From 01b8b4f0bd1535d6a90fcd3a7c6f92deea169741 Mon Sep 17 00:00:00 2001 From: Robin Krahl Date: Wed, 14 Apr 2021 12:14:57 +0200 Subject: [PATCH] Add --only-aes-key option to reset command This patch adds an --only-aes-key option to the reset command to only build a new AES key without performing a full factory reset. Fixes #69 --- CHANGELOG.md | 2 ++ doc/nitrocli.1 | 8 +++++-- doc/nitrocli.1.pdf | Bin 48011 -> 48261 bytes src/args.rs | 9 ++++++- src/commands.rs | 38 +++++++++++++++++------------ src/tests/reset.rs | 58 ++++++++++++++++++++++++++++++++++++++++++++- 6 files changed, 96 insertions(+), 19 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c4b6fe13..8394bd4c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ Unreleased - Fixed pinentry dialog highlighting some messages incorrectly as errors - Switched to using GitHub Actions as the project's CI pipeline - Bumped `nitrokey` dependency to `0.9.0` +- Added the `--only-aes-key` option to the `reset` command to build a new AES + key without performing a factory reset 0.4.0 diff --git a/doc/nitrocli.1 b/doc/nitrocli.1 index 9b602de6..d3301248 100644 --- a/doc/nitrocli.1 +++ b/doc/nitrocli.1 @@ -1,4 +1,4 @@ -.TH NITROCLI 1 2021-04-14 +.TH NITROCLI 1 2021-04-17 .SH NAME nitrocli \- access Nitrokey devices .SH SYNOPSIS @@ -79,12 +79,16 @@ This command locks the password safe (see the Password safe section). On the Nitrokey Storage, it will also close any active encrypted or hidden volumes (see the Storage section). .TP -.B nitrocli reset +.B nitrocli reset \fR[\fB\-\-only-aes-key\fR] Perform a factory reset on the Nitrokey. This command performs a factory reset on the OpenPGP smart card, clears the flash storage and builds a new AES key. The user PIN is reset to 123456, the admin PIN to 12345678. +If the \fB\-\-only-aes-key\fR option is set, the command does not perform a +full factory reset but only creates a new AES key. +The AES key is for example used to encrypt the password safe. + This command requires the admin PIN. To avoid accidental calls of this command, the user has to enter the PIN even if it has been cached. diff --git a/doc/nitrocli.1.pdf b/doc/nitrocli.1.pdf index c4e7ffabcfc73c616a3e96be4dcf40d65cc08d0f..3d6f6c9b0240b08dc184df6dc42ad643e2fd6fb3 100644 GIT binary patch delta 18928 zcmV({K+?a9_X36a0)>SlBV zyNs&BR&%p84u>W@vc}?^C?7y{k&O`=XaQ(a?QigWivMvkvlcAflI#f`C=!LNTwlIS zd}J{fEXIHCXLY!V+0)I(8$o|%?niZC-{0MQ`%8|0xO=>@hXuMt~Y3$)c{`v7vl4?0qyC zLkHfH>OxB{wRD%zJLpTz72NIq8eSeuHP&7Ge#6<%Eeau9q|SM+l{Y-PVy4VMjo95H zc&x}V=FHxIO-2s&xV=l^^EH*){|PordC_^=i_L0tn1mn-tA1wo;MP` zt<$J$P6sp0eErVafeze~+qXg|Tof`m&G{AYo#h~ZrBlX>Sx#T3q5ZXhD4W5ItAtE5 z2(R~ibib6ZAj)xE_(b~SkFIUb+tLi%4{wr8+7r@Wq++s4MH*d0~)ad}KtTd6ujyLnZoam7&uREIR$Ns*t1AX&|Kl z1By6*$*(H)^U<_#e|+o0l|z|8$psS&p{(rTQ1&CM%6@kXiD}B-mfwHNVb2B^cD(mt zBOKzK>Sl-6w}xax5KtBrNt|<)d&jHN24*l+qHU z{{+`)ZOi)gBcaDPvs{#*a+dwYR4llV(tE5sViBR*p!6+8!3TZUK{>YF=%bIpKLMOP zl5*f*6@W);X#=~+i3h6fSQpU=6Qr@4Y?TmDUV7<@syF3mT!c|Rr!XZMS4F_od3XVT zVkWS?7T!41dKuoY_J@GB7}D=9geoXlHKA?5<9enrWJo$)JUj;Z0GdMkp5b5#V9;y? z^sYEp(WmloY$%gC(UfO zQRVDQP>{28mz*x7@D9#xgq-t5+GMx-fE(D{XJHIeIA_L#3WDJJ;KGws52mDVJG2?s>d zp|iTv>xK_>Y-;#fG3)r~ScvmWJ?^270**puaYiYD|7A7+$G*lygOFHC@a-?q?w!iu z(NsB9iB7HYZF^~13LGI6U{7Y}P(mTcqbCFw%)pBqwyFRM7f+4+Ggl;V#hl)_4%xK^ z761Ly2C5D2%OkL4sDCrVEi({*D|RS%V7G6L(iSGfDd7EcIm=x!y|JFMkVw)U7gh}Xjiu_sGs z4A+s{_Zy3Omeyd(oO(Qe0*6gIocg+bg6E~Bqgy1q=>iAuqg^?co@<31gDXg0BJ4d= z=k8YYFcUoeTDsh$qmMR8{B^G4@YYMK5K){;SSB05MPeTOayW#3Gb88Mc=-%&*hI`j za*7zps!y&%w_Bm@HbYV$&oDQREk}E`FWV8io>oykXBY!vWz)QlD{T zA79mng60zYLGp?YfCeHt{cK)-xVV|TN2 zVRH_a@Xa<&6;BJj;7`^d37kBZa>+`*z^nueCD!9_y3tTkFSyUd%6{(;FTm+71q)-f z$`ePZdvrU&i%cTZ57-{S0%2$9Cuj?9AS&|2MlA;#;XTcNf0)no$yDQI-_+1itY{p+ zt!Uy11RcZa=%#L2BshhJ?se??@sbYxsi}La?G6UT&#r-x{A6}%1;;MH4lc&ERiL7H zJg4I}H-T5OOZM5+5)?NIzIgYUTDV^PfM_Din+{ndO(A*+m0__{}f|dR(&=-?xR<<%(~VD zkqutUf>j^Pd6Hesaqs2?K&1h6DDZ20B+mbTBIR9wzpQ2pCm3|seN7`Dj(y)58Z5vO zcO<4=apG;7+oJ*7r5(PbS2RM;Cg@yKiX|zKn9z`3_LG%Z`Z9DX*Vpk?NWJg?FA%fp zs@tL7T{<5@51f(4Uv8dO+GOU^IGiwpriar2CDiWf3eB2P5G1YBWa@}8z^4!CXX!nV z`mJMsj==C{ECB$JETkreY7J|}VH7E*6sOp%2R&@4VJGavHZhkRNp5Jf>#!~#_vVNz zlyGG4k1)l&?1Kh8ASA^#O;P({4`znfu^&$f32M<&!*1-aW*ST*IhXKciYsCA*C^Y zMIBOIi?HY{-v;v`W0R0^uixAfL9ym!I9IPmkJ-18RFeU<9WtiQvE=*6M0|(*tDR#j zQW!&Lt1ZjeqVLd^PbW;C2HG3W;*3^@I68UUD>4fSl7~LGLcQ5i0S8Yz@Xt~icb0az zp@D5>SgvsoHbKF78dg{U5S@lkO<{?D-glPBf$(Rr08Qy>1aOJ{?(dFp0b&c4t^AMM za!V_4TZWFO%)nbLqq)u z2fV(lK%W6W{lTb#J#2q9&uHWG0GA-rFSv??AuvrQePqzbEjknF_Te&2IMKK?O7lFE z;d5SlUamTnmU3lD)Ya`s`>y(bU>w4M5Iy@`g|KcX6iRKo1;Z~j&vkbi&{zm(z-SGm zItgBt#f+{G_9G=4e;T_3lyXH&FXDhZ&fe9Bx`A=U^|Bn_MV6isVqf&K0=c-DzVlw$ zlcX*a>0(!MK)@2QsyI-|D#7YU`j{Hv8w!x%_W!J-KSys@1w>z@EvKRE&Xu-;rSR;HY+A1{(u*Dr70ChYAc`BAsJuXebWNtw#bE~U8a zHo5Nh`>Ndx-ujXm2y(8Sed6~Nmio39dDDi8T(5R zK`Ew^uHH4|<8J33@~UKIN^>hha*IMu`-xNtN~QbqQ)RymHlS&L>Aw2+{5kHQ_*9K! zRd46dtvH-0!9pv>jpAu8rLoZu&2Bf4ajVIj?