xref: /netbsd-src/external/bsd/openldap/dist/libraries/liblutil/passwd.c (revision 549b59ed3ccf0d36d3097190a0db27b770f3a839)
1 /*	$NetBSD: passwd.c,v 1.9 2021/08/14 16:14:58 christos Exp $	*/
2 
3 /* $OpenLDAP$ */
4 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5  *
6  * Copyright 1998-2021 The OpenLDAP Foundation.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted only as authorized by the OpenLDAP
11  * Public License.
12  *
13  * A copy of this license is available in the file LICENSE in the
14  * top-level directory of the distribution or, alternatively, at
15  * <http://www.OpenLDAP.org/license.html>.
16  */
17 
18 /*
19  * int lutil_passwd(
20  *	const struct berval *passwd,
21  *	const struct berval *cred,
22  *	const char **schemes )
23  *
24  * Returns true if user supplied credentials (cred) matches
25  * the stored password (passwd).
26  *
27  * Due to the use of the crypt(3) function
28  * this routine is NOT thread-safe.
29  */
30 
31 #include <sys/cdefs.h>
32 __RCSID("$NetBSD: passwd.c,v 1.9 2021/08/14 16:14:58 christos Exp $");
33 
34 #include "portable.h"
35 
36 #include <stdio.h>
37 #include <ac/stdlib.h>
38 #include <ac/string.h>
39 #include <ac/time.h>
40 #include <ac/unistd.h>
41 #include <ac/param.h>
42 
43 #ifdef SLAPD_CRYPT
44 # include <ac/crypt.h>
45 
46 # if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
47 #  ifdef HAVE_SHADOW_H
48 #	include <shadow.h>
49 #  endif
50 #  ifdef HAVE_PWD_H
51 #	include <pwd.h>
52 #  endif
53 #  ifdef HAVE_AIX_SECURITY
54 #	include <userpw.h>
55 #  endif
56 # endif
57 #endif
58 
59 #include <lber.h>
60 
61 #include "ldap_pvt.h"
62 #include "lber_pvt.h"
63 
64 #include "lutil_md5.h"
65 #include "lutil_sha1.h"
66 #include "lutil.h"
67 
68 static const unsigned char crypt64[] =
69 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890./";
70 
71 #ifdef SLAPD_CRYPT
72 static char *salt_format = NULL;
73 static lutil_cryptfunc lutil_crypt;
74 lutil_cryptfunc *lutil_cryptptr = lutil_crypt;
75 #endif
76 
77 /* KLUDGE:
78  *  chk_fn is NULL iff name is {CLEARTEXT}
79  *	otherwise, things will break
80  */
81 struct pw_scheme {
82 	struct berval name;
83 	LUTIL_PASSWD_CHK_FUNC *chk_fn;
84 	LUTIL_PASSWD_HASH_FUNC *hash_fn;
85 };
86 
87 struct pw_slist {
88 	struct pw_slist *next;
89 	struct pw_scheme s;
90 };
91 
92 /* password check routines */
93 
94 #define	SALT_SIZE	4
95 
96 static LUTIL_PASSWD_CHK_FUNC chk_md5;
97 static LUTIL_PASSWD_CHK_FUNC chk_smd5;
98 static LUTIL_PASSWD_HASH_FUNC hash_smd5;
99 static LUTIL_PASSWD_HASH_FUNC hash_md5;
100 
101 
102 #ifdef LUTIL_SHA1_BYTES
103 static LUTIL_PASSWD_CHK_FUNC chk_ssha1;
104 static LUTIL_PASSWD_CHK_FUNC chk_sha1;
105 static LUTIL_PASSWD_HASH_FUNC hash_sha1;
106 static LUTIL_PASSWD_HASH_FUNC hash_ssha1;
107 #endif
108 
109 
110 #ifdef SLAPD_CRYPT
111 static LUTIL_PASSWD_CHK_FUNC chk_crypt;
112 static LUTIL_PASSWD_HASH_FUNC hash_crypt;
113 
114 #if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
115 static LUTIL_PASSWD_CHK_FUNC chk_unix;
116 #endif
117 #endif
118 
119 /* password hash routines */
120 
121 #ifdef SLAPD_CLEARTEXT
122 static LUTIL_PASSWD_HASH_FUNC hash_clear;
123 #endif
124 
125 static struct pw_slist *pw_schemes;
126 static int pw_inited;
127 
128 static const struct pw_scheme pw_schemes_default[] =
129 {
130 #ifdef LUTIL_SHA1_BYTES
131 	{ BER_BVC("{SSHA}"),		chk_ssha1, hash_ssha1 },
132 	{ BER_BVC("{SHA}"),			chk_sha1, hash_sha1 },
