Documentation
¶
Overview ¶
Package gokeepasslib is a library written in go which provides functionality to decrypt and parse keepass 2 files (kdbx)
Index ¶
- Constants
- Variables
- func DecodeBlocks(body []byte) (result []byte, err error)
- func EncodeBlocks(data []byte) (result []byte, err error)
- func LockProtectedEntries(p ProtectedStreamManager, es []Entry)
- func LockProtectedEntry(p ProtectedStreamManager, e *Entry)
- func LockProtectedGroup(p ProtectedStreamManager, g *Group)
- func LockProtectedGroups(p ProtectedStreamManager, gs []Group)
- func ParseKeyFile(location string) ([]byte, error)
- func UnlockProtectedEntries(p ProtectedStreamManager, e []Entry)
- func UnlockProtectedEntry(p ProtectedStreamManager, e *Entry)
- func UnlockProtectedGroup(p ProtectedStreamManager, g *Group)
- func UnlockProtectedGroups(p ProtectedStreamManager, gs []Group)
- type AutoTypeAssociation
- type AutoTypeData
- type Binaries
- type Binary
- type BinaryReference
- type Block
- type BoolWrapper
- type DBContent
- type DBCredentials
- type Database
- func (db *Database) Cipher() (cipher.Block, error)
- func (db *Database) Decrypter() (cipher.BlockMode, error)
- func (db *Database) Encrypter() (cipher.BlockMode, error)
- func (db *Database) LockProtectedEntries() error
- func (db *Database) StreamManager() ProtectedStreamManager
- func (db *Database) String() string
- func (db *Database) UnlockProtectedEntries() error
- type Decoder
- type DeletedObjectData
- type Encoder
- type Entry
- type ErrCorruptBlock
- type ErrInvalidSignature
- type ErrRequiredAttributeMissing
- type ErrUnknownHeaderID
- type FileHeaders
- type FileSignature
- type Group
- type Header
- type History
- type InsecureStreamManager
- type MemProtection
- type MetaData
- type ProtectedStreamManager
- type RootData
- type SalsaManager
- func (s *SalsaManager) LockEntries(es []Entry)
- func (s *SalsaManager) LockEntry(e *Entry)
- func (s *SalsaManager) LockGroup(g *Group)
- func (s *SalsaManager) LockGroups(gs []Group)
- func (s *SalsaManager) Pack(payload []byte) string
- func (s *SalsaManager) UnlockEntries(e []Entry)
- func (s *SalsaManager) UnlockEntry(e *Entry)
- func (s *SalsaManager) UnlockGroup(g *Group)
- func (s *SalsaManager) UnlockGroups(gs []Group)
- func (s *SalsaManager) Unpack(payload string) []byte
- type TimeData
- type TimeWrapper
- type UUID
- type V
- type ValueData
Constants ¶
const ( NoStreamID uint32 = 0 ARC4StreamID = 1 SalsaStreamID = 2 )
Constant enumerator for the inner random stream ID
const ( NoCompressionFlag uint32 = 0 GzipCompressionFlag = 1 )
Constants enumerator for compression flags
const MajorVersion = 3
MajorVersion
const MinorVersion = 1
MinorVersion
Variables ¶
var AESCipherID = []byte{0x31, 0xC1, 0xF2, 0xE6, 0xBF, 0x71, 0x43, 0x50, 0xBE, 0x58, 0x05, 0x21, 0x6A, 0xFC, 0x5A, 0xFF}
var BaseSignature = [...]byte{0x03, 0xd9, 0xa2, 0x9a}
BaseSignature is the valid base signature for kdbx files
var DefaultSig = FileSignature{BaseSignature, SecondarySignature, MinorVersion, MajorVersion}
A full valid default signature struct for new databases
var EndHeader = Header{0, 4, []byte{0x0d, 0x0a, 0x0d, 0x0a}}
var ErrBlockTooSmall = errors.New("gokeepasslib: block is too small")
ErrBlockTooSmall is returned by decoder if the block length does not match the body size
var ErrEmptyBlock = errors.New("gokeepasslib: block appears to be empty/closing block")
