lastpass 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 63a049d06efc466ce9ff2861ba45dc8c0797c0bb
-  data.tar.gz: 3d818fcc7316b20729917c5e40edac24a2e6b408
+SHA256:
+  metadata.gz: 7051161f3612e54ae85ce0930e91973c84fd12d0395c3c4703d18c78151d49c6
+  data.tar.gz: b586d087e2697a0f4f63d3157677bd85b6583828ab124b13d43d4c5dd65a6a0a
 SHA512:
-  metadata.gz: 2ec4ba7d245d8bc025b85f386ae69743db765c8a319436017586465cedfec115f03e454bc8495c5d2e4e14296e0c1b13eca3f5aa0e72851fbdc6bd75554e7548
-  data.tar.gz: 4df5d76964fa78f8a1cfcdc14086043dbf2a927249425fe67d4acff71dd7ed0047a5c95bb52e0d29da8d4e207fd59abef54770bdf4bbfa021a24c8887aba2eb8
+  metadata.gz: b3fff4b432c45316ee806e854d4b95c8c0e7e77671bed0d65ce091a611217bfd90878fd6e995845f3551d9927f0ecc4dbd3fafd88236f82dd6d2f00fd9a4f996
+  data.tar.gz: 32ef67cac6f64a4478210ba82eedf21a34e4e7f3edc1b66601db97473c675b6b662b4d91d0a5e746df2c66f194eb6feb341918528260c3a70d901bf78e4d89a4

data/.travis.yml

@@ -5,3 +5,6 @@ rvm:
   - 2.2.6
   - 2.3.3
   - 2.4.0
+deploy:
+  provider: rubygems
+  api_key: "YOUR API KEY"

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+Version 1.6.0
+-------------
+
+- Changed the way the private keys are parsed
+- OpenSSL 1.1.0 support
+- Bug fixes
+
 Version 1.5.0
 -------------
 

data/lib/lastpass/blob.rb

@@ -4,11 +4,13 @@
 module LastPass
     class Blob
         attr_reader :bytes,
-                    :key_iteration_count
+                    :key_iteration_count,
+                    :encrypted_private_key
 
-        def initialize bytes, key_iteration_count
+        def initialize bytes, key_iteration_count, encrypted_private_key
             @bytes = bytes
             @key_iteration_count = key_iteration_count
+            @encrypted_private_key = encrypted_private_key
         end
 
         def encryption_key username, password

data/lib/lastpass/fetcher.rb

@@ -9,20 +9,22 @@ module LastPass
         end
 
         def self.logout session, web_client = http
-            response = web_client.get "https://lastpass.com/logout.php?mobile=1",
+            response = web_client.get "https://lastpass.com/logout.php?method=cli&noredirect=1",
                                       cookies: {"PHPSESSID" => URI.encode(session.id)}
 
             raise NetworkError unless response.response.is_a? Net::HTTPOK
         end
 
         def self.fetch session, web_client = http
-            response = web_client.get "https://lastpass.com/getaccts.php?mobile=1&b64=1&hash=0.0&hasplugin=3.0.23&requestsrc=android",
+            response = web_client.get "https://lastpass.com/getaccts.php?mobile=1&b64=1&hash=0.0&hasplugin=3.0.23&requestsrc=cli",
                                       format: :plain,
                                       cookies: {"PHPSESSID" => URI.encode(session.id)}
 
             raise NetworkError unless response.response.is_a? Net::HTTPOK
 
-            Blob.new decode_blob(response.parsed_response), session.key_iteration_count
+            Blob.new decode_blob(response.parsed_response),
+                     session.key_iteration_count,
+                     session.encrypted_private_key
         end
 
         def self.request_iteration_count username, web_client = http
@@ -50,12 +52,12 @@ module LastPass
                                web_client = http
 
             body = {
-                method: "mobile",
-                web: 1,
-                xml: 1,
+                method: "cli",
+                xml: 2,
                 username: username,
                 hash: make_hash(username, password, key_iteration_count),
-                iterations: key_iteration_count
+                iterations: key_iteration_count,
+                includeprivatekeyenc: 1
             }
 
