3 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
8 * const struct berval *passwd,
9 * const struct berval *cred,
10 * const char **schemes )
12 * Returns true if user supplied credentials (cred) matches
13 * the stored password (passwd).
15 * Due to the use of the crypt(3) function
16 * this routine is NOT thread-safe.
22 #include <ac/stdlib.h>
23 #include <ac/string.h>
24 #include <ac/unistd.h>
27 # include <openssl/des.h>
28 #endif /* SLAPD_LMHASH */
31 # ifdef HAVE_SASL_SASL_H
32 # include <sasl/sasl.h>
46 # include <ac/crypt.h>
48 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
55 # ifdef HAVE_AIX_SECURITY
65 #include "lutil_md5.h"
66 #include "lutil_sha1.h"
69 static const unsigned char crypt64[] =
70 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890./";
73 static char *salt_format = NULL;
78 typedef int (*PASSWD_CHK_FUNC)(
79 const struct pw_scheme *scheme,
80 const struct berval *passwd,
81 const struct berval *cred );
83 typedef struct berval * (*PASSWD_HASH_FUNC) (
84 const struct pw_scheme *scheme,
85 const struct berval *passwd );
89 PASSWD_CHK_FUNC chk_fn;
90 PASSWD_HASH_FUNC hash_fn;
93 /* password check routines */
95 const struct pw_scheme *scheme,
96 const struct berval *passwd,
97 const struct berval *cred );
100 const struct pw_scheme *scheme,
101 const struct berval *passwd,
102 const struct berval *cred );
104 #ifdef LUTIL_SHA1_BYTES
105 static int chk_ssha1(
106 const struct pw_scheme *scheme,
107 const struct berval *passwd,
108 const struct berval *cred );
111 const struct pw_scheme *scheme,
112 const struct berval *passwd,
113 const struct berval *cred );
117 static int chk_lanman(
118 const struct pw_scheme *scheme,
119 const struct berval *passwd,
120 const struct berval *cred );
125 const struct pw_scheme *scheme,
126 const struct berval *passwd,
127 const struct berval *cred );
131 static int chk_kerberos(
132 const struct pw_scheme *scheme,
133 const struct berval *passwd,
134 const struct berval *cred );
138 static int chk_crypt(
139 const struct pw_scheme *scheme,
140 const struct berval *passwd,
141 const struct berval *cred );
143 #if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
145 const struct pw_scheme *scheme,
146 const struct berval *passwd,
147 const struct berval *cred );
152 #ifdef LUTIL_SHA1_BYTES
153 /* password hash routines */
154 static struct berval *hash_sha1(
155 const struct pw_scheme *scheme,
156 const struct berval *passwd );
158 static struct berval *hash_ssha1(
159 const struct pw_scheme *scheme,
160 const struct berval *passwd );
163 static struct berval *hash_smd5(
164 const struct pw_scheme *scheme,
165 const struct berval *passwd );
167 static struct berval *hash_md5(
168 const struct pw_scheme *scheme,
169 const struct berval *passwd );
172 static struct berval *hash_lanman(
173 const struct pw_scheme *scheme,
174 const struct berval *passwd );
178 static struct berval *hash_crypt(
179 const struct pw_scheme *scheme,
180 const struct berval *passwd );
183 #ifdef SLAPD_CLEARTEXT
184 static struct berval *hash_clear(
185 const struct pw_scheme *scheme,
186 const struct berval *passwd );
189 static const struct pw_scheme pw_schemes[] =
191 #ifdef LUTIL_SHA1_BYTES
192 { {sizeof("{SSHA}")-1, "{SSHA}"}, chk_ssha1, hash_ssha1 },
193 { {sizeof("{SHA}")-1, "{SHA}"}, chk_sha1, hash_sha1 },
196 { {sizeof("{SMD5}")-1, "{SMD5}"}, chk_smd5, hash_smd5 },
197 { {sizeof("{MD5}")-1, "{MD5}"}, chk_md5, hash_md5 },
