client: Use getrandom for generating a session secret

Share the same code as the portal key

Author: bilelmoussaoui

Cargo.lock

@@ -28,6 +28,7 @@ digest = { version = "0.10", optional = true }
 endi.workspace = true
 futures-lite = { workspace = true, optional = true }
 futures-util.workspace = true
+getrandom = "0.2"
 hkdf = { version = "0.12", optional = true }
 hmac = { version = "0.12", optional = true }
 md-5 = { version = "0.10", optional = true }

client/Cargo.toml

@@ -1,8 +1,7 @@
-use rand::Rng;
 use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
 
 /// A safe wrapper around a combination of (secret, content-type).
-#[derive(Debug, Zeroize, ZeroizeOnDrop)]
+#[derive(Debug, Clone, Zeroize, ZeroizeOnDrop)]
 pub enum Secret {
     /// Corresponds to `text/plain`
     Text(String),
@@ -12,8 +11,12 @@ pub enum Secret {
 
 impl Secret {
     /// Generate a random secret, used when creating a session collection.
-    pub fn random() -> Self {
-        Self::Blob(rand::thread_rng().gen::<[u8; 8]>().to_vec())
+    pub fn random() -> Result<Self, getrandom::Error> {
+        let mut secret = [0; 64];
+        // Equivalent of `ring::rand::SecureRandom`
+        getrandom::getrandom(&mut secret)?;
+
+        Ok(Self::blob(secret))
     }
 
     /// Create a text secret, stored with `text/plain` content type.

client/src/secret.rs

@@ -15,7 +15,6 @@ version.workspace = true
 ashpd = {workspace = true, features = ["backend", "tracing"]}
 clap.workspace = true
 oo7.workspace = true
-getrandom = "0.2"
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
 tracing.workspace = true
 tracing-subscriber.workspace = true

portal/Cargo.toml

@@ -1,6 +1,5 @@
 #[derive(Debug)]
 pub enum Error {
-    Rand(getrandom::Error),
     Oo7(oo7::dbus::Error),
     Io(std::io::Error),
     Portal(ashpd::PortalError),
@@ -9,7 +8,6 @@ pub enum Error {
 impl std::fmt::Display for Error {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
-            Error::Rand(e) => f.write_fmt(format_args!("Rand error {e}")),
             Error::Oo7(e) => f.write_fmt(format_args!("DBus error: {e}")),
             Error::Io(e) => f.write_fmt(format_args!("IO error: {e}")),
             Error::Portal(e) => f.write_fmt(format_args!("Portal error: {e}")),
@@ -20,20 +18,13 @@ impl std::fmt::Display for Error {
 impl std::error::Error for Error {
     fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
         match self {
-            Self::Rand(_) => None,
             Self::Oo7(e) => Some(e),
             Self::Io(e) => Some(e),
             Self::Portal(e) => Some(e),
         }
     }
 }
 
-impl From<getrandom::Error> for Error {
-    fn from(err: getrandom::Error) -> Self {
-        Self::Rand(err)
-    }
-}
-
 impl From<oo7::dbus::Error> for Error {
     fn from(value: oo7::dbus::Error) -> Self {
         Self::Oo7(value)

portal/src/error.rs

@@ -11,7 +11,6 @@ pub use error::Result;
 use oo7::dbus::Service;
 use tokio::io::AsyncWriteExt;
 
-const PORTAL_SECRET_SIZE: usize = 64;
 const PORTAL_NAME: &str = "org.freedesktop.impl.portal.desktop.oo7";
 
 struct Secret;
@@ -36,13 +35,6 @@ impl ashpd::backend::secret::SecretImpl for Secret {
     }
 }
 
-fn generate_secret() -> Result<zeroize::Zeroizing<Vec<u8>>> {
-    let mut secret = [0; PORTAL_SECRET_SIZE];
-    // Equivalent of `ring::rand::SecureRandom`
-    getrandom::getrandom(&mut secret)?;
-    Ok(zeroize::Zeroizing::new(secret.to_vec()))
-}
-
 /// Generates, stores and send the secret back to the fd stream
 async fn send_secret_to_app(app_id: &AppID, fd: std::os::fd::OwnedFd) -> Result<()> {
     let service = Service::new().await?;
@@ -56,11 +48,17 @@ async fn send_secret_to_app(app_id: &AppID, fd: std::os::fd::OwnedFd) -> Result<
         (oo7::XDG_SCHEMA_ATTRIBUTE, GENERIC_SCHEMA_VALUE),
         ("app_id", app_id),
     ]);
-    let secret = if let Some(item) = collection.search_items(&attributes).await?.first() {
-        item.secret().await?
+
+    // Write the secret to the FD.
+    let std_stream = UnixStream::from(fd);
+    std_stream.set_nonblocking(true)?;
+    let mut stream = tokio::net::UnixStream::from_std(std_stream)?;
+
+    if let Some(item) = collection.search_items(&attributes).await?.first() {
+        stream.write_all(&item.secret().await?).await?;
     } else {
         tracing::debug!("Could not find secret for {app_id}, creating one");
-        let secret = generate_secret()?;
+        let secret = oo7::Secret::random().unwrap();
 
         collection
             .create_item(
@@ -72,14 +70,8 @@ async fn send_secret_to_app(app_id: &AppID, fd: std::os::fd::OwnedFd) -> Result<
             )
             .await?;
 
-        secret
-    };
-
-    // Write the secret to the FD.
-    let std_stream = UnixStream::from(fd);
-    std_stream.set_nonblocking(true)?;
-    let mut stream = tokio::net::UnixStream::from_std(std_stream)?;
-    stream.write_all(&secret).await?;
+        stream.write_all(&secret).await?;
+    }
 
     Ok(())
 }

portal/src/main.rs

@@ -233,7 +233,7 @@ impl Service {
             "session",
             false,
             Arc::clone(&service.manager),
-            Arc::new(Keyring::temporary(Secret::random()).await?),
+            Arc::new(Keyring::temporary(Secret::random().unwrap()).await?),
         );
         collections.push(collection.clone());
         object_server