Merge pull request #351 from paolostivanin/newpr_rb

Release 3.5.0

.circleci/config.yml

@@ -1,9 +1,9 @@
 version: 2.0
 
 jobs:
- ubuntu2004:
+ ubuntu2304:
  docker:
- - image: ubuntu:20.04
+ - image: ubuntu:23.04
  steps:
  - checkout
  - run: apt update && DEBIAN_FRONTEND=noninteractive apt -y install git gcc clang cmake libgcrypt20-dev libgtk-3-dev libzip-dev libjansson-dev libpng-dev libzbar-dev libprotobuf-c-dev libsecret-1-dev uuid-dev libprotobuf-dev libqrencode-dev
@@ -50,7 +50,7 @@ workflows:
  version: 2
  build:
  jobs:
- - ubuntu2004
+ - ubuntu2304
  - ubuntuLatestRolling
  - debianLatestStable
  - fedoraLatestStable

CMakeLists.txt

@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.16)
-project(OTPClient VERSION "3.4.1" LANGUAGES "C")
+project(OTPClient VERSION "3.5.0" LANGUAGES "C")
 include(GNUInstallDirs)
 
 configure_file("src/common/version.h.in" "version.h")
@@ -44,14 +44,14 @@ endif()
 
 find_package(PkgConfig REQUIRED)
 find_package(Protobuf 3.6.0 REQUIRED)
-find_package(Gcrypt 1.8.0 REQUIRED)
+find_package(Gcrypt 1.10.1 REQUIRED)
 pkg_check_modules(COTP REQUIRED cotp>=3.0.0)
 pkg_check_modules(PNG REQUIRED libpng>=1.6.30)
 pkg_check_modules(JANSSON REQUIRED jansson>=2.12)
 pkg_check_modules(ZBAR REQUIRED zbar>=0.20)
 pkg_check_modules(GTK3 REQUIRED gtk+-3.0>=3.24.0)
-pkg_check_modules(GLIB2 REQUIRED glib-2.0>=2.64.0)
-pkg_check_modules(GIO REQUIRED gio-2.0>=2.64.0)
+pkg_check_modules(GLIB2 REQUIRED glib-2.0>=2.68.0)
+pkg_check_modules(GIO REQUIRED gio-2.0>=2.68.0)
 pkg_check_modules(UUID REQUIRED uuid>=2.34.0)
 pkg_check_modules(PROTOC REQUIRED libprotobuf-c>=1.3.0)
 pkg_check_modules(LIBSECRET REQUIRED libsecret-1>=0.20.0)
@@ -130,7 +130,9 @@ set(GUI_SOURCE_FILES
  src/show-qr-cb.c
  src/setup-signals-shortcuts.c
  src/change-pwd-cb.c
- src/dbinfo-cb.c)
+ src/dbinfo-cb.c
+ src/common/twofas.c
+ src/common/authpro.c)
 
 set(CLI_HEADER_FILES
  src/cli/get-data.h
@@ -159,7 +161,9 @@ set(CLI_SOURCE_FILES
  src/common/aegis.c
  src/common/freeotp.c
  src/secret-schema.c
- src/google-migration.pb-c.c)
+ src/google-migration.pb-c.c
+ src/common/twofas.c
+ src/common/authpro.c)
 
