Add APR1 to Makefile/README. Add {BSDMD5} mechanism.

diff --git a/contrib/slapd-modules/passwd/Makefile b/contrib/slapd-modules/passwd/Makefile
index 48a2881fdc5766d039d4eb1398970d24dc5ddc43..1e49e6abe04d36e9e62233f78580a871d4f678dd 100644 (file)
--- a/contrib/slapd-modules/passwd/Makefile
+++ b/contrib/slapd-modules/passwd/Makefile
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 CPPFLAGS+=-I../../../include -I../../../servers/slapd
 
-all: kerberos.la netscape.la radius.la
+all: kerberos.la netscape.la radius.la apr1.la
 
 kerberos.lo:   kerberos.c
        $(LIBTOOL) --mode=compile $(CC) $(CPPFLAGS) -DHAVE_KRB5 -Wall -c $?
@@ -24,14 +24,23 @@ radius.la:  radius.lo
        $(LIBTOOL) --mode=link $(CC) -version-info 0:0:0 \
        -rpath $(PREFIX)/lib -module -o $@ $? -lradius
 
+apr1.lo:       apr1.c
+       $(LIBTOOL) --mode=compile $(CC) $(CPPFLAGS) -Wall -c $?
+
+apr1.la:       apr1.lo
+       $(LIBTOOL) --mode=link $(CC) -version-info 0:0:0 \
+       -rpath $(PREFIX)/lib -module -o $@ $? 
+
 clean:
        rm -f kerberos.lo kerberos.la
        rm -f netscape.lo netscape.la
        rm -f radius.lo radius.la
+       rm -f apr1.lo apr1.la
 
-install: kerberos.la netscape.la radius.la
+install: kerberos.la netscape.la radius.la apr1.la
        mkdir -p $(PREFIX)/lib/openldap
        $(LIBTOOL) --mode=install cp kerberos.la $(PREFIX)/lib/openldap
        $(LIBTOOL) --mode=install cp netscape.la $(PREFIX)/lib/openldap
        $(LIBTOOL) --mode=install cp radius.la $(PREFIX)/lib/openldap
+       $(LIBTOOL) --mode=install cp apr1.la $(PREFIX)/lib/openldap
        $(LIBTOOL) --finish $(PREFIX)/lib

diff --git a/contrib/slapd-modules/passwd/README b/contrib/slapd-modules/passwd/README
index e6f08280c84fb78f0630bcad1b5d82d611e9580d..c9ef3bf7effb2f02afa83f8b252a6a94f5752805 100644 (file)
--- a/contrib/slapd-modules/passwd/README
+++ b/contrib/slapd-modules/passwd/README
@@ -1,6 +1,7 @@
 This directory contains native slapd plugins for password mechanisms that
 are not actively supported by the project. Currently this includes the
-Kerberos, Netscape MTA-MD5 and RADIUS password mechanisms.
+Kerberos, Netscape MTA-MD5 and RADIUS password mechanisms. The Apache
+APR1 MD5 and BSD/Paul Henning Kamp MD5 mechanisms are also included.
 
 To use the Kerberos plugin, add:
 
@@ -14,6 +15,12 @@ moduleload pw-netscape.so
 
 to your slapd configuration file.
 
+To use the APR1/BSD/MD5 plugin, add:
+
+moduleload pw-apr1.so
+
+to your slapd configuration file.
+
 To use the RADIUS plugin, add:
 
 moduleload pw-radius.so
@@ -42,6 +49,10 @@ gcc -shared -I../../../include -Wall -g -o pw-radius.so radius.c -lradius
 (Actually, you might want to statically link the RADIUS client library 
 libradius.a into the module).
 
+The corresponding command for the APR1 plugin would be:
+
+gcc -shared -I../../../include -Wall -g -o pw-apr1.so apr1.c
+
 ---
 This work is part of OpenLDAP Software <http://www.openldap.org/>.
 

