X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;ds=inline;f=libraries%2Fliblutil%2Fpasswd.c;h=8cd6b1af484d93224541522b11533b1a9b12804e;hb=a26cca88ddf591e00ea7287e288fcbf56e08582b;hp=0d2d5aa35556238c8ad01b0b078db7e5e9a0df3f;hpb=66d9bf404b38579c84b5c0c0d238bfe58910f520;p=openldap diff --git a/libraries/liblutil/passwd.c b/libraries/liblutil/passwd.c index 0d2d5aa355..8cd6b1af48 100644 --- a/libraries/liblutil/passwd.c +++ b/libraries/liblutil/passwd.c @@ -1,6 +1,6 @@ /* $OpenLDAP$ */ /* - * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. + * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved. * COPYING RESTRICTIONS APPLY, see COPYRIGHT file */ /* @@ -23,14 +23,6 @@ #include #include -/* KPASSWD/krb.h brings in a conflicting des.h so don't use both. - * configure currently requires OpenSSL to enable LMHASH. Obviously - * this requirement can be fulfilled by the KRB DES library as well. - */ -#if defined(SLAPD_LMHASH) && !defined(SLAPD_KPASSWD) -# include -#endif /* SLAPD_LMHASH */ - #ifdef SLAPD_SPASSWD # ifdef HAVE_SASL_SASL_H # include @@ -44,6 +36,14 @@ # include #endif +/* KPASSWD/krb.h brings in a conflicting des.h so don't use both. + * configure currently requires OpenSSL to enable LMHASH. Obviously + * this requirement can be fulfilled by the KRB DES library as well. + */ +#if defined(SLAPD_LMHASH) && !defined(DES_ENCRYPT) +# include +#endif /* SLAPD_LMHASH */ + #include #ifdef SLAPD_CRYPT @@ -65,6 +65,7 @@ #include #include "ldap_pvt.h" +#include "lber_pvt.h" #include "lutil_md5.h" #include "lutil_sha1.h" @@ -77,166 +78,154 @@ static const unsigned char crypt64[] = static char *salt_format = NULL; #endif -struct pw_scheme; - -typedef int (*PASSWD_CHK_FUNC)( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); - -typedef struct berval * (*PASSWD_HASH_FUNC) ( - const struct pw_scheme *scheme, - const struct berval *passwd ); - struct pw_scheme { struct berval name; - PASSWD_CHK_FUNC chk_fn; - PASSWD_HASH_FUNC hash_fn; + LUTIL_PASSWD_CHK_FUNC *chk_fn; + LUTIL_PASSWD_HASH_FUNC *hash_fn; +}; + +struct pw_slist { + struct pw_slist *next; + struct pw_scheme s; }; /* password check routines */ -static int chk_md5( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); -static int chk_smd5( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); +static LUTIL_PASSWD_CHK_FUNC chk_md5; +static LUTIL_PASSWD_CHK_FUNC chk_smd5; +static LUTIL_PASSWD_HASH_FUNC hash_smd5; +static LUTIL_PASSWD_HASH_FUNC hash_md5; -#ifdef LUTIL_SHA1_BYTES -static int chk_ssha1( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); -static int chk_sha1( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); +#ifdef LUTIL_SHA1_BYTES +static LUTIL_PASSWD_CHK_FUNC chk_ssha1; +static LUTIL_PASSWD_CHK_FUNC chk_sha1; +static LUTIL_PASSWD_HASH_FUNC hash_sha1; +static LUTIL_PASSWD_HASH_FUNC hash_ssha1; #endif #ifdef SLAPD_LMHASH -static int chk_lanman( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); +static LUTIL_PASSWD_CHK_FUNC chk_lanman; +static LUTIL_PASSWD_HASH_FUNC hash_lanman; +#endif + +#ifdef SLAPD_NS_MTA_MD5 +static LUTIL_PASSWD_CHK_FUNC chk_ns_mta_md5; #endif #ifdef