             body[:otp] = multifactor_password if multifactor_password
@@ -75,11 +77,14 @@ module LastPass
         end
 
         def self.create_session parsed_response, key_iteration_count
-            ok = parsed_response["ok"]
+            ok = (parsed_response["response"] || {})["ok"]
             if ok.is_a? Hash
                 session_id = ok["sessionid"]
                 if session_id.is_a? String
-                    return Session.new session_id, key_iteration_count
+                    private_key = ok["privatekeyenc"]
+                    private_key = nil if private_key == ""
+
+                    return Session.new session_id, key_iteration_count, private_key
                 end
             end
 
@@ -95,7 +100,7 @@ module LastPass
                 "unknownpassword" => LastPassInvalidPasswordError,
                 "googleauthrequired" => LastPassIncorrectGoogleAuthenticatorCodeError,
                 "googleauthfailed" => LastPassIncorrectGoogleAuthenticatorCodeError,
-                "yubikeyrestricted" => LastPassIncorrectYubikeyPasswordError,
+                "otprequired" => LastPassIncorrectYubikeyPasswordError,
             }
 
             cause = error["cause"]

data/lib/lastpass/parser.rb

@@ -62,30 +62,6 @@ module LastPass
             end
         end
 
-        # Parse PRIK chunk which contains private RSA key
-        def self.parse_PRIK chunk, encryption_key
-            decrypted = decode_aes256 "cbc",
-                                      encryption_key[0, 16],
-                                      decode_hex(chunk.payload),
-                                      encryption_key
-
-            /^LastPassPrivateKey<(?<hex_key>.*)>LastPassPrivateKey$/ =~ decrypted
-            asn1_encoded_all = OpenSSL::ASN1.decode decode_hex hex_key
-            asn1_encoded_key = OpenSSL::ASN1.decode asn1_encoded_all.value[2].value
-
-            rsa_key = OpenSSL::PKey::RSA.new
-            rsa_key.n = asn1_encoded_key.value[1].value
-            rsa_key.e = asn1_encoded_key.value[2].value
-            rsa_key.d = asn1_encoded_key.value[3].value
-            rsa_key.p = asn1_encoded_key.value[4].value
-            rsa_key.q = asn1_encoded_key.value[5].value
-            rsa_key.dmp1 = asn1_encoded_key.value[6].value
-            rsa_key.dmq1 = asn1_encoded_key.value[7].value
-            rsa_key.iqmp = asn1_encoded_key.value[8].value
-
-            rsa_key
-        end
-
         # TODO: Fake some data and make a test
         def self.parse_SHAR chunk, encryption_key, rsa_key
             StringIO.open chunk.payload do |io|
@@ -112,6 +88,45 @@ module LastPass
             end
         end
 
+        # Parse and decrypt the encrypted private RSA key
+        def self.parse_private_key encrypted_private_key, encryption_key
+            decrypted = decode_aes256 "cbc",
+                                      encryption_key[0, 16],
+                                      decode_hex(encrypted_private_key),
+                                      encryption_key
+
+            /^LastPassPrivateKey<(?<hex_key>.*)>LastPassPrivateKey$/ =~ decrypted
+            asn1_encoded_all = OpenSSL::ASN1.decode decode_hex hex_key
+            asn1_encoded_key = OpenSSL::ASN1.decode asn1_encoded_all.value[2].value
+
+            rsa_key = OpenSSL::PKey::RSA.new
+            n = asn1_encoded_key.value[1].value
+            e = asn1_encoded_key.value[2].value
+            d = asn1_encoded_key.value[3].value
+            p = asn1_encoded_key.value[4].value
+            q = asn1_encoded_key.value[5].value
+            dmp1 = asn1_encoded_key.value[6].value
+            dmq1 = asn1_encoded_key.value[7].value
+            iqmp = asn1_encoded_key.value[8].value
+
+            if rsa_key.respond_to? :set_key
+                rsa_key.set_key n, e, d
+                rsa_key.set_factors p, q
+                rsa_key.set_crt_params dmp1, dmq1, iqmp
+            else
+                rsa_key.n = n
+                rsa_key.e = e
+                rsa_key.d = d
+                rsa_key.p = p
+                rsa_key.q = q
+                rsa_key.dmp1 = dmp1
+                rsa_key.dmq1 = dmq1
+                rsa_key.iqmp = iqmp
+            end
+
+            rsa_key
+        end
+
         def self.parse_secure_note_server notes
             info = {}
 
