git.sur5r.net Git - openldap/blob - libraries/liblutil/passwd.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1998-2004 The OpenLDAP Foundation.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15
  16 /*
  17  * int lutil_passwd(
  18  *      const struct berval *passwd,
  19  *      const struct berval *cred,
  20  *      const char **schemes )
  21  *
  22  * Returns true if user supplied credentials (cred) matches
  23  * the stored password (passwd).
  24  *
  25  * Due to the use of the crypt(3) function
  26  * this routine is NOT thread-safe.
  27  */
  28
  29 #include "portable.h"
  30
  31 #include <stdio.h>
  32 #include <ac/stdlib.h>
  33 #include <ac/string.h>
  34 #include <ac/unistd.h>
  35
  36 #ifdef SLAPD_SPASSWD
  37 #       ifdef HAVE_SASL_SASL_H
  38 #               include <sasl/sasl.h>
  39 #       else
  40 #               include <sasl.h>
  41 #       endif
  42 #endif
  43
  44 #if defined(SLAPD_LMHASH)
  45 #       include <openssl/des.h>
  46 #endif /* SLAPD_LMHASH */
  47
  48 #include <ac/param.h>
  49
  50 #ifdef SLAPD_CRYPT
  51 # include <ac/crypt.h>
  52
  53 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
  54 #  ifdef HAVE_SHADOW_H
  55 #       include <shadow.h>
  56 #  endif
  57 #  ifdef HAVE_PWD_H
  58 #       include <pwd.h>
  59 #  endif
  60 #  ifdef HAVE_AIX_SECURITY
  61 #       include <userpw.h>
  62 #  endif
  63 # endif
  64 #endif
  65
  66 #include <lber.h>
  67
  68 #include "ldap_pvt.h"
  69 #include "lber_pvt.h"
  70
  71 #include "lutil_md5.h"
  72 #include "lutil_sha1.h"
  73 #include "lutil.h"
  74
  75 static const unsigned char crypt64[] =
  76         "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890./";
  77
  78 #ifdef SLAPD_CRYPT
  79 static char *salt_format = NULL;
  80 #endif
  81
  82 struct pw_scheme {
  83         struct berval name;
  84         LUTIL_PASSWD_CHK_FUNC *chk_fn;
  85         LUTIL_PASSWD_HASH_FUNC *hash_fn;
  86 };
  87
  88 struct pw_slist {
  89         struct pw_slist *next;
  90         struct pw_scheme s;
  91 };
  92
  93 /* password check routines */
  94
  95 #define SALT_SIZE       4
  96
  97 static LUTIL_PASSWD_CHK_FUNC chk_md5;
  98 static LUTIL_PASSWD_CHK_FUNC chk_smd5;
  99 static LUTIL_PASSWD_HASH_FUNC hash_smd5;
 100 static LUTIL_PASSWD_HASH_FUNC hash_md5;
 101
 102
 103 #ifdef LUTIL_SHA1_BYTES
 104 static LUTIL_PASSWD_CHK_FUNC chk_ssha1;
 105 static LUTIL_PASSWD_CHK_FUNC chk_sha1;
 106 static LUTIL_PASSWD_HASH_FUNC hash_sha1;
 107 static LUTIL_PASSWD_HASH_FUNC hash_ssha1;
 108 #endif
 109
 110 #ifdef SLAPD_LMHASH
 111 static LUTIL_PASSWD_CHK_FUNC chk_lanman;
 112 static LUTIL_PASSWD_HASH_FUNC hash_lanman;
 113 #endif
 114
 115 #ifdef SLAPD_SPASSWD
 116 static LUTIL_PASSWD_CHK_FUNC chk_sasl;
 117 #endif
 118
 119 #ifdef SLAPD_CRYPT
 120 static LUTIL_PASSWD_CHK_FUNC chk_crypt;
 121 static LUTIL_PASSWD_HASH_FUNC hash_crypt;
 122
 123 #if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
 124 static LUTIL_PASSWD_CHK_FUNC chk_unix;
 125 #endif
 126 #endif
 127
 128 /* password hash routines */
 129
 130 #ifdef SLAPD_CLEARTEXT
 131 static LUTIL_PASSWD_HASH_FUNC hash_clear;
 132 #endif
 133
 134 static struct pw_slist *pw_schemes;
 135
 136 static const struct pw_scheme pw_schemes_default[] =
 137 {
 138 #ifdef LUTIL_SHA1_BYTES
 139         { BER_BVC("{SSHA}"),            chk_ssha1, hash_ssha1 },
 140         { BER_BVC("{SHA}"),                     chk_sha1, hash_sha1 },
 141 #endif
 142
 143         { BER_BVC("{SMD5}"),            chk_smd5, hash_smd5 },
 144         { BER_BVC("{MD5}"),                     chk_md5, hash_md5 },
 145
 146 #ifdef SLAPD_LMHASH