ErrEmptyBlock is returned by decoder when a block is empty,ignored if is the last block in the file
var ErrEndOfHeaders = errors.New("gokeepasslib: header id was 0, end of headers")
var ErrInvalidUUIDLength = errors.New("gokeepasslib: length of decoded UUID was not 16")
ErrInvalidUUIDLength is an error which is returned during unmarshaling if the UUID does not have 16 bytes length
var ErrUnsupportedStreamType = errors.New("Type of stream manager unsupported")
ErrUnsupportedStreamType is retured if no streamManager can be created due to an unsupported InnerRandomStreamID value
var SecondarySignature = [...]byte{0x67, 0xfb, 0x4b, 0xb5}
SecondarySignature is the valid version signature for kdbx files
Functions ¶
func DecodeBlocks ¶
DecodeBlocks converts a []byte in kdbx block format into the xml content, checking for corruption
func EncodeBlocks ¶
EncodeBlocks Converts raw xml data to keepass's block format, which includes a hash of each block to check for data corruption, Every block contains the following elements: (4 bytes) ID : an unique interger id for this block (32 bytes) sha-256 hash of block data (4 bytes) size in bytes of the block data (Data Size Bytes) the actual xml data of the block, will be blockSplitRate bytes at most
func LockProtectedEntries ¶
func LockProtectedEntries(p ProtectedStreamManager, es []Entry)
func LockProtectedEntry ¶
func LockProtectedEntry(p ProtectedStreamManager, e *Entry)
func LockProtectedGroup ¶
func LockProtectedGroup(p ProtectedStreamManager, g *Group)
func LockProtectedGroups ¶
func LockProtectedGroups(p ProtectedStreamManager, gs []Group)
func ParseKeyFile ¶
ParseKeyFile returns the hashed key from a key file at the path specified by location, parsing xml if needed
func UnlockProtectedEntries ¶
func UnlockProtectedEntries(p ProtectedStreamManager, e []Entry)
func UnlockProtectedEntry ¶
func UnlockProtectedEntry(p ProtectedStreamManager, e *Entry)
func UnlockProtectedGroup ¶
func UnlockProtectedGroup(p ProtectedStreamManager, g *Group)
func UnlockProtectedGroups ¶
func UnlockProtectedGroups(p ProtectedStreamManager, gs []Group)
Types ¶
type AutoTypeAssociation ¶
type AutoTypeData ¶
type AutoTypeData struct { Enabled BoolWrapper `xml:"Enabled"` DataTransferObfuscation int64 `xml:"DataTransferObfuscation"` Association *AutoTypeAssociation `xml:"Association,omitempty"` }
type Binaries ¶
type Binaries []Binary
Binaries Stores a slice of binaries in the metadata header of a database
type Binary ¶
type Binary struct { Content []byte `xml:",innerxml"` ID int `xml:"ID,attr"` Compressed BoolWrapper `xml:"Compressed,attr"` }
Binary stores a binary found in the metadata header of a database
func (Binary) CreateReference ¶
func (b Binary) CreateReference(f string) BinaryReference
CreateReference creates a reference with the same id as b with filename f
func (Binary) GetContent ¶
GetContent returns a string which is the plaintext content of a binary
func (*Binary) SetContent ¶
SetContent encodes and (if Compressed=true) compresses c and sets b's content
type BinaryReference ¶
type BinaryReference struct { Name string `xml:"Key"` Value struct { ID int `xml:"Ref,attr"` } `xml:"Value"` }
BinaryReference stores a reference to a binary which appears in the xml of an entry
func NewBinaryReference ¶
func NewBinaryReference(name string, id int) BinaryReference
