/
1pass.lua
716 lines (595 loc) · 21.6 KB
1
JSON = (loadfile "JSON.lua")()
2
3
dofile("dumptable.lua")
4
5
6
local basedir = "1Password/1Password.agilekeychain/data/default" -- !!! FIXME
local password = argv[2]
local items = nil
7
local faveitems = nil
8
local keyhookRunning = false
9
10
11
12
13
14
15
16
17
18
local keyhookGuiMenus = nil
local function runGarbageCollector()
--local memused = math.floor(collectgarbage("count") * 1024.0)
--print("Collecting garbage (currently using " .. memused .. " bytes).")
collectgarbage()
--local newmemused = math.floor(collectgarbage("count") * 1024.0)
--print("Now using " .. newmemused .. " bytes (" .. memused - newmemused .. " bytes savings).")
end
19
20
21
22
23
24
25
26
27
local passwordTypeNameMap = {
["webforms.WebForm"] = "Logins",
["wallet.financial.CreditCard"] = "Credit cards",
["passwords.Password"] = "Passwords",
["wallet.financial.BankAccountUS"] = "Bank accounts",
["wallet.membership.Membership"] = "Memberships",
["wallet.government.DriversLicense"] = "Drivers licenses",
["system.Tombstone"] = "Dead items",
28
["securenotes.SecureNote"] = "Secure notes",
29
30
["wallet.government.SsnUS"] = "Social Security Numbers",
["wallet.computer.Router"] = "Router passwords",
31
32
33
34
35
36
37
38
39
40
-- !!! FIXME: more!
}
local passwordTypeOrdering = {
"webforms.WebForm",
"wallet.financial.CreditCard",
"passwords.Password",
"wallet.financial.BankAccountUS",
"wallet.membership.Membership",
"wallet.government.DriversLicense",
41
"wallet.government.SsnUS",
42
"securenotes.SecureNote",
43
"wallet.computer.Router",
44
45
46
-- never show "system.Tombstone",
-- !!! FIXME: more!
}
47
48
49
50
51
52
local function load_json_str(str, desc)
local retval = JSON:decode(str)
return retval
end
53
54
55
56
57
58
local function load_json(fname)
local f = io.open(fname, "rb")
if (f == nil) then
return nil
end
59
local str = f:read("*a")
60
61
f:close()
62
return load_json_str(str, fname)
63
64
65
end
66
local keys = {}
67
local function loadKey(level, password)
68
69
70
71
if keys[level] ~= nil then
return keys[level]
end
72
local keysjson = load_json(basedir .. "/encryptionKeys.js")
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
if (keysjson == nil) or (keysjson[level] == nil) then
return nil
end
local identifier = keysjson[level]
for i,v in ipairs(keysjson.list) do
if v.identifier == identifier then
local iterations = v.iterations
if (iterations == nil) or (iterations < 1000) then
iterations = 1000
end
local decrypted = decryptUsingPBKDF2(v.data, password, iterations)
if decrypted == nil then
return nil
end
local validate = decryptBase64UsingKey(v.validation, decrypted)
if validate ~= decrypted then
return nil
end
95
keys[level] = decrypted
96
97
98
99
100
101
102
return decrypted
end
end
return nil
end
103
local function getHint()
104
105
106
107
108
local f = io.open(basedir .. "/.password.hint", "r")
if (f == nil) then
return
end
109
local str = "(hint is '" .. f:read("*a") .. "')."
110
f:close()
111
112
--print(str)
return str
113
114
end
115
116
local function loadContents()
117
118
119
return load_json(basedir .. "/contents.js")
end
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
local function makeMenu()
return {}
end
local function appendMenuItem(menu, text, callback)
local item = {}
item["text"] = text
if callback ~= nil then
item["callback"] = callback
end
menu[#menu+1] = item
return item
end
local function setMenuItemSubmenu(menuitem, submenu)
menuitem["submenu"] = submenu
end
138
139
140
local function setMenuItemChecked(menuitem, ischecked)
menuitem["checked"] = ischecked
end
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
local function build_secret_menuitem(menu, type, str, hidden)
if str == nil then
return nil
end
local valuestr = str
if hidden == true then
valuestr = "*****"
end
local text = type .. " " .. valuestr
local callback = function()
copyToClipboard(str)
--print("Copied data [" .. str .. "] to clipboard.")