@@ -275,7 +290,7 @@ module LastPass
         # Allowed ciphers are: :ecb, :cbc.
         # If for :ecb iv is not used and should be set to "".
         def self.decode_aes256 cipher, iv, data, encryption_key
-            aes = OpenSSL::Cipher::Cipher.new "aes-256-#{cipher}"
+            aes = OpenSSL::Cipher.new "aes-256-#{cipher}"
             aes.decrypt
             aes.key = encryption_key
             aes.iv = iv

data/lib/lastpass/session.rb

@@ -4,11 +4,13 @@
 module LastPass
     class Session
         attr_reader :id,
-                    :key_iteration_count
+                    :key_iteration_count,
+                    :encrypted_private_key
 
-        def initialize id, key_iteration_count
+        def initialize id, key_iteration_count, encrypted_private_key
             @id = id
             @key_iteration_count = key_iteration_count
+            @encrypted_private_key = encrypted_private_key
         end
     end
 end

data/lib/lastpass/vault.rb

@@ -11,12 +11,6 @@ module LastPass
             open blob, username, password
         end
 
-        # Creates a vault from a locally stored blob
-        def self.open_local blob_filename, username, password
-            # TODO: read the blob here
-            raise NotImplementedError
-        end
-
         # Creates a vault from a blob object
         def self.open blob, username, password
             new blob, blob.encryption_key(username, password)
@@ -38,18 +32,21 @@ module LastPass
                 raise InvalidResponseError, "Blob is truncated"
             end
 
-            @accounts = parse_accounts chunks, encryption_key
+            private_key = nil
+            if blob.encrypted_private_key
+                private_key = Parser.parse_private_key blob.encrypted_private_key, encryption_key
+            end
+
+            @accounts = parse_accounts chunks, encryption_key, private_key
         end
 
         def complete? chunks
             !chunks.empty? && chunks.last.id == "ENDM" && chunks.last.payload == "OK"
         end
 
-        def parse_accounts chunks, encryption_key
+        def parse_accounts chunks, encryption_key, private_key
             accounts = []
-
             key = encryption_key
-            rsa_private_key = nil
 
             chunks.each do |i|
                 case i.id
@@ -59,11 +56,11 @@ module LastPass
                     if account
                         accounts << account
                     end
-                when "PRIK"
-                    rsa_private_key = Parser.parse_PRIK i, encryption_key
                 when "SHAR"
+                    raise "private_key must be provided" if !private_key
+
                     # After SHAR chunk all the folliwing accounts are enrypted with a new key
-                    key = Parser.parse_SHAR(i, encryption_key, rsa_private_key)[:encryption_key]
+                    key = Parser.parse_SHAR(i, encryption_key, private_key)[:encryption_key]
                 end
             end
 

data/lib/lastpass/version.rb

@@ -2,5 +2,5 @@
 # Licensed under the terms of the MIT license. See LICENCE for details.
 
 module LastPass
-    VERSION = "1.5.0"
+    VERSION = "1.6.0"
 end

data/spec/blob_spec.rb

@@ -6,14 +6,16 @@ require "spec_helper"
 describe LastPass::Blob do
     let(:bytes) { "TFBBVgAAAAMxMjJQUkVNAAAACjE0MTQ5".decode64 }
     let(:key_iteration_count) { 500 }
+    let(:encrypted_private_key) { "DEADBEEF" }
     let(:username) { "postlass@gmail.com" }
     let(:password) { "pl1234567890" }
     let(:encryption_key) { "OfOUvVnQzB4v49sNh4+PdwIFb9Fr5+jVfWRTf+E2Ghg=".decode64 }
 