NewBinaryReference creates a new BinaryReference with the given name and id
func (*BinaryReference) Find ¶
func (br *BinaryReference) Find(bs Binaries) *Binary
Find returns a reference to a binary in the slice of binaries bs with the same id as br, or nil if none is found
func (BinaryReference) String ¶
func (br BinaryReference) String() string
type Block ¶
Block stores an individual block following the kdbx block format
func (Block) MarshalText ¶
MarshalText converts a block into kdbx binary block format
func (*Block) UnmarshalText ¶
UnmarshalText turns text in binary kdbx format into a block
type BoolWrapper ¶
type BoolWrapper bool
Wraps the builtin boolean to provide xml marshaling and demarshaling
func (*BoolWrapper) MarshalXML ¶
func (b *BoolWrapper) MarshalXML(e *xml.Encoder, start xml.StartElement) error
func (*BoolWrapper) MarshalXMLAttr ¶
func (*BoolWrapper) UnmarshalXML ¶
func (b *BoolWrapper) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error
func (*BoolWrapper) UnmarshalXMLAttr ¶
func (b *BoolWrapper) UnmarshalXMLAttr(attr xml.Attr) error
type DBContent ¶
type DBContent struct { XMLName xml.Name `xml:"KeePassFile"` Meta *MetaData `xml:"Meta"` Root *RootData `xml:"Root"` }
DBContent is a container for all elements of a keepass database
func NewDBContent ¶
func NewDBContent() *DBContent
NewDBContent creates a new DB content with some good defaults
type DBCredentials ¶
type DBCredentials struct { Passphrase []byte //Passphrase if using one, stored in sha256 hash Key []byte //Contents of the keyfile if using one, stored in sha256 hash Windows []byte //Whatever is returned from windows user account auth, stored in sha256 hash }
DBCredentials holds the key used to lock and unlock the database
func NewKeyCredentials ¶
func NewKeyCredentials(location string) (*DBCredentials, error)
NewKeyCredentials builds new DBCredentials from a key file at the path specified by location
func NewPasswordAndKeyCredentials ¶
func NewPasswordAndKeyCredentials(password, location string) (*DBCredentials, error)
NewPasswordAndKeyCredentials builds new DBCredentials from a password and the key file at the path specified by location
func NewPasswordCredentials ¶
func NewPasswordCredentials(password string) *DBCredentials
NewPasswordCredentials builds a new DBCredentials from a Password string
func (*DBCredentials) String ¶
func (c *DBCredentials) String() string
type Database ¶
type Database struct { Signature *FileSignature Headers *FileHeaders Credentials *DBCredentials Content *DBContent }
Database stores all contents nessesary for a keepass database file
func NewDatabase ¶
func NewDatabase() *Database
NewDatabase creates a new database with some sensable default settings. To create a database with no settigns per-set, use gokeepasslib.Database{}
func (*Database) LockProtectedEntries ¶
LockProtectedEntries goes through the entire database and decrypts any Values in entries with protected=true set. Warning: Do not call this if entries are already locked Warning: Encoding a database calls LockProtectedEntries automatically
func (*Database) StreamManager ¶
func (db *Database) StreamManager() ProtectedStreamManager
StreamManager returns a ProtectedStreamManager bassed on the db headers, or nil if the type is unsupported Can be used to lock only certain entries instead of calling
func (*Database) UnlockProtectedEntries ¶