133 #endif
134 
135 	{ BER_BVC("{SMD5}"),		chk_smd5, hash_smd5 },
136 	{ BER_BVC("{MD5}"),			chk_md5, hash_md5 },
137 
138 #ifdef SLAPD_CRYPT
139 	{ BER_BVC("{CRYPT}"),		chk_crypt, hash_crypt },
140 # if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
141 	{ BER_BVC("{UNIX}"),		chk_unix, NULL },
142 # endif
143 #endif
144 
145 #ifdef SLAPD_CLEARTEXT
146 	/* pseudo scheme */
147 	{ BER_BVC("{CLEARTEXT}"),	NULL, hash_clear },
148 #endif
149 
150 	{ BER_BVNULL, NULL, NULL }
151 };
152 
lutil_passwd_add(struct berval * scheme,LUTIL_PASSWD_CHK_FUNC * chk,LUTIL_PASSWD_HASH_FUNC * hash)153 int lutil_passwd_add(
154 	struct berval *scheme,
155 	LUTIL_PASSWD_CHK_FUNC *chk,
156 	LUTIL_PASSWD_HASH_FUNC *hash )
157 {
158 	struct pw_slist *ptr;
159 
160 	if (!pw_inited) lutil_passwd_init();
161 
162 	ptr = ber_memalloc( sizeof( struct pw_slist ));
163 	if (!ptr) return -1;
164 	ptr->next = pw_schemes;
165 	ptr->s.name = *scheme;
166 	ptr->s.chk_fn = chk;
167 	ptr->s.hash_fn = hash;
168 	pw_schemes = ptr;
169 	return 0;
170 }
171 
lutil_passwd_init()172 void lutil_passwd_init()
173 {
174 	struct pw_scheme *s;
175 
176 	pw_inited = 1;
177 
178 	for( s=(struct pw_scheme *)pw_schemes_default; s->name.bv_val; s++) {
179 		if ( lutil_passwd_add( &s->name, s->chk_fn, s->hash_fn ) ) break;
180 	}
181 }
182 
lutil_passwd_destroy()183 void lutil_passwd_destroy()
184 {
185 	struct pw_slist *ptr, *next;
186 
187 	for( ptr=pw_schemes; ptr; ptr=next ) {
188 		next = ptr->next;
189 		ber_memfree( ptr );
190 	}
191 }
192 
get_scheme(const char * scheme)193 static const struct pw_scheme *get_scheme(
194 	const char* scheme )
195 {
196 	struct pw_slist *pws;
197 	struct berval bv;
198 
199 	if (!pw_inited) lutil_passwd_init();
200 
201 	bv.bv_val = strchr( scheme, '}' );
202 	if ( !bv.bv_val )
203 		return NULL;
204 
205 	bv.bv_len = bv.bv_val - scheme + 1;
206 	bv.bv_val = (char *) scheme;
207 
208 	for( pws=pw_schemes; pws; pws=pws->next ) {
209 		if ( ber_bvstrcasecmp(&bv, &pws->s.name ) == 0 ) {
210 			return &(pws->s);
211 		}
212 	}
213 
214 	return NULL;
215 }
216 
lutil_passwd_scheme(const char * scheme)217 int lutil_passwd_scheme(
218 	const char* scheme )
219 {
220 	if( scheme == NULL ) {
221 		return 0;
222 	}
223 
224 	return get_scheme(scheme) != NULL;
225 }
226 
227 
is_allowed_scheme(const char * scheme,const char ** schemes)228 static int is_allowed_scheme(
229 	const char* scheme,
230 	const char** schemes )
231 {
232 	int i;
233 
234 	if( schemes == NULL ) return 1;
235 
236 	for( i=0; schemes[i] != NULL; i++ ) {
237 		if( strcasecmp( scheme, schemes[i] ) == 0 ) {
238 			return 1;
239 		}
240 	}
241 	return 0;
242 }
243 
passwd_scheme(const struct pw_scheme * scheme,const struct berval * passwd,struct berval * bv,const char ** allowed)244 static struct berval *passwd_scheme(
245 	const struct pw_scheme *scheme,
246 	const struct berval * passwd,
247 	struct berval *bv,
248 	const char** allowed )
249 {
250 	if( !is_allowed_scheme( scheme->name.bv_val, allowed ) ) {
251 		return NULL;
252 	}
253 
254 	if( passwd->bv_len >= scheme->name.bv_len ) {
255 		if( strncasecmp( passwd->bv_val, scheme->name.bv_val, scheme->name.bv_len ) == 0 ) {
256 			bv->bv_val = &passwd->bv_val[scheme->name.bv_len];
257 			bv->bv_len = passwd->bv_len - scheme->name.bv_len;
258 
259 			return bv;
260 		}
261 	}
262 
263 	return NULL;
264 }
265 
266 /*
267  * Return 0 if creds are good.
