From 434e61c231e142b6f5f8d81eb25f4ef97686d85a Mon Sep 17 00:00:00 2001 From: Robin Krahl Date: Sat, 27 Mar 2021 16:10:53 +0100 Subject: Initial commit --- .gitignore | 2 + Cargo.toml | 21 ++++++ examples/list.rs | 21 ++++++ src/crc32.rs | 84 ++++++++++++++++++++++++ src/devices.rs | 62 ++++++++++++++++++ src/devices/pro.rs | 99 ++++++++++++++++++++++++++++ src/features.rs | 20 ++++++ src/hid.rs | 187 +++++++++++++++++++++++++++++++++++++++++++++++++++++ src/lib.rs | 101 +++++++++++++++++++++++++++++ 9 files changed, 597 insertions(+) create mode 100644 .gitignore create mode 100644 Cargo.toml create mode 100644 examples/list.rs create mode 100644 src/crc32.rs create mode 100644 src/devices.rs create mode 100644 src/devices/pro.rs create mode 100644 src/features.rs create mode 100644 src/hid.rs create mode 100644 src/lib.rs diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..96ef6c0 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/target +Cargo.lock diff --git a/Cargo.toml b/Cargo.toml new file mode 100644 index 0000000..e096d97 --- /dev/null +++ b/Cargo.toml @@ -0,0 +1,21 @@ +[package] +name = "nitrokey-hid" +version = "0.1.0" +authors = ["Robin Krahl "] +edition = "2018" + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +serde-big-array = "0.3" +ssmarshal = "1" +static_assertions = "1" + +[dependencies.hidapi] +version = "1.2.5" +default-features = false +features = ["linux-shared-libusb"] + +[dependencies.serde] +version = "1" +features = ["derive"] diff --git a/examples/list.rs b/examples/list.rs new file mode 100644 index 0000000..ee59ceb --- /dev/null +++ b/examples/list.rs @@ -0,0 +1,21 @@ +use nitrokey_hid::features::Basic; + +fn main() -> Result<(), nitrokey_hid::Error> { + let device = nitrokey_hid::connect()?; + let status = device.get_status()?; + println!( + r#"Status: + model: {model:?} + serial number: 0x{id:08x} + firmware version: {fwv_maj}.{fwv_min} + user retry count: {urc} + admin retry count: {arc}"#, + model = device.get_model(), + id = status.serial_number, + fwv_maj = status.firmware_version_major, + fwv_min = status.firmware_version_minor, + urc = device.get_user_retry_count()?, + arc = device.get_admin_retry_count()?, + ); + Ok(()) +} diff --git a/src/crc32.rs b/src/crc32.rs new file mode 100644 index 0000000..6b3f9d7 --- /dev/null +++ b/src/crc32.rs @@ -0,0 +1,84 @@ +// https://github.com/d-e-s-o/nitrocli/blob/ac29709a644682c61a5a28d2a23f8887174fcc31/nitrocli/src/crc32.rs +// +// ************************************************************************* +// * Copyright (C) 2017 Daniel Mueller (deso@posteo.net) * +// * * +// * This program is free software: you can redistribute it and/or modify * +// * it under the terms of the GNU General Public License as published by * +// * the Free Software Foundation, either version 3 of the License, or * +// * (at your option) any later version. * +// * * +// * This program is distributed in the hope that it will be useful, * +// * but WITHOUT ANY WARRANTY; without even the implied warranty of * +// * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * +// * GNU General Public License for more details. * +// * * +// * You should have received a copy of the GNU General Public License * +// * along with this program. If not, see . * +// ************************************************************************* + +/// Polynomial used in STM32. +const CRC32_POLYNOMIAL: u32 = 0x04c11db7; + +fn crc32(mut crc: u32, data: u32) -> u32 { + crc = crc ^ data; + + for _ in 0..32 { + if crc & 0x80000000 != 0 { + crc = (crc << 1) ^ CRC32_POLYNOMIAL; + } else { + crc = crc << 1; + } + } + return crc; +} + +/// Retrieve a u32 slice of the 'data' part. +/// +/// Note that the size of the supplied data has to be a multiple of 4 +/// bytes. +fn as_slice_u32(data: &[u8]) -> &[u32] { + assert!