3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
8 * const struct berval *passwd,
9 * const struct berval *cred,
10 * const char **schemes )
12 * Returns true if user supplied credentials (cred) matches
13 * the stored password (passwd).
15 * Due to the use of the crypt(3) function
16 * this routine is NOT thread-safe.
22 #include <ac/stdlib.h>
23 #include <ac/string.h>
24 #include <ac/unistd.h>
27 # include <openssl/des.h>
28 #endif /* SLAPD_LMHASH */
42 # include <ac/crypt.h>
44 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
51 # ifdef HAVE_AIX_SECURITY
61 #include "lutil_md5.h"
62 #include "lutil_sha1.h"
65 static const unsigned char crypt64[] =
66 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890./";
70 typedef int (*PASSWD_CHK_FUNC)(
71 const struct pw_scheme *scheme,
72 const struct berval *passwd,
73 const struct berval *cred );
75 typedef struct berval * (*PASSWD_HASH_FUNC) (
76 const struct pw_scheme *scheme,
77 const struct berval *passwd );
81 PASSWD_CHK_FUNC chk_fn;
82 PASSWD_HASH_FUNC hash_fn;
85 /* password check routines */
87 const struct pw_scheme *scheme,
88 const struct berval *passwd,
89 const struct berval *cred );
92 const struct pw_scheme *scheme,
93 const struct berval *passwd,
94 const struct berval *cred );
97 const struct pw_scheme *scheme,
98 const struct berval *passwd,
99 const struct berval *cred );
102 const struct pw_scheme *scheme,
103 const struct berval *passwd,
104 const struct berval *cred );
107 static int chk_lanman(
108 const struct pw_scheme *scheme,
109 const struct berval *passwd,
110 const struct berval *cred );
115 const struct pw_scheme *scheme,
116 const struct berval *passwd,
117 const struct berval *cred );
121 static int chk_kerberos(
122 const struct pw_scheme *scheme,
123 const struct berval *passwd,
124 const struct berval *cred );
128 static int chk_crypt(
129 const struct pw_scheme *scheme,
130 const struct berval *passwd,
131 const struct berval *cred );
133 #if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
135 const struct pw_scheme *scheme,
136 const struct berval *passwd,
137 const struct berval *cred );
142 /* password hash routines */
143 static struct berval *hash_sha1(
144 const struct pw_scheme *scheme,
145 const struct berval *passwd );
147 static struct berval *hash_ssha1(
148 const struct pw_scheme *scheme,
149 const struct berval *passwd );
151 static struct berval *hash_smd5(
152 const struct pw_scheme *scheme,
153 const struct berval *passwd );
155 static struct berval *hash_md5(
156 const struct pw_scheme *scheme,
157 const struct berval *passwd );
160 static struct berval *hash_lanman(
161 const struct pw_scheme *scheme,
162 const struct berval *passwd );
166 static struct berval *hash_crypt(
167 const struct pw_scheme *scheme,
168 const struct berval *passwd );
172 static const struct pw_scheme pw_schemes[] =
174 { {sizeof("{SSHA}")-1, "{SSHA}"}, chk_ssha1, hash_ssha1 },
175 { {sizeof("{SHA}")-1, "{SHA}"}, chk_sha1, hash_sha1 },
177 { {sizeof("{SMD5}")-1, "{SMD5}"}, chk_smd5, hash_smd5 },
178 { {sizeof("{MD5}")-1, "{MD5}"}, chk_md5, hash_md5 },
181 { {sizeof("{LANMAN}")-1, "{LANMAN}"}, chk_lanman, hash_lanman },
182 #endif /* SLAPD_LMHASH */
185 { {sizeof("{SASL}")-1, "{SASL}"}, chk_sasl, NULL },
189 { {sizeof("{KERBEROS}")-1, "{KERBEROS}"}, chk_kerberos, NULL },
193 { {sizeof("{CRYPT}")-1, "{CRYPT}"}, chk_crypt, hash_crypt },
194 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
