james/age-plugin-yubikey
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #96 from str4d/refactors-and-cleanups

Browse Source 
Refactors and cleanups
This commit is contained in:
str4d
2022-12-31 16:41:21 +00:00
committed by GitHub
parent d4f8993988 ac7b04a61d
commit 4d4d8cc183
7 changed files with 108 additions and 263 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/builder.rs
+2 -7
View File
@@ -1,7 +1,7 @@
use rand::{rngs::OsRng, RngCore}; use rand::{rngs::OsRng, RngCore};
use x509::RelativeDistinguishedName; use x509::RelativeDistinguishedName;
use yubikey::{ use yubikey::{
certificate::{Certificate, PublicKeyInfo}, certificate::Certificate,
piv::{generate as yubikey_generate, AlgorithmId, RetiredSlotId, SlotId}, piv::{generate as yubikey_generate, AlgorithmId, RetiredSlotId, SlotId},
Key, PinPolicy, TouchPolicy, YubiKey, Key, PinPolicy, TouchPolicy, YubiKey,
}; };
@@ -106,12 +106,7 @@ impl IdentityBuilder {
touch_policy, touch_policy,
)?; )?;
let recipient = match &generated { let recipient = Recipient::from_spki(&generated).expect("YubiKey generates a valid pubkey");
PublicKeyInfo::EcP256(pubkey) => {
Recipient::from_encoded(pubkey).expect("YubiKey generates a valid pubkey")
}
_ => unreachable!(),
};
let stub = Stub::new(yubikey.serial(), slot, &recipient); let stub = Stub::new(yubikey.serial(), slot, &recipient);
// Pick a random serial for the new self-signed certificate. // Pick a random serial for the new self-signed certificate.
src/error.rs
+37 -128
View File
@@ -1,4 +1,3 @@
use i18n_embed_fl::fl;
use std::fmt; use std::fmt;
use std::io; use std::io;
use yubikey::{piv::RetiredSlotId, Serial}; use yubikey::{piv::RetiredSlotId, Serial};
@@ -9,6 +8,9 @@ macro_rules! wlnfl {
($f:ident, $message_id:literal) => { ($f:ident, $message_id:literal) => {
writeln!($f, "{}", $crate::fl!($message_id)) writeln!($f, "{}", $crate::fl!($message_id))
}; };
($f:ident, $message_id:literal, $($kwarg:expr),* $(,)*) => {{
writeln!($f, "{}", $crate::fl!($message_id, $($kwarg,)*))
}};
} }
pub enum Error { pub enum Error {
@@ -52,105 +54,44 @@ impl fmt::Debug for Error {
wlnfl!(f, "err-custom-mgmt-key")?; wlnfl!(f, "err-custom-mgmt-key")?;
let cmd = "ykman piv access change-management-key --protect"; let cmd = "ykman piv access change-management-key --protect";
let url = "https://developers.yubico.com/yubikey-manager/"; let url = "https://developers.yubico.com/yubikey-manager/";
writeln!( wlnfl!(f, "rec-custom-mgmt-key", cmd = cmd, url = url)?;
f,
"{}",
fl!(
crate::LANGUAGE_LOADER,
"rec-custom-mgmt-key",
cmd = cmd,
url = url,
),
)?;
} }
Error::InvalidFlagCommand(flag, command) => writeln!( Error::InvalidFlagCommand(flag, command) => wlnfl!(
f, f,
"{}", "err-invalid-flag-command",
fl!( flag = flag.as_str(),
crate::LANGUAGE_LOADER, command = command.as_str(),
"err-invalid-flag-command",
flag = flag.as_str(),
command = command.as_str(),
),
)?,
Error::InvalidFlagTui(flag) => writeln!(
f,
"{}",
fl!(
crate::LANGUAGE_LOADER,
"err-invalid-flag-tui",
flag = flag.as_str(),
),
)?, )?,
