diff --git a/src/constants.rs b/src/constants.rs index 2452d6d..84ceb4b 100644 --- a/src/constants.rs +++ b/src/constants.rs @@ -301,7 +301,7 @@ impl core::convert::TryFrom for YubicoPivExtension { } } -pub const YUBICO_PIV_AUTHENTICATION_CERTIFICATE: &'static [u8; 351] = &[ +pub const YUBICO_PIV_AUTHENTICATION_CERTIFICATE: &[u8; 351] = &[ 0x53, 0x82, 0x01, 0x5b, 0x70, 0x82, 0x01, 0x52, 0x30, 0x82, 0x01, 0x4e, 0x30, 0x81, 0xf5, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x11, 0x00, 0x8e, 0x46, 0x32, 0xd8, 0xf0, 0xc1, 0xf7, 0xc1, 0x4d, 0x67, 0xd1, 0x4b, 0xfd, 0xe3, 0x64, 0x8e, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, @@ -326,7 +326,7 @@ pub const YUBICO_PIV_AUTHENTICATION_CERTIFICATE: &'static [u8; 351] = &[ 0x93, 0x33, 0xb8, 0x47, 0xa9, 0x73, 0xc2, 0x82, 0x92, 0x3e, 0x71, 0x01, 0x00, 0xfe, 0x00, ]; -pub const YUBICO_ATTESTATION_CERTIFICATE: &'static [u8; 754] = &[ +pub const YUBICO_ATTESTATION_CERTIFICATE: &[u8; 754] = &[ 0x53, 0x82, 0x02, 0xee, 0x70, 0x82, 0x02, 0xea, 0x30, 0x82, 0x02, 0xe6, 0x30, 0x82, 0x01, 0xce, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x09, 0x00, 0xa4, 0x85, 0x22, 0xaa, 0x34, 0xaf, 0xae, 0x4f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, @@ -377,7 +377,7 @@ pub const YUBICO_ATTESTATION_CERTIFICATE: &'static [u8; 754] = &[ 0xa0, 0x85, ]; -pub const YUBICO_ATTESTATION_CERTIFICATE_FOR_9A: &'static [u8; 584] = &[ +pub const YUBICO_ATTESTATION_CERTIFICATE_FOR_9A: &[u8; 584] = &[ 0x30, 0x82, 0x02, 0x44, 0x30, 0x82, 0x01, 0x2c, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x11, 0x00, 0xc6, 0x36, 0xe7, 0xb3, 0xa5, 0xa5, 0xa4, 0x98, 0x5d, 0x13, 0x6e, 0x43, 0x36, 0x2d, 0x13, 0xf7, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, @@ -416,15 +416,15 @@ pub const YUBICO_ATTESTATION_CERTIFICATE_FOR_9A: &'static [u8; 584] = &[ 0x76, 0xa7, 0x05, 0xe1, 0x4c, 0x45, 0x55, 0x14, 0xff, 0x10, 0x10, 0x89, 0x69, 0x6a, 0x13, 0x3d, 0x89, 0xf2, 0xca, 0xfd, 0x14, 0x9a, 0xc4, 0xd0, ]; -// pub const YUBICO_DEFAULT_MANAGEMENT_KEY: &'static [u8; 24] = b"123456781234567812345678"; -pub const YUBICO_DEFAULT_MANAGEMENT_KEY: &'static [u8; 24] = &[ +// pub const YUBICO_DEFAULT_MANAGEMENT_KEY: & [u8; 24] = b"123456781234567812345678"; +pub const YUBICO_DEFAULT_MANAGEMENT_KEY: &[u8; 24] = &[ 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, ]; // stolen from le yubico -pub const DISCOVERY_OBJECT: &'static [u8; 20] = +pub const DISCOVERY_OBJECT: &[u8; 20] = b"~\x12O\x0b\xa0\x00\x00\x03\x08\x00\x00\x10\x00\x01\x00_/\x02@\x00"; // import secrets; secrets.token_bytes(16) -pub const GUID: &'static [u8; 16] = b"\x0c\x92\xc9\x04\xd0\xdeL\xd9\xf6\xd1\xa2\x9fE3\xca\xeb"; +pub const GUID: &[u8; 16] = b"\x0c\x92\xc9\x04\xd0\xdeL\xd9\xf6\xd1\xa2\x9fE3\xca\xeb"; diff --git a/src/lib.rs b/src/lib.rs index b2ded31..00d2f75 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -107,7 +107,7 @@ where self.state.runtime.chained_command = None; entire_command } else { - return Ok(Default::default()); + return Ok(()); } } @@ -117,7 +117,7 @@ where command.clone() } else { self.state.runtime.chained_command = Some(command.clone()); - return Ok(Default::default()); + return Ok(()); } } }; @@ -174,13 +174,13 @@ where return Err(Status::FunctionNotSupported); } if self.state.runtime.app_security_status.pin_verified { - return Ok(()); + Ok(()) } else { let retries = self .state .persistent(&mut self.trussed) .remaining_pin_retries(); - return Err(Status::RemainingRetries(retries)); + Err(Status::RemainingRetries(retries)) } } } @@ -209,7 +209,7 @@ where persistent_state.reset_consecutive_pin_mismatches(); persistent_state.set_pin(new_pin); self.state.runtime.app_security_status.pin_verified = true; - return Ok(Default::default()); + Ok(()) } pub fn change_puk(&mut self, old_puk: commands::Puk, new_puk: commands::Puk) -> Result { @@ -227,7 +227,7 @@ where persistent_state.reset_consecutive_puk_mismatches(); persistent_state.set_puk(new_puk); self.state.runtime.app_security_status.puk_verified = true; - return Ok(Default::default()); + Ok(()) } // pub fn old_respond(&mut self, command: &iso7816::Command, reply: &mut Data) -> Result { @@ -379,10 +379,12 @@ where panic!