268  */
269 int
lutil_passwd(const struct berval * passwd,const struct berval * cred,const char ** schemes,const char ** text)270 lutil_passwd(
271 	const struct berval *passwd,	/* stored passwd */
272 	const struct berval *cred,		/* user cred */
273 	const char **schemes,
274 	const char **text )
275 {
276 	struct pw_slist *pws;
277 
278 	if ( text ) *text = NULL;
279 
280 	if (cred == NULL || cred->bv_len == 0 ||
281 		passwd == NULL || passwd->bv_len == 0 )
282 	{
283 		return -1;
284 	}
285 
286 	if (!pw_inited) lutil_passwd_init();
287 
288 	for( pws=pw_schemes; pws; pws=pws->next ) {
289 		if( pws->s.chk_fn ) {
290 			struct berval x;
291 			struct berval *p = passwd_scheme( &(pws->s),
292 				passwd, &x, schemes );
293 
294 			if( p != NULL ) {
295 				return (pws->s.chk_fn)( &(pws->s.name), p, cred, text );
296 			}
297 		}
298 	}
299 
300 #ifdef SLAPD_CLEARTEXT
301 	/* Do we think there is a scheme specifier here that we
302 	 * didn't recognize? Assume a scheme name is at least 1 character.
303 	 */
304 	if (( passwd->bv_val[0] == '{' ) &&
305 		( ber_bvchr( passwd, '}' ) > passwd->bv_val+1 ))
306 	{
307 		return 1;
308 	}
309 	if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) {
310 		return ( passwd->bv_len == cred->bv_len ) ?
311 			memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
312 			: 1;
313 	}
314 #endif
315 	return 1;
316 }
317 
lutil_passwd_generate(struct berval * pw,ber_len_t len)318 int lutil_passwd_generate( struct berval *pw, ber_len_t len )
319 {
320 
321 	if( len < 1 ) return -1;
322 
323 	pw->bv_len = len;
324 	pw->bv_val = ber_memalloc( len + 1 );
325 
326 	if( pw->bv_val == NULL ) {
327 		return -1;
328 	}
329 
330 	if( lutil_entropy( (unsigned char *) pw->bv_val, pw->bv_len) < 0 ) {
331 		return -1;
332 	}
333 
334 	for( len = 0; len < pw->bv_len; len++ ) {
335 		pw->bv_val[len] = crypt64[
336 			pw->bv_val[len] % (sizeof(crypt64)-1) ];
337 	}
338 
339 	pw->bv_val[len] = '\0';
340 
341 	return 0;
342 }
343 
lutil_passwd_hash(const struct berval * passwd,const char * method,struct berval * hash,const char ** text)344 int lutil_passwd_hash(
345 	const struct berval * passwd,
346 	const char * method,
347 	struct berval *hash,
348 	const char **text )
349 {
350 	const struct pw_scheme *sc = get_scheme( method );
351 
352 	hash->bv_val = NULL;
353 	hash->bv_len = 0;
354 
355 	if( sc == NULL ) {
356 		if( text ) *text = "scheme not recognized";
357 		return -1;
358 	}
359 
360 	if( ! sc->hash_fn ) {
361 		if( text ) *text = "scheme provided no hash function";
362 		return -1;
363 	}
364 
365 	if( text ) *text = NULL;
366 
367 	return (sc->hash_fn)( &sc->name, passwd, hash, text );
368 }
369 
370 /* pw_string is only called when SLAPD_CRYPT is defined */
371 #if defined(SLAPD_CRYPT)
pw_string(const struct berval * sc,struct berval * passwd)372 static int pw_string(
373 	const struct berval *sc,
374 	struct berval *passwd )
375 {
376 	struct berval pw;
377 
378 	pw.bv_len = sc->bv_len + passwd->bv_len;
379 	pw.bv_val = ber_memalloc( pw.bv_len + 1 );
380 
381 	if( pw.bv_val == NULL ) {
382 		return LUTIL_PASSWD_ERR;
383 	}
384 
385 	AC_MEMCPY( pw.bv_val, sc->bv_val, sc->bv_len );
386 	AC_MEMCPY( &pw.bv_val[sc->bv_len], passwd->bv_val, passwd->bv_len );
387 
388 	pw.bv_val[pw.bv_len] = '\0';
389 	*passwd = pw;
390 
391 	return LUTIL_PASSWD_OK;
