use config::{Config, RawConfig}; use libc; use nitrokey_sys; use std::ffi::CString; use std::os::raw::c_int; use misc::Authenticate; use otp::{ConfigureOtp, GenerateOtp, OtpMode, OtpSlotData, RawOtpSlotData}; use util::{generate_password, get_last_error, result_from_string, CommandError, CommandStatus}; static TEMPORARY_PASSWORD_LENGTH: usize = 25; /// Available Nitrokey models. #[derive(Debug, PartialEq)] enum Model { /// The Nitrokey Storage. Storage, /// The Nitrokey Pro. Pro, } /// A wrapper for a Nitrokey device of unknown type. /// /// Use the function [`connect`][] to obtain a wrapped instance. The wrapper implements all traits /// that are shared between all Nitrokey devices so that the shared functionality can be used /// without knowing the type of the underlying device. If you want to use functionality that is /// not available for all devices, you have to extract the device. /// /// # Examples /// /// Authentication with error handling: /// /// ```no_run /// use nitrokey::{Authenticate, DeviceWrapper, User}; /// # use nitrokey::CommandError; /// /// fn perform_user_task(device: &User) {} /// fn perform_other_task(device: &DeviceWrapper) {} /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// let device = match device.authenticate_user("123456") { /// Ok(user) => { /// perform_user_task(&user); /// user.device() /// }, /// Err((device, err)) => { /// println!("Could not authenticate as user: {:?}", err); /// device /// }, /// }; /// perform_other_task(&device); /// # Ok(()) /// # } /// ``` /// /// [`connect`]: fn.connect.html // TODO: add example for Storage-specific code #[derive(Debug)] pub enum DeviceWrapper { /// A Nitrokey Storage device. Storage(()), /// A Nitrokey Pro device. Pro(Pro), } /// A Nitrokey Pro device without user or admin authentication. /// /// Use the global function [`connect`][] to obtain an instance wrapper or the method /// [`connect`][`Pro::connect`] to directly obtain an instance. If you want to execute a command /// that requires user or admin authentication, use [`authenticate_admin`][] or /// [`authenticate_user`][]. /// /// # Examples /// /// Authentication with error handling: /// /// ```no_run /// use nitrokey::{Authenticate, User, Pro}; /// # use nitrokey::CommandError; /// /// fn perform_user_task(device: &User) {} /// fn perform_other_task(device: &Pro) {} /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::Pro::connect()?; /// let device = match device.authenticate_user("123456") { /// Ok(user) => { /// perform_user_task(&user); /// user.device() /// }, /// Err((device, err)) => { /// println!("Could not authenticate as user: {:?}", err); /// device /// }, /// }; /// perform_other_task(&device); /// # Ok(()) /// # } /// ``` /// /// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin /// [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user /// [`connect`]: fn.connect.html /// [`Pro::connect`]: #method.connect #[derive(Debug)] pub struct Pro {} /// A Nitrokey device with user authentication. /// /// To obtain an instance of this struct, use the [`authenticate_user`][] method from the /// [`Authenticate`][] trait. To get back to an unauthenticated device, use the [`device`][] /// method. /// /// [`Authenticate`]: trait.Authenticate.html /// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin /// [`device`]: #method.device #[derive(Debug)] pub struct User { device: T, temp_password: Vec, } /// A Nitrokey device with admin authentication. /// /// To obtain an instance of this struct, use the [`authenticate_admin`][] method from the /// [`Authenticate`][] trait. To get back to an unauthenticated device, use the [`device`][] /// method. /// /// [`Authenticate`]: trait.Authenticate.html /// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin /// [`device`]: #method.device #[derive(Debug)] pub struct Admin { device: T, temp_password: Vec, } /// A Nitrokey device. /// /// This trait provides the commands that can be executed without authentication and that are /// present on all supported Nitrokey devices. pub trait Device: GenerateOtp { /// Sets the time on the Nitrokey. This command may set the time to arbitrary values. `time` /// is the number of seconds since January 1st, 1970 (Unix timestamp). /// /// The time is used for TOTP generation (see [`get_totp_code`][]). /// /// # Example /// /// ```ignore /// extern crate chrono; /// /// use chrono::Utc; /// use nitrokey::Device; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// let time = Utc::now().timestamp(); /// if time < 0 { /// println!