@3+t8}itUThfC)x;@!cV|7J3+-wEz z%E`LEV7W+DUbyq#Yy6Vp7b@ja1=GR_r8RH=*f(R-K9Fj+Bl?o%DWyD1J~V^*6wgR6 zS9vbek`~E&+YF?CJAk{!rfbPqy}JY#$Xw)!9!Pc99Y@l&+E{eO3X$@xnA9qTJ#*U~ zdop(9W7`Z{a^Ll&BCH@kHs5(Y@yHTzqeOBu!Y6IpjpR<_Z?)d(%@uKHc)fYfQdQ2> zhQq}(%@G2Z0wF0yazC0)jD0vwh4=ba&)vs(S`h}uqz|banL>4Rv?{)DpP<2R?KyWU0@Y12g!+^VY;9xWx<}- zxjfBJ`<7?Qz~*1$iWQn16_#agM7%-e z7RcavS_E!86W$q1Gm(4oyMu`wFw&sMtC_hVxFH6A5$VHN^&wqlE!nj9*zRIKY z@ndigE5KB_@-C9N90Luu3&DyZCCjv+5K`?h>S}`+1HJ2agN-E)5tlCgt z`Z3-PHK>n$502YCk^b1WNEgTn;KPjuXE!wzoQz#xJ?JZAB;5REbJy!V z`TLyLDMW1+$z1yFhiUs9D6m{^e>@yI02A(i{9qET@g78KH#aM0--5#-9$&`DC_~1w z6wDRO%aqOF#{pfA8~^ncE`-!0SjGZTC}F+u8gk1+2We)zN6LVG&2t_3`G;$gabA$l zhW^^AoLR7gMU@Nf6URRS1>=MTZ=Z`J8kQfn6r2+~FL`tt$E)IZy zEDI6giE^unVcCtziR3>Rp4DClw+*`P^$4G1XoF8-A@K09>qf`m9L?hZl3e@Hab#vw zl>mUqpw`tG)GAX+1>+$ZgM;y=M3c)FTn?L}Y zP`v~g0G(zK(i;sb_u4ofO$NM@XUdCzw|;G5gDI7lbDlT$Fg8P>V}IvG$|sih{?1Q$ zJ3>4peFs;w6b>-No7_PD>(=%E7=TR@4ST~iB<MtdQxOb=LNM!pAKecw zqFpFv;5@42Jn+UXC{^u-4)d|C6dZjMBmqmo9GpOz7ZUWtm@vMiIdEna5(UeQ4X{=@ z%ZU(2G$LB%o&iYKaq5!UL>hkIU01&&`{Q7$zTv5@w|&<(ziU?k8}ZE=r*?HX?3&tD zrKl>_M0yylrk?7IbR|>;U`D5Z%5CDa3TU1yWW8lNvW|agQMCTksV<@$55TUYdk`#W zpDZBXso-10-=bqE0)GF1R>S+=E(k(_kD-O~1h7~YYFL$qMDXkUggljzWVfG|I`LFY zcs?tgcSj_cfb27|-?Sj?4Ato*xRGkbp?8uZqUur^{Mepy1Yn%Xb5sIzFbsnVV!`wUp8R>LF9Pg7Uz?D($wuEBtUzTc zeJtVz7A)0qH@>}0$!p!4Ob2a$S@`hskH&o~3!NK2YC8`LBXFmGP~Lt#g+jwDtNq{w z8kON3#WRM#`F=`2xi9nQ-5I1gxA8ZyTWk|0y)UN2Foc#d+ z)}%VUT5uOsu`5^g0PJ{F^%ssiIs=KOg|-d{aVyGJXh-_O{3pMxuK||89fh5-%mx+v z=3zVfam6$oz?T1QGHCnJb=TTL98Y#xH~IK*be#)Gh(GavkZ)!_D5et4W@r;Uk^cdf z)E0>$XM??$WUJCVG--zWZJCedy=ih}noVV@US5AX1GMg;{};$nz(Lcur^UT>#Iky9+D(U(SH%mN zJU%Ns)ileT);~ra)pTyoq8xF~&XDn$pDC~I=Yj+FqHj+NPAzqO`g9-WLS4VdhGeLl z<@mG!uAL-0Ng~ebmb0Yyp%rsn6upal>qva zYB86NMR=R+t0&^7@p^w4pOAPHAV8Mw4 zmX@f0y_u`vSjDt>ldV@+Bmu9unQgLuHo=!B;f5$$;Ba{ZB+{~+QgxwRr|o99!$H^3 zmRnixEs(v9jN~T$LDVpYL*rRypLdox6OzGeHW=*80FR8rl+CbxHQnnNnxkrx)fMBA z`s;1gSM?Y`WIfEVlMm%`^3crcxf08wKtq0i)^0}Ni+V0;XLFb`nrsR?F~3c$A3^&D z`SSpOKm%V{!+rba`sN1kywPqLN$#FT-*x0)G91*bGSKft20_$wtPsuAum{Y8suS$I zxVW%@URj3Oy=%J^l+|T44$ZmMcG9mRRwMvyZ{|tQrk-FeGk(lrfB7Y40o;PiIe~$H z3^`w5B%i?}_!Mi?&|#gu6HNLiGCt0>#y&`fi;HMx0|m3cE=E688;H1lwL?nCEgLK_L#Y|ZVdI0799jy~=0p!P!!r!wnD?vm z$&%$(T;bd{aL$=Q3N-IoIW@~Umx~sE+;q9+nHJoZ!SGmCPCK}p+o&ryJW2DY1)r;m zBQL?ct|xo&%s0HV7TnASRDP-j55w{tGD|dp$*FC>moxrnUAUAWREVvUT{tA;sdSfq z;CP}P&w)mZ`Ro{LO8KRBoKCl$U*C^2pWS>DzMLKvQ0e(xo5Y21P%Vezwwxz_{4mmC z({Pfdnf3Kl4A|{vQ%y2WFcJ5r4B2+a-G*$d#Vt8iK-4oLD69qNRFHlf&u61);cnO2 z0U8caLRI=`M$~b#wiIBTPQ2|HHTHTz3N+cGL^4yHEVP?vN^S_)D9scskBgWFn!X0F zqV1!8R$%X@7-U)=J?Sn;XSjxceIV#IL0o`-$(+pegv=~ssVKZT7ln3IVdL#tzNqfP zG+N|f}jj_C`3oqKwEUhj0(FD+aOXtvdVX9ltVKl5`i z0A9~VWrJ|B{k`64Hy}QBp*Y4ramD?bSM0o94RMRlsC*QMapt{p%tdo3Vbb#Sw75N?4HSooC3`XAGs&< zp`6|-S>(gz)tbwL3U4QW2w$Pf%>BNVD6!Qz|2m(4Jm z_u^cY1^@@gyDNQDbKcx9tRRaNnu_c*2WL2}WV)no9$Jk2bTMmY zg*11x;RP8#nK0wgrIsPDoS5BX^Br9%mo&UnvUp>lgnqR6@*4x0ul(?Zfo(NEtAy6H zP|LI4LjyelGB?HTVmEwOu#PlDW8o$J@WSME97po$8GAEtE-Q|E^0KSnU6JeRFqmHr zwZ5tQ4qR&fUfgAWNC^8d`ql2$3}q*i^8#sznjsKiYHzBR+}XsQ;VhVCiymiR9S*?e z5L~d*6AENdhb#LQ&WN%_>3NkPtFd%OSVrmLAH#swtq$o^(EmTT_ z5CBPld5p7_IB{%eJzHC;u^%W7Br!Wfj!BNSO6@1?ulOI+jT=GE=wg>#WoZZkjmGKI zryKK`q?C~qf877|{vsu}7oRVf`INZ->OJ|(`r=PNO8j7bb72QFA~}&+M%Md_Y^$_JT1;YZp|RvBqR{O&+;XQc+5?O0Y#uKvY7XUxyd zsLG{s!-idFEGwxh6?!9oS|+2J^IP)iw@vU@w3dPqdFfYtyD$^L#me$oGrNVQ{{2Ex z9^OZFT7calrTfteY4A3GW^gLo0rVA=W zng-ineXk1_<_8~2M3Nf`o+x3m$D9bLW~E2u*I_@#`@3Ny)@ZRBw2J0#*L3-5#1Qhvpd0} zeC{y2@$mJ~w2%2D%cxQTkaMI7%3h4LcMHp4DHTZYDWpaAML1)~wa%tbhJ7cjSGtOj14j?8go|!%U+)O4gj1xaG5RaLAyu;ZRZp&#lMemZ3z3Xyj z{bWa7&8Ns={-PlbB4bCc!4C7-`Xua(sRB}oBLV!) z!E>DU1t)HQpJTLHhf(tS<|JK-87^Lw0Z*Z!;&^@{2}mHUi88u=A!~$!BoRFNGCqXG zy&r_7Lhvt~*AuvqS!4yHg*pQZMOlbhKl8@Hg1`#fW~i=rdP^@?g;2>F)*A1PZ30-) zMkk}W@LP?DW9IX&M-w|cuY)wHdK14Z4ti0s8EH=FEfyf)YF0uU^HA_LRRmV`p~ z4uN@pyHvbD-MK8d4-b_VF)5!$2@sH+6!H_P2XGZ60D#8MJ9*((<^tR>7eMvWr!@fEU;!dbo+`su0fJadQCn=#0J3gE9}g9XHEx0& ziIIgNl4ob(#ZrjU{AK9E0&ymjR;(@iMZuBDZO9S#O zL83>!ZF@1OSm`;FnSBUJ)q#vG}bnN=-R$r0I zG5nk6y4QR1&)M`WWmKl;j6TdVSO|gMoHUS^N~hP{lAGj9vjv$ELJOQ-=E1$>WAgrg z=MPY6Bl-xGe3*m=i@z1e;)73A1T<|G&+C@xs=jk+Y|!>C^3WX(tOwX8F4;#CUsI zgLt}Z1aXk+D7AfC+g@A!s_G#8#&q)JiHNY6anGqA%(wcI}8AMIZ;{2;>k%*s>&H84{9s z9D@==Fk~VopQuOd{Hq+Z3zNxvc(Tb?~kawF8>#n3m;#B`sp6Wjx|Q zn+)(b1DcQmPtFfg5G@W)50GX;%w18!UzxCbrtCyNa;l=mQQMBGZlLd-x08(=2KBw z=o$hj?Tr5H+MP{igWlPHboaa7ZLRh*r-$W?