onepass 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 780ae33029de7cf60dfa6a1b16feb41dbff4c4e7
-  data.tar.gz: 087efe99c57afbc5e782b01b7dfd1774c30b731f
+  metadata.gz: f081e63d2a0fc4f35b2ca7698facbc79a27dbe68
+  data.tar.gz: 26e4b49e1e270d90ae4c00262d4b0d0bd68cf3fa
 SHA512:
-  metadata.gz: 01fa89e1b5ee6a87c8ebd1cab37f88c4f98fc0fb638ad52f7b0d8e96d3799778c67c90a7dcf47ad4b41cecbbac53c481166b6ab06af865668932ce66f84df954
-  data.tar.gz: 4ae603513c043f6545973729efcc40d3e1863e2566d725b05d1aa9ab5356f8538e5fdd6c8c6a38a768eb5d1b7c5f5b9fb27553e20fabfa6d435f7ab57b4884cd
+  metadata.gz: fa0258a8c9ab35aeba1062fbe697f7f46172d2d355158080d80597c7246d21225d32a32bf42a7315bfb29df1ccf8fe52a4dc03e17c7d488c04119d43602b12a1
+  data.tar.gz: 1f16989a6776547b046f6c80eb3075186c0c9c76297061c23b14debb9215cb8211298563f741db47fc6cbff7316690cbd7c5b0e4f326ff308b7bfb3f2f13ff99

data/OnePass.gemspec

@@ -19,6 +19,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "sqlite3", "~> 1.3.9"
+  spec.add_dependency "CFPropertyList"
 
   spec.add_development_dependency "bundler", "~> 1.7"
   spec.add_development_dependency "rake", "~> 10.0"

data/lib/OnePass/version.rb

@@ -1,3 +1,3 @@
 module OnePass
-  VERSION = "0.0.2"
+  VERSION = "0.0.3"
 end

data/lib/OnePass.rb

@@ -3,6 +3,7 @@ require "openssl"
 require "sqlite3"
 require "json"
 require "tempfile"
+require "cfpropertylist"
 
 module OnePass
   class VerifyException < Exception
@@ -18,7 +19,7 @@ module OnePass
       if buf[0..7] != "opdata01"
         raise OnePass::Opdata::InvalidException.new("Header was incorrect")
       end
-      @length = buf[8..15].unpack("V")[0]
+      @length = buf[8..15].unpack("Q<")[0]
       @mac = buf[-32..-1]
       if OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, mac, buf[0..-33]) != @mac
         raise OnePass::VerifyException.new("MAC doesn't match; verify failed. Check your encryption/mac keys.")
@@ -60,33 +61,48 @@ module OnePass
         db = SQLite3::Database.new(sqlite_file)
         db.execute "VACUUM;"
 