Error::InvalidFlagTui(flag) => wlnfl!(f, "err-invalid-flag-tui", flag = flag.as_str())?,
Error::InvalidPinLength => wlnfl!(f, "err-invalid-pin-length")?, Error::InvalidPinLength => wlnfl!(f, "err-invalid-pin-length")?,
Error::InvalidPinPolicy(s) => writeln!( Error::InvalidPinPolicy(s) => wlnfl!(
f, f,
"{}", "err-invalid-pin-policy",
fl!( policy = s.as_str(),
crate::LANGUAGE_LOADER, expected = "always, once, never",
"err-invalid-pin-policy",
policy = s.as_str(),
expected = "always, once, never",
),
)?, )?,
Error::InvalidSlot(slot) => writeln!( Error::InvalidSlot(slot) => wlnfl!(f, "err-invalid-slot", slot = slot)?,
Error::InvalidTouchPolicy(s) => wlnfl!(
f, f,
"{}", "err-invalid-touch-policy",
fl!(crate::LANGUAGE_LOADER, "err-invalid-slot", slot = slot), policy = s.as_str(),
)?, expected = "always, cached, never",
Error::InvalidTouchPolicy(s) => writeln!(
f,
"{}",
fl!(
crate::LANGUAGE_LOADER,
"err-invalid-touch-policy",
policy = s.as_str(),
expected = "always, cached, never",
),
)?,
Error::Io(e) => writeln!(
f,
"{}",
fl!(crate::LANGUAGE_LOADER, "err-io", err = e.to_string()),
)?, )?,
Error::Io(e) => wlnfl!(f, "err-io", err = e.to_string())?,
Error::MultipleCommands => wlnfl!(f, "err-multiple-commands")?, Error::MultipleCommands => wlnfl!(f, "err-multiple-commands")?,
Error::MultipleYubiKeys => wlnfl!(f, "err-multiple-yubikeys")?, Error::MultipleYubiKeys => wlnfl!(f, "err-multiple-yubikeys")?,
Error::NoEmptySlots(serial) => writeln!( Error::NoEmptySlots(serial) => {
f, wlnfl!(f, "err-no-empty-slots", serial = serial.to_string())?
"{}", }
fl!( Error::NoMatchingSerial(serial) => {
crate::LANGUAGE_LOADER, wlnfl!(f, "err-no-matching-serial", serial = serial.to_string())?
"err-no-empty-slots", }
serial = serial.to_string(), Error::SlotHasNoIdentity(slot) => {
), wlnfl!(f, "err-slot-has-no-identity", slot = slot_to_ui(slot))?
)?, }
Error::NoMatchingSerial(serial) => writeln!( Error::SlotIsNotEmpty(slot) => {
f, wlnfl!(f, "err-slot-is-not-empty", slot = slot_to_ui(slot))?
"{}", }
fl!(
crate::LANGUAGE_LOADER,
"err-no-matching-serial",
serial = serial.to_string(),
),
)?,
Error::SlotHasNoIdentity(slot) => writeln!(
f,
"{}",
fl!(
crate::LANGUAGE_LOADER,
"err-slot-has-no-identity",
slot = slot_to_ui(slot),
),
)?,
Error::SlotIsNotEmpty(slot) => writeln!(
f,
"{}",
fl!(
crate::LANGUAGE_LOADER,
"err-slot-is-not-empty",
slot = slot_to_ui(slot),
),
)?,
Error::TimedOut => wlnfl!(f, "err-timed-out")?, Error::TimedOut => wlnfl!(f, "err-timed-out")?,
Error::UseListForSingleSlot => wlnfl!(f, "err-use-list-for-single")?, Error::UseListForSingleSlot => wlnfl!(f, "err-use-list-for-single")?,
Error::YubiKey(e) => match e { Error::YubiKey(e) => match e {
@@ -161,55 +102,23 @@ impl fmt::Debug for Error {
if cfg!(windows) { if cfg!(windows) {
wlnfl!(f, "err-yk-no-service-win")?; wlnfl!(f, "err-yk-no-service-win")?;
let url = "https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-debugging-information#smart-card-service"; let url = "https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-debugging-information#smart-card-service";