200 { {sizeof("{LANMAN}")-1, "{LANMAN}"}, chk_lanman, hash_lanman },
201 #endif /* SLAPD_LMHASH */
204 { {sizeof("{SASL}")-1, "{SASL}"}, chk_sasl, NULL },
208 { {sizeof("{KERBEROS}")-1, "{KERBEROS}"}, chk_kerberos, NULL },
212 { {sizeof("{CRYPT}")-1, "{CRYPT}"}, chk_crypt, hash_crypt },
213 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
214 { {sizeof("{UNIX}")-1, "{UNIX}"}, chk_unix, NULL },
218 #ifdef SLAPD_CLEARTEXT
220 { {0, "{CLEARTEXT}"}, NULL, hash_clear },
223 { {0, NULL}, NULL, NULL }
226 static const struct pw_scheme *get_scheme(
231 for( i=0; pw_schemes[i].name.bv_val; i++) {
232 if( pw_schemes[i].name.bv_val == NULL ) continue;
234 if( strcasecmp(scheme, pw_schemes[i].name.bv_val ) == 0 ) {
235 return &pw_schemes[i];
242 int lutil_passwd_scheme(
245 if( scheme == NULL ) {
249 return get_scheme(scheme) != NULL;
253 static int is_allowed_scheme(
255 const char** schemes )
259 if( schemes == NULL ) return 1;
261 for( i=0; schemes[i] != NULL; i++ ) {
262 if( strcasecmp( scheme, schemes[i] ) == 0 ) {
269 static struct berval *passwd_scheme(
270 const struct pw_scheme *scheme,
271 const struct berval * passwd,
272 const char** allowed )
274 if( !is_allowed_scheme( scheme->name.bv_val, allowed ) ) {
278 if( passwd->bv_len >= scheme->name.bv_len ) {
279 if( strncasecmp( passwd->bv_val, scheme->name.bv_val, scheme->name.bv_len ) == 0 ) {
280 struct berval *bv = ber_memalloc( sizeof(struct berval) );
282 if( bv == NULL ) return NULL;
284 bv->bv_val = &passwd->bv_val[scheme->name.bv_len];
285 bv->bv_len = passwd->bv_len - scheme->name.bv_len;
295 * Return 0 if creds are good.
299 const struct berval *passwd, /* stored passwd */
300 const struct berval *cred, /* user cred */
301 const char **schemes )
305 if (cred == NULL || cred->bv_len == 0 ||
306 passwd == NULL || passwd->bv_len == 0 )
311 for( i=0; pw_schemes[i].name.bv_val != NULL; i++ ) {
312 if( pw_schemes[i].chk_fn ) {
313 struct berval *p = passwd_scheme( &pw_schemes[i],
317 int rc = (pw_schemes[i].chk_fn)( &pw_schemes[i], p, cred );
319 /* only free the berval structure as the bv_val points
320 * into passwd->bv_val
329 #ifdef SLAPD_CLEARTEXT
330 if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) {
331 return passwd->bv_len == cred->bv_len
332 ? memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
339 struct berval * lutil_passwd_generate( ber_len_t len )
343 if( len < 1 ) return NULL;
345 pw = ber_memalloc( sizeof( struct berval ) );
346 if( pw == NULL ) return NULL;
349 pw->bv_val = ber_memalloc( len + 1 );
351 if( pw->bv_val == NULL ) {
356 if( lutil_entropy( pw->bv_val, pw->bv_len) < 0 ) {
361 for( len = 0; len < pw->bv_len; len++ ) {
362 pw->bv_val[len] = crypt64[
363 pw->bv_val[len] % (sizeof(crypt64)-1) ];
366 pw->bv_val[len] = '\0';
371 struct berval * lutil_passwd_hash(
372 const struct berval * passwd,
373 const char * method )
375 const struct pw_scheme *sc = get_scheme( method );
377 if( sc == NULL ) return NULL;
378 if( ! sc->hash_fn ) return NULL;
380 return (sc->hash_fn)( sc, passwd );
383 /* pw_string is only called when SLAPD_LMHASH or SLAPD_CRYPT is defined */
384 #if defined(SLAPD_LMHASH) || defined(SLAPD_CRYPT)
385 static struct berval * pw_string(
386 const struct pw_scheme *sc,
387 const struct berval *passwd )
389 struct berval *pw = ber_memalloc( sizeof( struct berval ) );
390 if( pw == NULL ) return NULL;
392 pw->bv_len = sc->name.bv_len + passwd->bv_len;
393 pw->bv_val = ber_memalloc( pw->bv_len + 1 );
