lastpass 1.3.0 → 1.7.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: '09a65355723c0ba7300141aa42b691b35072efe71328f6095dce6580c4ff0ccd'
+  data.tar.gz: 3a18f05b3a62ef6fc42568956cc5a99f0bb229597795333363e54fadd036c107
+SHA512:
+  metadata.gz: e08bffaa03731f26519611ea40b52aec82097e3421cda2e0b68ebd785fdafaf9e9e9d6bb39ca8ae4c8df606d43e417003032d006e6a8966591a6db1727073328
+  data.tar.gz: b49b1995780a93c08b87396e78cb8d6718e0920336cd4981c0421290cfaee653904aaca4af23573aa2458a51a8aeb8d4dc4d1e0775dd20410602bb188b7cd7b4

data/.github/workflows/ruby.yml

@@ -0,0 +1,23 @@
+name: Ruby
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: [2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7]
+    steps:
+    - uses: actions/checkout@v2
+    - uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+    - run: bundle install
+    - run: bundle exec rake

data/.gitignore

@@ -1,4 +1,5 @@
-Gemfile.lock
-lastpass-*.gem
-coverage
-example/credentials.yaml
+/pkg/
+/Gemfile.lock
+/coverage
+/example/credentials.yaml
+/vendor/

data/.travis.yml

@@ -1,5 +1,10 @@
 language: ruby
 rvm:
-  - 1.9.3
-  - 2.0.0
-  - 2.1.5
+  - 2.0.0-p648
+  - 2.1.10
+  - 2.2.9
+  - 2.3.8
+  - 2.4.9
+  - 2.5.8
+  - 2.6.6
+  - 2.7.1

data/CHANGELOG.md

@@ -1,3 +1,44 @@
+Version 1.7.0
+-------------
+
+- Parse generic secure notes (thanks to Michael Chui @saraid)
+- Parse and store secure notes for accounts (see `Account.note` property)
+
+Version 1.6.1
+-------------
+
+- Obsolete URI.encode is replaced with URI.encode_www_form_component to
+  inhibit the warning
+- Travic CI runs on all 2.* latest minor version releases (2.0.0 to 2.7.1)
+
+Version 1.6.0
+-------------
+
+- Changed the way the private keys are parsed
+- OpenSSL 1.1.0 support
+- Bug fixes
+
+Version 1.5.0
+-------------
+
+- Fixed failing `get_iteraction_count`. POST parameters are moved from the
+  query (URL) to the body.
+- pbkdf2-ruby gem is no longer used as it was causing problems. Relying on
+  built-in `OpenSSL::PKCS5.pbkdf2_hmac`
+- Minimum supported Ruby version is 2.0.0
+- Dependencies updated to their laters versions
+- Travis CI fixed
+
+Version 1.4.0
+-------------
+
+- Added device id (IMEI/UUID) support
+- Log out after fetching the blob to close the newly open session on LP server
+  to prevent triggering anti-hacking logic (hopefully)
+- Verify that the recieved blob is marked with ENDM chunk and hasn't been
+  truncated in the process
+
+
 Version 1.3.0
 -------------
 

data/README.md

@@ -1,14 +1,14 @@
 LastPass Ruby API
 =================
 
-[![Build Status](https://travis-ci.org/detunized/lastpass-ruby.png?branch=master)](https://travis-ci.org/detunized/lastpass-ruby)
-[![Coverage Status](https://coveralls.io/repos/detunized/lastpass-ruby/badge.png?branch=master)](https://coveralls.io/r/detunized/lastpass-ruby?branch=master)
-[![Code Climate](https://codeclimate.com/github/detunized/lastpass-ruby.png)](https://codeclimate.com/github/detunized/lastpass-ruby)
-[![Dependency Status](https://gemnasium.com/detunized/lastpass-ruby.png)](https://gemnasium.com/detunized/lastpass-ruby)
+[![Build Status](https://travis-ci.org/detunized/lastpass-ruby.svg?branch=master)](https://travis-ci.org/detunized/lastpass-ruby)
+[![Coverage Status](https://coveralls.io/repos/detunized/lastpass-ruby/badge.svg?branch=master)](https://coveralls.io/r/detunized/lastpass-ruby?branch=master)
+[![Code Climate](https://codeclimate.com/github/detunized/lastpass-ruby.svg)](https://codeclimate.com/github/detunized/lastpass-ruby)
+[![Dependency Status](https://gemnasium.com/detunized/lastpass-ruby.svg)](https://gemnasium.com/detunized/lastpass-ruby)
 