writeln!( wlnfl!(f, "rec-yk-no-service-win", url = url)?;
f,
"{}",
fl!(crate::LANGUAGE_LOADER, "rec-yk-no-service-win", url = url),
)?;
} else if cfg!(target_os = "macos") { } else if cfg!(target_os = "macos") {
wlnfl!(f, "err-yk-no-service-macos")?; wlnfl!(f, "err-yk-no-service-macos")?;
let url = "https://apple.stackexchange.com/a/438198"; let url = "https://apple.stackexchange.com/a/438198";
writeln!( wlnfl!(f, "rec-yk-no-service-macos", url = url)?;
f,
"{}",
fl!(crate::LANGUAGE_LOADER, "rec-yk-no-service-macos", url = url),
)?;
} else { } else {
wlnfl!(f, "err-yk-no-service-pcscd")?; wlnfl!(f, "err-yk-no-service-pcscd")?;
let apt = "sudo apt-get install pcscd"; let apt = "sudo apt-get install pcscd";
writeln!( wlnfl!(f, "rec-yk-no-service-pcscd", apt = apt)?;
f,
"{}",
fl!(crate::LANGUAGE_LOADER, "rec-yk-no-service-pcscd", apt = apt),
)?;
} }
} }
yubikey::Error::WrongPin { tries } => writeln!( yubikey::Error::WrongPin { tries } => wlnfl!(f, "err-yk-wrong-pin", tries = tries)?,
f,
"{}",
fl!(crate::LANGUAGE_LOADER, "err-yk-wrong-pin", tries = tries),
)?,
e => { e => {
writeln!( wlnfl!(f, "err-yk-general", err = e.to_string())?;
f,
"{}",
fl!(
crate::LANGUAGE_LOADER,
"err-yk-general",
err = e.to_string(),
),
)?;
use std::error::Error; use std::error::Error;
if let Some(inner) = e.source() { if let Some(inner) = e.source() {
writeln!( wlnfl!(f, "err-yk-general-cause", inner_err = inner.to_string())?;
f,
"{}",
fl!(
crate::LANGUAGE_LOADER,
"err-yk-general-cause",
inner_err = inner.to_string(),
),
)?;
} }
} }
}, },
src/key.rs
+19 -47
View File
@@ -15,7 +15,7 @@ use std::iter;
use std::thread::sleep; use std::thread::sleep;
use std::time::{Duration, Instant, SystemTime}; use std::time::{Duration, Instant, SystemTime};
use yubikey::{ use yubikey::{
certificate::{Certificate, PublicKeyInfo}, certificate::Certificate,
piv::{decrypt_data, AlgorithmId, RetiredSlotId, SlotId}, piv::{decrypt_data, AlgorithmId, RetiredSlotId, SlotId},
reader::{Context, Reader}, reader::{Context, Reader},
MgmKey, PinPolicy, Serial, TouchPolicy, YubiKey, MgmKey, PinPolicy, Serial, TouchPolicy, YubiKey,
@@ -47,11 +47,7 @@ pub(crate) fn filter_connected(reader: &Reader) -> bool {
{ {
warn!( warn!(
"{}", "{}",
i18n_embed_fl::fl!( fl!("warn-yk-not-connected", yubikey_name = reader.name())
crate::LANGUAGE_LOADER,
"warn-yk-not-connected",
yubikey_name = reader.name(),
)
); );
false false
} else { } else {
@@ -147,11 +143,7 @@ pub(crate) fn open(serial: Option<Serial>) -> Result<YubiKey, Error> {
if let Some(serial) = serial { if let Some(serial) = serial {
eprintln!( eprintln!(
"{}", "{}",
i18n_embed_fl::fl!( fl!("open-yk-with-serial", yubikey_serial = serial.to_string())
crate::LANGUAGE_LOADER,
"open-yk-with-serial",
yubikey_serial = serial.to_string(),
)
); );
} else { } else {
eprintln!("{}", fl!("open-yk-without-serial")); eprintln!("{}", fl!("open-yk-without-serial"));
@@ -196,8 +188,7 @@ pub(crate) fn manage(yubikey: &mut YubiKey) -> Result<(), Error> {
eprintln!(); eprintln!();