>91#$Pf3Jv9(0vC2JdV8cB>bXr9fmo zqYiuP!IDERpOkuiSGBi#Fh*cG^2TVM3|C+OabpZPu^1>G==ct-GPxThMs=-sh!aRf z8Dq&$E}hH~!J$BwQRRCsSYac%2;q_|5%nD~vkb?>0jf6}K4#f}!D89wWRCrmoG;2Z za|n<{4@Vo@UoN@R+STr;2dkL2#Na*-^+l>OHxJLGso_kTDyS?Xg^hg%3T@BJCCWfX**QXR=cxtS2Yo_U)#GFZ1pw#rDYDA)sWFqM+!y!f$qEnTzHdf- z%8H<&mFM!)$mcA7YE1jc4{ztVJD<5XD7S10CrrHCdOtL4Z|}cDEq(&ks6lJx1FDB|ipEXy1}X*uuLhqENQP;Oot^o{m4XD5iYL~~VjR0d z%cK&$Ka3Bq)O_BuB92XeX(y$^P0&C|L++~iTG-Z@_};JeMccNj?`2?XMDVF5cf;+zsa;DT| zot;2eu-4H0dgY6+l~C9+iHKfU$(RIl2`ICjc~Liiw|5X|cU513vgn7!MgTjZ-FE|$ zE!4Nev4*5QEJ6n;yG(u9cjJMa^zfjl;AQ3y{A04!2kn}uty5;&c@cZ zu6sCB-wn~1e~7>b;=Ay<^f7gZ>$%zjroZnyI2BwJvJ(7l@4bLUNMkA5^n`<~1;aF& zqqlB{NP77s5wT%jkGlt48VEf%SQoRaNV<-Ho9#uxLrk0D;0IW>0g`X3-NFYZhxFQt z2$U$rbbplQR_46EaaRlRi-@0bf%yMv>>T=5*x9xQhYVSAuZmqqd6gmVU^{-($M*WP z;~^GwRl4h?sP*CAi(DR?h-m@9DOmROmS#u|dvYx`XN0$O!BqeY5y7HxcmAGIfvfO; z6U(VZxbg3z<|Yn_xXMnjNo=beAbewhBW0NY?{xix+vohg0PRup3ZH?BO@+^Wy^h#1 zXws8=gN)|k`zmSp8i;rJ@;WOQkQ{uh+#YThljT_Zg+`)slbJ6lQSy^*@C(2}8opF; zf*zQIg&Te+Pv*&0(hwG>1{;#mwmW8jIWxn&C6|ga0>!Y%@K~0eQA>cASS_A@T?z%V z%_XmJoaX_&a0QdLzU$hV!fv9}x1AA?z*BCVc?SguXyvYMs#yeQ)IRjp5iQBD|s z*zfE82_w6cPbXaeme_CWJ^6ll^5R{BzgTWh%wkTGfFweY<^IIGx?H|HUHI{kI|53nk;R{1=MXp#^=jB&?nuPWO56imo6o_T6r7UWP=q>-(C zk#qZI9O|8oC0_e*kZ9iEuOB34fzJbNEEO!$e!aZStDS!&Ir-`Gikg>(T?I|KNT1!6 zXEci4bKEl4TNVvzZzaL?L~ZrYusM9sTXJ8NC0R+b*2iwn&4vyDp29AnJulzvi)wmc z2w@JR%o(KYHu?y?91p@*{2&uF6S4ExQ}yg5PB~|8r>>Fp^rT??oY5fVCcM)#@jU~a z9|b98S?GT)Z^8YwApucU`9SV4Ju~DT~W3^(8w~cIh&e}GS3}~`e3i1jk< zV~{Z;Vz9W6l!^AXtJdgoUKZ^G0sGKxP?|mJv>|L$*9qkpRMy(FM$h|PV`-jW3Zi+K7AtsS}oL3(Y9W<3pc0CYF=CH!STVh z-&+K@Kr)C?O${;)jHgX&Z)?@BsXG03fQ^PJW9e7I7Ci%6 z1j)){uUY7Gm_;NjO66D)8&-f|CNB2( zv?qnhH=0Gde1uu3`;@+XynK80!{saT!{zIXsay{|$rHWIT&ok1_P~F-FMx%nytj3M zeTRY`B;ROH)~fol>uk+O9n0HUrGzRGgpq^ko8SKP_g5c`jURq|`{v?*FOKTQ3%#j^ zl8e}*t=g9}`vL~k%3P0qbJQ4vsxcah!QpRyn;n+I&R=;LDm{w=rx-joV3>w?dM?(O zp~IQEI#WFcrOoa76{>${4YaC<1pwMQoT8BBCIJEIWU!K(4nfxnD6$)?8rb^GJ8y_6 z_M;oQJ>%i_lQ(TlL&~CQvGY2jEl;5cg%jHP+@!p3pAC8Vi_N)I z*fPO~uBuxP^#cSlb=jx`YX%1Be#*w!jV|33M799dmy-lNk(W=>aO!)6@*Q zOwYI<=3{CEI1k<9KQDec9=dvC5!z{y2Btx=>zm-`dV~62E6P!hZ4K3(ijK^}iYKCp zrs{oDDn=swFf}$oVEczRUL$2+;00qC7}o?}Xo`aJ3{4-FPZNp(Z!2iXN*E_I?@DPm zpl7jl$uElvbOL|UFh#9Qyney??$m62{$Ok)Y+X&+(Ft*R?)%?x~<{vTi>c=67n0Y?Lpleni z4taa~Ec$;Q`mZGM`vLj!Kz{B0{5?U7W<=GsAx^)7r~*JrdJMrq|JXrc(&Kly3Q{@7 zsZt+wU-}$Q-sRSmG61FSB-pI9k@_W^KL;E*RFQwa{dp(`7}%&#LYt>=iZ-apwQP}v zE2T=AR|EU7Sv7c=+8>3eVU2temIP3adRQv;_=GZ7# zQVk6HvmzVQI38|-y`OChP^uj%r?Yqz9Ov;9WGZjGQOS%sj2yl2RV{Y*-cHu;4&Z14 z@XmiWqbT$uFbA1Eg)3B~@hI{5cn5ERfPmw2){6>3+0Z>WbOQn1S3JI~Ts~C__Z>)3 zXD(F9QrBM|aqsP$*ThUhXS&U^cOcM3ea`m>SE}HA2ev5!egHw#xIx8Ch&#Xjn$Y~e6>`?2ZTySV!ICH8!j2`0R^S8pz^me1bmYJ9=_U7hb?aI6%# z+uo14C5GNbO$tQVYX;B*yPoZHeXDLnBGES@FsYZN8QuE`>B~>D(EX~g{px}q{Y8HU z(nW|-vb`KpnDdG_GNi(Il|J1k^<0t}RDn0VH65%VwHOJLDvgb9`EVbl2&o7imns zU4{6I)$Ngfn30f^PzbWx961+ftE<`SpGTb2*mLoLRd&Q!NI6;Uj-1PXx94X!4!fC= zKg&|qNrBI@D58yPy_m+a%ZIaO|5*J6tcs0Q za~AqE49VOJ@WgBLmaAU)^#1bQ;@rGp{eTDOjN`-3m2BENPg{~!Whv7(ugZqB6>0A! zxy#YoIe_GoRSI4OR2UC`od>DBrs|WJ@+h_*Ib~*E5BGeQdTW#WP1#M$vqI5!gd%k~HXW?Zdr$g#9 zmzzg!W>kONqv(YmxBKn>g;tK~sJT}T6e75N_lmcvip1Xzy> zk39oz(F4dB<;;yu7QwAdU7I&8scr$FI!_8xcAK@V8vr%M1e-Tf`)jdsg&g@*(UA%UY#IC@F03cod}<@ut&UW)^j{=>ZZ`u`9i6GB#wc)!x@tcXvNc zRnNoRu@MmyQI1Ush%DsLNn~{fH^N7Yy#Y)EklrPut5Om-_w9T9!bG zVLG(;d-4F{8Vx+8!ZSUK$29Ckx6?jupI|CnP#}jh195#_>|TPkJJhR3@&4aXWig}T z|AH#!%$C`bR4tLIaw}$(-Pi~oy)6t<0kVg(kI(PQ1)DkM{im)?OH7FVzEFYSs zuvIpH~9I0_@@Yb(otW*}#zR5@)hjA0Vl9Qr!6m5H7}vxG7$?OK(- z-;knr_t4Yv$1>SK<7^YOcb9`ueS=P;uk$ym8*xm3HE4|_G-hjWSC%(vHIX`yvutQi z4+l(hYGsdUZy=ef&)t?h5#41PNePOGdYOp!?6d`e;C4=yLwPCdYXpV{VK@17o=i-AjW0#&|kjMu+ zoAua%sQ&=&5wQlk$y2=H+g+!dHOLL1iH-glh{`JO7+=8i!HvMy%i~CEaO6Ns6E?d* zBVqei@kgbEgtt@K36QbA?vlrU$t4j?6GIf~a-!(mo&&Zr&A+8dQ9RB91Fo)aC9_2| zjAhi111(ST7P7D?l!lX_--(S@$fnWSU zt-3)Y7K~`q0jtug235HQ9Seck>jW@U1MvO))RU9PpCu;`U=_XCWr5HTkMeea$B=al zDz4GZ?+o0{vK&7>R(KiNC-ip9$UfB}KxamMwObXar7Xycz3E$pca36QuPR2ht@_jX z(dv(T9qJUiJvY7N1b*#*>mLt~VUSQh?+Z0qH&xNKQV-%<$?x6lvcAc@3fMU6iF=)w zN&VQf*zP`utVO(VRD*KhVyHGPtX=LQ%Ak%6pL0D7KYk| z$Q9+|Mi=bd<2Yf6X#hrJ5s37zZt{KZc3;8Wpnr19d&YjqeD?=`?4RtF2JU+m{=ysf z2;fJ)*%ngOZz}6Hf%?DgN>%Jhk++(DFlp(NRV)yZ>m8IvSBvH4`7FjI5|G!gi+9hh zrjT;`70s(RQ!w~Jj~o&fu+`;>8T-+0jSN*~Qr8_1fvQreTJOH(1XP$68HX?&2J{h@ zz(2Mv?5eT#tS2UaG%r%ggY%$Sn_&X26U?Nle5RzBN4@X|HoV8v_kFmsC%eh6ajsJv zSb+JxEOE>RQb3pUrY=Iu6+;}3C;JB$T3M#I;N!&`oWuwFpWnRskcw6SnyUe%YOBU- z;83-r6*0(fE7TZ_Kw6LCxUGhXvVwwb(|csp3lv|UpX?xiBW~CUQqjCFAIaY0KB7MF zcj||B_rv{=NXG=n`dhN;iZ+K5!bF3&uqb*BfeF``ow5)5hfUbz+EJ#fEH!THZejX1 zZk%3FS=xQI{WOBh8)@`w=LC9%+Dn*Mu>$%v1Fm22RMYOCz0r0XT<$1=qgmRla|}ht zgWQIDn2{ELvR*@P+-SR;3kjVcGDh?n3-K`>b*JoO#y(kV-EL~vwp%o|HVu;oLNf>0 z+Xt*21uP0iYd<)o&hPG9Gne*lIVsR*FV=`o)zN@b4t`})nes-Fo3bF#U!