git.sur5r.net Git - openldap/blob - libraries/liblutil/passwd.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1998-2005 The OpenLDAP Foundation.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15
  16 /*
  17  * int lutil_passwd(
  18  *      const struct berval *passwd,
  19  *      const struct berval *cred,
  20  *      const char **schemes )
  21  *
  22  * Returns true if user supplied credentials (cred) matches
  23  * the stored password (passwd).
  24  *
  25  * Due to the use of the crypt(3) function
  26  * this routine is NOT thread-safe.
  27  */
  28
  29 #include "portable.h"
  30
  31 #include <stdio.h>
  32 #include <ac/stdlib.h>
  33 #include <ac/string.h>
  34 #include <ac/unistd.h>
  35
  36 #if defined(SLAPD_LMHASH)
  37 #       include <openssl/des.h>
  38 #endif /* SLAPD_LMHASH */
  39
  40 #include <ac/param.h>
  41
  42 #ifdef SLAPD_CRYPT
  43 # include <ac/crypt.h>
  44
  45 # if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
  46 #  ifdef HAVE_SHADOW_H
  47 #       include <shadow.h>
  48 #  endif
  49 #  ifdef HAVE_PWD_H
  50 #       include <pwd.h>
  51 #  endif
  52 #  ifdef HAVE_AIX_SECURITY
  53 #       include <userpw.h>
  54 #  endif
  55 # endif
  56 #endif
  57
  58 #include <lber.h>
  59
  60 #include "ldap_pvt.h"
  61 #include "lber_pvt.h"
  62
  63 #include "lutil_md5.h"
  64 #include "lutil_sha1.h"
  65 #include "lutil.h"
  66
  67 static const unsigned char crypt64[] =
  68         "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890./";
  69
  70 #ifdef SLAPD_CRYPT
  71 static char *salt_format = NULL;
  72 static lutil_cryptfunc lutil_crypt;
  73 lutil_cryptfunc *lutil_cryptptr = lutil_crypt;
  74 #endif
  75
  76 struct pw_scheme {
  77         struct berval name;
  78         LUTIL_PASSWD_CHK_FUNC *chk_fn;
  79         LUTIL_PASSWD_HASH_FUNC *hash_fn;
  80 };
  81
  82 struct pw_slist {
  83         struct pw_slist *next;
  84         struct pw_scheme s;
  85 };
  86
  87 /* password check routines */
  88
  89 #define SALT_SIZE       4
  90
  91 static LUTIL_PASSWD_CHK_FUNC chk_md5;
  92 static LUTIL_PASSWD_CHK_FUNC chk_smd5;
  93 static LUTIL_PASSWD_HASH_FUNC hash_smd5;
  94 static LUTIL_PASSWD_HASH_FUNC hash_md5;
  95
  96
  97 #ifdef LUTIL_SHA1_BYTES
  98 static LUTIL_PASSWD_CHK_FUNC chk_ssha1;
  99 static LUTIL_PASSWD_CHK_FUNC chk_sha1;
 100 static LUTIL_PASSWD_HASH_FUNC hash_sha1;
 101 static LUTIL_PASSWD_HASH_FUNC hash_ssha1;
 102 #endif
 103
 104 #ifdef SLAPD_LMHASH
 105 static LUTIL_PASSWD_CHK_FUNC chk_lanman;
 106 static LUTIL_PASSWD_HASH_FUNC hash_lanman;
 107 #endif
 108
 109 #ifdef SLAPD_CRYPT
 110 static LUTIL_PASSWD_CHK_FUNC chk_crypt;
 111 static LUTIL_PASSWD_HASH_FUNC hash_crypt;
 112
 113 #if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
 114 static LUTIL_PASSWD_CHK_FUNC chk_unix;
 115 #endif
 116 #endif
 117
 118 /* password hash routines */
 119
 120 #ifdef SLAPD_CLEARTEXT
 121 static LUTIL_PASSWD_HASH_FUNC hash_clear;
 122 #endif
 123
 124 static struct pw_slist *pw_schemes;
 125 static int pw_inited;
 126
 127 static const struct pw_scheme pw_schemes_default[] =
 128 {
 129 #ifdef LUTIL_SHA1_BYTES
 130         { BER_BVC("{SSHA}"),            chk_ssha1, hash_ssha1 },
 131         { BER_BVC("{SHA}"),                     chk_sha1, hash_sha1 },
 132 #endif
 133
 134         { BER_BVC("{SMD5}"),            chk_smd5, hash_smd5 },
 135         { BER_BVC("{MD5}"),                     chk_md5, hash_md5 },
 136
 137 #ifdef SLAPD_LMHASH
 138         { BER_BVC("{LANMAN}"),          chk_lanman, hash_lanman },
 139 #endif /* SLAPD_LMHASH */
 140
 141 #ifdef SLAPD_CRYPT
 142         { BER_BVC("{CRYPT}"),           chk_crypt, hash_crypt },
 143 # if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
 144         { BER_BVC("{UNIX}"),            chk_unix, NULL },
 145 # endif
 146 #endif
 147
 148 #ifdef SLAPD_CLEARTEXT
 149         /* pseudo scheme */
 150         { {0, "{CLEARTEXT}"},           NULL, hash_clear },
 151 #endif
 152
 153         { BER_BVNULL, NULL, NULL }
 154 };
 155
 156 int lutil_passwd_add(
 157         struct berval *scheme,
 158         LUTIL_PASSWD_CHK_FUNC *chk,
 159         LUTIL_PASSWD_HASH_FUNC *hash )
 160 {
 161         struct pw_slist *ptr;
 162
 163         if (!pw_inited) lutil_passwd_init();
 164
 165         ptr = ber_memalloc( sizeof( struct pw_slist ));
