Attachment 145101 Details for Bug 221905 – Patch adding SMD5 support

[patch] Patch adding SMD5 support

smd5.patch (text/plain), 7.32 KB, created by Josh Kelley on 2007-01-08 20:34:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Josh Kelley

Created: 2007-01-08 20:34:30 UTC

Size: 7.32 KB

patch

obsolete

>diff -ur fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/md5_pwd.c ldapserver/ldap/servers/plugins/pwdstorage/md5_pwd.c
>--- fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/md5_pwd.c	2005-06-14 11:44:19.000000000 -0400
>+++ ldapserver/ldap/servers/plugins/pwdstorage/md5_pwd.c	2006-08-02 17:32:41.000000000 -0400
>@@ -51,6 +51,9 @@
> #define MD5_HASH_LEN 20
> #define MD5_SUBSYSTEM_NAME "MD5 password hash"
> 
>+#define SMD5_HASH_LEN 24
>+#define MD5_SALT_LEN 4
>+
> int
> md5_pw_cmp( char *userpwd, char *dbpwd )
> {
>@@ -128,3 +131,107 @@
>    return( enc );
> }
> 
>+int
>+smd5_pw_cmp( char *userpwd, char *dbpwd )
>+{
>+   int rc=-1;
>+   char * bver;
>+   PK11Context *ctx=NULL;
>+   unsigned int outLen;
>+   unsigned char userhash[SMD5_HASH_LEN];
>+   int hash_len;
>+   unsigned char quick_dbhash[MD5_HASH_LEN + MD5_SALT_LEN + 3];
>+   unsigned char *dbhash = quick_dbhash;
>+   unsigned char *salt;
>+
>+   ctx = PK11_CreateDigestContext(SEC_OID_MD5);
>+   if (ctx == NULL) {
>+	   slapi_log_error(SLAPI_LOG_PLUGIN, MD5_SUBSYSTEM_NAME,
>+					   "Could not create context for digest operation for password compare");
>+	   goto loser;
>+   }
>+
>+    /*
>+     * Decode hash stored in database.
>+     *
>+     * Note that ldif_base64_decode() returns a value less than zero to
>+     * indicate that a decoding error occurred, so it is critical that
>+     * hash_len be a signed value.
>+     */
>+    hash_len = (((strlen(dbpwd) + 3) / 4) * 3); /* maybe less */
>+    if ( hash_len > sizeof(quick_dbhash) ) { /* get more space: */
>+        dbhash = (unsigned char*) slapi_ch_malloc( hash_len );
>+        if ( dbhash == NULL ) goto loser;
>+    }
>+    hash_len = ldif_base64_decode( dbpwd, dbhash );
>+	printf("%i\n", hash_len);
>+	salt = (void*)(dbhash + 16); // TODO: hard-coded 16
>+	// TODO: Error handling for invalid hash length?
>+
>+   /* create the salted hash of the user's password */
>+   PK11_DigestBegin(ctx);
>+   PK11_DigestOp(ctx, userpwd, strlen(userpwd));
>+   PK11_DigestOp(ctx, salt, MD5_SALT_LEN);
>+   PK11_DigestFinal(ctx, userhash, &outLen, sizeof userhash);
>+   PK11_DestroyContext(ctx, 1);
>+
>+   /* bver points to b2a_out upon success */
>+   if (bver) {
>+	   rc = memcmp(dbhash, userhash, 16); // TODO: hard-coded 16
>+   } else {
>+	   slapi_log_error(SLAPI_LOG_PLUGIN, MD5_SUBSYSTEM_NAME,
>+					   "Could not base64 encode hashed value for password compare");
>+   }
>+loser:
>+	if ( dbhash && dbhash != quick_dbhash ) slapi_ch_free( (void**)&dbhash );
>+   return rc;
>+}
>+
>+char *
>+smd5_pw_enc( char *pwd )
>+{
>+   char * bver, *enc=NULL;
>+   PK11Context *ctx=NULL;
>+   unsigned int outLen;
>+   unsigned char hash_out[SMD5_HASH_LEN];
>+   unsigned char *salt = hash_out + 16;  // TODO: Hard-coded 16
>+   unsigned char b2a_out[SMD5_HASH_LEN*2]; /* conservative */
>+   SECItem binary_item;
>+
>+    /* generate a new random salt */
>+        /* Note: the uninitialized salt array provides a little extra entropy
>+         * to the random array generation, but it is not really needed since
>+         * PK11_GenerateRandom takes care of seeding. In any case, it doesn't
>+         * hurt. */
>+        ssha_rand_array( salt, MD5_SALT_LEN );
>+
>+   ctx = PK11_CreateDigestContext(SEC_OID_MD5);
>+   if (ctx == NULL) {
>+	   slapi_log_error(SLAPI_LOG_PLUGIN, MD5_SUBSYSTEM_NAME,
>+					   "Could not create context for digest operation for password encoding");
>+	   return NULL;
>+   }
>+
>+   /* create the hash */
>+   PK11_DigestBegin(ctx);
>+   PK11_DigestOp(ctx, pwd, strlen(pwd));
>+   PK11_DigestOp(ctx, salt, MD5_SALT_LEN);
>+   PK11_DigestFinal(ctx, hash_out, &outLen, sizeof hash_out);
>+   PK11_DestroyContext(ctx, 1);
>+
>+   /* convert the binary hash to base64 */
