=================================================================== RCS file: /cvs/palm/Palm-Keyring/lib/Palm/Keyring.pm,v retrieving revision 1.6 retrieving revision 1.17 diff -u -r1.6 -r1.17 --- palm/Palm-Keyring/lib/Palm/Keyring.pm 2006/11/10 16:18:59 1.6 +++ palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/01/30 05:16:16 1.17 @@ -1,388 +1,498 @@ -# Palm::Keyring.pm +package Palm::Keyring; + +# $RedRiver: Keyring.pm,v 1.16 2007/01/30 04:59:55 andrew Exp $ # -# Perl class for dealing with Keyring for Palm OS databases. +# Perl class for dealing with Keyring for Palm OS databases. # -# Copyright (C) 2004, Andrew Fresh -# You may distribute this file under the terms of the Artistic -# License, as specified in the README file distributed with the p5-Palm distribution. -# # This started as Memo.pm, I just made it work for Keyring. -# -# $Id: Keyring.pm,v 1.6 2006/11/10 16:18:59 andrew Exp $ -# $RedRiver: Keyring.pm,v 1.5 2006/11/10 04:52:27 andrew Exp $ use strict; -package Palm::Keyring; -use Palm::Raw(); -use Palm::StdAppInfo(); -use vars qw( $VERSION @ISA ); +use warnings; +use Carp; +use base qw/ Palm::StdAppInfo /; + use Digest::MD5 qw(md5); use Crypt::DES; +use Readonly; -use constant ENCRYPT => 1; -use constant DECRYPT => 0; -use constant MD5_CBLOCK => 64; -my $kSaltSize = 4; +Readonly my $ENCRYPT => 1; +Readonly my $DECRYPT => 0; +Readonly my $MD5_CBLOCK => 64; +Readonly my $kSalt_Size => 4; +Readonly my $EMPTY => q{}; +Readonly my $SPACE => q{ }; +Readonly my $NULL => chr 0; - # One liner, to allow MakeMaker to work. -$VERSION = do { my @r = (q$Revision: 1.6 $ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r }; +our $VERSION = 0.91; -@ISA = qw( Palm::StdAppInfo Palm::Raw ); +sub new { + my $classname = shift; + my $pass = shift; -=head1 NAME + # Create a generic PDB. No need to rebless it, though. + my $self = $classname->SUPER::new(@_); -Palm::Keyring - Handler for Palm Keyring databases. + $self->{'name'} = 'Keys-Gtkr'; # Default + $self->{'creator'} = 'Gtkr'; + $self->{'type'} = 'Gkyr'; -=head1 SYNOPSIS + # The PDB is not a resource database by + # default, but it's worth emphasizing, + # since MemoDB is explicitly not a PRC. + $self->{'attributes'}{'resource'} = 0; - use Palm::Keyring; - $pdb->Decrypt('mypassword'); + # Initialize the AppInfo block + $self->{'appinfo'} = {}; -=head1 DESCRIPTION + # Add the standard AppInfo block stuff + Palm::StdAppInfo::seed_StdAppInfo( $self->{'appinfo'} ); -The Keyring PDB handler is a helper class for the Palm::PDB package. It -parses Keyring databases. See -L. + # Set the version + $self->{'version'} = 4; -It is just the standard Palm::Raw with 2 additional public methods. Decrypt and Encrypt. + if ( defined $pass ) { + $self->Password($pass); + } -=cut -=head2 new + return $self; +} - $pdb = new Palm::Keyring ('password'); +sub import { + Palm::PDB::RegisterPDBHandlers( __PACKAGE__, [ 'Gtkr', 'Gkyr' ], ); + return 1; +} -Create a new PDB, initialized with the various Palm::Keyring fields -and an empty record list. +sub ParseRecord { + my $self = shift; -Use this method if you're creating a Keyring PDB from scratch. + my $rec = $self->SUPER::ParseRecord(@_); -=cut -#' -sub new -{ - my $classname = shift; - my $pass = shift; + # skip the 0 record that holds the password + return $rec if ! exists $self->{'records'}; - # Create a generic PDB. No need to rebless it, though. - my $self = $classname->SUPER::new(@_); + # skip records