~#2m%5+? z5R&i*LULJTzUu-ad_!zkQ|Tmr5BaT+sTKSa))-C`OSmT?#%F&kPyIJ+9zmpeJF?8E^V; z1H)0z!(rL%1yvJ(K@t2{)>V2uQ)uJ3)(jHY4Da|@S8rjsf_|*Mpl+xdB-AFz5^Gj< zJEmHHF}_@XGt|{8?~`$l1;IIx^+PpI81u_q(euCa6vnx=YJU1hRZ~q zO`@*dZgd%g76*55k+*@o%A^_jhDc#y*<~OE$Sy-{SwSJ%y!dIduZ~pdm=UNP^RYL4 zje&FNjRT{!tW)eVcE`+do8b*40WWzbQx`*j8iE2ce58U?%Opdt+toShKrGRw#adCz zU8q!(mYic+R$YVP+%$AH51>OvZtN`cOAsKM_a0>~}lQH3RUJ(L9) zO73ztcf}n38=w!1)zM$!&wl_zsS-hDZe(+Ga%Ev{3T19&Z(?c+Gcq7BAa7!73NkqY zF))+FOjLiqRN5bu(v}sJZOKZN=&CaIByrcV!FCAgYTtlY;T`wPj4!ddw1Cu-AAo&) zF5mgiHzz(v1XD!Rr~Vx+Mg+}9=Oe1GqWV{~Krbhw?GK*1Fqw{wF-0Cjp5vg&Vr0GB zpL`fkzKj^d0Vm2}5|1eLFhi5o$U53R*#BhFPh)@dMrN`IQ)NqiAN!6mCCco?+RYb> zFpEoc7-mbbvMCKbV!ZPJ2LWN7ukqiLKSnm>F3=g<5x1Q&}FSNeM(&Y)DZY6dVTO^_LewG(Z>_KoE(zphGkP1hIqw&VUmF$O;Hb zafhKhx=83!LNiJm5rVKNqJV|66vgh?D6(SgyYPvl!!|pY0$8oovd4=AS3WeR(EGNv)Bk#@n zFdMD+YPC(8-&qxyvREOl$A;*u1q064EaO9T3}E5G$-s(=;P!^8AU}=pK%Z^P!cHo8 zg?y#{_AC*d8nCOH%P#P$4-u(}ZBd1eGW((^BgdoOy@bR|a9y`?JSWwcR$1bBFg zVaq9Ao^qljD)ljk9+#sqM+JjiFwGsb%s#H4Mv8vcI@6>L)TEkc;z@eMInN7E!#wc* zZl`F&2VvjzJX--DDcI^A6JeuxLw8k`N~$nVi=yhZEM+>my@bva6c}4I*RWbc5>e&S zT#cbe*VUc)^w33fq193i+wU_o9UoPC)4p(D!3;&2#hfz+W%)0Yc_B;rN4J^>Ip-s0 zmGG+8q2o<=HhdfUtWZbYaJw_;qp%5!ilY(eHWvw+dH( znk|eLtUSb~=1Kpv5J> z_~y;aF=-{0MH#cg#2an=;@lrQcO~#%*LDBA?>I}*)v~)>MMD*Y0sOA8M0u1-ewkQ4cwvLf7+;i5t>QP)v*M=I^n&lmZ>trLi-7)!!$AToTT% zK1z(R?l{y^f}BNfCl&&-Z#D~=Ys=Dt${Wpn#`ea8PaKl~uTo|HR_ds_8JBe+@rS0U z)2NPUX4i1>-Ma^cCf(CNGdEQ97`ZQbXSSPl=NE*h8@en|TQHtu<$L7E$a_;GBjVuc z+3$;cmlU>3lH4n3v)(z_0WlS{Jf=nIdIan5H~6@3{@(KkGG zx}(h6_Qb7gVfXL6U|TGCymw|emJ_+=jZa9)^>@wMZdY$Byt|@WujTfz18tV{jW^Lp zDu=DyMN#Dye#Cgq!eX!U;pRq1JN&{8BiEo;e0`_m^^CmM)t)^+7$o?=3bvNI4JXg; z6Hng$?&HK|iN{P>AN5puW%ji>Ui7fNiixJru7^}#Goe}CKBmJz-Gz2Gf?)~^4e?{Ns@IhYcWS{Lc z(%Ih>vwDBF2BXwgi&I>BUt|nXdb`dU>MHf)F47`*%bZy;XJk1&ZjbihQm`3(Q`~kr zn;qwoO#@7>dv-o^Wj-H$Z9Cl}iB9kHG*E)k>gS%rO4>2&;fScNSp9{0rJ6%RN%bJ> znJ)$334(M4paW2PUp4sot5(e~CLAsSU~De1nS<}AZ3aPqY%?HxHe)!(;UH`_8)PG< zmgxs;OsWlQn-tY>5JUi3s)u6zKgNo6UR!XSX7ni#Fgj#J`E7t;1Ob!gAQ;1Cf5!d^ z2SF&5o>4~^Kr}KO#vuqN!x0Q5;~;`YBhy0&1cBsOlpy4AFb(-FU;6z9EoBJ9(tYbq z1%T|J@Mo1UO}-k424Ex{fZ-5X9tfcF@?he3+Rq$=AOii}9l?KX1OW^nNF=fr(By1{ z|CikWfyl*z0NEE1BNZo*)ea$myh0d)$p(TL0m_jOG=l7mET6oCFiaym4H5(>kn1{# zLu3*N0Y9DRNNqwPIbsk;P%;ieWyX_Y5%51^1b?hz2!jZ+7#M(2G6{_1n4CZqlC1Yp?7!~rnV-ob%^;0$6Lv5mRK`u`$i_k}H# ZP(GW-KgQ$wQxF_PaLUGw4%?ZOe*-nQF@FF6 delta 18556 zcmV(|K+(U2`2vgg0_I>9=K7iOWM_^RlE_APRrRe~ zw+bIgN*PJ<$N#R5tCT#fKCYPkl=xrOk^Hb-efMjDA8hYeZZRVTCxw(`dt4=NUT=S0 zZ~wL8oGOvxg6(d9#aKZ(**>n4UtazE`hCLQugOoQF`Yi(T2_{{lx}H?%Wjib?eVCa zT~Gd|n=`E1Fs6#s?Jg8mD&^x|>wj+l3RWp^)rJ)rEef&`IqrCyH1*J}!33q4O4{mB zlS5m5@J|I_VDW}=YXVKt8L;+eSVo4uA#Y%Z_5<3wfe>YXWLvFrLCd^!MknTi-(~K> zYE{x)sNhjTxAUob)QOepuoZL+U>QaMkpNxePnr2GDH&A<#M^Q7%|q}TU`yia;# z?1Hz}bf!4viu*(CGZ;%n1)S|ajSu&x8tS%rzoz7u1~;+3a8=MkiQss0#Z8`r8L2;o z(Nx&Lm18&VJCu|6D#KJ+cA4sCCUZtz(_xnTBraJBG{ zCl@{L%V}P)@CDdEGfdGU8?9pY%uj}x@$sChJXNDv%t5QEy31)WJJNP!U+;FNA)nS9 zqph-}J)DoGpTzo|^8*98v0>jZB`GU;44RKCo;$&RpoLRT%L%5R!qEL&!Y!NL3@-pu zWNwSMrn_&uBhlpE0VGq2uE4|#>2M3uHdDM>dqcpOR5X_hzzV6p23VEF7~0j33*erd zO}#Y=QnO5Dan-0_PNsSL(_0_K0?-SY5M3;paC`Sh-3_GD-R=hPVsz)S;=j7zliuG3 zo_n`{W}XPn^$7a})xWpL^4hx3Aw22$~DX&=SUl%<>zThB;(VFy$0*-evnU?{tNG67g%M<4!k#W z=1nJ*1UYZxK|Lw(GF}d5+?q=SiAe7KpJfJ-wJ@=ca79^>ib$g5&Hx`&y4suFGNoC6 zmQe|1g_ka^6VDB9Sx8&XMobrZxSgvdL`n)UW0A%D>Ls}{7K0r&^l1Qbgy~PmFOoTK!HzqLT+_4PkSd{?`oprmQIa8qq zp?Q`ck_Vtfo1;(8+K3YBW;(LxGlxlkIINtIcjn2vZ4CPG`L{Ksn^L(*z^T6ex9M+) zfm7yuUngvVqC>&1H z>JY_D5Df?Lphi$YTxxw+AL`+M;v7QB!9e+?g-Cv@`vI=sx;l{-URAtbI|6it3sH0K za0x6nO@Hp{<^jIfP6upIWn?o_yiIm`(4m?}n86WtKgrxVWY+>IG%eKKg#gGI&5ExC z`W7R7a%c(1`J}^BpL&J-;!VO#Sp!L0-AbRTawt9%Rdh`dO~{9giYTIgl%*g?0#uIe zZb7}99Mx1hA>cH1Rru9jHxEwG0VVD>k6k?&f;$AqK3VZBbHHwZob`_`5=B6zNrQsF zVgnEY%VkKU+STCUa*7ApLjjnTH>v$oKxgR^Ed-27R0YM1Z&Rm0!iT|=MHoZ|xu_j0?xSdIKxO%SbMn6T=H3XaP;52jX$^%paFLKL5I-en{c_?o5$7%Z{Lsp|HzPRb`P(wArGyL{eCs@Mh&nMsH z@KVw-k&;u}4NnEpH}yDULbss*pY3t*P71dN_6biY4jVM2SO>kA+8k&s3K<(#;dXr@ zswAv)YXr^w8YiHCY!$bXANx-cMY6XqiE`fF=AzuR-u7wj+;9oECB`=UYSD}p6Sw?$ zHeC%nLeXg+=20(8Xz)X~ot$c5%%NLmOiuH$M!R_nqRr`Aa(9_;S>Pxm3hIZ`!xsoc zGb|LDq*)os*Y3H*1C$X|TrV>Gc&Bz2@GKr~lUH_DaIMsTDPDX74xkvwJl63mASke{ zcJBC_U;4wbkNXCU`>I$?`guK=W%W|1eA7@}`U581fW5A17V3AC6>e!{aITzCdDY?0 zuGh6~PoeA#MM5jjctFMDe)JN{aT>{PI`0_Msc!mu_cYda$^@h>SoUH`bmon2&7Hv} zQbs|A6DxFo8hZNVW~}4@$s%V(Y}l2r1Q2Y0hd-nSgOi-Lud(fTR_wur#UWT` zuQIZ?aJwc~fdrO7J>l5p1X}i2Vz<2^8pk&$(^WVse+g( z;v_QZ`!Nd`PJy?e$NVTHpZi6_asr zrQgN?0Dfgi;@59(tO#-b{3BSV89Mp5dsi{CyQD#Os* z$rQ@$0VPIDcA;a0t2wo6?t9Qj09fS?hBA4nP}D9uG4Yiy%wzFIy#}qb@t(wJ)5qonTvKFi~yBn8bo|@b# zlb1P@inG@=SL4Exj_H&)Cz?