 if(BUILD_GUI AND BUILD_CLI)
  list(APPEND CLI_SOURCE_FILES

README.md

@@ -13,9 +13,9 @@ Highly secure and easy to use GTK+ software for two-factor authentication that s
 | Name | Min Version |
 |----------------------------------------------------|-------------|
 | GTK+ | 3.24 |
-| Glib | 2.64.0 |
+| Glib | 2.68.0 |
 | jansson | 2.12 |
-| libgcrypt | 1.8.0  |
+| libgcrypt | 1.10.1 |
 | libpng | 1.6.30 |
 | [libcotp](https://github.com/paolostivanin/libcotp) | 3.0.0 |
 | zbar | 0.20 |
@@ -38,6 +38,8 @@ See this [wiki section](https://github.com/paolostivanin/OTPClient/wiki/Secure-M
 - import and export encrypted/plain [andOTP](https://github.com/flocke/andOTP) backup
 - import and export encrypted/plain [Aegis](https://github.com/beemdevelopment/Aegis) backup
 - import and export plain [FreeOTPPlus](https://github.com/helloworld1/FreeOTPPlus) backup (key URI format only)
+- import and export encrypted/plain [AuthenticatorPro](https://github.com/jamie-mh/AuthenticatorPro) backup
+- import and export encrypted/plain [2FAS](https://github.com/twofas) backup
 - import of Google's migration QR codes
 - local database is encrypted using AES256-GCM
  - key is derived using PBKDF2 with SHA512 and 100k iterations

SECURITY.md

@@ -6,8 +6,10 @@ The following list describes whether a version is eligible or not for security u
 
 | Version | Supported | EOL |
 |---------|--------------------|-------------|
-| 3.4.x | :white_check_mark: | - |
-| 3.3.x | :white_check_mark: | 03-Mar-2024 |
+| 3.5.x | :white_check_mark: | - |
+| 3.4.1 | :white_check_mark: | 31-May-2024 |
+| 3.4.0 | :x: | 29-Feb-2024 |
+| 3.3.x | :x: | 29-Feb-2024 |
 | 3.2.x | :x: | 31-Jan-2024 |
 | 3.1.x | :x: | 30-Nov-2023 |
 | 3.0.x | :x: | 31-Dec-2022 |

data/com.github.paolostivanin.OTPClient.appdata.xml

@@ -5,7 +5,7 @@
  <metadata_license>CC-BY-4.0</metadata_license>
  <project_license>GPL-3.0+</project_license>
  <name>OTPClient</name>
- <summary>GTK+ application for managing TOTP and HOTP tokens with built-in encryption.</summary>
+ <summary>Application for managing TOTP/HOTP tokens with built-in encryption</summary>
 
  <keywords>
  <keyword>otp</keyword>
@@ -89,6 +89,20 @@
  </content_rating>
 
  <releases>
+ <release version="3.5.0" date="2024-03-01x">
+ <description>
+ <p>OTPClient 3.5.0 brings some new features and improvements:</p>
+ <ul>
+ <li>NEW: add support for importing and exporting plain/encrypted 2FAS backups (#322)</li>
+ <li>NEW: add support for importing and exporting plain/encrypted AuthenticatorPro backups (#322)</li>
+ <li>CHANGE: show warning when exporting a plain backup</li>
+ <li>CHANGE: remove support for older Glib and GCrypt</li>
+ <li>FIX: add 2fa keyword to the desktop file (#349)</li>
+ <li>FIX: remove custom keywords from metadata file (#348)</li>
+ <li>FIX: returning to a dialog won't crash the widget</li>
+ </ul>
+ </description>
+ </release>
  <release version="3.4.1" date="2024-02-12">
  <description>
  <p>OTPClient 3.4.1 brings a single fix::</p>
@@ -561,8 +575,4 @@
  </description>
  </release>
  </releases>
- <custom>
- <value key="Purism::form_factor">workstation</value>
- <value key="Purism::form_factor">mobile</value>
- </custom>
 </component>

data/com.github.paolostivanin.OTPClient.desktop

@@ -2,7 +2,7 @@
 Type=Application
 Exec=otpclient
 Icon=com.github.paolostivanin.OTPClient
-Keywords=otp;totp;hotp;
+Keywords=otp;totp;hotp;2fa
 Terminal=false
 Name=OTPClient
 Comment=GTK+ TOTP and HOTP client

