pyrus_cert_store/

connection.rs

use argon2::{Algorithm, Argon2, Version};

use rusqlite::{params, Connection};

use zeroize::{Zeroize, Zeroizing};

use std::path::Path;

use crate::error::{Result, StoreError};
use crate::store::CertStore;

/// A [`CertStore`] connection builder.
///
/// An instance of this struct is returned by [`CertStore::open`] and can be 
/// configured using exposed methods. In simple terms:
/// * [`CertStoreConn::with_params`] - changes the Argon2 parameters used for 
/// password hashing (only applicable if using encryption),
/// * [`CertStoreConn::with_passphrase`] - enables encryption. The user 
/// supplies a password and a salt,
/// * [`CertStoreConn::connect`] - starts the connection to the underlying 
/// SQL database.
///
/// # Example
/// Start a connection with custom password hashing parameters.
/// ```rust
/// use pyrus_cert_store::CertStore;
/// # use std::error::Error;
/// # use pyrus_crypto::prelude::*;
///
/// # fn main() -> Result<(), Box<dyn Error>> {
/// let store = CertStore::open("certstore.db3")
/// # ;
/// # let store = CertStore::open("")
///     // 20 blocks of memory used, 3 threads, 4 iterations
///     .with_params(20 * 1024, 3, 4)
///     .with_passphrase(String::from("password123"), b"use a better password and salt")
///     .connect()?;
/// # Ok(())
/// # }
/// ```
pub struct CertStoreConn<P: AsRef<Path>> {
    passphrase: Option<String>,
    salt: Option<Vec<u8>>,
    path: P,
    memory: u32,
    threads: u32,
    iterations: u32,
}

impl<P: AsRef<Path>> CertStoreConn<P> {
    fn params(&self) -> Result<argon2::Params> {
        argon2::Params::new(self.memory, self.iterations, self.threads, Some(64))
            .map_err(|_| StoreError::InvalidParams)
    }

    pub(crate) fn new(path: P) -> Self {
        Self {
            passphrase: None,
            salt: None,
            path,
            memory: argon2::Params::DEFAULT_M_COST,
            threads: argon2::Params::DEFAULT_P_COST,
            iterations: argon2::Params::DEFAULT_T_COST,
        }
    }

    /// Modifies the parameters used for the Argon2 password hashing 
    /// algorithm. For detailed information about these parameters 
    /// read the [`argon2`] crate documentation.
    ///
    /// In simple terms:
    /// * `memory` - the number of 1 KiB memory blocks,
    /// * `threads` - the number of threads used for calculations,
    /// * `iterations` - the number of passes through the algorithm.
    pub fn with_params(mut self, memory: u32, threads: u32, iterations: u32) -> Self {
        self.memory = memory;
        self.threads = threads;
        self.iterations = iterations;
        self
    }

    /// Sets a passphrase to be used for the connection. Not calling this 
    /// method is equivalent to not enabling encryption for the [`CertStore`]. 
    ///
    /// # Example
    /// Using a wrong password results in an error
    /// ```rust
    /// # use pyrus_cert_store::CertStore;
    /// # use std::error::Error;
    /// # use std::path::Path;
    /// # fn main() -> Result<(), Box<dyn Error>> {
    /// let store_file = Path::new("certstore.db3");
    /// # let file = temp_file::empty();
    /// # let store_file = file.path();
    /// {
    ///     let store = CertStore::open(store_file)
    ///         .with_passphrase(String::from("1234"), b"saltysalt")
    ///         .connect()?;
    /// } // drops the connection
    /// {
    ///     // reconnect with a wrong password
    ///     let store = CertStore::open(store_file)
    ///         .with_passphrase(String::from("banana"), b"saltysalt")
    ///         .connect();
    ///
    ///     assert!(store.is_err());
    /// }
    /// # Ok(())
    /// # }
    /// ```
    pub fn with_passphrase<S: AsRef<[u8]>>(mut self, passphrase: String, salt: S) -> Self {
        self.passphrase = Some(passphrase);
        self.salt = Some(salt.as_ref().to_vec());
        self
    }

    fn derive_key(&self) -> Result<Zeroizing<[u8; 64]>> {
        let params = self.params()?;
        let hasher = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);
        let mut key = Zeroizing::new([0; 64]);
        let passphrase = self.passphrase.as_ref().unwrap();
        let salt = self.salt.as_ref().unwrap();
        hasher.hash_password_into(passphrase.as_bytes(), salt, &mut *key)?;
        Ok(key)
    }

    /// Attempts the connection to the underlying SQL database. If the 
    /// database does not exist, it is created and initialized.
    ///
    /// # Errors
    /// * [`StoreError::InvalidPath`] when the store path cannot be converted 
    /// to a C-compatible string.
    /// * [`StoreError::SQLiteFail`] when any other `rusqlite` error occured.
    pub fn connect(self) -> Result<CertStore> {
        let conn = if self.path.as_ref() != Path::new("") {
            match Connection::open(&self.path) {
                Ok(c) => c,
                Err(rusqlite::Error::NulError(_)) => return Err(StoreError::InvalidPath),
                Err(e) => return Err(StoreError::SQLiteFail(e)),
            }
        } else {
            Connection::open_in_memory()?
        };
        // enable encryption
        if self.passphrase.is_some() && self.salt.is_some() {
            let key = self.derive_key()?;
            let key = Zeroizing::new(hex::encode(&key));
            conn.pragma_update(None, "key", hex::encode(key))?;
            conn.pragma_update(None, "cipher_memory_security", "ON")?;
        }
        conn.query_row("SELECT COUNT(*) FROM `sqlite_master`;", params![], |_| {
            Ok(())
        })?;
        conn.execute(
            "CREATE TABLE IF NOT EXISTS certs (
                fpr TEXT UNIQUE NOT NULL,
                uid TEXT NOT NULL,
                bytes BLOB NOT NULL
            )",
            (),
        )?;
        Ok(CertStore { conn })
    }
}

/// Zeroizes the passphrase and salt on drop. This is for security reasons 
/// to not leave the passphrase in memory after opening the connection.
impl<P: AsRef<Path>> Drop for CertStoreConn<P> {
    fn drop(&mut self) {
        self.passphrase.zeroize();
        self.salt.zeroize();
    }
}