let pin = Password::new() let pin = Password::new()
.with_prompt(i18n_embed_fl::fl!( .with_prompt(fl!(
crate::LANGUAGE_LOADER,
"mgr-enter-pin", "mgr-enter-pin",
yubikey_serial = yubikey.serial().to_string(), yubikey_serial = yubikey.serial().to_string(),
default_pin = DEFAULT_PIN, default_pin = DEFAULT_PIN,
@@ -211,11 +202,7 @@ pub(crate) fn manage(yubikey: &mut YubiKey) -> Result<(), Error> {
eprintln!("{}", fl!("mgr-change-default-pin")); eprintln!("{}", fl!("mgr-change-default-pin"));
eprintln!(); eprintln!();
let current_puk = Password::new() let current_puk = Password::new()
.with_prompt(i18n_embed_fl::fl!( .with_prompt(fl!("mgr-enter-current-puk", default_puk = DEFAULT_PUK))
crate::LANGUAGE_LOADER,
"mgr-enter-current-puk",
default_puk = DEFAULT_PUK,
))
.interact()?; .interact()?;
let new_pin = Password::new() let new_pin = Password::new()
.with_prompt(fl!("mgr-choose-new-pin")) .with_prompt(fl!("mgr-choose-new-pin"))
@@ -244,8 +231,7 @@ pub(crate) fn manage(yubikey: &mut YubiKey) -> Result<(), Error> {
mgm_key.set_protected(yubikey).map_err(|e| { mgm_key.set_protected(yubikey).map_err(|e| {
eprintln!( eprintln!(
"{}", "{}",
i18n_embed_fl::fl!( fl!(
crate::LANGUAGE_LOADER,
"mgr-changing-mgmt-key-error", "mgr-changing-mgmt-key-error",
management_key = hex::encode(mgm_key.as_ref()), management_key = hex::encode(mgm_key.as_ref()),
) )
@@ -340,11 +326,7 @@ impl Stub {
let mut yubikey = match open_by_serial(self.serial) { let mut yubikey = match open_by_serial(self.serial) {
Ok(yk) => yk, Ok(yk) => yk,
Err(yubikey::Error::NotFound) => { Err(yubikey::Error::NotFound) => {
let mut message = i18n_embed_fl::fl!( let mut message = fl!("plugin-insert-yk", yubikey_serial = self.serial.to_string());
crate::LANGUAGE_LOADER,
"plugin-insert-yk",
yubikey_serial = self.serial.to_string(),
);
// If the `confirm` command is available, we loop until either the YubiKey // If the `confirm` command is available, we loop until either the YubiKey
// we want is inserted, or the used explicitly skips. // we want is inserted, or the used explicitly skips.
@@ -365,8 +347,7 @@ impl Stub {
Err(_) => { Err(_) => {
return Ok(Err(identity::Error::Identity { return Ok(Err(identity::Error::Identity {
index: self.identity_index, index: self.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-yk-opening", "plugin-err-yk-opening",
yubikey_serial = self.serial.to_string(), yubikey_serial = self.serial.to_string(),
), ),
@@ -377,8 +358,7 @@ impl Stub {
Err(age_core::plugin::Error::Fail) => { Err(age_core::plugin::Error::Fail) => {
return Ok(Err(identity::Error::Identity { return Ok(Err(identity::Error::Identity {
index: self.identity_index, index: self.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-yk-opening", "plugin-err-yk-opening",
yubikey_serial = self.serial.to_string(), yubikey_serial = self.serial.to_string(),
), ),
@@ -388,8 +368,7 @@ impl Stub {
// We're going to loop around, meaning that the first attempt failed. // We're going to loop around, meaning that the first attempt failed.