195 { {sizeof("{UNIX}")-1, "{UNIX}"}, chk_unix, NULL },
199 #ifdef SLAPD_CLEARTEXT
201 { {0, "{CLEARTEXT}"}, NULL, NULL },
204 { {0, NULL}, NULL, NULL }
207 static const struct pw_scheme *get_scheme(
212 for( i=0; pw_schemes[i].name.bv_val; i++) {
213 if( pw_schemes[i].name.bv_len == 0 ) continue;
215 if( strncasecmp(scheme, pw_schemes[i].name.bv_val,
216 pw_schemes[i].name.bv_len) == 0 )
218 return &pw_schemes[i];
225 int lutil_passwd_scheme(
228 if( scheme == NULL ) {
232 return get_scheme(scheme) != NULL;
236 static int is_allowed_scheme(
238 const char** schemes )
242 if( schemes == NULL ) return 1;
244 for( i=0; schemes[i] != NULL; i++ ) {
245 if( strcasecmp( scheme, schemes[i] ) == 0 ) {
252 static struct berval *passwd_scheme(
253 const struct pw_scheme *scheme,
254 const struct berval * passwd,
255 const char** allowed )
257 if( !is_allowed_scheme( scheme->name.bv_val, allowed ) ) {
261 if( passwd->bv_len >= scheme->name.bv_len ) {
262 if( strncasecmp( passwd->bv_val, scheme->name.bv_val, scheme->name.bv_len ) == 0 ) {
263 struct berval *bv = ber_memalloc( sizeof(struct berval) );
265 if( bv == NULL ) return NULL;
267 bv->bv_val = &passwd->bv_val[scheme->name.bv_len];
268 bv->bv_len = passwd->bv_len - scheme->name.bv_len;
278 * Return 0 if creds are good.
282 const struct berval *passwd, /* stored passwd */
283 const struct berval *cred, /* user cred */
284 const char **schemes )
288 if (cred == NULL || cred->bv_len == 0 ||
289 passwd == NULL || passwd->bv_len == 0 )
294 for( i=0; pw_schemes[i].name.bv_val != NULL; i++ ) {
295 if( pw_schemes[i].chk_fn ) {
296 struct berval *p = passwd_scheme( &pw_schemes[i],
300 int rc = (pw_schemes[i].chk_fn)( &pw_schemes[i], p, cred );
302 /* only free the berval structure as the bv_val points
303 * into passwd->bv_val
312 #ifdef SLAPD_CLEARTEXT
313 if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) {
314 return passwd->bv_len == cred->bv_len
315 ? memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
322 struct berval * lutil_passwd_generate( ber_len_t len )
326 if( len < 1 ) return NULL;
328 pw = ber_memalloc( sizeof( struct berval ) );
329 if( pw == NULL ) return NULL;
332 pw->bv_val = ber_memalloc( len + 1 );
334 if( pw->bv_val == NULL ) {
339 if( lutil_entropy( pw->bv_val, pw->bv_len) < 0 ) {
344 for( len = 0; len < pw->bv_len; len++ ) {
345 pw->bv_val[len] = crypt64[
346 pw->bv_val[len] % (sizeof(crypt64)-1) ];
349 pw->bv_val[len] = '\0';
354 struct berval * lutil_passwd_hash(
355 const struct berval * passwd,
356 const char * method )
358 const struct pw_scheme *sc = get_scheme( method );
360 if( sc == NULL ) return NULL;
361 if( ! sc->hash_fn ) return NULL;
363 return (sc->hash_fn)( sc, passwd );
366 static struct berval * pw_string(
367 const struct pw_scheme *sc,
368 const struct berval *passwd )
370 struct berval *pw = ber_memalloc( sizeof( struct berval ) );
371 if( pw == NULL ) return NULL;
373 pw->bv_len = sc->name.bv_len + passwd->bv_len;
374 pw->bv_val = ber_memalloc( pw->bv_len + 1 );
376 if( pw->bv_val == NULL ) {
381 AC_MEMCPY( pw->bv_val, sc->name.bv_val, sc->name.bv_len );
382 AC_MEMCPY( &pw->bv_val[sc->name.bv_len], passwd->bv_val, passwd->bv_len );
384 pw->bv_val[pw->bv_len] = '\0';
388 static struct berval * pw_string64(
389 const struct pw_scheme *sc,
390 const struct berval *hash,
391 const struct berval *salt )
394 struct berval string;
395 struct berval *b64 = ber_memalloc( sizeof(struct berval) );
398 if( b64 == NULL ) return NULL;