392 }
393 #endif /* SLAPD_CRYPT */
394 
lutil_passwd_string64(const struct berval * sc,const struct berval * hash,struct berval * b64,const struct berval * salt)395 int lutil_passwd_string64(
396 	const struct berval *sc,
397 	const struct berval *hash,
398 	struct berval *b64,
399 	const struct berval *salt )
400 {
401 	int rc;
402 	struct berval string;
403 	size_t b64len;
404 
405 	if( salt ) {
406 		/* need to base64 combined string */
407 		string.bv_len = hash->bv_len + salt->bv_len;
408 		string.bv_val = ber_memalloc( string.bv_len + 1 );
409 
410 		if( string.bv_val == NULL ) {
411 			return LUTIL_PASSWD_ERR;
412 		}
413 
414 		AC_MEMCPY( string.bv_val, hash->bv_val,
415 			hash->bv_len );
416 		AC_MEMCPY( &string.bv_val[hash->bv_len], salt->bv_val,
417 			salt->bv_len );
418 		string.bv_val[string.bv_len] = '\0';
419 
420 	} else {
421 		string = *hash;
422 	}
423 
424 	b64len = LUTIL_BASE64_ENCODE_LEN( string.bv_len ) + 1;
425 	b64->bv_len = b64len + sc->bv_len;
426 	b64->bv_val = ber_memalloc( b64->bv_len + 1 );
427 
428 	if( b64->bv_val == NULL ) {
429 		if( salt ) ber_memfree( string.bv_val );
430 		return LUTIL_PASSWD_ERR;
431 	}
432 
433 	AC_MEMCPY(b64->bv_val, sc->bv_val, sc->bv_len);
434 
435 	rc = lutil_b64_ntop(
436 		(unsigned char *) string.bv_val, string.bv_len,
437 		&b64->bv_val[sc->bv_len], b64len );
438 
439 	if( salt ) ber_memfree( string.bv_val );
440 
441 	if( rc < 0 ) {
442 		return LUTIL_PASSWD_ERR;
443 	}
444 
445 	/* recompute length */
446 	b64->bv_len = sc->bv_len + rc;
447 	assert( strlen(b64->bv_val) == b64->bv_len );
448 	return LUTIL_PASSWD_OK;
449 }
450 
451 /* PASSWORD CHECK ROUTINES */
452 
453 #ifdef LUTIL_SHA1_BYTES
chk_ssha1(const struct berval * sc,const struct berval * passwd,const struct berval * cred,const char ** text)454 static int chk_ssha1(
455 	const struct berval *sc,
456 	const struct berval * passwd,
457 	const struct berval * cred,
458 	const char **text )
459 {
460 	lutil_SHA1_CTX SHA1context;
461 	unsigned char SHA1digest[LUTIL_SHA1_BYTES];
462 	int rc;
463 	unsigned char *orig_pass = NULL;
464 	size_t decode_len = LUTIL_BASE64_DECODE_LEN(passwd->bv_len);
465 
466 	/* safety check -- must have some salt */
467 	if (decode_len <= sizeof(SHA1digest)) {
468 		return LUTIL_PASSWD_ERR;
469 	}
470 
471 	/* decode base64 password */
472 	orig_pass = (unsigned char *) ber_memalloc(decode_len + 1);
473 
474 	if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
475 
476 	rc = lutil_b64_pton(passwd->bv_val, orig_pass, decode_len);
477 
478 	/* safety check -- must have some salt */
479 	if (rc <= (int)(sizeof(SHA1digest))) {
480 		ber_memfree(orig_pass);
481 		return LUTIL_PASSWD_ERR;
482 	}
483 
484 	/* hash credentials with salt */
485 	lutil_SHA1Init(&SHA1context);
486 	lutil_SHA1Update(&SHA1context,
487 		(const unsigned char *) cred->bv_val, cred->bv_len);
488 	lutil_SHA1Update(&SHA1context,
489 		(const unsigned char *) &orig_pass[sizeof(SHA1digest)],
490 		rc - sizeof(SHA1digest));
491 	lutil_SHA1Final(SHA1digest, &SHA1context);
492 
493 	/* compare */
494 	rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
495 	ber_memfree(orig_pass);
496 	return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
497 }
498 
chk_sha1(const struct berval * sc,const struct berval * passwd,const struct berval * cred,const char ** text)499 static int chk_sha1(