// Change the message to indicate this to the user. // Change the message to indicate this to the user.
message = i18n_embed_fl::fl!( message = fl!(
crate::LANGUAGE_LOADER,
"plugin-insert-yk-retry", "plugin-insert-yk-retry",
yubikey_serial = self.serial.to_string(), yubikey_serial = self.serial.to_string(),
); );
@@ -402,8 +381,7 @@ impl Stub {
if callbacks.message(&message)?.is_err() { if callbacks.message(&message)?.is_err() {
return Ok(Err(identity::Error::Identity { return Ok(Err(identity::Error::Identity {
index: self.identity_index, index: self.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-yk-not-found", "plugin-err-yk-not-found",
yubikey_serial = self.serial.to_string(), yubikey_serial = self.serial.to_string(),
), ),
@@ -419,8 +397,7 @@ impl Stub {
Err(_) => { Err(_) => {
return Ok(Err(identity::Error::Identity { return Ok(Err(identity::Error::Identity {
index: self.identity_index, index: self.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-yk-opening", "plugin-err-yk-opening",
yubikey_serial = self.serial.to_string(), yubikey_serial = self.serial.to_string(),
), ),
@@ -432,8 +409,7 @@ impl Stub {
Ok(end) if end >= FIFTEEN_SECONDS => { Ok(end) if end >= FIFTEEN_SECONDS => {
return Ok(Err(identity::Error::Identity { return Ok(Err(identity::Error::Identity {
index: self.identity_index, index: self.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-yk-timed-out", "plugin-err-yk-timed-out",
yubikey_serial = self.serial.to_string(), yubikey_serial = self.serial.to_string(),
), ),
@@ -447,8 +423,7 @@ impl Stub {
Err(_) => { Err(_) => {
return Ok(Err(identity::Error::Identity { return Ok(Err(identity::Error::Identity {
index: self.identity_index, index: self.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-yk-opening", "plugin-err-yk-opening",
yubikey_serial = self.serial.to_string(), yubikey_serial = self.serial.to_string(),
), ),
@@ -459,11 +434,10 @@ impl Stub {
// Read the pubkey from the YubiKey slot and check it still matches. // Read the pubkey from the YubiKey slot and check it still matches.
let (cert, pk) = match Certificate::read(&mut yubikey, SlotId::Retired(self.slot)) let (cert, pk) = match Certificate::read(&mut yubikey, SlotId::Retired(self.slot))
.ok() .ok()
.and_then(|cert| match cert.subject_pki() { .and_then(|cert| {
PublicKeyInfo::EcP256(pubkey) => Recipient::from_encoded(pubkey) Recipient::from_certificate(&cert)
.filter(|pk| pk.tag() == self.tag) .filter(|pk| pk.tag() == self.tag)
.map(|pk| (cert, pk)), .map(|pk| (cert, pk))
_ => None,
}) { }) {
Some(pk) => pk, Some(pk) => pk,
None => { None => {
@@ -528,8 +502,7 @@ impl Connection {
// The policy requires a PIN, so request it. // The policy requires a PIN, so request it.
// Note that we can't distinguish between PinPolicy::Once and PinPolicy::Always // Note that we can't distinguish between PinPolicy::Once and PinPolicy::Always
// because this plugin is ephemeral, so we always request the PIN. // because this plugin is ephemeral, so we always request the PIN.
