Nitrokey Start ID switching without sudo #305

szszszsz · 2022-12-17T17:35:32Z

This PR supports switching multiple identities for Nitrokey Start without changing the underlying services state, but using whatever is connected to the device at the time. 3 attempts are made, each using different method:

Calling gpg-connect-agent
Sending data through pcscd (requires pyscard; optional)
Direct connection

Changes

Add pyscard support
Add gpg-agent support
Extract direct connection
Rewrite CLI call to use each method

Checklist

tested with Python3.10
run make check or make fix for the formatting check
signed commits
updated documentation (e.g. parameter description, inline doc, docs.nitrokey)
added labels

Further work

To be done in the future / next PRs:

Select device to connect to by serial number
Test more the behavior without pyscard installed

Test Environment and Execution

OS: Linux Fedora 35
device's model: Nitrokey Start
device's firmware version: RTM.13

Setup snippet

$ cd /tmp
$ python -m venv env
$ env/bin/pip install pynitrokey[pcsc]
$ env/bin/pip install git+https://github.com/Nitrokey/pynitrokey.git@295-switching-id-without-sudo
$ env/bin/nitropy start set-identity 1

Relevant Output Example

Example output with logs:

(venv) sz@stumpy ~/w/nitropy (295-switching-id-without-sudo)> env PYNK_DEBUG=" " ./venv/bin/nitropy start set-identity 2
Found PYNK_DEBUG=' '. Setting VERBOSE=10
Command line tool to interact with Nitrokey devices 0.4.31
Setting identity to 2
2022-12-17 17:31:25,140   INFO pynitrokey.confconsts Trying changing identity through gpg-agent
2022-12-17 17:31:25,144  DEBUG pynitrokey.confconsts ['gpg-connect-agent', 'SCD APDU 00 85 00 02', '/bye']
2022-12-17 17:31:25,144  DEBUG pynitrokey.confconsts b'ERR 65547 Bad passphrase <Unspecified source>\n'
2022-12-17 17:31:25,144   INFO pynitrokey.confconsts Trying changing identity through gpg-agent
2022-12-17 17:31:25,146  DEBUG pynitrokey.confconsts ['gpg-connect-agent', 'SCD APDU 00 85 00 02', '/bye']
2022-12-17 17:31:25,146  DEBUG pynitrokey.confconsts b'ERR 100663406 Card removed <SCD>\n'
2022-12-17 17:31:25,149   INFO pynitrokey.confconsts Trying changing identity through pcscd
2022-12-17 17:31:25,182  DEBUG pynitrokey.confconsts ['Nitrokey Nitrokey Start (FSIJ-1.2.19-87053532) 00 00', <smartcard.CardConnectionDecorator.CardConnectionDecorator object at 0x7fa9aaca9570>]
2022-12-17 17:31:25,182  DEBUG pynitrokey.confconsts Expected error. PCSC reports Failed to transmit with protocol T1. Transaction failed.
Reset done - now active identity: 2
(venv) sz@stumpy ~/w/nitropy (295-switching-id-without-sudo)>

Output for not connected device:


(venv) sz@stumpy ~/w/nitropy (295-switching-id-without-sudo) [1]> ./venv/bin/nitropy start set-identity 2
Command line tool to interact with Nitrokey devices 0.4.31
Setting identity to 2
Critical error:
Device is not connected or occupied by some other service and cannot be connected to. Identity not changed.

--------------------------------------------------------------------------------
Critical error occurred, exiting now
Unexpected? Is this a bug? Would you like to get support/help?
- You can report issues at: https://support.nitrokey.com/
- Writing an e-mail to [email protected] is also possible
- Please attach the log: '/tmp/nitropy.log.aneroxwq' with any support/help request!
- Please check if you have udev rules installed: https://docs.nitrokey.com/nitrokey3/linux/firmware-update.html#troubleshooting

Fixes #295

Ignore smartcard.pcsc types Ignore this particular mypy error

szszszsz · 2022-12-17T17:53:08Z

pynitrokey/confconsts.py

+logger = logging.getLogger(__name__)
+stream_handler = logging.StreamHandler()
+stream_handler.setLevel(VERBOSE)
+stream_handler.setFormatter(logging.Formatter(LOG_FORMAT_STDOUT))
+logger.addHandler(stream_handler)


The default verbosity level should probably be higher than INFO to avoid printing to console.

