1 /* High-level libcrypt interfaces.
2
3 Copyright 2007-2017 Thorsten Kukuk and Zack Weinberg
4 Copyright 2018-2021 Björn Esser
5
6 This library is free software; you can redistribute it and/or
7 modify it under the terms of the GNU Lesser General Public License
8 as published by the Free Software Foundation; either version 2.1 of
9 the License, or (at your option) any later version.
10
11 This library is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public
17 License along with this library; if not, see
18 <https://www.gnu.org/licenses/>. */
19
20 #include "crypt-port.h"
21
22 #include <errno.h>
23 #include <stdlib.h>
24
25 /* The internal storage area within struct crypt_data is used as
26 follows. We don't know what alignment the algorithm modules will
27 need for their scratch data, so give it the maximum natural
28 alignment. Note that the C11 alignas() specifier can't be applied
29 directly to a struct type, but it can be applied to the first field
30 of a struct, which effectively forces alignment of the entire
31 struct, since the first field must always have offset 0. */
32 struct crypt_internal
33 {
34 char alignas (alignof (max_align_t)) alg_specific[ALG_SPECIFIC_SIZE];
35 };
36
37 static_assert(sizeof (struct crypt_internal) + alignof (struct crypt_internal)
38 <= CRYPT_DATA_INTERNAL_SIZE,
39 "crypt_data.internal is too small for crypt_internal");
40
41 /* struct crypt_data is allocated by application code and contains
42 only char-typed fields, so its 'internal' field may not be
43 sufficiently aligned. */
44 static inline struct crypt_internal *
45 get_internal (struct crypt_data *data)
46 {
47 uintptr_t internalp = (uintptr_t) data->internal;
48 const uintptr_t align = alignof (struct crypt_internal);
49 internalp = (internalp + align - 1) & ~(align - 1);
50 return (struct crypt_internal *)internalp;
51 }
52
53 typedef void (*crypt_fn) (const char *phrase, size_t phr_size,
54 const char *setting, size_t set_size,
55 uint8_t *output, size_t out_size,
56 void *scratch, size_t scr_size);
57
58 typedef void (*gensalt_fn) (unsigned long count,
59 const uint8_t *rbytes, size_t nrbytes,
60 uint8_t *output, size_t output_size);
61
62 struct hashfn
63 {
64 const char *prefix;
65 size_t plen;
66 crypt_fn crypt;
67 gensalt_fn gensalt;
68 /* The type of this field is unsigned char to ensure that it cannot
69 be set larger than the size of an internal buffer in crypt_gensalt_rn. */
70 unsigned char nrbytes;
71 unsigned char is_strong;
72 };
73
74 static const struct hashfn hash_algorithms[] =
75 {
76 HASH_ALGORITHM_TABLE_ENTRIES
77 };
78
79 #if INCLUDE_descrypt || INCLUDE_bigcrypt
80 static int
81 is_des_salt_char (char c)
82 {
83 return ((c >= 'a' && c <= 'z') ||
84 (c >= 'A' && c <= 'Z') ||
85 (c >= '0' && c <= '9') ||
86 c == '.' || c == '/');
87 }
88 #endif
89
90 static const struct hashfn *
91 get_hashfn (const char *setting)
92 {
93 const struct hashfn *h;
94 for (h = hash_algorithms; h->prefix; h++)
95 {
96 if (h->plen > 0)
97 {
98 if (!strncmp (setting, h->prefix, h->plen))
99 return h;
100 }
101 #if INCLUDE_descrypt || INCLUDE_bigcrypt
102 else
103 {
104 if (setting[0] == '\0' ||
105 (is_des_salt_char (setting[0]) && is_des_salt_char (setting[1])))
106 return h;
107 }
108 #endif
109 }
110 return 0;
111 }
112
113 /* Check a setting string for generic validity, according to the rule
114 stated in crypt(5):
115
116 "Hashed passphrases are always entirely printable ASCII, and do
117 not contain any whitespace or the characters ':', ';', '*', '!',
118 or '\\'. (These characters are used as delimiters and special
119 markers in the passwd(5) and shadow(5) files.)"
120
121 There is a precautionary case for rejecting additional ASCII
122 punctuation, particularly other characters often given syntactic
123 significance in configuration files, such as " ' and #. However,
124 this check didn't used to exist at all, and some of the hash
125 function implementations don't restrict the set of byte values they
126 they will accept in their setting strings (particularly in the salt
127 component) either. Thus, to maintain compatibility with the widest
128 variety of existing hashed passphrases, we are only enforcing the
129 documented rule for now.
