passwordbasedauthentication.c File Reference

#include "passwordbasedauthentication.h"
#include "authutils.c"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <crypt.h>

Include dependency graph for passwordbasedauthentication.c:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	__USE_GNU
#define	INVALID_HASH   "1234567890$"
#define	CRYPT_GENSALT_OUTPUT_SIZE   192
#define	CRYPT_OUTPUT_SIZE   384

Functions
static int	is_prefix_supported (const char *id)
	Check if a prefix is supported.
static int	get_random (char *buf, size_t buflen)
	Try to get random bytes.
char *	crypt_gensalt_r (const char *prefix, unsigned long count, const char *rbytes, int nrbytes, char *output, int output_size)
	Generate string suitable for use as setting when hashing a passphrase.
struct PBASettings *	pba_init (const char *pepper, unsigned int pepper_size, unsigned int count, char *prefix)
	Init PBA.
void	pba_finalize (struct PBASettings *settings)
	Cleanup PBA settings.
static int	pba_is_phc_compliant (const char *setting)
	Check if a PBA settings is PHC compliant.
char *	pba_hash (struct PBASettings *setting, const char *password)
	Create a password hash.
enum pba_rc	pba_verify_hash (const struct PBASettings *setting, const char *hash, const char *password)
	Verify a password hash.

Variables
const char	ascii64 []

Macro Definition Documentation

__USE_GNU

#define __USE_GNU

Definition at line 16 of file passwordbasedauthentication.c.

CRYPT_GENSALT_OUTPUT_SIZE

#define CRYPT_GENSALT_OUTPUT_SIZE   192

Definition at line 24 of file passwordbasedauthentication.c.

Referenced by pba_hash().

CRYPT_OUTPUT_SIZE

#define CRYPT_OUTPUT_SIZE   384

Definition at line 28 of file passwordbasedauthentication.c.

Referenced by pba_hash(), and pba_verify_hash().

INVALID_HASH

#define INVALID_HASH   "1234567890$"

Definition at line 22 of file passwordbasedauthentication.c.

Referenced by pba_verify_hash().

Function Documentation

crypt_gensalt_r()

char * crypt_gensalt_r	(	const char *	prefix,
		unsigned long	count,
		const char *	rbytes,
		int	nrbytes,
		char *	output,
		int	output_size )

Generate string suitable for use as setting when hashing a passphrase.

If prefix is a NULL pointer, the current best default is used; if rbytes is a NULL pointer, random data will be retrieved from the operating system if possible.

Parameters

[in]	prefix	Controls which hash function will be used.
[in]	count	Controls the computional cost of the hash.
[in]	rbytes	Should point to nrbytes bytes of random data.
[in]	nrbytes	Number of bytes in rbytes.
[out]	output	The generated setting string is written here.
[in]	output_size	Length of output. Must be at least CRYPT_GENSALT_OUTPUT_SIZE.

Returns

On success output, else NULL.

Definition at line 104 of file passwordbasedauthentication.c.

{
  char *internal_rbytes = NULL;
  unsigned int written = 0, used = 0;
  unsigned long value = 0;
  if ((rbytes != NULL && nrbytes < 3) || output_size < 16
      || !is_prefix_supported (prefix))
    {
      output[0] = '*';
      goto exit;
    }
  if (rbytes == NULL)
    {
      internal_rbytes = malloc (16);
      if (get_random (internal_rbytes, 16) != 0)
        {
          output[0] = '*';
          goto exit;
        }
      nrbytes = 16;
      rbytes = internal_rbytes;
    }
  written = snprintf (output, output_size, "%srounds=%lu$",
                      prefix == NULL ? PREFIX_DEFAULT : prefix, count);
  while (written + 5 < (unsigned int) output_size
         && used + 3 < (unsigned int) nrbytes && (used * 4 / 3) < 16)
    {
      value = ((unsigned long) rbytes[used + 0] << 0)
              | ((unsigned long) rbytes[used + 1] << 8)
              | ((unsigned long) rbytes[used + 2] << 16);
      output[written] = ascii64[value & 0x3f];
      output[written + 1] = ascii64[(value >> 6) & 0x3f];
      output[written + 2] = ascii64[(value >> 12) & 0x3f];
      output[written + 3] = ascii64[(value >> 18) & 0x3f];
      written += 4;
      used += 3;
    }
  output[written] = '\0';
exit:
  if (internal_rbytes != NULL)
    free (internal_rbytes);
  return output[0] == '*' ? 0 : output;
}

References ascii64, get_random(), is_prefix_supported(), and PREFIX_DEFAULT.

Referenced by pba_hash().