let enter_pin_msg = i18n_embed_fl::fl!( let enter_pin_msg = fl!(
crate::LANGUAGE_LOADER,
"plugin-enter-pin", "plugin-enter-pin",
yubikey_serial = self.yubikey.serial().to_string(), yubikey_serial = self.yubikey.serial().to_string(),
); );
@@ -555,8 +528,7 @@ impl Connection {
Err(_) => { Err(_) => {
return Ok(Err(identity::Error::Identity { return Ok(Err(identity::Error::Identity {
index: self.identity_index, index: self.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-pin-required", "plugin-err-pin-required",
yubikey_serial = self.yubikey.serial().to_string(), yubikey_serial = self.yubikey.serial().to_string(),
), ),
src/main.rs
+31 -66
View File
@@ -13,7 +13,6 @@ use i18n_embed::{
use lazy_static::lazy_static; use lazy_static::lazy_static;
use rust_embed::RustEmbed; use rust_embed::RustEmbed;
use yubikey::{ use yubikey::{
certificate::PublicKeyInfo,
piv::{RetiredSlotId, SlotId}, piv::{RetiredSlotId, SlotId},
reader::Context, reader::Context,
Key, PinPolicy, Serial, TouchPolicy, Key, PinPolicy, Serial, TouchPolicy,
@@ -73,6 +72,9 @@ macro_rules! fl {
($message_id:literal) => {{ ($message_id:literal) => {{
i18n_embed_fl::fl!($crate::LANGUAGE_LOADER, $message_id) i18n_embed_fl::fl!($crate::LANGUAGE_LOADER, $message_id)
}}; }};
($message_id:literal, $($kwarg:expr),* $(,)*) => {{
i18n_embed_fl::fl!($crate::LANGUAGE_LOADER, $message_id, $($kwarg,)*)
}};
} }
#[derive(Debug, Options)] #[derive(Debug, Options)]
@@ -196,9 +198,9 @@ fn print_single(
let mut keys = Key::list(&mut yubikey)?.into_iter().filter_map(|key| { let mut keys = Key::list(&mut yubikey)?.into_iter().filter_map(|key| {
// - We only use the retired slots. // - We only use the retired slots.
// - Only P-256 keys are compatible with us. // - Only P-256 keys are compatible with us.
match (key.slot(), key.certificate().subject_pki()) { match key.slot() {
(SlotId::Retired(slot), PublicKeyInfo::EcP256(pubkey)) => { SlotId::Retired(slot) => {
p256::Recipient::from_encoded(pubkey).map(|r| (key, slot, r)) p256::Recipient::from_certificate(key.certificate()).map(|r| (key, slot, r))
} }
_ => None, _ => None,
} }
@@ -244,12 +246,9 @@ fn print_multiple(
}; };
// Only P-256 keys are compatible with us. // Only P-256 keys are compatible with us.
let recipient = match key.certificate().subject_pki() { let recipient = match p256::Recipient::from_certificate(key.certificate()) {
PublicKeyInfo::EcP256(pubkey) => match p256::Recipient::from_encoded(pubkey) { Some(recipient) => recipient,
Some(recipient) => recipient, None => continue,
None => continue,
},
_ => continue,
}; };
let stub = key::Stub::new(yubikey.serial(), slot, &recipient); let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
@@ -268,15 +267,7 @@ fn print_multiple(
println!(); println!();
} }
if printed > 1 { if printed > 1 {
eprintln!( eprintln!("{}", fl!("printed-multiple", kind = kind, count = printed));
"{}",
i18n_embed_fl::fl!(
LANGUAGE_LOADER,
"printed-multiple",
kind = kind,
count = printed,
)
);
} }
Ok(()) Ok(())
@@ -382,8 +373,7 @@ fn main() -> Result<(), Error> {
eprintln!( eprintln!(
"{}", "{}",
i18n_embed_fl::fl!( fl!(
LANGUAGE_LOADER,
"cli-setup-intro", "cli-setup-intro",
generate_usage = "age-plugin-yubikey --generate", generate_usage = "age-plugin-yubikey --generate",
) )
@@ -402,8 +392,7 @@ fn main() -> Result<(), Error> {
.iter() .iter()
.map(|reader| { .map(|reader| {
key::open_connection(reader).map(|yk| { key::open_connection(reader).map(|yk| {
i18n_embed_fl::fl!( fl!(
LANGUAGE_LOADER,
"cli-setup-yk-name", "cli-setup-yk-name",
yubikey_name = reader.name(), yubikey_name = reader.name(),
yubikey_serial = yk.serial().to_string(), yubikey_serial = yk.serial().to_string(),
@@ -429,20 +418,17 @@ fn main() -> Result<(), Error> {
.map(|&slot| { .map(|&slot| {
keys.iter() keys.iter()
.find(|key| key.slot() == SlotId::Retired(slot)) .find(|key| key.slot() == SlotId::Retired(slot))
.map(|key| match key.certificate().subject_pki() { .map(|key| {
PublicKeyInfo::EcP256(pubkey) => { p256::Recipient::from_certificate(key.certificate()).map(|_| {
p256::Recipient::from_encoded(pubkey).map(|_| { // Cache the details we need to display to the user.