 166         if (!ptr) return -1;
 167         ptr->next = pw_schemes;
 168         ptr->s.name = *scheme;
 169         ptr->s.chk_fn = chk;
 170         ptr->s.hash_fn = hash;
 171         pw_schemes = ptr;
 172         return 0;
 173 }
 174
 175 void lutil_passwd_init()
 176 {
 177         struct pw_scheme *s;
 178
 179         pw_inited = 1;
 180
 181         for( s=(struct pw_scheme *)pw_schemes_default; s->name.bv_val; s++) {
 182                 if ( lutil_passwd_add( &s->name, s->chk_fn, s->hash_fn ) ) break;
 183         }
 184 }
 185
 186 void lutil_passwd_destroy()
 187 {
 188         struct pw_slist *ptr, *next;
 189
 190         for( ptr=pw_schemes; ptr; ptr=next ) {
 191                 next = ptr->next;
 192                 ber_memfree( ptr );
 193         }
 194 }
 195
 196 static const struct pw_scheme *get_scheme(
 197         const char* scheme )
 198 {
 199         struct pw_slist *pws;
 200         struct berval bv;
 201
 202         if (!pw_inited) lutil_passwd_init();
 203
 204         bv.bv_val = strchr( scheme, '}' );
 205         if ( !bv.bv_val )
 206                 return NULL;
 207
 208         bv.bv_len = bv.bv_val - scheme + 1;
 209         bv.bv_val = (char *) scheme;
 210
 211         for( pws=pw_schemes; pws; pws=pws->next ) {
 212                 if( bv.bv_len != pws->s.name.bv_len )
 213                         continue;
 214                 if( strncasecmp(bv.bv_val, pws->s.name.bv_val, bv.bv_len ) == 0 ) {
 215                         return &(pws->s);
 216                 }
 217         }
 218
 219         return NULL;
 220 }
 221
 222 int lutil_passwd_scheme(
 223         const char* scheme )
 224 {
 225         if( scheme == NULL ) {
 226                 return 0;
 227         }
 228
 229         return get_scheme(scheme) != NULL;
 230 }
 231
 232
 233 static int is_allowed_scheme(
 234         const char* scheme,
 235         const char** schemes )
 236 {
 237         int i;
 238
 239         if( schemes == NULL ) return 1;
 240
 241         for( i=0; schemes[i] != NULL; i++ ) {
 242                 if( strcasecmp( scheme, schemes[i] ) == 0 ) {
 243                         return 1;
 244                 }
 245         }
 246         return 0;
 247 }
 248
 249 static struct berval *passwd_scheme(
 250         const struct pw_scheme *scheme,
 251         const struct berval * passwd,
 252         struct berval *bv,
 253         const char** allowed )
 254 {
 255         if( !is_allowed_scheme( scheme->name.bv_val, allowed ) ) {
 256                 return NULL;
 257         }
 258
 259         if( passwd->bv_len >= scheme->name.bv_len ) {
 260                 if( strncasecmp( passwd->bv_val, scheme->name.bv_val, scheme->name.bv_len ) == 0 ) {
 261                         bv->bv_val = &passwd->bv_val[scheme->name.bv_len];
 262                         bv->bv_len = passwd->bv_len - scheme->name.bv_len;
 263
 264                         return bv;
 265                 }
 266         }
 267
 268         return NULL;
 269 }
 270
 271 /*
 272  * Return 0 if creds are good.
 273  */
 274 int
 275 lutil_passwd(
 276         const struct berval *passwd,    /* stored passwd */
 277         const struct berval *cred,              /* user cred */
 278         const char **schemes,
 279         const char **text )
 280 {
 281         struct pw_slist *pws;
 282
 283         if ( text ) *text = NULL;
 284
 285         if (cred == NULL || cred->bv_len == 0 ||
 286                 passwd == NULL || passwd->bv_len == 0 )
 287         {
 288                 return -1;
 289         }
 290
 291         if (!pw_inited) lutil_passwd_init();
 292
 293         for( pws=pw_schemes; pws; pws=pws->next ) {
 294                 if( pws->s.chk_fn ) {
 295                         struct berval x;
 296                         struct berval *p = passwd_scheme( &(pws->s),
 297                                 passwd, &x, schemes );
 298
 299                         if( p != NULL ) {
 300                                 return (pws->s.chk_fn)( &(pws->s.name), p, cred, text );
 301                         }
 302                 }
 303         }
 304
 305 #ifdef SLAPD_CLEARTEXT
 306         /* Do we think there is a scheme specifier here that we
 307          * didn't recognize? Assume a scheme name is at least 1 character.
