1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
|
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "errno-util.h"
#include "glyph-util.h"
#include "homectl-recovery-key.h"
#include "libcrypt-util.h"
#include "memory-util.h"
#include "qrcode-util.h"
#include "random-util.h"
#include "recovery-key.h"
#include "strv.h"
#include "terminal-util.h"
static int add_privileged(JsonVariant **v, const char *hashed) {
_cleanup_(json_variant_unrefp) JsonVariant *e = NULL, *w = NULL, *l = NULL;
int r;
assert(v);
assert(hashed);
r = json_build(&e, JSON_BUILD_OBJECT(
JSON_BUILD_PAIR("type", JSON_BUILD_CONST_STRING("modhex64")),
JSON_BUILD_PAIR("hashedPassword", JSON_BUILD_STRING(hashed))));
if (r < 0)
return log_error_errno(r, "Failed to build recover key JSON object: %m");
json_variant_sensitive(e);
w = json_variant_ref(json_variant_by_key(*v, "privileged"));
l = json_variant_ref(json_variant_by_key(w, "recoveryKey"));
r = json_variant_append_array(&l, e);
if (r < 0)
return log_error_errno(r, "Failed append recovery key: %m");
r = json_variant_set_field(&w, "recoveryKey", l);
if (r < 0)
return log_error_errno(r, "Failed to set recovery key array: %m");
r = json_variant_set_field(v, "privileged", w);
if (r < 0)
return log_error_errno(r, "Failed to update privileged field: %m");
return 0;
}
static int add_public(JsonVariant **v) {
_cleanup_strv_free_ char **types = NULL;
int r;
assert(v);
r = json_variant_strv(json_variant_by_key(*v, "recoveryKeyType"), &types);
if (r < 0)
return log_error_errno(r, "Failed to parse recovery key type list: %m");
r = strv_extend(&types, "modhex64");
if (r < 0)
return log_oom();
r = json_variant_set_field_strv(v, "recoveryKeyType", types);
if (r < 0)
return log_error_errno(r, "Failed to update recovery key types: %m");
return 0;
}
static int add_secret(JsonVariant **v, const char *password) {
_cleanup_(json_variant_unrefp) JsonVariant *w = NULL, *l = NULL;
_cleanup_strv_free_erase_ char **passwords = NULL;
int r;
assert(v);
assert(password);
w = json_variant_ref(json_variant_by_key(*v, "secret"));
l = json_variant_ref(json_variant_by_key(w, "password"));
r = json_variant_strv(l, &passwords);
if (r < 0)
return log_error_errno(r, "Failed to convert password array: %m");
r = strv_extend(&passwords, password);
if (r < 0)
return log_oom();
r = json_variant_new_array_strv(&l, passwords);
if (r < 0)
return log_error_errno(r, "Failed to allocate new password array JSON: %m");
json_variant_sensitive(l);
r = json_variant_set_field(&w, "password", l);
if (r < 0)
return log_error_errno(r, "Failed to update password field: %m");
r = json_variant_set_field(v, "secret", w);
if (r < 0)
return log_error_errno(r, "Failed to update secret object: %m");
return 0;
}
int identity_add_recovery_key(JsonVariant **v) {
_cleanup_(erase_and_freep) char *password = NULL, *hashed = NULL;
int r;
assert(v);
/* First, let's generate a secret key */
r = make_recovery_key(&password);
if (r < 0)
return log_error_errno(r, "Failed to generate recovery key: %m");
/* Let's UNIX hash it */
r = hash_password(password, &hashed);
if (r < 0)
return log_error_errno(errno_or_else(EINVAL), "Failed to UNIX hash secret key: %m");
/* Let's now add the "privileged" version of the recovery key */
r = add_privileged(v, hashed);
if (r < 0)
return r;
/* Let's then add the public information about the recovery key */
r = add_public(v);
if (r < 0)
return r;
/* Finally, let's add the new key to the secret part, too */
r = add_secret(v, password);
if (r < 0)
return r;
/* We output the key itself with a trailing newline to stdout and the decoration around it to stderr
* instead. */
fflush(stdout);
fprintf(stderr,
"A secret recovery key has been generated for this account:\n\n"
" %s%s%s",
emoji_enabled() ? special_glyph(SPECIAL_GLYPH_LOCK_AND_KEY) : "",
emoji_enabled() ? " " : "",
ansi_highlight());
fflush(stderr);
fputs(password, stdout);
fflush(stdout);
fputs(ansi_normal(), stderr);
fflush(stderr);
fputc('\n', stdout);
fflush(stdout);
fputs("\nPlease save this secret recovery key at a secure location. It may be used to\n"
"regain access to the account if the other configured access credentials have\n"
"been lost or forgotten. The recovery key may be entered in place of a password\n"
"whenever authentication is requested.\n", stderr);
fflush(stderr);
(void) print_qrcode(stderr, "You may optionally scan the recovery key off screen", password);
return 0;
}
|