UnlockProtectedEntries goes through the entire database and encrypts any Values in entries with protected=true set. This should be called after decoding if you want to view plaintext password in an entry Warning: If you call this when entry values are already unlocked, it will cause them to be unreadable
type Decoder ¶
type Decoder struct {
// contains filtered or unexported fields
}
Decoder stores a reader which is expected to be in kdbx format
func NewDecoder ¶
type DeletedObjectData ¶
type DeletedObjectData struct { XMLName xml.Name `xml:"DeletedObject"` UUID UUID `xml:"UUID"` DeletionTime *TimeWrapper `xml:"DeletionTime"` }
type Encoder ¶
type Encoder struct {
// contains filtered or unexported fields
}
Encoder is used to automaticaly encrypt and write a database to a file, network, etc
func NewEncoder ¶
NewEncoder creates a new encoder with writer w, identical to gokeepasslib.Encoder{w}
type Entry ¶
type Entry struct { UUID UUID `xml:"UUID"` IconID int64 `xml:"IconID"` ForegroundColor string `xml:"ForegroundColor"` BackgroundColor string `xml:"BackgroundColor"` OverrideURL string `xml:"OverrideURL"` Tags string `xml:"Tags"` Times TimeData `xml:"Times"` Values []ValueData `xml:"String,omitempty"` AutoType AutoTypeData `xml:"AutoType"` Histories []History `xml:"History"` Binaries []BinaryReference `xml:"Binary,omitempty"` }
Entry is the structure which holds information about a parsed entry in a keepass database
func (*Entry) Get ¶
Get returns the value in e corresponding with key k, or an empty string otherwise
func (*Entry) GetContent ¶
GetContent returns the content of the value belonging to the given key in string form
func (*Entry) GetIndex ¶
GetIndex returns the index of the Value belonging to the given key, or -1 if none is found
func (*Entry) GetPassword ¶
GetPassword returns the password of an entry
func (*Entry) GetPasswordIndex ¶
GetPasswordIndex returns the index in the values slice belonging to the password
type ErrCorruptBlock ¶
type ErrCorruptBlock struct { Hash [32]byte // contains filtered or unexported fields }
ErrCorruptBlock is returned by Decoder when a block in the kdbx file has a different hash from the correct hash
func (ErrCorruptBlock) Error ¶
func (e ErrCorruptBlock) Error() string
type ErrInvalidSignature ¶
type ErrInvalidSignature struct { Name string Is interface{} Shouldbe interface{} }
ErrInvalidSignature is the error returned if the file signature is invalid
func (ErrInvalidSignature) Error ¶
func (e ErrInvalidSignature) Error() string
type ErrRequiredAttributeMissing ¶
type ErrRequiredAttributeMissing string
ErrRequiredAttributeMissing is returned if a required value is not given
func (ErrRequiredAttributeMissing) Error ¶
func (e ErrRequiredAttributeMissing) Error() string
type ErrUnknownHeaderID ¶
type ErrUnknownHeaderID int
func (ErrUnknownHeaderID) Error ¶
func (i ErrUnknownHeaderID) Error() string
type FileHeaders ¶
type FileHeaders struct { RawData []byte Comment []byte // FieldID: 1 CipherID []byte // FieldID: 2 CompressionFlags uint32 // FieldID: 3 MasterSeed []byte // FieldID: 4 TransformSeed []byte // FieldID: 5 TransformRounds uint64 // FieldID: 6 EncryptionIV []byte // FieldID: 7 ProtectedStreamKey []byte // FieldID: 8 StreamStartBytes []byte // FieldID: 9 InnerRandomStreamID uint32 // FieldID: 10 }
FileHeaders holds the header information of the Keepass File.
