=================================================================== RCS file: /cvs/palm/Palm-Keyring/lib/Palm/Keyring.pm,v retrieving revision 1.48 retrieving revision 1.58 diff -u -r1.48 -r1.58 --- palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/09/12 03:44:36 1.48 +++ palm/Palm-Keyring/lib/Palm/Keyring.pm 2008/09/19 03:50:05 1.58 @@ -1,5 +1,5 @@ package Palm::Keyring; -# $RedRiver: Keyring.pm,v 1.47 2007/09/12 00:30:10 andrew Exp $ +# $RedRiver: Keyring.pm,v 1.57 2008/09/19 02:04:34 andrew Exp $ ######################################################################## # Keyring.pm *** Perl class for Keyring for Palm OS databases. # @@ -15,6 +15,8 @@ use strict; use warnings; +require 5.006_001; + use Carp; use base qw/ Palm::StdAppInfo /; @@ -83,7 +85,7 @@ ); -our $VERSION = '0.96_01'; +our $VERSION = '0.96_07'; sub new { @@ -108,6 +110,7 @@ else { $options->{password} = shift; $options->{version} = shift; + $options->{cipher} = shift; } } @@ -139,6 +142,10 @@ $self->{appinfo}->{iter} ||= $self->{options}->{iterations}; }; + if ( defined $options->{file} ) { + $self->Load($options->{file}); + } + if ( defined $options->{password} ) { $self->Password($options->{password}); } @@ -217,13 +224,13 @@ } } - my $rc = $self->SUPER::Write(@_); + my @rc = $self->SUPER::Write(@_); if ($self->{version} == 4) { shift @{ $self->{records} }; } - return $rc; + return @rc; } # ParseRecord @@ -233,7 +240,7 @@ my $self = shift; my $rec = $self->SUPER::ParseRecord(@_); - return $rec if ! exists $rec->{data}; + return $rec if !(defined $rec->{data} && length $rec->{data} ); if ($self->{version} == 4) { # skip the first record because it contains the password. @@ -241,7 +248,7 @@ $self->{encpassword} = $rec->{data}; return '__DELETE_ME__'; } - + if ($self->{records}->[0] eq '__DELETE_ME__') { shift @{ $self->{records} }; } @@ -270,8 +277,9 @@ $rec->{encrypted} = substr $extra, $blocksize; } else { + # XXX Can never get here to test, ParseAppInfoBlock is always run + # XXX first by Load(). croak "Unsupported Version $self->{version}"; - return; } return $rec; @@ -288,11 +296,12 @@ if ($rec->{encrypted}) { my $name = $rec->{plaintext}->{0}->{data} || $EMPTY; $rec->{data} = join $NULL, $name, $rec->{encrypted}; - delete $rec->{plaintext}; - delete $rec->{encrypted}; } } elsif ($self->{version} == 5) { + croak 'No encrypted data in record' if !defined $rec->{encrypted}; + croak 'No ivec!' if !$rec->{ivec}; + my $field; if ($rec->{plaintext}->{0}) { $field = $rec->{plaintext}->{0}; @@ -311,7 +320,12 @@ } else { croak "Unsupported Version $self->{version}"; } + # XXX Should I? + delete $rec->{plaintext}; + delete $rec->{encrypted}; + croak 'No data in record to pack' if !$rec->{data}; + return $self->SUPER::PackRecord($rec, @_); } @@ -631,8 +645,10 @@ my $plaintext; foreach my $k (keys %{ $new }) { + next if $new->{$k}->{label_id} == 0; $plaintext .= _pack_field($new->{$k}); } + $plaintext .= chr(0xff) x 2; my $encrypted; if ($c->{name} eq 'None') { @@ -1176,7 +1192,7 @@ my ($len) = unpack "n", $field; if ($len + 4 > length $field) { - return undef, $field; + return (undef, $field); } my $unpackstr = "x2 C1 C1 A$len"; my $offset = 2 +1 +1 +$len; @@ -1285,6 +1301,8 @@ my $maxlines = shift; # Max # of lines to dump my $offset; # Offset of current chunk + my @lines; + for ($offset = 0; $offset < length($data); $offset += 16) { my $hex; # Hex values of the data @@ -1299,8 +1317,9 @@ ($ascii = $chunk) =~ y/\040-\176/./c; - printf "%s %-48s|%-16s|\n", $prefix, $hex, $ascii; + push @lines, sprintf "%s %-48s|%-16s|\n", $prefix, $hex, $ascii; } + return wantarray ? @lines : \@lines; } sub _bindump @@ -1310,6 +1329,8 @@ my $maxlines = shift; # Max # of lines to dump my $offset; # Offset of current chunk + my @lines; + for ($offset = 0; $offset < length($data); $offset += 8) { my $bin; # binary values of the data @@ -1324,8 +1345,9 @@ ($ascii = $chunk) =~ y/\040-\176/./c; - printf "%s %-72s|%-8s|\n", $prefix, $bin, $ascii; + push @lines, sprintf "%s %-72s|%-8s|\n", $prefix, $bin, $ascii; } + return wantarray ? @lines : \@lines; } # Thanks to Jochen Hoenicke @@ -1337,7 +1359,7 @@ # keylen is length of generated key in bytes # prf is the pseudo random function (e.g. hmac_sha1) # returns the key. -sub _pbkdf2($$$$$) +sub _pbkdf2 { my ($password, $salt, $iter, $keylen, $prf) = @_; my ($k, $t, $u, $ui, $i); @@ -1353,7 +1375,7 @@ return substr($t, 0, $keylen); } -sub _DES_odd_parity($) { +sub _DES_odd_parity { my $key = $_[0]; my ($r, $i); my @odd_parity = ( @@ -1391,17 +1413,12 @@ parses Keyring for Palm OS databases. See L. -It has the standard Palm::PDB methods with 2 additional public methods. -Decrypt and Encrypt. +It has the standard Palm::PDB methods with 4 additional public methods. +Unlock, Lock, Decrypt and Encrypt. It currently supports