-    subject { LastPass::Blob.new bytes, key_iteration_count }
+    subject { LastPass::Blob.new bytes, key_iteration_count, encrypted_private_key }
 
     its(:bytes) { should eq bytes }
     its(:key_iteration_count) { should eq key_iteration_count }
+    its(:encrypted_private_key) { should eq encrypted_private_key }
 
     describe "#encryption_key" do
         it "returns encryption key" do

data/spec/fetcher_spec.rb

@@ -10,18 +10,18 @@ describe LastPass::Fetcher do
 
     let(:hash) { "7880a04588cfab954aa1a2da98fd9c0d2c6eba4c53e36a94510e6dbf30759256" }
     let(:session_id) { "53ru,Hb713QnEVM5zWZ16jMvxS0" }
-    let(:session) { LastPass::Session.new session_id, key_iteration_count }
+    let(:session) { LastPass::Session.new session_id, key_iteration_count, "DEADBEEF" }
 
     let(:blob_response) { "TFBBVgAAAAMxMjJQUkVNAAAACjE0MTQ5" }
     let(:blob_bytes) { blob_response.decode64 }
-    let(:blob) { LastPass::Blob.new blob_bytes, key_iteration_count }
+    let(:blob) { LastPass::Blob.new blob_bytes, key_iteration_count, "DEADBEEF" }
 
-    let(:login_post_data) { {method: "mobile",
-                             web: 1,
-                             xml: 1,
+    let(:login_post_data) { {method: "cli",
+                             xml: 2,
                              username: username,
                              hash: hash,
-                             iterations: key_iteration_count} }
+                             iterations: key_iteration_count,
+                             includeprivatekeyenc: 1} }
 
     let(:device_id) { "492378378052455" }
     let(:login_post_data_with_device_id) { login_post_data.merge({imei: device_id}) }
@@ -36,7 +36,7 @@ describe LastPass::Fetcher do
         it "makes a GET request" do
             web_client = double "web_client"
             expect(web_client).to receive(:get)
-                .with("https://lastpass.com/logout.php?mobile=1", cookies: {"PHPSESSID" => session_id})
+                .with("https://lastpass.com/logout.php?method=cli&noredirect=1", cookies: {"PHPSESSID" => session_id})
                 .and_return(http_ok "")
             LastPass::Fetcher.logout session, web_client
         end
@@ -98,7 +98,7 @@ describe LastPass::Fetcher do
             web_client = double("web_client")
             expect(web_client).to receive(:post)
                 .with("https://lastpass.com/login.php", format: :xml, body: post_data)
-                .and_return(http_ok("ok" => {"sessionid" => session_id}))
+                .and_return(http_ok("response" => {"ok" => {"sessionid" => session_id, "privatekeyenc" => "DEADBEEF"}}))
 
             LastPass::Fetcher.request_login username,
                                             password,
@@ -125,7 +125,7 @@ describe LastPass::Fetcher do
         end
 
         it "returns a session" do
-            expect(request_login_with_xml "<ok sessionid='#{session_id}' />").to eq session
+            expect(request_login_with_xml "<response><ok sessionid='#{session_id}' /></response>").to eq session
         end
 
         it "raises an exception on HTTP error" do
@@ -177,7 +177,7 @@ describe LastPass::Fetcher do
         it "raises an exception on missing/incorrect Yubikey password" do
             message = "Your account settings have restricted you from logging in " +
                       "from mobile devices that do not support YubiKey authentication."
-            expect { request_login_with_lastpass_error "yubikeyrestricted", message }
+            expect { request_login_with_lastpass_error "otprequired", message }
                 .to raise_error LastPass::LastPassIncorrectYubikeyPasswordError, message
         end
 