(data.len() % ::std::mem::size_of::() == 0); + + unsafe { + let ptr = data.as_ptr() as *const u32; + let len = data.len() / ::std::mem::size_of::(); + return ::std::slice::from_raw_parts(ptr, len); + } +} + +/// Calculate the CRC of a byte slice. +pub fn crc(data: &[u8]) -> u32 { + let mut crc = 0xffffffff; + + for value in as_slice_u32(data) { + crc = crc32(crc, *value); + } + + return crc; +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_crc32() { + let mut crc = 0; + + // The expected values were computed with the original function. + crc = crc32(crc, 0xdeadbeef); + assert_eq!(crc, 0x46dec763); + + crc = crc32(crc, 42); + assert_eq!(crc, 0x7e579b45); + } + + #[test] + fn test_crc() { + let data = &"thisisatextthatistobecrced..".to_string().into_bytes(); + let crc = crc(data); + + assert_eq!(crc, 0x469db4ee); + } +} diff --git a/src/devices.rs b/src/devices.rs new file mode 100644 index 0000000..a40207b --- /dev/null +++ b/src/devices.rs @@ -0,0 +1,62 @@ +use crate::features; +use crate::{Error, Model}; + +mod pro; + +pub use pro::Pro; + +#[derive(Debug)] +pub enum Device { + Pro(Pro), +} + +impl Device { + fn as_basic(&self) -> &dyn features::Basic { + match self { + Device::Pro(pro) => pro, + } + } +} + +impl RawDevice for Device { + fn execute(&self, command_id: impl Into, data: T) -> Result + where + T: serde::Serialize, + U: serde::de::DeserializeOwned + { + match self { + Device::Pro(pro) => pro.execute(command_id, data), + } + } +} + +impl features::Basic for Device { + fn get_model(&self) -> Model { + self.as_basic().get_model() + } + + fn get_status(&self) -> Result { + self.as_basic().get_status() + } + + fn get_user_retry_count(&self) -> Result { + self.as_basic().get_user_retry_count() + } + + fn get_admin_retry_count(&self) -> Result { + self.as_basic().get_admin_retry_count() + } +} + +impl From for Device { + fn from(pro: Pro) -> Device { + Device::Pro(pro) + } +} + +pub(crate) trait RawDevice { + fn execute(&self, command_id: impl Into, data: T) -> Result + where + T: serde::Serialize, + U: serde::de::DeserializeOwned; +} diff --git a/src/devices/pro.rs b/src/devices/pro.rs new file mode 100644 index 0000000..f986f6b --- /dev/null +++ b/src/devices/pro.rs @@ -0,0 +1,99 @@ +use std::fmt; + +use crate::{devices, hid, features, DeviceInfo, Error, Model}; +use crate::devices::RawDevice as _; + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +#[repr(u8)] +enum Command { + GetStatus = 0x00, + GetPasswordRetryCount = 0x09, + GetUserPasswordRetryCount = 0x0F, +} + +impl From for u8 { + fn from(command: Command) -> u8 { + command as u8 + } +} + +pub struct Pro { + hid_device: hidapi::HidDevice, + path: std::ffi::CString, +} + +impl Pro { + pub(crate) fn new(hid_device: hidapi::HidDevice, device_info: &DeviceInfo<'_>) -> Self { + Self { + hid_device, + path: device_info.device_info.path().to_owned(), + } + } +} + +impl features::Basic for Pro { + fn get_model(&self) -> Model { + Model::Pro + } + + fn get_status(&self) -> Result { + self.execute(Command::GetStatus, ()) + } + + fn get_user_retry_count(&self) -> Result { + self.execute(Command::GetPasswordRetryCount, ()) + } + + fn get_admin_retry_count(&self) -> Result { + self.execute(Command::GetUserPasswordRetryCount, ()) + } +} + +impl devices::RawDevice for Pro { + fn execute(&self, command_id: impl Into, data: T) -> Result + where + T: serde::Serialize, + U: serde::de::DeserializeOwned, + { + use hid::HidDeviceExt as _; + + let command_id = command_id.into(); + let crc = self.hid_device.send(&hid::Request::new(command_id, data))?; + + let mut response = self.hid_device.receive()?; + let mut retry_count = 0; + while response.device_status == hid::DeviceStatus::Busy && retry_count < 3 { + std::thread::sleep(std::time::Duration::from_millis(100)); + response = self.hid_device.receive()?; + retry_count += 1; + } + + if response.device_status != hid::DeviceStatus::Ok { + return Err(format!("Got device status {:?}", response.device_status).into()); + } + if response.command_id != command_id { + return Err(format!( + "Expected command ID {}, got {}", + command_id, response.command_id + ) + .into()); + } + if response.command_status != hid::CommandStatus::Ok { + return Err(format!