 147         { BER_BVC("{LANMAN}"),          chk_lanman, hash_lanman },
 148 #endif /* SLAPD_LMHASH */
 149
 150 #ifdef SLAPD_SPASSWD
 151         { BER_BVC("{SASL}"),            chk_sasl, NULL },
 152 #endif
 153
 154 #ifdef SLAPD_CRYPT
 155         { BER_BVC("{CRYPT}"),           chk_crypt, hash_crypt },
 156 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
 157         { BER_BVC("{UNIX}"),            chk_unix, NULL },
 158 # endif
 159 #endif
 160
 161 #ifdef SLAPD_CLEARTEXT
 162         /* pseudo scheme */
 163         { {0, "{CLEARTEXT}"},           NULL, hash_clear },
 164 #endif
 165
 166         { BER_BVNULL, NULL, NULL }
 167 };
 168
 169 int lutil_passwd_add(
 170         struct berval *scheme,
 171         LUTIL_PASSWD_CHK_FUNC *chk,
 172         LUTIL_PASSWD_HASH_FUNC *hash )
 173 {
 174         struct pw_slist *ptr;
 175
 176         ptr = ber_memalloc( sizeof( struct pw_slist ));
 177         if (!ptr) return -1;
 178         ptr->next = pw_schemes;
 179         ptr->s.name = *scheme;
 180         ptr->s.chk_fn = chk;
 181         ptr->s.hash_fn = hash;
 182         pw_schemes = ptr;
 183         return 0;
 184 }
 185
 186 void lutil_passwd_init()
 187 {
 188         struct pw_slist *ptr;
 189         struct pw_scheme *s;
 190
 191         for( s=(struct pw_scheme *)pw_schemes_default; s->name.bv_val; s++) {
 192                 if ( lutil_passwd_add( &s->name, s->chk_fn, s->hash_fn )) break;
 193         }
 194 }
 195
 196 void lutil_passwd_destroy()
 197 {
 198         struct pw_slist *ptr, *next;
 199
 200         for( ptr=pw_schemes; ptr; ptr=next ) {
 201                 next = ptr->next;
 202                 ber_memfree( ptr );
 203         }
 204 }
 205
 206 static const struct pw_scheme *get_scheme(
 207         const char* scheme )
 208 {
 209         struct pw_slist *pws;
 210
 211         if (!pw_schemes) lutil_passwd_init();
 212
 213         for( pws=pw_schemes; pws; pws=pws->next ) {
 214                 if( strcasecmp(scheme, pws->s.name.bv_val ) == 0 ) {
 215                         return &(pws->s);
 216                 }
 217         }
 218
 219         return NULL;
 220 }
 221
 222 int lutil_passwd_scheme(
 223         const char* scheme )
 224 {
 225         if( scheme == NULL ) {
 226                 return 0;
 227         }
 228
 229         return get_scheme(scheme) != NULL;
 230 }
 231
 232
 233 static int is_allowed_scheme(
 234         const char* scheme,
 235         const char** schemes )
 236 {
 237         int i;
 238
 239         if( schemes == NULL ) return 1;
 240
 241         for( i=0; schemes[i] != NULL; i++ ) {
 242                 if( strcasecmp( scheme, schemes[i] ) == 0 ) {
 243                         return 1;
 244                 }
 245         }
 246         return 0;
 247 }
 248
 249 static struct berval *passwd_scheme(
 250         const struct pw_scheme *scheme,
 251         const struct berval * passwd,
 252         struct berval *bv,
 253         const char** allowed )
 254 {
 255         if( !is_allowed_scheme( scheme->name.bv_val, allowed ) ) {
 256                 return NULL;
 257         }
 258
 259         if( passwd->bv_len >= scheme->name.bv_len ) {
 260                 if( strncasecmp( passwd->bv_val, scheme->name.bv_val, scheme->name.bv_len ) == 0 ) {
 261                         bv->bv_val = &passwd->bv_val[scheme->name.bv_len];
 262                         bv->bv_len = passwd->bv_len - scheme->name.bv_len;
 263
 264                         return bv;
 265                 }
 266         }
 267
 268         return NULL;
 269 }
 270
 271 /*
 272  * Return 0 if creds are good.