 308          */
 309         if (( passwd->bv_val[0] == '{' ) &&
 310                 ( strchr( passwd->bv_val, '}' ) > passwd->bv_val+1 ))
 311                 return 1;
 312         if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) {
 313                 return ( passwd->bv_len == cred->bv_len ) ?
 314                         memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
 315                         : 1;
 316         }
 317 #endif
 318         return 1;
 319 }
 320
 321 int lutil_passwd_generate( struct berval *pw, ber_len_t len )
 322 {
 323
 324         if( len < 1 ) return -1;
 325
 326         pw->bv_len = len;
 327         pw->bv_val = ber_memalloc( len + 1 );
 328
 329         if( pw->bv_val == NULL ) {
 330                 return -1;
 331         }
 332
 333         if( lutil_entropy( (unsigned char *) pw->bv_val, pw->bv_len) < 0 ) {
 334                 return -1;
 335         }
 336
 337         for( len = 0; len < pw->bv_len; len++ ) {
 338                 pw->bv_val[len] = crypt64[
 339                         pw->bv_val[len] % (sizeof(crypt64)-1) ];
 340         }
 341
 342         pw->bv_val[len] = '\0';
 343
 344         return 0;
 345 }
 346
 347 int lutil_passwd_hash(
 348         const struct berval * passwd,
 349         const char * method,
 350         struct berval *hash,
 351         const char **text )
 352 {
 353         const struct pw_scheme *sc = get_scheme( method );
 354
 355         hash->bv_val = NULL;
 356         hash->bv_len = 0;
 357
 358         if( sc == NULL ) {
 359                 if( text ) *text = "scheme not recognized";
 360                 return -1;
 361         }
 362
 363         if( ! sc->hash_fn ) {
 364                 if( text ) *text = "scheme provided no hash function";
 365                 return -1;
 366         }
 367
 368         if( text ) *text = NULL;
 369
 370         return (sc->hash_fn)( &sc->name, passwd, hash, text );
 371 }
 372
 373 /* pw_string is only called when SLAPD_LMHASH or SLAPD_CRYPT is defined */
 374 #if defined(SLAPD_LMHASH) || defined(SLAPD_CRYPT)
 375 static int pw_string(
 376         const struct berval *sc,
 377         struct berval *passwd )
 378 {
 379         struct berval pw;
 380
 381         pw.bv_len = sc->bv_len + passwd->bv_len;
 382         pw.bv_val = ber_memalloc( pw.bv_len + 1 );
 383
 384         if( pw.bv_val == NULL ) {
 385                 return LUTIL_PASSWD_ERR;
 386         }
 387
 388         AC_MEMCPY( pw.bv_val, sc->bv_val, sc->bv_len );
 389         AC_MEMCPY( &pw.bv_val[sc->bv_len], passwd->bv_val, passwd->bv_len );
 390
 391         pw.bv_val[pw.bv_len] = '\0';
 392         *passwd = pw;
 393
 394         return LUTIL_PASSWD_OK;
 395 }
 396 #endif /* SLAPD_LMHASH || SLAPD_CRYPT */
 397
 398 static int pw_string64(
 399         const struct berval *sc,
 400         const struct berval *hash,
 401         struct berval *b64,
 402         const struct berval *salt )
 403 {
 404         int rc;
 405         struct berval string;
 406         size_t b64len;
 407
 408         if( salt ) {
 409                 /* need to base64 combined string */
 410                 string.bv_len = hash->bv_len + salt->bv_len;
 411                 string.bv_val = ber_memalloc( string.bv_len + 1 );
 412
 413                 if( string.bv_val == NULL ) {
 414                         return LUTIL_PASSWD_ERR;
 415                 }
 416
 417                 AC_MEMCPY( string.bv_val, hash->bv_val,
 418                         hash->bv_len );
 419                 AC_MEMCPY( &string.bv_val[hash->bv_len], salt->bv_val,
 420                         salt->bv_len );
 421                 string.bv_val[string.bv_len] = '\0';
 422
 423         } else {
 424                 string = *hash;
 425         }
 426
 427         b64len = LUTIL_BASE64_ENCODE_LEN( string.bv_len ) + 1;
 428         b64->bv_len = b64len + sc->bv_len;
 429         b64->bv_val = ber_memalloc( b64->bv_len + 1 );
 430
 431         if( b64->bv_val == NULL ) {
 432                 if( salt ) ber_memfree( string.bv_val );
 433                 return LUTIL_PASSWD_ERR;
 434         }
 435
 436         AC_MEMCPY(b64->bv_val, sc->bv_val, sc->bv_len);
 437
 438         rc = lutil_b64_ntop(
 439                 (unsigned char *) string.bv_val, string.bv_len,
 440                 &b64->bv_val[sc->bv_len], b64len );
 441
 442         if( salt ) ber_memfree( string.bv_val );
 443
 444         if( rc < 0 ) {
 445                 return LUTIL_PASSWD_ERR;
 446         }
 447
 448         /* recompute length */
 449         b64->bv_len = sc->bv_len + rc;
 450         assert( strlen(b64->bv_val) == b64->bv_len );
 451         return LUTIL_PASSWD_OK;
 452 }
 453
 454 /* PASSWORD CHECK ROUTINES */
 455
 456 #ifdef LUTIL_SHA1_BYTES
 457 static int chk_ssha1(
 458         const struct berval *sc,