395 if( pw->bv_val == NULL ) {
400 AC_MEMCPY( pw->bv_val, sc->name.bv_val, sc->name.bv_len );
401 AC_MEMCPY( &pw->bv_val[sc->name.bv_len], passwd->bv_val, passwd->bv_len );
403 pw->bv_val[pw->bv_len] = '\0';
406 #endif /* SLAPD_LMHASH || SLAPD_CRYPT */
408 static struct berval * pw_string64(
409 const struct pw_scheme *sc,
410 const struct berval *hash,
411 const struct berval *salt )
414 struct berval string;
415 struct berval *b64 = ber_memalloc( sizeof(struct berval) );
418 if( b64 == NULL ) return NULL;
421 /* need to base64 combined string */
422 string.bv_len = hash->bv_len + salt->bv_len;
423 string.bv_val = ber_memalloc( string.bv_len + 1 );
425 if( string.bv_val == NULL ) {
430 AC_MEMCPY( string.bv_val, hash->bv_val,
432 AC_MEMCPY( &string.bv_val[hash->bv_len], salt->bv_val,
434 string.bv_val[string.bv_len] = '\0';
440 b64len = LUTIL_BASE64_ENCODE_LEN( string.bv_len ) + 1;
441 b64->bv_len = b64len + sc->name.bv_len;
442 b64->bv_val = ber_memalloc( b64->bv_len + 1 );
444 if( b64->bv_val == NULL ) {
445 if( salt ) ber_memfree( string.bv_val );
450 AC_MEMCPY(b64->bv_val, sc->name.bv_val, sc->name.bv_len);
453 string.bv_val, string.bv_len,
454 &b64->bv_val[sc->name.bv_len], b64len );
456 if( salt ) ber_memfree( string.bv_val );
463 /* recompute length */
464 b64->bv_len = sc->name.bv_len + rc;
465 assert( strlen(b64->bv_val) == b64->bv_len );
469 /* PASSWORD CHECK ROUTINES */
471 #ifdef LUTIL_SHA1_BYTES
472 static int chk_ssha1(
473 const struct pw_scheme *sc,
474 const struct berval * passwd,
475 const struct berval * cred )
477 lutil_SHA1_CTX SHA1context;
478 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
480 unsigned char *orig_pass = NULL;
482 /* decode base64 password */
483 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
484 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
486 if( orig_pass == NULL ) return -1;
488 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
491 ber_memfree(orig_pass);
495 /* hash credentials with salt */
496 lutil_SHA1Init(&SHA1context);
497 lutil_SHA1Update(&SHA1context,
498 (const unsigned char *) cred->bv_val, cred->bv_len);
499 lutil_SHA1Update(&SHA1context,
500 (const unsigned char *) &orig_pass[sizeof(SHA1digest)],
501 rc - sizeof(SHA1digest));
502 lutil_SHA1Final(SHA1digest, &SHA1context);
505 rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
506 ber_memfree(orig_pass);
511 const struct pw_scheme *sc,
512 const struct berval * passwd,
513 const struct berval * cred )
515 lutil_SHA1_CTX SHA1context;
516 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
518 unsigned char *orig_pass = NULL;
520 /* base64 un-encode password */
521 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
522 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
524 if( orig_pass == NULL ) return -1;
526 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
528 if( rc != sizeof(SHA1digest) ) {
529 ber_memfree(orig_pass);
533 /* hash credentials with salt */
534 lutil_SHA1Init(&SHA1context);
535 lutil_SHA1Update(&SHA1context,
536 (const unsigned char *) cred->bv_val, cred->bv_len);
537 lutil_SHA1Final(SHA1digest, &SHA1context);
540 rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
541 ber_memfree(orig_pass);
547 const struct pw_scheme *sc,
548 const struct berval * passwd,
549 const struct berval * cred )
551 lutil_MD5_CTX MD5context;
552 unsigned char MD5digest[LUTIL_MD5_BYTES];
554 unsigned char *orig_pass = NULL;
