Skip to content

Commit

Permalink
Unlock P12 with --pkcs12-passphrase (#70)
Browse files Browse the repository at this point in the history 
* Unlock P12 with --pkcs12-passphrase

* Bump openpgp-dsm crate version to 1.0.3
  • Loading branch information
@zugzwang
zugzwang authored Sep 23, 2022
1 parent bd7422a commit 89a1205
Show file tree
Hide file tree
Showing 7 changed files with 67 additions and 8 deletions.
2 changes: 1 addition & 1 deletion Cargo.lock
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion openpgp-dsm/Cargo.toml
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "openpgp-dsm"
version = "1.0.2"
version = "1.0.3"
authors = ["zugzwang <francisco.vialprado@fortanix.com>"]
edition = "2018"

Expand Down
13 changes: 7 additions & 6 deletions openpgp-dsm/src/lib.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -110,9 +110,10 @@ pub enum Auth {

impl Auth {
pub fn from_options_or_env(
cli_api_key: Option<&str>,
cli_api_key: Option<&str>,
cli_client_cert: Option<&str>,
cli_app_uuid: Option<&str>,
cli_app_uuid: Option<&str>,
cli_p12_pass: Option<&str>,
) -> Result<Self> {
// Try API key
let api_key = match (cli_api_key, env::var(ENV_API_KEY).ok()) {
Expand Down Expand Up @@ -169,7 +170,7 @@ impl Auth {
Ok(Auth::ApiKey(api_key))
},
(None, Some((client_cert, app_uuid))) => {
let p12_id = try_unlock_p12(client_cert)?;
let p12_id = try_unlock_p12(client_cert, cli_p12_pass)?;

let uuid = Uuid::parse_str(&app_uuid)
.context("bad app UUID")?;
Expand Down Expand Up @@ -1847,15 +1848,15 @@ fn api_curve_from_sequoia_curve(curve: SequoiaCurve) -> Result<ApiCurve> {
}
}