flatpak/com.github.paolostivanin.OTPClient.yaml

@@ -1,11 +1,11 @@
 app-id: com.github.paolostivanin.OTPClient
 runtime: org.gnome.Platform
-runtime-version: '44'
+runtime-version: '45'
 sdk: org.gnome.Sdk
 command: otpclient
 finish-args:
 - "--share=ipc"
-- "--socket=x11"
+- "--socket=fallback-x11"
 - "--socket=wayland"
 - "--device=all"
 - "--talk-name=org.freedesktop.secrets"
@@ -42,8 +42,8 @@ modules:
  - "/lib/*.la"
  sources:
  - type: archive
- url: https://github.com/protobuf-c/protobuf-c/archive/refs/tags/v1.4.1.tar.gz
- sha256: 99be336cdb15dfc5827efe34e5ac9aaa962e2485db547dd254d2a122a7d23102
+ url: https://github.com/protobuf-c/protobuf-c/archive/refs/tags/v1.5.0.tar.gz
+ sha256: 7b404c63361ed35b3667aec75cc37b54298d56dd2bcf369de3373212cc06fd98
 - name: qrencode
  buildsystem: cmake-ninja
  config-opts:
@@ -66,8 +66,8 @@ modules:
  - "--enable-codes=qrcode"
  sources:
  - type: archive
- url: https://www.linuxtv.org/downloads/zbar/zbar-0.23.90.tar.gz
- sha256: ff857dd7e3dbe043dac3765b5182c91dfd0477800713a75d15287d797cee60fa
+ url: https://www.linuxtv.org/downloads/zbar/zbar-0.23.93.tar.gz
+ sha256: 78ae427a529f0399561bc198de5c2c7ca3f11d05fa9e903e65e501168433d218
 - name: libcotp
  buildsystem: cmake-ninja
  config-opts:
@@ -77,8 +77,8 @@ modules:
  - "/include"
  sources:
  - type: archive
- url: https://github.com/paolostivanin/libcotp/archive/v2.0.1.tar.gz
- sha256: b111d528bbde7c1a0a392f49293b25ae33e6e78fbcbe378e0cf8bc6d59743d11
+ url: https://github.com/paolostivanin/libcotp/archive/v3.0.0.tar.gz
+ sha256: ff0b9ce208c4c6542a0f1e739cf31978fbf28848c573837c671a6cb7b56b2c12
 - name: OTPClient
  buildsystem: cmake-ninja
  config-opts:

src/app.c

@@ -536,11 +536,19 @@ set_action_group (GtkBuilder *builder,
  { .name = FREEOTPPLUS_IMPORT_ACTION_NAME, .activate = select_file_cb },
  { .name = AEGIS_IMPORT_ACTION_NAME, .activate = select_file_cb },
  { .name = AEGIS_IMPORT_ENC_ACTION_NAME, .activate = select_file_cb },
+ { .name = AUTHPRO_IMPORT_ENC_ACTION_NAME, .activate = select_file_cb },
+ { .name = AUTHPRO_IMPORT_PLAIN_ACTION_NAME, .activate = select_file_cb },
+ { .name = TWOFAS_IMPORT_ENC_ACTION_NAME, .activate = select_file_cb },
+ { .name = TWOFAS_IMPORT_PLAIN_ACTION_NAME, .activate = select_file_cb },
  { .name = ANDOTP_EXPORT_ACTION_NAME, .activate = export_data_cb },
  { .name = ANDOTP_EXPORT_PLAIN_ACTION_NAME, .activate = export_data_cb },
  { .name = FREEOTPPLUS_EXPORT_ACTION_NAME, .activate = export_data_cb },
  { .name = AEGIS_EXPORT_ACTION_NAME, .activate = export_data_cb },
  { .name = AEGIS_EXPORT_PLAIN_ACTION_NAME, .activate = export_data_cb },
+ { .name = AUTHPRO_EXPORT_ENC_ACTION_NAME, .activate = export_data_cb },
+ { .name = AUTHPRO_EXPORT_PLAIN_ACTION_NAME, .activate = export_data_cb },
+ { .name = TWOFAS_EXPORT_ENC_ACTION_NAME, .activate = export_data_cb },
+ { .name = TWOFAS_EXPORT_PLAIN_ACTION_NAME, .activate = export_data_cb },
  { .name = GOOGLE_MIGRATION_FILE_ACTION_NAME, .activate = add_qr_from_file },
  { .name = GOOGLE_MIGRATION_WEBCAM_ACTION_NAME, .activate = webcam_add_cb },
  { .name = "create_newdb", .activate = new_db_cb },
@@ -601,6 +609,8 @@ get_db_path (AppData *app_data)
  gchar *msg = g_strconcat ("Database file/location:\n<b>", db_path, "</b>\ndoes not exist. A new database will be created.", NULL);
  show_message_dialog (app_data->main_window, msg, GTK_MESSAGE_ERROR);
  g_free (msg);
+ g_free (db_path);
+ db_path = NULL;
  goto new_db;
  }
  goto end;