with no data (There shouldn't be any) + return $rec if ! exists $rec->{'data'}; - $self->{name} = "Keys-Gtkr"; # Default - $self->{creator} = "Gtkr"; - $self->{type} = "Gkyr"; - # The PDB is not a resource database by - # default, but it's worth emphasizing, - # since MemoDB is explicitly not a PRC. - $self->{attributes}{resource} = 0; + my ( $name, $encrypted ) = split /$NULL/xm, $rec->{'data'}, 2; - # Initialize the AppInfo block - $self->{appinfo} = {}; + return $rec if ! $encrypted; + $rec->{'data'} = $name; + $rec->{'encrypted'} = $encrypted; - # Add the standard AppInfo block stuff - &Palm::StdAppInfo::seed_StdAppInfo($self->{appinfo}); + return $rec; +} - # Set the version - $self->{version} = 4; +sub PackRecord { + my $self = shift; + my $rec = shift; - # Give the PDB the first record that will hold the encrypted password - $self->{records} = [ { - 'category' => 0, - 'attributes' => { - 'private' => 1, - 'Secret' => 1, - 'Dirty' => 1, - 'dirty' => 1 - }, - }, ]; + my $rec0_id = $self->{'records'}->[0]->{'id'}; - if ($pass) { - $self->Encrypt($pass); - } + if ($rec->{'encrypted'} && ! $rec->{'id'} == $rec0_id) { + $rec->{'data'} = join $NULL, $rec->{'data'}, $rec->{'encrypted'}; + delete $rec->{'encrypted'}; + } - return $self; + return $self->SUPER::PackRecord($rec, @_); } -sub import -{ - &Palm::PDB::RegisterPDBHandlers(__PACKAGE__, - [ "Gtkr", "Gkyr" ], - ); -} +sub Encrypt { + my $self = shift; + my $rec = shift; + my $data = shift; + my $pass = shift || $self->{'password'}; -sub Load -{ - my $self = shift; - $self->SUPER::Load(@_); + if ( ! $pass) { + croak("'password' not set!\n"); + } - # Skip the first 2 records because they are special - # and don't have any plaintext - my $skip = 0; - foreach my $record (@{ $self->{records} }) { - if ($skip < 2) { - $skip++; - next; - } - my ($name, $encrypted) = split /\000/, $record->{data}, 2; - $record->{plaintext}->{name} = $name; - $record->{encrypted} = $encrypted; - } - 1; -} + if ( ! $rec) { + croak("Needed parameter 'record' not passed!\n"); + } -sub Write -{ - my $self = shift; - $self->Encrypt() || return undef; - return $self->SUPER::Load(@_); -} + if ( ! $data) { + croak("Needed parameter 'data' not passed!\n"); + } -sub Encrypt -{ - my $self = shift; - my $pass = shift; + if ( ! $self->Password($pass)) { + croak("Incorrect Password!\n"); + } - if ($pass) { - unless ($self->_keyring_verify($pass) ) { - # This would encrypt with a new password. - # First decrypting everything with the old password of course. - $self->_keyring_update($pass) || return undef; - $self->_keyring_verify($pass) || return undef; - } - } + $self->{'digest'} ||= _calc_keys( $pass ); - my $seen_enc_pass = 0; - foreach my $record (@{ $self->{records} }) { - unless ($seen_enc_pass) { - $seen_enc_pass = 1; - next; - } + $data->{'account'} ||= $EMPTY; + $data->{'password'} ||= $EMPTY; + $data->{'notes'} ||= $EMPTY; - next unless defined $record->{plaintext}; + my $plaintext = join $NULL, + $data->{'account'}, $data->{'password'}, $data->{'notes'}; - my $name = defined $record->{plaintext}->{name} ? $record->{plaintext}->{name} : ''; - my $account = defined $record->{plaintext}->{account} ? $record->{plaintext}->{account} : ''; - my $password = defined $record->{plaintext}->{password} ? $record->{plaintext}->{password} : ''; - my $description = defined $record->{plaintext}->{description} ? $record->{plaintext}->{description} : ''; - my $extra = ''; + my $encrypted = _crypt3des( $plaintext, $self->{'digest'}, $ENCRYPT ); - my $plaintext = join("\000", $account, $password, $description, $extra); + return if ! $encrypted; - my $encrypted = $self->_crypt3des($plaintext, ENCRYPT); + $rec->{'data'} ||= $data->{'name'}; + $rec->{'encrypted'} = $encrypted; + return 1; +} - $record->{data} = join("\000", $name, $encrypted); - } +sub Decrypt { + my $self = shift; + my $rec = shift; + my $pass = shift || $self->{'password'}; - return 1; -} + if ( ! $pass) { + croak("'password' not set!\n"); + } -sub Decrypt -{ - my $self = shift; - my $pass = shift; + if ( ! $rec) { + carp("Needed parameter 'record' not passed!\n"); + return; + } - if ($pass) { - $self->_keyring_verify($pass) || return undef; - } + if ( ! $self->Password($pass)) { + croak("Invalid Password!\n"); + } - my $seen_enc_pass = 0; - foreach my $record (@{ $self->{records} }) { - unless ($seen_enc_pass) { - # need to skip the first record because it is the encrypted password - $seen_enc_pass = 1; - next; - } + if ( ! $rec->{'encrypted'} ) { + croak("No encrypted content!"); + } - next unless defined $record->{data}; + $self->{'digest'} ||= _calc_keys( $pass ); - my ($name, $encrypted) = split /\000/, $record->{data}, 2; - $record->{plaintext}->{name} = $name; + my $decrypted = + _crypt3des( $rec->{'encrypted'}, $self->{'digest'}, $DECRYPT ); + my ( $account, $password, $notes, $extra ) = split /$NULL/xm, + $decrypted, 4; - my $decrypted = $self->_crypt3des($encrypted, DECRYPT); - my ($account, $password, $description, $extra) - = split /\000/, $decrypted, 4; + return { + account => $account, + password => $password, + notes => $notes, + }; +} - $record->{plaintext}->{account} = defined $account ? $account : ''; - $record->{plaintext}->{password} = defined $password ? $password : ''; - $record->{plaintext}->{description} = defined $description ? $description : ''; +sub Password { + my $self = shift; + my $pass = shift || $self->{'password'}; + my $new_pass = shift; - #print "Name: '$name'\n"; - #print "Encrypted: '$encrypted' - Length: " . length($encrypted) . "\n"; - #print "Hex: '" . unpack("H*", $encrypted) . "'\n"; - #print "Binary: '" . unpack("b*", $encrypted) . "'\n"; - #print "Decrypted: '$decrypted' - Length: " . length($decrypted) . "\n"; - #print "Hex: '" . unpack("H*", $decrypted) . "'\n"; - #print "Binary: '" . unpack("b*", $decrypted) . "'\n"; - #print "\n"; - #print "Extra: $extra\n"; - #-------------------------------------------------- - # print "Account: $account\n"; - # print "Password: $password\n"; - # print "Description: $description\n"; - #-------------------------------------------------- + if (! exists $self->{'records'}) { + # Give the PDB the first record that will hold the encrypted password + $self->{'records'} = [ $self->new_Record ]; - } + return $self->_password_update($pass); + } - return 1; + if ($new_pass) { + my @accts = (); + foreach my $i (0..$#{ $self->{'records'} }) { + if ($i == 0) { + push @accts, undef; + next; + } + my $acct = $self->Decrypt($self->{'records'}->[$i], $pass); + if ( ! $acct ) { + croak("Couldn't decrypt $self->{'records'}->[$i]->{'data'}"); + } + push @accts, $acct; + } + + if ( ! $self->_password_update($new_pass)) { + croak("Couldn't set new password!"); + } + $pass = $new_pass; + + foreach my $i (0..