fn try_unlock_p12(cert_file: String) -> Result<Identity> {
fn try_unlock_p12(cert_file: String, passphrase: Option<&str>) -> Result<Identity> {
let mut cert_stream = File::open(cert_file.clone())
.context(format!("opening {}", cert_file))?;
let mut cert = Vec::new();
cert_stream.read_to_end(&mut cert)
.context(format!("reading {}", cert_file))?;
// Try to unlock certificate without password first
// Try to unlock certificate with passed password, if any
let mut first = true;
if let Ok(id) = Identity::from_pkcs12(&cert, "") {
if let Ok(id) = Identity::from_pkcs12(&cert, passphrase.unwrap_or("")) {
return Ok(id)
} else {
// Try to unlock with env var passphrase
Expand Down
4 changes: 4 additions & 0 deletions sq/src/commands/key.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ fn generate(config: Config, m: &ArgMatches) -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
println!("Generating keys inside inside Fortanix DSM. This might take a while...");
dsm::generate_key(
Expand Down Expand Up @@ -334,6 +335,7 @@ fn extract_cert(config: Config, m: &ArgMatches) -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
let dsm_auth = dsm::Credentials::new(dsm_secret)?;
dsm::extract_cert(key_name, dsm_auth)?
Expand All @@ -357,6 +359,7 @@ fn dsm_import(config: Config, m: &ArgMatches) -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
let dsm_auth = dsm::Credentials::new(dsm_secret)?;
let input = open_or_stdin(m.value_of("input"))?;
Expand All @@ -376,6 +379,7 @@ fn extract_dsm(config: Config, m: &ArgMatches) -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
let dsm_auth = dsm::Credentials::new(dsm_secret)?;
let key = match m.value_of("dsm-key") {
Expand Down
22 changes: 22 additions & 0 deletions sq/src/sq-usage.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,9 @@
//! -o, --output <FILE>
//! Writes to FILE or stdout if omitted
//!
//! --pkcs12-passphrase <PKCS12-PASSPHRASE>
//! Passphrase for unlocking the PKCS12 identity file (cert-based
//! authentication)
//! --private-key-store <KEY_STORE>
//! Provides parameters for private key store
//!
Expand Down Expand Up @@ -193,6 +196,9 @@
//! -o, --output <FILE>
//! Writes to FILE or stdout if omitted
//!
//! --pkcs12-passphrase <PKCS12-PASSPHRASE>
//! Passphrase for unlocking the PKCS12 identity file (cert-based
//! authentication)
//! --private-key-store <KEY_STORE>
//! Provides parameters for private key store
//!
Expand Down Expand Up @@ -283,6 +289,9 @@
//! -o, --output <FILE>
//! Writes to FILE or stdout if omitted
//!
//! --pkcs12-passphrase <PKCS12-PASSPHRASE>
//! Passphrase for unlocking the PKCS12 identity file (cert-based
//! authentication)
//! --private-key-store <KEY_STORE>
//! Provides parameters for private key store
//!
Expand Down Expand Up @@ -480,6 +489,9 @@
//! -e, --export <OUTFILE>
//! Writes the key to OUTFILE
//!
//! --pkcs12-passphrase <PKCS12-PASSPHRASE>
//! Passphrase for unlocking the PKCS12 identity file (cert-based
//! authentication)
//! --rev-cert <FILE or ->
//! Writes the revocation certificate to FILE. mandatory if OUTFILE is
//! "-". [default: <OUTFILE>.rev]
Expand Down Expand Up @@ -592,6 +604,9 @@
//! -o, --output <FILE>
//! Writes to FILE or stdout if omitted
//!
//! --pkcs12-passphrase <PKCS12-PASSPHRASE>
//! Passphrase for unlocking the PKCS12 identity file (cert-based
//! authentication)
//!
//! ARGS:
//! <FILE>
Expand Down Expand Up @@ -644,6 +659,10 @@
//!
//! -o, --output <FILE>
//! Writes to FILE or stdout if omitted
//!
//! --pkcs12-passphrase <PKCS12-PASSPHRASE>
//! Passphrase for unlocking the PKCS12 identity file (cert-based
//! authentication)
//! ```
//!
//! ### Subcommand key dsm-import
Expand Down Expand Up @@ -684,6 +703,9 @@
//! --input <FILE>
//! Reads from FILE or stdin if omitted
//!
//! --pkcs12-passphrase <PKCS12-PASSPHRASE>
//! Passphrase for unlocking the PKCS12 identity file (cert-based
//! authentication)
//!
//! EXAMPLES:
//!
Expand Down
4 changes: 4 additions & 0 deletions sq/src/sq.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -441,6 +441,7 @@ fn main() -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
let dsm_auth = Credentials::new(dsm_secret)?;
secrets.push(PreSecret::Dsm(dsm_auth, name.to_string()));
Expand Down Expand Up @@ -488,6 +489,7 @@ fn main() -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
let dsm_auth = Credentials::new(dsm_secret)?;
additional_secrets