556 /* base64 un-encode password */
557 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
558 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
560 if( orig_pass == NULL ) return -1;
562 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
564 ber_memfree(orig_pass);
568 /* hash credentials with salt */
569 lutil_MD5Init(&MD5context);
570 lutil_MD5Update(&MD5context,
571 (const unsigned char *) cred->bv_val,
573 lutil_MD5Update(&MD5context,
574 &orig_pass[sizeof(MD5digest)],
575 rc - sizeof(MD5digest));
576 lutil_MD5Final(MD5digest, &MD5context);
579 rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
580 ber_memfree(orig_pass);
585 const struct pw_scheme *sc,
586 const struct berval * passwd,
587 const struct berval * cred )
589 lutil_MD5_CTX MD5context;
590 unsigned char MD5digest[LUTIL_MD5_BYTES];
592 unsigned char *orig_pass = NULL;
594 /* base64 un-encode password */
595 orig_pass = (unsigned char *) ber_memalloc( (size_t) (
596 LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
598 if( orig_pass == NULL ) return -1;
600 rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
601 if ( rc != sizeof(MD5digest) ) {
602 ber_memfree(orig_pass);
606 /* hash credentials with salt */
607 lutil_MD5Init(&MD5context);
608 lutil_MD5Update(&MD5context,
609 (const unsigned char *) cred->bv_val,
611 lutil_MD5Final(MD5digest, &MD5context);
614 rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
615 ber_memfree(orig_pass);
620 static int chk_lanman(
621 const struct pw_scheme *scheme,
622 const struct berval *passwd,
623 const struct berval *cred )
627 hash = hash_lanman( scheme, cred );
628 return memcmp( &hash->bv_val[scheme->name.bv_len], passwd->bv_val, 32);
630 #endif /* SLAPD_LMHASH */
633 #ifdef HAVE_CYRUS_SASL
634 sasl_conn_t *lutil_passwd_sasl_conn = NULL;
638 const struct pw_scheme *sc,
639 const struct berval * passwd,
640 const struct berval * cred )
645 for( i=0; i<cred->bv_len; i++) {
646 if(cred->bv_val[i] == '\0') {
647 return 1; /* NUL character in password */
651 if( cred->bv_val[i] != '\0' ) {
652 return 1; /* cred must behave like a string */
655 for( i=0; i<passwd->bv_len; i++) {
656 if(passwd->bv_val[i] == '\0') {
657 return 1; /* NUL character in password */
661 if( passwd->bv_val[i] != '\0' ) {
662 return 1; /* passwd must behave like a string */
667 #ifdef HAVE_CYRUS_SASL
668 if( lutil_passwd_sasl_conn != NULL ) {
670 # if SASL_VERSION_MAJOR < 2
671 const char *errstr = NULL;
672 sc = sasl_checkpass( lutil_passwd_sasl_conn,
673 passwd->bv_val, passwd->bv_len,
674 cred->bv_val, cred->bv_len,
677 sc = sasl_checkpass( lutil_passwd_sasl_conn,
678 passwd->bv_val, passwd->bv_len,
679 cred->bv_val, cred->bv_len );
681 rtn = ( sc != SASL_OK );
690 static int chk_kerberos(
691 const struct pw_scheme *sc,
692 const struct berval * passwd,
693 const struct berval * cred )
698 for( i=0; i<cred->bv_len; i++) {
699 if(cred->bv_val[i] == '\0') {
700 return 1; /* NUL character in password */
704 if( cred->bv_val[i] != '\0' ) {
705 return 1; /* cred must behave like a string */
708 for( i=0; i<passwd->bv_len; i++) {
709 if(passwd->bv_val[i] == '\0') {
710 return 1; /* NUL character in password */
714 if( passwd->bv_val[i] != '\0' ) {
715 return 1; /* passwd must behave like a string */
720 #ifdef HAVE_KRB5 /* HAVE_HEIMDAL_KRB5 */
723 * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska H\xf6gskolan
724 * (Royal Institute of Technology, Stockholm, Sweden).
