Check-in [8732d95e73]
Overview
Comment:Updated to use a plain-text format for password storage
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: 8732d95e73d67b2ce7d388c5c885731bfc78220d
User & Date: rkeene on 2016-03-15 19:34:31
Other Links: manifest | tags
Context
2016-03-15
19:41
Updated README to be more accurate and deal with the new storage mechanism check-in: bf46eec3a7 user: rkeene tags: trunk
19:34
Updated to use a plain-text format for password storage check-in: 8732d95e73 user: rkeene tags: trunk
18:35
Updated to make verification failure more fatal check-in: 21bc3c9fe8 user: rkeene tags: trunk
Changes

Modified hunter2 from [05208b6e4e] to [a60ac58fb4].

90
91
92
93
94
95
96


97
98
99
100
101
102
103
	_printHelp stderr ""

	exit 1
}

set argv [lrange $argv 2 end]



package require sqlite3
package require platform

lappend ::auto_path [file join [file dirname [info script]] lib [platform::identify]]
lappend ::auto_path [file join [file dirname [info script]] lib [platform::generic]]
lappend ::auto_path [file join [file dirname [info script]] lib]








>
>







90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
	_printHelp stderr ""

	exit 1
}

set argv [lrange $argv 2 end]

# We need Tcl 8.6 for [binary encode base64]
package require Tcl 8.6
package require sqlite3
package require platform

lappend ::auto_path [file join [file dirname [info script]] lib [platform::identify]]
lappend ::auto_path [file join [file dirname [info script]] lib [platform::generic]]
lappend ::auto_path [file join [file dirname [info script]] lib]

165
166
167
168
169
170
171














































































































































172
173
174
175
176
177
178
                        ]

        return [list data $ret begin "-----BEGIN PUBLIC KEY-----" end "-----END PUBLIC KEY-----"]
}
# End backports

# Start internal functions














































































































































proc _listCertificates {} {
	if {![info exists ::env(PKCS11MODULE)]} {
		return [list]
	}

	set ::env(CACKEY_NO_EXTRA_CERTS) 1








>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>







167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
                        ]

        return [list data $ret begin "-----BEGIN PUBLIC KEY-----" end "-----END PUBLIC KEY-----"]
}
# End backports

# Start internal functions
proc _loadDB {dbCmd fileName} {
	set ::saveRequired 1

	if {[file exists $fileName]} {
		set fd [open $fileName]

		# Verify that we have a valid file
		gets $fd header

		# Ignore the first line if it is a hash-bang as well
		if {[string range $header 0 1] == "#!"} {
			set ::globalHeader($dbCmd) $header

			gets $fd header
		}

		if {$header ne "# <AzureDiamond> oh, ok."} {
			# This may be an old SQLite3 DB, convert it
			close $fd

			sqlite3 $dbCmd $fileName

			_saveDB $dbCmd $fileName

			$dbCmd close

			return [_loadDB $dbCmd $fileName]
		}

		set data [read $fd]

		close $fd
	} else {
		set data ""
	}

	sqlite3 $dbCmd ":memory:"

	$dbCmd eval {
		CREATE TABLE IF NOT EXISTS users(name, publicKey BLOB);
		CREATE TABLE IF NOT EXISTS passwords(name, encryptedPass BLOB, encryptedKey BLOB, publicKey BLOB, verification BLOB);
	}

	$dbCmd transaction {
		foreach line [split $data "\n"] {
			if {[string trim $line] eq ""} {
				continue
			}

			set table [lindex $line 0]
			set line [lrange $line 1 end]

			set keys [list]
			set values [list]
			unset -nocomplain valueArray

			foreach {key value} $line {
				if {[string index $key 0] == ":"} {
					set key [string range $key 1 end]
					set valueBase64Encoded 1
				} else {
					set valueBase64Encoded 0
				}

				if {$valueBase64Encoded} {
					set value [binary decode base64 $value]
				}

				if {![regexp {^[a-zA-Z]+$} $key]} {
					return -code error "Invalid key name: $key"
				}

				switch -- $key {
					"name" {
						set type ""
						set typeInsertChar {$}

						# Convert this to a string-ified value
						set value [string range "x$value" 1 end]
					}
					default {
						set type "BLOB"
						set typeInsertChar "@"
					}
				}

				lappend keys $key

				set valueArray($key) $value

				lappend values ${typeInsertChar}valueArray($key)
			}

			$dbCmd eval "INSERT INTO $table ([join $keys {, }]) VALUES ([join $values {, }]);"
		}
	}
}

proc _saveDB {dbCmd fileName} {
	set tmpFileName "${fileName}.[expr rand()]"

	file delete -force -- $tmpFileName

	set fd [open $tmpFileName w]

	if {[info exists ::globalHeader($dbCmd)]} {
		puts $fd $::globalHeader($dbCmd)

		unset ::globalHeader($dbCmd)
	}

	puts $fd "# <AzureDiamond> oh, ok."