 **This is unofficial LastPass API.**
 
-There's also [C#/.NET port](https://github.com/detunized/lastpass-sharp) available.
+There are also [a C#/.NET port](https://github.com/detunized/lastpass-sharp) and [a Python port](https://github.com/konomae/lastpass-python) available.
 
 This library implements fetching and parsing of LastPass data.  The library is
 still in the proof of concept stage and doesn't support all LastPass features

data/Rakefile

@@ -1,6 +1,7 @@
 # Copyright (C) 2013 Dmitry Yakimenko (detunized@gmail.com).
 # Licensed under the terms of the MIT license. See LICENCE for details.
 
+require "bundler/gem_tasks"
 require "rspec/core/rake_task"
 
 task :default => :spec

data/example/example.rb

@@ -7,6 +7,8 @@
 require "lastpass"
 require "yaml"
 
+DEVICE_ID = "example.rb"
+
 credentials = YAML.load_file File.join File.dirname(__FILE__), "credentials.yaml"
 
 username = credentials["username"]
@@ -14,21 +16,21 @@ password = credentials["password"]
 
 begin
     # First try without a multifactor password
-    vault = LastPass::Vault.open_remote username, password
+    vault = LastPass::Vault.open_remote username, password, nil, DEVICE_ID
 rescue LastPass::LastPassIncorrectGoogleAuthenticatorCodeError => e
     # Get the code
     puts "Enter Google Authenticator code:"
     multifactor_password = gets.chomp
 
     # And now retry with the code
-    vault = LastPass::Vault.open_remote username, password, multifactor_password
+    vault = LastPass::Vault.open_remote username, password, multifactor_password, DEVICE_ID
 rescue LastPass::LastPassIncorrectYubikeyPasswordError => e
     # Get the password
     puts "Enter Yubikey password:"
     multifactor_password = gets.chomp
 
     # And now retry with the Yubikey password
-    vault = LastPass::Vault.open_remote username, password, multifactor_password
+    vault = LastPass::Vault.open_remote username, password, multifactor_password, DEVICE_ID
 end
 
 vault.accounts.each_with_index do |i, index|

data/lastpass.gemspec

@@ -12,17 +12,16 @@ Gem::Specification.new do |s|
     s.email       = "detunized@gmail.com"
     s.homepage    = "https://github.com/detunized/lastpass-ruby"
     s.summary     = "Unofficial LastPass API"
-    s.description = "Unofficial LastPass API"
+    s.description = "Read only access to the online LastPass vault"
 
-    s.required_ruby_version = ">= 1.9.3"
+    s.required_ruby_version = ">= 2.0.0"
 
-    s.add_dependency "httparty", "~> 0.13.0"
-    s.add_dependency "pbkdf2-ruby", "~> 0.2.0"
+    s.add_dependency "httparty", "~> 0.14.0"
 
-    s.add_development_dependency "rake", "~> 10.4.0"
-    s.add_development_dependency "rspec", "~> 3.1.0"
-    s.add_development_dependency "rspec-its", "~> 1.1.0"
-    s.add_development_dependency "coveralls", "~> 0.7.0"
+    s.add_development_dependency "rake", "~> 12.0"
+    s.add_development_dependency "rspec", "~> 3.5"
+    s.add_development_dependency "rspec-its", "~> 1.2"
+    s.add_development_dependency "coveralls", "~> 0.8.19"
 
     s.files         = `git ls-files`.split "\n"
     s.test_files    = `git ls-files spec`.split "\n"

data/lib/lastpass.rb

@@ -4,7 +4,6 @@
 require "base64"
 require "httparty"
 require "openssl"
-require "pbkdf2"
 require "stringio"
 
 require "lastpass/account"
@@ -13,6 +12,7 @@ require "lastpass/chunk"
 require "lastpass/exceptions"
 require "lastpass/http"
 require "lastpass/fetcher"
+require "lastpass/note"
 require "lastpass/parser"
 require "lastpass/session"
 require "lastpass/vault"

data/lib/lastpass/account.rb

@@ -8,14 +8,16 @@ module LastPass
                     :username,
                     :password,
                     :url,
+                    :notes,
                     :group
 