>+   binary_item.data = hash_out;
>+   binary_item.len = outLen + MD5_SALT_LEN;
>+   bver = NSSBase64_EncodeItem(NULL, b2a_out, sizeof b2a_out, &binary_item);
>+   if (bver) {
>+	   enc = slapi_ch_smprintf("%c%s%c%s", PWD_HASH_PREFIX_START, SMD5_SCHEME_NAME,
>+							   PWD_HASH_PREFIX_END, bver );
>+   } else {
>+	   slapi_log_error(SLAPI_LOG_PLUGIN, MD5_SUBSYSTEM_NAME,
>+					   "Could not base64 encode hashed value for password encoding");
>+   }
>+	   
>+   return( enc );
>+}
>+
>+
>diff -ur fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/pwd_init.c ldapserver/ldap/servers/plugins/pwdstorage/pwd_init.c
>--- fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/pwd_init.c	2005-09-06 17:15:15.000000000 -0400
>+++ ldapserver/ldap/servers/plugins/pwdstorage/pwd_init.c	2006-08-02 17:13:59.000000000 -0400
>@@ -69,6 +69,8 @@
> 
> static Slapi_PluginDesc md5_pdesc = { "md5-password-storage-scheme", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "MD5 hash algorithm (MD5)" };
> 
>+static Slapi_PluginDesc smd5_pdesc = { "smd5-password-storage-scheme", PLUGIN_MAGIC_VENDOR_STR, PRODUCTTEXT, "Salted MD5 hash algorithm (SMD5)" };
>+
> static char *plugin_name = "NSPwdStoragePlugin";
> 
> int
>@@ -365,3 +367,29 @@
> 	slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= md5_pwd_storage_scheme_init %d\n\n", rc );
> 	return( rc );
> }
>+
>+
>+int
>+smd5_pwd_storage_scheme_init( Slapi_PBlock *pb )
>+{
>+	int     rc;
>+	char *name;
>+
>+	slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> smd5_pwd_storage_scheme_init\n" );
>+
>+	rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
>+						   (void *) SLAPI_PLUGIN_VERSION_01 );
>+	rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION,
>+							(void *)&smd5_pdesc );
>+	rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN,
>+							(void *) smd5_pw_enc );
>+	rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN,
>+							(void *) smd5_pw_cmp );
>+	name = slapi_ch_strdup("SMD5");
>+	rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME,
>+							name );
>+
>+	slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= smd5_pwd_storage_scheme_init %d\n\n", rc );
>+	return( rc );
>+}
>+
>diff -ur fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/pwdstorage.h ldapserver/ldap/servers/plugins/pwdstorage/pwdstorage.h
>--- fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/pwdstorage.h	2005-09-06 17:15:15.000000000 -0400
>+++ ldapserver/ldap/servers/plugins/pwdstorage/pwdstorage.h	2006-08-02 17:13:59.000000000 -0400
>@@ -75,6 +75,8 @@
> #define CLEARTEXT_NAME_LEN  5
> #define MD5_SCHEME_NAME "MD5"
> #define MD5_NAME_LEN 3
>+#define SMD5_SCHEME_NAME "SMD5"
>+#define SMD5_NAME_LEN 4
> 
> SECStatus sha_salted_hash(unsigned char *hash_out, char *pwd, struct berval *salt, unsigned int secOID);
> int sha_pw_cmp( char *userpwd, char *dbpwd, unsigned int shaLen );
>@@ -102,6 +104,8 @@
> int ns_mta_md5_pw_cmp( char *userpwd, char *dbpwd );
> int md5_pw_cmp( char *userpwd, char *dbpwd );
> char *md5_pw_enc( char *pwd );
>+int smd5_pw_cmp ( char *userpwd, char *dbpwd );
>+char *smd5_pw_enc( char *pwd );
> 
> 
> #if !defined(NET_SSL)
>diff -ur fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/ssha_pwd.c ldapserver/ldap/servers/plugins/pwdstorage/ssha_pwd.c
>--- fedora-ds-1.0.2/ldap/servers/plugins/pwdstorage/ssha_pwd.c	2005-09-14 19:37:37.000000000 -0400
>+++ ldapserver/ldap/servers/plugins/pwdstorage/ssha_pwd.c	2006-08-02 17:16:00.000000000 -0400
>@@ -55,7 +55,7 @@
> 
> #define SHA_SALT_LENGTH    8   /* number of bytes of data in salt */
> 
>-static void ssha_rand_array(void *randx, size_t len);
>+void ssha_rand_array(void *randx, size_t len);
> 
> 
> /* ***************************************************
>@@ -63,7 +63,7 @@
> 	that here since this module is included in libds_admin, which doesn't
> 	link to libslapd.
>    *************************************************** */
>-static void
>+void
> ssha_rand_array(void *randx, size_t len)
> {
>     PK11_RandomUpdate(randx, len);

Actions: View | Diff

Attachments on bug 221905: 145101 | 366151