Implement biometric-protected GPG unlock
This commit is contained in:
433
crates/storage/src/mobile_authentication.rs
Normal file
433
crates/storage/src/mobile_authentication.rs
Normal file
@@ -0,0 +1,433 @@
|
||||
//! Shared mobile authentication state; Swift only supplies input and presents results.
|
||||
|
||||
use std::{error::Error, fmt, sync::Mutex};
|
||||
|
||||
use crate::{
|
||||
authentication::{
|
||||
AuthenticationError, NativeAuthenticationHandle, NativeAuthenticationSession,
|
||||
},
|
||||
config::{Config, ConfigError},
|
||||
crypto::{CryptoError, KeyInfo, KeyStore, SecretProvider, SecretProviderError},
|
||||
repository::{EntryPath, Repository, RepositoryError, SecretBytes},
|
||||
secret_store::{SecretProtectionPolicy, SecretStoreError},
|
||||
};
|
||||
|
||||
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
||||
pub enum MobileAuthenticationErrorKind {
|
||||
PassphraseRequired,
|
||||
InvalidPassphrase,
|
||||
Cancelled,
|
||||
BiometryUnavailable,
|
||||
Configuration,
|
||||
KeyMaterial,
|
||||
Entry,
|
||||
SecureStorage,
|
||||
Expired,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Eq, PartialEq)]
|
||||
pub struct MobileAuthenticationError {
|
||||
kind: MobileAuthenticationErrorKind,
|
||||
title: String,
|
||||
detail: String,
|
||||
}
|
||||
|
||||
impl MobileAuthenticationError {
|
||||
pub fn kind(&self) -> MobileAuthenticationErrorKind {
|
||||
self.kind
|
||||
}
|
||||
|
||||
pub fn title(&self) -> &str {
|
||||
&self.title
|
||||
}
|
||||
|
||||
pub fn detail(&self) -> &str {
|
||||
&self.detail
|
||||
}
|
||||
|
||||
fn new(kind: MobileAuthenticationErrorKind, title: &str, detail: impl Into<String>) -> Self {
|
||||
Self {
|
||||
kind,
|
||||
title: title.to_owned(),
|
||||
detail: detail.into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn passphrase_required(detail: impl Into<String>) -> Self {
|
||||
Self::new(
|
||||
MobileAuthenticationErrorKind::PassphraseRequired,
|
||||
"Passphrase Required",
|
||||
detail,
|
||||
)
|
||||
}
|
||||
|
||||
fn authentication(error: AuthenticationError) -> Self {
|
||||
match error {
|
||||
AuthenticationError::Cancelled => Self::new(
|
||||
MobileAuthenticationErrorKind::Cancelled,
|
||||
"Authentication Cancelled",
|
||||
"No protected content was unlocked.",
|
||||
),
|
||||
AuthenticationError::Expired => Self::new(
|
||||
MobileAuthenticationErrorKind::Expired,
|
||||
"IronStorage Locked",
|
||||
"The authentication lease expired.",
|
||||
),
|
||||
AuthenticationError::SecretStore(SecretStoreError::Missing) => {
|
||||
Self::passphrase_required("Enter the GPG key passphrase to continue.")