// Cache the details we need to display to the user. let (_, cert) =
let (_, cert) = x509_parser::parse_x509_certificate(key.certificate().as_ref())
x509_parser::parse_x509_certificate(key.certificate().as_ref()) .unwrap();
.unwrap(); let (name, _) = util::extract_name(&cert, true).unwrap();
let (name, _) = util::extract_name(&cert, true).unwrap(); let created = cert.validity().not_before.to_rfc2822();
let created = cert.validity().not_before.to_rfc2822();
format!("{}, created: {}", name, created) format!("{}, created: {}", name, created)
}) })
}
_ => None,
}) })
}) })
.collect(); .collect();
@@ -455,20 +441,13 @@ fn main() -> Result<(), Error> {
let i = i + 1; let i = i + 1;
match occupied { match occupied {
Some(Some(name)) => i18n_embed_fl::fl!( Some(Some(name)) => fl!(
LANGUAGE_LOADER,
"cli-setup-slot-usable", "cli-setup-slot-usable",
slot_index = i, slot_index = i,
slot_name = name.as_str(), slot_name = name.as_str(),
), ),
Some(None) => i18n_embed_fl::fl!( Some(None) => fl!("cli-setup-slot-unusable", slot_index = i),
LANGUAGE_LOADER, None => fl!("cli-setup-slot-empty", slot_index = i),
"cli-setup-slot-unusable",
slot_index = i,
),
None => {
i18n_embed_fl::fl!(LANGUAGE_LOADER, "cli-setup-slot-empty", slot_index = i)
}
} }
}) })
.collect(); .collect();
@@ -492,19 +471,11 @@ fn main() -> Result<(), Error> {
}; };
if let Some(key) = keys.iter().find(|key| key.slot() == SlotId::Retired(slot)) { if let Some(key) = keys.iter().find(|key| key.slot() == SlotId::Retired(slot)) {
let recipient = match key.certificate().subject_pki() { let recipient = p256::Recipient::from_certificate(key.certificate())
PublicKeyInfo::EcP256(pubkey) => { .expect("We checked this above");
p256::Recipient::from_encoded(pubkey).expect("We checked this above")
}
_ => unreachable!(),
};
if Confirm::new() if Confirm::new()
.with_prompt(i18n_embed_fl::fl!( .with_prompt(fl!("cli-setup-use-existing", slot_index = slot_index))
LANGUAGE_LOADER,
"cli-setup-use-existing",
slot_index = slot_index,
))
.interact()? .interact()?
{ {
let stub = key::Stub::new(yubikey.serial(), slot, &recipient); let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
@@ -576,11 +547,7 @@ fn main() -> Result<(), Error> {
}; };
if Confirm::new() if Confirm::new()
.with_prompt(i18n_embed_fl::fl!( .with_prompt(fl!("cli-setup-generate-new", slot_index = slot_index))
LANGUAGE_LOADER,
"cli-setup-generate-new",
slot_index = slot_index,
))
.interact()? .interact()?
