210 lines
7.6 KiB
Diff
210 lines
7.6 KiB
Diff
|
diff --git a/configure.in b/configure.in
|
||
|
|
index de6a8ad..4ca489d 100644
|
||
|
|
--- a/configure.in
|
||
|
|
+++ b/configure.in
|
||
|
|
@@ -465,6 +465,28 @@ LIBS=""
|
||
|
|
AC_SEARCH_LIBS(crypt, crypt)
|
||
|
|
CRYPT_LIBS="$LIBS"
|
||
|
|
APACHE_SUBST(CRYPT_LIBS)
|
||
|
|
+
|
||
|
|
+if test "$ac_cv_search_crypt" != "no"; then
|
||
|
|
+ # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt
|
||
|
|
+ AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [
|
||
|
|
+ AC_RUN_IFELSE([AC_LANG_PROGRAM([[
|
||
|
|
+#include <crypt.h>
|
||
|
|
+#include <stdlib.h>
|
||
|
|
+#include <string.h>
|
||
|
|
+
|
||
|
|
+#define PASSWD_0 "Hello world!"
|
||
|
|
+#define SALT_0 "\$6\$saltstring"
|
||
|
|
+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \
|
||
|
|
+ "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1"
|
||
|
|
+]], [char *result = crypt(PASSWD_0, SALT_0);
|
||
|
|
+ if (!result) return 1;
|
||
|
|
+ if (strcmp(result, EXPECT_0)) return 2;
|
||
|
|
+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])])
|
||
|
|
+ if test "$ap_cv_crypt_sha2" = yes; then
|
||
|
|
+ AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes])
|
||
|
|
+ fi
|
||
|
|
+fi
|
||
|
|
+
|
||
|
|
LIBS="$saved_LIBS"
|
||
|
|
|
||
|
|
dnl See Comment #Spoon
|
||
|
|
diff --git a/support/htpasswd.c b/support/htpasswd.c
|
||
|
|
index 660a27c..136f62a 100644
|
||
|
|
--- a/support/htpasswd.c
|
||
|
|
+++ b/support/htpasswd.c
|
||
|
|
@@ -98,28 +98,32 @@ static int mkrecord(struct passwd_ctx *ctx, char *user)
|
||
|
|
static void usage(void)
|
||
|
|
{
|
||
|
|
apr_file_printf(errfile, "Usage:" NL
|
||
|
|
- "\thtpasswd [-cimBdpsDv] [-C cost] passwordfile username" NL
|
||
|
|
- "\thtpasswd -b[cmBdpsDv] [-C cost] passwordfile username password" NL
|
||
|
|
+ "\thtpasswd [-cimB25dpsDv] [-C cost] [-r rounds] passwordfile username" NL
|
||
|
|
+ "\thtpasswd -b[cmB25dpsDv] [-C cost] [-r rounds] passwordfile username password" NL
|
||
|
|
NL
|
||
|
|
- "\thtpasswd -n[imBdps] [-C cost] username" NL
|
||
|
|
- "\thtpasswd -nb[mBdps] [-C cost] username password" NL
|
||
|
|
+ "\thtpasswd -n[imB25dps] [-C cost] [-r rounds] username" NL
|
||
|
|
+ "\thtpasswd -nb[mB25dps] [-C cost] [-r rounds] username password" NL
|
||
|
|
" -c Create a new file." NL
|
||
|
|
" -n Don't update file; display results on stdout." NL
|
||
|
|
" -b Use the password from the command line rather than prompting "
|
||
|
|
"for it." NL
|
||
|
|
" -i Read password from stdin without verification (for script usage)." NL
|
||
|
|
" -m Force MD5 encryption of the password (default)." NL
|
||
|
|
- " -B Force bcrypt encryption of the password (very secure)." NL
|
||
|
|
+ " -2 Force SHA-256 crypt() hash of the password (secure)." NL
|
||
|
|