	foreach table [list users passwords] {
		unset -nocomplain row
		$dbCmd eval "SELECT * FROM $table ORDER BY name;" row {
			set outputLine [list $table]

			unset -nocomplain row(*)

			foreach {key value} [array get row] {
				if {![regexp {^[a-zA-Z]+$} $value]} {
					set key ":$key"
					set value [binary encode base64 $value]
				}

				lappend outputLine $key $value
			}

			puts $fd $outputLine
		}
	}

	close $fd

	catch {
		file attributes $tmpFileName {*}[file attributes $fileName]
	}

	file rename -force -- $tmpFileName $fileName
}

proc _listCertificates {} {
	if {![info exists ::env(PKCS11MODULE)]} {
		return [list]
	}

	set ::env(CACKEY_NO_EXTRA_CERTS) 1

415
416
417
418
419
420
421


422
423
424
425
426
427
428
	foreach {subject pubkeys} [array get publicKeys] {
		puts "$subject"

		foreach pubkey $pubkeys {
			puts "  |-> $pubkey"
		}
	}


}

proc listAvailablePasswords {} {
	set passwordNames [list]
	foreach slotInfoDict [_listCertificates] {
		unset -nocomplain slotInfo
		array set slotInfo $slotInfoDict







>
>







559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
	foreach {subject pubkeys} [array get publicKeys] {
		puts "$subject"

		foreach pubkey $pubkeys {
			puts "  |-> $pubkey"
		}
	}

	set ::saveRequired 0
}

proc listAvailablePasswords {} {
	set passwordNames [list]
	foreach slotInfoDict [_listCertificates] {
		unset -nocomplain slotInfo
		array set slotInfo $slotInfoDict
439
440
441
442
443
444
445


446
447
448
449
450
451


452
453
454
455
456
457


458
459
460
461
462
463
464
		}
	}


	foreach passwordName $passwordNames {
		puts "$passwordName - [join [_getUsersForPassword [list $passwordName]] {, }]"
	}


}

proc listPasswords {} {
	db eval {SELECT DISTINCT name FROM passwords;} row {
		puts "$row(name) - [join [_getUsersForPassword [list $row(name)]] {, }]"
	}


}

proc listUsers {} {
	db eval {SELECT DISTINCT name FROM users;} row {
		puts "$row(name) - [join [_getPasswordsForUser [list $row(name)]] {, }]"
	}


}

proc addUser {userName key} {
	set keyRaw [binary decode base64 $key]
	set keyVerify [::pki::pkcs::parse_public_key $keyRaw]

	db eval {INSERT INTO users (name, publicKey) VALUES ($userName, @key);}







>
>






>
>






>
>







585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
		}
	}


	foreach passwordName $passwordNames {
		puts "$passwordName - [join [_getUsersForPassword [list $passwordName]] {, }]"
	}

	set ::saveRequired 0
}

proc listPasswords {} {
	db eval {SELECT DISTINCT name FROM passwords;} row {
		puts "$row(name) - [join [_getUsersForPassword [list $row(name)]] {, }]"
	}

	set ::saveRequired 0
}

proc listUsers {} {
	db eval {SELECT DISTINCT name FROM users;} row {
		puts "$row(name) - [join [_getPasswordsForUser [list $row(name)]] {, }]"
	}

	set ::saveRequired 0
}

proc addUser {userName key} {
	set keyRaw [binary decode base64 $key]
	set keyVerify [::pki::pkcs::parse_public_key $keyRaw]

	db eval {INSERT INTO users (name, publicKey) VALUES ($userName, @key);}
493
494
495
496
497
498
499


500
501
502
503
504
505
506
	}

	_addPassword $passwordName $password $publicKeys
}

proc getPassword {passwordName} {
	puts [_getPassword $passwordName]


}

proc updatePassword {passwordName password} {
	if {$password eq ""} {
		set password [_prompt "Please enter the new password: "]
	}








>
>







645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
	}

	_addPassword $passwordName $password $publicKeys
}

proc getPassword {passwordName} {
	puts [_getPassword $passwordName]

	set ::saveRequired 0
}

proc updatePassword {passwordName password} {
	if {$password eq ""} {
		set password [_prompt "Please enter the new password: "]
	}

566
567
568
569
570
571
572


573
574
575
576


577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602



603

604

		unset -nocomplain row
		db eval {SELECT name FROM users WHERE publicKey = $pubkey;} row {
			set users($row(name)) 1
		}
	}

	puts [join [array names users] {, }]


}

proc help {{action ""}} {
	_printHelp stdout $action


}
# End user CLI functions

### MAIN

sqlite3 db $passwordFile

db eval {
	CREATE TABLE IF NOT EXISTS users(name, publicKey BLOB);
	CREATE TABLE IF NOT EXISTS passwords(name, encryptedPass BLOB, encryptedKey BLOB, publicKey BLOB, verification BLOB);
}

if {$action in $validCommands} {
	if {[catch {
		$action {*}$argv
	} error]} {
		puts stderr "Error: $error"

		exit 1
	}
} else {
	puts stderr "Invalid action"

	exit 1
}




exit 0










>
>




>
>





|
<
<
<
<
<















>
>
>
|
>

>
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740





741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
		unset -nocomplain row
		db eval {SELECT name FROM users WHERE publicKey = $pubkey;} row {
			set users($row(name)) 1
		}
	}

	puts [join [array names users] {, }]

	set ::saveRequired 0
}

proc help {{action ""}} {
	_printHelp stdout $action

	set ::saveRequired 0
}
# End user CLI functions

### MAIN

_loadDB db $passwordFile






if {$action in $validCommands} {
	if {[catch {
		$action {*}$argv
	} error]} {
		puts stderr "Error: $error"

		exit 1
	}
} else {
	puts stderr "Invalid action"

	exit 1
}

if {$::saveRequired} {
	_saveDB db $passwordFile
}

db close

exit 0