 459         const struct berval * passwd,
 460         const struct berval * cred,
 461         const char **text )
 462 {
 463         lutil_SHA1_CTX SHA1context;
 464         unsigned char SHA1digest[LUTIL_SHA1_BYTES];
 465         int rc;
 466         unsigned char *orig_pass = NULL;
 467
 468         /* safety check -- must have some salt */
 469         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <= sizeof(SHA1digest)) {
 470                 return LUTIL_PASSWD_ERR;
 471         }
 472
 473         /* decode base64 password */
 474         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 475                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 476
 477         if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
 478
 479         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 480
 481         /* safety check -- must have some salt */
 482         if (rc <= (int)(sizeof(SHA1digest))) {
 483                 ber_memfree(orig_pass);
 484                 return LUTIL_PASSWD_ERR;
 485         }
 486
 487         /* hash credentials with salt */
 488         lutil_SHA1Init(&SHA1context);
 489         lutil_SHA1Update(&SHA1context,
 490                 (const unsigned char *) cred->bv_val, cred->bv_len);
 491         lutil_SHA1Update(&SHA1context,
 492                 (const unsigned char *) &orig_pass[sizeof(SHA1digest)],
 493                 rc - sizeof(SHA1digest));
 494         lutil_SHA1Final(SHA1digest, &SHA1context);
 495
 496         /* compare */
 497         rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
 498         ber_memfree(orig_pass);
 499         return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
 500 }
 501
 502 static int chk_sha1(
 503         const struct berval *sc,
 504         const struct berval * passwd,
 505         const struct berval * cred,
 506         const char **text )
 507 {
 508         lutil_SHA1_CTX SHA1context;
 509         unsigned char SHA1digest[LUTIL_SHA1_BYTES];
 510         int rc;
 511         unsigned char *orig_pass = NULL;
 512
 513         /* safety check */
 514         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) < sizeof(SHA1digest)) {
 515                 return LUTIL_PASSWD_ERR;
 516         }
 517
 518         /* base64 un-encode password */
 519         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 520                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 521
 522         if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
 523
 524         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 525
 526         if( rc != sizeof(SHA1digest) ) {
 527                 ber_memfree(orig_pass);
 528                 return LUTIL_PASSWD_ERR;
 529         }
 530
 531         /* hash credentials with salt */
 532         lutil_SHA1Init(&SHA1context);
 533         lutil_SHA1Update(&SHA1context,
 534                 (const unsigned char *) cred->bv_val, cred->bv_len);
 535         lutil_SHA1Final(SHA1digest, &SHA1context);
 536
 537         /* compare */
 538         rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
 539         ber_memfree(orig_pass);
 540         return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
 541 }
 542 #endif
 543
 544 static int chk_smd5(
 545         const struct berval *sc,
 546         const struct berval * passwd,
 547         const struct berval * cred,
 548         const char **text )
 549 {
 550         lutil_MD5_CTX MD5context;
 551         unsigned char MD5digest[LUTIL_MD5_BYTES];
 552         int rc;
 553         unsigned char *orig_pass = NULL;
 554
 555         /* safety check */
 556         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <= sizeof(MD5digest)) {
 557                 return LUTIL_PASSWD_ERR;
 558         }
 559
 560         /* base64 un-encode password */
 561         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 562                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 563
 564         if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
 565
 566         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 567
 568         if (rc <= (int)(sizeof(MD5digest))) {
 569                 ber_memfree(orig_pass);
 570                 return LUTIL_PASSWD_ERR;
 571         }
 572
 573         /* hash credentials with salt */
 574         lutil_MD5Init(&MD5context);
 575         lutil_MD5Update(&MD5context,
 576                 (const unsigned char *) cred->bv_val,
 577                 cred->bv_len );
 578         lutil_MD5Update(&MD5context,
 579                 &orig_pass[sizeof(MD5digest)],
 580                 rc - sizeof(MD5digest));
 581         lutil_MD5Final(MD5digest, &MD5context);
 582
 583         /* compare */
 584         rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