500 	const struct berval *sc,
501 	const struct berval * passwd,
502 	const struct berval * cred,
503 	const char **text )
504 {
505 	lutil_SHA1_CTX SHA1context;
506 	unsigned char SHA1digest[LUTIL_SHA1_BYTES];
507 	int rc;
508 	unsigned char *orig_pass = NULL;
509 	size_t decode_len = LUTIL_BASE64_DECODE_LEN(passwd->bv_len);
510 
511 	/* safety check */
512 	if (decode_len < sizeof(SHA1digest)) {
513 		return LUTIL_PASSWD_ERR;
514 	}
515 
516 	/* base64 un-encode password */
517 	orig_pass = (unsigned char *) ber_memalloc(decode_len + 1);
518 
519 	if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
520 
521 	rc = lutil_b64_pton(passwd->bv_val, orig_pass, decode_len);
522 
523 	if( rc != sizeof(SHA1digest) ) {
524 		ber_memfree(orig_pass);
525 		return LUTIL_PASSWD_ERR;
526 	}
527 
528 	/* hash credentials with salt */
529 	lutil_SHA1Init(&SHA1context);
530 	lutil_SHA1Update(&SHA1context,
531 		(const unsigned char *) cred->bv_val, cred->bv_len);
532 	lutil_SHA1Final(SHA1digest, &SHA1context);
533 
534 	/* compare */
535 	rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
536 	ber_memfree(orig_pass);
537 	return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
538 }
539 #endif
540 
chk_smd5(const struct berval * sc,const struct berval * passwd,const struct berval * cred,const char ** text)541 static int chk_smd5(
542 	const struct berval *sc,
543 	const struct berval * passwd,
544 	const struct berval * cred,
545 	const char **text )
546 {
547 	lutil_MD5_CTX MD5context;
548 	unsigned char MD5digest[LUTIL_MD5_BYTES];
549 	int rc;
550 	unsigned char *orig_pass = NULL;
551 	size_t decode_len = LUTIL_BASE64_DECODE_LEN(passwd->bv_len);
552 
553 	/* safety check */
554 	if (decode_len <= sizeof(MD5digest)) {
555 		return LUTIL_PASSWD_ERR;
556 	}
557 
558 	/* base64 un-encode password */
559 	orig_pass = (unsigned char *) ber_memalloc(decode_len + 1);
560 
561 	if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
562 
563 	rc = lutil_b64_pton(passwd->bv_val, orig_pass, decode_len);
564 
565 	if (rc <= (int)(sizeof(MD5digest))) {
566 		ber_memfree(orig_pass);
567 		return LUTIL_PASSWD_ERR;
568 	}
569 
570 	/* hash credentials with salt */
571 	lutil_MD5Init(&MD5context);
572 	lutil_MD5Update(&MD5context,
573 		(const unsigned char *) cred->bv_val,
574 		cred->bv_len );
575 	lutil_MD5Update(&MD5context,
576 		&orig_pass[sizeof(MD5digest)],
577 		rc - sizeof(MD5digest));
578 	lutil_MD5Final(MD5digest, &MD5context);
579 
580 	/* compare */
581 	rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
582 	ber_memfree(orig_pass);
583 	return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
584 }
585 
chk_md5(const struct berval * sc,const struct berval * passwd,const struct berval * cred,const char ** text)586 static int chk_md5(
587 	const struct berval *sc,
588 	const struct berval * passwd,
589 	const struct berval * cred,
590 	const char **text )
591 {
592 	lutil_MD5_CTX MD5context;
593 	unsigned char MD5digest[LUTIL_MD5_BYTES];
594 	int rc;
595 	unsigned char *orig_pass = NULL;
596 	size_t decode_len = LUTIL_BASE64_DECODE_LEN(passwd->bv_len);
597 
598 	/* safety check */
599 	if (decode_len < sizeof(MD5digest)) {
600 		return LUTIL_PASSWD_ERR;
601 	}
602 
603 	/* base64 un-encode password */
604 	orig_pass = (unsigned char *) ber_memalloc(decode_len + 1);