diff --git a/contrib/slapd-modules/passwd/apr1.c b/contrib/slapd-modules/passwd/apr1.c
index f6697368122ccea72429742b9cd509a0b190518a..2078e57fa844027c309850793f244e988936e526 100644 (file)
--- a/contrib/slapd-modules/passwd/apr1.c
+++ b/contrib/slapd-modules/passwd/apr1.c
@@ -23,9 +23,16 @@
 \r
 #include <assert.h>\r
 \r
+/* the only difference between this and straight PHK is the magic */\r
 static LUTIL_PASSWD_CHK_FUNC chk_apr1;\r
 static LUTIL_PASSWD_HASH_FUNC hash_apr1;\r
-static const struct berval scheme = BER_BVC("{APR1}");\r
+static const struct berval scheme_apr1 = BER_BVC("{APR1}");\r
+static const struct berval magic_apr1 = BER_BVC("$apr1$");\r
+\r
+static LUTIL_PASSWD_CHK_FUNC chk_bsdmd5;\r
+static LUTIL_PASSWD_HASH_FUNC hash_bsdmd5;\r
+static const struct berval scheme_bsdmd5 = BER_BVC("{BSDMD5}");\r
+static const struct berval magic_bsdmd5 = BER_BVC("$1$");\r
 \r
 static const unsigned char apr64[] =\r
        "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";\r
@@ -41,9 +48,10 @@ static const unsigned char apr64[] =
  * this stuff is worth it, you can buy me a beer in return Poul-Henning Kamp\r
  * ----------------------------------------------------------------------------\r
  */\r
-static void do_apr_hash(\r
+static void do_phk_hash(\r
        const struct berval *passwd,\r
        const struct berval *salt,\r
+       const struct berval *magic,\r
        unsigned char *digest)\r
 {\r
        lutil_MD5_CTX ctx, ctx1;\r
@@ -52,7 +60,7 @@ static void do_apr_hash(
        /* Start hashing */\r
        lutil_MD5Init(&ctx);\r
        lutil_MD5Update(&ctx, (const unsigned char *) passwd->bv_val, passwd->bv_len);\r
-       lutil_MD5Update(&ctx, "$apr1$", 6);\r
+       lutil_MD5Update(&ctx, (const unsigned char *) magic->bv_val, magic->bv_len);\r
        lutil_MD5Update(&ctx, (const unsigned char *) salt->bv_val, salt->bv_len);\r
        /* Inner hash */\r
        lutil_MD5Init(&ctx1);\r
@@ -100,8 +108,9 @@ static void do_apr_hash(
        }\r
 }\r
 \r
-static int chk_apr1(\r
+static int chk_phk(\r
        const struct berval *scheme,\r
+       const struct berval *magic,\r
        const struct berval *passwd,\r
        const struct berval *cred,\r
        const char **text)\r
@@ -133,7 +142,7 @@ static int chk_apr1(
        salt.bv_len = rc - sizeof(digest);\r
 \r
        /* the only difference between this and straight PHK is the magic */\r
-       do_apr_hash(cred, &salt, digest);\r
+       do_phk_hash(cred, magic, &salt, digest);\r
 \r
        if (text)\r
                *text = NULL;\r
@@ -144,8 +153,27 @@ static int chk_apr1(
        return rc ?  LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;\r
 }\r
 \r
-static int hash_apr1(\r
+static int chk_apr1(\r
+       const struct berval *scheme,\r
+       const struct berval *passwd,\r
+       const struct berval *cred,\r
+       const char **text)\r
+{\r
+       return chk_phk(scheme, &magic_apr1, passwd, cred, text);\r
+}\r
+\r
+static int chk_bsdmd5(\r
+       const struct berval *scheme,\r
+       const struct berval *passwd,\r
+       const struct berval *cred,\r
+       const char **text)\r
+{\r
+       return chk_phk(scheme, &magic_bsdmd5, passwd, cred, text);\r
+}\r
+\r
+static int hash_phk(\r
        const struct berval *scheme,\r
+       const struct berval *magic,\r
        const struct berval *passwd,\r
        struct berval *hash,\r
        const char **text)\r
@@ -168,8 +196,7 @@ static int hash_apr1(
        for (n = 0; n < salt.bv_len; n++)\r
                salt.bv_val[n] = apr64[salt.bv_val[n] % (sizeof(apr64) - 1)];\r
 \r
-       /* the only difference between this and straight PHK is the magic */\r
-       do_apr_hash(passwd, &salt, digest_buf);\r
+       do_phk_hash(passwd, magic, &salt, digest_buf);\r
 \r
        if (text)\r
                *text = NULL;\r
@@ -177,6 +204,29 @@ static int hash_apr1(
        return lutil_passwd_string64(scheme, &digest, hash, &salt);\r
 }\r
 \r
+static int hash_apr1(\r
+       const struct berval *scheme,\r
+       const struct berval *passwd,\r
+       struct berval *hash,\r
+       const char **text)\r
+{\r
+       return hash_phk(scheme, &magic_apr1, passwd, hash, text);\r
+}\r
+\r
+static int hash_bsdmd5(\r
+       const struct berval *scheme,\r
+       const struct berval *passwd,\r
+       struct berval *hash,\r
+       const char **text)\r
+{\r
+       return hash_phk(scheme, &magic_bsdmd5, passwd, hash, text);\r
+}\r
+\r
 int init_module(int argc, char *argv[]) {\r
-       return lutil_passwd_add((struct berval *) &scheme, chk_apr1, hash_apr1);\r
+       int rc;\r
+       rc = lutil_passwd_add((struct berval *) &scheme_apr1, chk_apr1, hash_apr1);\r
+       if ( !rc )\r
+               rc = lutil_passwd_add((struct berval *) &scheme_bsdmd5,\r
+                       chk_bsdmd5, hash_bsdmd5);\r
+       return rc;\r
 }\r