 585         ber_memfree(orig_pass);
 586         return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
 587 }
 588
 589 static int chk_md5(
 590         const struct berval *sc,
 591         const struct berval * passwd,
 592         const struct berval * cred,
 593         const char **text )
 594 {
 595         lutil_MD5_CTX MD5context;
 596         unsigned char MD5digest[LUTIL_MD5_BYTES];
 597         int rc;
 598         unsigned char *orig_pass = NULL;
 599
 600         /* safety check */
 601         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) < sizeof(MD5digest)) {
 602                 return LUTIL_PASSWD_ERR;
 603         }
 604
 605         /* base64 un-encode password */
 606         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 607                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 608
 609         if( orig_pass == NULL ) return LUTIL_PASSWD_ERR;
 610
 611         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 612         if ( rc != sizeof(MD5digest) ) {
 613                 ber_memfree(orig_pass);
 614                 return LUTIL_PASSWD_ERR;
 615         }
 616
 617         /* hash credentials with salt */
 618         lutil_MD5Init(&MD5context);
 619         lutil_MD5Update(&MD5context,
 620                 (const unsigned char *) cred->bv_val,
 621                 cred->bv_len );
 622         lutil_MD5Final(MD5digest, &MD5context);
 623
 624         /* compare */
 625         rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
 626         ber_memfree(orig_pass);
 627         return rc ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
 628 }
 629
 630 #ifdef SLAPD_LMHASH
 631 /* pseudocode from RFC2433
 632  * A.2 LmPasswordHash()
 633  *
 634  *    LmPasswordHash(
 635  *    IN  0-to-14-oem-char Password,
 636  *    OUT 16-octet         PasswordHash )
 637  *    {
 638  *       Set UcasePassword to the uppercased Password
 639  *       Zero pad UcasePassword to 14 characters
 640  *
 641  *       DesHash( 1st 7-octets of UcasePassword,
 642  *                giving 1st 8-octets of PasswordHash )
 643  *
 644  *       DesHash( 2nd 7-octets of UcasePassword,
 645  *                giving 2nd 8-octets of PasswordHash )
 646  *    }
 647  *
 648  *
 649  * A.3 DesHash()
 650  *
 651  *    DesHash(
 652  *    IN  7-octet Clear,
 653  *    OUT 8-octet Cypher )
 654  *    {
 655  *        *
 656  *        * Make Cypher an irreversibly encrypted form of Clear by
 657  *        * encrypting known text using Clear as the secret key.
 658  *        * The known text consists of the string
 659  *        *
 660  *        *              KGS!@#$%
 661  *        *
 662  *
 663  *       Set StdText to "KGS!@#$%"
 664  *       DesEncrypt( StdText, Clear, giving Cypher )
 665  *    }
 666  *
 667  *
 668  * A.4 DesEncrypt()
 669  *
 670  *    DesEncrypt(
 671  *    IN  8-octet Clear,
 672  *    IN  7-octet Key,
 673  *    OUT 8-octet Cypher )
 674  *    {
 675  *        *
 676  *        * Use the DES encryption algorithm [4] in ECB mode [9]
 677  *        * to encrypt Clear into Cypher such that Cypher can
 678  *        * only be decrypted back to Clear by providing Key.
 679  *        * Note that the DES algorithm takes as input a 64-bit
 680  *        * stream where the 8th, 16th, 24th, etc.  bits are
 681  *        * parity bits ignored by the encrypting algorithm.
 682  *        * Unless you write your own DES to accept 56-bit input
 683  *        * without parity, you will need to insert the parity bits
 684  *        * yourself.
 685  *        *
 686  *    }
 687  */
 688
 689 static void lmPasswd_to_key(
 690         const char *lmPasswd,
 691         des_cblock *key)
 692 {
 693         const unsigned char *lpw = (const unsigned char *) lmPasswd;
 694         unsigned char *k = (unsigned char *) key;
 695
 696         /* make room for parity bits */
 697         k[0] = lpw[0];
 698         k[1] = ((lpw[0] & 0x01) << 7) | (lpw[1] >> 1);
 699         k[2] = ((lpw[1] & 0x03) << 6) | (lpw[2] >> 2);
 700         k[3] = ((lpw[2] & 0x07) << 5) | (lpw[3] >> 3);
 701         k[4] = ((lpw[3] & 0x0F) << 4) | (lpw[4] >> 4);
 702         k[5] = ((lpw[4] & 0x1F) << 3) | (lpw[5] >> 5);
 703         k[6] = ((lpw[5] & 0x3F) << 2) | (lpw[6] >> 6);
 704         k[7] = ((lpw[6] & 0x7F) << 1);
 705
 706         des_set_odd_parity( key );
 707 }
 708
 709 static int chk_lanman(
 710         const struct berval *scheme,
 711         const struct berval *passwd,
 712         const struct berval *cred,
 713         const char **text )
 714 {
 715         int i;
 716         char UcasePassword[15];
 717         des_cblock key;
 718         des_key_schedule schedule;
 719         des_cblock StdText = "KGS!@#$%";
 720         des_cblock PasswordHash1, PasswordHash2;
 721         char PasswordHash[33], storedPasswordHash[33];