the v4 Keyring databases as well as -the pre-release v5 databases. I am not completely happy with the interface -for accessing v5 databases, so any suggestions on improvements on -the interface are appreciated. +the pre-release v5 databases. -This module doesn't store the plaintext content. It only keeps it until it -returns it to you or encrypts it. - =head1 SYNOPSIS use Palm::PDB; @@ -1412,16 +1429,18 @@ my $pdb = new Palm::PDB; $pdb->Load($file); + $pdb->Unlock($pass); foreach my $rec (@{ $pdb->{records} }) { - my $plaintext = $pdb->Decrypt($rec, $pass); - print $plaintext->{0}->{data}, ' - ', $plaintext->{1}->{data}, "\n"; + print $rec->{plaintext}->{0}->{data}, ' - ', + $rec->{plaintext}->{1}->{data}, "\n"; } + $pdb->Lock(); =head1 SUBROUTINES/METHODS =head2 new - $pdb = new Palm::Keyring([$password[, $version]]); + $pdb = new Palm::Keyring([$password[, $version[, $cipher]]]); Create a new PDB, initialized with the various Palm::Keyring fields and an empty record list. @@ -1429,7 +1448,7 @@ Use this method if you're creating a Keyring PDB from scratch otherwise you can just use Palm::PDB::new() before calling Load(). -If you pass in a password, it will initalize the first record with the encrypted +If you pass in a password, it will initalize the database with the encrypted password. new() now also takes options in other formats @@ -1453,7 +1472,7 @@ =item cipher -The cipher to use. Either the number or the name. +The cipher to use. Either the number or the name. Only used by v5 datbases. 0 => None 1 => DES_EDE3 @@ -1462,11 +1481,11 @@ =item iterations -The number of iterations to encrypt with. +The number of iterations to encrypt with. Only used by somy crypts in v5 databases. -=item options +=item file -A hashref of the options that are set +The name of a file to Load(). This will override many of the other options. =back @@ -1507,7 +1526,9 @@ =head2 labels -Pass in the id or the name of the label; +Pass in the id or the name of the label. The label id is used as a key +to the different parts of the records. +See Encrypt() for details on where the label is used. This is a function, not a method. @@ -1531,6 +1552,11 @@ =head2 Encrypt +=head3 B The order of the arguments to Encrypt has +changed. $password and $plaintext used to be swapped. They changed +because you can now set $rec->{plaintext} and not pass in $plaintext so +$password is more important. + $pdb->Encrypt($rec[, $password[, $plaintext[, $ivec]]]); Encrypts an account into a record, either with the password previously @@ -1565,7 +1591,11 @@ label => 'lastchange', label_id => 3, font => 0, - data => $lastchange, + data => { + year => $year, # usually the year - 1900 + mon => $mon, # range 0-11 + day => $day, # range 1-31 + }, }, 255 => { label => 'notes', @@ -1575,8 +1605,8 @@ }, }; -The account name is also stored in $rec->{plaintext}->{0}->{data} for both v4 -and v5 databases. +The account name is stored in $rec->{plaintext}->{0}->{data} for both v4 +and v5 databases even when the record has not been Decrypt()ed. $rec->{plaintext}->{0} => { label => 'name', @@ -1600,9 +1630,9 @@ my $plaintext = $pdb->Decrypt($rec[, $password]); Decrypts the record and returns a reference for the plaintext account as -described under L. +described under Encrypt(). Also sets $rec->{plaintext} with the same information as $plaintext as -described in L. +described in Encrypt(). foreach my $rec (@{ $pdb->{records} }) { my $plaintext = $pdb->Decrypt($rec); @@ -1668,7 +1698,7 @@ Unsets $rec->{plaintext} for all records and unsets the saved password. -This does NOT L any of the records before clearing them, so if +This does NOT Encrypt() any of the records before clearing them, so if you are not careful you will lose information. B This only does "delete $rec->{plaintext}" and the same for the @@ -1774,15 +1804,17 @@ I am not sure I am 'require module' the best way, but I don't want to depend on modules that you don't need to use. -I am not very happy with the data structures used by Encrypt() and -Decrypt() for v5 databases, but I am not sure of a better way. - The date validation for packing new dates is very poor. I have not gone through and standardized on how the module fails. Some things fail with croak, some return undef, some may even fail silently. -Nothing initializes a lasterr method or anything like that. I need -to fix all that before it is a 1.0 candidate. +Nothing initializes a lasterr method or anything like that. + +This module does not do anything special with the plaintext data. It SHOULD +treat it somehow special so that it can't be found in RAM or in a swap file +anywhere. I don't have a clue how to do this. + +I need to fix all this before it is a 1.0 candidate. Please report any bugs or feature requests to C, or through the web interface at