EXPERIMENTAL Password Hashing

utils/mgpost/mgpost.c

@@ -8,9 +8,9 @@
 s_JamBase *open_jam_base(char *path) {
 	int ret;
 	s_JamBase *jb;
-	
+
 	ret = JAM_OpenMB((char *)path, &jb);
-	
+
 	if (ret != 0) {
 		if (ret == JAM_IO_ERROR) {
 			free(jb);
@@ -35,12 +35,12 @@ int main(int argc, char **argv) {
 	time_t thetime;
 	int z;
 	int i;
-	
+
 	s_JamBase *jb;
 	s_JamMsgHeader jmh;
 	s_JamSubPacket* jsp;
 	s_JamSubfield jsf;
-	
+
 	if (argc < 6) {
 		printf("Usage:\n");
 		printf("%s [l|e] filename jambase from subject laddress\n", argv[0]);
@@ -50,29 +50,29 @@ int main(int argc, char **argv) {
 	}
 	if (tolower(argv[1][0]) != 'l' && tolower(argv[1][0]) != 'e') {
 		printf("Usage:\n");
-		printf("%s [l|e] filename jambase from subject\n", argv[0]);
+		printf("%s [l|e] filename jambase from subject laddress\n", argv[0]);
 		printf(" l = Local Message, e = Echomail Message\n");
 		printf(" laddress is your network address, and only required on echomail.\n");
 		exit(1);
 	}
-	
+
 	if (tolower(argv[1][0]) == 'e' && argc < 7) {
 		printf("Usage:\n");
-		printf("%s [l|e] filename jambase from subject\n", argv[0]);
+		printf("%s [l|e] filename jambase from subject laddress\n", argv[0]);
 		printf(" l = Local Message, e = Echomail Message\n");
 		printf(" laddress is your network address, and only required on echomail.\n");
 		exit(1);
 	}
-	
+
 	fptr = fopen(argv[2], "r");
-	
+
 	if (!fptr) {
 		printf("Unable to open %s\n", argv[2]);
 		exit(1);
 	}
 	body = NULL;
 	totlen = 0;
-	
+
 	len = fread(buffer, 1, 256, fptr);
 	while (len > 0) {
 		totlen += len;
@@ -85,33 +85,33 @@ int main(int argc, char **argv) {
 		body[totlen] = '\0';
 		len = fread(buffer, 1, 256, fptr);
 	}
-	
+
 	fclose(fptr);
-	
+
 	for (i=0;i<totlen;i++) {
 		if (body[i] == '\n') {
 			body[i] = '\r';
 		}
 	}
-	
+
 	jb = open_jam_base(argv[3]);
 	if (!jb) {
 		printf("Unable to open JAM base %s\n", argv[2]);
 		exit(1);
 	}
 	thetime = time(NULL);
-	
+
 	JAM_ClearMsgHeader( &jmh );
 	jmh.DateWritten = thetime;
-	
+
 	jmh.Attribute |= MSG_LOCAL;
-	
+
 	if (tolower(argv[1][0]) == 'l') {
 		jmh.Attribute |= MSG_TYPELOCAL;
 	} else if (tolower(argv[1][0]) == 'e') {
 		jmh.Attribute |= MSG_TYPEECHO;
 	}
-			
+
 	jsp = JAM_NewSubPacket();
 	jsf.LoID   = JAMSFLD_SENDERNAME;
 	jsf.HiID   = 0;
@@ -124,13 +124,13 @@ int main(int argc, char **argv) {
 	jsf.DatLen = 3;
 	jsf.Buffer = "ALL";
 	JAM_PutSubfield(jsp, &jsf);
-										
+
 	jsf.LoID   = JAMSFLD_SUBJECT;
 	jsf.HiID   = 0;
 	jsf.DatLen = strlen(argv[5]);
 	jsf.Buffer = (char *)argv[5];
 	JAM_PutSubfield(jsp, &jsf);
-	
+
 	if (tolower(argv[1][0]) == 'e') {
 		jsf.LoID   = JAMSFLD_OADDRESS;
 		jsf.HiID   = 0;
@@ -138,7 +138,7 @@ int main(int argc, char **argv) {
 		jsf.Buffer = (char *)argv[6];
 		JAM_PutSubfield(jsp, &jsf);
 	}
-	
+
 	while (1) {
 		z = JAM_LockMB(jb, 100);
 		if (z == 0) {
@@ -146,7 +146,7 @@ int main(int argc, char **argv) {
 		} else if (z == JAM_LOCK_FAILED) {
 			sleep(1);
 		} else {
-			printf("Failed to lock msg base!\n");		
+			printf("Failed to lock msg base!\n");
 			break;
 		}
 	}
@@ -154,11 +154,11 @@ int main(int argc, char **argv) {
 		if (JAM_AddMessage(jb, &jmh, jsp, (char *)body, strlen(body))) {
 			printf("Failed to add message\n");
 		}
-												
+
 		JAM_UnlockMB(jb);
 		JAM_DelSubPacket(jsp);
 	}
 	JAM_CloseMB(jb);
-	
+
 	return 0;
 }