130
131 See <https://github.com/besser82/libxcrypt/issues/135> for
132 additional discussion. */
133 static int
134 check_badsalt_chars (const char *setting)
135 {
136 size_t i;
137
138 for (i = 0; setting[i] != '\0'; i++)
139 if ((unsigned char) setting[i] <= 0x20 ||
140 (unsigned char) setting[i] >= 0x7f)
141 return 1;
142
143 return strcspn (setting, "!*:;\\") != i;
144 }
145
146 static void
147 do_crypt (const char *phrase, const char *setting, struct crypt_data *data)
148 {
149 if (!phrase || !setting)
150 {
151 errno = EINVAL;
152 return;
153 }
154 /* Do these strlen() calls before reading prefixes of either
155 'phrase' or 'setting', so we get a predictable crash if they are
156 not valid strings. */
157 size_t phr_size = strlen (phrase);
158 size_t set_size = strlen (setting);
159 if (phr_size >= CRYPT_MAX_PASSPHRASE_SIZE)
160 {
161 errno = ERANGE;
162 return;
163 }
164 if (check_badsalt_chars (setting))
165 {
166 errno = EINVAL;
167 return;
168 }
169
170 const struct hashfn *h = get_hashfn (setting);
171 if (!h)
172 {
173 /* Unrecognized hash algorithm */
174 errno = EINVAL;
175 return;
176 }
177
178 struct crypt_internal *cint = get_internal (data);
179 h->crypt (phrase, phr_size, setting, set_size,
180 (unsigned char *)data->output, sizeof data->output,
181 cint->alg_specific, sizeof cint->alg_specific);
182
183 explicit_bzero (data->internal, sizeof data->internal);
184 }
185
186 #if INCLUDE_crypt_rn
187 char *
188 crypt_rn (const char *phrase, const char *setting, void *data, int size)
189 {
190 make_failure_token (setting, data, MIN (size, CRYPT_OUTPUT_SIZE));
191 if (size < 0 || (size_t)size < sizeof (struct crypt_data))
192 {
193 errno = ERANGE;
194 return 0;
195 }
196
197 struct crypt_data *p = data;
198 do_crypt (phrase, setting, p);
199 return p->output[0] == '*' ? 0 : p->output;
200 }
201 SYMVER_crypt_rn;
202 #endif
203
204 #if INCLUDE_crypt_ra
205 char *
206 crypt_ra (const char *phrase, const char *setting, void **data, int *size)
207 {
208 if (!*data)
209 {
210 *data = malloc (sizeof (struct crypt_data));
211 if (!*data)
212 return 0;
213 *size = sizeof (struct crypt_data);
214 }
215 if (*size < 0 || (size_t)*size < sizeof (struct crypt_data))
216 {
217 void *rdata = realloc (*data, sizeof (struct crypt_data));
218 if (!rdata)
219 return 0;
220 *data = rdata;
221 *size = sizeof (struct crypt_data);
222 }
223
224 struct crypt_data *p = *data;
225 make_failure_token (setting, p->output, sizeof p->output);
226 do_crypt (phrase, setting, p);
227 return p->output[0] == '*' ? 0 : p->output;
228 }
229 SYMVER_crypt_ra;
230 #endif
231
232 #if INCLUDE_crypt_r
233 char *
234 crypt_r (const char *phrase, const char *setting, struct crypt_data *data)
235 {
236 make_failure_token (setting, data->output, sizeof data->output);
237 do_crypt (phrase, setting, data);
238 #if ENABLE_FAILURE_TOKENS
239 return data->output;
240 #else
241 return data->output[0] == '*' ? 0 : data->output;
242 #endif
243 }
244 SYMVER_crypt_r;
245 #endif
246
247 /* For code compatibility with older versions (v3.1.1 and earlier). */
248 #if INCLUDE_crypt_r && INCLUDE_xcrypt_r
249 strong_alias (crypt_r, xcrypt_r);
250 SYMVER_xcrypt_r;
251 #endif
252
253 #if INCLUDE_crypt_gensalt_rn
254 char *
255 crypt_gensalt_rn (const char *prefix, unsigned long count,
256 const char *rbytes, int nrbytes, char *output,
257 int output_size)
258 {
259 make_failure_token ("", output, output_size);
260
261 /* Individual gensalt functions will check for adequate space for
262 their own breed of setting, but the shortest possible one is
263 three bytes (DES two-character salt + NUL terminator) and we
264 also want to rule out negative numbers early. */
265 if (output_size < 3)
266 {
267 errno = ERANGE;
268 return 0;
269 }
270
271 /* If the prefix is 0, that means to use the current best default.