{ {
eprintln!(); eprintln!();
@@ -632,8 +599,7 @@ fn main() -> Result<(), Error> {
writeln!( writeln!(
file, file,
"{}", "{}",
i18n_embed_fl::fl!( fl!(
LANGUAGE_LOADER,
"yubikey-identity", "yubikey-identity",
yubikey_metadata = metadata.to_string(), yubikey_metadata = metadata.to_string(),
recipient = recipient.to_string(), recipient = recipient.to_string(),
@@ -668,8 +634,7 @@ fn main() -> Result<(), Error> {
eprintln!(); eprintln!();
eprintln!( eprintln!(
"{}", "{}",
i18n_embed_fl::fl!( fl!(
LANGUAGE_LOADER,
"cli-setup-finished", "cli-setup-finished",
is_new = if is_new { "true" } else { "false" }, is_new = if is_new { "true" } else { "false" },
recipient = recipient.to_string(), recipient = recipient.to_string(),
src/p256.rs
+14 -1
View File
@@ -1,6 +1,8 @@
use bech32::{ToBase32, Variant}; use bech32::{ToBase32, Variant};
use p256::elliptic_curve::sec1::{FromEncodedPoint, ToEncodedPoint}; use p256::elliptic_curve::sec1::{FromEncodedPoint, ToEncodedPoint};
use sha2::{Digest, Sha256}; use sha2::{Digest, Sha256};
use yubikey::{certificate::PublicKeyInfo, Certificate};
use std::fmt; use std::fmt;
use crate::RECIPIENT_PREFIX; use crate::RECIPIENT_PREFIX;
@@ -42,11 +44,22 @@ impl Recipient {
} }
} }
pub(crate) fn from_certificate(cert: &Certificate) -> Option<Self> {
Self::from_spki(cert.subject_pki())
}
pub(crate) fn from_spki(spki: &PublicKeyInfo) -> Option<Self> {
match spki {
PublicKeyInfo::EcP256(pubkey) => Self::from_encoded(pubkey),
_ => None,
}
}
/// Attempts to parse a valid YubiKey recipient from its SEC-1 encoding. /// Attempts to parse a valid YubiKey recipient from its SEC-1 encoding.
/// ///
/// This accepts both compressed (as used by the plugin) and uncompressed (as used in /// This accepts both compressed (as used by the plugin) and uncompressed (as used in
/// the YubiKey certificate) encodings. /// the YubiKey certificate) encodings.
pub(crate) fn from_encoded(encoded: &p256::EncodedPoint) -> Option<Self> { fn from_encoded(encoded: &p256::EncodedPoint) -> Option<Self> {
p256::PublicKey::from_encoded_point(encoded).map(Recipient) p256::PublicKey::from_encoded_point(encoded).map(Recipient)
} }
src/plugin.rs
+1 -2
View File
@@ -71,8 +71,7 @@ impl RecipientPluginV1 for RecipientPlugin {
Ok(Some(conn)) => yk_recipients.push(conn.recipient().clone()), Ok(Some(conn)) => yk_recipients.push(conn.recipient().clone()),
Ok(None) => yk_errors.push(recipient::Error::Identity { Ok(None) => yk_errors.push(recipient::Error::Identity {
index: stub.identity_index, index: stub.identity_index,
message: i18n_embed_fl::fl!( message: fl!(
crate::LANGUAGE_LOADER,
"plugin-err-yk-opening", "plugin-err-yk-opening",
yubikey_serial = stub.serial.to_string(), yubikey_serial = stub.serial.to_string(),
), ),
src/util.rs
+4 -12
View File
@@ -180,8 +180,7 @@ impl fmt::Display for Metadata {
write!( write!(
f, f,
"{}", "{}",
i18n_embed_fl::fl!( fl!(
crate::LANGUAGE_LOADER,
"yubikey-metadata", "yubikey-metadata",
serial = self.serial.to_string(), serial = self.serial.to_string(),
slot = slot_to_ui(&self.slot), slot = slot_to_ui(&self.slot),
@@ -197,20 +196,13 @@ impl fmt::Display for Metadata {
pub(crate) fn print_identity(stub: Stub, recipient: Recipient, metadata: Metadata) { pub(crate) fn print_identity(stub: Stub, recipient: Recipient, metadata: Metadata) {
let recipient = recipient.to_string(); let recipient = recipient.to_string();
if !console::user_attended() { if !console::user_attended() {
eprintln!( let recipient = recipient.as_str();
"{}", eprintln!("{}", fl!("print-recipient", recipient = recipient));
i18n_embed_fl::fl!(
crate::LANGUAGE_LOADER,
"print-recipient",
recipient = recipient.as_str(),
)
);
} }
println!( println!(
"{}", "{}",
i18n_embed_fl::fl!( fl!(
crate::LANGUAGE_LOADER,
"yubikey-identity", "yubikey-identity",
yubikey_metadata = metadata.to_string(), yubikey_metadata = metadata.to_string(),
recipient = recipient, recipient = recipient,