fnox 1.21.0

A flexible secret management tool supporting multiple providers and encryption methods
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141

use crate::error::{FnoxError, Result};
use async_trait::async_trait;
use std::collections::HashMap;
use std::sync::OnceLock;

use super::hw_encrypt;
use super::yubikey_usb;

pub fn env_dependencies() -> &'static [&'static str] {
    &[]
}

/// Cached HMAC responses keyed by provider name.
/// After a successful YubiKey tap, the response is cached for the process lifetime.
static CACHED_SECRETS: OnceLock<std::sync::Mutex<HashMap<String, Vec<u8>>>> = OnceLock::new();

#[derive(Clone)]
pub struct YubikeyProvider {
    challenge: Vec<u8>,
    slot: u8,
    provider_name: String,
}

impl YubikeyProvider {
    pub fn new(provider_name: String, challenge: String, slot: String) -> Result<Self> {
        let challenge_bytes = hex::decode(&challenge).map_err(|e| {
            FnoxError::Config(format!(
                "yubikey provider '{}': invalid hex in challenge: {}",
                provider_name, e
            ))
        })?;
        let slot_num: u8 = slot.parse().map_err(|e| {
            FnoxError::Config(format!(
                "yubikey provider '{}': invalid slot number: {}",
                provider_name, e
            ))
        })?;
        Ok(Self {
            challenge: challenge_bytes,
            slot: slot_num,
            provider_name,
        })
    }

    fn get_hmac_secret(&self) -> Result<Vec<u8>> {
        let cache = CACHED_SECRETS.get_or_init(|| std::sync::Mutex::new(HashMap::new()));
        // Hold the mutex for the entire operation to prevent concurrent HID access.
        // USB HID devices don't support concurrent access — two callers hitting
        // the device simultaneously would cause a device-busy error.
        let mut guard = cache
            .lock()
            .map_err(|_| FnoxError::Provider("YubiKey cache lock poisoned".to_string()))?;

        if let Some(cached) = guard.get(&self.provider_name) {
            return Ok(cached.clone());
        }

        eprintln!("Tap your YubiKey...");

        let hmac_result = yubikey_usb::challenge_response_hmac(&self.challenge, self.slot)
            .map_err(|e| FnoxError::Provider(format!("YubiKey HMAC-SHA1 challenge failed: {e}")))?;

        let secret = hmac_result.to_vec();
        guard.insert(self.provider_name.clone(), secret.clone());

        Ok(secret)
    }

    fn hkdf_context(&self) -> Vec<u8> {
        format!("fnox-yubikey-{}", self.provider_name).into_bytes()
    }
}

#[async_trait]
impl crate::providers::Provider for YubikeyProvider {
    fn capabilities(&self) -> Vec<crate::providers::ProviderCapability> {
        vec![crate::providers::ProviderCapability::Encryption]
    }

    async fn encrypt(&self, plaintext: &str) -> Result<String> {
        let provider = self.clone();
        let secret = tokio::task::spawn_blocking(move || provider.get_hmac_secret())
            .await
            .map_err(|e| FnoxError::Provider(format!("YubiKey task failed: {e}")))??;
        hw_encrypt::encrypt(&secret, &self.hkdf_context(), plaintext)
    }

    async fn get_secret(&self, value: &str) -> Result<String> {
        let provider = self.clone();
        let secret = tokio::task::spawn_blocking(move || provider.get_hmac_secret())
            .await
            .map_err(|e| FnoxError::Provider(format!("YubiKey task failed: {e}")))??;
        hw_encrypt::decrypt(&secret, &self.hkdf_context(), value)
    }
}

/// Setup helpers for `fnox provider add --type yubikey`
pub mod setup {
    use super::yubikey_usb;
    use crate::error::{FnoxError, Result};

    pub fn setup_yubikey(provider_name: &str) -> Result<(String, String)> {
        eprintln!("\nPlug in your YubiKey and tap it when prompted...");

        let slot_str = demand::Input::new("YubiKey slot (1 or 2, default: 2)")
            .placeholder("2")
            .run()
            .map_err(|e| FnoxError::Config(format!("Failed to read slot: {}", e)))?;
        let slot_num: u8 = if slot_str.is_empty() {
            2
        } else {
            slot_str
                .parse()
                .map_err(|_| FnoxError::Config("Slot must be 1 or 2".to_string()))?
        };

        if slot_num != 1 && slot_num != 2 {
            return Err(FnoxError::Config("Slot must be 1 or 2".to_string()));
        }

        // Generate a random 32-byte challenge
        let challenge: [u8; 32] = rand::random();
        let challenge_hex = hex::encode(challenge);

        eprintln!("Tap your YubiKey now...");

        // Verify the YubiKey works with this challenge
        yubikey_usb::challenge_response_hmac(&challenge, slot_num).map_err(|e| {
            FnoxError::Provider(format!(
                "YubiKey HMAC-SHA1 challenge failed: {e}. Make sure HMAC-SHA1 is configured on slot {slot_num}.",
            ))
        })?;

        eprintln!(
            "YubiKey verified successfully for provider '{}'.",
            provider_name
        );

        Ok((challenge_hex, slot_num.to_string()))
    }
}