157
guiDestroyMenu(keyhookGuiMenus[1])
158
end
159
return appendMenuItem(menu, text, callback)
160
161
end
162
163
164
165
166
167
168
local secret_menuitem_builders = {}
local function build_secret_menuitem_webform(menu, info, secure)
local addthis = false
local username = nil
local password = nil
169
170
local designated_password = nil
local designated_username = nil
171
local email = nil
172
173
174
175
176
177
if secure.fields == nil then
print("no secure fields, don't know how to handle this item")
return
end
178
179
180
for i,v in ipairs(secure.fields) do
--print(info.name .. ": " .. v.type .. ", " .. v.value)
local ignored = false
181
182
183
184
185
186
187
if (v.value == nil) or (v.value == "") then
ignored = true
elseif (v.designation ~= nil) and (v.designation == "password") then
designated_password = v.value
elseif (v.designation ~= nil) and (v.designation == "username") then
designated_username = v.value
elseif (v.type == "P") then
188
password = v.value
189
elseif (v.type == "T") then
190
username = v.value
191
elseif (v.type == "E") then
192
193
194
195
196
197
198
199
200
201
202
email = v.value
else
ignored = true
end
if not ignored then
addthis = true
end
end
if addthis then
203
204
205
206
207
208
209
210
211
-- designated fields always win out.
if (designated_username ~= nil) then
username = designated_username
end
if (designated_password ~= nil) then
password = designated_password
end
212
213
214
215
216
217
218
if (username ~= nil) and (email ~= nil) and (email == username) then
email = nil
end
build_secret_menuitem(menu, "username", username)
build_secret_menuitem(menu, "email", email)
build_secret_menuitem(menu, "password", password, true)
219
end
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
end
secret_menuitem_builders["webforms.WebForm"] = build_secret_menuitem_webform
local function build_secret_menuitem_password(menu, info, secure)
build_secret_menuitem(menu, "password", secure.password, true)
end
secret_menuitem_builders["passwords.Password"] = build_secret_menuitem_password
local function build_secret_menuitem_bankacctus(menu, info, secure)
-- !!! FIXME: there's more data than this in a generic dictionary.
build_secret_menuitem(menu, "Account type", secure.accountType)
build_secret_menuitem(menu, "Routing number", secure.routingNo)
build_secret_menuitem(menu, "Account number", secure.accountNo)
build_secret_menuitem(menu, "Bank name", secure.bankName)
build_secret_menuitem(menu, "Owner", secure.owner)
237
238
build_secret_menuitem(menu, "SWIFT code", secure.swift)
build_secret_menuitem(menu, "PIN", secure.telephonePin)
239
240
241
242
243
end
secret_menuitem_builders["wallet.financial.BankAccountUS"] = build_secret_menuitem_bankacctus
local function build_secret_menuitem_driverslic(menu, info, secure)
244
245
246
247
248
249
250
251
252
253
254
255
256
-- !!! FIXME: there's more data for this menuitem than this, in a generic dictionary.
local birthdate = nil
if secure.birthdate_yy ~= nil then
birthdate = secure.birthdate_yy
if secure.birthdate_mm ~= nil then
birthdate = birthdate .. "/" .. string.sub("00" .. secure.birthdate_mm, -2)
if secure.birthdate_dd ~= nil then
birthdate = birthdate .. "/" .. string.sub("00" .. secure.birthdate_dd, -2)
end
end
end
257
local expiredate = nil
258
259
260
261
262
263
264
265
266
267
if secure.expiry_date_yy ~= nil then
expiredate = secure.expiry_date_yy
if secure.expiry_date_mm ~= nil then
expiredate = expiredate .. "/" .. string.sub("00" .. secure.expiry_date_mm, -2)
if secure.expiry_date_dd ~= nil then
expiredate = expiredate .. "/" .. string.sub("00" .. secure.expiry_date_dd, -2)
end
end
end
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
build_secret_menuitem(menu, "License number", secure.number)
build_secret_menuitem(menu, "Class", secure.class)
build_secret_menuitem(menu, "Expires", expiredate)
build_secret_menuitem(menu, "State", secure.state)
build_secret_menuitem(menu, "Country", secure.country)
build_secret_menuitem(menu, "Conditions", secure.conditions)
build_secret_menuitem(menu, "Full name", secure.fullname)
build_secret_menuitem(menu, "Address", secure.address)
build_secret_menuitem(menu, "Gender", secure.sex)
build_secret_menuitem(menu, "Birthdate", birthdate)
build_secret_menuitem(menu, "Height", secure.height)
end
secret_menuitem_builders["wallet.government.DriversLicense"] = build_secret_menuitem_driverslic
local function build_secret_menuitem_membership(menu, info, secure)
-- !!! FIXME: there's more data than this in a generic dictionary.