Here is the call graph for this function:

Here is the caller graph for this function:

get_random()

int get_random ( char * buf, size_t buflen )

static

Try to get random bytes.

Parameters

[in]	buf	Destination for bytes.
[in]	buflen	Number of bytes to get.

Returns

0 on success, else error.

Definition at line 63 of file passwordbasedauthentication.c.

{
  FILE *fp = fopen ("/dev/urandom", "r");
  int result = 0;
  if (fp == NULL)
    {
      result = -1;
      goto exit;
    }
  size_t nread = fread (buf, 1, buflen, fp);
  fclose (fp);
  if (nread < buflen)
    {
      result = -2;
    }
 
exit:
  return result;
}

Referenced by crypt_gensalt_r().

Here is the caller graph for this function:

is_prefix_supported()

int is_prefix_supported ( const char * id )

static

Check if a prefix is supported.

Parameters

[in]

id

Prefix.

Returns

1 if supported, else 0.

Definition at line 39 of file passwordbasedauthentication.c.

{
  return strcmp (PREFIX_DEFAULT, id) == 0;
}

References PREFIX_DEFAULT.

Referenced by crypt_gensalt_r(), pba_hash(), pba_init(), and pba_verify_hash().

Here is the caller graph for this function:

pba_finalize()

void pba_finalize

(

struct PBASettings *

settings

)

Cleanup PBA settings.

Parameters

[in]

settings

PBA settings.

Definition at line 189 of file passwordbasedauthentication.c.

{
  free (settings);
}

Referenced by Ensure(), Ensure(), and Ensure().

Here is the caller graph for this function:

pba_hash()

char * pba_hash	(	struct PBASettings *	setting,
		const char *	password )

Create a password hash.

Parameters

[in]	setting	PBA settings.
[in]	password	Password.

Returns

Hash. Must be freed with free().

Definition at line 220 of file passwordbasedauthentication.c.

{
  char *result = NULL, *settings = NULL, *tmp, *rslt;
  int i;
  struct crypt_data *data = NULL;
 
  if (!setting || !password)
    goto exit;
  if (!is_prefix_supported (setting->prefix))
    goto exit;
  settings = malloc (CRYPT_GENSALT_OUTPUT_SIZE);
  if (crypt_gensalt_r (setting->prefix, setting->count, NULL, 0, settings,
                       CRYPT_GENSALT_OUTPUT_SIZE)
      == NULL)
    goto exit;
  tmp = settings + strlen (settings) - 1;
  for (i = MAX_PEPPER_SIZE - 1; i > -1; i--)
    {
      if (setting->pepper[i] != 0)
        tmp[0] = setting->pepper[i];
      tmp--;
    }
 
  data = calloc (1, sizeof (struct crypt_data));
  rslt = crypt_r (password, settings, data);
  if (rslt == NULL)
    goto exit;
  result = calloc (1, CRYPT_OUTPUT_SIZE);
  memcpy (result, rslt, CRYPT_OUTPUT_SIZE);
  // remove pepper, by jumping to begin of applied pepper within result
  // and overriding it.
  tmp = result + (tmp - settings);
  for (i = 0; i < MAX_PEPPER_SIZE; i++)
    {
      tmp++;
      if (setting->pepper[i] != 0)
        tmp[0] = '0';
    }
exit:
  if (data != NULL)
    free (data);
  if (settings != NULL)
    free (settings);
  return result;
}

References PBASettings::count, CRYPT_GENSALT_OUTPUT_SIZE, crypt_gensalt_r(), CRYPT_OUTPUT_SIZE, is_prefix_supported(), MAX_PEPPER_SIZE, PBASettings::pepper, and PBASettings::prefix.

Referenced by Ensure(), Ensure(), Ensure(), and Ensure().

Here is the call graph for this function:

Here is the caller graph for this function:

pba_init()

struct PBASettings * pba_init	(	const char *	pepper,
		unsigned int	pepper_size,
		unsigned int	count,
		char *	prefix )

Init PBA.

Parameters

[in]	pepper	A static hidden addition to the randomly generated salt.
[in]	pepper_size	The size of pepper; it must not be larger than MAX_PEPPER_SIZE.
[in]	count	Number of rounds used to calculate the hash. 0 to use COUNT_DEFAULT.
[in]	prefix	The algorithm used, if NULL then the most secure available algorithm will be used.

Returns

Settings, or NULL on error. Free with pba_finalize.

Definition at line 165 of file passwordbasedauthentication.c.