401 /* need to base64 combined string */
402 string.bv_len = hash->bv_len + salt->bv_len;
403 string.bv_val = ber_memalloc( string.bv_len + 1 );
405 if( string.bv_val == NULL ) {
410 AC_MEMCPY( string.bv_val, hash->bv_val,
412 AC_MEMCPY( &string.bv_val[hash->bv_len], salt->bv_val,
414 string.bv_val[string.bv_len] = '\0';
420 b64len = LUTIL_BASE64_ENCODE_LEN( string.bv_len ) + 1;
421 b64->bv_len = b64len + sc->name.bv_len;
422 b64->bv_val = ber_memalloc( b64->bv_len + 1 );
424 if( b64->bv_val == NULL ) {
425 if( salt ) ber_memfree( string.bv_val );
430 AC_MEMCPY(b64->bv_val, sc->name.bv_val, sc->name.bv_len);
433 string.bv_val, string.bv_len,
434 &b64->bv_val[sc->name.bv_len], b64len );
436 if( salt ) ber_memfree( string.bv_val );
443 /* recompute length */
444 b64->bv_len = sc->name.bv_len + rc;
445 assert( strlen(b64->bv_val) == b64->bv_len );
449 /* PASSWORD CHECK ROUTINES */
451 static int chk_ssha1(
452 const struct pw_scheme *sc,
453 const struct berval * passwd,
454 const struct berval * cred )
456 lutil_SHA1_CTX SHA1context;
457 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
459 unsigned char *orig_pass = NULL;
461 /* decode base64 password */
462 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
463 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
465 if( orig_pass == NULL ) return -1;
467 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
470 ber_memfree(orig_pass);
474 /* hash credentials with salt */
475 lutil_SHA1Init(&SHA1context);
476 lutil_SHA1Update(&SHA1context,
477 (const unsigned char *) cred->bv_val, cred->bv_len);
478 lutil_SHA1Update(&SHA1context,
479 (const unsigned char *) &orig_pass[sizeof(SHA1digest)],
480 rc - sizeof(SHA1digest));
481 lutil_SHA1Final(SHA1digest, &SHA1context);
484 rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
485 ber_memfree(orig_pass);
490 const struct pw_scheme *sc,
491 const struct berval * passwd,
492 const struct berval * cred )
494 lutil_SHA1_CTX SHA1context;
495 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
497 unsigned char *orig_pass = NULL;
499 /* base64 un-encode password */
500 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
501 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
503 if( orig_pass == NULL ) return -1;
505 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
507 if( rc != sizeof(SHA1digest) ) {
508 ber_memfree(orig_pass);
512 /* hash credentials with salt */
513 lutil_SHA1Init(&SHA1context);
514 lutil_SHA1Update(&SHA1context,
515 (const unsigned char *) cred->bv_val, cred->bv_len);
516 lutil_SHA1Final(SHA1digest, &SHA1context);
519 rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
520 ber_memfree(orig_pass);
525 const struct pw_scheme *sc,
526 const struct berval * passwd,
527 const struct berval * cred )
529 lutil_MD5_CTX MD5context;
530 unsigned char MD5digest[LUTIL_MD5_BYTES];
532 unsigned char *orig_pass = NULL;
534 /* base64 un-encode password */
535 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
536 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
538 if( orig_pass == NULL ) return -1;
540 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
542 ber_memfree(orig_pass);
546 /* hash credentials with salt */
547 lutil_MD5Init(&MD5context);
548 lutil_MD5Update(&MD5context,
549 (const unsigned char *) cred->bv_val,
551 lutil_MD5Update(&MD5context,
552 &orig_pass[sizeof(MD5digest)],
553 rc - sizeof(MD5digest));
554 lutil_MD5Final(MD5digest, &MD5context);