|
||||
}
|
||||
AuthenticationError::SecretStore(
|
||||
SecretStoreError::Denied
|
||||
| SecretStoreError::UnsupportedProtection
|
||||
| SecretStoreError::Unavailable,
|
||||
) => Self::new(
|
||||
MobileAuthenticationErrorKind::BiometryUnavailable,
|
||||
"Biometric Unlock Unavailable",
|
||||
"Enter the GPG key passphrase to recover or continue without biometric unlock.",
|
||||
),
|
||||
error => Self::new(
|
||||
MobileAuthenticationErrorKind::SecureStorage,
|
||||
"Secure Unlock Failed",
|
||||
error.to_string(),
|
||||
),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl fmt::Display for MobileAuthenticationError {
|
||||
fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
|
||||
write!(formatter, "{}: {}", self.title, self.detail)
|
||||
}
|
||||
}
|
||||
|
||||
impl Error for MobileAuthenticationError {}
|
||||
|
||||
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
||||
pub struct MobileAuthenticationState {
|
||||
unlocked: bool,
|
||||
biometric_unlock_enabled: bool,
|
||||
remaining_seconds: u64,
|
||||
}
|
||||
|
||||
impl MobileAuthenticationState {
|
||||
pub fn unlocked(self) -> bool {
|
||||
self.unlocked
|
||||
}
|
||||
|
||||
pub fn biometric_unlock_enabled(self) -> bool {
|
||||
self.biometric_unlock_enabled
|
||||
}
|
||||
|
||||
pub fn remaining_seconds(self) -> u64 {
|
||||
self.remaining_seconds
|
||||
}
|
||||
}
|
||||
|
||||
struct ActiveMobileLease {
|
||||
handle: NativeAuthenticationHandle,
|
||||
key: KeyInfo,
|
||||
}
|
||||
|
||||
struct MobileAuthenticationStatus {
|
||||
biometric_unlock_enabled: bool,
|
||||
active: Option<ActiveMobileLease>,
|
||||
}
|
||||
|
||||
/// One process-wide mobile authentication lease shared by every tab and viewer.
|
||||
pub struct MobileAuthentication {
|
||||
config: Config,
|
||||
repository: Repository,
|
||||
keys: KeyStore,
|
||||
session: NativeAuthenticationSession,
|
||||
status: Mutex<MobileAuthenticationStatus>,
|
||||
}
|
||||
|
||||
impl MobileAuthentication {
|
||||
pub fn load() -> Result<Self, MobileAuthenticationError> {
|
||||
let config = Config::load(None).map_err(|error| {
|
||||
MobileAuthenticationError::new(
|
||||
MobileAuthenticationErrorKind::Configuration,
|
||||
"Authentication Is Unavailable",
|
||||
error.to_string(),
|
||||
)
|
||||
})?;
|
||||
let repository = Repository::open(config.vault()).map_err(entry_error)?;
|
||||
let keys = KeyStore::load(config.key_material()).map_err(key_error)?;
|
||||
let session = NativeAuthenticationSession::system(
|
||||
SecretProtectionPolicy::current_biometry_for_openpgp(),
|
||||
config.authentication_timeout(),
|
||||
)
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
Ok(Self {
|
||||
status: Mutex::new(MobileAuthenticationStatus {
|
||||
biometric_unlock_enabled: config.biometric_unlock_enabled(),
|
||||
active: None,
|
||||
}),
|
||||
config,
|
||||
repository,
|
||||
keys,
|
||||
session,
|
||||
})
|
||||
}
|
||||
|
||||
/// Validate an entry unlock and retain only the key passphrase for the shared lease.
|
||||
pub fn unlock_entry(
|
||||
&self,
|
||||
path: &str,
|
||||
passphrase: Option<SecretBytes>,
|
||||
) -> Result<MobileAuthenticationState, MobileAuthenticationError> {
|
||||
let entry = EntryPath::parse(path).map_err(entry_error)?;
|
||||
let ciphertext = self.repository.read_entry(&entry).map_err(entry_error)?;
|
||||
let candidates = self.keys.decrypting_keys(&ciphertext).map_err(key_error)?;
|
||||
|
||||
if let Some(active) = self.take_active()? {
|
||||
let mut provider = KeyOnlyProvider::new(active.handle.clone(), &active.key);
|
||||
if self.keys.decrypt(&ciphertext, &mut provider).is_ok() {
|
||||
self.restore_active(active)?;
|
||||
return self.state();
|
||||
}
|
||||
self.session
|
||||
.manual_lock()
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
}
|
||||
|
||||
let biometric_enabled = self.status()?.biometric_unlock_enabled;
|
||||