725 * All rights reserved.
727 * Redistribution and use in source and binary forms, with or without
728 * modification, are permitted provided that the following conditions
731 * 1. Redistributions of source code must retain the above copyright
732 * notice, this list of conditions and the following disclaimer.
734 * 2. Redistributions in binary form must reproduce the above copyright
735 * notice, this list of conditions and the following disclaimer in the
736 * documentation and/or other materials provided with the distribution.
738 * 3. Neither the name of the Institute nor the names of its contributors
739 * may be used to endorse or promote products derived from this software
740 * without specific prior written permission.
742 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
743 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
744 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
745 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
746 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
747 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
748 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
749 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
750 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
751 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
755 krb5_context context;
758 krb5_get_init_creds_opt get_options;
759 krb5_verify_init_creds_opt verify_options;
760 krb5_principal client, server;
762 krb5_preauthtype pre_auth_types[] = {KRB5_PADATA_ENC_TIMESTAMP};
765 ret = krb5_init_context( &context );
771 krb5_get_init_creds_opt_set_preauth_list(&get_options,
775 krb5_get_init_creds_opt_init( &get_options );
777 krb5_verify_init_creds_opt_init( &verify_options );
779 ret = krb5_parse_name( context, passwd->bv_val, &client );
782 krb5_free_context( context );
786 ret = krb5_get_init_creds_password( context,
787 &creds, client, cred->bv_val, NULL,
788 NULL, 0, NULL, &get_options );
791 krb5_free_principal( context, client );
792 krb5_free_context( context );
797 char *host = ldap_pvt_get_fqdn( NULL );
800 krb5_free_principal( context, client );
801 krb5_free_context( context );
805 ret = krb5_sname_to_principal( context,
806 host, "ldap", KRB5_NT_SRV_HST, &server );
812 krb5_free_principal( context, client );
813 krb5_free_context( context );
817 ret = krb5_verify_init_creds( context,
818 &creds, server, NULL, NULL, &verify_options );
820 krb5_free_principal( context, client );
821 krb5_free_principal( context, server );
822 krb5_free_cred_contents( context, &creds );
823 krb5_free_context( context );
827 #elif defined(HAVE_KRB4)
829 /* Borrowed from Heimdal kpopper */
831 * Copyright (c) 1989 Regents of the University of California.
832 * All rights reserved. The Berkeley software License Agreement
833 * specifies the terms and conditions for redistribution.