605 
606 	if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
607 
608 	rc = lutil_b64_pton(passwd->bv_val, orig_pass, decode_len);
609 	if ( rc != sizeof(MD5digest) ) {
610 		ber_memfree(orig_pass);
611 		return LUTIL_PASSWD_ERR;
612 	}
613 
614 	/* hash credentials with salt */
615 	lutil_MD5Init(&MD5context);
616 	lutil_MD5Update(&MD5context,
617 		(const unsigned char *) cred->bv_val,
618 		cred->bv_len );
619 	lutil_MD5Final(MD5digest, &MD5context);
620 
621 	/* compare */
622 	rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
623 	ber_memfree(orig_pass);
624 	return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
625 }
626 
627 #ifdef SLAPD_CRYPT
lutil_crypt(const char * key,const char * salt,char ** hash)628 static int lutil_crypt(
629 	const char *key,
630 	const char *salt,
631 	char **hash )
632 {
633 	char *cr = crypt( key, salt );
634 	int rc;
635 
636 	if( cr == NULL || cr[0] == '\0' ) {
637 		/* salt must have been invalid */
638 		rc = LUTIL_PASSWD_ERR;
639 	} else {
640 		if ( hash ) {
641 			*hash = ber_strdup( cr );
642 			rc = LUTIL_PASSWD_OK;
643 		} else {
644 			rc = strcmp( salt, cr ) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
645 		}
646 	}
647 	return rc;
648 }
649 
chk_crypt(const struct berval * sc,const struct berval * passwd,const struct berval * cred,const char ** text)650 static int chk_crypt(
651 	const struct berval *sc,
652 	const struct berval * passwd,
653 	const struct berval * cred,
654 	const char **text )
655 {
656 	unsigned int i;
657 
658 	for( i=0; i<cred->bv_len; i++) {
659 		if(cred->bv_val[i] == '\0') {
660 			return LUTIL_PASSWD_ERR;	/* NUL character in password */
661 		}
662 	}
663 
664 	if( cred->bv_val[i] != '\0' ) {
665 		return LUTIL_PASSWD_ERR;	/* cred must behave like a string */
666 	}
667 
668 	if( passwd->bv_len < 2 ) {
669 		return LUTIL_PASSWD_ERR;	/* passwd must be at least two characters long */
670 	}
671 
672 	for( i=0; i<passwd->bv_len; i++) {
673 		if(passwd->bv_val[i] == '\0') {
674 			return LUTIL_PASSWD_ERR;	/* NUL character in password */
675 		}
676 	}
677 
678 	if( passwd->bv_val[i] != '\0' ) {
679 		return LUTIL_PASSWD_ERR;	/* passwd must behave like a string */
680 	}
681 
682 	return lutil_cryptptr( cred->bv_val, passwd->bv_val, NULL );
683 }
684 
685 # if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
chk_unix(const struct berval * sc,const struct berval * passwd,const struct berval * cred,const char ** text)686 static int chk_unix(
687 	const struct berval *sc,
688 	const struct berval * passwd,
689 	const struct berval * cred,
690 	const char **text )
691 {
692 	unsigned int i;
693 	char *pw;
694 
695 	for( i=0; i<cred->bv_len; i++) {
696 		if(cred->bv_val[i] == '\0') {
697 			return LUTIL_PASSWD_ERR;	/* NUL character in password */
698 		}
699 	}
700 	if( cred->bv_val[i] != '\0' ) {
701 		return LUTIL_PASSWD_ERR;	/* cred must behave like a string */
702 	}
703 
704 	for( i=0; i<passwd->bv_len; i++) {
705 		if(passwd->bv_val[i] == '\0') {
706 			return LUTIL_PASSWD_ERR;	/* NUL character in password */
707 		}
708 	}
709 
710 	if( passwd->bv_val[i] != '\0' ) {
711 		return LUTIL_PASSWD_ERR;	/* passwd must behave like a string */
712 	}
713 
714 	{
715 		struct passwd *pwd = getpwnam(passwd->bv_val);
716 
717 		if(pwd == NULL) {
718 			return LUTIL_PASSWD_ERR;	/* not found */