match passphrase {
|
||||
Some(passphrase) => {
|
||||
for key in &candidates {
|
||||
let candidate = SecretBytes::new(passphrase.expose().to_vec());
|
||||
let handle = self
|
||||
.session
|
||||
.authenticate_with_passphrase(key, candidate)
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
let mut provider = KeyOnlyProvider::new(handle.clone(), key);
|
||||
match self.keys.decrypt(&ciphertext, &mut provider) {
|
||||
Ok(plaintext) => {
|
||||
drop(plaintext);
|
||||
if biometric_enabled {
|
||||
handle
|
||||
.persist_passphrase(key)
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
}
|
||||
self.set_active(handle, key.clone())?;
|
||||
return self.state();
|
||||
}
|
||||
Err(CryptoError::DecryptionFailed) => {
|
||||
self.session
|
||||
.manual_lock()
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
}
|
||||
Err(error) => return Err(key_error(error)),
|
||||
}
|
||||
}
|
||||
Err(MobileAuthenticationError::new(
|
||||
MobileAuthenticationErrorKind::InvalidPassphrase,
|
||||
"Incorrect Passphrase",
|
||||
"The GPG key could not be unlocked.",
|
||||
))
|
||||
}
|
||||
None if biometric_enabled => {
|
||||
for key in &candidates {
|
||||
let handle = match self.session.authenticate(key) {
|
||||
Ok(handle) => handle,
|
||||
Err(AuthenticationError::Cancelled) => {
|
||||
return Err(MobileAuthenticationError::authentication(
|
||||
AuthenticationError::Cancelled,
|
||||
));
|
||||
}
|
||||
Err(_) => continue,
|
||||
};
|
||||
let mut provider = KeyOnlyProvider::new(handle.clone(), key);
|
||||
if let Ok(plaintext) = self.keys.decrypt(&ciphertext, &mut provider) {
|
||||
drop(plaintext);
|
||||
self.set_active(handle, key.clone())?;
|
||||
return self.state();
|
||||
}
|
||||
let _ = self.session.delete_key_passphrase(key);
|
||||
let _ = self.session.manual_lock();
|
||||
}
|
||||
Err(MobileAuthenticationError::passphrase_required(
|
||||
"Biometric unlock could not restore this key. Enter its GPG passphrase to recover.",
|
||||
))
|
||||
}
|
||||
None => Err(MobileAuthenticationError::passphrase_required(
|
||||
"Enter the GPG key passphrase to continue.",
|
||||
)),
|
||||
}
|
||||
}
|
||||
|
||||
pub fn set_biometric_unlock(
|
||||
&self,
|
||||
enabled: bool,
|
||||
) -> Result<MobileAuthenticationState, MobileAuthenticationError> {
|
||||
if enabled {
|
||||
let status = self.status()?;
|
||||
if status.biometric_unlock_enabled {
|
||||
drop(status);
|
||||
return self.state();
|
||||
}
|
||||
let active = status.active.as_ref().ok_or_else(|| {
|
||||
MobileAuthenticationError::passphrase_required(
|
||||
"Unlock a password entry before enabling biometric unlock.",
|
||||
)
|
||||
})?;
|
||||
active
|
||||
.handle
|
||||
.persist_passphrase(&active.key)
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
drop(status);
|
||||
if let Err(error) = self.config.update_biometric_unlock(true) {
|
||||
let _ = self.delete_all_key_passphrases();
|
||||
let _ = self.manual_lock();
|
||||
return Err(config_error(error));
|
||||
}
|
||||
self.status()?.biometric_unlock_enabled = true;
|
||||
} else {
|
||||
self.delete_all_key_passphrases()?;
|
||||
self.config
|
||||
.update_biometric_unlock(false)
|
||||
.map_err(config_error)?;
|
||||
self.session
|
||||
.manual_lock()
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
let mut status = self.status()?;
|
||||
status.biometric_unlock_enabled = false;
|
||||
status.active = None;
|
||||
}
|
||||
self.state()
|
||||
}
|
||||
|
||||
pub fn state(&self) -> Result<MobileAuthenticationState, MobileAuthenticationError> {
|
||||
let remaining = self
|
||||
.session
|
||||
.remaining_time()
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
let mut status = self.status()?;
|
||||
if remaining.is_none() {
|
||||
status.active = None;
|
||||
}
|
||||
Ok(MobileAuthenticationState {
|
||||
unlocked: status.active.is_some(),
|
||||
biometric_unlock_enabled: status.biometric_unlock_enabled,