func NewFileHeaders ¶
func NewFileHeaders() *FileHeaders
NewFileHeaders creates a new FileHeaders with good defaults
func (*FileHeaders) ReadFrom ¶
func (h *FileHeaders) ReadFrom(r io.Reader) error
ReadHeaders reads the headers from an io.Reader and creates a structure containing the parsed header information
func (*FileHeaders) SetHeader ¶
func (headers *FileHeaders) SetHeader(h Header) error
func (FileHeaders) String ¶
func (h FileHeaders) String() string
type FileSignature ¶
type FileSignature struct { BaseSignature [4]byte SecondarySignature [4]byte MinorVersion uint16 MajorVersion uint16 }
FileSignature holds the Keepass File Signature. The first 4 Bytes are the Base Signature, followed by 4 Bytes for the Version of the Format which is followed by 4 Bytes for the File Version
func (*FileSignature) ReadFrom ¶
func (s *FileSignature) ReadFrom(r io.Reader) error
ReadFrom reads and validates the FileSignature from an io.Reader
func (FileSignature) String ¶
func (s FileSignature) String() string
func (FileSignature) Validate ¶
func (s FileSignature) Validate() error
Validate checks the file signature for validity
type Group ¶
type Group struct { UUID UUID `xml:"UUID"` Name string `xml:"Name"` Notes string `xml:"Notes"` IconID int64 `xml:"IconID"` Times TimeData `xml:"Times"` IsExpanded BoolWrapper `xml:"IsExpanded"` DefaultAutoTypeSequence string `xml:"DefaultAutoTypeSequence"` EnableAutoType BoolWrapper `xml:"EnableAutoType"` EnableSearching BoolWrapper `xml:"EnableSearching"` LastTopVisibleEntry string `xml:"LastTopVisibleEntry"` Entries []Entry `xml:"Entry,omitempty"` Groups []Group `xml:"Group,omitempty"` }
Group is a structure to store entries in their named groups for organization
type History ¶
type History struct {
Entries []Entry `xml:"Entry"`
}
History stores information about changes made to an entry, in the form of a list of previous versions of that entry
type InsecureStreamManager ¶
type InsecureStreamManager struct{}
InsecureStreamManager is a stream manger which does not encrypt, just stores the plaintext payload
func (InsecureStreamManager) Pack ¶
func (i InsecureStreamManager) Pack(payload []byte) string
Pack returns the string belonging to the given byte slice payload without any packaging to be done
func (InsecureStreamManager) Unpack ¶
func (i InsecureStreamManager) Unpack(payload string) []byte
Unpack returns the given string as a byte slice without any other action being taken
type MemProtection ¶
type MemProtection struct { ProtectTitle BoolWrapper `xml:"ProtectTitle"` ProtectUserName BoolWrapper `xml:"ProtectUserName"` ProtectPassword BoolWrapper `xml:"ProtectPassword"` ProtectURL BoolWrapper `xml:"ProtectURL"` ProtectNotes BoolWrapper `xml:"ProtectNotes"` }
MemProtection is a structure containing settings for MemoryProtection
type MetaData ¶
type MetaData struct { Generator string `xml:"Generator"` HeaderHash string `xml:"HeaderHash"` DatabaseName string `xml:"DatabaseName"` DatabaseNameChanged *TimeWrapper `xml:"DatabaseNameChanged"` DatabaseDescription string `xml:"DatabaseDescription"` DatabaseDescriptionChanged *TimeWrapper `xml:"DatabaseDescriptionChanged"` DefaultUserName string `xml:"DefaultUserName"` DefaultUserNameChanged *TimeWrapper `xml:"DefaultUserNameChanged"` MaintenanceHistoryDays int64 `xml:"MaintenanceHistoryDays"` Color string `xml:"Color"` MasterKeyChanged *TimeWrapper `xml:"MasterKeyChanged"` MasterKeyChangeRec int64 `xml:"MasterKeyChangeRec"` MasterKeyChangeForce int64 `xml:"MasterKeyChangeForce"` MemoryProtection MemProtection `xml:"MemoryProtection"` RecycleBinEnabled BoolWrapper `xml:"RecycleBinEnabled"` RecycleBinUUID UUID `xml:"RecycleBinUUID"` RecycleBinChanged *TimeWrapper `xml:"RecycleBinChanged"` EntryTemplatesGroup string `xml:"EntryTemplatesGroup"` EntryTemplatesGroupChanged *TimeWrapper `xml:"EntryTemplatesGroupChanged"` HistoryMaxItems int64 `xml:"HistoryMaxItems"` HistoryMaxSize int64 `xml:"HistoryMaxSize"` LastSelectedGroup string `xml:"LastSelectedGroup"` LastTopVisibleGroup string `xml:"LastTopVisibleGroup"` Binaries Binaries `xml:"Binaries>Binary"` CustomData string `xml:"CustomData"` }