("Timestamps before 1970-01-01 are not supported!"); /// } else { /// device.set_time(time as u64); /// } /// # Ok(()) /// # } /// ``` /// /// # Errors /// /// - [`Timestamp`][] if the time could not be set /// /// [`get_totp_code`]: trait.GenerateOtp.html#method.get_totp_code /// [`Timestamp`]: enum.CommandError.html#variant.Timestamp fn set_time(&self, time: u64) -> CommandStatus { unsafe { CommandStatus::from(nitrokey_sys::NK_totp_set_time(time)) } } /// Returns the serial number of the Nitrokey device. The serial number is the string /// representation of a hex number. /// /// # Example /// /// ```no_run /// use nitrokey::Device; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// match device.get_serial_number() { /// Ok(number) => println!("serial no: {:?}", number), /// Err(err) => println!("Could not get serial number: {:?}", err), /// }; /// # Ok(()) /// # } /// ``` fn get_serial_number(&self) -> Result { unsafe { result_from_string(nitrokey_sys::NK_device_serial_number()) } } /// Returns the number of remaining authentication attempts for the user. The total number of /// available attempts is three. /// /// # Example /// /// ```no_run /// use nitrokey::Device; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// let count = device.get_user_retry_count(); /// println!("{} remaining authentication attempts (user)", count); /// # Ok(()) /// # } /// ``` fn get_user_retry_count(&self) -> u8 { unsafe { nitrokey_sys::NK_get_user_retry_count() } } /// Returns the number of remaining authentication attempts for the admin. The total number of /// available attempts is three. /// /// # Example /// /// ```no_run /// use nitrokey::Device; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// let count = device.get_admin_retry_count(); /// println!("{} remaining authentication attempts (admin)", count); /// # Ok(()) /// # } /// ``` fn get_admin_retry_count(&self) -> u8 { unsafe { nitrokey_sys::NK_get_admin_retry_count() } } /// Returns the major part of the firmware version (should be zero). /// /// # Example /// /// ```no_run /// use nitrokey::Device; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// println!( /// "Firmware version: {}.{}", /// device.get_major_firmware_version(), /// device.get_minor_firmware_version(), /// ); /// # Ok(()) /// # } /// ``` fn get_major_firmware_version(&self) -> i32 { unsafe { nitrokey_sys::NK_get_major_firmware_version() } } /// Returns the minor part of the firmware version (for example 8 for version 0.8). /// /// # Example /// /// ```no_run /// use nitrokey::Device; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// println!( /// "Firmware version: {}.{}", /// device.get_major_firmware_version(), /// device.get_minor_firmware_version(), /// ); /// # Ok(()) /// # } fn get_minor_firmware_version(&self) -> i32 { unsafe { nitrokey_sys::NK_get_minor_firmware_version() } } /// Returns the current configuration of the Nitrokey device. /// /// # Example /// /// ```no_run /// use nitrokey::Device; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// let config = device.get_config()?; /// println!("numlock binding: {:?}", config.numlock); /// println!("capslock binding: {:?}", config.capslock); /// println!("scrollock binding: {:?}", config.scrollock); /// println!("require password for OTP: {:?}", config.user_password); /// # Ok(()) /// # } /// ``` fn get_config(&self) -> Result { unsafe { let config_ptr = nitrokey_sys::NK_read_config(); if config_ptr.is_null() { return Err(get_last_error()); } let config_array_ptr = config_ptr as *const [u8; 5]; let raw_config = RawConfig::from(*config_array_ptr); libc::free(config_ptr as *mut libc::c_void); return Ok(raw_config.into()); } } /// Changes the administrator PIN. /// /// # Errors /// /// - [`InvalidString`][] if one of the provided passwords contains a null byte /// - [`WrongPassword`][] if the current admin password is wrong /// /// # Example /// /// ```no_run /// use nitrokey::{CommandStatus, Device}; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// match device.change_admin_pin("12345678", "12345679") { /// CommandStatus::Success => println!