Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Encrypt data on external flash #57

Merged
merged 18 commits into from
Oct 17, 2024
Merged

Encrypt data on external flash #57

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
5916b25
Associate an X25519 key to the user PIN
sosthene-nitrokey Jul 31, 2024
93c182c
Encrypt protected DOs
sosthene-nitrokey Aug 2, 2024
f72154b
Fix warnings
sosthene-nitrokey Aug 5, 2024
23394d8
This time for keys
sosthene-nitrokey Aug 23, 2024
0579bd0
Fix warnings
sosthene-nitrokey Aug 26, 2024
1303e3b
Fix memory leak
sosthene-nitrokey Aug 26, 2024
bd35b57
Fix key history object
sosthene-nitrokey Aug 26, 2024
4246003
Remove commented-out code
sosthene-nitrokey Aug 26, 2024
7f1783c
Fix clippy warnings
sosthene-nitrokey Sep 20, 2024
d4089da
Remove unused derp module
sosthene-nitrokey Sep 20, 2024
e48df62
Add test for signature with multiple keys (including unprotected ones)
sosthene-nitrokey Sep 20, 2024
649aef7
Add ecdh tests for multiple keys including unprotected ones
sosthene-nitrokey Sep 20, 2024
a59e6c8
Use up to date, rebased hpke extension
sosthene-nitrokey Sep 23, 2024
c8f31f1
Properly clear rather than delete keys
sosthene-nitrokey Sep 27, 2024
6cfab5e
Return error instead of crash when the PIN is wrong
sosthene-nitrokey Sep 27, 2024
82aed8b
Enable test suite to run on a hardware device
sosthene-nitrokey Sep 30, 2024
bc4f528
Update expectrl
sosthene-nitrokey Sep 30, 2024
e67a954
Release v0.3.8
robin-nitrokey Oct 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update expectrl
  • Loading branch information
@sosthene-nitrokey
sosthene-nitrokey committed Sep 30, 2024
commit bc4f5283eac08a1c9acbf793cdd9e9a2f2bdad65
2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ ron = "0.8"
des = "0.8"
aes = "0.8.2"
stoppable_thread = "0.2.1"
expectrl = "0.6.0"
expectrl = "0.7.0"
iso7816 = { version = "0.1.2", features = ["std"] }

# Examples
Expand Down
19 changes: 14 additions & 5 deletions tests/opensc.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,10 @@ fn list() {
.unwrap();
p.expect("Personal Identity Verification Card").unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);
};
cfg_if! {
if #[cfg(not(feature = "dangerous-test-real-card"))] {
Expand All @@ -48,7 +51,10 @@ fn admin_mutual() {
.unwrap();
// p.expect("Personal Identity Verification Card").unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);
};
cfg_if! {
if #[cfg(not(feature = "dangerous-test-real-card"))]{
Expand All @@ -75,7 +81,10 @@ fn admin_card() {
.unwrap();
p.expect("Personal Identity Verification Card").unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);
};
cfg_if! {
if #[cfg(not(feature = "dangerous-test-real-card"))]{
Expand All @@ -99,7 +108,7 @@ fn generate_key() {
// .unwrap();
// p.expect(Eof).unwrap();
// // Non zero exit code?
// assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 1));
// assert_eq!(p.get_process().wait().unwrap(), WaitStatus::Exited(p.get_process().pid(), 1));
// });
// cfg_if! {
// if #[cfg(not(feature = "dangerous-test-real-card"))]{
Expand All @@ -120,7 +129,7 @@ fn generate_key() {
// .unwrap();
// p.expect(Eof).unwrap();
// // Non zero exit code?
// assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 1));
// assert_eq!(p.get_process().wait().unwrap(), WaitStatus::Exited(p.get_process().pid(), 1));
// };
// cfg_if! {
// if #[cfg(not(feature = "dangerous-test-real-card"))]{
Expand Down
79 changes: 47 additions & 32 deletions tests/pivy.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,32 +15,31 @@ const CARD: &str = env!("PIV_DANGEROUS_TEST_CARD_READER");

const EXPECT_TIMEOUT: Option<Duration> = Some(Duration::from_secs(30));

// #[derive(Default)]
// struct LogWriter(Vec<u8>);
#[derive(Default)]
struct LogWriter(Vec<u8>);