557 rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
558 ber_memfree(orig_pass);
563 const struct pw_scheme *sc,
564 const struct berval * passwd,
565 const struct berval * cred )
567 lutil_MD5_CTX MD5context;
568 unsigned char MD5digest[LUTIL_MD5_BYTES];
570 unsigned char *orig_pass = NULL;
572 /* base64 un-encode password */
573 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
574 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
576 if( orig_pass == NULL ) return -1;
578 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
579 if ( rc != sizeof(MD5digest) ) {
580 ber_memfree(orig_pass);
584 /* hash credentials with salt */
585 lutil_MD5Init(&MD5context);
586 lutil_MD5Update(&MD5context,
587 (const unsigned char *) cred->bv_val,
589 lutil_MD5Final(MD5digest, &MD5context);
592 rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
593 ber_memfree(orig_pass);
598 static int chk_lanman(
599 const struct pw_scheme *scheme,
600 const struct berval *passwd,
601 const struct berval *cred )
605 hash = hash_lanman( scheme, cred );
606 return memcmp( &hash->bv_val[scheme->name.bv_len], passwd->bv_val, 32);
608 #endif /* SLAPD_LMHASH */
611 #ifdef HAVE_CYRUS_SASL
612 sasl_conn_t *lutil_passwd_sasl_conn = NULL;
616 const struct pw_scheme *sc,
617 const struct berval * passwd,
618 const struct berval * cred )
623 for( i=0; i<cred->bv_len; i++) {
624 if(cred->bv_val[i] == '\0') {
625 return 1; /* NUL character in password */
629 if( cred->bv_val[i] != '\0' ) {
630 return 1; /* cred must behave like a string */
633 for( i=0; i<passwd->bv_len; i++) {
634 if(passwd->bv_val[i] == '\0') {
635 return 1; /* NUL character in password */
639 if( passwd->bv_val[i] != '\0' ) {
640 return 1; /* passwd must behave like a string */
645 #ifdef HAVE_CYRUS_SASL
646 if( lutil_passwd_sasl_conn != NULL ) {
647 const char *errstr = NULL;
650 sc = sasl_checkpass( lutil_passwd_sasl_conn,
651 passwd->bv_val, passwd->bv_len,
652 cred->bv_val, cred->bv_len,
655 rtn = ( sc != SASL_OK );
664 static int chk_kerberos(
665 const struct pw_scheme *sc,
666 const struct berval * passwd,
667 const struct berval * cred )
672 for( i=0; i<cred->bv_len; i++) {
673 if(cred->bv_val[i] == '\0') {
674 return 1; /* NUL character in password */
678 if( cred->bv_val[i] != '\0' ) {
679 return 1; /* cred must behave like a string */
682 for( i=0; i<passwd->bv_len; i++) {
683 if(passwd->bv_val[i] == '\0') {
684 return 1; /* NUL character in password */
688 if( passwd->bv_val[i] != '\0' ) {
689 return 1; /* passwd must behave like a string */
694 #ifdef HAVE_KRB5 /* HAVE_HEIMDAL_KRB5 */
697 * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska H\xf6gskolan
698 * (Royal Institute of Technology, Stockholm, Sweden).
699 * All rights reserved.
701 * Redistribution and use in source and binary forms, with or without
702 * modification, are permitted provided that the following conditions
705 * 1. Redistributions of source code must retain the above copyright
706 * notice, this list of conditions and the following disclaimer.
708 * 2. Redistributions in binary form must reproduce the above copyright
709 * notice, this list of conditions and the following disclaimer in the
710 * documentation and/or other materials provided with the distribution.
712 * 3. Neither the name of the Institute nor the names of its contributors
713 * may be used to endorse or promote products derived from this software
714 * without specific prior written permission.