719 		}
720 
721 		pw = pwd->pw_passwd;
722 	}
723 #  ifdef HAVE_GETSPNAM
724 	{
725 		struct spwd *spwd = getspnam(passwd->bv_val);
726 
727 		if(spwd != NULL) {
728 			pw = spwd->sp_pwdp;
729 		}
730 	}
731 #  endif
732 #  ifdef HAVE_AIX_SECURITY
733 	{
734 		struct userpw *upw = getuserpw(passwd->bv_val);
735 
736 		if (upw != NULL) {
737 			pw = upw->upw_passwd;
738 		}
739 	}
740 #  endif
741 
742 	if( pw == NULL || pw[0] == '\0' || pw[1] == '\0' ) {
743 		/* password must must be at least two characters long */
744 		return LUTIL_PASSWD_ERR;
745 	}
746 
747 	return lutil_cryptptr( cred->bv_val, pw, NULL );
748 }
749 # endif
750 #endif
751 
752 /* PASSWORD GENERATION ROUTINES */
753 
754 #ifdef LUTIL_SHA1_BYTES
hash_ssha1(const struct berval * scheme,const struct berval * passwd,struct berval * hash,const char ** text)755 static int hash_ssha1(
756 	const struct berval *scheme,
757 	const struct berval  *passwd,
758 	struct berval *hash,
759 	const char **text )
760 {
761 	lutil_SHA1_CTX  SHA1context;
762 	unsigned char   SHA1digest[LUTIL_SHA1_BYTES];
763 	char            saltdata[SALT_SIZE];
764 	struct berval digest;
765 	struct berval salt;
766 
767 	digest.bv_val = (char *) SHA1digest;
768 	digest.bv_len = sizeof(SHA1digest);
769 	salt.bv_val = saltdata;
770 	salt.bv_len = sizeof(saltdata);
771 
772 	if( lutil_entropy( (unsigned char *) salt.bv_val, salt.bv_len) < 0 ) {
773 		return LUTIL_PASSWD_ERR;
774 	}
775 
776 	lutil_SHA1Init( &SHA1context );
777 	lutil_SHA1Update( &SHA1context,
778 		(const unsigned char *)passwd->bv_val, passwd->bv_len );
779 	lutil_SHA1Update( &SHA1context,
780 		(const unsigned char *)salt.bv_val, salt.bv_len );
781 	lutil_SHA1Final( SHA1digest, &SHA1context );
782 
783 	return lutil_passwd_string64( scheme, &digest, hash, &salt);
784 }
785 
hash_sha1(const struct berval * scheme,const struct berval * passwd,struct berval * hash,const char ** text)786 static int hash_sha1(
787 	const struct berval *scheme,
788 	const struct berval  *passwd,
789 	struct berval *hash,
790 	const char **text )
791 {
792 	lutil_SHA1_CTX  SHA1context;
793 	unsigned char   SHA1digest[LUTIL_SHA1_BYTES];
794 	struct berval digest;
795 	digest.bv_val = (char *) SHA1digest;
796 	digest.bv_len = sizeof(SHA1digest);
797 
798 	lutil_SHA1Init( &SHA1context );
799 	lutil_SHA1Update( &SHA1context,
800 		(const unsigned char *)passwd->bv_val, passwd->bv_len );
801 	lutil_SHA1Final( SHA1digest, &SHA1context );
802 
803 	return lutil_passwd_string64( scheme, &digest, hash, NULL);
804 }
805 #endif
806 
hash_smd5(const struct berval * scheme,const struct berval * passwd,struct berval * hash,const char ** text)807 static int hash_smd5(
808 	const struct berval *scheme,
809 	const struct berval  *passwd,
810 	struct berval *hash,
811 	const char **text )
812 {
813 	lutil_MD5_CTX   MD5context;
814 	unsigned char   MD5digest[LUTIL_MD5_BYTES];
815 	char            saltdata[SALT_SIZE];
816 	struct berval digest;
817 	struct berval salt;
818 
819 	digest.bv_val = (char *) MD5digest;
820 	digest.bv_len = sizeof(MD5digest);
821 	salt.bv_val = saltdata;
822 	salt.bv_len = sizeof(saltdata);
823 
824 	if( lutil_entropy( (unsigned char *) salt.bv_val, salt.bv_len) < 0 ) {
825 		return LUTIL_PASSWD_ERR;
826 	}
827 
828 	lutil_MD5Init( &MD5context );
829 	lutil_MD5Update( &MD5context,