// impl Write for LogWriter {
// fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
// self.0.write(buf)
// }
impl Write for LogWriter {
fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
self.0.write(buf)
}

// fn flush(&mut self) -> io::Result<()> {
// self.0.flush()
// }
// }
fn flush(&mut self) -> io::Result<()> {
self.0.flush()
}
}

// impl Drop for LogWriter {
// fn drop(&mut self) {
// io::stdout().write_all(&self.0).unwrap();
// }
// }
impl Drop for LogWriter {
fn drop(&mut self) {
io::stdout().write_all(&self.0).unwrap();
}
}

#[test_log::test]
fn list() {
let test = || {
let mut p = spawn("pivy-tool list")
// .unwrap()
// .with_log(LogWriter(Vec::new()))
.unwrap();
let mut logger = LogWriter(Vec::new());
let p = spawn("pivy-tool list").unwrap();
let mut p = expectrl::session::log(p, &mut logger).unwrap();
p.set_expect_timeout(EXPECT_TIMEOUT);
p.expect(Regex("card: [0-9A-Z]{8}")).unwrap();
p.expect(&format!("device: {CARD}")).unwrap();
Expand All @@ -49,7 +48,10 @@ fn list() {
p.expect("algos: 3DES AES256 ECCP256 (null) (null)")
.unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);
};
cfg_if! {
if #[cfg(not(feature = "dangerous-test-real-card"))]{
Expand All @@ -71,7 +73,10 @@ fn generate() {
))
.unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);
};
cfg_if! {
if #[cfg(not(feature = "dangerous-test-real-card"))]{
Expand All @@ -91,7 +96,10 @@ fn generate() {
))
.unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);
};
cfg_if! {
if #[cfg(not(feature = "dangerous-test-real-card"))]{
Expand All @@ -115,7 +123,10 @@ fn ecdh_inner(key: &str, requires_pin: bool) {
)))
.unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);

let mut p = Command::new("pivy-tool")
.args(if requires_pin {
Expand Down Expand Up @@ -162,11 +173,10 @@ fn ecdh_9e() {
fn sign_inner(key: &str, requires_pin: bool) {
#[cfg(feature = "rsa")]
let test_rsa = || {
let mut logger = LogWriter::default();
let mut p = spawn(format!("pivy-tool -A 3des -K 010203040506070801020304050607080102030405060708 generate {key} -a rsa2048 -P 123456"))
// .unwrap()
// .with_log(LogWriter(Vec::new()))
let mut logger = LogWriter(Vec::new());
let p = spawn(format!("pivy-tool -A 3des -K 010203040506070801020304050607080102030405060708 generate {key} -a rsa2048 -P 123456"))
.unwrap();
let mut p = expectrl::session::log(p, &mut logger).unwrap();
p.set_expect_timeout(EXPECT_TIMEOUT);
p.expect(Regex(&format!(
"{}{key}{}",
Expand All @@ -175,7 +185,10 @@ fn sign_inner(key: &str, requires_pin: bool) {
)))
.unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);

let mut p = Command::new("pivy-tool")
.args(if requires_pin {
Expand All @@ -196,14 +209,16 @@ fn sign_inner(key: &str, requires_pin: bool) {

let test_p256 = || {
let mut logger = LogWriter::default();
let mut p = spawn(format!("pivy-tool -A 3des -K 010203040506070801020304050607080102030405060708 generate {key} -a eccp256 -P 123456"))
// .unwrap()
// .with_log(LogWriter(Vec::new()))
let p = spawn(format!("pivy-tool -A 3des -K 010203040506070801020304050607080102030405060708 generate {key} -a eccp256 -P 123456"))
.unwrap();
let mut p = expectrl::session::log(p, &mut logger).unwrap();
p.set_expect_timeout(EXPECT_TIMEOUT);
p.expect(Regex(&format!("{}{key}{}","ecdsa-sha2-nistp256 (?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)? PIV_slot_", "@[A-F0-9]{20}"))).unwrap();
p.expect(Eof).unwrap();
assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
assert_eq!(
p.get_process().wait().unwrap(),
WaitStatus::Exited(p.get_process().pid(), 0)
);

let mut p = Command::new("pivy-tool")
.args(if requires_pin {
Expand Down