>dmu|Q9O zHEn+tZg#?R2Ztc>&qND{o-dQv?D0c?PAUAW4UqkzoD6fH6a}U$Co_AeeVWUB#37Uz zJ#tIhx*6=Gt3Db}cCeY6%8=4)bO&%_Q3t690B_GdIt^Di>h+jk?iCQad>+~(ByeR% zTUG+@D0x>O>jN|vt!U7P<&(_A*-oCZ66wdP!$HJCze`g+jo6yyZmr?lY&#A5d^VHAY%?a_26R+fUu5kr6 z6HzpL(F@s<#?Jgd^XEbl{_;f+gLWgiiGBrYOlO0b%mF9)OO5XZ9Q)aKJZ{niytr$R zcHnfgoN_`xuB7^k7`jb5q(&rvL_k&;$w3E=BRTvOw|1e#QdP*9A6Z$t`?n20+;gX` z1{(B-wIec-Aa~!jXMB@o!Ym-AI1C?0{r>IM9_1@=+2^M2_qJkb!gBIc{X_5=XAGe5 z@TJ6SEU1kmcl@g|2P8AIAO%+*rvbosr`O+i2wMk5az9K49_iTW?9KdFBJm~bbQluh zB)Ems61OBZdZSYpZ@`oh?-)P9U2=0F*7-nI~qlQ;I%Q!1 z5Cp*9O`OL#=}bF4nw5JNY>Kv+mP8FnwZ~KWfmHRc_#bmGUVKQhJBw5*)m>#<0)hKH z_uLEqLKx+Q;XnVg++Hy9aPi9px1SRKqui3;FE74*uknNB{e@f1i55glNtWA-YFqEf?adDqrC2Zu50n>NrBpNHC8s)U(~!b{FB5hdsKm5imV9pTJBDB6 z)PFdLP_IZ)mi4OI^~Hvi#b(oy<{o4iB)hT_9lEL|>jK2H`z?6RsOE|+xQNC{U>8`0 z%RzKfd7*fQhbu-IXCg>tzZ5icatV_MGv6h<`cg==WSZRjUrm#m2hx{+>uTjJmK!Q@#X?A@u+hqjc!SE>!@qr>`(P0nRcVmy`MKzO*vTyk@gzBw zX_g1`8J*ePntfk4I|9b)s{U$XHu6|+He}cIr0a{eCk5HrV^f-Ht2H;Ecb@rUAHPI5 zaRnyJcrXX-((EB1@g#b=$c&~LPi}TyUll7-_XM4*pQ8s?6__5JAawG%E+HgArEc9^g0UEvDtYYS?2hc) z<^iI%qxSs4ri%;$UKk8qRN~#PTJ-g{BKxB29xpjdns(LsXM&Lhk8*=$w9k=>{80C8 z^Jx-)O;XYnPVnx?{Nn0~+zw{cR7n+G7B*}f7tkj*%_LP>nxEM9$Jci4o3?nUuB?@C z_qX-Ow%U@vPWI;vl2)1%`**|s8O^mGws&cI*zX&NA>8@FqLXzWBx*CYD?*kMfDAsW ztdUU!$tBf8SWup)E;J4u`W!d@{++`wW0K{6Eh#n+OnUB@m)S!}E5v#u)Js)x@pox!275J0%wG<`>1;eg!b-u20U zbx0f!WWs8hLU@>{72QRxk5w-wnPwjV3>&mKW7#*77844I-Qzg2DH zN&y#~vK-V<4vZL8ipP+d=m3DHP8l252|rLq=17nGgA( zxQnfOi1M>=2yBC8L(R*1jK^|ZtBi~xtGM(|EI*O$q3fYAlkRC(uG?l;|5jm9?AK0q zyT)6g*zY%W=|IiuiDanidZ%W^^&as<42C31d$>w;+cJLDIA zdkHw6=Nuj=H#KScJ>Y8ZALQJBKdB&H@)*(>ep6BaJIDHcH>DJS6e$Z-EqN|x4+3}c zU;T4NMFtiUJnt4np&-wIaRw*PR)qrqB4v>5=jjOjh$af^DBH_4g?va>)xC{Xpp+(LqCX5xe%SOME-AUK zT3hB)totD)!=pf9R7jWMWPH>$8ZMT=r)e&ODFuYKT~>xJ75b8Y?i|2#Zh!MU;>mxP z9rt8V;oP?0z+Pk1ic7t@KjNV)rm_W^3zueE-ncL zcT#V=YEzZH?*Vfl7a>5Q?VHBaB8BcNm9gQNKw3o66lfif1yD<`pzrpe^>V-Zo_Lh{ z8p2Vk^H>PsDkEoqNNU&1U6IFiU9Mx{EXYs0`d4c`U^d%5gjG!|dNqS7psfo}bRgKo zxXOEu-`GH?chJS*tYX3V0`1D)*#G3G?tSaL#2s0U(5*RPSYJhCUWcIGuX%jSSnrg;nixW}${vLss3 zBHNgJNT|<$N=F2E+4-}u$&o{_mxaCapt5+ZcdOtn7W9h0*VV7HD4F^Y2_#dav5|I60uTxD=L~~?w6!%7A>kOHC2|NKb3zGBC{1-f z0+?fBDWQG{V;rACzg%XGi#D3ux`2DH798eSGqVWLrGhStOK| zYP;{B5Q}FbU^axnwb%*C50Rph*ce4=lqH{Gu@}dWPd?k2F`2Z)5|y^I6da}4*3Mbj z&Bbwl;Ksv@Hd)T+vK;txWWgumaV8efD6PfNjON^zKR2Z9_EibJxD)o?1#~cy72TFV z$R5sdN<69V(~c4cK_+_3C50Om>>dupz4?FqAkik#*FhUR70F| z28?>BCj?F-5sD}jX6i;CGq_|onYw5-j3HBhH_N_Doc}=S8qsqPe?Y@tID38fU%nj0_=`_SdDvvFv=2r>Ruz)ZPbFE*C739~p z*dPLAF8ODn!k8VoVS{6vXPw%1X7oVa9feMcH1=z&$Q;xbBFE8egqSnq5-F%0hVGfr zvu@kY#X-k2-F7CZ=3?A#TL@&?sJEVfsl}iH2&3N9&9#i}EJ|dYM58tvWx^v)^x6yG zW~+?KaX*mx@ydLbf7ERo0~|aW^<=jV74PM4I|GP3>b4QAUg@@3yt+hz|I>Dx(=3kU ze3v~R4=JqX;p{Q%joM|vWc9Sz#=#9|e3)DK`T9`n-FB0y<#<{I0dGmhx;borR%Bg- z%M+LRg5?0rlf+lfnA6m!-;Kwwqha7?)3^Z{P2&LUE_t-$=W$VXxo`bWg7rAF_Ig7U znry~U?Zie#C^$o~AybtaM!{;5L^bqxHC{2hN5eSadq2to%S-|po`U3BdErnTWO^wd zw$I`?$Pc_6j2fGc$HRC)p`%wE z8|%XCdy*s)rzTOz^LHk9$!!f7X=mJ6$%l(@Xu9wU(yyvY+v*384iNi>q-^kOY`~!y zy5gw9J?-h)c)6*Hb{-Tug}yp}ffoP&Ovk|hcZ)+KB|Oz; zh*S(OkHD7lwJw86bKaUj#v=l})ML1|$lz6?7;Z_N2Qy!*k4M#dJYGFtCC#8up2`zd z(&)1@=^VUn)TBz{s|1?AP$dCx(}0L4tE3rT8<~utkEi3lCgykxF(oz0=^O5&s>rcA z#YX)|8lI1`{!CGn)O_849qHtHJPRs*RUNdi%cNN>f3utiyr34+Udj2cFZ#p$4GoQP z5_SA9Wc6m|VH_?*gSlMQxhromw%^tr-i&UhM9tsZTh@7VKeK{S6uJrd!od;;w4=IU zU*y55uWg^na2H)a><|R#Y`)ADz6!yIcVNOu!j44eTE+@_x<3OWro+rz>(@>^u9b#nm6nwgD&Fzdy~GQ7$P9+``{fK)x`2OpdxyJ3f<88@-ZK+TDF;cyerh?t1$4 z&9pV>=x#ceusHKdZlP)IC+`EC2qFOA_{PlXYy8phcH~6&;)`zw7AmLq6-L2;7ddMR zCisHM1(zhnwSQb*{2l)N8@{!;y=87>b98cLVQmU!Ze(whSt$(zH8ePrX(>#9ZK;$7 zAqZac7-uVS;@HZ1wzg8TA1DqbF_|I9Bu84M_7nUo{>PlgjUZ=qS(jX8X$S(1#_7|i z8}o&QT(FRS%>UKyEM&K5U(SU3l$rmk9sBe8?2kWX^uhY(Ob-?;i&z%NY`r@R-oIV{ zbiV%2SrqX?hBRQkITIq|5nDfhoCP1=ynFj85TDN3U+cE+%Pox+dCv1#4-IM9Rq&?U z?aFpDuz!~A0i#wz6j`Wemjy41Fq-B%|GfS?tSXFEE0HBU%h*b$G-J>uJpIrPQx=ALgj*}eh@`M9 zzF(M$gAzsYqM6;oQu}_I^Jsei^Jlj7QY10JZsc3FSRII?gLq-}s@xAxcquB<;)Iv7 z=e*>cw2DOvs7SUFkv`&oxdoC-8HUdIH{a{Jh5gQV86n7wgewXI$x~iTc|Lh@n9o!2 z1h|NwHRKAG3{`(Favq9A1l@M4Ez-d=xwPQo72bH|1Ef@vdg?!J3`I>nfy|v4t$+Lf8Wf zxm2&zkF0W=L^MT?Vk4etf(5l6`f_Z#mb3L;qrjUHdD=76i&vWSSzmuSG<`iNGs?}b zY1!r5_uQBgD`$#-Gy#m+DvH&ferYBX1f8&*7}O)wS8`cf(61Neu}8v95H#$u7pj_XF+;INWLym-IO_(S!m(f?a95vh4LAEx38SKsl`XrjDM|8w1r4ucB!JJtVcXJ%2jGln z4!|MLrOxw>K4p0Ry6#zbqyGBa2c6@iELdMMnv0DcyM`U=vG#=9n8;J)5EK0Ln?dC` zZ42kDpHq-&Omg=2<|t3eiOpY~@s0qI`(gYH`DY-ii7C2%KF><#NDi6x=<9e8i(5ZP zok`$doYymdu*hQ13c=I-1S)baT&UWauM8|0R@gK{dA+SS{Ct(lJXm9`@j=-pL54ag z1y7{is>c^IpLac(*y(u!_dsp0iN)@ zd|$hz3m$nnQ?m;k7-f(SmR6P!L4F96M4ZY6UIqYvJo3Z^QC=ht>h35G1JDjqV-L-C zOF?BgZ$m)8RmvDN+_m*;Y<4xo|hnInX8ueKy}B5fC# zw@ZZ!#!l=@a4-nPqvGQr0qbNUDqc=FfR)Sqz)YCVo$$e_ctp6_Fpk@D%)ah#x_$?L zJT&8fU3VCD2B7^$5(J;wa|6}}jSorL$)&RZ0Hi8}C;F@%#JUN4^f2_mGy#tJxS{|_ z;*;PKA!0On9k!