 722
 723         for( i=0; i<cred->bv_len; i++) {
 724                 if(cred->bv_val[i] == '\0') {
 725                         return LUTIL_PASSWD_ERR;        /* NUL character in password */
 726                 }
 727         }
 728
 729         if( cred->bv_val[i] != '\0' ) {
 730                 return LUTIL_PASSWD_ERR;        /* passwd must behave like a string */
 731         }
 732
 733         strncpy( UcasePassword, cred->bv_val, 14 );
 734         UcasePassword[14] = '\0';
 735         ldap_pvt_str2upper( UcasePassword );
 736
 737         lmPasswd_to_key( UcasePassword, &key );
 738         des_set_key_unchecked( &key, schedule );
 739         des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT );
 740
 741         lmPasswd_to_key( &UcasePassword[7], &key );
 742         des_set_key_unchecked( &key, schedule );
 743         des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT );
 744
 745         sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
 746                 PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3],
 747                 PasswordHash1[4],PasswordHash1[5],PasswordHash1[6],PasswordHash1[7],
 748                 PasswordHash2[0],PasswordHash2[1],PasswordHash2[2],PasswordHash2[3],
 749                 PasswordHash2[4],PasswordHash2[5],PasswordHash2[6],PasswordHash2[7] );
 750
 751         /* as a precaution convert stored password hash to lower case */
 752         strncpy( storedPasswordHash, passwd->bv_val, 32 );
 753         storedPasswordHash[32] = '\0';
 754         ldap_pvt_str2lower( storedPasswordHash );
 755
 756         return memcmp( PasswordHash, storedPasswordHash, 32) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
 757 }
 758 #endif /* SLAPD_LMHASH */
 759
 760 #ifdef SLAPD_CRYPT
 761 static int lutil_crypt(
 762         const char *key,
 763         const char *salt,
 764         char **hash )
 765 {
 766         char *cr = crypt( key, salt );
 767         int rc;
 768
 769         if( cr == NULL || cr[0] == '\0' ) {
 770                 /* salt must have been invalid */
 771                 rc = LUTIL_PASSWD_ERR;
 772         } else {
 773                 if ( hash ) {
 774                         *hash = ber_strdup( cr );
 775                         rc = LUTIL_PASSWD_OK;
 776                 } else {
 777                         rc = strcmp( salt, cr ) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
 778                 }
 779         }
 780         return rc;
 781 }
 782
 783 static int chk_crypt(
 784         const struct berval *sc,
 785         const struct berval * passwd,
 786         const struct berval * cred,
 787         const char **text )
 788 {
 789         unsigned int i;
 790
 791         for( i=0; i<cred->bv_len; i++) {
 792                 if(cred->bv_val[i] == '\0') {
 793                         return LUTIL_PASSWD_ERR;        /* NUL character in password */
 794                 }
 795         }
 796
 797         if( cred->bv_val[i] != '\0' ) {
 798                 return LUTIL_PASSWD_ERR;        /* cred must behave like a string */
 799         }
 800
 801         if( passwd->bv_len < 2 ) {
 802                 return LUTIL_PASSWD_ERR;        /* passwd must be at least two characters long */
 803         }
 804
 805         for( i=0; i<passwd->bv_len; i++) {
 806                 if(passwd->bv_val[i] == '\0') {
 807                         return LUTIL_PASSWD_ERR;        /* NUL character in password */
 808                 }
 809         }
 810
 811         if( passwd->bv_val[i] != '\0' ) {
 812                 return LUTIL_PASSWD_ERR;        /* passwd must behave like a string */
 813         }
 814
 815         return lutil_cryptptr( cred->bv_val, passwd->bv_val, NULL );
 816 }
 817
 818 # if defined( HAVE_GETPWNAM ) && defined( HAVE_STRUCT_PASSWD_PW_PASSWD )
 819 static int chk_unix(
 820         const struct berval *sc,
 821         const struct berval * passwd,
 822         const struct berval * cred,
 823         const char **text )
 824 {
 825         unsigned int i;
 826         char *pw;
 827
 828         for( i=0; i<cred->bv_len; i++) {
 829                 if(cred->bv_val[i] == '\0') {
 830                         return LUTIL_PASSWD_ERR;        /* NUL character in password */
 831                 }
 832         }
 833         if( cred->bv_val[i] != '\0' ) {
 834                 return LUTIL_PASSWD_ERR;        /* cred must behave like a string */
 835         }
 836
 837         for( i=0; i<passwd->bv_len; i++) {
 838                 if(passwd->bv_val[i] == '\0') {
 839                         return LUTIL_PASSWD_ERR;        /* NUL character in password */
 840                 }
 841         }
 842
 843         if( passwd->bv_val[i] != '\0' ) {
 844                 return LUTIL_PASSWD_ERR;        /* passwd must behave like a string */
