===================================================================
RCS file: /cvs/palm/Palm-Keyring/lib/Palm/Keyring.pm,v
retrieving revision 1.59
retrieving revision 1.65
diff -u -r1.59 -r1.65
--- palm/Palm-Keyring/lib/Palm/Keyring.pm	2008/09/19 06:39:07	1.59
+++ palm/Palm-Keyring/lib/Palm/Keyring.pm	2011/09/19 04:23:37	1.65
@@ -1,5 +1,5 @@
 package Palm::Keyring;
-# $RedRiver: Keyring.pm,v 1.58 2008/09/19 02:50:05 andrew Exp $
+# $RedRiver: Keyring.pm,v 1.62 2008/09/19 06:01:00 andrew Exp $
 ########################################################################
 # Keyring.pm *** Perl class for Keyring for Palm OS databases.
 #
@@ -59,6 +59,13 @@
         blocksize => 16,
         default_iter => 250,
     },
+    {   # Only for testing
+        alias     => 'TESTING',
+        name      => 'Testing',
+        keylen    => 0,
+        blocksize => 0,
+        default_iter => 0,
+    },
 );
 
 my %LABELS = (
@@ -298,7 +305,8 @@
             $rec->{data} = join $NULL, $name, $rec->{encrypted};
         }
 
-    } elsif ($self->{version} == 5) {
+    } 
+    elsif ($self->{version} == 5) {
         croak 'No encrypted data in record' if !defined $rec->{encrypted};
         croak 'No ivec!' if !$rec->{ivec};
 
@@ -317,12 +325,13 @@
 
         $rec->{data} = join $EMPTY, $packed, $rec->{ivec}, $rec->{encrypted};
 
-    } else {
+    } 
+    else {
         croak "Unsupported Version $self->{version}";
     }
     # XXX Should I?
-    delete $rec->{plaintext};
-    delete $rec->{encrypted};
+    #delete $rec->{plaintext};
+    #delete $rec->{encrypted};
 
     croak 'No data in record to pack' if !$rec->{data};
 
@@ -432,29 +441,15 @@
 sub Encrypt 
 {
     my $self = shift;
-    my $rec  = shift;
+    my $rec  = shift || croak('Needed parameter [record] not passed!');
     my $pass = shift || $self->{password};
-
-    if ( !$rec ) {
-        croak('Needed parameter [record] not passed!');
-    }
-
     my $data = shift || $rec->{plaintext};
     my $ivec = shift;
 
+    $self->_password_verify($pass);
 
-    if ( ! $pass && ! $self->{appinfo}->{key}) {
-        croak('password not set!');
-    }
+    if ( !$data ) { croak('Needed parameter [plaintext] not passed!'); }
 
-    if ( ! $data) {
-        croak('Needed parameter [plaintext] not passed!');
-    }
-
-    if ( $pass && ! $self->Password($pass)) {
-        croak('Incorrect Password!');
-    }
-
     my $acct;
     if ($rec->{encrypted}) {
         $acct = $self->Decrypt($rec, $pass);
@@ -470,13 +465,16 @@
             lastchange => $data->{3}->{data},
             notes      => $data->{255}->{data},
         };
-        my $acctv4 = {
-            name       => $acct->{0}->{data},
-            account    => $acct->{1}->{data},
-            password   => $acct->{2}->{data},
-            lastchange => $acct->{3}->{data},
-            notes      => $acct->{255}->{data},
-        };
+        my $acctv4 = {};
+        if ($acct) {
+            $acctv4 = {
+                name       => $acct->{0}->{data},
+                account    => $acct->{1}->{data},
+                password   => $acct->{2}->{data},
+                lastchange => $acct->{3}->{data},
+                notes      => $acct->{255}->{data},
+            };
+        }
         $encrypted = _encrypt_v4($datav4, $acctv4, $self->{digest});
 
     } elsif ($self->{version} == 5) {
@@ -486,29 +484,21 @@
             $self->{appinfo}->{cipher},
             $ivec,
         );
-        if (defined $ivec) {
-            $rec->{ivec} = $ivec;
-        }
+        $rec->{ivec} = $ivec if $ivec;
 
     } else {
         croak "Unsupported Version $self->{version}";
     }
 
-    $rec->{plaintext}->{0} = $data->{0};
+    $rec->{plaintext} = $data;
 