+ " -5 Force SHA-512 crypt() hash of the password (secure)." NL
|
||
|
|
+ " -B Force bcrypt encryption of the password (very secure)." NL
|
||
|
|
" -C Set the computing time used for the bcrypt algorithm" NL
|
||
|
|
" (higher is more secure but slower, default: %d, valid: 4 to 31)." NL
|
||
|
|
+ " -r Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL
|
||
|
|
+ " (higher is more secure but slower, default: 5000)." NL
|
||
|
|
" -d Force CRYPT encryption of the password (8 chars max, insecure)." NL
|
||
|
|
- " -s Force SHA encryption of the password (insecure)." NL
|
||
|
|
+ " -s Force SHA-1 encryption of the password (insecure)." NL
|
||
|
|
" -p Do not encrypt the password (plaintext, insecure)." NL
|
||
|
|
" -D Delete the specified user." NL
|
||
|
|
" -v Verify password for the specified user." NL
|
||
|
|
"On other systems than Windows and NetWare the '-p' flag will "
|
||
|
|
"probably not work." NL
|
||
|
|
- "The SHA algorithm does not use a salt and is less secure than the "
|
||
|
|
+ "The SHA-1 algorithm does not use a salt and is less secure than the "
|
||
|
|
"MD5 algorithm." NL,
|
||
|
|
BCRYPT_DEFAULT_COST
|
||
|
|
);
|
||
|
|
@@ -178,7 +182,7 @@ static void check_args(int argc, const char *const argv[],
|
||
|
|
if (rv != APR_SUCCESS)
|
||
|
|
exit(ERR_SYNTAX);
|
||
|
|
|
||
|
|
- while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) {
|
||
|
|
+ while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) {
|
||
|
|
switch (opt) {
|
||
|
|
case 'c':
|
||
|
|
*mask |= APHTP_NEWFILE;
|
||
|
|
diff --git a/support/passwd_common.c b/support/passwd_common.c
|
||
|
|
index 664e509..d45657c 100644
|
||
|
|
--- a/support/passwd_common.c
|
||
|
|
+++ b/support/passwd_common.c
|
||
|
|
@@ -185,10 +185,15 @@ int mkhash(struct passwd_ctx *ctx)
|
||
|
|
#if CRYPT_ALGO_SUPPORTED
|
||
|
|
char *cbuf;
|
||
|
|
#endif
|
||
|
|
+#ifdef HAVE_CRYPT_SHA2
|
||
|
|
+ const char *setting;
|
||
|
|
+ char method;
|
||
|
|
+#endif
|
||
|
|
|
||
|
|
- if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) {
|
||
|
|
+ if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT
|
||
|
|
+ && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) {
|
||
|
|
apr_file_printf(errfile,
|
||
|
|
- "Warning: Ignoring -C argument for this algorithm." NL);
|
||
|
|
+ "Warning: Ignoring -C/-r argument for this algorithm." NL);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (ctx->passwd == NULL) {
|
||
|
|
@@ -246,6 +251,34 @@ int mkhash(struct passwd_ctx *ctx)
|
||
|
|
break;
|
||
|
|
#endif /* CRYPT_ALGO_SUPPORTED */
|
||
|
|
|
||
|
|
+#ifdef HAVE_CRYPT_SHA2
|
||
|
|
+ case ALG_CRYPT_SHA256:
|
||
|
|
+ case ALG_CRYPT_SHA512:
|
||
|
|
+ ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool);
|
||
|
|
+ if (ret != 0)
|
||
|
|
+ break;
|
||
|
|
+
|
||
|
|
+ method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6';