("Updated admin PIN."), /// CommandStatus::Error(err) => println!("Failed to update admin PIN: {:?}", err), /// }; /// # Ok(()) /// # } /// ``` /// /// [`InvalidString`]: enum.CommandError.html#variant.InvalidString /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword fn change_admin_pin(&self, current: &str, new: &str) -> CommandStatus { let current_string = CString::new(current); let new_string = CString::new(new); if current_string.is_err() || new_string.is_err() { return CommandStatus::Error(CommandError::InvalidString); } let current_string = current_string.unwrap(); let new_string = new_string.unwrap(); unsafe { CommandStatus::from(nitrokey_sys::NK_change_admin_PIN( current_string.as_ptr(), new_string.as_ptr(), )) } } /// Changes the user PIN. /// /// # Errors /// /// - [`InvalidString`][] if one of the provided passwords contains a null byte /// - [`WrongPassword`][] if the current user password is wrong /// /// # Example /// /// ```no_run /// use nitrokey::{CommandStatus, Device}; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// match device.change_user_pin("123456", "123457") { /// CommandStatus::Success => println!("Updated admin PIN."), /// CommandStatus::Error(err) => println!("Failed to update admin PIN: {:?}", err), /// }; /// # Ok(()) /// # } /// ``` /// /// [`InvalidString`]: enum.CommandError.html#variant.InvalidString /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword fn change_user_pin(&self, current: &str, new: &str) -> CommandStatus { let current_string = CString::new(current); let new_string = CString::new(new); if current_string.is_err() || new_string.is_err() { return CommandStatus::Error(CommandError::InvalidString); } let current_string = current_string.unwrap(); let new_string = new_string.unwrap(); unsafe { CommandStatus::from(nitrokey_sys::NK_change_user_PIN( current_string.as_ptr(), new_string.as_ptr(), )) } } } trait AuthenticatedDevice { fn new(device: T, temp_password: Vec) -> Self; } /// Connects to a Nitrokey device. This method can be used to connect to any connected device, /// both a Nitrokey Pro and a Nitrokey Storage. /// /// # Example /// /// ``` /// use nitrokey::DeviceWrapper; /// /// fn do_something(device: DeviceWrapper) {} /// /// match nitrokey::connect() { /// Ok(device) => do_something(device), /// Err(err) => println!("Could not connect to a Nitrokey: {:?}", err), /// } /// ``` pub fn connect() -> Result { unsafe { match nitrokey_sys::NK_login_auto() { 1 => match get_connected_device() { Some(wrapper) => Ok(wrapper), None => Err(CommandError::Unknown), }, _ => Err(CommandError::Unknown), } } } fn get_connected_device() -> Option { // TODO: check connected device Some(DeviceWrapper::Pro(Pro {})) } fn connect_model(model: Model) -> bool { let model = match model { Model::Storage => nitrokey_sys::NK_device_model_NK_STORAGE, Model::Pro => nitrokey_sys::NK_device_model_NK_PRO, }; unsafe { nitrokey_sys::NK_login_enum(model) == 1 } } impl> GenerateOtp for T { fn get_hotp_slot_name(&self, slot: u8) -> Result { self.as_ref().get_hotp_slot_name(slot) } fn get_totp_slot_name(&self, slot: u8) -> Result { self.as_ref().get_totp_slot_name(slot) } fn get_hotp_code(&self, slot: u8) -> Result { self.as_ref().get_hotp_code(slot) } fn get_totp_code(&self, slot: u8) -> Result { self.as_ref().get_totp_code(slot) } } impl + GenerateOtp> Device for T {} impl AsRef for DeviceWrapper { fn as_ref(&self) -> &(GenerateOtp + 'static) { match *self { DeviceWrapper::Storage(_) => panic!("..."), DeviceWrapper::Pro(ref pro) => pro, } } } impl AsRef for DeviceWrapper { fn as_ref(&self) -> &(Device + 'static) { match *self { DeviceWrapper::Storage(_) => panic!("..."), DeviceWrapper::Pro(ref pro) => pro, } } } impl Authenticate for DeviceWrapper { fn authenticate_user(self, password: &str) -> Result, (Self, CommandError)> { match self { DeviceWrapper::Storage(_) => panic!