-        def initialize id, name, username, password, url, group
+        def initialize id, name, username, password, url, notes, group
             @id = id
             @name = name
             @username = username
             @password = password
             @url = url
+            @notes = notes
             @group = group
         end
     end

data/lib/lastpass/blob.rb

@@ -4,11 +4,13 @@
 module LastPass
     class Blob
         attr_reader :bytes,
-                    :key_iteration_count
+                    :key_iteration_count,
+                    :encrypted_private_key
 
-        def initialize bytes, key_iteration_count
+        def initialize bytes, key_iteration_count, encrypted_private_key
             @bytes = bytes
             @key_iteration_count = key_iteration_count
+            @encrypted_private_key = encrypted_private_key
         end
 
         def encryption_key username, password

data/lib/lastpass/fetcher.rb

@@ -3,24 +3,33 @@
 
 module LastPass
     class Fetcher
-        def self.login username, password, multifactor_password = nil
+        def self.login username, password, multifactor_password = nil, client_id = nil
             key_iteration_count = request_iteration_count username
-            request_login username, password, key_iteration_count, multifactor_password
+            request_login username, password, key_iteration_count, multifactor_password, client_id
+        end
+
+        def self.logout session, web_client = http
+            response = web_client.get "https://lastpass.com/logout.php?method=cli&noredirect=1",
+                                      cookies: {"PHPSESSID" => URI.encode_www_form_component(session.id)}
+
+            raise NetworkError unless response.response.is_a? Net::HTTPOK
         end
 
         def self.fetch session, web_client = http
-            response = web_client.get "https://lastpass.com/getaccts.php?mobile=1&b64=1&hash=0.0&hasplugin=3.0.23&requestsrc=android",
+            response = web_client.get "https://lastpass.com/getaccts.php?mobile=1&b64=1&hash=0.0&hasplugin=3.0.23&requestsrc=cli",
                                       format: :plain,
-                                      cookies: {"PHPSESSID" => URI.encode(session.id)}
+                                      cookies: {"PHPSESSID" => URI.encode_www_form_component(session.id)}
 
             raise NetworkError unless response.response.is_a? Net::HTTPOK
 
-            Blob.new decode_blob(response.parsed_response), session.key_iteration_count
+            Blob.new decode_blob(response.parsed_response),
+                     session.key_iteration_count,
+                     session.encrypted_private_key
         end
 
         def self.request_iteration_count username, web_client = http
             response = web_client.post "https://lastpass.com/iterations.php",
-                                       query: {email: username}
+                                       body: {email: username}
 
             raise NetworkError unless response.response.is_a? Net::HTTPOK
 
@@ -39,18 +48,20 @@ module LastPass
                                password,
                                key_iteration_count,
                                multifactor_password = nil,
+                               client_id = nil,
                                web_client = http
 
             body = {
-                method: "mobile",
-                web: 1,
-                xml: 1,
+                method: "cli",
+                xml: 2,
                 username: username,
                 hash: make_hash(username, password, key_iteration_count),
-                iterations: key_iteration_count
+                iterations: key_iteration_count,
+                includeprivatekeyenc: 1
             }
 
             body[:otp] = multifactor_password if multifactor_password
+            body[:imei] = client_id if client_id
 
             response = web_client.post "https://lastpass.com/login.php",
                                        format: :xml,
@@ -66,11 +77,14 @@ module LastPass
         end
 
         def self.create_session parsed_response, key_iteration_count
-            ok = parsed_response["ok"]
+            ok = (parsed_response["response"] || {})["ok"]
             if ok.is_a? Hash
                 session_id = ok["sessionid"]
                 if session_id.is_a? String
-                    return Session.new session_id, key_iteration_count
+                    private_key = ok["privatekeyenc"]
+                    private_key = nil if private_key == ""
+
+                    return Session.new session_id, key_iteration_count, private_key
                 end
             end
 
