119 lines
3.8 KiB
Python
119 lines
3.8 KiB
Python
import getpass
|
|
from pathlib import Path
|
|
from typing import ClassVar
|
|
|
|
from archinstall.lib.command import SysCommand, SysCommandWorker
|
|
from archinstall.lib.exceptions import SysCallError
|
|
from archinstall.lib.models.device import Fido2Device
|
|
from archinstall.lib.models.users import Password
|
|
from archinstall.lib.output import error, info
|
|
from archinstall.lib.utils.encoding import clear_vt100_escape_codes_from_str
|
|
|
|
|
|
class Fido2:
|
|
_loaded_cryptsetup: bool = False
|
|
_loaded_u2f: bool = False
|
|
_cryptenroll_devices: ClassVar[list[Fido2Device]] = []
|
|
_u2f_devices: ClassVar[list[Fido2Device]] = []
|
|
|
|
@classmethod
|
|
def get_fido2_devices(cls) -> list[Fido2Device]:
|
|
"""
|
|
fido2-tool output example:
|
|
|
|
/dev/hidraw4: vendor=0x1050, product=0x0407 (Yubico YubiKey OTP+FIDO+CCID)
|
|
"""
|
|
|
|
if not cls._loaded_u2f:
|
|
cls._loaded_u2f = True
|
|
try:
|
|
ret = SysCommand('fido2-token -L').decode()
|
|
except Exception as e:
|
|
error(f'failed to read fido2 devices: {e}')
|
|
return []
|
|
|
|
fido_devices = clear_vt100_escape_codes_from_str(ret)
|
|
|
|
if not fido_devices:
|
|
return []
|
|
|
|
for line in fido_devices.splitlines():
|
|
path, details = line.replace(',', '').split(':', maxsplit=1)
|
|
_, product, manufacturer = details.strip().split(' ', maxsplit=2)
|
|
|
|
cls._u2f_devices.append(Fido2Device(Path(path.strip()), manufacturer.strip(), product.strip().split('=')[1]))
|
|
|
|
return cls._u2f_devices
|
|
|
|
@classmethod
|
|
def get_cryptenroll_devices(cls, reload: bool = False) -> list[Fido2Device]:
|
|
"""
|
|
Uses systemd-cryptenroll to list the FIDO2 devices
|
|
connected that supports FIDO2.
|
|
Some devices might show up in udevadm as FIDO2 compliant
|
|
when they are in fact not.
|
|
|
|
The drawback of systemd-cryptenroll is that it uses human readable format.
|
|
That means we get this weird table like structure that is of no use.
|
|
|
|
So we'll look for `MANUFACTURER` and `PRODUCT`, we take their index
|
|
and we split each line based on those positions.
|
|
|
|
Output example:
|
|
|
|
PATH MANUFACTURER PRODUCT
|
|
/dev/hidraw1 Yubico YubiKey OTP+FIDO+CCID
|
|
"""
|
|
|
|
# to prevent continuous reloading which will slow
|
|
# down moving the cursor in the menu
|
|
if not cls._loaded_cryptsetup or reload:
|
|
try:
|
|
ret = SysCommand('systemd-cryptenroll --fido2-device=list').decode()
|
|
except SysCallError:
|
|
error('fido2 support is most likely not installed')
|
|
raise ValueError('HSM devices can not be detected, is libfido2 installed?')
|
|
|
|
fido_devices = clear_vt100_escape_codes_from_str(ret)
|
|
|
|
manufacturer_pos = 0
|
|
product_pos = 0
|
|
devices = []
|
|
|
|
for line in fido_devices.split('\r\n'):
|
|
if '/dev' not in line:
|
|
manufacturer_pos = line.find('MANUFACTURER')
|
|
product_pos = line.find('PRODUCT')
|
|
continue
|
|
|
|
path = line[:manufacturer_pos].rstrip()
|
|
manufacturer = line[manufacturer_pos:product_pos].rstrip()
|
|
product = line[product_pos:]
|
|
|
|
devices.append(
|
|
Fido2Device(Path(path), manufacturer, product),
|
|
)
|
|
|
|
cls._loaded_cryptsetup = True
|
|
cls._cryptenroll_devices = devices
|
|
|
|
return cls._cryptenroll_devices
|
|
|
|
@staticmethod
|
|
def fido2_enroll(hsm_device: Fido2Device, dev_path: Path, password: Password) -> None:
|
|
worker = SysCommandWorker(f'systemd-cryptenroll --fido2-device={hsm_device.path} {dev_path}', peek_output=True)
|
|
pw_inputted = False
|
|
pin_inputted = False
|
|
|
|
info('You might need to touch the FIDO2 device to unlock it if no prompt comes up after 3 seconds')
|
|
|
|
while worker.is_alive():
|
|
if pw_inputted is False:
|
|
if bytes(f'please enter current passphrase for disk {dev_path}', 'UTF-8') in worker._trace_log.lower():
|
|
worker.write(bytes(password.plaintext, 'UTF-8'))
|
|
pw_inputted = True
|
|
elif pin_inputted is False:
|
|
if bytes('please enter security token pin', 'UTF-8') in worker._trace_log.lower():
|
|
worker.write(bytes(getpass.getpass(' '), 'UTF-8'))
|
|
pin_inputted = True
|