("..."), DeviceWrapper::Pro(pro) => { let result = pro.authenticate_user(password); match result { Ok(user) => Ok(User::new( DeviceWrapper::Pro(user.device), user.temp_password, )), Err((pro, err)) => Err((DeviceWrapper::Pro(pro), err)), } } } } fn authenticate_admin(self, password: &str) -> Result, (Self, CommandError)> { match self { DeviceWrapper::Storage(_) => panic!("..."), DeviceWrapper::Pro(pro) => { let result = pro.authenticate_admin(password); match result { Ok(admin) => Ok(Admin::new( DeviceWrapper::Pro(admin.device), admin.temp_password, )), Err((pro, err)) => Err((DeviceWrapper::Pro(pro), err)), } } } } } impl Pro { pub fn connect() -> Result { // TODO: maybe Option instead of Result? match connect_model(Model::Pro) { true => Ok(Pro {}), false => Err(CommandError::Unknown), } } fn authenticate(self, password: &str, callback: T) -> Result where D: AuthenticatedDevice, T: Fn(*const i8, *const i8) -> c_int, { let temp_password = match generate_password(TEMPORARY_PASSWORD_LENGTH) { Ok(pw) => pw, Err(_) => return Err((self, CommandError::RngError)), }; let password = CString::new(password); if password.is_err() { return Err((self, CommandError::InvalidString)); } let pw = password.unwrap(); let password_ptr = pw.as_ptr(); let temp_password_ptr = temp_password.as_ptr() as *const i8; return match callback(password_ptr, temp_password_ptr) { 0 => Ok(D::new(self, temp_password)), rv => Err((self, CommandError::from(rv))), }; } } impl Authenticate for Pro { fn authenticate_user(self, password: &str) -> Result, (Self, CommandError)> { return self.authenticate(password, |password_ptr, temp_password_ptr| unsafe { nitrokey_sys::NK_user_authenticate(password_ptr, temp_password_ptr) }); } fn authenticate_admin(self, password: &str) -> Result, (Self, CommandError)> { return self.authenticate(password, |password_ptr, temp_password_ptr| unsafe { nitrokey_sys::NK_first_authenticate(password_ptr, temp_password_ptr) }); } } impl Drop for Pro { fn drop(&mut self) { unsafe { nitrokey_sys::NK_logout(); } } } impl Device for Pro {} impl GenerateOtp for Pro {} impl AsRef for User { fn as_ref(&self) -> &(Device + 'static) { &self.device } } impl User { /// Forgets the user authentication and returns an unauthenticated device. This method /// consumes the authenticated device. It does not perform any actual commands on the /// Nitrokey. pub fn device(self) -> T { self.device } } impl GenerateOtp for User { /// Generates an HOTP code on the given slot. This operation may not require user /// authorization, depending on the device configuration (see [`get_config`][]). /// /// # Errors /// /// - [`SlotNotProgrammed`][] if the given slot is not configured /// - [`WrongSlot`][] if there is no slot with the given number /// /// # Example /// /// ```no_run /// use nitrokey::{Authenticate, GenerateOtp}; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// match device.authenticate_user("123456") { /// Ok(user) => { /// let code = user.get_hotp_code(1)?; /// println!("Generated HOTP code on slot 1: {:?}", code); /// }, /// Err(err) => println!("Could not authenticate: {:?}", err), /// }; /// # Ok(()) /// # } /// ``` /// /// [`get_config`]: trait.Device.html#method.get_config /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed /// [`WrongSlot`]: enum.CommandError.html#variant.WrongSlot fn get_hotp_code(&self, slot: u8) -> Result { unsafe { let temp_password_ptr = self.temp_password.as_ptr() as *const i8; return result_from_string(nitrokey_sys::NK_get_hotp_code_PIN(slot, temp_password_ptr)); } } /// Generates a TOTP code on the given slot. This operation may not require user /// authorization, depending on the device configuration (see [`get_config`][]). /// /// To make sure that the Nitrokey’s time is in sync, consider calling [`set_time`][] before /// calling this method. /// /// # Errors /// /// - [`SlotNotProgrammed`][] if the given slot is not configured /// - [`WrongSlot`][] if there is no slot with the given number /// /// # Example /// /// ```no_run /// use nitrokey::{Authenticate, GenerateOtp}; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// match device.authenticate_user("123456") { /// Ok(user) => { /// let code = user.get_totp_code(1)?; /// println!