272 Note that this is different from the behavior when the prefix is
273 "", which selects DES. HASH_ALGORITHM_DEFAULT is not defined when
274 the current default algorithm was disabled at configure time. */
275 if (!prefix)
276 {
277 #if defined HASH_ALGORITHM_DEFAULT
278 prefix = HASH_ALGORITHM_DEFAULT;
279 #else
280 errno = EINVAL;
281 return 0;
282 #endif
283 }
284
285 const struct hashfn *h = get_hashfn (prefix);
286 if (!h)
287 {
288 errno = EINVAL;
289 return 0;
290 }
291
292 char internal_rbytes[UCHAR_MAX];
293 /* typeof (internal_nrbytes) == typeof (h->nrbytes). */
294 unsigned char internal_nrbytes = 0;
295
296 /* If rbytes is 0, read random bytes from the operating system if
297 possible. */
298 if (!rbytes)
299 {
300 if (!get_random_bytes (internal_rbytes, h->nrbytes))
301 return 0;
302
303 rbytes = internal_rbytes;
304 nrbytes = internal_nrbytes = h->nrbytes;
305 }
306
307 h->gensalt (count,
308 (const unsigned char *)rbytes, (size_t)nrbytes,
309 (unsigned char *)output, (size_t)output_size);
310
311 if (internal_nrbytes)
312 explicit_bzero (internal_rbytes, internal_nrbytes);
313
314 return output[0] == '*' ? 0 : output;
315 }
316 SYMVER_crypt_gensalt_rn;
317 #endif
318
319 /* For code compatibility with older versions (v3.1.1 and earlier). */
320 #if INCLUDE_crypt_gensalt_rn && INCLUDE_crypt_gensalt_r
321 strong_alias (crypt_gensalt_rn, crypt_gensalt_r);
322 SYMVER_crypt_gensalt_r;
323 #endif
324
325 /* For code compatibility with older versions (v3.1.1 and earlier). */
326 #if INCLUDE_crypt_gensalt_rn && INCLUDE_xcrypt_gensalt_r
327 strong_alias (crypt_gensalt_rn, xcrypt_gensalt_r);
328 SYMVER_xcrypt_gensalt_r;
329 #endif
330
331 #if INCLUDE_crypt_gensalt_ra
332 char *
333 crypt_gensalt_ra (const char *prefix, unsigned long count,
334 const char *rbytes, int nrbytes)
335 {
336 char *output = malloc (CRYPT_GENSALT_OUTPUT_SIZE);
337 if (!output)
338 return 0;
339
340 char *result = crypt_gensalt_rn (prefix, count, rbytes, nrbytes, output,
341 CRYPT_GENSALT_OUTPUT_SIZE);
342 if (result == 0)
343 free (output);
344 return result;
345 }
346 SYMVER_crypt_gensalt_ra;
347 #endif
348
349 #if INCLUDE_crypt_checksalt
350 static_assert(CRYPT_SALT_OK == 0, "CRYPT_SALT_OK does not equal zero");
351
352 int
353 crypt_checksalt (const char *setting)
354 {
355 int retval = CRYPT_SALT_INVALID;
356
357 if (!setting || /* NULL string */
358 setting[0] == '\0' || /* empty passphrase */
359 check_badsalt_chars (setting)) /* bad salt chars */
360 goto end;
361
362 const struct hashfn *h = get_hashfn (setting);
363
364 if (h)
365 {
366 retval = CRYPT_SALT_OK;
367
368 if (h->is_strong == 0)
369 {
370 retval = CRYPT_SALT_METHOD_LEGACY;
371 goto end;
372 }
373 }
374
375 end:
376 return retval;
377 }
378 SYMVER_crypt_checksalt;
379 #endif
380
381 #if INCLUDE_crypt_preferred_method
382 const char *
383 crypt_preferred_method (void)
384 {
385 #if defined HASH_ALGORITHM_DEFAULT
386 return HASH_ALGORITHM_DEFAULT;
387 #else
388 return NULL;
389 #endif
390 }
391 SYMVER_crypt_preferred_method;
392 #endif