reworked API surface into our program
would severely complicate the architecture because of the additional
requirement of keeping a manager object around while a device is being
used.
To make the program more amenable to those changes in nitrokey, this
patch reworks the way we interact with a device handle: instead of
passing the device object around we pass in the functionality making use
of it in the form of a function. In more concrete terms, instead of
retrieving a device handle via get_device() we now have a with_device()
function that takes care of opening the device and then passing it to a
user-provided function.
|
|
|
|
|
|
|
|
|
| |
The try_with_* and authenticate functions accept a user-supplied
function to work with. Currently this function is declared as Fn. That,
however, is unnecessarily restrictive.
With this change we declare said function an FnMut instead, which allows
it to potentially capture variables from its environment in a mutable
manner.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We recently fixed a compilation failure in some test code caused by a
use declaration that was ultimately unused. To this point we were under
the impression that there was a set of lints that were known to be
potentially changing in backwards incompatible ways while others would
not. Discovery of unused use declarations or symbols was always assumed
to fall into the latter category.
Because such a build breakage due to semantic change in what a lint can
detect by now is a repeated pattern (with dire consequences), this
change downgrades all 'deny'-style lints to warnings in order to prevent
similar problems in the future.
|
|
|
|
|
|
|
|
| |
For functionality that explicitly works with the storage device we emit
an error message stating that a "Nitrokey Storage" device could not be
found. When the user chooses the model using the -m/--model argument
that is not the case.
With this patch we adjust the error message printed.
|
|
|
|
|
| |
This patch replaces two cases where we use Result::or_else over the more
idiomatic (and shorter) Result::map_err for converting errors.
|
|
|
|
|
|
|
|
|
|
| |
This change removes the explicit change of the global allocator to the
system allocator that we introduced a while back.
The reason this was needed in the past was due to Rust's use of jemalloc
in the default configuration, which increases binary size quite
significantly. However, with Rust issue #36963 fixed, jemalloc is now an
explicit opt-in and the system allocator is the default choice --
rendering our explicit change rather pointless.
|
|
|
|
|
|
|
|
|
|
|
| |
When the gpg-connect-agent binary is not available on the system we
report an error that is really only hinting at the problem and without
knowing internals it is hard to guess what may be wrong:
$ nitrocli pws get 0
> IO error: No such file or directory (os error 2)
This change adjusts the code to make the error less ambiguous and more
to the point.
|
|
|
|
|
|
|
| |
This change adds support for changing the read-write mode of the
unencrypted volume. To do so, we introduce a new top-level command,
unencrypted, with a new subcommand, set, that accepts the new mode of
the volume.
|
|
|
|
|
|
|
|
|
| |
This change rewords the error message that is emitted if the lock
command fails. The old message was incorrectly stating a problem with
the retrieval of the device's status.
While at it, also slightly rephrase the description for the hidden
command to be more in line with that of the other storage commands, and
replace lowercase 'nitrokey' with a capitalized one in a few comments.
|
|
|
|
|
|
|
| |
The --ascii option of the otp set subcommand has been deprecated a while
in favor of --format. As the next release is slated to be a major one
breaking backwards compatibility, this change removes this option for
good.
|
|
|
|
|
|
|
|
| |
This change is the last step in the process of restructuring the storage
command. In particular, now that functionality pertaining hidden volumes
has been moved out into a dedicated top-level command, it renames said
command to encrypted, because dealing with the encrypted volume is the
only functionality it provides.
|
|
|
|
|
|
| |
This patch marks the next step in the process of restructuring the
storage command. Specifically, it promotes the storage hidden subcommand
to a top-level command, hidden.
|
|
|
|
|
|
|
|
| |
In an attempt to rework the structure of the storage command to better
accommodate future requirements for allowing to change the read-write
state of the unencrypted volume (as well as potentially the encrypted
one), this change removes the storage status subcommand and merges its
output into the storage command.
|
|
|
|
|
|
|
|
|
|
| |
When a PIN is changed using the pin set command, the last action is to
confirm the operation with the previously used PIN. This step will cause
this PIN, which is now stale and no longer valid, to be cached, which in
turn can cause follow up command using the same PIN type to use this
wrong cached entry for authentication.
To fix this problem, this change explicitly clear the PIN entry from the
cache after the PIN has been changed.
|
|
|
|
|
|
|
|
|
|
|
|
| |
So far we have cached secrets in gpg-agent(1) whenever that made sense
to do (i.e., for the two PINs in most contexts but not for passwords).
While there is reason to believe that such caching is desired by the
majority of users, not everybody has a use for it.
To give users an opportunity to opt out of such caching, this change
introduces a new environment variable, NITROCLI_NO_CACHE, that, when
present in the environment, instructs the program to bypass the cache
for all operations that require a secret and to instead inquire such
secrets each time they are needed.
|
|
|
|
|
|
|
|
|
|
| |
The input to the Enum macro is supposed to resemble the definition of an
enum in Rust code. When manually defining an enum (or a struct for that
matter), we typically terminate all branches with a comma, and don't
just omit that on the last line.
To mirror this behavior, this change adjusts the Enum macro to accept
(and in fact, require) a comma-terminated last line as well, as opposed
to not accepting it as had been the case so far.
|
|
|
|
|
|
|
|
|
| |
Macros typically should reference types by their full path and not
assume that they are in scope wherever the macro is expanded. We did
missed one spot where AsRef was not fully qualified in the Enum macro.
While that is not much of an issue here (and there may be more
occurrences, e.g., in the auto derives) lets fix that up for the sake of
consistency.
|
|
|
|
|
|
|
|
|
|
| |
With Rust 1.35 we get compile errors due to doc comments that are added
to macro invocations but not actually included in the expanded output.
The rustc wrongly assumes that we want to document the resulting code
and not just provide details about the invocation itself.
This change explicitly allows for those cases. Alternatively we could
have "downgraded" the doc comments to normal comments or removed them
altogether. There is little difference between those alternatives.
|
|
|
|
|
| |
This change adds a test case for the -V/--version option to the suite of
tests.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Due to a bug in argparse [0], custom stdout and stderr settings are
ignored when using argparse::Print, as we currently do for the --version
option. This patch adds a workaround for this problem: Instead of using
argparse::Print, we use argparse::StoreTrue for the --version option.
The argument parsing will fail as the command is missing, but the
version variable will still be set to true if the version option was
set. So we ignore the parsing result and discard the argparse output if
the version variable is set.
[0] https://github.com/tailhook/rust-argparse/pull/50
|
|
|
|
|
|
|
|
|
| |
The split between the parse_arguments and the handle_arguments functions
is not really useful for reasoning about the code. In fact, it just adds
additional overhead in the form of complex function signatures into the
picture.
As it provides no real other value, this change merges the functionality
of both functions into a single one: handle_arguments.
|
|
|
|
|
|
|
|
|
| |
To be able to decide whether to print the argparse output depending on
the result of the argument parsing, this patch wraps stdout and stderr
in a BufWriter before invoking argparse. Our BufWriter implementation
only writes to the inner Write if the flush method is called. This
allows us to decide whether the buffered data should be written or
silently dropped.
|
|
|
|
|
|
|
|
|
|
| |
We have introduced the parse function to unify the common parsing
related tasks. In that vein, this change goes one step further and
adjusts the function to actually consume the ArgumentParser object used
by it.
All clients using this function actually do not access the parser
afterwards, and, in fact, some of them have to explicitly drop it
because of borrow conflicts with "referred" arguments.
|
|
|
|
|
| |
This patch changes the error handling in the args' module parse function
to use the Result's map_err instead of a more verbose if let expression.
|