@@ -197,7 +197,7 @@ describe LastPass::Fetcher do
     describe ".fetch" do
         it "makes a GET request" do
             expect(web_client = double("web_client")).to receive(:get)
-                .with("https://lastpass.com/getaccts.php?mobile=1&b64=1&hash=0.0&hasplugin=3.0.23&requestsrc=android",
+                .with("https://lastpass.com/getaccts.php?mobile=1&b64=1&hash=0.0&hasplugin=3.0.23&requestsrc=cli",
                       format: :plain,
                       cookies: {"PHPSESSID" => session_id})
                 .and_return(http_ok(blob_response))

data/spec/parser_spec.rb

@@ -6,7 +6,7 @@ require_relative "test_data"
 
 describe LastPass::Parser do
     let(:key_iteration_count) { 5000 }
-    let(:blob) { LastPass::Blob.new TEST_BLOB, key_iteration_count }
+    let(:blob) { LastPass::Blob.new TEST_BLOB, key_iteration_count, "DEADBEEF" }
     let(:padding) { "BEEFFACE"}
     let(:encryption_key) { "OfOUvVnQzB4v49sNh4+PdwIFb9Fr5+jVfWRTf+E2Ghg=".decode64 }
     let(:encoded_rsa_key) { "98F3F5518AE7C03EBBF195A616361619033509FB1FFA0408E883B7C5E80381F8" +
@@ -114,9 +114,10 @@ describe LastPass::Parser do
         end
     end
 
-    describe ".parse_PRIK" do
-        let(:chunk) { LastPass::Chunk.new "PRIK", encoded_rsa_key }
-        let(:rsa_key) { LastPass::Parser.parse_PRIK chunk, rsa_key_encryption_key }
+    describe ".parse_private_key" do
+        let(:rsa_key) {
+            LastPass::Parser.parse_private_key encoded_rsa_key, rsa_key_encryption_key
+        }
 
         it "parses private key" do
             expect(rsa_key).to be_instance_of OpenSSL::PKey::RSA

data/spec/session_spec.rb

@@ -6,9 +6,11 @@ require "spec_helper"
 describe LastPass::Session do
     let(:id) { "53ru,Hb713QnEVM5zWZ16jMvxS0" }
     let(:key_iteration_count) { 5000 }
+    let(:encrypted_private_key) { "DEADBEEF" }
 
-    subject { LastPass::Session.new id, key_iteration_count }
+    subject { LastPass::Session.new id, key_iteration_count, encrypted_private_key }
 
     its(:id) { should eq id }
     its(:key_iteration_count) { should eq key_iteration_count }
+    its(:encrypted_private_key) { should eq encrypted_private_key }
 end

data/spec/vault_spec.rb

@@ -6,7 +6,7 @@ require "test_data"
 
 describe LastPass::Vault do
     let(:vault) {
-        LastPass::Vault.new LastPass::Blob.new(TEST_BLOB, TEST_KEY_ITERATION_COUNT),
+        LastPass::Vault.new LastPass::Blob.new(TEST_BLOB, TEST_KEY_ITERATION_COUNT, nil),
                             TEST_ENCRYPTION_KEY
     }
 
@@ -15,7 +15,7 @@ describe LastPass::Vault do
             [1, 2, 3, 4, 5, 10, 100, 1000].each do |i|
                 expect {
                     blob = TEST_BLOB[0..(-1 - i)]
-                    LastPass::Vault.new LastPass::Blob.new(blob, TEST_KEY_ITERATION_COUNT),
+                    LastPass::Vault.new LastPass::Blob.new(blob, TEST_KEY_ITERATION_COUNT, nil),
                                         TEST_ENCRYPTION_KEY
                 }.to raise_error LastPass::InvalidResponseError, "Blob is truncated"
             end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lastpass
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Dmitry Yakimenko
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-05 00:00:00.000000000 Z
+date: 2019-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty
@@ -138,8 +138,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Unofficial LastPass API