830 		(const unsigned char *) passwd->bv_val, passwd->bv_len );
831 	lutil_MD5Update( &MD5context,
832 		(const unsigned char *) salt.bv_val, salt.bv_len );
833 	lutil_MD5Final( MD5digest, &MD5context );
834 
835 	return lutil_passwd_string64( scheme, &digest, hash, &salt );
836 }
837 
hash_md5(const struct berval * scheme,const struct berval * passwd,struct berval * hash,const char ** text)838 static int hash_md5(
839 	const struct berval *scheme,
840 	const struct berval  *passwd,
841 	struct berval *hash,
842 	const char **text )
843 {
844 	lutil_MD5_CTX   MD5context;
845 	unsigned char   MD5digest[LUTIL_MD5_BYTES];
846 
847 	struct berval digest;
848 
849 	digest.bv_val = (char *) MD5digest;
850 	digest.bv_len = sizeof(MD5digest);
851 
852 	lutil_MD5Init( &MD5context );
853 	lutil_MD5Update( &MD5context,
854 		(const unsigned char *) passwd->bv_val, passwd->bv_len );
855 	lutil_MD5Final( MD5digest, &MD5context );
856 
857 	return lutil_passwd_string64( scheme, &digest, hash, NULL );
858 ;
859 }
860 
861 #ifdef SLAPD_CRYPT
hash_crypt(const struct berval * scheme,const struct berval * passwd,struct berval * hash,const char ** text)862 static int hash_crypt(
863 	const struct berval *scheme,
864 	const struct berval *passwd,
865 	struct berval *hash,
866 	const char **text )
867 {
868 	unsigned char salt[32];	/* salt suitable for most anything */
869 	unsigned int i;
870 	char *save;
871 	int rc;
872 
873 	for( i=0; i<passwd->bv_len; i++) {
874 		if(passwd->bv_val[i] == '\0') {
875 			return LUTIL_PASSWD_ERR;	/* NUL character in password */
876 		}
877 	}
878 
879 	if( passwd->bv_val[i] != '\0' ) {
880 		return LUTIL_PASSWD_ERR;	/* passwd must behave like a string */
881 	}
882 
883 	if( lutil_entropy( salt, sizeof( salt ) ) < 0 ) {
884 		return LUTIL_PASSWD_ERR;
885 	}
886 
887 	for( i=0; i< ( sizeof(salt) - 1 ); i++ ) {
888 		salt[i] = crypt64[ salt[i] % (sizeof(crypt64)-1) ];
889 	}
890 	salt[sizeof( salt ) - 1 ] = '\0';
891 
892 	if( salt_format != NULL ) {
893 		/* copy the salt we made into entropy before snprintfing
894 		   it back into the salt */
895 		char entropy[sizeof(salt)];
896 		strcpy( entropy, (char *) salt );
897 		snprintf( (char *) salt, sizeof(entropy), salt_format, entropy );
898 	}
899 
900 	rc = lutil_cryptptr( passwd->bv_val, (char *) salt, &hash->bv_val );
901 	if ( rc != LUTIL_PASSWD_OK ) return rc;
902 
903 	if( hash->bv_val == NULL ) return -1;
904 
905 	hash->bv_len = strlen( hash->bv_val );
906 
907 	save = hash->bv_val;
908 
909 	if( hash->bv_len == 0 ) {
910 		rc = LUTIL_PASSWD_ERR;
911 	} else {
912 		rc = pw_string( scheme, hash );
913 	}
914 	ber_memfree( save );
915 	return rc;
916 }
917 #endif
918 
lutil_salt_format(const char * format)919 int lutil_salt_format(const char *format)
920 {
921 #ifdef SLAPD_CRYPT
922 	ber_memfree( salt_format );
923 
924 	salt_format = format != NULL ? ber_strdup( format ) : NULL;
925 #endif
926 
927 	return 0;
928 }
929 
930 #ifdef SLAPD_CLEARTEXT
hash_clear(const struct berval * scheme,const struct berval * passwd,struct berval * hash,const char ** text)931 static int hash_clear(
932 	const struct berval *scheme,
933 	const struct berval  *passwd,
934 	struct berval *hash,
935 	const char **text )
936 {
937 	ber_dupbv( hash, (struct berval *)passwd );
938 	return LUTIL_PASSWD_OK;
939 }
940 #endif
941 
942