 273  */
 274 int
 275 lutil_passwd(
 276         const struct berval *passwd,    /* stored passwd */
 277         const struct berval *cred,              /* user cred */
 278         const char **schemes,
 279         const char **text )
 280 {
 281         struct pw_slist *pws;
 282
 283         if ( text ) *text = NULL;
 284
 285         if (cred == NULL || cred->bv_len == 0 ||
 286                 passwd == NULL || passwd->bv_len == 0 )
 287         {
 288                 return -1;
 289         }
 290
 291         if (!pw_schemes) lutil_passwd_init();
 292
 293         for( pws=pw_schemes; pws; pws=pws->next ) {
 294                 if( pws->s.chk_fn ) {
 295                         struct berval x;
 296                         struct berval *p = passwd_scheme( &(pws->s),
 297                                 passwd, &x, schemes );
 298
 299                         if( p != NULL ) {
 300                                 return (pws->s.chk_fn)( &(pws->s.name), p, cred, text );
 301                         }
 302                 }
 303         }
 304
 305 #ifdef SLAPD_CLEARTEXT
 306         if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) {
 307                 return (( passwd->bv_len == cred->bv_len ) &&
 308                                 ( passwd->bv_val[0] != '{' /*'}'*/ ))
 309                         ? memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
 310                         : 1;
 311         }
 312 #endif
 313         return 1;
 314 }
 315
 316 int lutil_passwd_generate( struct berval *pw, ber_len_t len )
 317 {
 318
 319         if( len < 1 ) return -1;
 320
 321         pw->bv_len = len;
 322         pw->bv_val = ber_memalloc( len + 1 );
 323
 324         if( pw->bv_val == NULL ) {
 325                 return -1;
 326         }
 327
 328         if( lutil_entropy( (unsigned char *) pw->bv_val, pw->bv_len) < 0 ) {
 329                 return -1;
 330         }
 331
 332         for( len = 0; len < pw->bv_len; len++ ) {
 333                 pw->bv_val[len] = crypt64[
 334                         pw->bv_val[len] % (sizeof(crypt64)-1) ];
 335         }
 336
 337         pw->bv_val[len] = '\0';
 338
 339         return 0;
 340 }
 341
 342 int lutil_passwd_hash(
 343         const struct berval * passwd,
 344         const char * method,
 345         struct berval *hash,
 346         const char **text )
 347 {
 348         const struct pw_scheme *sc = get_scheme( method );
 349
 350         hash->bv_val = NULL;
 351         hash->bv_len = 0;
 352
 353         if( sc == NULL ) {
 354                 if( text ) *text = "scheme not recognized";
 355                 return -1;
 356         }
 357
 358         if( ! sc->hash_fn ) {
 359                 if( text ) *text = "scheme provided no hash function";
 360                 return -1;
 361         }
 362
 363         if( text ) *text = NULL;
 364
 365         return (sc->hash_fn)( &sc->name, passwd, hash, text );
 366 }
 367
 368 /* pw_string is only called when SLAPD_LMHASH or SLAPD_CRYPT is defined */
 369 #if defined(SLAPD_LMHASH) || defined(SLAPD_CRYPT)
 370 static int pw_string(
 371         const struct berval *sc,
 372         const struct berval *passwd )
 373 {
 374         struct berval pw;
 375
 376         pw->bv_len = sc->bv_len + passwd->bv_len;
 377         pw->bv_val = ber_memalloc( pw->bv_len + 1 );
 378
 379         if( pw->bv_val == NULL ) {
 380                 return -1;
 381         }
 382
 383         AC_MEMCPY( pw.bv_val, sc->bv_val, sc->bv_len );
 384         AC_MEMCPY( &pw.bv_val[sc->bv_len], passwd->bv_val, passwd->bv_len );
 385
 386         pw.bv_val[pw.bv_len] = '\0';
 387         *passwd = pw;
 388
 389         return 0;
 390 }
 391 #endif /* SLAPD_LMHASH || SLAPD_CRYPT */
 392
 393 static int pw_string64(
 394         const struct berval *sc,
 395         const struct berval *hash,
 396         struct berval *b64,
 397         const struct berval *salt )
 398 {
 399         int rc;
 400         struct berval string;
 401         size_t b64len;
 402
 403         if( salt ) {
 404                 /* need to base64 combined string */
 405                 string.bv_len = hash->bv_len + salt->bv_len;
 406                 string.bv_val = ber_memalloc( string.bv_len + 1 );
 407
 408                 if( string.bv_val == NULL ) {
 409                         return -1;
 410                 }
 411
 412                 AC_MEMCPY( string.bv_val, hash->bv_val,
 413                         hash->bv_len );
 414                 AC_MEMCPY( &string.bv_val[hash->bv_len], salt->bv_val,
 415                         salt->bv_len );
 416                 string.bv_val[string.bv_len] = '\0';
 417
 418         } else {
 419                 string = *hash;
 420         }
 421
 422         b64len = LUTIL_BASE64_ENCODE_LEN( string.bv_len ) + 1;
 423         b64->bv_len = b64len + sc->bv_len;
 424         b64->bv_val = ber_memalloc( b64->bv_len + 1 );
 425
 426         if( b64->bv_val == NULL ) {
 427                 if( salt ) ber_memfree( string.bv_val );
 428                 return -1;
 429         }
 430
 431         AC_MEMCPY(b64->bv_val, sc->bv_val, sc->bv_len);
 432
 433         rc = lutil_b64_ntop(
 434                 (unsigned char *) string.bv_val, string.bv_len,
 435                 &b64->bv_val[sc->bv_len], b64len );
 436
 437         if( salt ) ber_memfree( string.bv_val );
 438
 439         if( rc < 0 ) {
 440                 return rc;
 441         }
 442
 443         /* recompute length */
 444         b64->bv_len = sc->bv_len + rc;
 445         assert( strlen(b64->bv_val) == b64->bv_len );
 446         return 0;
 447 }
 448
 449 /* PASSWORD CHECK ROUTINES */
 450
 451 #ifdef LUTIL_SHA1_BYTES
 452 static int chk_ssha1(
 453         const struct berval *sc,
 454         const struct berval * passwd,
 455         const struct berval * cred,
 456         const char **text )
 457 {
 458         lutil_SHA1_CTX SHA1context;
 459         unsigned char SHA1digest[LUTIL_SHA1_BYTES];
 460         int rc;
 461         unsigned char *orig_pass = NULL;
 462
 463         /* safety check */
 464         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <
 465                 sizeof(SHA1digest)+SALT_SIZE) {
 466                 return -1;
 467         }
 468
 469         /* decode base64 password */
 470         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 471                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 472
