| Commit message (Collapse) | Author | Age |
|
|
|
| |
This prepares the refactoring of util::CommandError into multiple enums.
|
|
|
|
|
|
| |
The FirmwareVersion struct stores the major and minor firmware version
of a Nitrokey device. We refactor the StorageProductionInfo and
StorageStatus structs to use this new struct.
|
| |
|
|
|
|
|
|
| |
The clear_new_sd_card_warning method calls the libnitrokey
NK_clear_new_sd_card_warning function to reset the corresponding flag in
the Storage status.
|
|
|
|
|
|
|
|
|
|
|
| |
The get_production_info method maps to the NK_get_production_info
function of libnitrokey. The Storage firmware supports two query modes:
with or without a write test. libnitrokey only performs the query
without write test, so the fields that are only set for the write test
are ignored in our implementation. This affects:
- user and admin retry counts
- smart card ID
- SD card size
|
|
|
|
|
|
|
| |
The export_firmware method writes the firmware of the Nitrokey Storage
to the unencrypted storage. We only test that the command succeeds as
mounting the unencrypted storage and accessing the file is out of scope
for the tests.
|
|
|
|
|
|
|
|
|
|
| |
The new set_unencrypted_volume_mode method sets the access mode of the
unencrypted volume on the Nitrokey Storage. Depending on the requested
access mode, it calls either NK_set_unencrypted_read_only_admin or
NK_set_unencrypted_read_write_admin.
Note that this function requires firmware version 0.51 or later.
(Earlier firmware versions used the user PIN.)
|
|
|
|
|
|
| |
The VolumeMode enum will be used when setting the access mode for the
unencrypted volume. It can also be used when refactoring the
VolumeStatus enum in a future release.
|
|
|
|
|
|
| |
This patch adds the wink method to the Storage struct that lets the
Nitrokey device blink until reconnected. We do not test this method as
it does not change the state that we can observe.
|
|
|
|
|
|
| |
This patch adds the global connect_model function that can be used to
connect to a Nitrokey device of a given model. Contrary to Pro::connect
and Storage::connect, the model does not have to be set at compile time.
|
|
|
|
| |
connect_model will be used for a public function with the next patch.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
This patch introduces the methods enable_hidden_volume,
disable_hidden_volume and create_hidden_volume for the Storage struct to
support the hidden volumes on the Nitrokey Storage. The enable and
create methods require that the encrypted storage has been enabled.
Contrary to authentication and password safe access, we do not enforce
this requirement in the API as file system operations could have
unwanted side effects and should not performed implicitly.
|
|
|
|
|
|
| |
Contrary to my previous beliefs, build_aes_key has to be called even
after a factory reset using the Nitrokey API. This patch updates the
documentation and the unit tests based on this insight.
|
| |
|
|
|
|
|
|
|
|
| |
This patch adds the enable_firmware_update method to the Storage struct
that uses NK_enable_firmware_update to put the Nitrokey Storage into
update mode. This method is not tested as external tooling is required
to resume normal operation and as it is hard to bail out if an error
occurs.
|
|
|
|
|
|
|
|
| |
This patch adds the build_aes_key method to the Device trait that uses
the NK_build_aes_key function to build new AES keys on the device. This
effectively resets the password safe and the encrypted storage. It is
unclear whether other data (e. g. the one-time passwords) are affected
too.
|
|
|
|
|
|
|
| |
This patch adds the factory_reset_method to the Device trait that uses
the NK_factory_reset function to perform a factory reset. The tests
verify that the user and admin PIN are reset and that the OTP storage
and the password safe are deleted.
|
|
|
|
|
|
| |
This patch adds the change_update_pin method to the Storage struct that
uses the NK_change_update_password function to set the password required
for firmware updates.
|
|
|
|
|
|
|
|
|
|
| |
The CommandError::Unknown variant, which is used whenever a reported
error code is not known, makes it close to impossible to determine the
root cause of, say, a one-off error, because all information explaining
what went wrong is discarded.