^nnu(*8C{iwCfDP4;8hBaySuAv^_9~c;pAF?ry@>llK|FS`fz|af zu21K2XcQTzE=4A0G&u9pPX(#W9ADcR`|jd@DRqDxm&*9Wq#s|JbnN=_w!UDcA^3OA zbzkq;KW5X5Q1HwW>umo0EPuHO=+#k!yYg^)%`ABp+&3GD3l~}Nc9A&$vQNR~FCS5) z68ab_Jjy|X#@{NUqGQrcAZdl|;BCw5vbr-#Y^e21?6Es2R1erCt=N`3+A7<2w@s^m z_iW7|z!G0&E?c3J)#<9=kaSWAi$hOi(ej30U@?(#i)>l9RsXmj>&*pdJfh9TX@DSV z@Ndw&Kt%E=^e_{erS^R{B1@Rio3qvRqx$=6zf;BvM0sd+C8Ej9fB@p`LtANUAzaf* zGul;X8e{OGwYd?wC@SJ&8mk=(Q?M|9$k6J8$~FhK%|M1;*DIYOP_Ab#Wd_^M04UX& z4jITHK^XP=aKRdnC=l$@#`9Qt@th$`MIKuOny1RDs)xa&sqz2=+p(#%+*Jk$9r*&> znb<`1@6KNpBc?2PsC*VErs^0=;v|k`Y#fpHvZIcLMntf;fVpxq8<~d2Dv$bq2}VT# zU-ncY2zCj#j{Czt5I{7r+YwY>*T}J}3vlJqKQu1&@$!8PL5m;anec(eCe3yOGj)n@_5%EUMKmCQ)rp>el~5!U!6hDS>Ko_U@~~AJ53kxl+mp41c0~d% z@%9rL@>a{J%s{^>z_@gHbaqHjcs$;f*mu9F`%mY}9?(D`p;L5NSgEh5k$2*uY;Ws9ftV_hcS`R_C+UvN1DAt$?_iY5*$@}y zb-m^1KcIG_KC-9EV%_ICl}7-ELT1IYL5fm4kxoo2P*EZo4*NZ7Hyti&@j=5^r{IWs zC~>+d-jv^wH1`J`%lGGz(c0zqP!C!$ZJ2_(AKHt|B-59((r_YwE2TV3J%vqO2Espr zPwPQQCW=CZE>!0-3zoowh|+Vocuqon&GE55qNnm{azX(RS>=41o#LsUOhRER`_tS+ z=kd@tV|`45B#&&o9mjekyl%9Ob@z5cD~rtf3trL%oKz96i~TSZ^ALyhh`lLGFAR#< z)i*B0CsU=@h(cw5=FR{gr}>G4fVK*weBR9LYrY2o4EC(fqVUY*NGA~3G_lkHL z%keNQP9fK~hcC;x^7nV$QH&pf)$7V?xj<^6n8NWYc!&CbfZ%~5jO`WCEN4?vRkEYloPHt{nI?N@kLb(DH70TeZ9 zWDDSp85bp{2o{zug8JSIIWc7(WGC}}g9?V-mGh;jt#P!{eXV<{wv|Dh5jpXa8THV4 zT?E8`;x(Or?V8y6pXQaN)jCtVpUU0o`R;&|Tw00RGM_pQX)3Lmr54*ceWETUlENPC zxOK)sy`zv$CgV)&xWrOJ^XrApkSm#^EcDogOQS=bwG2{ht6r>|+dD+rUD=nA68*5) z2Y};ReK*i(u9O`P6%zNbh#N3=5l%-YbV1yWdv?@+$U`X+71q_kr(jd>Ytu<>jV_D1 zC{ka1x>CII?r1)ptJ5IsTogF%MVAsbjzI*AK-S{M_5;je+by~V2Hi0FYCAG|%sG>q z0)y_q`F&9>i!^E0PAl94z-0f*bZ5fUSD(|(lWtg0?2()jrhW7yb!=$OyAsih<;MOI zvmKCswtKCxslQ!UJr38lL~7`&351Y^sim){bRMl|8laf|q3>`iv?y{D{?>P1;1bqo zqE?OJsiGKYTn#6f9V+UZ#3FUgt8x2COM})E6`OK)4awJj#~n$2>aiqRO<>gqRNs`_ zg%4CF>1!<}NU5Z@_M?|gINzB21^-3D&$xhp{{L#~AKH%C$!11`JXuHwF)9mK7vyBqR4oO*;Mgu>j#=yo{(tP9bo5CQ0?>mSW7=T`<~O+K&c1*9y0 z2`E#R)E-G%a36g+1~w+sHwCPhmls)yL~5|@g4_M=Vh+ekmsZX0ABesLidy!w?(IvE zj=SkRLJX!5)0MtaCiA?S(ZrtDirIa$qLx~B!ZcIHl(ytjO?prm7TJCMhm%SPDDjoz zR7FiB9Ge@rH#E*hKi##$q>XL3cB;02n~3y%r^F-J$&6F)kobU5?y9DowQo1NJxVL8 zN;1>br-+lb`~xZXOnqU7?pBTQ#miP-^Gf8{yiZu6-t9QQ?Qo>DTk3e06 zsd}*T{oo?5I)LO_kQ~M8hUlMy1-QuVxzlbgOr8VFPZ6k3kJK6oLFGw(dIGN^(*-Lc zUVTpt^3V2{qA(JxFkXq6#WeKC_1VAh^MCVN9u<@CHXH#olMFXcf6`irOn0++(_$YI zui_|c%UNf<*gy&d&P;2>HHRGYq6>ok1OJNtajW{m+elsqvNeL(?5;X>>Qq(h6Jb6l z48QE>dUwRg_UO|Q*S{t9W4$9kERVi>ALB2UH%DeMC$S*0lw`R(q8I1O_s7fs90}p4 z0mB8$%@OCZFUa!#e~7+&_2&GF@~dO=T9vBK3S7&R#80GI%5d2weO2vtS-EM*+pO$h zmB)D+GqZb;`f19tiq>O?gVIb&->OUXn(& z_C?O^n^B;5HkQ!#aj($4!Cz0rW`W0rHrAIc(tf?V&C0DJe;N7Z{K7Xc4ZBJ|;mM1e z^3)Hb$Ue>+(%ve9t4MXDe}*05Gi%9xUKC`d$XcJZIW^ljuXzI21a_Njv&+lrF#*Ij z2vdtP7#?cF+sf{z&(iPViTJK3Qt79mbCy>1>_qN!-lNqus-B)G#?P5A5)<0#iTIiU z%?lCTB%sS%e?Vbv2tcZ`cqI2aP&@^*!(ltF9jNM$4ap5uwQB1}c(p5A*!8BW2LKV! zyfJP8H>0?Zp|J|^EmYRDaG*k47^7G8L!*tH@e9}*CaDW((`Ieg%sh{MYbSMnXs^}! z+w+dECmZAKlu`cyK+@j>yOsHKGM;^f6qvU#=j3{DM4Fm1>8SCA80C5 zF-5;tpSm2DPs!oy0|OTLLiU7;Pyiqv%kfIG&dRcCHSBJEZ(A&kCIF?KBd|_NKTa%Z z;03!zZG3{3;ff&fqeyahu-m5EgPyc`RYIHz+O1Coq5uNxqbT;1FtFCry9^&Pe31Ga zf@#&~f07oeY%y3G9g7({QtkED`?@;jq0g91>0Q228?t(w(E}5a0l&;i+x>Qy?jfZ6 zkQK2AwDm?5uON-`a%=DkBgmhgrxb}e%|Aejr_QCPCzDlA`+4SrsyQ|qFRqULIpKm3 zpeCM34B_b6L#xUL*3OyDhxiF@B;>q=fNye*e~(2jTU8c)uF+2-UyPg%?VERstolG8 z*;&|!)$QKpMe6~ZEG3(hsp%;7y~vF7BoI1J=D86dQ5|MYx8GNF+Yl#SVF00%F10<3 zHrA&IEFK9NH%vG2zv;>~x}Ftz`$)i0^dF>Whx)A}#w7>6u?(XRo<>Frup}B~14~RL ze{s0`#v7_jN8YP1m zl7X(fHd_^ne1`w`w^gHmDzlv;AbJSfecs-Z1!9g+dkd{Dx>i97Zt`Y5Wq|-DCa%)m zIg7;M!L`?01VBN;$Pw#OT}P<4ti7$Pe{OqAimLk9?a5u95t}BkF+dI*jO!JYcNg1V zz8{DO;R*T&%b#ZX3ayKb9F9tZocb*2twob!BeHjSU6ngjkh^06wKI()n$dB znqo2v1k|FGe`O>Z7i*K^4!jtmIfVMI2i@%B9Q&vYKjJht4}xH%dz3@@1L-yO^n1w1frC}M_tqJd+6C6v0`%D+j%K`p{;E9wcEHUK62_9R z#4UUQwGdL0N3>b!bC^X;GRG+0e_&8&AQ=p_GVIC3Pmw}>xuq~myq8YThADIBO?Tf=Dt@Bnn7~`Oau_x3G^dcLlUW52UldQ!JmK2p^MPyh3 zQre5!z2B3<1|W8?Kt@7|vM_q&6N z@}1sPL&;@C{kGZ_Gy4PsYNf6-zB=ffLDU!$Y4G@)KW3*Tu=Q7-#slt;3MY?DV{Cfj z>A_fZ!obPR%-5OjF{pZ>fB2H_@kl(Qd)88`dsqpe1H@?y`R;{4a={{cu4@F;-HoA@ zh*3wQSyv9R#8!2qZjMvLgae>Fu`j4~U4(GAnScG<3oq=Ld=lUx0QYotMwU!)Y*Nq{$ z)6bDvSmWH>X4O>hoA`1hzmHR6V+6K;ctsnf`qC~L!@#)4_)K#XG$$T6Y3ZDrR>}+u zMM^I!?FKX}wjy~&e_nz@K>j7Dk_p{*_+mq^ha}oK!IISvMrw*m4+*op$iYY?9 z?KA=A9R;L-V@YGiFhkilN6Wul>e=h2DuDSq3&RvDY`Gn0i~<>{@n@Sw;~`3m^`AmAMsTJ`#{3y5n@Nl7(9(txYZxGgf{BfnL9TfYIA4e`XIlX~vOp;hImYe0*#2^ke|?zz*9m!UzhC?X!9{zfOX2R}O9ZVF*HI zo)0nTn$`6_Yj0mf|Ib7Jl_dT!AU__`FX^v85VUAUR9zdQQ*UD0Qd6=1Lo>UmE64e}hoyr;Zno`2YhO6-sFE^tI9k zHMv$TvT#*Zh04l-eb}ZNJWTBm1JtlaJqrsAyK&gVQdUpT_!9yF5BM{bs{tOo-y5Mb zQTS2!PwQ3Hz|21@vJs5+!woV0)wTddwI#)L2oJ?!9zR2-;);$+X2fCG=!LIrv8Sh7 zRomp(2fkh^MDJcnbss99Od@R7#%>-Gf6{Na((z@kQqH zxl*|6K!Q4R*-DnW{_>F1cW>ViGXtIIHV=H2ri*&Wc6(Q<;Cu(RDFS~Zi+x=!bW>oa zzNr|)g3ASaxM6ISWs4KC*uc23QtD>$JCwOze>HF)#uz_^Z_z0e3wVe{)@2JkA7yUQ z%qDvb>9@}|28K59IvWzx%}dzAVea+=(9*62 zFW40x#FI_!2r{wzybCj~ysqKHO9KkDLRH_qE?vq{RVA@7rN2T#oyi$hnR?!