 473         if( orig_pass == NULL ) return -1;
 474
 475         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 476
 477         if (rc < (int)(sizeof(SHA1digest)+SALT_SIZE)) {
 478                 ber_memfree(orig_pass);
 479                 return -1;
 480         }
 481
 482         /* hash credentials with salt */
 483         lutil_SHA1Init(&SHA1context);
 484         lutil_SHA1Update(&SHA1context,
 485                 (const unsigned char *) cred->bv_val, cred->bv_len);
 486         lutil_SHA1Update(&SHA1context,
 487                 (const unsigned char *) &orig_pass[sizeof(SHA1digest)],
 488                 rc - sizeof(SHA1digest));
 489         lutil_SHA1Final(SHA1digest, &SHA1context);
 490
 491         /* compare */
 492         rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
 493         ber_memfree(orig_pass);
 494         return rc ? 1 : 0;
 495 }
 496
 497 static int chk_sha1(
 498         const struct berval *sc,
 499         const struct berval * passwd,
 500         const struct berval * cred,
 501         const char **text )
 502 {
 503         lutil_SHA1_CTX SHA1context;
 504         unsigned char SHA1digest[LUTIL_SHA1_BYTES];
 505         int rc;
 506         unsigned char *orig_pass = NULL;
 507
 508         /* safety check */
 509         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) < sizeof(SHA1digest)) {
 510                 return -1;
 511         }
 512
 513         /* base64 un-encode password */
 514         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 515                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 516
 517         if( orig_pass == NULL ) return -1;
 518
 519         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 520
 521         if( rc != sizeof(SHA1digest) ) {
 522                 ber_memfree(orig_pass);
 523                 return -1;
 524         }
 525
 526         /* hash credentials with salt */
 527         lutil_SHA1Init(&SHA1context);
 528         lutil_SHA1Update(&SHA1context,
 529                 (const unsigned char *) cred->bv_val, cred->bv_len);
 530         lutil_SHA1Final(SHA1digest, &SHA1context);
 531
 532         /* compare */
 533         rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
 534         ber_memfree(orig_pass);
 535         return rc ? 1 : 0;
 536 }
 537 #endif
 538
 539 static int chk_smd5(
 540         const struct berval *sc,
 541         const struct berval * passwd,
 542         const struct berval * cred,
 543         const char **text )
 544 {
 545         lutil_MD5_CTX MD5context;
 546         unsigned char MD5digest[LUTIL_MD5_BYTES];
 547         int rc;
 548         unsigned char *orig_pass = NULL;
 549
 550         /* safety check */
 551         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <
 552                 sizeof(MD5digest)+SALT_SIZE) {
 553                 return -1;
 554         }
 555
 556         /* base64 un-encode password */
 557         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 558                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 559
 560         if( orig_pass == NULL ) return -1;
 561
 562         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 563
 564         if (rc < (int)(sizeof(MD5digest)+SALT_SIZE)) {
 565                 ber_memfree(orig_pass);
 566                 return -1;
 567         }
 568
 569         /* hash credentials with salt */
 570         lutil_MD5Init(&MD5context);
 571         lutil_MD5Update(&MD5context,
 572                 (const unsigned char *) cred->bv_val,
 573                 cred->bv_len );
 574         lutil_MD5Update(&MD5context,
 575                 &orig_pass[sizeof(MD5digest)],
 576                 rc - sizeof(MD5digest));
 577         lutil_MD5Final(MD5digest, &MD5context);
 578
 579         /* compare */
 580         rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
 581         ber_memfree(orig_pass);
 582         return rc ? 1 : 0;
 583 }
 584
 585 static int chk_md5(
 586         const struct berval *sc,
 587         const struct berval * passwd,
 588         const struct berval * cred,
 589         const char **text )
 590 {
 591         lutil_MD5_CTX MD5context;
 592         unsigned char MD5digest[LUTIL_MD5_BYTES];
 593         int rc;
 594         unsigned char *orig_pass = NULL;
 595
 596         /* safety check */
 597         if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) < sizeof(MD5digest)) {
 598                 return -1;
 599         }
 600
 601         /* base64 un-encode password */
 602         orig_pass = (unsigned char *) ber_memalloc( (size_t) (
 603                 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 604
 605         if( orig_pass == NULL ) return -1;
 606
 607         rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 608         if ( rc != sizeof(MD5digest) ) {
 609                 ber_memfree(orig_pass);
 610                 return -1;
 611         }
 612
 613         /* hash credentials with salt */
 614         lutil_MD5Init(&MD5context);
 615         lutil_MD5Update(&MD5context,
 616                 (const unsigned char *) cred->bv_val,
 617                 cred->bv_len );
 618         lutil_MD5Final(MD5digest, &MD5context);
 619
 620         /* compare */
 621         rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
 622         ber_memfree(orig_pass);
 623         return rc ? 1 : 0;
 624 }
 625
 626 #ifdef SLAPD_LMHASH
 627 /* pseudocode from RFC2433
 628  * A.2 LmPasswordHash()
 629  *
 630  *    LmPasswordHash(
 631  *    IN  0-to-14-oem-char Password,
 632  *    OUT 16-octet         PasswordHash )
 633  *    {
 634  *       Set UcasePassword to the uppercased Password
 635  *       Zero pad UcasePassword to 14 characters
 636  *
 637  *       DesHash( 1st 7-octets of UcasePassword,
 638  *                giving 1st 8-octets of PasswordHash )
 639  *
 640  *       DesHash( 2nd 7-octets of UcasePassword,
 641  *                giving 2nd 8-octets of PasswordHash )
 642  *    }
 643  *
 644  *
 645  * A.3 DesHash()
 646  *
 647  *    DesHash(
 648  *    IN  7-octet Clear,
 649  *    OUT 8-octet Cypher )
 650  *    {
 651  *        *
 652  *        * Make Cypher an irreversibly encrypted form of Clear by
 653  *        * encrypting known text using Clear as the secret key.