716 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
717 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
718 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
719 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
720 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
721 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
722 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
723 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
724 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
725 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
729 krb5_context context;
732 krb5_get_init_creds_opt get_options;
733 krb5_verify_init_creds_opt verify_options;
734 krb5_principal client, server;
736 krb5_preauthtype pre_auth_types[] = {KRB5_PADATA_ENC_TIMESTAMP};
739 ret = krb5_init_context( &context );
745 krb5_get_init_creds_opt_set_preauth_list(&get_options,
749 krb5_get_init_creds_opt_init( &get_options );
751 krb5_verify_init_creds_opt_init( &verify_options );
753 ret = krb5_parse_name( context, passwd->bv_val, &client );
756 krb5_free_context( context );
760 ret = krb5_get_init_creds_password( context,
761 &creds, client, cred->bv_val, NULL,
762 NULL, 0, NULL, &get_options );
765 krb5_free_principal( context, client );
766 krb5_free_context( context );
771 char *host = ldap_pvt_get_fqdn( NULL );
774 krb5_free_principal( context, client );
775 krb5_free_context( context );
779 ret = krb5_sname_to_principal( context,
780 host, "ldap", KRB5_NT_SRV_HST, &server );
786 krb5_free_principal( context, client );
787 krb5_free_context( context );
791 ret = krb5_verify_init_creds( context,
792 &creds, server, NULL, NULL, &verify_options );
794 krb5_free_principal( context, client );
795 krb5_free_principal( context, server );
796 krb5_free_cred_contents( context, &creds );
797 krb5_free_context( context );
801 #elif defined(HAVE_KRB4)
803 /* Borrowed from Heimdal kpopper */
805 * Copyright (c) 1989 Regents of the University of California.
806 * All rights reserved. The Berkeley software License Agreement
807 * specifies the terms and conditions for redistribution.
811 char lrealm[REALM_SZ];
812 char tkt[MAXHOSTNAMELEN];
814 status = krb_get_lrealm(lrealm,1);
815 if (status == KFAILURE) {
819 snprintf(tkt, sizeof(tkt), "%s_slapd.%u",
820 TKT_ROOT, (unsigned)getpid());
821 krb_set_tkt_string (tkt);
823 status = krb_verify_user( passwd->bv_val, "", lrealm,
824 cred->bv_val, 1, "ldap");
826 dest_tkt(); /* no point in keeping the tickets */
828 return status == KFAILURE;
834 #endif /* SLAPD_KPASSWD */
837 static int chk_crypt(
838 const struct pw_scheme *sc,
839 const struct berval * passwd,
840 const struct berval * cred )
845 for( i=0; i<cred->bv_len; i++) {
846 if(cred->bv_val[i] == '\0') {
847 return 1; /* NUL character in password */
851 if( cred->bv_val[i] != '\0' ) {
852 return -1; /* cred must behave like a string */
855 if( passwd->bv_len < 2 ) {
856 return -1; /* passwd must be at least two characters long */
859 for( i=0; i<passwd->bv_len; i++) {
860 if(passwd->bv_val[i] == '\0') {
861 return -1; /* NUL character in password */
865 if( passwd->bv_val[i] != '\0' ) {
866 return -1; /* passwd must behave like a string */
869 cr = crypt( cred->bv_val, passwd->bv_val );
871 if( cr == NULL || cr[0] == '\0' ) {
872 /* salt must have been invalid */
876 return strcmp( passwd->bv_val, cr ) ? 1 : 0;
879 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
881 const struct pw_scheme *sc,
882 const struct berval * passwd,
883 const struct berval * cred )
888 for( i=0; i<cred->bv_len; i++) {
889 if(cred->bv_val[i] == '\0') {
890 return -1; /* NUL character in password */
893 if( cred->bv_val[i] != '\0' ) {
894 return -1; /* cred must behave like a string */
897 for( i=0; i<passwd->bv_len; i++) {
898 if(passwd->bv_val[i] == '\0') {
899 return -1; /* NUL character in password */
903 if( passwd->bv_val[i] != '\0' ) {
904 return -1; /* passwd must behave like a string */
908 struct passwd *pwd = getpwnam(passwd->bv_val);