837 char lrealm[REALM_SZ];
838 char tkt[MAXHOSTNAMELEN];
840 status = krb_get_lrealm(lrealm,1);
841 if (status == KFAILURE) {
845 snprintf(tkt, sizeof(tkt), "%s_slapd.%u",
846 TKT_ROOT, (unsigned)getpid());
847 krb_set_tkt_string (tkt);
849 status = krb_verify_user( passwd->bv_val, "", lrealm,
850 cred->bv_val, 1, "ldap");
852 dest_tkt(); /* no point in keeping the tickets */
854 return status == KFAILURE;
860 #endif /* SLAPD_KPASSWD */
863 static int chk_crypt(
864 const struct pw_scheme *sc,
865 const struct berval * passwd,
866 const struct berval * cred )
871 for( i=0; i<cred->bv_len; i++) {
872 if(cred->bv_val[i] == '\0') {
873 return 1; /* NUL character in password */
877 if( cred->bv_val[i] != '\0' ) {
878 return -1; /* cred must behave like a string */
881 if( passwd->bv_len < 2 ) {
882 return -1; /* passwd must be at least two characters long */
885 for( i=0; i<passwd->bv_len; i++) {
886 if(passwd->bv_val[i] == '\0') {
887 return -1; /* NUL character in password */
891 if( passwd->bv_val[i] != '\0' ) {
892 return -1; /* passwd must behave like a string */
895 cr = crypt( cred->bv_val, passwd->bv_val );
897 if( cr == NULL || cr[0] == '\0' ) {
898 /* salt must have been invalid */
902 return strcmp( passwd->bv_val, cr ) ? 1 : 0;
905 # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD )
907 const struct pw_scheme *sc,
908 const struct berval * passwd,
909 const struct berval * cred )
914 for( i=0; i<cred->bv_len; i++) {
915 if(cred->bv_val[i] == '\0') {
916 return -1; /* NUL character in password */
919 if( cred->bv_val[i] != '\0' ) {
920 return -1; /* cred must behave like a string */
923 for( i=0; i<passwd->bv_len; i++) {
924 if(passwd->bv_val[i] == '\0') {
925 return -1; /* NUL character in password */
929 if( passwd->bv_val[i] != '\0' ) {
930 return -1; /* passwd must behave like a string */
934 struct passwd *pwd = getpwnam(passwd->bv_val);
937 return -1; /* not found */
942 # ifdef HAVE_GETSPNAM
944 struct spwd *spwd = getspnam(passwd->bv_val);
951 # ifdef HAVE_AIX_SECURITY
953 struct userpw *upw = getuserpw(passwd->bv_val);
956 pw = upw->upw_passwd;
961 if( pw == NULL || pw[0] == '\0' || pw[1] == '\0' ) {
962 /* password must must be at least two characters long */
966 cr = crypt(cred->bv_val, pw);
968 if( cr == NULL || cr[0] == '\0' ) {
969 /* salt must have been invalid */
973 return strcmp(pw, cr) ? 1 : 0;
979 /* PASSWORD GENERATION ROUTINES */
981 #ifdef LUTIL_SHA1_BYTES
982 static struct berval *hash_ssha1(
983 const struct pw_scheme *scheme,
984 const struct berval *passwd )
986 lutil_SHA1_CTX SHA1context;
987 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
988 unsigned char saltdata[4];
989 struct berval digest;
992 digest.bv_val = SHA1digest;
993 digest.bv_len = sizeof(SHA1digest);
994 salt.bv_val = saltdata;
995 salt.bv_len = sizeof(saltdata);
997 if( lutil_entropy( salt.bv_val, salt.bv_len) < 0 ) {
1001 lutil_SHA1Init( &SHA1context );
1002 lutil_SHA1Update( &SHA1context,
1003 (const unsigned char *)passwd->bv_val, passwd->bv_len );
1004 lutil_SHA1Update( &SHA1context,