Expand Down Expand Up @@ -554,6 +556,7 @@ fn main() -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
let dsm_auth = Credentials::new(dsm_secret)?;
secrets.push(secrets::PreSecret::Dsm(dsm_auth, name.to_string()));
Expand Down Expand Up @@ -702,6 +705,7 @@ fn main() -> Result<()> {
m.value_of("api-key"),
m.value_of("client-cert"),
m.value_of("app-uuid"),
m.value_of("pkcs12-passphrase"),
)?;
let dsm_auth = Credentials::new(dsm_secret)?;
secrets.push(PreSecret::Dsm(dsm_auth, name.to_string()));
Expand Down
28 changes: 28 additions & 0 deletions sq/src/sq_cli.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,10 @@ $ sq decrypt ciphertext.pgp
.long("app-uuid").value_name("APP-UUID")
.help("Authenticates to Fortanix DSM with the given App \
(cert-based authentication)"))
.arg(Arg::with_name("pkcs12-passphrase")
.long("pkcs12-passphrase").value_name("PKCS12-PASSPHRASE")
.help("Passphrase for unlocking the PKCS12 identity file \
(cert-based authentication)"))
.arg(Arg::with_name("dsm-key")
.long("dsm-key").value_name("DSM-KEY-NAME")
.help("Decrypts with secrets stored inside the \
Expand Down Expand Up @@ -210,6 +214,10 @@ $ sq encrypt --symmetric message.txt
.long("app-uuid").value_name("APP-UUID")
.help("Authenticates to Fortanix DSM with the given App \
(cert-based authentication)"))
.arg(Arg::with_name("pkcs12-passphrase")
.long("pkcs12-passphrase").value_name("PKCS12-PASSPHRASE")
.help("Passphrase for unlocking the PKCS12 identity file \
(cert-based authentication)"))
.arg(Arg::with_name("signer-dsm-key")
.long("signer-dsm-key").value_name("DSM-KEY-NAME")
.help("Signs the message with a key stored in Fortanix \
Expand Down Expand Up @@ -334,6 +342,10 @@ $ sq sign --detached --signer-key juliet.pgp message.txt
.long("app-uuid").value_name("APP-UUID")
.help("Authenticates to Fortanix DSM with the given App \
(cert-based authentication)"))
.arg(Arg::with_name("pkcs12-passphrase")
.long("pkcs12-passphrase").value_name("PKCS12-PASSPHRASE")
.help("Passphrase for unlocking the PKCS12 identity file \
(cert-based authentication)"))
.arg(Arg::with_name("dsm-key")
.long("dsm-key").value_name("DSM-KEY-NAME")
.help("Signs the message with the Fortanix DSM key"))
Expand Down Expand Up @@ -605,6 +617,10 @@ $ sq key generate --userid \"<juliet@example.org>\" --userid \"Juliet Capulet\"
.long("app-uuid").value_name("APP-UUID")
.help("Authenticates to Fortanix DSM with the given App \
(cert-based authentication)"))
.arg(Arg::with_name("pkcs12-passphrase")
.long("pkcs12-passphrase").value_name("PKCS12-PASSPHRASE")
.help("Passphrase for unlocking the PKCS12 identity file \
(cert-based authentication)"))
.arg(Arg::with_name("dsm-exportable")
.long("dsm-exportable")
.help("(DANGER) Configure the key to be exportable from DSM"))
Expand Down Expand Up @@ -759,6 +775,10 @@ $ sq key extract-cert --output juliet.cert.pgp juliet.key.pgp
.long("app-uuid").value_name("APP-UUID")
.help("Authenticates to Fortanix DSM with the given App \
(cert-based authentication)"))
.arg(Arg::with_name("pkcs12-passphrase")
.long("pkcs12-passphrase").value_name("PKCS12-PASSPHRASE")
.help("Passphrase for unlocking the PKCS12 identity file \
(cert-based authentication)"))
.arg(Arg::with_name("dsm-key")
.long("dsm-key").value_name("DSM-KEY-NAME")
.help("Extracts the certificate from Fortanix \
Expand All @@ -785,6 +805,10 @@ command exfiltrates secrets from DSM and outputs a Key.
.long("app-uuid").value_name("APP-UUID")
.help("Authenticates to Fortanix DSM with the given App \
(cert-based authentication)"))
.arg(Arg::with_name("pkcs12-passphrase")
.long("pkcs12-passphrase").value_name("PKCS12-PASSPHRASE")
.help("Passphrase for unlocking the PKCS12 identity file \
(cert-based authentication)"))
.arg(Arg::with_name("dsm-key")
.long("dsm-key").value_name("DSM-KEY-NAME")
.required(true)
Expand Down Expand Up @@ -822,6 +846,10 @@ $ sq-dsm key dsm-import --dsm-key=\"Imported by sq-dsm\" < my_priv_key.asc
.long("app-uuid").value_name("APP-UUID")
.help("Authenticates to Fortanix DSM with the given App \
(cert-based authentication)"))
.arg(Arg::with_name("pkcs12-passphrase")
.long("pkcs12-passphrase").value_name("PKCS12-PASSPHRASE")
.help("Passphrase for unlocking the PKCS12 identity file \
(cert-based authentication)"))
.arg(Arg::with_name("dsm-key")
.long("dsm-key").value_name("DSM-KEY-NAME")
.required(true)
Expand Down

0 comments on commit 89a1205

Please sign in to comment.