 845         }
 846
 847         {
 848                 struct passwd *pwd = getpwnam(passwd->bv_val);
 849
 850                 if(pwd == NULL) {
 851                         return LUTIL_PASSWD_ERR;        /* not found */
 852                 }
 853
 854                 pw = pwd->pw_passwd;
 855         }
 856 #  ifdef HAVE_GETSPNAM
 857         {
 858                 struct spwd *spwd = getspnam(passwd->bv_val);
 859
 860                 if(spwd != NULL) {
 861                         pw = spwd->sp_pwdp;
 862                 }
 863         }
 864 #  endif
 865 #  ifdef HAVE_AIX_SECURITY
 866         {
 867                 struct userpw *upw = getuserpw(passwd->bv_val);
 868
 869                 if (upw != NULL) {
 870                         pw = upw->upw_passwd;
 871                 }
 872         }
 873 #  endif
 874
 875         if( pw == NULL || pw[0] == '\0' || pw[1] == '\0' ) {
 876                 /* password must must be at least two characters long */
 877                 return LUTIL_PASSWD_ERR;
 878         }
 879
 880         return lutil_cryptptr( cred->bv_val, pw, NULL );
 881 }
 882 # endif
 883 #endif
 884
 885 /* PASSWORD GENERATION ROUTINES */
 886
 887 #ifdef LUTIL_SHA1_BYTES
 888 static int hash_ssha1(
 889         const struct berval *scheme,
 890         const struct berval  *passwd,
 891         struct berval *hash,
 892         const char **text )
 893 {
 894         lutil_SHA1_CTX  SHA1context;
 895         unsigned char   SHA1digest[LUTIL_SHA1_BYTES];
 896         char            saltdata[SALT_SIZE];
 897         struct berval digest;
 898         struct berval salt;
 899
 900         digest.bv_val = (char *) SHA1digest;
 901         digest.bv_len = sizeof(SHA1digest);
 902         salt.bv_val = saltdata;
 903         salt.bv_len = sizeof(saltdata);
 904
 905         if( lutil_entropy( (unsigned char *) salt.bv_val, salt.bv_len) < 0 ) {
 906                 return LUTIL_PASSWD_ERR;
 907         }
 908
 909         lutil_SHA1Init( &SHA1context );
 910         lutil_SHA1Update( &SHA1context,
 911                 (const unsigned char *)passwd->bv_val, passwd->bv_len );
 912         lutil_SHA1Update( &SHA1context,
 913                 (const unsigned char *)salt.bv_val, salt.bv_len );
 914         lutil_SHA1Final( SHA1digest, &SHA1context );
 915
 916         return pw_string64( scheme, &digest, hash, &salt);
 917 }
 918
 919 static int hash_sha1(
 920         const struct berval *scheme,
 921         const struct berval  *passwd,
 922         struct berval *hash,
 923         const char **text )
 924 {
 925         lutil_SHA1_CTX  SHA1context;
 926         unsigned char   SHA1digest[LUTIL_SHA1_BYTES];
 927         struct berval digest;
 928         digest.bv_val = (char *) SHA1digest;
 929         digest.bv_len = sizeof(SHA1digest);
 930
 931         lutil_SHA1Init( &SHA1context );
 932         lutil_SHA1Update( &SHA1context,
 933                 (const unsigned char *)passwd->bv_val, passwd->bv_len );
 934         lutil_SHA1Final( SHA1digest, &SHA1context );
 935
 936         return pw_string64( scheme, &digest, hash, NULL);
 937 }
 938 #endif
 939
 940 static int hash_smd5(
 941         const struct berval *scheme,
 942         const struct berval  *passwd,
 943         struct berval *hash,
 944         const char **text )
 945 {
 946         lutil_MD5_CTX   MD5context;
 947         unsigned char   MD5digest[LUTIL_MD5_BYTES];
 948         char            saltdata[SALT_SIZE];
 949         struct berval digest;
 950         struct berval salt;
 951
 952         digest.bv_val = (char *) MD5digest;
 953         digest.bv_len = sizeof(MD5digest);
 954         salt.bv_val = saltdata;
 955         salt.bv_len = sizeof(saltdata);
 956
 957         if( lutil_entropy( (unsigned char *) salt.bv_val, salt.bv_len) < 0 ) {
 958                 return LUTIL_PASSWD_ERR;
 959         }
 960
 961         lutil_MD5Init( &MD5context );
 962         lutil_MD5Update( &MD5context,
 963                 (const unsigned char *) passwd->bv_val, passwd->bv_len );
 964         lutil_MD5Update( &MD5context,
 965                 (const unsigned char *) salt.bv_val, salt.bv_len );
 966         lutil_MD5Final( MD5digest, &MD5context );
 967
 968         return pw_string64( scheme, &digest, hash, &salt );
 969 }
 970
 971 static int hash_md5(
 972         const struct berval *scheme,
 973         const struct berval  *passwd,
 974         struct berval *hash,
 975         const char **text )
 976 {
 977         lutil_MD5_CTX   MD5context;
 978         unsigned char   MD5digest[LUTIL_MD5_BYTES];
 979
 980         struct berval digest;
 981
 982         digest.bv_val = (char *) MD5digest;
 983         digest.bv_len = sizeof(MD5digest);
 984
 985         lutil_MD5Init( &MD5context );
 986         lutil_MD5Update( &MD5context,