("Got command status {:?}", response.command_status).into()); + } + if response.last_crc() != crc { + return Err(format!("Expected last_crc {}, got {}", crc, response.last_crc()).into()); + } + + Ok(response.data) + } +} + +impl fmt::Debug for Pro { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + f.debug_struct("Pro") + .field("path", &self.path) + .finish() + } +} + diff --git a/src/features.rs b/src/features.rs new file mode 100644 index 0000000..1ec5dff --- /dev/null +++ b/src/features.rs @@ -0,0 +1,20 @@ +use crate::{Error, Model}; + +#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize)] +pub struct Status { + pub firmware_version_minor: u8, + pub firmware_version_major: u8, + pub serial_number: u32, + pub config_num_lock: u8, + pub config_caps_lock: u8, + pub config_scroll_lock: u8, + pub config_enable_user_password: u8, + _unused: u8, +} + +pub trait Basic { + fn get_model(&self) -> Model; + fn get_status(&self) -> Result; + fn get_user_retry_count(&self) -> Result; + fn get_admin_retry_count(&self) -> Result; +} diff --git a/src/hid.rs b/src/hid.rs new file mode 100644 index 0000000..291216c --- /dev/null +++ b/src/hid.rs @@ -0,0 +1,187 @@ +use std::convert; +use std::convert::TryFrom as _; + +use crate::crc32; +use crate::Error; + +pub const REPORT_LEN: usize = 65; +pub const REPORT_PAYLOAD_LEN: usize = REPORT_LEN - 5; +pub const MAX_REQUEST_DATA_LEN: usize = REPORT_PAYLOAD_LEN - 1; +pub const MAX_RESPONSE_DATA_LEN: usize = REPORT_PAYLOAD_LEN - 7; + +serde_big_array::big_array! { BigArray; REPORT_PAYLOAD_LEN } + +#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize)] +struct Report { + report_id: u8, + #[serde(with = "BigArray")] + payload: [u8; REPORT_PAYLOAD_LEN], + crc: [u8; 4], +} + +static_assertions::assert_eq_size!([u8; REPORT_LEN], Report); + +impl Report { + fn new(report_id: u8, payload: [u8; REPORT_PAYLOAD_LEN]) -> Report { + let crc = crc32::crc(&payload); + Report { + report_id, + payload, + crc: crc.to_le_bytes(), + } + } + + fn from_bytes(data: [u8; REPORT_LEN]) -> Result { + let (report, num_bytes): (Report, _) = ssmarshal::deserialize(&data)?; + if num_bytes != REPORT_LEN { + return Err(format!("Only {} of {} report bytes read", num_bytes, REPORT_LEN).into()); + } + Ok(report) + } + + fn to_bytes(&self) -> Result<[u8; REPORT_LEN], Error> { + let mut buf = [0; REPORT_LEN]; + let num_bytes = ssmarshal::serialize(&mut buf, self)?; + if num_bytes != REPORT_LEN { + return Err(format!("Invalid report length: {}", num_bytes).into()); + } + Ok(buf) + } + + fn crc(&self) -> u32 { + u32::from_le_bytes(self.crc) + } + + pub fn check_crc(&self) -> Result<(), Error> { + let crc = crc32::crc(&self.payload); + if self.crc() != crc { + Err(format!( + "Warning: Report has wrong CRC: got {:x}, expected {:x}", + self.crc(), + crc + ) + .into()) + } else { + Ok(()) + } + } +} + +impl Default for Report { + fn default() -> Report { + Report::new(0, [0; REPORT_PAYLOAD_LEN]) + } +} + +#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize)] +pub struct Request { + pub command_id: u8, + pub data: T, +} + +static_assertions::assert_eq_size!([u8; REPORT_PAYLOAD_LEN - MAX_REQUEST_DATA_LEN], Request<()>,); + +impl Request { + pub fn new(command_id: u8, data: T) -> Request { + Request { command_id, data } + } +} + +impl<'a, T: serde::Serialize> convert::TryFrom<&'a Request> for Report { + type Error = Error; + + fn try_from(request: &'a Request) -> Result { + let mut payload = [0; REPORT_PAYLOAD_LEN]; + let num_bytes = ssmarshal::serialize(&mut payload, &request)?; + if num_bytes > REPORT_PAYLOAD_LEN { + return Err(format!