From 0a708b4e41e80263f8c8e4a5a399c69cec1608c6 Mon Sep 17 00:00:00 2001
From: Simeon Simeonov
Date: Sun, 18 Mar 2018 17:07:51 +0100
Subject: Use the mpes1: - tag for passwords encrypted with master password

---
 libsylph/imap.c           | 19 +++++++++++++++----
 libsylph/masterpassword.c | 15 +++++++++++++--
 libsylph/prefs_account.c  | 29 ++++++++++++++++++++++++++++-
 3 files changed, 56 insertions(+), 7 deletions(-)

(limited to 'libsylph')

diff --git a/libsylph/imap.c b/libsylph/imap.c
index e773ad4..e1c7cfd 100644
--- a/libsylph/imap.c
+++ b/libsylph/imap.c
@@ -707,8 +707,12 @@ static gint imap_session_connect(IMAPSession *session)
 
 	log_message(_("creating IMAP4 connection to %s:%d ...\n"),
 				SESSION(session)->server, SESSION(session)->port);
-    /* TODO:  check of the format is correct | possible memory leak */
-	pass = decrypt_with_master_password(account->passwd);
+	if (master_password_active()) {
+		pass = decrypt_with_master_password(account->passwd);
+		/* a new string is allocated. To be removed ... */
+	} else {
+		pass = account->passwd;
+	}
 	if (!pass)
 		pass = account->tmp_pass;
 	if (!pass) {
@@ -771,8 +775,11 @@ static gint imap_session_connect(IMAPSession *session)
 #endif
 
 	if (!session->authenticated &&
-	    imap_auth(session, account->userid, pass, account->imap_auth_type)
-	    != IMAP_SUCCESS) {
+		imap_auth(session, account->userid, pass, account->imap_auth_type)
+		!= IMAP_SUCCESS) {
+		if (master_password_active()) {
+			g_free(pass); /* remove the decrypted password */
+		}
 		if (account->tmp_pass) {
 			g_free(account->tmp_pass);
 			account->tmp_pass = NULL;
@@ -781,6 +788,10 @@ static gint imap_session_connect(IMAPSession *session)
 		return IMAP_AUTHFAIL;
 	}
 
+	if (master_password_active()) {
+		g_free(pass); /* remove the decrypted password */
+	}
+
 	return IMAP_SUCCESS;
 }
 
diff --git a/libsylph/masterpassword.c b/libsylph/masterpassword.c
index 23e8f2f..77ff281 100644
--- a/libsylph/masterpassword.c
+++ b/libsylph/masterpassword.c
@@ -78,6 +78,9 @@ gchar *decrypt_with_master_password(const gchar *str) {
 		return g_strdup(str);
 
 	str_prefix = mpes_string_prefix(str);
+	if (!str_prefix)
+		return g_strdup(str);
+
 	if (decrypt_data(&new_str,
 					 str + str_prefix,
 					 master_password,
@@ -97,7 +100,7 @@ gchar *decrypt_with_master_password(const gchar *str) {
 gchar *encrypt_with_master_password(const gchar *str) {
 
 #if USE_SSL
-	gchar *new_str;
+	gchar *new_str, *mpes1_str;
 	gint length_encrypted;
 
 	if ((!str) || (!master_password_active()))
@@ -115,7 +118,11 @@ gchar *encrypt_with_master_password(const gchar *str) {
 		return g_strdup(str);
 	}
 
-	return new_str;
+	mpes1_str = g_strdup_printf("mpes1:%s", new_str);
+	OPENSSL_cleanse(new_str, strlen(new_str));
+	g_free(new_str);
+
+	return mpes1_str;
 #else
 	return g_strdup(str);
 #endif
@@ -163,6 +170,10 @@ gint check_master_password_interactively(guint max_attempts) {
 
 	for (cnt = 0; cnt < max_attempts; ++cnt) {
 		master_password = input_query_master_password();
+		if (master_password == NULL) {
+			/* input canceled or query_master_password_func not set */
+			continue;
+		}
 		if (check_password(master_password,
 						   prefs_common.master_password_hash) == RC_OK) {
 			return RC_OK; /* match */
diff --git a/libsylph/prefs_account.c b/libsylph/prefs_account.c
index 1aecba9..fc4d8f1 100644
--- a/libsylph/prefs_account.c
+++ b/libsylph/prefs_account.c
@@ -34,6 +34,7 @@
 #include "customheader.h"
 #include "account.h"
 #include "utils.h"
+#include "masterpassword.h"
 
 static PrefsAccount tmp_ac_prefs;
 
@@ -205,7 +206,7 @@ PrefsAccount *prefs_account_new(void)
 void prefs_account_read_config(PrefsAccount *ac_prefs, const gchar *label)
 {
 	const gchar *p = label;
-	gchar *rcpath;
+	gchar *rcpath, *tmp_str;
 	gint id;
 
 	g_return_if_fail(ac_prefs != NULL);
@@ -229,6 +230,32 @@ void prefs_account_read_config(PrefsAccount *ac_prefs, const gchar *label)
 		ac_prefs->use_apop_auth = TRUE;
 	}
 
+	if (master_password_active()) {
+		if ((ac_prefs->passwd != NULL) &&
+			!mpes_string_prefix(ac_prefs->passwd)) {
+			/* TODO:  Perhaps some prompt? */
+			debug_print(
+				"%s -> converting passwd cleartext to encrypted\n",
+				label);
+			tmp_str = ac_prefs->passwd;
+			ac_prefs->passwd = encrypt_with_master_password(ac_prefs->passwd);
+			g_free(tmp_str);
+		}
+
+		if ((ac_prefs->smtp_passwd != NULL) &&
+			!mpes_string_prefix(ac_prefs->smtp_passwd)) {
+			/* TODO:  Perhaps some prompt? */
+			debug_print(
+				"%s -> converting smtp_passwd from cleartext to encrypted\n",
+				label);
+			tmp_str = ac_prefs->smtp_passwd;
+			ac_prefs->smtp_passwd = encrypt_with_master_password(
+				ac_prefs->smtp_passwd);
+			g_free(tmp_str);
+		}
+
+	}
+
 	custom_header_read_config(ac_prefs);
 }
 
-- 
cgit v1.3