src/change-db-cb.c

@@ -60,10 +60,9 @@ change_db (AppData *app_data)
  g_free (old_db_path);
  break;
  case GTK_RESPONSE_CANCEL:
- gtk_widget_destroy (changedb_diag);
- return QUIT_APP;
  default:
- break;
+ gtk_widget_hide (changedb_diag);
+ return QUIT_APP;
  }
  gtk_widget_destroy (changedb_diag);
 

src/cli/exec-action.c

@@ -120,7 +120,7 @@ gboolean exec_action (CmdlineOpts *cmdline_opts,
  }
  }
  exported_file_path = g_build_filename (export_directory, export_pwd != NULL ? "aegis_exports.json.aes" : "aegis_exports.json", NULL);
- ret_msg = export_aegis (exported_file_path, db_data->json_data, export_pwd);
+ ret_msg = export_aegis (exported_file_path, export_pwd, db_data->json_data);
  gcry_free (export_pwd);
  exported = TRUE;
  }

src/cli/get-data.c

@@ -59,21 +59,13 @@ show_token (DatabaseData *db_data,
 
  // Translators: please do not translate 'account'
  GString *msg = g_string_new (_("Given account: %s"));
-#if GLIB_CHECK_VERSION(2, 68, 0)
  g_string_replace (msg, "%s", account != NULL ? account : "<none>", 0);
-#else
- g_string_replace_backported (msg, "%s", account != NULL ? account : "<none>", 0);
-#endif
  g_printerr ("%s\n", msg->str);
  g_string_free (msg, TRUE);
 
  // Translators: please do not translate 'issuer'
  msg = g_string_new (_("Given issuer: %s"));
-#if GLIB_CHECK_VERSION(2, 68, 0)
  g_string_replace (msg, "%s", issuer != NULL ? issuer : "<none>", 0);
-#else
- g_string_replace_backported (msg, "%s", issuer != NULL ? issuer : "<none>", 0);
-#endif
  g_printerr ("%s\n", msg->str);
  g_string_free (msg, TRUE);
 

src/common/aegis.c

@@ -22,23 +22,22 @@ static GSList *get_otps_from_encrypted_backup (const gchar *path,
  gint32 max_file_size,
  GError **err);
 
-static GSList *parse_json_data  (const gchar *data,
+static GSList *parse_aegis_json_data (const gchar *data,
  GError **err);
 
 
 GSList *
 get_aegis_data (const gchar *path,
  const gchar *password,
  gint32 max_file_size,
- gboolean encrypted,
  GError **err)
 {
  if (g_file_test (path, G_FILE_TEST_IS_SYMLINK | G_FILE_TEST_IS_DIR) ) {
  g_set_error (err, generic_error_gquark (), GENERIC_ERRCODE, "Selected file is either a symlink or a directory.");
  return NULL;
  }
 
