keyquorum 0.1.0

Shamir secret sharing daemon for distributed key quorum
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

use std::process::Stdio;

use keyquorum_core::config::ActionConfig;
use keyquorum_core::protocol::ActionResult;
use tokio::io::AsyncWriteExt;
use tokio::process::Command;
use tracing::{debug, info};

/// Execute the configured action with the reconstructed secret.
pub async fn execute(config: &ActionConfig, secret: &[u8]) -> ActionResult {
    match config {
        ActionConfig::Luks { device, name } => luks_unlock(device, name, secret).await,
        ActionConfig::Stdout => stdout_write(secret),
        ActionConfig::Command { program, args } => run_command(program, args, secret).await,
    }
}

async fn luks_unlock(device: &str, name: &str, secret: &[u8]) -> ActionResult {
    info!(device = device, name = name, "unlocking LUKS device");

    let mut child = match Command::new("cryptsetup")
        .args(["luksOpen", "--key-file=-", device, name])
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped())
        .spawn()
    {
        Ok(c) => c,
        Err(e) => {
            return ActionResult::Failure {
                message: format!("Failed to spawn cryptsetup: {}", e),
            };
        }
    };

    if let Some(mut stdin) = child.stdin.take() {
        if let Err(e) = stdin.write_all(secret).await {
            let _ = child.kill().await;
            return ActionResult::Failure {
                message: format!("Failed to write secret to cryptsetup stdin: {}", e),
            };
        }
        // drop stdin to close the pipe, signaling EOF
    }

    match child.wait_with_output().await {
        Ok(output) if output.status.success() => ActionResult::Success {
            message: format!("LUKS device {} unlocked as {}", device, name),
        },
        Ok(output) => {
            debug!(
                stderr = %String::from_utf8_lossy(&output.stderr),
                exit_code = %output.status,
                "cryptsetup stderr (not sent to client)"
            );
            ActionResult::Failure {
                message: format!("cryptsetup failed (exit {})", output.status),
            }
        }
        Err(e) => ActionResult::Failure {
            message: format!("Failed to wait for cryptsetup: {}", e),
        },
    }
}

fn stdout_write(secret: &[u8]) -> ActionResult {
    use std::io::Write;
    match std::io::stdout().write_all(secret) {
        Ok(_) => {
            let _ = std::io::stdout().flush();
            ActionResult::Success {
                message: "Secret written to stdout".to_string(),
            }
        }
        Err(e) => ActionResult::Failure {
            message: format!("Failed to write to stdout: {}", e),
        },
    }
}

async fn run_command(program: &str, args: &[String], secret: &[u8]) -> ActionResult {
    info!(program = program, "running command");

    let mut child = match Command::new(program)
        .args(args)
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped())
        .spawn()
    {
        Ok(c) => c,
        Err(e) => {
            return ActionResult::Failure {
                message: format!("Failed to spawn {}: {}", program, e),
            };
        }
    };

    if let Some(mut stdin) = child.stdin.take() {
        if let Err(e) = stdin.write_all(secret).await {
            let _ = child.kill().await;
            return ActionResult::Failure {
                message: format!("Failed to write secret to {} stdin: {}", program, e),
            };
        }
    }

    match child.wait_with_output().await {
        Ok(output) if output.status.success() => ActionResult::Success {
            message: format!("Command {} completed successfully", program,),
        },
        Ok(output) => {
            debug!(
                program = program,
                stderr = %String::from_utf8_lossy(&output.stderr),
                exit_code = %output.status,
                "command stderr (not sent to client)"
            );
            ActionResult::Failure {
                message: format!("{} failed (exit {})", program, output.status),
            }
        }
        Err(e) => ActionResult::Failure {
            message: format!("Failed to wait for {}: {}", program, e),
        },
    }
}