With this change we adjust the Unknown variant to include the error
report. In addition, we introduce a new CommandError variant, Undefined,
that is used when no error code is available.
|
| |
|
| |
|
|
|
|
|
| |
This patch adds the function Device::get_model that returns the model of
the connected Nitrokey stick.
|
| |
|
|
|
|
|
|
| |
This patch changes use declarations for modules within this crate to use
the crate:: path qualifier. This will be mandatory in Rust edition
2018.
|
|
|
|
|
| |
This patch changes the type of trait objects from `Trait` to `dyn
Trait`. This fixes bare-trait-object compiler warnings.
|
| |
|
| |
|
|
|
|
|
|
| |
This patch adds a `get_status` method to the `Storage` structure. The
returned structure `StorageStatus` is based on the structure provided by
libnitrokey.
|
|
|
|
|
|
|
| |
As connect() now returns DeviceWrappers of the correct type, this patch
adds an example to the DeviceWrapper documentation that shows how to use
type conditions, i. e. how to execute a command only for Nitrokey
Storage devices.
|
|
|
|
|
|
| |
This patch fixes the generic connect() method to return a DeviceWrapper
of the correct type. This is enabled by the NK_get_device_model()
method introduced in libnitrokey v3.4.
|
|
|
|
|
| |
Most notably, for command errors, this will print a human-readable error
message instead of just the name of the enum.
|
|
|
|
|
|
| |
The new get_cstring method in util returns a Result<CString,
CommandError>, so mast callers can just use the ? operator to unwrap the
result instead of cumbersome unwrapping code.
|
|
|
|
|
|
| |
The Result enum is more idiomatic and easier to use than our custom
CommandStatus enum with the same structure. This is especially true for
the try operator ?.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds support for the commands to enable or disable the
encrypted volume on the Nitrokey Storage. To test these commands, the
output of lsblk is parsed for the device model “Nitrokey Storage”. This
is not perfect but seems to be the best solution for automated testing.
As the effect of enabling and disabling volumes is not immediate, a
delay of two seconds is added to the tests before checking lsblk. This
is sufficient on my machine, yet it would be better to have a portable
version of this check.
This patch also adds a lock method to Device that executes the
lock_device command. This command was previously only used to close the
password safe. On the Nitrokey Storage, it also disables the encrypted
and hidden volume.
|
| |
|
| |
|
|
|
|
|
| |
Authenticate is supported by both the Nitrokey Pro and the Nitrokey
Storage. Therefore Device should extend it.
|
|
|
|
|
|
|
|
|
| |
A password safe (PWS) stores names, logins and passwords in slots. PWS
are supported both by the Nitrokey Pro and the Nitrokey Storage. They
are implemented as a struct wrapping a device as the device may not be
disconnected while the password safe is alive. The creation of a
password safe is handled by the GetPasswordSafe trait, implemented by
DeviceWrapper, Pro and Storage.
|
|
|
|
|
| |
This patch adds the Storage struct and the test-storage feature. It
also enables all currently supported Pro commands for the Storage.
|
| |
|
|
|
|
|
|
|
| |
For DeviceWrapper, the traits GenerateOtp and Device are now directly
implemented instead of complicated template implementations. For User
and Admin, the wrapper implementations are replaced with an
implementation of the Deref trait for easier access.
|
|
|
|
|
|
| |
The set_time operation is only used with TOTP generation. Therefore it
makes more sense to have it in the GenerateOtp trait than in the Device
trait.
|
|
|
|
|
|
| |
The defnition of the ConfigureOtp trait already contains documentation
comments, therefore the comments in the implementation for User<T> can
be removed.
|
| |
|
|
|
|
|
|
|
| |
DeviceWrapper abstracts over the supported devices. It implements the
traits that are implemented by all supported devices. The previous
UnauthenticatedDevice is renamed to Pro to prepare Storage support.
connect_model is moved to Pro::connect.
|
| |
|
|
|
|
|
| |
The example uses the chrono crate and can therefore not be executed, but
at least it shows how to set the Nitrokey device to the current time.
|
|
In future versions, we want to support not only the Nitrokey Pro, but
also the Nitrokey Storage. This requires a better code layout. This
patch introduces two main changes:
First, the OTP-specific methods are moved from the Device trait and the
AdminAuthenticatedDevice struct to the functionality-based traits
ConfigureOtp and GenerateOtp. This will hopefully make it easier to
integrate the Nitrokey Storage.
Secondly, the code is split into separate modules. These modules are
currently all private and re-exported in the lib module, but we can
consider making them public in the future.
|