("Generated TOTP code on slot 1: {:?}", code); /// }, /// Err(err) => println!("Could not authenticate: {:?}", err), /// }; /// # Ok(()) /// # } /// ``` /// /// [`get_config`]: trait.Device.html#method.get_config /// [`set_time`]: trait.Device.html#method.set_time /// [`SlotNotProgrammed`]: enum.CommandError.html#variant.SlotNotProgrammed /// [`WrongSlot`]: enum.CommandError.html#variant.WrongSlot fn get_totp_code(&self, slot: u8) -> Result { unsafe { let temp_password_ptr = self.temp_password.as_ptr() as *const i8; return result_from_string(nitrokey_sys::NK_get_totp_code_PIN( slot, 0, 0, 0, temp_password_ptr, )); } } } impl AuthenticatedDevice for User { fn new(device: T, temp_password: Vec) -> Self { User { device, temp_password, } } } impl AsRef for Admin { fn as_ref(&self) -> &(GenerateOtp + 'static) { &self.device } } impl AsRef for Admin { fn as_ref(&self) -> &(Device + 'static) { &self.device } } impl Admin { /// Forgets the user authentication and returns an unauthenticated device. This method /// consumes the authenticated device. It does not perform any actual commands on the /// Nitrokey. pub fn device(self) -> T { self.device } /// Writes the given configuration to the Nitrokey device. /// /// # Errors /// /// - [`InvalidSlot`][] if the provided numlock, capslock or scrolllock slot is larger than two /// /// # Example /// /// ```no_run /// use nitrokey::{Authenticate, Config}; /// # use nitrokey::CommandError; /// /// # fn try_main() -> Result<(), CommandError> { /// let device = nitrokey::connect()?; /// let config = Config::new(None, None, None, false); /// match device.authenticate_admin("12345678") { /// Ok(admin) => { /// admin.write_config(config); /// () /// }, /// Err((_, err)) => println!("Could not authenticate as admin: {:?}", err), /// }; /// # Ok(()) /// # } /// ``` /// /// [`InvalidSlot`]: enum.CommandError.html#variant.InvalidSlot pub fn write_config(&self, config: Config) -> CommandStatus { let raw_config = match RawConfig::try_from(config) { Ok(raw_config) => raw_config, Err(err) => return CommandStatus::Error(err), }; unsafe { let rv = nitrokey_sys::NK_write_config( raw_config.numlock, raw_config.capslock, raw_config.scrollock, raw_config.user_password, false, self.temp_password.as_ptr() as *const i8, ); return CommandStatus::from(rv); } } fn write_otp_slot(&self, data: OtpSlotData, callback: C) -> CommandStatus where C: Fn(RawOtpSlotData, *const i8) -> c_int, { let raw_data = match RawOtpSlotData::new(data) { Ok(raw_data) => raw_data, Err(err) => return CommandStatus::Error(err), }; let temp_password_ptr = self.temp_password.as_ptr() as *const i8; let rv = callback(raw_data, temp_password_ptr); return CommandStatus::from(rv); } } impl ConfigureOtp for Admin { fn write_hotp_slot(&self, data: OtpSlotData, counter: u64) -> CommandStatus { return self.write_otp_slot(data, |raw_data: RawOtpSlotData, temp_password_ptr| unsafe { nitrokey_sys::NK_write_hotp_slot( raw_data.number, raw_data.name.as_ptr(), raw_data.secret.as_ptr(), counter, raw_data.mode == OtpMode::EightDigits, raw_data.use_enter, raw_data.use_token_id, raw_data.token_id.as_ptr(), temp_password_ptr, ) }); } fn write_totp_slot(&self, data: OtpSlotData, time_window: u16) -> CommandStatus { return self.write_otp_slot(data, |raw_data: RawOtpSlotData, temp_password_ptr| unsafe { nitrokey_sys::NK_write_totp_slot( raw_data.number, raw_data.name.as_ptr(), raw_data.secret.as_ptr(), time_window, raw_data.mode == OtpMode::EightDigits, raw_data.use_enter, raw_data.use_token_id, raw_data.token_id.as_ptr(), temp_password_ptr, ) }); } fn erase_hotp_slot(&self, slot: u8) -> CommandStatus { let temp_password_ptr = self.temp_password.as_ptr() as *const i8; unsafe { CommandStatus::from(nitrokey_sys::NK_erase_hotp_slot(slot, temp_password_ptr)) } } fn erase_totp_slot(&self, slot: u8) -> CommandStatus { let temp_password_ptr = self.temp_password.as_ptr() as *const i8; unsafe { CommandStatus::from(nitrokey_sys::NK_erase_totp_slot(slot, temp_password_ptr)) } } } impl AuthenticatedDevice for Admin { fn new(device: T, temp_password: Vec) -> Self { Admin { device, temp_password, } } }