1005 (const unsigned char *)salt.bv_val, salt.bv_len );
1006 lutil_SHA1Final( SHA1digest, &SHA1context );
1008 return pw_string64( scheme, &digest, &salt);
1011 static struct berval *hash_sha1(
1012 const struct pw_scheme *scheme,
1013 const struct berval *passwd )
1015 lutil_SHA1_CTX SHA1context;
1016 unsigned char SHA1digest[LUTIL_SHA1_BYTES];
1017 struct berval digest;
1018 digest.bv_val = SHA1digest;
1019 digest.bv_len = sizeof(SHA1digest);
1021 lutil_SHA1Init( &SHA1context );
1022 lutil_SHA1Update( &SHA1context,
1023 (const unsigned char *)passwd->bv_val, passwd->bv_len );
1024 lutil_SHA1Final( SHA1digest, &SHA1context );
1026 return pw_string64( scheme, &digest, NULL);
1030 static struct berval *hash_smd5(
1031 const struct pw_scheme *scheme,
1032 const struct berval *passwd )
1034 lutil_MD5_CTX MD5context;
1035 unsigned char MD5digest[LUTIL_MD5_BYTES];
1036 unsigned char saltdata[4];
1037 struct berval digest;
1040 digest.bv_val = MD5digest;
1041 digest.bv_len = sizeof(MD5digest);
1042 salt.bv_val = saltdata;
1043 salt.bv_len = sizeof(saltdata);
1045 if( lutil_entropy( salt.bv_val, salt.bv_len) < 0 ) {
1049 lutil_MD5Init( &MD5context );
1050 lutil_MD5Update( &MD5context,
1051 (const unsigned char *) passwd->bv_val, passwd->bv_len );
1052 lutil_MD5Update( &MD5context,
1053 (const unsigned char *) salt.bv_val, salt.bv_len );
1054 lutil_MD5Final( MD5digest, &MD5context );
1056 return pw_string64( scheme, &digest, &salt );
1059 static struct berval *hash_md5(
1060 const struct pw_scheme *scheme,
1061 const struct berval *passwd )
1063 lutil_MD5_CTX MD5context;
1064 unsigned char MD5digest[LUTIL_MD5_BYTES];
1066 struct berval digest;
1068 digest.bv_val = MD5digest;
1069 digest.bv_len = sizeof(MD5digest);
1071 lutil_MD5Init( &MD5context );
1072 lutil_MD5Update( &MD5context,
1073 (const unsigned char *) passwd->bv_val, passwd->bv_len );
1074 lutil_MD5Final( MD5digest, &MD5context );
1076 return pw_string64( scheme, &digest, NULL );
1081 /* pseudocode from RFC2433
1082 * A.2 LmPasswordHash()
1085 * IN 0-to-14-oem-char Password,
1086 * OUT 16-octet PasswordHash )
1088 * Set UcasePassword to the uppercased Password
1089 * Zero pad UcasePassword to 14 characters
1091 * DesHash( 1st 7-octets of UcasePassword,
1092 * giving 1st 8-octets of PasswordHash )
1094 * DesHash( 2nd 7-octets of UcasePassword,
1095 * giving 2nd 8-octets of PasswordHash )
1103 * OUT 8-octet Cypher )
1106 * * Make Cypher an irreversibly encrypted form of Clear by
1107 * * encrypting known text using Clear as the secret key.
1108 * * The known text consists of the string
1113 * Set StdText to "KGS!@#$%"
1114 * DesEncrypt( StdText, Clear, giving Cypher )
1123 * OUT 8-octet Cypher )
1126 * * Use the DES encryption algorithm [4] in ECB mode [9]
1127 * * to encrypt Clear into Cypher such that Cypher can
1128 * * only be decrypted back to Clear by providing Key.
1129 * * Note that the DES algorithm takes as input a 64-bit
1130 * * stream where the 8th, 16th, 24th, etc. bits are
1131 * * parity bits ignored by the encrypting algorithm.