SLAPD_SPASSWD -static int chk_sasl( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); +static LUTIL_PASSWD_CHK_FUNC chk_sasl; #endif #ifdef SLAPD_KPASSWD -static int chk_kerberos( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); +static LUTIL_PASSWD_CHK_FUNC chk_kerberos; #endif #ifdef SLAPD_CRYPT -static int chk_crypt( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); +static LUTIL_PASSWD_CHK_FUNC chk_crypt; +static LUTIL_PASSWD_HASH_FUNC hash_crypt; #if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD ) -static int chk_unix( - const struct pw_scheme *scheme, - const struct berval *passwd, - const struct berval *cred ); +static LUTIL_PASSWD_CHK_FUNC chk_unix; #endif #endif - -#ifdef LUTIL_SHA1_BYTES /* password hash routines */ -static struct berval *hash_sha1( - const struct pw_scheme *scheme, - const struct berval *passwd ); - -static struct berval *hash_ssha1( - const struct pw_scheme *scheme, - const struct berval *passwd ); -#endif - -static struct berval *hash_smd5( - const struct pw_scheme *scheme, - const struct berval *passwd ); - -static struct berval *hash_md5( - const struct pw_scheme *scheme, - const struct berval *passwd ); - -#ifdef SLAPD_LMHASH -static struct berval *hash_lanman( - const struct pw_scheme *scheme, - const struct berval *passwd ); -#endif - -#ifdef SLAPD_CRYPT -static struct berval *hash_crypt( - const struct pw_scheme *scheme, - const struct berval *passwd ); -#endif #ifdef SLAPD_CLEARTEXT -static struct berval *hash_clear( - const struct pw_scheme *scheme, - const struct berval *passwd ); +static LUTIL_PASSWD_HASH_FUNC hash_clear; #endif -static const struct pw_scheme pw_schemes[] = +static struct pw_slist *pw_schemes; + +static const struct pw_scheme pw_schemes_default[] = { #ifdef LUTIL_SHA1_BYTES - { {sizeof("{SSHA}")-1, "{SSHA}"}, chk_ssha1, hash_ssha1 }, - { {sizeof("{SHA}")-1, "{SHA}"}, chk_sha1, hash_sha1 }, + { BER_BVC("{SSHA}"), chk_ssha1, hash_ssha1 }, + { BER_BVC("{SHA}"), chk_sha1, hash_sha1 }, #endif - { {sizeof("{SMD5}")-1, "{SMD5}"}, chk_smd5, hash_smd5 }, - { {sizeof("{MD5}")-1, "{MD5}"}, chk_md5, hash_md5 }, + { BER_BVC("{SMD5}"), chk_smd5, hash_smd5 }, + { BER_BVC("{MD5}"), chk_md5, hash_md5 }, #ifdef SLAPD_LMHASH - { {sizeof("{LANMAN}")-1, "{LANMAN}"}, chk_lanman, hash_lanman }, + { BER_BVC("{LANMAN}"), chk_lanman, hash_lanman }, #endif /* SLAPD_LMHASH */ +#ifdef SLAPD_NS_MTA_MD5 + { BER_BVC("{NS-MTA-MD5}"), chk_ns_mta_md5, NULL }, +#endif /* SLAPD_NS_MTA_MD5 */ + #ifdef SLAPD_SPASSWD - { {sizeof("{SASL}")-1, "{SASL}"}, chk_sasl, NULL }, + { BER_BVC("{SASL}"), chk_sasl, NULL }, #endif #ifdef SLAPD_KPASSWD - { {sizeof("{KERBEROS}")-1, "{KERBEROS}"}, chk_kerberos, NULL }, + { BER_BVC("{KERBEROS}"), chk_kerberos, NULL }, #endif #ifdef SLAPD_CRYPT - { {sizeof("{CRYPT}")-1, "{CRYPT}"}, chk_crypt, hash_crypt }, + { BER_BVC("{CRYPT}"), chk_crypt, hash_crypt }, # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD ) - { {sizeof("{UNIX}")-1, "{UNIX}"}, chk_unix, NULL }, + { BER_BVC("{UNIX}"), chk_unix, NULL }, # endif #endif #ifdef SLAPD_CLEARTEXT - /* psuedo scheme */ - { {0, "{CLEARTEXT}"}, NULL, hash_clear }, + /* pseudo scheme */ + { {0, "{CLEARTEXT}"}, NULL, hash_clear }, #endif - { {0, NULL}, NULL, NULL } + { BER_BVNULL, NULL, NULL } }; +int lutil_passwd_add( + struct berval *scheme, + LUTIL_PASSWD_CHK_FUNC *chk, + LUTIL_PASSWD_HASH_FUNC *hash ) +{ + struct pw_slist *ptr; + + ptr = ber_memalloc( sizeof( struct pw_slist )); + if (!ptr) return -1; + ptr->next = pw_schemes; + ptr->s.name = *scheme; + ptr->s.chk_fn = chk; + ptr->s.hash_fn = hash; + pw_schemes = ptr; + return 0; +} + +void lutil_passwd_init() +{ + struct pw_slist *ptr; + struct pw_scheme *s; + + for( s=(struct pw_scheme *)pw_schemes_default; s->name.bv_val; s++) { + if ( lutil_passwd_add( &s->name, s->chk_fn, s->hash_fn )) break; + } +} + +void lutil_passwd_destroy() +{ + struct pw_slist *ptr, *next; + + for( ptr=pw_schemes; ptr; ptr=next ) { + next = ptr->next; + ber_memfree( ptr ); + } +} + static const struct pw_scheme *get_scheme( const char* scheme ) { - int i; + struct pw_slist *pws; - for( i=0; pw_schemes[i].name.bv_val; i++) { - if( pw_schemes[i].name.bv_val == NULL ) continue; + if (!pw_schemes) lutil_passwd_init(); - if( strcasecmp(scheme, pw_schemes[i].name.bv_val ) == 0 ) { - return &pw_schemes[i]; + for( pws=pw_schemes; pws; pws=pws->next ) { + if( strcasecmp(scheme, pws->s.name.bv_val ) == 0 ) { + return &(pws->s); } } @@ -301,7 +290,7 @@ lutil_passwd( const struct berval *cred, /* user cred */ const char **schemes ) { - int i; + struct pw_slist *pws; if (cred == NULL || cred->bv_len == 0 || passwd == NULL || passwd->bv_len == 0 ) @@ -309,14 +298,16 @@ lutil_passwd( return -1; } - for( i=0; pw_schemes[i].name.bv_val != NULL; i++ ) { - if( pw_schemes[i].chk_fn ) { + if (!pw_schemes) lutil_passwd_init(); + + for( pws=pw_schemes; pws; pws=pws->next ) { + if( pws->s.chk_fn ) { struct berval x; - struct berval *p = passwd_scheme( &pw_schemes[i], + struct berval *p = passwd_scheme( &(pws->s), passwd, &x, schemes ); if( p != NULL ) { - return (pw_schemes[i].chk_fn)( &pw_schemes[i], p, cred ); + return (pws->s.chk_fn)( &(pws->s.name), p, cred ); } } } @@ -373,19 +364,19 @@ struct berval * lutil_passwd_hash( if( sc == NULL ) return NULL; if( ! sc->hash_fn ) return NULL; - return (sc->hash_fn)( sc, passwd ); + return (sc->hash_fn)( &sc->name, passwd ); } /* pw_string is only called when SLAPD_LMHASH or SLAPD_CRYPT is defined */ #if defined(SLAPD_LMHASH) || defined(SLAPD_CRYPT) static struct berval * pw_string( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval *passwd ) { struct berval *pw = ber_memalloc( sizeof( struct berval ) ); if( pw == NULL ) return NULL; - pw->bv_len = sc->name.bv_len + passwd->bv_len; + pw->bv_len = sc->bv_len + passwd->bv_len; pw->bv_val = ber_memalloc( pw->bv_len + 1 ); if( pw->bv_val == NULL ) { @@ -393,8 +384,8 @@ static struct berval * pw_string( return NULL; } - AC_MEMCPY( pw->bv_val, sc->name.bv_val, sc->name.bv_len ); - AC_MEMCPY( &pw->bv_val[sc->name.bv_len], passwd->bv_val, passwd->bv_len ); + AC_MEMCPY( pw->bv_val, sc->bv_val, sc->bv_len ); + AC_MEMCPY( &pw->bv_val[sc->bv_len], passwd->bv_val, passwd->bv_len ); pw->bv_val[pw->bv_len] = '\0'; return