$#accts) { + next if $i == 0; + $self->Encrypt($self->{'records'}->[$i], $accts[$i], $pass); + } + } + + return $self->_password_verify($pass); } -sub _calc_keys -{ - my $self = shift; +sub _calc_keys { + my $pass = shift; + if (! defined $pass) { croak('No password defined!'); }; - my $pass = $self->{'password'}; - die "No password defined!" unless defined $pass; + my $digest = md5($pass); - my $digest = md5($pass); + my ( $key1, $key2 ) = unpack 'a8a8', $digest; - my ($key1, $key2) = unpack('a8a8', $digest); - #-------------------------------------------------- - # print "key1: $key1: ", length $key1, "\n"; - # print "key2: $key2: ", length $key2, "\n"; - #-------------------------------------------------- + #-------------------------------------------------- + # print "key1: $key1: ", length $key1, "\n"; + # print "key2: $key2: ", length $key2, "\n"; + #-------------------------------------------------- - $digest = unpack('H*', $key1 . $key2 . $key1); - #-------------------------------------------------- - # print "Digest: ", $digest, "\n"; - # print length $digest, "\n"; - #-------------------------------------------------- + $digest = unpack 'H*', $key1 . $key2 . $key1; - $self->{digest} = $digest; - return $digest; + #-------------------------------------------------- + # print "Digest: ", $digest, "\n"; + # print length $digest, "\n"; + #-------------------------------------------------- + + return $digest; } -sub _keyring_verify -{ - my $self = shift; - my $pass = shift; +sub _password_verify { + my $self = shift; + my $pass = shift; - die "No password specified!" unless $pass; - $self->{password} = $pass; + if (! $pass) { croak('No password specified!'); }; - # AFAIK the thing we use to test the password is - # always in the first entry - my $data = $self->{records}->[0]->{data}; - #die "No encrypted password in file!" unless defined $data; - return undef unless defined $data; + if (defined $self->{'password'} && $pass eq $self->{'password'}) { + # already verified this password + return 1; + } - $data =~ s/\0$//; + # AFAIK the thing we use to test the password is + # always in the first entry + my $data = $self->{'records'}->[0]->{'data'}; - my $salt = substr($data, 0, $kSaltSize); + #die "No encrypted password in file!" unless defined $data; + if ( ! defined $data) { return; }; - my $msg = $salt . $pass; + $data =~ s/$NULL$//xm; - $msg .= "\0" x (MD5_CBLOCK - length($msg)); + my $salt = substr $data, 0, $kSalt_Size; - my $digest = md5($msg); + my $msg = $salt . $pass; - if ($data eq $salt . $digest) { - # May as well generate the keys we need now, since we know the password is right - if ($self->_calc_keys()) { - return 1; - } else { - return undef; - } - } else { - return undef; - } + $msg .= "\0" x ( $MD5_CBLOCK - length $msg ); + + my $digest = md5($msg); + + if ( $data eq $salt . $digest ) { + +# May as well generate the keys we need now, since we know the password is right + $self->{'digest'} = _calc_keys($pass); + if ( $self->{'digest'} ) { + $self->{'password'} = $pass; + return 1; + } + } + return; } -sub _keyring_update -{ - # It is very important to Encrypt after calling this - # (Although it is generally only called by Encrypt) - # because otherwise the data will be out of sync with the - # password, and that would suck! - my $self = shift; - my $pass = shift; +sub _password_update { - die "No password specified!" unless $pass; + # It is very important to Encrypt after calling this + # (Although it is generally only called by Encrypt) + # because otherwise the data will be out of sync with the + # password, and that would suck! + my $self = shift; + my $pass = shift; - # if the database already has a password in it - if ($self->{records}->[0]->{data}) { - # Make sure everything is decrypted before we update the keyring - $self->Decrypt() || return undef; - } + if (! defined $pass) { croak('No password specified!'); }; - my $salt; - for (1..