911 return -1; /* not found */
916 # ifdef HAVE_GETSPNAM
918 struct spwd *spwd = getspnam(passwd->bv_val);
925 # ifdef HAVE_AIX_SECURITY
927 struct userpw *upw = getuserpw(passwd->bv_val);
930 pw = upw->upw_passwd;
935 if( pw == NULL || pw[0] == '\0' || pw[1] == '\0' ) {
936 /* password must must be at least two characters long */
940 cr = crypt(cred->bv_val, pw);
942 if( cr == NULL || cr[0] == '\0' ) {
943 /* salt must have been invalid */
947 return strcmp(pw, cr) ? 1 : 0;
953 /* PASSWORD GENERATION ROUTINES */
955 static struct berval *hash_ssha1(
956 const struct pw_scheme *scheme,
957 const struct berval *passwd )
959 lutil_SHA1_CTX SHA1context;
960 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
961 unsigned char saltdata[4];
962 struct berval digest;
965 digest.bv_val = SHA1digest;
966 digest.bv_len = sizeof(SHA1digest);
967 salt.bv_val = saltdata;
968 salt.bv_len = sizeof(saltdata);
970 if( lutil_entropy( salt.bv_val, salt.bv_len) < 0 ) {
974 lutil_SHA1Init( &SHA1context );
975 lutil_SHA1Update( &SHA1context,
976 (const unsigned char *)passwd->bv_val, passwd->bv_len );
977 lutil_SHA1Update( &SHA1context,
978 (const unsigned char *)salt.bv_val, salt.bv_len );
979 lutil_SHA1Final( SHA1digest, &SHA1context );
981 return pw_string64( scheme, &digest, &salt);
984 static struct berval *hash_sha1(
985 const struct pw_scheme *scheme,
986 const struct berval *passwd )
988 lutil_SHA1_CTX SHA1context;
989 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
990 struct berval digest;
991 digest.bv_val = SHA1digest;
992 digest.bv_len = sizeof(SHA1digest);
994 lutil_SHA1Init( &SHA1context );
995 lutil_SHA1Update( &SHA1context,
996 (const unsigned char *)passwd->bv_val, passwd->bv_len );
997 lutil_SHA1Final( SHA1digest, &SHA1context );
999 return pw_string64( scheme, &digest, NULL);
1002 static struct berval *hash_smd5(
1003 const struct pw_scheme *scheme,
1004 const struct berval *passwd )
1006 lutil_MD5_CTX MD5context;
1007 unsigned char MD5digest[LUTIL_MD5_BYTES];
1008 unsigned char saltdata[4];
1009 struct berval digest;
1012 digest.bv_val = MD5digest;
1013 digest.bv_len = sizeof(MD5digest);
1014 salt.bv_val = saltdata;
1015 salt.bv_len = sizeof(saltdata);
1017 if( lutil_entropy( salt.bv_val, salt.bv_len) < 0 ) {
1021 lutil_MD5Init( &MD5context );
1022 lutil_MD5Update( &MD5context,
1023 (const unsigned char *) passwd->bv_val, passwd->bv_len );
1024 lutil_MD5Update( &MD5context,
1025 (const unsigned char *) salt.bv_val, salt.bv_len );
1026 lutil_MD5Final( MD5digest, &MD5context );
1028 return pw_string64( scheme, &digest, &salt );
1031 static struct berval *hash_md5(
1032 const struct pw_scheme *scheme,
1033 const struct berval *passwd )
1035 lutil_MD5_CTX MD5context;
1036 unsigned char MD5digest[LUTIL_MD5_BYTES];
1038 struct berval digest;
1040 digest.bv_val = MD5digest;
1041 digest.bv_len = sizeof(MD5digest);
1043 lutil_MD5Init( &MD5context );
1044 lutil_MD5Update( &MD5context,
1045 (const unsigned char *) passwd->bv_val, passwd->bv_len );
1046 lutil_MD5Final( MD5digest, &MD5context );
1048 return pw_string64( scheme, &digest, NULL );
1053 /* pseudocode from RFC2433
1054 * A.2 LmPasswordHash()
1057 * IN 0-to-14-oem-char Password,
1058 * OUT 16-octet PasswordHash )
1060 * Set UcasePassword to the uppercased Password
1061 * Zero pad UcasePassword to 14 characters
1063 * DesHash( 1st 7-octets of UcasePassword,
1064 * giving 1st 8-octets of PasswordHash )
1066 * DesHash( 2nd 7-octets of UcasePassword,
1067 * giving 2nd 8-octets of PasswordHash )
1075 * OUT 8-octet Cypher )
1078 * * Make Cypher an irreversibly encrypted form of Clear by
1079 * * encrypting known text using Clear as the secret key.
1080 * * The known text consists of the string
1085 * Set StdText to "KGS!@#$%"
1086 * DesEncrypt( StdText, Clear, giving Cypher )
1095 * OUT 8-octet Cypher )
1098 * * Use the DES encryption algorithm [4] in ECB mode [9]
1099 * * to encrypt Clear into Cypher such that Cypher can
1100 * * only be decrypted back to Clear by providing Key.