build_secret_menuitem(menu, "Membership number", secure.membership_no)
end
secret_menuitem_builders["wallet.membership.Membership"] = build_secret_menuitem_membership
local function build_secret_menuitem_creditcard(menu, info, secure)
-- !!! FIXME: there's more data than this in a generic dictionary.
local expiredate = secure.expiry_yy .. "/" .. string.sub("00" .. secure.expiry_mm, -2)
build_secret_menuitem(menu, "Type", secure.type)
build_secret_menuitem(menu, "CC number", secure.ccnum, true)
build_secret_menuitem(menu, "CVV", secure.cvv, true)
296
build_secret_menuitem(menu, "Expires", expiredate)
297
298
299
300
301
build_secret_menuitem(menu, "Card holder", secure.cardholder)
build_secret_menuitem(menu, "Bank", secure.bank)
end
secret_menuitem_builders["wallet.financial.CreditCard"] = build_secret_menuitem_creditcard
302
303
304
305
306
local function build_secret_menuitem_securenote(menu, info, secure)
build_secret_menuitem(menu, "Notes", secure.notesPlain, true)
end
secret_menuitem_builders["securenotes.SecureNote"] = build_secret_menuitem_securenote
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
local function build_secret_menuitem_ssnus(menu, info, secure)
build_secret_menuitem(menu, "Name", secure.name, false)
build_secret_menuitem(menu, "SSN", secure.number, true)
end
secret_menuitem_builders["wallet.government.SsnUS"] = build_secret_menuitem_ssnus
local function build_secret_menuitem_router(menu, info, secure)
build_secret_menuitem(menu, "Name", secure.name, false)
build_secret_menuitem(menu, "Password", secure.password, true)
end
secret_menuitem_builders["wallet.computer.Router"] = build_secret_menuitem_router
323
local function build_secret_menuitems(info, menu)
324
local metadata = load_json(basedir .. "/" .. info.uuid .. ".1password")
325
if (metadata == nil) or (next(metadata) == nil) then -- the "next" trick tests if table is empty.
326
327
328
return
end
329
330
local securityLevel = metadata.securityLevel
if securityLevel == nil then
331
securityLevel = metadata.openContents.securityLevel
332
end
333
--print("title: " .. metadata.title)
334
335
336
337
338
339
if securityLevel == nil then
--print("can't find security level, assuming SL5" .. metadata.title)
securityLevel = "SL5"
end
local plaintext = decryptBase64UsingKey(metadata.encrypted, loadKey(securityLevel, password))
340
341
342
343
344
345
346
347
348
349
if plaintext == nil then
return
end
local secure = load_json_str(plaintext, info.uuid)
if secure == nil then
return
end
--dumptable("secure " .. info.name, secure)
350
local menuitem = appendMenuItem(menu, info.name)
351
352
353
354
355
356
357
if secret_menuitem_builders[info.type] == nil then
print("WARNING: don't know how to handle items of type " .. info.type)
dumptable("secure " .. info.type .. " (" .. info.name .. ")", secure)
return
end
358
359
360
361
362
if metadata.faveIndex ~= nil then
--dumptable("fave metadata " .. info.name, metadata)
faveitems[metadata.faveIndex] = { info=info, secure=secure }
end
363
local submenu = makeMenu()
364
secret_menuitem_builders[info.type](submenu, info, secure)
365
setMenuItemSubmenu(menuitem, submenu)
366
367
end
368
369
370
local function prepItems()
items = {}
local contents = loadContents()
371
372
373
if contents == nil then
return false
end
374
375
376
377
for i,v in ipairs(contents) do
local t = v[2]
if items[t] == nil then
items[t] = {}
378
end
379
380
local bucket = items[t]
bucket[#bucket+1] = { uuid=v[1], type=t, name=v[3], url=v[4] } -- !!! FIXME: there are more fields, don't know what they mean yet.
381
end
382
return true
383
end
384
385
386
local passwordUnlockTime = nil
387
388
389
390
391
392
local function lockKeychain()
-- lose the existing password and key, prompt user again.
password = argv[2] -- might be nil, don't reset if on command line.
keys["SL5"] = nil
passwordUnlockTime = nil
setPowermateLED(false)
393
394
395
396
397
-- kill the popup if it exists.
if (keyhookGuiMenus ~= nil) and (keyhookGuiMenus[1] ~= nil) then
guiDestroyMenu(keyhookGuiMenus[1])
end
398
end
399
400
function pumpLua() -- not local! Called from C!
401
402
403
-- !!! FIXME: this should lose the key in RAM and turn off the Powermate
-- !!! FIXME: LED when the time expires instead of if the time has
-- !!! FIXME: expired when the user is trying to get at the keychain.
