mirror of
https://github.com/morgan9e/systemd
synced 2026-04-15 00:47:10 +09:00
e262205eb7
systemd-cryptsetup supports a FIDO2 mode with manual parameters, where the user provides all the information necessary for recreating the secret, such as: credential ID, relaying party ID and the salt. This feature works great for implementing 2FA schemes, where the salt file is for example a secret unsealed from the TPM or some other source. While the unlocking part is quite straightforward to set up, enrolling such a keyslot - not so easy. There is no clearly documented way on how to set this up and online resources are scarce on this topic too. By implementing a straightforward way to enroll such a keyslot directly from systemd-cryptenroll we streamline the enrollment process and reduce chances for user error when doing such things manually.
45 lines
1.8 KiB
C
45 lines
1.8 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
|
|
#include "fido2-util.h"
|
|
#include "fileio.h"
|
|
#include "libfido2-util.h"
|
|
#include "random-util.h"
|
|
|
|
int fido2_generate_salt(struct iovec *ret_salt) {
|
|
_cleanup_(iovec_done) struct iovec salt = {};
|
|
int r;
|
|
|
|
r = crypto_random_bytes_allocate_iovec(FIDO2_SALT_SIZE, &salt);
|
|
if (r < 0)
|
|
return log_error_errno(r, "Failed to generate FIDO2 salt: %m");
|
|
|
|
*ret_salt = TAKE_STRUCT(salt);
|
|
return 0;
|
|
}
|
|
|
|
int fido2_read_salt_file(const char *filename, uint64_t offset, const char *client, const char *node, struct iovec *ret_salt) {
|
|
_cleanup_(iovec_done_erase) struct iovec salt = {};
|
|
_cleanup_free_ char *bind_name = NULL;
|
|
int r;
|
|
|
|
/* If we read the salt via AF_UNIX, make the client recognizable */
|
|
if (asprintf(&bind_name, "@%" PRIx64"/%s-fido2-salt/%s", random_u64(), client, node) < 0)
|
|
return log_oom();
|
|
|
|
r = read_full_file_full(
|
|
AT_FDCWD, filename,
|
|
offset == 0 ? UINT64_MAX : offset,
|
|
/* size= */ FIDO2_SALT_SIZE,
|
|
READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE|
|
|
READ_FULL_FILE_CONNECT_SOCKET|READ_FULL_FILE_FAIL_WHEN_LARGER,
|
|
bind_name, (char**) &salt.iov_base, &salt.iov_len);
|
|
if (r == -E2BIG || (r >= 0 && salt.iov_len != FIDO2_SALT_SIZE))
|
|
return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL),
|
|
"FIDO2 salt file must contain exactly %u bytes.", FIDO2_SALT_SIZE);
|
|
if (r < 0)
|
|
return log_error_errno(r, "Reading FIDO2 salt file '%s' failed: %m", filename);
|
|
|
|
*ret_salt = TAKE_STRUCT(salt);
|
|
return 0;
|
|
}
|