1101 * * Note that the DES algorithm takes as input a 64-bit
1102 * * stream where the 8th, 16th, 24th, etc. bits are
1103 * * parity bits ignored by the encrypting algorithm.
1104 * * Unless you write your own DES to accept 56-bit input
1105 * * without parity, you will need to insert the parity bits
1111 static void lmPasswd_to_key(
1112 const unsigned char *lmPasswd,
1115 /* make room for parity bits */
1116 ((char *)key)[0] = lmPasswd[0];
1117 ((char *)key)[1] = ((lmPasswd[0]&0x01)<<7) | (lmPasswd[1]>>1);
1118 ((char *)key)[2] = ((lmPasswd[1]&0x03)<<6) | (lmPasswd[2]>>2);
1119 ((char *)key)[3] = ((lmPasswd[2]&0x07)<<5) | (lmPasswd[3]>>3);
1120 ((char *)key)[4] = ((lmPasswd[3]&0x0F)<<4) | (lmPasswd[4]>>4);
1121 ((char *)key)[5] = ((lmPasswd[4]&0x1F)<<3) | (lmPasswd[5]>>5);
1122 ((char *)key)[6] = ((lmPasswd[5]&0x3F)<<2) | (lmPasswd[6]>>6);
1123 ((char *)key)[7] = ((lmPasswd[6]&0x7F)<<1);
1125 des_set_odd_parity( key );
1128 static struct berval *hash_lanman(
1129 const struct pw_scheme *scheme,
1130 const struct berval *passwd )
1134 char UcasePassword[15];
1136 des_key_schedule schedule;
1137 des_cblock StdText = "KGS!@#$%";
1138 des_cblock hash1, hash2;
1142 for( i=0; i<passwd->bv_len; i++) {
1143 if(passwd->bv_val[i] == '\0') {
1144 return NULL; /* NUL character in password */
1148 if( passwd->bv_val[i] != '\0' ) {
1149 return NULL; /* passwd must behave like a string */
1152 strncpy( UcasePassword, passwd->bv_val, 14 );
1153 UcasePassword[14] = '\0';
1154 ldap_pvt_str2upper( UcasePassword );
1156 lmPasswd_to_key( UcasePassword, &key );
1157 des_set_key_unchecked( &key, schedule );
1158 des_ecb_encrypt( &StdText, &hash1, schedule , DES_ENCRYPT );
1160 lmPasswd_to_key( &UcasePassword[7], &key );
1161 des_set_key_unchecked( &key, schedule );
1162 des_ecb_encrypt( &StdText, &hash2, schedule , DES_ENCRYPT );
1164 sprintf( lmhash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
1165 hash1[0],hash1[1],hash1[2],hash1[3],hash1[4],hash1[5],hash1[6],hash1[7],
1166 hash2[0],hash2[1],hash2[2],hash2[3],hash2[4],hash2[5],hash2[6],hash2[7] );
1168 hash.bv_val = lmhash;
1171 return pw_string( scheme, &hash );
1173 #endif /* SLAPD_LMHASH */
1176 static struct berval *hash_crypt(
1177 const struct pw_scheme *scheme,
1178 const struct berval *passwd )
1181 unsigned char salt[9]; /* salt suitable for anything */
1184 for( i=0; i<passwd->bv_len; i++) {
1185 if(passwd->bv_val[i] == '\0') {
1186 return NULL; /* NUL character in password */
1190 if( passwd->bv_val[i] != '\0' ) {
1191 return NULL; /* passwd must behave like a string */
1194 if( lutil_entropy( salt, 8) < 0 ) {
1198 for( i=0; i<8; i++ ) {
1199 salt[i] = crypt64[ salt[i] % (sizeof(crypt64)-1) ];
1203 hash.bv_val = crypt( passwd->bv_val, salt );
1205 if( hash.bv_val == NULL ) return NULL;
1207 hash.bv_len = strlen( hash.bv_val );
1209 if( hash.bv_len == 0 ) {
1213 return pw_string( scheme, &hash );