-    if ($encrypted) { 
-        if ($encrypted eq '1') {
-            return 1;
-        }
-
+    if ($encrypted ne '1') {
         $rec->{attributes}{Dirty} = 1;
         $rec->{attributes}{dirty} = 1;
         $rec->{encrypted} = $encrypted;
-
-        return 1;
-    } else {
-        return;
     }
+
+    return 1;
 }
 
 sub _encrypt_v4 
@@ -591,9 +581,14 @@
     my $c = crypts($cipher) or croak('Unknown cipher ' . $cipher);
 
     if (! defined $ivec) { 
-        while (! $ivec) {
-            $ivec = pack("C*",map {rand(256)} 1..$c->{blocksize});
+        if (!$c->{blocksize}) {
+            $ivec = $EMPTY;
         }
+        else {
+            while (! $ivec) {
+                $ivec = pack("C*",map {rand(256)} 1..$c->{blocksize});
+            }
+        }
     }
 
     my $changed = 0;
@@ -601,29 +596,59 @@
     if ($new->{3}->{data}) {
         $need_newdate = 0;
     }
-    foreach my $k (keys %{ $new }) {
-        if (! $old) {
-            $changed = 1;
-        } elsif ($k == 3) {
-            if ($old && (
-                    $new->{$k}{data}{day}   == $old->{$k}{data}{day}   &&
-                    $new->{$k}{data}{month} == $old->{$k}{data}{month} &&
-                    $new->{$k}{data}{year}  == $old->{$k}{data}{year}
-                )) {
-                $changed      = 1;
-                $need_newdate = 1;
-            }
 
-        } else {
-            my $n = join ':', sort %{ $new->{$k} };
-            my $o = join ':', sort %{ $old->{$k} };
-            if ($n ne $o) {
+    if ($old) {
+        foreach my $k (keys %{ $new }) {
+            if (! $old->{$k} ) {
                 $changed = 1;
+                last;
+            } 
+            if (! $new->{$k}) {
+                $changed = 1;
+                last;
             }
+            elsif ($k == 3) {
+                if (! $new->{$k}->{data} && $old->{$k}->{data} ) {
+                    $changed = 1;
+                    last;
+                }
+
+                my %n = %{ $new->{$k}->{data} };
+                my %o = %{ $old->{$k}->{data} };
+
+                foreach (qw( day month year )) {
+                    $n{$_} ||= 0;
+                    $o{$_} ||= 0;
+                }
+
+                if (
+                    $n{day}   == $o{day}   &&
+                    $n{month} == $o{month} &&
+                    $n{year}  == $o{year}
+                ) {
+                    $need_newdate = 1;
+                }
+                else {
+                    $changed = 1;
+                    last;
+                }
+
+            } 
+            else {
+                my $n = join ':', sort %{ $new->{$k} };
+                my $o = join ':', sort %{ $old->{$k} };
+                if ($n ne $o) {
+                    $changed = 1;
+                    last;
+                }
+            }
         }
     }
+    else {
+        $changed = 1;
+    }
 
-    return 1, 0 if $changed == 0;
+    return 1 if $changed == 0;
 
     if ($need_newdate) {
         my ($day, $month, $year) = (localtime)[3,4,5];
@@ -651,6 +676,7 @@
     }
     $plaintext .= chr(0xff) x 2;
 
+    #print "CRYPT(e): $c->{name} [$cipher]\n";
     my $encrypted;
     if ($c->{name} eq 'None') {
         # do nothing
@@ -667,12 +693,8 @@
             -blocksize   => $c->{blocksize},
             -header      => 'none',
             -padding     => 'oneandzeroes',
-        );
+        ) || croak("Unable to set up encryption!");
 
-        if (! $c) {
-            croak("Unable to set up encryption!");
-        }
-
         $encrypted = $cbc->encrypt($plaintext);
 
     } else {
@@ -690,22 +712,11 @@
     my $rec  = shift;
     my $pass = shift || $self->{password};
 
-    if ( ! $pass && ! $self->{appinfo}->{key}) {
-        croak("password not set!\n");
-    }
+    if ( ! $rec) { croak('Needed parameter [record] not passed!'); } 
+    if ( ! $rec->{encrypted} ) { croak('No encrypted content!'); }
 
-    if ( ! $rec) {
-        croak("Needed parameter 'record' not passed!\n");
-    }
+    $self->_password_verify($pass);
 
-    if ( $pass && ! $self->Password($pass)) {
-        croak("Invalid Password!\n");
-    }
-
-    if ( ! $rec->{encrypted} ) {
-        croak("No encrypted content!");
-    }
-
     my $plaintext;
     if ($self->{version} == 4) {
         $self->{digest} ||= _calc_keys( $pass );
@@ -749,11 +760,8 @@
         croak "Unsupported Version $self->{version}";
     }
 