- return (encrypted == TRUE) ? get_otps_from_encrypted_backup(path, password, max_file_size, err) : get_otps_from_plain_backup(path, err);
+ return (password != NULL) ? get_otps_from_encrypted_backup (path, password, max_file_size, err) : get_otps_from_plain_backup (path, err);
 }
 
 
@@ -53,8 +52,8 @@ get_otps_from_plain_backup (const gchar *path,
  return NULL;
  }
 
- gchar *dumped_json = json_dumps(json_object_get (json, "db"), 0);
- GSList *otps = parse_json_data (dumped_json, err);
+ gchar *dumped_json = json_dumps (json_object_get (json, "db"), 0);
+ GSList *otps = parse_aegis_json_data (dumped_json, err);
  gcry_free (dumped_json);
 
  return otps;
@@ -204,7 +203,7 @@ get_otps_from_encrypted_backup (const gchar *path,
  g_regex_unref (regex);
  gcry_free (decrypted_db);
 
- GSList *otps = parse_json_data (cleaned_db, err);
+ GSList *otps = parse_aegis_json_data (cleaned_db, err);
  gcry_free (cleaned_db);
 
  return otps;
@@ -213,8 +212,8 @@ get_otps_from_encrypted_backup (const gchar *path,
 
 gchar *
 export_aegis (const gchar *export_path,
- json_t   *json_db_data,
- const gchar *password)
+ const gchar *password,
+ json_t   *json_db_data)
 {
  GError *err = NULL;
  json_t *root = json_object ();
@@ -422,8 +421,8 @@ export_aegis (const gchar *export_path,
 
 
 static GSList *
-parse_json_data (const gchar *data,
- GError **err)
+parse_aegis_json_data (const gchar *data,
+  GError **err)
 {
  json_error_t jerr;
  json_t *root = json_loads (data, JSON_DISABLE_EOF_CHECK, &jerr);
@@ -451,6 +450,7 @@ parse_json_data (const gchar *data,
  otp->secret = secure_strdup (json_string_value (json_object_get (info_obj, "secret")));
  otp->digits = (guint32) json_integer_value (json_object_get(info_obj, "digits"));
 
+ gboolean skip = FALSE;
  const gchar *type = json_string_value (json_object_get (obj, "type"));
  if (g_ascii_strcasecmp (type, "TOTP") == 0) {
  otp->type = g_strdup (type);
@@ -468,11 +468,8 @@ parse_json_data (const gchar *data,
  g_free (otp->issuer);
  otp->issuer = g_strdup ("Steam");
  } else {
- g_set_error (err, generic_error_gquark (), GENERIC_ERRCODE, "otp type is neither TOTP nor HOTP");
- gcry_free (otp->secret);
- g_free (otp);
- json_decref (obj);
- return NULL;
+ g_printerr ("Skipping token due to unsupported type: %s\n", type);
+ skip = TRUE;
  }
 
  const gchar *algo = json_string_value (json_object_get (info_obj, "algo"));
@@ -481,16 +478,20 @@ parse_json_data (const gchar *data,
  g_ascii_strcasecmp (algo, "SHA512") == 0) {
  otp->algo = g_ascii_strup (algo, -1);
  } else {
- g_printerr ("algo not supported (must be either one of: sha1, sha256 or sha512\n");
+ g_printerr ("Skipping token due to unsupported algo: %s\n", algo);
+ skip = TRUE;
+ }
+
+ if (!skip) {
+ otps = g_slist_append (otps, otp);
+ } else {
  gcry_free (otp->secret);
+ g_free (otp->issuer);
+ g_free (otp->account_name);
+ g_free (otp->algo);
+ g_free (otp->type);
  g_free (otp);
- json_decref (obj);
- json_decref (info_obj);
- return NULL;
  }
-
- otps = g_slist_append (otps, g_memdupX (otp, sizeof (otp_t)));
- g_free (otp);
  }
 
  json_decref (root);