$kSaltSize) { - $salt .= chr(int(rand(255))); - } + my $salt; + for ( 1 .. $kSalt_Size ) { + $salt .= chr int rand 255; + } - my $msg = $salt . $pass; + my $msg = $salt . $pass; - $msg .= "\0" x (MD5_CBLOCK - length($msg)); + $msg .= "\0" x ( $MD5_CBLOCK - length $msg ); - my $digest = md5($msg); + my $digest = md5($msg); - my $data = $salt . $digest;# . "\0"; + my $data = $salt . $digest; # . "\0"; - # AFAIK the thing we use to test the password is - # always in the first entry - $self->{records}->[0]->{data} = $data; + # AFAIK the thing we use to test the password is + # always in the first entry + $self->{'records'}->[0]->{'data'} = $data; - $self->{password} = $pass; - $self->_calc_keys(); + $self->{'password'} = $pass; + $self->{'digest'} = _calc_keys( $self->{'password'} ); - return 1; + return 1; } +sub _crypt3des { + my ( $plaintext, $passphrase, $flag ) = @_; -# XXX Have to make this encrypt as well as decrypting, but w00 h00! -# do null padding on the end of a cleartext if we are going to encrypt it -sub _crypt3des { - my ( $self, $plaintext, $flag ) = @_; + $passphrase .= $SPACE x ( 16 * 3 ); + my $cyphertext = $EMPTY; - my $passphrase = $self->{digest} || $self->_calc_keys(); - $passphrase .= ' ' x (16*3); - my $cyphertext = ""; + my $size = length $plaintext; + #print "STRING: '$plaintext' - Length: " . (length $plaintext) . "\n"; - my $size = length ( $plaintext ); - #print "STRING: '$plaintext' - Length: " . length($plaintext) . "\n"; + my @C; + for ( 0 .. 2 ) { + $C[$_] = + new Crypt::DES( pack 'H*', ( substr $passphrase, 16 * $_, 16 )); + } - # This check should see if it is plaintext first, if it is, - # pad it with \000 - # if not, then die - die "record not 8 byte padded" if (length($plaintext) % 8) && ! $flag; + for ( 0 .. ( ($size) / 8 ) ) { + my $pt = substr $plaintext, $_ * 8, 8; - my @C; - for ( 0..2 ) { - $C[$_] = new Crypt::DES( pack( "H*", substr($passphrase, 16*$_, 16 ))); - } + #print "PT: '$pt' - Length: " . length($pt) . "\n"; + if (! length $pt) { next; }; + if ( (length $pt) < 8 ) { + if ($flag == $DECRYPT) { croak('record not 8 byte padded'); }; + my $len = 8 - (length $pt); - for ( 0 .. (($size)/8) - 1) { - my $pt = substr( $plaintext, $_*8, 8 ); - #print "PT: '$pt' - Length: " . length($pt) . "\n"; - if (length($pt) < 8) { - my $len = 8 - length($pt); - print "LENGTH: $len\n"; - print "Binary: '" . unpack("b*", $pt) . "'\n"; - $pt .= (chr(0) x $len);# . $pt; - print "Binary: '" . unpack("b*", $pt) . "'\n"; - #print "PT: '$pt' - Length: " . length($pt) . "\n"; - } - $pt = $C[0]->decrypt( $pt ); - $pt = $C[1]->encrypt( $pt ); - $pt = $C[2]->decrypt( $pt ); - #print "PT: '$pt' - Length: " . length($pt) . "\n"; - $cyphertext .= $pt; - } + #print "LENGTH: $len\n"; + #print "Binary: '" . unpack("b*", $pt) . "'\n"; + $pt .= ($NULL x $len); - return substr ( $cyphertext, 0, $size ); + #print "PT: '$pt' - Length: " . length($pt) . "\n"; + #print "Binary: '" . unpack("b*", $pt) . "'\n"; + } + if ( $flag == $ENCRYPT ) { + $pt = $C[0]->encrypt($pt); + $pt = $C[1]->decrypt($pt); + $pt = $C[2]->encrypt($pt); + } + else { + $pt = $C[0]->decrypt($pt); + $pt = $C[1]->encrypt($pt); + $pt = $C[2]->decrypt($pt); + } + + #print "PT: '$pt' - Length: " . length($pt) . "\n"; + $cyphertext .