@@ -86,7 +100,7 @@ module LastPass
                 "unknownpassword" => LastPassInvalidPasswordError,
                 "googleauthrequired" => LastPassIncorrectGoogleAuthenticatorCodeError,
                 "googleauthfailed" => LastPassIncorrectGoogleAuthenticatorCodeError,
-                "yubikeyrestricted" => LastPassIncorrectYubikeyPasswordError,
+                "otprequired" => LastPassIncorrectYubikeyPasswordError,
             }
 
             cause = error["cause"]
@@ -108,13 +122,7 @@ module LastPass
             if key_iteration_count == 1
                 Digest::SHA256.digest username + password
             else
-                PBKDF2
-                    .new(password: password,
-                         salt: username,
-                         iterations: key_iteration_count,
-                         key_length: 32)
-                    .bin_string
-                    .force_encoding "BINARY"
+                OpenSSL::PKCS5.pbkdf2_hmac password, username, key_iteration_count, 32, "sha256"
             end
         end
 
@@ -122,12 +130,11 @@ module LastPass
             if key_iteration_count == 1
                 Digest::SHA256.hexdigest Digest.hexencode(make_key(username, password, 1)) + password
             else
-                PBKDF2
-                    .new(password: make_key(username, password, key_iteration_count),
-                         salt: password,
-                         iterations: 1,
-                         key_length: 32)
-                    .hex_string
+                Digest.hexencode OpenSSL::PKCS5.pbkdf2_hmac make_key(username, password, key_iteration_count),
+                                                            password,
+                                                            1,
+                                                            32,
+                                                            "sha256"
             end
         end
 

data/lib/lastpass/http.rb

@@ -2,7 +2,7 @@
 # Licensed under the terms of the MIT license. See LICENCE for details.
 
 module LastPass
-  class HTTP
-    include HTTParty
-  end
+    class HTTP
+        include HTTParty
+    end
 end

data/lib/lastpass/note.rb

@@ -0,0 +1,15 @@
+module LastPass
+    class Note
+        attr_reader :id,
+                    :name,
+                    :notes,
+                    :group
+
+        def initialize id, name, notes, group
+            @id = id
+            @name = name
+            @notes = notes
+            @group = group
+        end
+    end
+end

data/lib/lastpass/parser.rb

@@ -7,7 +7,7 @@ module LastPass
         RSA_PKCS1_OAEP_PADDING = 4
 
         # Secure note types that contain account-like information
-        ALLOWED_SECURE_NOTE_TYPES = {
+        ACCOUNT_LIKE_SECURE_NOTE_TYPES = {
             "Server" => true,
             "Email Account" => true,
             "Database" => true,
@@ -28,9 +28,9 @@ module LastPass
         end
 
         # Parses an account chunk, decrypts and creates an Account object.
-        # May return nil when the chunk does not represent an account.
-        # All secure notes are ACCTs but not all of them strore account
-        # information.
+        # Returns either an Account or a Note object, in case of a generic
+        # note that doesn't represent an account. All secure notes are ACCTs
+        # but not all of them store account information.
         #
         # TODO: Make a test case that covers secure note account
         def self.parse_ACCT chunk, encryption_key
@@ -48,44 +48,20 @@ module LastPass
 
                 # Parse secure note
                 if secure_note == "1"
-                    17.times { skip_item io }
-                    secure_note_type = read_item io
-
-                    if !ALLOWED_SECURE_NOTE_TYPES.key? secure_note_type
-                        return nil
+                    parsed = parse_secure_note_server notes
+                    if !ACCOUNT_LIKE_SECURE_NOTE_TYPES.key? parsed[:type]
+                        return Note.new id, name, notes, group
                     end
 
-                    url, username, password = parse_secure_note_server notes
+                    url = parsed[:url] if parsed.key? :url
+                    username = parsed[:username] if parsed.key? :username
+                    password = parsed[:password] if parsed.key? :password
                 end
 
-                Account.new id, name, username, password, url, group
+                Account.new id, name, username, password, url, notes, group
             end
         end
 