-        # read profile data
+        @master_keys = []
+        @overview_keys = []
         @overviews = []
-        @masters = []
-        db.execute "SELECT id,master_key_data,overview_key_data,salt,iterations FROM profiles" do |profile|
-
-          # derive the key from the password
-          derived_key = OpenSSL::PKCS5.pbkdf2_hmac(master_password, profile[3], profile[4], 64, OpenSSL::Digest::SHA512.new)
-          derived_encryption_key = derived_key[0..31]
-          derived_mac_key = derived_key[32..-1]
-
-          # try to unlock profile data. return fail if failed login
-          overview_key_data = OnePass::Opdata.new(profile[2], derived_encryption_key, derived_mac_key)
-          overview_key = OpenSSL::Digest::SHA512.new.digest(overview_key_data.data)
-          overview_encryption_key, overview_mac_key = overview_key[0..31], overview_key[32..-1]
-
-          # load overview opdata into object based format. overviews are stored decrypted for use later.
-          # the encrypted data for the keys is included, but is not decrypted unless requested later
-          db.execute "SELECT items.key_data, items.overview_data, item_details.data FROM items INNER JOIN item_details ON items.id=item_details.item_id WHERE items.profile_id=#{profile[0]};" do |row|
-            overview = OnePass::Opdata.new(row[1], overview_encryption_key, overview_mac_key)
-            json = JSON.parse(overview.data).merge({profile: profile[0], key_data: row[0], data: row[2]})
-            @overviews << json
-          end
-
-          # decrypt the master key for use later
-          master_key_data = OnePass::Opdata.new(profile[1], derived_encryption_key, derived_mac_key)
-          master_key = OpenSSL::Digest::SHA512.new.digest(master_key_data.data)
-          @masters[profile[0]] = {enc_key: master_key[0..31], mac_key: master_key[32..-1]}
+        # read master profile
+        master_profile = db.execute "SELECT id,master_key_data,overview_key_data,salt,iterations FROM profiles WHERE attributes_data IS NULL"
+        raise "Found more than one master profile!" unless master_profile.length == 1
+        master_profile.flatten!
+        master_profile_id = master_profile[0]
+
+        # derive the key from the password
+        derived_key = OpenSSL::PKCS5.pbkdf2_hmac(master_password, master_profile[3], master_profile[4], 64, OpenSSL::Digest::SHA512.new)
+        derived_encryption_key = derived_key[0..31]
+        derived_mac_key = derived_key[32..-1]
+
+        # Obtain the master profile master keys
+        master_key_data = OnePass::Opdata.new(master_profile[1], derived_encryption_key, derived_mac_key)
+        master_key = OpenSSL::Digest::SHA512.new.digest(master_key_data.data)
+        @master_keys[master_profile_id] = {enc_key: master_key[0..31], mac_key: master_key[32..-1]}
+
+        # Obtain the master profile overview keys
+        overview_key_data = OnePass::Opdata.new(master_profile[2], derived_encryption_key, derived_mac_key)
+        overview_key = OpenSSL::Digest::SHA512.new.digest(overview_key_data.data)
+        @overview_keys[master_profile_id] = { enc_key: overview_key[0..31], mac_key: overview_key[32..-1] }
+
+        # Obtain keys for remaining profiles
+        db.execute "SELECT id,attributes_data FROM profiles WHERE attributes_data IS NOT NULL" do |profile|
+          attributes_data = OnePass::Opdata.new(profile[1], @overview_keys[master_profile_id][:enc_key], @overview_keys[master_profile_id][:mac_key])
+          plist = CFPropertyList.native_types(CFPropertyList::List.new(:data => attributes_data.data).value)
+          overview_key_data = plist['$objects'][plist['$top']['overviewKey']]
+          overview_key = OpenSSL::Digest::SHA512.new.digest(overview_key_data)
+          @overview_keys[profile[0]] = { enc_key: overview_key[0..31], mac_key: overview_key[32..-1] }
+          master_key_data = plist['$objects'][plist['$top']['masterKey']]
+          master_key = OpenSSL::Digest::SHA512.new.digest(master_key_data)
+          @master_keys[profile[0]] = { enc_key: master_key[0..31], mac_key: master_key[32..-1] }
+        end
+
+        # load overview opdata into object based format. overviews are stored decrypted for use later.
+        # the encrypted data for the keys is included, but is not decrypted unless requested later
+        db.execute "SELECT items.profile_id, items.key_data, items.overview_data, item_details.data FROM items INNER JOIN item_details ON items.id=item_details.item_id" do |item|
+          overview = OnePass::Opdata.new(item[2], @overview_keys[item[0]][:enc_key], @overview_keys[item[0]][:mac_key])
+          json = JSON.parse(overview.data).merge({profile: item[0], key_data: item[1], data: item[3]})
+          @overviews << json
         end
 
         db.close
@@ -104,20 +120,26 @@ module OnePass
       return nil
     end
 
-    def decrypt(overview)
+    def decrypt(overview, all = nil)
       key_data = overview[:key_data][0..-33]
       mac = overview[:key_data][-32..-1]
       profile = overview[:profile]
-      if OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, @masters[profile][:mac_key], key_data) != mac
+      if OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, @master_keys[profile][:mac_key], key_data) != mac
         raise VerifyException.new("The item's encryption key couldn't be verified.")
       end
       cipher = OpenSSL::Cipher::AES.new(256, :CBC)
       cipher.decrypt
       cipher.padding = 0
       cipher.iv = key_data[0..15]
-      cipher.key = @masters[profile][:enc_key]
+      cipher.key = @master_keys[profile][:enc_key]
       key_data = cipher.update(key_data[16..-1]) + cipher.final
-      return JSON.parse(OnePass::Opdata.new(overview[:data],key_data[0..31],key_data[32..-1]).data)["password"]
+      results = JSON.parse(OnePass::Opdata.new(overview[:data],key_data[0..31],key_data[32..-1]).data)
+      password = if results.has_key?("password")
+        results["password"]
+      elsif results.has_key?("fields")
+        results["fields"].find { |h| h["designation"] == "password" }["value"]
+      end
+      return all ? results : password
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: onepass
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Kai Lieth
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-11-10 00:00:00.000000000 Z
+date: 2015-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.9
+- !ruby/object:Gem::Dependency
+  name: CFPropertyList
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -104,7 +118,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.2
+rubygems_version: 2.4.6
 signing_key: 
 specification_version: 4
 summary: Decrypt the secrets stored in 1Password 4