 654  *        * The known text consists of the string
 655  *        *
 656  *        *              KGS!@#$%
 657  *        *
 658  *
 659  *       Set StdText to "KGS!@#$%"
 660  *       DesEncrypt( StdText, Clear, giving Cypher )
 661  *    }
 662  *
 663  *
 664  * A.4 DesEncrypt()
 665  *
 666  *    DesEncrypt(
 667  *    IN  8-octet Clear,
 668  *    IN  7-octet Key,
 669  *    OUT 8-octet Cypher )
 670  *    {
 671  *        *
 672  *        * Use the DES encryption algorithm [4] in ECB mode [9]
 673  *        * to encrypt Clear into Cypher such that Cypher can
 674  *        * only be decrypted back to Clear by providing Key.
 675  *        * Note that the DES algorithm takes as input a 64-bit
 676  *        * stream where the 8th, 16th, 24th, etc.  bits are
 677  *        * parity bits ignored by the encrypting algorithm.
 678  *        * Unless you write your own DES to accept 56-bit input
 679  *        * without parity, you will need to insert the parity bits
 680  *        * yourself.
 681  *        *
 682  *    }
 683  */
 684
 685 static void lmPasswd_to_key(
 686         const unsigned char *lmPasswd,
 687         des_cblock *key)
 688 {
 689         /* make room for parity bits */
 690         ((char *)key)[0] = lmPasswd[0];
 691         ((char *)key)[1] = ((lmPasswd[0]&0x01)<<7) | (lmPasswd[1]>>1);
 692         ((char *)key)[2] = ((lmPasswd[1]&0x03)<<6) | (lmPasswd[2]>>2);
 693         ((char *)key)[3] = ((lmPasswd[2]&0x07)<<5) | (lmPasswd[3]>>3);
 694         ((char *)key)[4] = ((lmPasswd[3]&0x0F)<<4) | (lmPasswd[4]>>4);
 695         ((char *)key)[5] = ((lmPasswd[4]&0x1F)<<3) | (lmPasswd[5]>>5);
 696         ((char *)key)[6] = ((lmPasswd[5]&0x3F)<<2) | (lmPasswd[6]>>6);
 697         ((char *)key)[7] = ((lmPasswd[6]&0x7F)<<1);
 698
 699         des_set_odd_parity( key );
 700 }
 701
 702 static int chk_lanman(
 703         const struct berval *scheme,
 704         const struct berval *passwd,
 705         const struct berval *cred,
 706         const char **text )
 707 {
 708         int i;
 709         char UcasePassword[15];
 710         des_cblock key;
 711         des_key_schedule schedule;
 712         des_cblock StdText = "KGS!@#$%";
 713         des_cblock PasswordHash1, PasswordHash2;
 714         char PasswordHash[33], storedPasswordHash[33];
 715
 716         for( i=0; i<cred->bv_len; i++) {
 717                 if(cred->bv_val[i] == '\0') {
 718                         return -1;      /* NUL character in password */
 719                 }
 720         }
 721
 722         if( cred->bv_val[i] != '\0' ) {
 723                 return -1;      /* passwd must behave like a string */
 724         }
 725
 726         strncpy( UcasePassword, cred->bv_val, 14 );
 727         UcasePassword[14] = '\0';
 728         ldap_pvt_str2upper( UcasePassword );
 729
 730         lmPasswd_to_key( UcasePassword, &key );
 731         des_set_key_unchecked( &key, schedule );
 732         des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT );
 733
 734         lmPasswd_to_key( &UcasePassword[7], &key );
 735         des_set_key_unchecked( &key, schedule );
 736         des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT );
 737
 738         sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
 739                 PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3],
 740                 PasswordHash1[4],PasswordHash1[5],PasswordHash1[6],PasswordHash1[7],
 741                 PasswordHash2[0],PasswordHash2[1],PasswordHash2[2],PasswordHash2[3],
 742                 PasswordHash2[4],PasswordHash2[5],PasswordHash2[6],PasswordHash2[7] );
 743
 744         /* as a precaution convert stored password hash to lower case */
 745         strncpy( storedPasswordHash, passwd->bv_val, 32 );
 746         storedPasswordHash[32] = '\0';
 747         ldap_pvt_str2lower( storedPasswordHash );
 748
 749         return memcmp( PasswordHash, storedPasswordHash, 32) ? 1 : 0;
 750 }
 751 #endif /* SLAPD_LMHASH */
 752
 753 #ifdef SLAPD_SPASSWD
 754 #ifdef HAVE_CYRUS_SASL
 755 sasl_conn_t *lutil_passwd_sasl_conn = NULL;
 756 #endif
 757
 758 static int chk_sasl(
 759         const struct berval *sc,
 760         const struct berval * passwd,
 761         const struct berval * cred,
 762         const char **text )
 763 {
 764         unsigned int i;
 765         int rtn;
 766
 767         for( i=0; i<cred->bv_len; i++) {