robin-nitrokey

Looks good, just some thoughts regarding robustness:

We could handle the case where the gpg-connect-agent binary is not available and just ignore that execution path.
~~Similarly, System.readers would fail if pcsc is not running. We should handle that exception and ignore the pcsc path.~~

pynitrokey/cli/start.py

robin-nitrokey · 2022-12-19T12:50:01Z

pynitrokey/cli/start.py

+def gpg_agent_set_identity(identity: int):
+    from pexpect import run
+
+    cmd = f"gpg-connect-agent 'SCD APDU 00 85 00 0{identity}' /bye"


It could make sense to run SERIALNO before this one:

This command should be used to check for the presence of a card. It is special in that it can be used to reset the card. Most other commands will return an error when a card change has been detected and the use of this function is therefore required.

pynitrokey/cli/start.py

robin-nitrokey · 2022-12-19T13:00:06Z

Ah, sorry, I commented on an outdated version. Will review again.

robin-nitrokey · 2022-12-19T13:01:38Z

pynitrokey/cli/start.py

+
+
+def gpg_agent_set_identity(identity: int):
+    from subprocess import check_output as run


I’d prefer removing that rename because there also is subprocess.run.

dvzrv · 2023-01-05T13:16:57Z

pynitrokey/cli/start.py

+def gpg_agent_set_identity(identity: int):
+    from subprocess import check_output as run
+
+    cmd = f"gpg-connect-agent" f"|SCD APDU 00 85 00 0{identity}" f"|/bye".split("|")


You don't need an f-string for all of those strings.
Also, it might be worth providing a string list instead.

szszszsz · 2023-04-21T08:09:05Z

To do: review, re-test and release as-is, with a further improvement plan if necessary

szszszsz added 5 commits December 17, 2022 18:22

NK Start: use pcscd and gpg-connect-agent for switching ids

518b7d4

Add guard for the pcsc feature import

99953d0

Cleanup implementation. Use logger instead of print.

9306b89

Remove mypy_cache on clean

8818cd5

Mypy: ignore smartcard.pcsc related errors

ae1e375

Ignore smartcard.pcsc types Ignore this particular mypy error

szszszsz added the device/Nitrokey Start Concerns Nitrokey Start label Dec 17, 2022

szszszsz requested a review from robin-nitrokey December 17, 2022 17:35

szszszsz mentioned this pull request Dec 17, 2022

0.4.31: Switching of identies often fails #295

Open

szszszsz commented Dec 17, 2022

View reviewed changes

Support another gpg-agent error

8767cf3

robin-nitrokey mentioned this pull request Dec 19, 2022

Make fix reformats, with Python set to 39 #304

Merged

5 tasks

robin-nitrokey reviewed Dec 19, 2022

View reviewed changes

WIP SIGN try to get serial number data by reading AID file

c1534df

szszszsz marked this pull request as draft December 29, 2022 09:52

szszszsz self-assigned this Dec 29, 2022

dvzrv suggested changes Jan 5, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Nitrokey Start ID switching without sudo #305

Nitrokey Start ID switching without sudo #305

szszszsz commented Dec 17, 2022 •

edited

Loading

szszszsz Dec 17, 2022

robin-nitrokey left a comment •

edited

Loading

robin-nitrokey Dec 19, 2022

robin-nitrokey commented Dec 19, 2022

robin-nitrokey Dec 19, 2022

dvzrv Jan 5, 2023

szszszsz commented Apr 21, 2023



		def gpg_agent_set_identity(identity: int):
		from subprocess import check_output as run

Nitrokey Start ID switching without sudo #305

Are you sure you want to change the base?

Nitrokey Start ID switching without sudo #305

Conversation

szszszsz commented Dec 17, 2022 • edited Loading

Changes

Checklist

Further work

Test Environment and Execution

Setup snippet

Relevant Output Example

szszszsz Dec 17, 2022

Choose a reason for hiding this comment

robin-nitrokey left a comment • edited Loading

Choose a reason for hiding this comment

robin-nitrokey Dec 19, 2022

Choose a reason for hiding this comment

robin-nitrokey commented Dec 19, 2022

robin-nitrokey Dec 19, 2022

Choose a reason for hiding this comment

dvzrv Jan 5, 2023

Choose a reason for hiding this comment

szszszsz commented Apr 21, 2023

szszszsz commented Dec 17, 2022 •

edited

Loading

robin-nitrokey left a comment •

edited

Loading