1132 * * Unless you write your own DES to accept 56-bit input
1133 * * without parity, you will need to insert the parity bits
1139 static void lmPasswd_to_key(
1140 const unsigned char *lmPasswd,
1143 /* make room for parity bits */
1144 ((char *)key)[0] = lmPasswd[0];
1145 ((char *)key)[1] = ((lmPasswd[0]&0x01)<<7) | (lmPasswd[1]>>1);
1146 ((char *)key)[2] = ((lmPasswd[1]&0x03)<<6) | (lmPasswd[2]>>2);
1147 ((char *)key)[3] = ((lmPasswd[2]&0x07)<<5) | (lmPasswd[3]>>3);
1148 ((char *)key)[4] = ((lmPasswd[3]&0x0F)<<4) | (lmPasswd[4]>>4);
1149 ((char *)key)[5] = ((lmPasswd[4]&0x1F)<<3) | (lmPasswd[5]>>5);
1150 ((char *)key)[6] = ((lmPasswd[5]&0x3F)<<2) | (lmPasswd[6]>>6);
1151 ((char *)key)[7] = ((lmPasswd[6]&0x7F)<<1);
1153 des_set_odd_parity( key );
1156 static struct berval *hash_lanman(
1157 const struct pw_scheme *scheme,
1158 const struct berval *passwd )
1162 char UcasePassword[15];
1164 des_key_schedule schedule;
1165 des_cblock StdText = "KGS!@#$%";
1166 des_cblock hash1, hash2;
1170 for( i=0; i<passwd->bv_len; i++) {
1171 if(passwd->bv_val[i] == '\0') {
1172 return NULL; /* NUL character in password */
1176 if( passwd->bv_val[i] != '\0' ) {
1177 return NULL; /* passwd must behave like a string */
1180 strncpy( UcasePassword, passwd->bv_val, 14 );
1181 UcasePassword[14] = '\0';
1182 ldap_pvt_str2upper( UcasePassword );
1184 lmPasswd_to_key( UcasePassword, &key );
1185 des_set_key_unchecked( &key, schedule );
1186 des_ecb_encrypt( &StdText, &hash1, schedule , DES_ENCRYPT );
1188 lmPasswd_to_key( &UcasePassword[7], &key );
1189 des_set_key_unchecked( &key, schedule );
1190 des_ecb_encrypt( &StdText, &hash2, schedule , DES_ENCRYPT );
1192 sprintf( lmhash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
1193 hash1[0],hash1[1],hash1[2],hash1[3],hash1[4],hash1[5],hash1[6],hash1[7],
1194 hash2[0],hash2[1],hash2[2],hash2[3],hash2[4],hash2[5],hash2[6],hash2[7] );
1196 hash.bv_val = lmhash;
1199 return pw_string( scheme, &hash );
1201 #endif /* SLAPD_LMHASH */
1204 static struct berval *hash_crypt(
1205 const struct pw_scheme *scheme,
1206 const struct berval *passwd )
1209 unsigned char salt[32]; /* salt suitable for most anything */
1212 for( i=0; i<passwd->bv_len; i++) {
1213 if(passwd->bv_val[i] == '\0') {
1214 return NULL; /* NUL character in password */
1218 if( passwd->bv_val[i] != '\0' ) {
1219 return NULL; /* passwd must behave like a string */
1222 if( lutil_entropy( salt, sizeof( salt ) ) < 0 ) {
1226 for( i=0; i< ( sizeof(salt) - 1 ); i++ ) {
1227 salt[i] = crypt64[ salt[i] % (sizeof(crypt64)-1) ];
1229 salt[sizeof( salt ) - 1 ] = '\0';
1231 if( salt_format != NULL ) {
1232 /* copy the salt we made into entropy before snprintfing
1233 it back into the salt */
1234 char entropy[sizeof(salt)];
1235 strcpy( entropy, salt );
1236 snprintf( salt, sizeof(entropy), salt_format, entropy );
1239 hash.bv_val = crypt( passwd->bv_val, salt );
1241 if( hash.bv_val == NULL ) return NULL;
1243 hash.bv_len = strlen( hash.bv_val );
1245 if( hash.bv_len == 0 ) {
1249 return pw_string( scheme, &hash );
1253 int lutil_salt_format(const char *format)
1256 free( salt_format );
1258 salt_format = format != NULL ? strdup( format ) : NULL;
1264 #ifdef SLAPD_CLEARTEXT
1265 static struct berval *hash_clear(
1266 const struct pw_scheme *scheme,
1267 const struct berval *passwd )
1269 return ber_bvdup( (struct berval *) passwd );