|
||||
remaining_seconds: remaining.map_or(0, |duration| duration.as_secs()),
|
||||
})
|
||||
}
|
||||
|
||||
pub fn touch_user_activity(&self) -> Result<(), MobileAuthenticationError> {
|
||||
let status = self.status()?;
|
||||
let active = status.active.as_ref().ok_or_else(|| {
|
||||
MobileAuthenticationError::new(
|
||||
MobileAuthenticationErrorKind::Expired,
|
||||
"IronStorage Locked",
|
||||
"Authenticate before using protected content.",
|
||||
)
|
||||
})?;
|
||||
active
|
||||
.handle
|
||||
.touch_user_activity()
|
||||
.map_err(MobileAuthenticationError::authentication)
|
||||
}
|
||||
|
||||
pub fn manual_lock(&self) -> Result<(), MobileAuthenticationError> {
|
||||
self.session
|
||||
.manual_lock()
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
self.status()?.active = None;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn cancel(&self) -> Result<(), MobileAuthenticationError> {
|
||||
self.session
|
||||
.cancel()
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
self.status()?.active = None;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn delete_all_key_passphrases(&self) -> Result<(), MobileAuthenticationError> {
|
||||
for key in self.keys.infos().filter(KeyInfo::has_secret) {
|
||||
self.session
|
||||
.delete_key_passphrase(&key)
|
||||
.map_err(MobileAuthenticationError::authentication)?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn status(
|
||||
&self,
|
||||
) -> Result<std::sync::MutexGuard<'_, MobileAuthenticationStatus>, MobileAuthenticationError>
|
||||
{
|
||||
self.status.lock().map_err(|_| {
|
||||
MobileAuthenticationError::new(
|
||||
MobileAuthenticationErrorKind::SecureStorage,
|
||||
"Authentication Is Unavailable",
|
||||
"The shared authentication state is unavailable.",
|
||||
)
|
||||
})
|
||||
}
|
||||
|
||||
fn take_active(&self) -> Result<Option<ActiveMobileLease>, MobileAuthenticationError> {
|
||||
Ok(self.status()?.active.take())
|
||||
}
|
||||
|
||||
fn restore_active(&self, active: ActiveMobileLease) -> Result<(), MobileAuthenticationError> {
|
||||
self.status()?.active = Some(active);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn set_active(
|
||||
&self,
|
||||
handle: NativeAuthenticationHandle,
|
||||
key: KeyInfo,
|
||||
) -> Result<(), MobileAuthenticationError> {
|
||||
self.status()?.active = Some(ActiveMobileLease { handle, key });
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
struct KeyOnlyProvider<'a> {
|
||||
handle: NativeAuthenticationHandle,
|
||||
fingerprint: &'a str,
|
||||
}
|
||||
|
||||
impl<'a> KeyOnlyProvider<'a> {
|
||||
fn new(handle: NativeAuthenticationHandle, key: &'a KeyInfo) -> Self {
|
||||
Self {
|
||||
handle,
|
||||
fingerprint: key.fingerprint().as_str(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl SecretProvider for KeyOnlyProvider<'_> {
|
||||
fn secret_for(&mut self, key: &KeyInfo) -> Result<SecretBytes, SecretProviderError> {
|
||||
if key.fingerprint().as_str() != self.fingerprint {
|
||||
return Err(SecretProviderError::Missing);
|
||||
}
|
||||
self.handle.secret_for(key)
|
||||
}
|
||||
}
|
||||
|
||||
fn config_error(error: ConfigError) -> MobileAuthenticationError {
|
||||
MobileAuthenticationError::new(
|
||||
MobileAuthenticationErrorKind::Configuration,
|
||||
"Preference Was Not Saved",
|
||||
error.to_string(),
|
||||
)
|
||||
}
|
||||
|
||||
fn entry_error(error: RepositoryError) -> MobileAuthenticationError {
|
||||
MobileAuthenticationError::new(
|
||||
MobileAuthenticationErrorKind::Entry,
|
||||
"Password Entry Is Unavailable",
|
||||
error.to_string(),
|
||||
)
|
||||
}
|
||||
|
||||
fn key_error(error: CryptoError) -> MobileAuthenticationError {
|
||||
MobileAuthenticationError::new(
|
||||
MobileAuthenticationErrorKind::KeyMaterial,
|
||||
"GPG Key Unlock Failed",
|
||||
error.to_string(),
|
||||
)
|
||||
}
|
||||
Reference in New Issue
Block a user