("unhandled >1B lengths"); } if data[1] == 0x81 { - data[2] as usize; + // FIXME: Proper length parsing and avoid panics + // data[2] as usize; data = &data[3..]; } else { - data[1] as usize; // ~158 for ssh ed25519 signatures (which have a ~150B commitment) + // FIXME: Proper length parsing and avoid panics + // data[1] as usize; // ~158 for ssh ed25519 signatures (which have a ~150B commitment) data = &data[2..]; }; @@ -492,7 +494,7 @@ where // no retries ;) self.state.runtime.command_cache = None; - if &our_challenge != response { + if our_challenge != response { debug_now!("{:?}", &our_challenge); debug_now!("{:?}", &response); return Err(Status::IncorrectDataParameter); @@ -502,7 +504,7 @@ where // B) encrypt their challenge let (header, challenge) = data.split_at(2); - if header != &[0x81, 0x08] { + if header != [0x81, 0x08] { return Err(Status::IncorrectDataParameter); } @@ -748,7 +750,7 @@ where // } // TODO: iterate on this, don't expect tags.. - let input = derp::Input::from(&command.data()); + let input = derp::Input::from(command.data()); // let (mechanism, parameter) = input.read_all(derp::Error::Read, |input| { let (mechanism, _pin_policy, _touch_policy) = input .read_all(derp::Error::Read, |input| { @@ -772,7 +774,7 @@ where // if mechanism != &[0x11] { // HA! patch in Ed255 - if mechanism != &[0x22] { + if mechanism != [0x22] { return Err(Status::InstructionNotSupportedOrInvalid); } @@ -830,7 +832,7 @@ where let serialized_public_key = syscall!(self.trussed.serialize_key( // trussed::types::Mechanism::P256, trussed::types::Mechanism::Ed255, - public_key.clone(), + public_key, trussed::types::KeySerialization::Raw, )) .serialized_key; @@ -870,7 +872,7 @@ where // 88 1A 89 18 AA 81 D5 48 A5 EC 26 01 60 BA 06 F6 EC 3B B6 05 00 2E B6 3D 4B 28 7F 86 // - let input = derp::Input::from(&command.data()); + let input = derp::Input::from(command.data()); let (data_object, data) = input .read_all(derp::Error::Read, |input| { let data_object = derp::expect_tag_and_get_value(input, 0x5c)?; @@ -885,7 +887,7 @@ where // info_now!("PutData in {:?}: {:?}", data_object, data); - if data_object == &[0x5f, 0xc1, 0x09] { + if data_object == [0x5f, 0xc1, 0x09] { // "Printed Information", supposedly // Yubico uses this to store its "Metadata" // @@ -910,7 +912,7 @@ where return Ok(()); } - if data_object == &[0x5f, 0xc1, 0x05] { + if data_object == [0x5f, 0xc1, 0x05] { // "X.509 Certificate for PIV Authentication", supposedly // IOW, the cert for "authentication key" // Yubico uses this to store its "Metadata" @@ -933,7 +935,7 @@ where )) .map_err(|_| Status::NotEnoughMemory)?; - return Ok(Default::default()); + return Ok(()); } Err(Status::IncorrectDataParameter) @@ -1105,7 +1107,7 @@ where return Err(Status::IncorrectDataParameter); } let (prefix, new_management_key) = data.split_at(3); - if prefix != &[0x03, 0x9b, 0x18] { + if prefix != [0x03, 0x9b, 0x18] { return Err(Status::IncorrectDataParameter); } let new_management_key: [u8; 24] = new_management_key.try_into().unwrap(); diff --git a/src/piv_types.rs b/src/piv_types.rs index 006da27..65d72fd 100644 --- a/src/piv_types.rs +++ b/src/piv_types.rs @@ -24,9 +24,9 @@ impl TryFrom<&[u8]> for Pin { match unpadded_pin.len() { len @ 6..=8 => { let verifier = if cfg!(feature = "strict-pin") { - |&byte| byte >= b'0' && byte <= b'9' + |&byte| (b'0'..