-    if ($plaintext) {
-        $rec->{plaintext} = $plaintext;
-        return $plaintext;
-    }
-    return;
+    $rec->{plaintext} = $plaintext;
+    return $plaintext;
 }
 
 sub _decrypt_v4
@@ -767,6 +775,7 @@
 
     my $modified;
     if ($packed_date) {
+        #print _hexdump('DATE:', $packed_date);
         $modified = _parse_keyring_date($packed_date);
     }
 
@@ -790,11 +799,13 @@
 
     my $plaintext;
 
+    #print "CRYPT(d): $c->{name} [$cipher]\n";
     if ($c->{name} eq 'None') {
         # do nothing
         $plaintext = $encrypted;
 
-    } elsif ($c->{name} eq 'DES_EDE3' or $c->{name} eq 'Rijndael') {
+    } 
+    elsif ($c->{name} eq 'DES_EDE3' or $c->{name} eq 'Rijndael') {
         require Crypt::CBC;
         my $cbc = Crypt::CBC->new( 
             -key         => $key,
@@ -805,26 +816,23 @@
             -blocksize   => $c->{blocksize},
             -header      => 'none',
             -padding     => 'oneandzeroes',
-        );
+        ) || croak("Unable to set up decryption!");
 
-        if (! $c) {
-            croak("Unable to set up encryption!");
-        }
         my $len = $c->{blocksize} - length($encrypted) % $c->{blocksize};
         $encrypted .= $NULL x $len;
+
         $plaintext  = $cbc->decrypt($encrypted);
 
-    } else {
-        croak "Unsupported Crypt $c->{name}";
     } 
+    else {
+        croak "Unsupported Crypt $c->{name} in decrypt";
+    } 
 
     my %fields;
     while ($plaintext) {
         my $field;
         ($field, $plaintext) = _parse_field($plaintext);
-        if (! $field) {
-            last;
-        }
+        last if ! $field;
         $fields{ $field->{label_id} } = $field;
     }
 
@@ -855,16 +863,12 @@
     if ($new_pass) {
         my @accts = ();
         foreach my $rec (@{ $self->{records} }) {
-            my $acct = $self->Decrypt($rec, $pass);
-            if ( ! $acct ) {
-                croak("Couldn't decrypt $rec->{plaintext}->{0}->{data}");
-            }
+            my $acct = $self->Decrypt($rec, $pass)
+                || croak("Couldn't decrypt $rec->{plaintext}->{0}->{data}");
             push @accts, $acct;
         }
 
-        if ( ! $self->_password_update($new_pass)) {
-            croak("Couldn't set new password!");
-        }
+        $self->_password_update($new_pass);
         $pass = $new_pass;
 
         foreach my $i (0..$#accts) {
@@ -874,30 +878,42 @@
         }
     }
 
+    return $self->_password_verify($pass);
+}
+
+sub _password_verify {
+    my $self = shift;
+    my $pass = shift;
+    if (!defined $pass) {
+        $pass = $self->{password};
+    }
+
+    if ( !$pass ) {
+        croak("Password not set!\n");
+    }
+
     if (defined $self->{password} && $pass eq $self->{password}) {
         # already verified this password
         return 1;
     }
 
     if ($self->{version} == 4) {
-        my $valid = _password_verify_v4($pass, $self->{encpassword});
+        _password_verify_v4($pass, $self->{encpassword});
 
         # May as well generate the keys we need now, 
         # since we know the password is right
-        if ($valid) {
-            $self->{digest} = _calc_keys($pass);
-            if ($self->{digest} ) {
-                $self->{password} = $pass;
-                return 1;
-            }
-        }
-    } elsif ($self->{version} == 5) {
-        return _password_verify_v5($self->{appinfo}, $pass);
-    } else {
-        croak "Unsupported version $self->{version}";
+        $self->{digest}   = _calc_keys($pass);
+        $self->{password} = $pass;
+
+        return 1;
+    } 
+    elsif ($self->{version} == 5) {
+        _password_verify_v5($self->{appinfo}, $pass);
+        $self->{password} = $pass;
+        return 1;
     }
 
-    return;
+    croak "Unsupported Version $self->{version}";
 }
 
 sub _password_verify_v4 
@@ -908,11 +924,9 @@
     my $pass = shift;
     my $data = shift;
 