 768                 if(cred->bv_val[i] == '\0') {
 769                         return 1;       /* NUL character in password */
 770                 }
 771         }
 772
 773         if( cred->bv_val[i] != '\0' ) {
 774                 return 1;       /* cred must behave like a string */
 775         }
 776
 777         for( i=0; i<passwd->bv_len; i++) {
 778                 if(passwd->bv_val[i] == '\0') {
 779                         return 1;       /* NUL character in password */
 780                 }
 781         }
 782
 783         if( passwd->bv_val[i] != '\0' ) {
 784                 return 1;       /* passwd must behave like a string */
 785         }
 786
 787         rtn = 1;
 788
 789 #ifdef HAVE_CYRUS_SASL
 790         if( lutil_passwd_sasl_conn != NULL ) {
 791                 int sc;
 792 # if SASL_VERSION_MAJOR < 2
 793                 sc = sasl_checkpass( lutil_passwd_sasl_conn,
 794                         passwd->bv_val, passwd->bv_len,
 795                         cred->bv_val, cred->bv_len,
 796                         text );
 797 # else
 798                 sc = sasl_checkpass( lutil_passwd_sasl_conn,
 799                         passwd->bv_val, passwd->bv_len,
 800                         cred->bv_val, cred->bv_len );
 801 # endif
 802                 rtn = ( sc != SASL_OK );
 803         }
 804 #endif
 805
 806         return rtn;
 807 }
 808 #endif
 809
 810 #ifdef SLAPD_CRYPT
 811 static int chk_crypt(
 812         const struct berval *sc,
 813         const struct berval * passwd,
 814         const struct berval * cred,
 815         const char **text )
 816 {
 817         char *cr;
 818         unsigned int i;
 819
 820         for( i=0; i<cred->bv_len; i++) {
 821                 if(cred->bv_val[i] == '\0') {
 822                         return 1;       /* NUL character in password */
 823                 }
 824         }
 825
 826         if( cred->bv_val[i] != '\0' ) {
 827                 return -1;      /* cred must behave like a string */
 828         }
 829
 830         if( passwd->bv_len < 2 ) {
 831                 return -1;      /* passwd must be at least two characters long */
 832         }
 833
 834         for( i=0; i<passwd->bv_len; i++) {
 835                 if(passwd->bv_val[i] == '\0') {
 836                         return -1;      /* NUL character in password */
 837                 }
 838         }
 839
 840         if( passwd->bv_val[i] != '\0' ) {
 841                 return -1;      /* passwd must behave like a string */
 842         }
 843
 844         cr = crypt( cred->bv_val, passwd->bv_val );
 845
 846         if( cr == NULL || cr[0] == '\0' ) {
 847                 /* salt must have been invalid */
 848                 return -1;
 849         }
 850
 851         return strcmp( passwd->bv_val, cr ) ? 1 : 0;
 852 }
 853
 854 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
 855 static int chk_unix(
 856         const struct berval *sc,
 857         const struct berval * passwd,
 858         const struct berval * cred,
 859         const char **text )
 860 {
 861         unsigned int i;
 862         char *pw,*cr;
 863
 864         for( i=0; i<cred->bv_len; i++) {
 865                 if(cred->bv_val[i] == '\0') {
 866                         return -1;      /* NUL character in password */
 867                 }
 868         }
 869         if( cred->bv_val[i] != '\0' ) {
 870                 return -1;      /* cred must behave like a string */
 871         }
 872
 873         for( i=0; i<passwd->bv_len; i++) {
 874                 if(passwd->bv_val[i] == '\0') {
 875                         return -1;      /* NUL character in password */
 876                 }
 877         }
 878
 879         if( passwd->bv_val[i] != '\0' ) {
 880                 return -1;      /* passwd must behave like a string */
 881         }
 882
 883         {
 884                 struct passwd *pwd = getpwnam(passwd->bv_val);
 885
 886                 if(pwd == NULL) {
 887                         return -1;      /* not found */
 888                 }
 889
 890                 pw = pwd->pw_passwd;
 891         }
 892 #  ifdef HAVE_GETSPNAM
 893         {
 894                 struct spwd *spwd = getspnam(passwd->bv_val);
 895
 896                 if(spwd != NULL) {
 897                         pw = spwd->sp_pwdp;
 898                 }
 899         }
 900 #  endif
 901 #  ifdef HAVE_AIX_SECURITY
 902         {