|
||
|
|
+
|
||
|
|
+ if (ctx->cost)
|
||
|
|
+ setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s",
|
||
|
|
+ method, ctx->cost, salt);
|
||
|
|
+ else
|
||
|
|
+ setting = apr_psprintf(ctx->pool, "$%c$%s",
|
||
|
|
+ method, salt);
|
||
|
|
+
|
||
|
|
+ cbuf = crypt(pw, setting);
|
||
|
|
+ if (cbuf == NULL) {
|
||
|
|
+ rv = APR_FROM_OS_ERROR(errno);
|
||
|
|
+ ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv);
|
||
|
|
+ ret = ERR_PWMISMATCH;
|
||
|
|
+ break;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1);
|
||
|
|
+ break;
|
||
|
|
+#endif /* HAVE_CRYPT_SHA2 */
|
||
|
|
+
|
||
|
|
#if BCRYPT_ALGO_SUPPORTED
|
||
|
|
case ALG_BCRYPT:
|
||
|
|
rv = apr_generate_random_bytes((unsigned char*)salt, 16);
|
||
|
|
@@ -294,6 +327,19 @@ int parse_common_options(struct passwd_ctx *ctx, char opt,
|
||
|
|
case 's':
|
||
|
|
ctx->alg = ALG_APSHA;
|
||
|
|
break;
|
||
|
|
+#ifdef HAVE_CRYPT_SHA2
|
||
|
|
+ case '2':
|
||
|
|
+ ctx->alg = ALG_CRYPT_SHA256;
|
||
|
|
+ break;
|
||
|
|
+ case '5':
|
||
|
|
+ ctx->alg = ALG_CRYPT_SHA512;
|
||
|
|
+ break;
|
||
|
|
+#else
|
||
|
|
+ case '2':
|
||
|
|
+ case '5':
|
||
|
|
+ ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform.";
|
||
|
|
+ return ERR_ALG_NOT_SUPP;
|
||
|
|
+#endif
|
||
|
|
case 'p':
|
||
|
|
ctx->alg = ALG_PLAIN;
|
||
|
|
#if !PLAIN_ALGO_SUPPORTED
|
||
|
|
@@ -324,11 +370,12 @@ int parse_common_options(struct passwd_ctx *ctx, char opt,
|
||
|
|
return ERR_ALG_NOT_SUPP;
|
||
|
|
#endif
|
||
|
|
break;
|
||
|
|
- case 'C': {
|
||
|
|
+ case 'C':
|
||
|
|
+ case 'r': {
|
||
|
|
char *endptr;
|
||
|
|
long num = strtol(opt_arg, &endptr, 10);
|
||
|
|
if (*endptr != '\0' || num <= 0) {
|
||
|
|
- ctx->errstr = "argument to -C must be a positive integer";
|
||
|
|
+ ctx->errstr = "argument to -C/-r must be a positive integer";
|
||
|
|
return ERR_SYNTAX;
|
||
|
|
}
|
||
|
|
ctx->cost = num;
|
||
|
|
diff --git a/support/passwd_common.h b/support/passwd_common.h
|
||
|
|
index 660081e..f1b3cd7 100644
|
||
|
|
--- a/support/passwd_common.h
|
||
|
|
+++ b/support/passwd_common.h
|
||
|
|
@@ -28,6 +28,8 @@
|
||
|
|
#include "apu_version.h"
|
||
|
|
#endif
|
||
|
|
|
||
|
|
+#include "ap_config_auto.h"
|
||
|
|
+
|
||
|
|
#define MAX_STRING_LEN 256
|
||
|
|
|
||
|
|
#define ALG_PLAIN 0
|
||
|
|
@@ -35,6 +37,8 @@
|
||
|
|
#define ALG_APMD5 2
|
||
|
|
#define ALG_APSHA 3
|
||
|
|
#define ALG_BCRYPT 4
|
||
|
|
+#define ALG_CRYPT_SHA256 5
|
||
|
|
+#define ALG_CRYPT_SHA512 6
|
||
|
|
|
||
|
|
#define BCRYPT_DEFAULT_COST 5
|
||
|
|
|
||
|
|
@@ -84,7 +88,7 @@ struct passwd_ctx {
|
||
|
|
apr_size_t out_len;
|
||
|
|
char *passwd;
|
||
|
|
int alg;
|
||
|
|
- int cost;
|
||
|
|
+ int cost; /* cost for bcrypt, rounds for SHA-2 */
|
||
|
|
enum {
|
||
|
|
PW_PROMPT = 0,
|
||
|
|
PW_ARG,
|