Rework counter code in fallback.

[openldap] / libraries / liblutil / passwd.c

diff --git a/libraries/liblutil/passwd.c b/libraries/liblutil/passwd.c
index a8f69dc5ff3baea01409fbf8db9d1c8aa3fdc06a..4960add60d74dfb82b963cb1e7d9355256a0eca8 100644 (file)
--- a/libraries/liblutil/passwd.c
+++ b/libraries/liblutil/passwd.c
@@ -1,3 +1,8 @@
+/* $OpenLDAP$ */
+/*
+ * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
 /*
  * lutil_password(credentials, password)
  *
@@ -10,35 +15,101 @@
 
 #include "portable.h"
 
-#include <stdlib.h>
+#include <ac/stdlib.h>
 
 #include <ac/string.h>
 #include <ac/unistd.h>
+#include <ac/crypt.h>
 
 #include "lutil_md5.h"
 #include "lutil_sha1.h"
 #include "lutil.h"
 
+#ifdef HAVE_SHADOW_H
+#      include <shadow.h>
+#endif
+#ifdef HAVE_PWD_H
+#      include <pwd.h>
+#endif
+
+static int is_allowed_scheme(
+       const char* scheme,
+       const char** schemes )
+{
+       int i;
+
+       if(schemes == NULL) {
+               return 1;
+       }
+
+       for(i=0; schemes[i] != NULL; i++) {
+               if(strcasecmp(scheme, schemes[i]) == 0) {
+                       return 1;
+               }
+       }
+
+       return 0;
+}
+
+const char *lutil_passwd_schemes[] = {
+#ifdef SLAPD_CRYPT
+       "{CRYPT}",
+#endif
+       "{MD5}", "{SMD5}",
+       "{SHA}", "{SSHA}",
+# if defined( HAVE_GETSPNAM ) \
+  || ( defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD ) )
+       "{UNIX}",
+#endif
+#ifdef SLAPD_CLEARTEXT
+       "{CLEARTEXT}",          /* psuedo scheme */
+#endif
+       NULL,
+};
+
+int lutil_passwd_scheme( char *scheme ) {
+       return is_allowed_scheme( scheme, lutil_passwd_schemes );
+}
+
+static const char *passwd_scheme(
+       const char* passwd,
+       const char* scheme,
+       const char** schemes )
+{
+       int len;
+
+       if( !is_allowed_scheme( scheme, schemes ) ) {
+               return NULL;
+       }
+
+       len = strlen(scheme);
+
+       if( strncasecmp( passwd, scheme, len ) == 0 ) {
+               return &passwd[len];
+       }
+
+       return NULL;
+}
+
 /*
  * Return 0 if creds are good.
  */
-
 int
 lutil_passwd(
        const char *cred,
-       const char *passwd)
+       const char *passwd,
+       const char **schemes)
 {
+       const char *p;
 
        if (cred == NULL || passwd == NULL) {
                return -1;
        }
 
-       if (strncasecmp(passwd, "{MD5}", sizeof("{MD5}") - 1) == 0 ) {
+       if ((p = passwd_scheme( passwd, "{MD5}", schemes )) != NULL ) {
                lutil_MD5_CTX MD5context;
                unsigned char MD5digest[16];
-               char base64digest[25];  /* ceiling(sizeof(input)/3) * 4 + 1 */
-
-               const char *p = passwd + (sizeof("{MD5}") - 1);
+               char base64digest[LUTIL_BASE64_ENCODE_LEN(16)]; 
 
                lutil_MD5Init(&MD5context);
                lutil_MD5Update(&MD5context,
@@ -53,11 +124,10 @@ lutil_passwd(
 
                return( strcmp(p, base64digest) );
 
-       } else if (strncasecmp(passwd, "{SHA}",sizeof("{SHA}") - 1) == 0 ) {
+       } else if ((p = passwd_scheme( passwd, "{SHA}", schemes )) != NULL ) {
                lutil_SHA1_CTX SHA1context;
                unsigned char SHA1digest[20];
-               char base64digest[29];  /* ceiling(sizeof(input)/3) * 4 + 1 */
-               const char *p = passwd + (sizeof("{SHA}") - 1);
+               char base64digest[LUTIL_BASE64_ENCODE_LEN(20)]; 
 
                lutil_SHA1Init(&SHA1context);
                lutil_SHA1Update(&SHA1context,
@@ -72,16 +142,16 @@ lutil_passwd(
 
                return( strcmp(p, base64digest) );
 