 903                 struct userpw *upw = getuserpw(passwd->bv_val);
 904
 905                 if (upw != NULL) {
 906                         pw = upw->upw_passwd;
 907                 }
 908         }
 909 #  endif
 910
 911         if( pw == NULL || pw[0] == '\0' || pw[1] == '\0' ) {
 912                 /* password must must be at least two characters long */
 913                 return -1;
 914         }
 915
 916         cr = crypt(cred->bv_val, pw);
 917
 918         if( cr == NULL || cr[0] == '\0' ) {
 919                 /* salt must have been invalid */
 920                 return -1;
 921         }
 922
 923         return strcmp(pw, cr) ? 1 : 0;
 924
 925 }
 926 # endif
 927 #endif
 928
 929 /* PASSWORD GENERATION ROUTINES */
 930
 931 #ifdef LUTIL_SHA1_BYTES
 932 static int hash_ssha1(
 933         const struct berval *scheme,
 934         const struct berval  *passwd,
 935         struct berval *hash,
 936         const char **text )
 937 {
 938         lutil_SHA1_CTX  SHA1context;
 939         unsigned char   SHA1digest[LUTIL_SHA1_BYTES];
 940         char            saltdata[SALT_SIZE];
 941         struct berval digest;
 942         struct berval salt;
 943
 944         digest.bv_val = (char *) SHA1digest;
 945         digest.bv_len = sizeof(SHA1digest);
 946         salt.bv_val = saltdata;
 947         salt.bv_len = sizeof(saltdata);
 948
 949         if( lutil_entropy( (unsigned char *) salt.bv_val, salt.bv_len) < 0 ) {
 950                 return -1;
 951         }
 952
 953         lutil_SHA1Init( &SHA1context );
 954         lutil_SHA1Update( &SHA1context,
 955                 (const unsigned char *)passwd->bv_val, passwd->bv_len );
 956         lutil_SHA1Update( &SHA1context,
 957                 (const unsigned char *)salt.bv_val, salt.bv_len );
 958         lutil_SHA1Final( SHA1digest, &SHA1context );
 959
 960         return pw_string64( scheme, &digest, hash, &salt);
 961 }
 962
 963 static int hash_sha1(
 964         const struct berval *scheme,
 965         const struct berval  *passwd,
 966         struct berval *hash,
 967         const char **text )
 968 {
 969         lutil_SHA1_CTX  SHA1context;
 970         unsigned char   SHA1digest[LUTIL_SHA1_BYTES];
 971         struct berval digest;
 972         digest.bv_val = (char *) SHA1digest;
 973         digest.bv_len = sizeof(SHA1digest);
 974
 975         lutil_SHA1Init( &SHA1context );
 976         lutil_SHA1Update( &SHA1context,
 977                 (const unsigned char *)passwd->bv_val, passwd->bv_len );
 978         lutil_SHA1Final( SHA1digest, &SHA1context );
 979
 980         return pw_string64( scheme, &digest, hash, NULL);
 981 }
 982 #endif
 983
 984 static int hash_smd5(
 985         const struct berval *scheme,
 986         const struct berval  *passwd,
 987         struct berval *hash,
 988         const char **text )
 989 {
 990         lutil_MD5_CTX   MD5context;
 991         unsigned char   MD5digest[LUTIL_MD5_BYTES];
 992         char            saltdata[SALT_SIZE];
 993         struct berval digest;
 994         struct berval salt;
 995
 996         digest.bv_val = (char *) MD5digest;
 997         digest.bv_len = sizeof(MD5digest);
 998         salt.bv_val = saltdata;
 999         salt.bv_len = sizeof(saltdata);
1000
1001         if( lutil_entropy( (unsigned char *) salt.bv_val, salt.bv_len) < 0 ) {
1002                 return -1;
1003         }
1004
1005         lutil_MD5Init( &MD5context );
1006         lutil_MD5Update( &MD5context,
1007                 (const unsigned char *) passwd->bv_val, passwd->bv_len );
1008         lutil_MD5Update( &MD5context,
1009                 (const unsigned char *) salt.bv_val, salt.bv_len );
1010         lutil_MD5Final( MD5digest, &MD5context );
1011
1012         return pw_string64( scheme, &digest, hash, &salt );
1013 }
1014
1015 static int hash_md5(
1016         const struct berval *scheme,
1017         const struct berval  *passwd,
1018         struct berval *hash,
1019         const char **text )
1020 {
1021         lutil_MD5_CTX   MD5context;
1022         unsigned char   MD5digest[LUTIL_MD5_BYTES];
1023
1024         struct berval digest;
1025
1026         digest.bv_val = (char *) MD5digest;
1027         digest.bv_len = sizeof(MD5digest);
1028
1029         lutil_MD5Init( &MD5context );
1030         lutil_MD5Update( &MD5context,
1031                 (const unsigned char *) passwd->bv_val, passwd->bv_len );