=b'9').contains(&byte) } else { - |&byte| byte >= 32 && byte <= 127 + |&byte| (32..=127).contains(&byte) }; if unpadded_pin.iter().all(verifier) { Ok(Pin { padded_pin, len }) diff --git a/src/state.rs b/src/state.rs index 198e268..cdcd5d6 100644 --- a/src/state.rs +++ b/src/state.rs @@ -66,7 +66,7 @@ pub struct RetiredSlotIndex(u8); impl core::convert::TryFrom for RetiredSlotIndex { type Error = u8; fn try_from(i: u8) -> core::result::Result { - if 1 <= i && i <= 20 { + if (1..=20).contains(&i) { Ok(Self(i)) } else { Err(i) @@ -477,7 +477,7 @@ where let keys = Keys { authentication_key: None, - management_key: management_key, + management_key, signature_key: None, encryption_key: None, pinless_authentication_key: None, @@ -500,20 +500,19 @@ where state } + #[allow(clippy::result_unit_err)] pub fn load(trussed: &'t mut T) -> Result { let data = block!(trussed .read_file(Location::Internal, PathBuf::from(Self::FILENAME),) .unwrap()) - .map_err(|e| { - info!("loading error: {:?}", &e); - drop(e) + .map_err(|_err| { + info!("loading error: {_err:?}"); })? .data; - let previous_state: PersistentState = trussed::cbor_deserialize(&data).map_err(|e| { - info!("cbor deser error: {:?}", e); + let previous_state: PersistentState = trussed::cbor_deserialize(&data).map_err(|_err| { + info!("cbor deser error: {_err:?}"); info!("data: {:X?}", &data); - drop(e) })?; // horrible deser bug to forget Ok here :) Ok(Self { @@ -527,10 +526,9 @@ where let data = try_syscall!(trussed.read_file(Location::Internal, PathBuf::from(Self::FILENAME))); if let Ok(data) = data { - let previous_state = trussed::cbor_deserialize(&data.data).map_err(|e| { - info!("cbor deser error: {:?}", e); + let previous_state = trussed::cbor_deserialize(&data.data).map_err(|_err| { + info!("cbor deser error: {_err:?}", e); info!("data: {:X?}", &data); - drop(e) }); if let Ok(state) = previous_state { // horrible deser bug to forget Ok here :) diff --git a/tests/generate_asymmetric_keypair.rs b/tests/generate_asymmetric_keypair.rs index bfd8817..877ceea 100644 --- a/tests/generate_asymmetric_keypair.rs +++ b/tests/generate_asymmetric_keypair.rs @@ -1,6 +1,6 @@ mod setup; -use iso7816::Status::*; + // example: 00 47 00 9A 0B // AC 09 @@ -13,10 +13,10 @@ use iso7816::Status::*; #[test] fn gen_keypair() { - let cmd = cmd!("00 47 00 9A 0B AC 09 80 01 11 AA 01 02 AB 01 02"); + let _cmd = cmd!("00 47 00 9A 0B AC 09 80 01 11 AA 01 02 AB 01 02"); // without PIN, no key generation - setup::piv(|piv| { + setup::piv(|_piv| { // not currently implemented // // let mut response = iso7816::Data::<16>::default(); diff --git a/tests/get_data.rs b/tests/get_data.rs index 8e669a3..7164901 100644 --- a/tests/get_data.rs +++ b/tests/get_data.rs @@ -10,7 +10,7 @@ fn get_data() { // let cmd = cmd!("00 f8 00 00"); // // without PIN, no key generation - setup::piv(|piv| { + setup::piv(|_piv| { // ykGetSerial // println!("{}", hex_str!(&piv.respond(&cmd!("00 f8 00 00")).unwrap())); diff --git a/tests/put_data.rs b/tests/put_data.rs index ee6e034..dcfbaa5 100644 --- a/tests/put_data.rs +++ b/tests/put_data.rs @@ -16,7 +16,7 @@ mod setup; #[test] fn put_data() { - setup::piv(|piv| { + setup::piv(|_piv| { // let mut response = iso7816::Data::<16>::default(); // piv.respond(&cmd!( diff --git a/tests/setup/mod.rs b/tests/setup/mod.rs index c53b0dd..edea91c 100644 --- a/tests/setup/mod.rs +++ b/tests/setup/mod.rs @@ -41,9 +41,9 @@ pub fn init_platform() -> Platform { ); let ui = ui::UserInterface::new(); - let platform = Platform::new(rng, store, ui); + - platform + Platform::new(rng, store, ui) } pub mod ui { @@ -79,8 +79,7 @@ pub mod ui { pub mod store { use littlefs2::{ - const_ram_storage, consts, - fs::{Allocation, Filesystem}, + const_ram_storage, }; use trussed::types::{LfsResult, LfsStorage};