-       } else if (strncasecmp(passwd, "{SSHA}", sizeof("{SSHA}") - 1) == 0) {
+       } else if ((p = passwd_scheme( passwd, "{SSHA}", schemes )) != NULL ) {
                lutil_SHA1_CTX SHA1context;
                unsigned char SHA1digest[20];
-               const char *p = passwd + (sizeof("{SSHA}") - 1);
                int pw_len = strlen(p);
                int rc;
                unsigned char *orig_pass = NULL;
  
                /* base64 un-encode password */
-               orig_pass = (unsigned char *)malloc(pw_len * 0.75 + 1);
+               orig_pass = (unsigned char *) malloc( (size_t) (
+                       LUTIL_BASE64_DECODE_LEN(pw_len) + 1) );
                if ((rc = lutil_b64_pton(p, orig_pass, pw_len)) < 0)
                {
                        free(orig_pass);
@@ -98,20 +168,20 @@ lutil_passwd(
                lutil_SHA1Final(SHA1digest, &SHA1context);
  
                /* compare */
-               rc = strncmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
+               rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
                free(orig_pass);
                return(rc);
 
-       } else if (strncasecmp(passwd, "{SMD5}", sizeof("{SMD5}") - 1) == 0) {
+       } else if ((p = passwd_scheme( passwd, "{SMD5}", schemes )) != NULL ) {
                lutil_MD5_CTX MD5context;
                unsigned char MD5digest[16];
-               const char *p = passwd + (sizeof("{SMD5}") - 1);
                int pw_len = strlen(p);
                int rc;
                unsigned char *orig_pass = NULL;
 
                /* base64 un-encode password */
-               orig_pass = (unsigned char *)malloc(pw_len * 0.75 + 1);
+               orig_pass = (unsigned char *) malloc( (size_t) (
+                       LUTIL_BASE64_DECODE_LEN(pw_len) + 1) );
                if ((rc = lutil_b64_pton(p, orig_pass, pw_len)) < 0)
                {
                        free(orig_pass);
@@ -128,21 +198,42 @@ lutil_passwd(
                lutil_MD5Final(MD5digest, &MD5context);
 
                /* compare */
-               rc = strncmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
+               rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
                free(orig_pass);
                return ( rc );
 
 #ifdef SLAPD_CRYPT
-       } else if (strncasecmp(passwd, "{CRYPT}", sizeof("{CRYPT}") - 1) == 0 ) {
-               const char *p = passwd + (sizeof("{CRYPT}") - 1);
-
+       } else if ((p = passwd_scheme( passwd, "{CRYPT}", schemes )) != NULL ) {
                return( strcmp(p, crypt(cred, p)) );
 
+# if defined( HAVE_GETSPNAM ) \
+  || ( defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD ) )
+       } else if ((p = passwd_scheme( passwd, "{UNIX}", schemes )) != NULL ) {
+
+#  ifdef HAVE_GETSPNAM
+               struct spwd *spwd = getspnam(p);
+
+               if(spwd == NULL) {
+                       return 1;       /* not found */
+               }
+
+               return strcmp(spwd->sp_pwdp, crypt(cred, spwd->sp_pwdp));
+#  else
+               struct passwd *pwd = getpwnam(p);
+
+               if(pwd == NULL) {
+                       return 1;       /* not found */
+               }
+
+               return strcmp(pwd->pw_passwd, crypt(cred, pwd->pw_passwd));
+#  endif
+# endif
 #endif
        }
 
 #ifdef SLAPD_CLEARTEXT
-       return( strcmp(passwd, cred) );
+       return is_allowed_scheme("{CLEARTEXT}", schemes ) &&
+               strcmp(passwd, cred) != 0;
 #else
        return( 1 );
 #endif