`2YUEZHH z`N#4vU{!3anz7KQVMu0PfG6IVw_NqYr}tOy<`?D->jykIV;moLu4U8KdD@b+DodHR zc~v%~tw_6;fObRMMgnyOD?%A?qNO_j-l+&XAbc|RqYyqhqWx=aL4vMbu3Nm;d|k?j=zk_R9#pHnX~_k91Z z&ce$EPKVTIE;oBXnZkMGas*NdZox{wBcOojeO zkmc}`Cq~eERNz5Rz%4om8Ka!JvH2ixT2kEsGIgF5q}***vTgv)6f*jK==apkdhk@MzF~J}%BaeNeFitYc+wJCm8L`%XJnhS>w^M8Zs0-miUJWnWnqW-u363SxUri;m*opJ z;?nSVja*)RdV4zYedp~j^W&6rj#=6&oa&tfH!5X!nxp_*QVyVD%!inN7;7H$9vR@4 zE`~Qw`DK^aklKw*YuRGbud1q$N!fFV8+ryJ1zF^KzLOM8ert&mRO0tq<*Fc6r&Ti`pkOKs`a31nZLQ(4b;8!9ZT$&|+ZDPp)Ub?T74gR;; zZMU^-8iFyX6Ce%CPdd1eR5T1s3>jsR|420tlE~iQkTP!TLivW62{0>)!Y+f_bzSZ5 z*W<+WJj?{!1-E%A?fb(l1f*?9j6l&M=B}zqwFR>c)vXigCE#Ga&l^eh9UE1Vclch_GGkA zhAo5zePIkeht$Tfr$^zB0TLNhg|A+H)|0B z^@Qort`Ecj#5L+!M}=p67LRGzX=|r_+&;lnxS%(VX9nW>y4bx0>+V=*9>n{9LzTsh zivJ6$n3D&f!sjo8>VY*cXsZts5X^DRLg#d`_)RNyKX$IJ-wj*Jvq+zAk3rdSDISGf zYQakFfTTEorbS7#l4g zdZXx6;|yC5j*r1`kij05>D~a@!CfytY#m=)SvEa?Un9$o^+W`<>{}4N_HAY?C(>Q3 z()b%v^?nVV9Dgj64Rp&kL9_Qc$kR9IJo-F)qb}iC1|Ay=XUy8pm@IG7YGe@PE*p4w z%%WP^W7-@DrRwu;OCIvX76Y6Yim{A9MH$(HKb#H~M9`P|@<9Cq;&uiB1yoLinMxn> zx+*t+&_S`<172}(l(R)Li z)zE_oD%P@Slc#v_xBH!L)*v^4CN}zKAS$b~yJNxpz}Cy-Kx%O0KzpoBB@jf|zE#{& z79rv7Rc-=QtgE}k+OE?KMu$Flba70+ZDpE&e@m01c$@?VR9)RlREsF;HJcv?TAt)B zWM5Gz!6rei6C0(FjiYqH$w>nvLX+0{3fut3MX~mF2wSsTHF~ncp&37(mwF@P4^M_? zX39pi>_P=vFM!mW$*P+CG>~|lhA|(fH%5X#N%0$JnooEvKuvqjU8`=e3Xq50z5}d( zN~;=FU<0LgjXfju{Q{8?^-gbl5@gkbbZ+Jn*yJ-|=3ymN3e%X0j5s!-Bm zPc;G@_U-)$jAkXH|Iqc22Hlir0;2`3D==lo)S<$>LWQmu6ocAUed^+5`NxA!bp~CZ zo1StCzxMTy$A>RSET4CEnyi|t*tJrBkKbC+AKdJ+uGzc_;W+BDeU+C<{n)YCew{=1 zB7(9TGrFqNxVzj#+(9Lo!GY_H;4~0jQgwu?bINAQ=OLGRUSE!xkuA!{jV|1o$8pdQ z;{Xh1ArR}ky2%f@+kFLhgAU3q?HT)F=x~3){?Rrm>NxRL_zSP!9)KVDW?M*qRmZ8U z+XQ&vZdaU|XB z(BS*73fM+n!hW=?BEwjj0xkBb9qBLmW-ErY^0j9&({pV0@vf|j$rVqXni zVFN7+v!Pj-VG^wp%%-Y*rmUEMN4+j%Ua{1jj^FpuPdDh^@3)LIo!-C%tXHLG^$29^ ziLqnQbVVPE>1gr5dK%V?@8QZ#9c8b7e&yyvHgbD}xf>!=ZPkbk%&NAtA_gfQ*{>I1 z9MVtW=&c5evVx**(>0RnB?_?5PqvQ{H%LG_dYXgfBRSaBN7U~Y3&*y9^?1F0AF^jk zaKgVMn_bc7P(>!$ur31L?K|PY#%z;)D*Uk;ym6H2Dpif!x`&t^j=QE8l$Lg1?LCd? z@&`DJ)tHC<$^lm~c&cgr&)#S|4la6>*wIXFRy&5K;d-L1k~fAiC7d2 z7JhI@o!_rpGoyCRIw{a+FV={Tl~RvV4t`})nes*voU$O$-=5*cSGu4Ckdp9wQgT^j zzTN^dd_!9CjRYS&%MBajDA)A**G%^K;;!Dp#05=SQ2A>oS7 zvt6ySKN)sgkf3aTAVI5P-q2OzsbNM_11y$ zTGlDH8@p!axZ?17wm_w7Qg+_wBgi2`Oe!d~OfqD>eVwC!D8yQAS}Yp1@r9B#`N=uv zXSHiEjGKl|W&w(8H+B~JCNGlOQpg4shpBNr>EKro0VJ95sKOG)dejJ*B;4g}=873O z9iR{M<;h>+&wl{$9uRzGZe(+Ga%Ev{3T19&Z(?c+Gcq7BAa7!73Nko3Gzw*IWN%_> z3NtkzFd%P}(@jQyW4qG+pp>?(O4*jIREe%CV^0!y9h=$?fv)xqcop7p&&>D|hf51c zE%^a>&Ya74zH^DcAc83(`qTW57bAjZqc0rdR^ncCx47w@LixuJaVZouD7Fky4OB_or5|09bx#u;}IIFtTNUex{K3C|& zi&yA*R4Md-A}v*17v%*yI#qFc8AmmkKv9JvG+U;L%FG|qt$Y;68m+rIKfVo5>LzGl5*@8LclHoVjmsrUZMm zi=d2qoFQADYRT58uArfA#70 z;lbX2+XiN$xf#PXN?Tsj5DU>tac&-AG3$7vavLN7BjhWxr@xFpEg-E^^4;2-=_iP`f0Z$>ZO zsZH5tmix!+gIBm-$qvo;wi?IHyonggdLX}y8wr)1hN@|+jgM-%gWj9M-7oK?5e zkr4l%!uvX1f!52;%I^yj7X?S1cFAw=D!cwHO+qcIJ-XeuPDc6CGrijG%(@P#fc-^B zT!@t~_rPsl>ls$kiw%8ktBPmy3(>WSjb{tnc^Pa~%CzfA`xl|=&~rEED*u#Uqg4v) z;-Xcfxw(GN?*vj?NV~#$9Fup)jSc0_-iO{BoILJ%Sn3(NqEkds4e_QEf0}V|AyDh@ zuMOmFiS*EKC|2#?%OULbkZ#8F1Z!-DZcVwe{r!tGHSHJr$y?5_8?5a=A0^r}D|g19Z6u4r5`6kH!&anqen%{+U==6y z>wDcdi*gKgt6CCxW5soIu;!JYSedwWccD&8r_gC9;NUHpw-p2IIzw^(s9CZVseU6d~f*Mr%OgStv)M1 zkXL{B3TwVQW4t(s+mfJ`2QW@$C*70$S5UIw;lh3({bbFf6fuvnV}LU?ymIrC0k`p9 z#?b)y4O;esI>gDwluzE2KASF`JUiMq)YN&t``OrRP(%-vrB=?)cAXMruI9|d6lObz z3^zIk*>l@}>&lgs0aJtv>xj{(N8fB(_haOreQn|YJ_uU;)w{3MJY`crd_zj`>+Gf- zq#sgO#d34E)%w`WA3jtpsu$grP8d|=?fSByJY!>Mgye2YcBmlsn*)+F>|=)SJ>5mS zS_@RR$}Gk0g164;MI-8lCbq1)gShf@vz^k!o>7bCffsu#9E}Zn`T~BG_v|{CcQwYJ z8e_ci?LSl&iya?K`Hi2XuORQ zEo~48&^m!22p1R1y#xRZYaPKD9mlm|5CUV`c@Q0gwFx1Zj)U5@D30jnq4Whjaj9a7 z0RoD{6jUozM| zfj|V;mI1*unszM&L%6n$np(PM4*P^d(-{jFA<#rWI-|K)9Wf9FAliKb10bMH0^=yC zBM_nM_6~|ce-mS}APbrQ8T*yeCjx^YCX>cOnSK}(z;PJzX9nOvfabeEKm=s^`~LI) fW^5z*`jXPpqf*oNrS6C&AsCI0lPDC{W;W@6ZR!0! diff --git a/src/args.rs b/src/args.rs index 4b1e21c2..62cf444b 100644 --- a/src/args.rs +++ b/src/args.rs @@ -103,7 +103,7 @@ Command! { /// Accesses the password safe Pws(PwsArgs) => |ctx, args: PwsArgs| args.subcmd.execute(ctx), /// Performs a factory reset - Reset => crate::commands::reset, + Reset(ResetArgs) => |ctx, args: ResetArgs| crate::commands::reset(ctx, args.only_aes_key), /// Prints the status of the connected Nitrokey device Status => crate::commands::status, /// Interacts with the device's unencrypted volume @@ -445,6 +445,13 @@ pub struct