pw; @@ -402,7 +393,7 @@ static struct berval * pw_string( #endif /* SLAPD_LMHASH || SLAPD_CRYPT */ static struct berval * pw_string64( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval *hash, const struct berval *salt ) { @@ -434,7 +425,7 @@ static struct berval * pw_string64( } b64len = LUTIL_BASE64_ENCODE_LEN( string.bv_len ) + 1; - b64->bv_len = b64len + sc->name.bv_len; + b64->bv_len = b64len + sc->bv_len; b64->bv_val = ber_memalloc( b64->bv_len + 1 ); if( b64->bv_val == NULL ) { @@ -443,11 +434,11 @@ static struct berval * pw_string64( return NULL; } - AC_MEMCPY(b64->bv_val, sc->name.bv_val, sc->name.bv_len); + AC_MEMCPY(b64->bv_val, sc->bv_val, sc->bv_len); rc = lutil_b64_ntop( string.bv_val, string.bv_len, - &b64->bv_val[sc->name.bv_len], b64len ); + &b64->bv_val[sc->bv_len], b64len ); if( salt ) ber_memfree( string.bv_val ); @@ -457,7 +448,7 @@ static struct berval * pw_string64( } /* recompute length */ - b64->bv_len = sc->name.bv_len + rc; + b64->bv_len = sc->bv_len + rc; assert( strlen(b64->bv_val) == b64->bv_len ); return b64; } @@ -466,7 +457,7 @@ static struct berval * pw_string64( #ifdef LUTIL_SHA1_BYTES static int chk_ssha1( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -474,7 +465,12 @@ static int chk_ssha1( unsigned char SHA1digest[LUTIL_SHA1_BYTES]; int rc; unsigned char *orig_pass = NULL; - + + /* safety check */ + if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <= sizeof(SHA1digest)) { + return -1; + } + /* decode base64 password */ orig_pass = (unsigned char *) ber_memalloc( (size_t) ( LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) ); @@ -483,7 +479,7 @@ static int chk_ssha1( rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len); - if(rc < 0) { + if (rc <= sizeof(SHA1digest)) { ber_memfree(orig_pass); return -1; } @@ -504,7 +500,7 @@ static int chk_ssha1( } static int chk_sha1( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -540,7 +536,7 @@ static int chk_sha1( #endif static int chk_smd5( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -549,6 +545,11 @@ static int chk_smd5( int rc; unsigned char *orig_pass = NULL; + /* safety check */ + if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <= sizeof(MD5digest)) { + return -1; + } + /* base64 un-encode password */ orig_pass = (unsigned char *) ber_memalloc( (size_t) ( LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) ); @@ -556,7 +557,8 @@ static int chk_smd5( if( orig_pass == NULL ) return -1; rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len); - if ( rc < 0 ) { + + if (rc <= sizeof(MD5digest)) { ber_memfree(orig_pass); return -1; } @@ -578,7 +580,7 @@ static int chk_smd5( } static int chk_md5( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -614,24 +616,72 @@ static int chk_md5( #ifdef SLAPD_LMHASH static int chk_lanman( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd, const struct berval *cred ) { struct berval *hash; hash = hash_lanman( scheme, cred ); - return memcmp( &hash->bv_val[scheme->name.bv_len], passwd->bv_val, 32); + return memcmp( &hash->bv_val[scheme->bv_len], passwd->bv_val, 32); } #endif /* SLAPD_LMHASH */ +#ifdef SLAPD_NS_MTA_MD5 +static int chk_ns_mta_md5( + const struct berval *scheme, + const struct berval *passwd, + const struct berval *cred ) +{ + lutil_MD5_CTX MD5context; + unsigned char MD5digest[LUTIL_MD5_BYTES], c; + char buffer[LUTIL_MD5_BYTES + LUTIL_MD5_BYTES + 1]; + int i; + + /* hash credentials with salt */ + lutil_MD5Init(&MD5context); + lutil_MD5Update(&MD5context, + (const unsigned char *) &passwd->bv_val[32], + 32 ); + + c = 0x59; + lutil_MD5Update(&MD5context, + (const unsigned char *) &c, + 1 ); + + lutil_MD5Update(&MD5context, + (const unsigned char *) cred->bv_val, + cred->bv_len ); + + c = 0xF7; + lutil_MD5Update(&MD5context, + (const unsigned char *) &c, + 1 ); + + lutil_MD5Update(&MD5context, + (const unsigned char *) &passwd->bv_val[32], + 32 ); + + lutil_MD5Final(MD5digest, &MD5context); + + for( i=0; i < sizeof( MD5digest ); i++ ) { + buffer[i+i] = "0123456789abcdef"[(MD5digest[i]>>4) & 0x0F]; + buffer[i+i+1] = "0123456789abcdef"[ MD5digest[i] & 0x0F]; + } + + /* compare */ + return memcmp((char *)passwd->bv_val, (char *)buffer, sizeof(buffer)) + ? 1 : 0; +} +#endif + #ifdef SLAPD_SPASSWD #ifdef HAVE_CYRUS_SASL sasl_conn_t *lutil_passwd_sasl_conn = NULL; #endif static int chk_sasl( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -684,7 +734,7 @@ static int chk_sasl( #ifdef SLAPD_KPASSWD static int chk_kerberos( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -857,7 +907,7 @@ static int chk_kerberos( #ifdef SLAPD_CRYPT static int chk_crypt( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -900,7 +950,7 @@ static int chk_crypt( # if defined( HAVE_GETPWNAM ) && defined( HAVE_PW_PASSWD ) static int chk_unix( - const struct pw_scheme *sc, + const struct berval *sc, const struct berval * passwd, const struct berval * cred ) { @@ -976,7 +1026,7 @@ static int chk_unix( #ifdef LUTIL_SHA1_BYTES static struct berval *hash_ssha1( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd ) { lutil_SHA1_CTX SHA1context; @@ -1005,7 +1055,7 @@ static struct berval *hash_ssha1( } static struct berval *hash_sha1( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd ) { lutil_SHA1_CTX SHA1context; @@ -1024,7 +1074,7 @@ static struct berval *hash_sha1( #endif static struct berval *hash_smd5( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd ) { lutil_MD5_CTX MD5context; @@ -1053,7 +1103,7 @@ static struct berval *hash_smd5( } static struct berval *hash_md5( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd ) { lutil_MD5_CTX MD5context; @@ -1150,7 +1200,7 @@ static void lmPasswd_to_key( } static struct berval *hash_lanman( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd ) { @@ -1198,7 +1248,7 @@ static struct berval *hash_lanman( #ifdef SLAPD_CRYPT static struct berval *hash_crypt( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd ) { struct berval hash; @@ -1259,11 +1309,10 @@ int lutil_salt_format(const char *format) #ifdef SLAPD_CLEARTEXT static struct berval *hash_clear( - const struct pw_scheme *scheme, + const struct berval *scheme, const struct berval *passwd ) { return ber_bvdup( (struct berval *) passwd ); } #endif -