 987                 (const unsigned char *) passwd->bv_val, passwd->bv_len );
 988         lutil_MD5Final( MD5digest, &MD5context );
 989
 990         return pw_string64( scheme, &digest, hash, NULL );
 991 ;
 992 }
 993
 994 #ifdef SLAPD_LMHASH
 995 static int hash_lanman(
 996         const struct berval *scheme,
 997         const struct berval *passwd,
 998         struct berval *hash,
 999         const char **text )
1000 {
1001
1002         int i;
1003         char UcasePassword[15];
1004         des_cblock key;
1005         des_key_schedule schedule;
1006         des_cblock StdText = "KGS!@#$%";
1007         des_cblock PasswordHash1, PasswordHash2;
1008         char PasswordHash[33];
1009
1010         for( i=0; i<passwd->bv_len; i++) {
1011                 if(passwd->bv_val[i] == '\0') {
1012                         return LUTIL_PASSWD_ERR;        /* NUL character in password */
1013                 }
1014         }
1015
1016         if( passwd->bv_val[i] != '\0' ) {
1017                 return LUTIL_PASSWD_ERR;        /* passwd must behave like a string */
1018         }
1019
1020         strncpy( UcasePassword, passwd->bv_val, 14 );
1021         UcasePassword[14] = '\0';
1022         ldap_pvt_str2upper( UcasePassword );
1023
1024         lmPasswd_to_key( UcasePassword, &key );
1025         des_set_key_unchecked( &key, schedule );
1026         des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT );
1027
1028         lmPasswd_to_key( &UcasePassword[7], &key );
1029         des_set_key_unchecked( &key, schedule );
1030         des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT );
1031
1032         sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
1033                 PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3],
1034                 PasswordHash1[4],PasswordHash1[5],PasswordHash1[6],PasswordHash1[7],
1035                 PasswordHash2[0],PasswordHash2[1],PasswordHash2[2],PasswordHash2[3],
1036                 PasswordHash2[4],PasswordHash2[5],PasswordHash2[6],PasswordHash2[7] );
1037
1038         hash->bv_val = PasswordHash;
1039         hash->bv_len = 32;
1040
1041         return pw_string( scheme, hash );
1042 }
1043 #endif /* SLAPD_LMHASH */
1044
1045 #ifdef SLAPD_CRYPT
1046 static int hash_crypt(
1047         const struct berval *scheme,
1048         const struct berval *passwd,
1049         struct berval *hash,
1050         const char **text )
1051 {
1052         unsigned char salt[32]; /* salt suitable for most anything */
1053         unsigned int i;
1054         char *save;
1055         int rc;
1056
1057         for( i=0; i<passwd->bv_len; i++) {
1058                 if(passwd->bv_val[i] == '\0') {
1059                         return LUTIL_PASSWD_ERR;        /* NUL character in password */
1060                 }
1061         }
1062
1063         if( passwd->bv_val[i] != '\0' ) {
1064                 return LUTIL_PASSWD_ERR;        /* passwd must behave like a string */
1065         }
1066
1067         if( lutil_entropy( salt, sizeof( salt ) ) < 0 ) {
1068                 return LUTIL_PASSWD_ERR;
1069         }
1070
1071         for( i=0; i< ( sizeof(salt) - 1 ); i++ ) {
1072                 salt[i] = crypt64[ salt[i] % (sizeof(crypt64)-1) ];
1073         }
1074         salt[sizeof( salt ) - 1 ] = '\0';
1075
1076         if( salt_format != NULL ) {
1077                 /* copy the salt we made into entropy before snprintfing
1078                    it back into the salt */
1079                 char entropy[sizeof(salt)];
1080                 strcpy( entropy, (char *) salt );
1081                 snprintf( (char *) salt, sizeof(entropy), salt_format, entropy );
1082         }
1083
1084         rc = lutil_cryptptr( passwd->bv_val, (char *) salt, &hash->bv_val );
1085         if ( rc != LUTIL_PASSWD_OK ) return rc;
1086
1087         if( hash->bv_val == NULL ) return -1;
1088
1089         hash->bv_len = strlen( hash->bv_val );
1090
1091         save = hash->bv_val;
1092
1093         if( hash->bv_len == 0 ) {
1094                 rc = LUTIL_PASSWD_ERR;
1095         } else {
1096                 rc = pw_string( scheme, hash );
1097         }
1098         ber_memfree( save );
1099         return rc;
1100 }
1101 #endif
1102
1103 int lutil_salt_format(const char *format)
1104 {
1105 #ifdef SLAPD_CRYPT
1106         free( salt_format );
1107
1108         salt_format = format != NULL ? ber_strdup( format ) : NULL;
1109 #endif
1110
1111         return 0;
1112 }
1113
1114 #ifdef SLAPD_CLEARTEXT
1115 static int hash_clear(
1116         const struct berval *scheme,
1117         const struct berval  *passwd,
1118         struct berval *hash,
1119         const char **text )
1120 {
1121         ber_dupbv( hash, (struct berval *)passwd );
1122         return LUTIL_PASSWD_OK;
1123 }
1124 #endif
1125