404
405
406
407
if passwordUnlockTime ~= nil then
local now = os.time()
local maxTime = (15 * 60) -- !!! FIXME: don't hardcode.
if os.difftime(now, passwordUnlockTime) > maxTime then
408
lockKeychain()
409
410
end
end
411
412
end
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
function escapePressed() -- not local! Called from C!
if keyhookGuiMenus[1] then
guiDestroyMenu(keyhookGuiMenus[1])
end
end
local buildGuiMenuList
local function spawnSubMenu(button, submenu, depth)
local guimenu = guiCreateSubMenu(button)
for i = #keyhookGuiMenus, depth, -1 do
if keyhookGuiMenus[i] then
--print("Destroying conflicting submenu at depth " .. i)
guiDestroyMenu(keyhookGuiMenus[i])
keyhookGuiMenus[i] = nil
end
end
--print("New submenu at depth " .. depth)
keyhookGuiMenus[depth] = guimenu
buildGuiMenuList(guimenu, submenu)
guiShowWindow(guimenu)
end
local function buildGuiMenuItem(guimenu, item)
local cb = item["callback"]
if cb == nil then
local submenu = item["submenu"]
local depth = #keyhookGuiMenus+1
cb = function (button)
return spawnSubMenu(button, submenu, depth)
end
end
449
guiAddMenuItem(guimenu, item["text"], item["checked"], cb)
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
end
buildGuiMenuList = function(guimenu, list)
for i,v in ipairs(list) do
buildGuiMenuItem(guimenu, v)
end
end
local function buildSearchResultsMenuCategory(guimenu, menu, str)
local submenu = menu["submenu"]
if not submenu then return end
local name = menu["text"]
-- !!! FIXME: hacky. We should really list favorites first anyhow.
if name == "Favorites" then return end
for i,v in ipairs(submenu) do
if string.find(string.lower(v["text"]), str, 1, true) ~= nil then
buildGuiMenuItem(guimenu, v)
end
end
end
local function buildSearchResultsMenuList(guimenu, topmenu, str)
for i,v in ipairs(topmenu) do
buildSearchResultsMenuCategory(guimenu, v, str)
end
end
local function searchEntryChanged(guimenu, str, topmenu)
--print("search changed to '" .. str .. "' ...")
guiRemoveAllMenuItems(guimenu)
if str == "" then
buildGuiMenuList(guimenu, topmenu)
else
buildSearchResultsMenuList(guimenu, topmenu, string.lower(str))
end
guiShowWindow(guimenu)
end
local function handleMenuDestroyed()
--print("Destroying main menu...")
for i,v in ipairs(keyhookGuiMenus) do
if i > 1 then
guiDestroyMenu(v)
end
end
keyhookGuiMenus = nil
keyhookRunning = false
runGarbageCollector()
end
local function launchGuiMenu(topmenu)
local guimenu = guiCreateTopLevelMenu("1pass",
function(guimenu, str) -- search text changed callback
return searchEntryChanged(guimenu, str, topmenu)
end,
function() -- window destroyed callback
handleMenuDestroyed()
end
)
keyhookGuiMenus = {}
keyhookGuiMenus[#keyhookGuiMenus+1] = guimenu
buildGuiMenuList(guimenu, topmenu)
guiShowWindow(guimenu)
end
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
local trustedDisks = {}
local function getTrustedDiskChecksumPath(mntpoint)
return mntpoint .. "/1pass.dat"
end
local function getTrustedDiskChecksum(mntpoint)
local f = io.open(getTrustedDiskChecksumPath(mntpoint), "rb")
if f == nil then
return nil
end
local str = f:read("*a")
f:close()
return calcSha256(str)
end
local function choseTrustedDisk(mntpoint)
if trustedDisks[mntpoint] ~= nil then
trustedDisks[mntpoint] = nil -- no longer check existing trusted disk.
else
-- !!! FIXME: probably needs a message box if this fails.
local checksum = getTrustedDiskChecksum(mntpoint)
-- No checksum file yet? Generate and write out a random string.
if checksum == nil then
local f = io.open("/dev/urandom", "rb")
if f ~= nil then
local str = f:read(4096)
f:close()
if (str ~= nil) and (#str == 4096) then
f = io.open(getTrustedDiskChecksumPath(mntpoint), "wb")
if f ~= nil then
if f:write(str) and f:flush() then
checksum = calcSha256(str)
end
f:close()
end
end
end
end
trustedDisks[mntpoint] = checksum
end
-- kill the popup if it exists.