PwsStatusArgs { pub all: bool, } +#[derive(Debug, PartialEq, structopt::StructOpt)] +pub struct ResetArgs { + /// Only build a new AES key instead of performing a full factory reset. + #[structopt(long)] + pub only_aes_key: bool, +} + #[derive(Debug, PartialEq, structopt::StructOpt)] pub struct UnencryptedArgs { #[structopt(subcommand)] diff --git a/src/commands.rs b/src/commands.rs index 3a4ff897..92574779 100644 --- a/src/commands.rs +++ b/src/commands.rs @@ -513,7 +513,7 @@ pub fn fill(ctx: &mut Context<'_>, attach: bool) -> anyhow::Result<()> { } /// Perform a factory reset. -pub fn reset(ctx: &mut Context<'_>) -> anyhow::Result<()> { +pub fn reset(ctx: &mut Context<'_>, only_aes_key: bool) -> anyhow::Result<()> { with_device(ctx, |ctx, mut device| { let pin_entry = pinentry::PinEntry::from(args::PinType::Admin, &device)?; @@ -522,20 +522,28 @@ pub fn reset(ctx: &mut Context<'_>) -> anyhow::Result<()> { pinentry::clear(&pin_entry).context("Failed to clear cached secret")?; try_with_pin(ctx, &pin_entry, |pin| { - device - .factory_reset(&pin) - .context("Failed to reset to factory settings")?; - // Work around for a timing issue between factory_reset and - // build_aes_key, see - // https://github.com/Nitrokey/nitrokey-storage-firmware/issues/80 - thread::sleep(time::Duration::from_secs(3)); - // Another work around for spurious WrongPassword returns of - // build_aes_key after a factory reset on Pro devices. - // https://github.com/Nitrokey/nitrokey-pro-firmware/issues/57 - let _ = device.get_user_retry_count(); - device - .build_aes_key(nitrokey::DEFAULT_ADMIN_PIN) - .context("Failed to rebuild AES key") + if only_aes_key { + // Similar to the else arm, we have to execute this command to avoid WrongPassword errors + let _ = device.get_user_retry_count(); + device + .build_aes_key(&pin) + .context("Failed to rebuild AES key") + } else { + device + .factory_reset(&pin) + .context("Failed to reset to factory settings")?; + // Work around for a timing issue between factory_reset and + // build_aes_key, see + // https://github.com/Nitrokey/nitrokey-storage-firmware/issues/80 + thread::sleep(time::Duration::from_secs(3)); + // Another work around for spurious WrongPassword returns of + // build_aes_key after a factory reset on Pro devices. + // https://github.com/Nitrokey/nitrokey-pro-firmware/issues/57 + let _ = device.get_user_retry_count(); + device + .build_aes_key(nitrokey::DEFAULT_ADMIN_PIN) + .context("Failed to rebuild AES key") + } }) }) } diff --git a/src/tests/reset.rs b/src/tests/reset.rs index 99342843..78fd13c7 100644 --- a/src/tests/reset.rs +++ b/src/tests/reset.rs @@ -1,6 +1,6 @@ // reset.rs -// Copyright (C) 2019-2020 The Nitrocli Developers +// Copyright (C) 2019-2021 The Nitrocli Developers // SPDX-License-Identifier: GPL-3.0-or-later use nitrokey::Authenticate; @@ -43,3 +43,59 @@ fn reset(model: nitrokey::Model) -> anyhow::Result<()> { Ok(()) } + +#[test_device] +fn reset_only_aes_key(model: nitrokey::Model) -> anyhow::Result<()> { + const NEW_USER_PIN: &str = "654321"; + const NAME: &str = "slotname"; + const LOGIN: &str = "sloglogin"; + const PASSWORD: &str = "slotpassword"; + + let mut ncli = Nitrocli::new().model(model).new_user_pin(NEW_USER_PIN); + + // Change the user PIN + let _ = ncli.handle(&["pin", "set", "user"])?; + + // Add an entry to the PWS + { + let mut manager = nitrokey::force_take()?; + let mut device = manager.connect_model(model)?; + let mut pws = device.get_password_safe(NEW_USER_PIN)?; + pws.write_slot(0, NAME, LOGIN, PASSWORD)?; + } + + // Build AES key + let mut ncli = Nitrocli::new().model(model); + let out = ncli.handle(&["reset", "--only-aes-key"])?; + assert!(out.is_empty()); + + // Check that 1) the password store works, i.e., there is an AES key, + // that 2) we can no longer access the stored data, i.e., the AES has + // been replaced, and that 3) the changed user PIN still works, i.e., + // we did not perform a factory reset. + { + let mut manager = nitrokey::force_take()?; + let mut device = manager.connect_model(model)?; + let pws = device.get_password_safe(NEW_USER_PIN)?; + let slot = pws.get_slot_unchecked(0)?; + + if let Ok(name) = slot.get_name() { + assert_ne!(NAME, &name); + } + if let Ok(login) = slot.get_login() { + assert_ne!(LOGIN, &login); + } + if let Ok(password) = slot.get_password() { + assert_ne!(PASSWORD, &password); + } + } + + // Reset the user PIN for other tests + let mut ncli = ncli + .user_pin(NEW_USER_PIN) + .new_user_pin(nitrokey::DEFAULT_USER_PIN); + let out = ncli.handle(&["pin", "set", "user"])?; + assert!(out.is_empty()); + + Ok(()) +}