1032         lutil_MD5Final( MD5digest, &MD5context );
1033
1034         return pw_string64( scheme, &digest, hash, NULL );
1035 ;
1036 }
1037
1038 #ifdef SLAPD_LMHASH
1039 static int hash_lanman(
1040         const struct berval *scheme,
1041         const struct berval *passwd,
1042         struct berval *hash,
1043         const char **text )
1044 {
1045
1046         int i;
1047         char UcasePassword[15];
1048         des_cblock key;
1049         des_key_schedule schedule;
1050         des_cblock StdText = "KGS!@#$%";
1051         des_cblock PasswordHash1, PasswordHash2;
1052         char PasswordHash[33];
1053
1054         for( i=0; i<passwd->bv_len; i++) {
1055                 if(passwd->bv_val[i] == '\0') {
1056                         return -1;      /* NUL character in password */
1057                 }
1058         }
1059
1060         if( passwd->bv_val[i] != '\0' ) {
1061                 return -1;      /* passwd must behave like a string */
1062         }
1063
1064         strncpy( UcasePassword, passwd->bv_val, 14 );
1065         UcasePassword[14] = '\0';
1066         ldap_pvt_str2upper( UcasePassword );
1067
1068         lmPasswd_to_key( UcasePassword, &key );
1069         des_set_key_unchecked( &key, schedule );
1070         des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT );
1071
1072         lmPasswd_to_key( &UcasePassword[7], &key );
1073         des_set_key_unchecked( &key, schedule );
1074         des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT );
1075
1076         sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
1077                 PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3],
1078                 PasswordHash1[4],PasswordHash1[5],PasswordHash1[6],PasswordHash1[7],
1079                 PasswordHash2[0],PasswordHash2[1],PasswordHash2[2],PasswordHash2[3],
1080                 PasswordHash2[4],PasswordHash2[5],PasswordHash2[6],PasswordHash2[7] );
1081
1082         hash->bv_val = PasswordHash;
1083         hash->bv_len = 32;
1084
1085         return pw_string( scheme, hash );
1086 }
1087 #endif /* SLAPD_LMHASH */
1088
1089 #ifdef SLAPD_CRYPT
1090 static int hash_crypt(
1091         const struct berval *scheme,
1092         const struct berval *passwd,
1093         struct berval *hash,
1094         const char **text )
1095 {
1096         unsigned char salt[32]; /* salt suitable for most anything */
1097         unsigned int i;
1098
1099         for( i=0; i<passwd->bv_len; i++) {
1100                 if(passwd->bv_val[i] == '\0') {
1101                         return NULL;    /* NUL character in password */
1102                 }
1103         }
1104
1105         if( passwd->bv_val[i] != '\0' ) {
1106                 return NULL;    /* passwd must behave like a string */
1107         }
1108
1109         if( lutil_entropy( salt, sizeof( salt ) ) < 0 ) {
1110                 return NULL;
1111         }
1112
1113         for( i=0; i< ( sizeof(salt) - 1 ); i++ ) {
1114                 salt[i] = crypt64[ salt[i] % (sizeof(crypt64)-1) ];
1115         }
1116         salt[sizeof( salt ) - 1 ] = '\0';
1117
1118         if( salt_format != NULL ) {
1119                 /* copy the salt we made into entropy before snprintfing
1120                    it back into the salt */
1121                 char entropy[sizeof(salt)];
1122                 strcpy( entropy, (char *) salt );
1123                 snprintf( (char *) salt, sizeof(entropy), salt_format, entropy );
1124         }
1125
1126         hash->bv_val = crypt( passwd->bv_val, (char *) salt );
1127
1128         if( hash->bv_val == NULL ) return NULL;
1129
1130         hash->bv_len = strlen( hash->bv_val );
1131
1132         if( hash->bv_len == 0 ) {
1133                 return -1;
1134         }
1135
1136         return pw_string( scheme, hash );
1137 }
1138 #endif
1139
1140 int lutil_salt_format(const char *format)
1141 {
1142 #ifdef SLAPD_CRYPT
1143         free( salt_format );
1144
1145         salt_format = format != NULL ? strdup( format ) : NULL;
1146 #endif
1147
1148         return 0;
1149 }
1150
1151 #ifdef SLAPD_CLEARTEXT
1152 static int hash_clear(
1153         const struct berval *scheme,
1154         const struct berval  *passwd,
1155         struct berval *hash,
1156         const char **text )
1157 {
1158         ber_dupbv( hash, (struct berval *)passwd );
1159         return 0;
1160 }
1161 #endif
1162