= $pt; + } + + $cyphertext =~ s/$NULL+$//xm; + + #print "CT: '$cyphertext' - Length: " . length($cyphertext) . "\n"; + + return $cyphertext; } 1; __END__ +=head1 NAME + +Palm::Keyring - Handler for Palm Keyring databases. + +=head1 DESCRIPTION + +The Keyring PDB handler is a helper class for the Palm::PDB package. It +parses Keyring for Palm OS databases. See +L. + +It has the standard Palm::PDB methods with 2 additional public methods. +Decrypt and Encrypt. + +It currently supports the v4 Keyring databases. The v5 databases from +the pre-release keyring-2.0 are not supported. + +This module doesn't store the decrypted content. It only keeps it until it +returns it to you or encrypts it. + +=head1 SYNOPSIS + + use Palm::PDB; + use Palm::Keyring; + + my $pass = 'password'; + my $pdb = new Palm::PDB; + $pdb->Load($file); + + foreach (0..$#{ $pdb->{'records'} }) { + next if $_ = 0; # skip the password record + my $rec = $pdb->{'records'}->[$_]; + my $acct = $pdb->Decrypt($rec, $pass); + print $rec->{'data'}, ' - ', $acct->{'account'}, "\n"; + } + +=head1 SUBROUTINES/METHODS + +=head2 new + + $pdb = new Palm::Keyring([$password]); + +Create a new PDB, initialized with the various Palm::Keyring fields +and an empty record list. + +Use this method if you're creating a Keyring PDB from scratch otherwise you +can just use Palm::PDB::new() before calling Load(). + +=head2 Encrypt + + $pdb->Encrypt($rec, $acct, [$password]); + +Encrypts an account into a record, either with the password previously +used, or with a password that is passed. + +$rec is a record from $pdb->{'records'} or a newly generated record. +$acct is a hashref in the format below. + + my $acct = { + account => $account, + password => $password, + notes => $notes, + }; + +=head2 Decrypt + + my $acct = $pdb->Decrypt($rec[, $password]); + +Decrypts the record and returns a hashref for the account as described +under Encrypt(); + + foreach (0..$#{ $pdb->{'records'}) { + next if $_ == 0; + my $rec = $pdb->{'records'}->[$_]; + my $acct = $pdb->Decrypt($rec[, $password]); + # do something with $acct + } + +=head2 Password + + $pdb->Password([$password[, $new_password]]); + +Either sets the password to be used to crypt, or if you pass $new_password, +changes the password on the database. + +If you have created a new $pdb, and you didn't set a password when you +called new(), you only need to pass one password and it will set that as +the password. + +If nothing is passed, and there has been a password used before, +it just verifies that the password was correct. + +=head1 DEPENDENCIES + +Palm::StdAppInfo + +Digest::MD5 + +Crypt::DES + +Readonly + +=head1 BUGS AND LIMITATIONS + +Once this module is uploaded, you can +Please report any bugs or feature requests to +C, or through the web interface at +L. I will be notified, and then you'll automatically be +notified of progress on your bug as I make changes. + =head1 AUTHOR -Andrew Fresh Eandrew@mad-techies.org +Andrew Fresh Eandrew@mad-techies.orgE +=head1 LICENSE AND COPYRIGHT + +Copyright 2004, 2005, 2006, 2007 Andrew Fresh, All Rights Reserved. + +This program is free software; you can redistribute it and/or +modify it under the same terms as Perl itself. + =head1 SEE ALSO Palm::PDB(3) Palm::StdAppInfo(3) -=cut +The Keyring for Palm OS website: +L