-- !!! FIXME: put this in its own function, this is a copy/paste from elsewhere.
if (keyhookGuiMenus ~= nil) and (keyhookGuiMenus[1] ~= nil) then
guiDestroyMenu(keyhookGuiMenus[1])
end
end
local function buildTrustedDeviceMenu()
local menu = makeMenu()
local disks = getMountedDisks() -- this is a C function.
table.sort(disks, function(a, b) return a < b end)
for i,v in ipairs(disks) do
local item = appendMenuItem(menu, v, function() choseTrustedDisk(v) end)
if trustedDisks[v] ~= nil then
setMenuItemChecked(item, true)
end
end
return menu
end
585
function keyhookPressed() -- not local! Called from C!
586
587
588
589
--print("keyhookPressed: running==" .. tostring(keyhookRunning))
if keyhookRunning then
return
end
590
591
keyhookRunning = true
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
local allowaccess = true;
for mntpoint,checksum in pairs(trustedDisks) do
if getTrustedDiskChecksum(mntpoint) ~= checksum then
allowaccess = false
break
end
end
if not allowaccess then
-- !!! FIXME: probably needs a message box if this happens.
keyhookRunning = false
return
end
607
608
609
610
611
612
613
614
615
616
617
618
619
while password == nil do
password = runGuiPasswordPrompt(getHint())
if password == nil then
keyhookRunning = false
return
end
if loadKey("SL5", password) == nil then
password = nil -- wrong password
local start = os.time() -- cook the CPU for three seconds.
local now = start
while os.difftime(now, start) < 3 do
now = os.time()
end
620
621
else
passwordUnlockTime = os.time()
622
setPowermateLED(true)
623
end
624
end
625
626
627
628
629
if not prepItems() then
keyhookRunning = false
return
end
630
631
632
local topmenu = makeMenu()
local favesmenu = makeMenu()
633
local securitymenu = makeMenu()
634
635
faveitems = {}
636
setMenuItemSubmenu(appendMenuItem(topmenu, "Favorites"), favesmenu)
637
setMenuItemSubmenu(appendMenuItem(topmenu, "Security"), securitymenu)
638
639
640
appendMenuItem(securitymenu, "Lock keychain now", function() lockKeychain() end)
setMenuItemSubmenu(appendMenuItem(securitymenu, "Require trusted device"), buildTrustedDeviceMenu())
641
642
643
for orderi,type in ipairs(passwordTypeOrdering) do
local bucket = items[type]
644
645
646
647
648
if bucket ~= nil then
local realname = passwordTypeNameMap[type]
if realname == nil then
realname = type
end
649
650
local menuitem = appendMenuItem(topmenu, realname)
local submenu = makeMenu()
651
652
653
654
table.sort(bucket, function(a, b) return a.name < b.name end)
for i,v in pairs(bucket) do
build_secret_menuitems(v, submenu)
end
655
setMenuItemSubmenu(menuitem, submenu)
656
else
657
--print("no bucket found for item type '" .. type .. "'")
658
end
659
end
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
-- This favepairs stuff is obnoxious.
local function favepairs(t)
local a = {}
for n in pairs(t) do table.insert(a, n) end
table.sort(a)
local i = 0
local iter = function()
i = i + 1
if a[i] == nil then
return nil
else
return a[i], t[a[i]]
end
end
return iter
end
for i,v in favepairs(faveitems) do
--dumptable("fave " .. i, v)
680
681
local menuitem = appendMenuItem(favesmenu, v.info.name)
local submenu = makeMenu()
682
secret_menuitem_builders[v.info.type](submenu, v.info, v.secure)
683
setMenuItemSubmenu(menuitem, submenu)
684
685
686
687
end
favepairs = nil
faveitems = nil
688
689
launchGuiMenu(topmenu)
690
691
end
692
693
694
695
696
697
698
699
-- Mainline!
--for i,v in ipairs(argv) do
-- print("argv[" .. i .. "] = " .. v)
--end
-- !!! FIXME: message box, exit if basedir is wack.
700
701
702
703
704
705
706
707
708
709
local f = io.open(basedir .. "/contents.js", "rb")
if f == nil then
print("ERROR: Couldn't read your 1Password keychain in '" .. basedir .. "'.")
print("ERROR: Please make sure it exists and you have permission to access it.")
print("ERROR: (maybe you need to run 'ln -s ~/Dropbox/1Password' here?")
print("ERROR: Giving up for now.")
os.exit(1)
end
f:close()
710
-- !!! FIXME: this can probably happen in C now (the Lua mainline is basically gone now).
711
setPowermateLED(false) -- off by default
712
print("Now waiting for the magic key combo (probably Alt-Meta-\\) ...")
713
714
giveControlToGui()
715
-- end of 1pass.lua ...