("Invalid request length: {}", num_bytes).into()); + } + Ok(Report::new(0, payload)) + } +} + +#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize)] +#[repr(u8)] +pub enum DeviceStatus { + Ok, + Busy, + Error, + ReceivedReport, +} + +#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize)] +#[repr(u8)] +pub enum CommandStatus { + Ok, + WrongCrc, + WrongSlot, + SlotNotProgrammed, + WrongPassword, + NotAuthorized, + TimestampWarning, + NoNameError, + NotSupported, + UnknownCommand, + AesDecFailed, +} + +#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize)] +pub struct Response { + pub device_status: DeviceStatus, + pub command_id: u8, + pub last_crc: [u8; 4], + pub command_status: CommandStatus, + pub data: T, +} + +static_assertions::assert_eq_size!( + [u8; REPORT_PAYLOAD_LEN - MAX_RESPONSE_DATA_LEN], + Response<()>, +); + +impl Response { + pub fn last_crc(&self) -> u32 { + u32::from_le_bytes(self.last_crc) + } +} + +impl<'a, T: serde::de::DeserializeOwned> convert::TryFrom<&'a Report> for Response { + type Error = Error; + + fn try_from(report: &'a Report) -> Result, Error> { + let (response, _) = ssmarshal::deserialize(&report.payload)?; + Ok(response) + } +} + +pub trait HidDeviceExt { + fn send(&self, request: &Request) -> Result; + fn receive(&self) -> Result, Error>; +} + +impl HidDeviceExt for hidapi::HidDevice { + fn send(&self, request: &Request) -> Result { + let report = Report::try_from(request)?; + let data = report.to_bytes()?; + self.send_feature_report(&data)?; + Ok(report.crc()) + } + + fn receive(&self) -> Result, Error> { + let mut buf = [0; REPORT_LEN]; + let n = self.get_feature_report(&mut buf)?; + if n != REPORT_LEN { + return Err(format!("Invalid report length: {}", n).into()); + } + let report = Report::from_bytes(buf)?; + if report.report_id != 0 { + return Err(format!("Invalid report ID: {}", report.report_id).into()); + } + let response = Response::try_from(&report)?; + // TODO: is the CRC set for all other status variants? + if response.device_status != DeviceStatus::Busy { + report.check_crc()?; + } + Ok(response) + } +} diff --git a/src/lib.rs b/src/lib.rs new file mode 100644 index 0000000..a26f02f --- /dev/null +++ b/src/lib.rs @@ -0,0 +1,101 @@ +mod crc32; +mod hid; + +pub mod devices; +pub mod features; + +use std::fmt; + +pub type Error = Box; + +const VID_NITROKEY: u16 = 0x20a0; +const PID_NITROKEY_PRO: u16 = 0x4108; +const PID_NITROKEY_STORAGE: u16 = 0x4109; + +pub fn connect() -> Result { + let manager = Manager::new()?; + if let Some(device) = manager.devices().first() { + device.connect() + } else { + Err("No device connected".into()) + } +} + +pub fn connect_model(model: Model) -> Result { + let manager = Manager::new()?; + if let Some(device) = manager.devices().iter().filter(|i| i.model == model).next() { + device.connect() + } else { + Err(format!("No {:?} device connected", model).into()) + } +} + +pub struct Manager { + hidapi: hidapi::HidApi, +} + +impl Manager { + pub fn new() -> Result { + let hidapi = hidapi::HidApi::new()?; + Ok(Manager { hidapi }) + } + + pub fn devices(&self) -> Vec> { + self.hidapi + .device_list() + .flat_map(|device_info| { + Model::from_vid_pid(device_info.vendor_id(), device_info.product_id()).map( + |model| DeviceInfo { + hidapi: &self.hidapi, + device_info, + model, + }, + ) + }) + .collect() + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub enum Model { + Pro, + Storage, +} + +impl Model { + fn from_vid_pid(vid: u16, pid: u16) -> Option { + match vid { + VID_NITROKEY => match pid { + PID_NITROKEY_PRO => Some(Model::Pro), + PID_NITROKEY_STORAGE => Some(Model::Storage), + _ => None, + }, + _ => None, + } + } +} + +pub struct DeviceInfo<'a> { + hidapi: &'a hidapi::HidApi, + device_info: &'a hidapi::DeviceInfo, + model: Model, +} + +impl<'a> DeviceInfo<'a> { + pub fn connect(&self) -> Result { + let hid_device = self.device_info.open_device(self.hidapi)?; + match self.model { + Model::Pro => Ok(devices::Pro::new(hid_device, self).into()), + Model::Storage => unimplemented!(), + } + } +} + +impl<'a> fmt::Debug for DeviceInfo<'a> { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + f.debug_struct("DeviceInfo") + .field("model", &self.model) + .field("path", &self.device_info.path()) + .finish() + } +} -- cgit v1.2.1