{
  unsigned int i = 0;
  struct PBASettings *result = NULL;
  if (pepper_size > MAX_PEPPER_SIZE)
    goto exit;
  if (prefix != NULL && !is_prefix_supported (prefix))
    goto exit;
  result = malloc (sizeof (struct PBASettings));
  for (i = 0; i < MAX_PEPPER_SIZE; i++)
    result->pepper[i] = pepper != NULL && i < pepper_size ? pepper[i] : 0;
  result->count = count == 0 ? COUNT_DEFAULT : count;
  result->prefix = prefix == NULL ? PREFIX_DEFAULT : prefix;
exit:
  return result;
}

References PBASettings::count, COUNT_DEFAULT, is_prefix_supported(), MAX_PEPPER_SIZE, PBASettings::pepper, PBASettings::prefix, and PREFIX_DEFAULT.

Referenced by Ensure(), Ensure(), and Ensure().

Here is the call graph for this function:

Here is the caller graph for this function:

pba_is_phc_compliant()

int pba_is_phc_compliant ( const char * setting )

static

Check if a PBA settings is PHC compliant.

Parameters

[in]

setting

Setting.

Returns

1 if compliant, else 0.

Definition at line 202 of file passwordbasedauthentication.c.

{
  if (setting == NULL)
    {
      return 1;
    }
  return strlen (setting) > 1 && setting[0] == '$';
}

Referenced by Ensure(), Ensure(), and pba_verify_hash().

Here is the caller graph for this function:

pba_verify_hash()

enum pba_rc pba_verify_hash	(	const struct PBASettings *	setting,
		const char *	hash,
		const char *	password )

Verify a password hash.

Parameters

[in]	setting	PBA settings.
[in]	hash	Hash.
[in]	password	Password.

Returns

Validity. VALID, UPDATE_RECOMMENDED, ...

Definition at line 276 of file passwordbasedauthentication.c.

{
  char *cmp, *tmp = NULL;
  struct crypt_data *data = NULL;
  int i = 0;
  enum pba_rc result = ERR;
 
  char *invalid_hash = calloc (1, CRYPT_OUTPUT_SIZE);
  memset (invalid_hash, 0, CRYPT_OUTPUT_SIZE);
  memcpy (invalid_hash, INVALID_HASH, strlen (INVALID_HASH));
 
  if (!setting)
    goto exit;
  if (!is_prefix_supported (setting->prefix))
    goto exit;
  if (pba_is_phc_compliant (hash) != 0)
    {
      int hash_size;
      hash_size = hash ? strlen (hash) : strlen (invalid_hash);
 
      data = calloc (1, sizeof (struct crypt_data));
      // manipulate hash to reapply pepper
      tmp = calloc (1, CRYPT_OUTPUT_SIZE);
 
      memset (tmp, 0, CRYPT_OUTPUT_SIZE);
      memcpy (tmp, hash ? hash : invalid_hash,
              (hash_size < CRYPT_OUTPUT_SIZE) ? hash_size
                                              : CRYPT_OUTPUT_SIZE - 1);
      cmp = strrchr (tmp, '$');
      for (i = MAX_PEPPER_SIZE - 1; i > -1; i--)
        {
          cmp--;
          if (setting->pepper[i] != 0)
            cmp[0] = setting->pepper[i];
        }
      // some crypt_r implementations cannot handle if password is a
      // NULL pointer and run into SEGMENTATION faults.
      // Therefore we set it to ""
      cmp = crypt_r (password ? password : "", tmp, data);
      if (strcmp (tmp, cmp) == 0)
        result = VALID;
      else
        result = INVALID;
    }
  else
    {
      // assume authutils hash handling
      // initialize gvm_auth utils if not already initialized
      if (initialized == FALSE && gvm_auth_init () != 0)
        {
          goto exit;
        }
      // verify result of gvm_authenticate_classic
      i = gvm_authenticate_classic (NULL, password, hash);
      if (i == 0)
        result = UPDATE_RECOMMENDED;
      else if (i == 1)
        result = INVALID;
    }
exit:
  free (invalid_hash);
  if (data != NULL)
    free (data);
  if (tmp != NULL)
    free (tmp);
  return result;
}

References CRYPT_OUTPUT_SIZE, ERR, gvm_auth_init(), gvm_authenticate_classic(), initialized, INVALID, INVALID_HASH, is_prefix_supported(), MAX_PEPPER_SIZE, pba_is_phc_compliant(), PBASettings::pepper, PBASettings::prefix, UPDATE_RECOMMENDED, and VALID.

Referenced by Ensure(), Ensure(), and Ensure().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

ascii64

const char ascii64[]

Initial value:

=
  "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"

Definition at line 51 of file passwordbasedauthentication.c.

Referenced by crypt_gensalt_r().