utils/update_pass/Makefile

@@ -0,0 +1,15 @@
+CC=cc
+CFLAGS=-I/usr/local/include
+DEPS = update_pass.c
+
+OBJ = update_pass.o
+%.o: %.c $(DEPS)
+	$(CC) -c -o $@ $< $(CFLAGS)
+
+update_pass: $(OBJ)
+	$(CC) -o update_pass -o $@ $^ $(CFLAGS) -L/usr/local/lib -lsqlite3 -lssl -lcrypto
+
+.PHONY: clean
+
+clean:
+	rm -f $(OBJ) update_pass

utils/update_pass/update_pass.c

@@ -0,0 +1,126 @@
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sqlite3.h>
+#include <ctype.h>
+#include <openssl/sha.h>
+
+char *hash_sha256(char *pass, char *salt) {
+	char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
+	char *shash = (char *)malloc(66);
+	unsigned char hash[SHA256_DIGEST_LENGTH];
+
+	if (!buffer) {
+		printf("Out of memory!");
+		exit(-1);
+	}
+
+	sprintf(buffer, "%s%s", pass, salt);
+
+
+	SHA256_CTX sha256;
+	SHA256_Init(&sha256);
+	SHA256_Update(&sha256, buffer, strlen(buffer));
+	SHA256_Final(hash, &sha256);
+	int i = 0;
+	for(i = 0; i < SHA256_DIGEST_LENGTH; i++) {
+		sprintf(shash + (i * 2), "%02x", hash[i]);
+	}
+	shash[64] = 0;
+
+	free(buffer);
+	return shash;
+}
+
+void gen_salt(char **s) {
+	FILE *fptr;
+	int i;
+	char c;
+	*s = (char *)malloc(11);
+	char *salt = *s;
+
+	if (!salt) {
+		printf("Out of memory..");
+		exit(-1);
+	}
+	fptr = fopen("/dev/urandom", "rb");
+	if (!fptr) {
+		printf("Unable to open /dev/urandom!");
+		exit(-1);
+	}
+	for (i=0;i<10;i++) {
+		fread(&c, 1, 1, fptr);
+		salt[i] = (char)((abs(c) % 93) + 33);
+	}
+	fclose(fptr);
+	salt[10] = '\0';
+}
+
+int main(int argc, char **argv) {
+	sqlite3 *db;
+	sqlite3_stmt *res;
+	sqlite3_stmt *res2;
+
+	char *alter_table_sql = "ALTER TABLE users ADD COLUMN salt TEXT";
+	char *select_sql = "SELECT Id,password FROM users";
+	char *update_sql = "UPDATE users SET password=?, salt=? WHERE Id=?";
+	char *err_msg = 0;
+	int id;
+	int rc;
+	char *password;
+	char *hash;
+	char *salt;
+
+ 	rc = sqlite3_open(argv[1], &db);
+
+	if (rc != SQLITE_OK) {
+		printf("Error opening database\n");
+		return -1;
+	}
+
+	rc = sqlite3_exec(db, alter_table_sql, 0, 0, &err_msg);
+	if (rc != SQLITE_OK ) {
+
+			printf("SQL error: %s\n", err_msg);
+
+			sqlite3_free(err_msg);
+			sqlite3_close(db);
+
+			return 1;
+	}
+	rc = sqlite3_prepare_v2(db, select_sql, -1, &res, 0);
+	if (rc != SQLITE_OK) {
+			printf("Cannot prepare statement: %s\n", sqlite3_errmsg(db));
+			sqlite3_close(db);
+			exit(1);
+	}
+	while (sqlite3_step(res) == SQLITE_ROW) {
+		id = sqlite3_column_int(res, 0);
+		password = strdup(sqlite3_column_text(res, 1));
+
+		gen_salt(&salt);
+		hash = hash_sha256(password, salt);
+
+		rc = sqlite3_prepare_v2(db, update_sql, -1, &res2, 0);
+		if (rc != SQLITE_OK) {
+				printf("Cannot prepare statement: %s\n", sqlite3_errmsg(db));
+				sqlite3_close(db);
+				exit(1);
+		}
+		sqlite3_bind_text(res2, 1, hash, -1, 0);
+		sqlite3_bind_text(res2, 2, salt, -1, 0);
+		sqlite3_bind_int(res2, 3, id);
+
+		rc = sqlite3_step(res2);
+
+		if (rc != SQLITE_DONE) {
+			printf("Error: %s\n", sqlite3_errmsg(db));
+			exit(1);
+		}
+		sqlite3_finalize(res2);
+	}
+
+	printf("Converted!\n");
+	sqlite3_finalize(res);
+	sqlite3_close(db);
+}