-        # Parse PRIK chunk which contains private RSA key
-        def self.parse_PRIK chunk, encryption_key
-            decrypted = decode_aes256 "cbc",
-                                      encryption_key[0, 16],
-                                      decode_hex(chunk.payload),
-                                      encryption_key
-
-            /^LastPassPrivateKey<(?<hex_key>.*)>LastPassPrivateKey$/ =~ decrypted
-            asn1_encoded_all = OpenSSL::ASN1.decode decode_hex hex_key
-            asn1_encoded_key = OpenSSL::ASN1.decode asn1_encoded_all.value[2].value
-
-            rsa_key = OpenSSL::PKey::RSA.new
-            rsa_key.n = asn1_encoded_key.value[1].value
-            rsa_key.e = asn1_encoded_key.value[2].value
-            rsa_key.d = asn1_encoded_key.value[3].value
-            rsa_key.p = asn1_encoded_key.value[4].value
-            rsa_key.q = asn1_encoded_key.value[5].value
-            rsa_key.dmp1 = asn1_encoded_key.value[6].value
-            rsa_key.dmq1 = asn1_encoded_key.value[7].value
-            rsa_key.iqmp = asn1_encoded_key.value[8].value
-
-            rsa_key
-        end
-
         # TODO: Fake some data and make a test
         def self.parse_SHAR chunk, encryption_key, rsa_key
             StringIO.open chunk.payload do |io|
@@ -112,24 +88,63 @@ module LastPass
             end
         end
 
+        # Parse and decrypt the encrypted private RSA key
+        def self.parse_private_key encrypted_private_key, encryption_key
+            decrypted = decode_aes256 "cbc",
+                                      encryption_key[0, 16],
+                                      decode_hex(encrypted_private_key),
+                                      encryption_key
+
+            /^LastPassPrivateKey<(?<hex_key>.*)>LastPassPrivateKey$/ =~ decrypted
+            asn1_encoded_all = OpenSSL::ASN1.decode decode_hex hex_key
+            asn1_encoded_key = OpenSSL::ASN1.decode asn1_encoded_all.value[2].value
+
+            rsa_key = OpenSSL::PKey::RSA.new
+            n = asn1_encoded_key.value[1].value
+            e = asn1_encoded_key.value[2].value
+            d = asn1_encoded_key.value[3].value
+            p = asn1_encoded_key.value[4].value
+            q = asn1_encoded_key.value[5].value
+            dmp1 = asn1_encoded_key.value[6].value
+            dmq1 = asn1_encoded_key.value[7].value
+            iqmp = asn1_encoded_key.value[8].value
+
+            if rsa_key.respond_to? :set_key
+                rsa_key.set_key n, e, d
+                rsa_key.set_factors p, q
+                rsa_key.set_crt_params dmp1, dmq1, iqmp
+            else
+                rsa_key.n = n
+                rsa_key.e = e
+                rsa_key.d = d
+                rsa_key.p = p
+                rsa_key.q = q
+                rsa_key.dmp1 = dmp1
+                rsa_key.dmq1 = dmq1
+                rsa_key.iqmp = iqmp
+            end
+
+            rsa_key
+        end
+
         def self.parse_secure_note_server notes
-            url = nil
-            username = nil
-            password = nil
+            info = {}
 
             notes.split("\n").each do |i|
                 key, value = i.split ":", 2
                 case key
+                when "NoteType"
+                    info[:type] = value
                 when "Hostname"
-                    url = value
+                    info[:url] = value
                 when "Username"
-                    username = value
+                    info[:username] = value
                 when "Password"
-                    password = value
+                    info[:password] = value
                 end
             end
 
-            [url, username, password]
+            info
         end
 
         # Reads one chunk from a stream and creates a Chunk object with the data read.
@@ -275,7 +290,7 @@ module LastPass
         # Allowed ciphers are: :ecb, :cbc.
         # If for :ecb iv is not used and should be set to "".
         def self.decode_aes256 cipher, iv, data, encryption_key
-            aes = OpenSSL::Cipher::Cipher.new "aes-256-#{cipher}"
+            aes = OpenSSL::Cipher.new "aes-256-#{cipher}"
             aes.decrypt
             aes.key = encryption_key
             aes.iv = iv