MetaData is the structure for the metadata headers at the top of kdbx files, it contains things like the name of the database
func NewMetaData ¶
func NewMetaData() *MetaData
NewMetaData creates a MetaData struct with some defaults set
type ProtectedStreamManager ¶
ProtectedStreamManager is an interface for the different types of StreamManagers which might be used for protecting certain values
type RootData ¶
type RootData struct { Groups []Group `xml:"Group"` DeletedObjects []DeletedObjectData `xml:"DeletedObjects>DeletedObject"` }
RootData stores the actual content of a database (all enteries sorted into groups and the recycle bin)
func NewRootData ¶
func NewRootData() *RootData
NewRootData returns a RootData struct with good defaults
type SalsaManager ¶
type SalsaManager struct { State []uint32 // contains filtered or unexported fields }
SalsaManager is responsible for stream encrypting and decrypting of the passwords
func NewSalsaManager ¶
func NewSalsaManager(key [32]byte) *SalsaManager
NewSalsaManager initializes a new Password
func (*SalsaManager) LockEntries ¶
func (s *SalsaManager) LockEntries(es []Entry)
func (*SalsaManager) LockEntry ¶
func (s *SalsaManager) LockEntry(e *Entry)
func (*SalsaManager) LockGroup ¶
func (s *SalsaManager) LockGroup(g *Group)
func (*SalsaManager) LockGroups ¶
func (s *SalsaManager) LockGroups(gs []Group)
func (*SalsaManager) Pack ¶
func (s *SalsaManager) Pack(payload []byte) string
func (*SalsaManager) UnlockEntries ¶
func (s *SalsaManager) UnlockEntries(e []Entry)
func (*SalsaManager) UnlockEntry ¶
func (s *SalsaManager) UnlockEntry(e *Entry)
func (*SalsaManager) UnlockGroup ¶
func (s *SalsaManager) UnlockGroup(g *Group)
func (*SalsaManager) UnlockGroups ¶
func (s *SalsaManager) UnlockGroups(gs []Group)
func (*SalsaManager) Unpack ¶
func (s *SalsaManager) Unpack(payload string) []byte
type TimeData ¶
type TimeData struct { CreationTime *TimeWrapper `xml:"CreationTime"` LastModificationTime *TimeWrapper `xml:"LastModificationTime"` LastAccessTime *TimeWrapper `xml:"LastAccessTime"` ExpiryTime *TimeWrapper `xml:"ExpiryTime"` Expires BoolWrapper `xml:"Expires"` UsageCount int64 `xml:"UsageCount"` LocationChanged *TimeWrapper `xml:"LocationChanged"` }
TimeData contains all metadata related to times for groups and entries e.g. the last modification time or the creation time
func NewTimeData ¶
func NewTimeData() TimeData
NewTimeData returns a TimeData struct with good defaults (no expire time, all times set to now)
type TimeWrapper ¶
func (TimeWrapper) MarshalText ¶
func (tw TimeWrapper) MarshalText() ([]byte, error)
MarshalText marshals time into an RFC3339 compliant value in UTC
func (*TimeWrapper) UnmarshalText ¶
func (tw *TimeWrapper) UnmarshalText(data []byte) error
UnmarshalText take a string of format time.RFC3339 and marshals it into the TimeWrapper value.
type UUID ¶
type UUID [16]byte
UUID stores a universal identifier for each group+entry
func (UUID) Compare ¶
Compare allowes to check whether two instance of UUID are equal in value. This is used for searching a uuid
func (UUID) MarshalText ¶
MarshalText is a marshaler method to encode uuid content as base 64 and return it
func (*UUID) UnmarshalText ¶
UnmarshalText unmarshals a byte slice into a UUID by decoding the given data from base64
type V ¶
type V struct { Content string `xml:",chardata"` Protected BoolWrapper `xml:"Protected,attr,omitempty"` }
V is a wrapper for the content of a value, so that it can store whether it is protected