-    if (! $pass) { croak('No password specified!'); };
+    if (! $pass) { croak('No password specified!'); }
+    if (! $data) { croak('No encrypted password in file!'); }
 
-    # XXX die "No encrypted password in file!" unless defined $data;
-    if ( ! defined $data) { return; };
-
     $data =~ s/$NULL$//xm;
 
     my $salt = substr $data, 0, $kSalt_Size;
@@ -920,10 +934,10 @@
     my $msg = $salt . $pass; 
     $msg .= "\0" x ( $MD5_CBLOCK - length $msg );
 
-    my $digest = md5($msg);
+    my $digest = md5($msg) || croak('MD5 Failed');
 
     if ($data ne $salt . $digest ) {
-        return;
+        croak("Incorrect Password!");
     }
 
     return 1;
@@ -950,13 +964,11 @@
     #print "Hash: '". $hash . "'\n";
     #print "Hash: '". $appinfo->{masterhash} . "'\n";
 
-    if ($appinfo->{masterhash} eq $hash) {
-        $appinfo->{key} = $key;
-    } else {
-        return;
+    if ($appinfo->{masterhash} && $appinfo->{masterhash} ne $hash) {
+        croak('Incorrect Password');
     }
-
-    return $key;
+    $appinfo->{key} = $key;
+    return 1;
 }
 
 
@@ -972,10 +984,7 @@
     if ($self->{version} == 4) {
         my $data = _password_update_v4($pass, @_);
 
-        if (! $data) {
-            carp("Failed  to update password!");
-            return;
-        }
+        if (! $data) { croak "Failed to update password!"; }
 
         # AFAIK the thing we use to test the password is
         #     always in the first entry
@@ -984,8 +993,8 @@
         $self->{digest}   = _calc_keys( $self->{password} );
 
         return 1;
-
-    } elsif ($self->{version} == 5) {
+    } 
+    elsif ($self->{version} == 5) {
         my $cipher  = shift || $self->{appinfo}->{cipher};
         my $iter    = shift || $self->{appinfo}->{iter};
         my $salt    = shift || 0;
@@ -994,17 +1003,14 @@
             $self->{appinfo}, $pass, $cipher, $iter, $salt
         );
 
-        if (! $hash) {
-            carp("Failed  to update password!");
-            return;
-        }
+        if (! $hash) { croak "Failed to update password!"; }
 
+        $self->{password} = $pass;
+
         return 1;
-    } else {
-        croak("Unsupported version ($self->{version})");
     }
 
-    return;
+    croak "Unsupported Version $self->{version}";
 }
 
 sub _password_update_v4
@@ -1014,7 +1020,7 @@
 
     my $pass = shift;
     
-    if (! defined $pass) { croak('No password specified!'); };
+    croak('No password specified!') if ! defined $pass;
 
     my $salt;
     for ( 1 .. $kSalt_Size ) {
@@ -1025,7 +1031,7 @@
 
     $msg .= "\0" x ( $MD5_CBLOCK - length $msg );
 
-    my $digest = md5($msg);
+    my $digest = md5($msg) || croak('MD5 failed');
 
     my $data = $salt . $digest;    # . "\0";
 
@@ -1039,7 +1045,7 @@
     my $cipher  = shift;
     my $iter    = shift;
 
-    # I thought this needed to be 'blocksize', but apparently not.
+    # I thought $length needed to be 'blocksize', but apparently not.
     #my $length  = $CRYPTS[ $cipher ]{blocksize};
     my $length  = 8;
     my $salt    = shift || pack("C*",map {rand(256)} 1..$length);
@@ -1066,9 +1072,7 @@
     my ($pass) = @_;
     $pass ||= $self->{password};
 
-    if ( $pass && ! $self->Password($pass)) {
-        croak("Invalid Password!\n");
-    }
+    $self->_password_verify($pass);
 
     foreach my $rec (@{ $self->{records} }) {
         $self->Decrypt($rec);
@@ -1097,6 +1101,9 @@
 
 sub _calc_keys 
 {
+    require Digest::MD5;
+    import Digest::MD5 qw(md5);
+
     my $pass = shift;
     if (! defined $pass) { croak('No password defined!'); };
 
@@ -1129,7 +1136,7 @@
     import  Digest::SHA1 qw(sha1);
 
     my $key = _pbkdf2( $pass, $salt, $iter, $keylen, \&hmac_sha1 );
-    if ($dop) { $key = _DES_odd_parity($key); }
+    $key = _DES_odd_parity($key) if $dop;
 
     my $hash = unpack("H*", substr(sha1($key.$salt),0, 8));