bbs/magicka
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update password hashing to use evp functions

Browse Source
This commit is contained in:
Andrew Pamment 2018-05-26 12:35:06 +10:00
parent 5920963420
commit 834afccb57
6 changed files with 81 additions and 11339 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11156
deps/libuuid/ltmain.sh vendored
View File

File diff suppressed because it is too large Load Diff

1
deps/libuuid/ltmain.sh vendored Symbolic link
View File

@ -0,0 +1 @@
/usr/share/libtool/build-aux/ltmain.sh

42
src/users.c
View File

@ -3,11 +3,7 @@
#include <stdlib.h> #include <stdlib.h>
#include <sqlite3.h> #include <sqlite3.h>
#include <ctype.h> #include <ctype.h>
#ifdef __DragonFly__ #include <openssl/evp.h>
#include <sha.h>
#else
#include <openssl/sha.h>
#endif
#include "bbs.h" #include "bbs.h"
#include "inih/ini.h" #include "inih/ini.h"
@ -16,8 +12,10 @@ extern struct user_record *gUser;
char *hash_sha256(char *pass, char *salt) { char *hash_sha256(char *pass, char *salt) {
char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1); char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
char *shash = (char *)malloc(66); char *shash = NULL;
unsigned char hash[SHA256_DIGEST_LENGTH]; unsigned char hash[EVP_MAX_MD_SIZE];
unsigned int length_of_hash = 0;
int i;
if (!buffer) { if (!buffer) {
dolog("Out of memory!"); dolog("Out of memory!");
@ -27,18 +25,30 @@ char *hash_sha256(char *pass, char *salt) {
sprintf(buffer, "%s%s", pass, salt); sprintf(buffer, "%s%s", pass, salt);
SHA256_CTX sha256; EVP_MD_CTX *context = EVP_MD_CTX_new();
SHA256_Init(&sha256);
SHA256_Update(&sha256, buffer, strlen(buffer)); if (context != NULL) {
SHA256_Final(hash, &sha256); if(EVP_DigestInit_ex(context, EVP_sha256(), NULL)) {
int i = 0; if(EVP_DigestUpdate(context, buffer, strlen(buffer))) {
for(i = 0; i < SHA256_DIGEST_LENGTH; i++) { if(EVP_DigestFinal_ex(context, hash, &length_of_hash)) {
sprintf(shash + (i * 2), "%02x", hash[i]);
shash = (char *)malloc(length_of_hash * 2 + 1);
for(i = 0; i < length_of_hash; i++) {
sprintf(shash + (i * 2), "%02x", (int)hash[i]);
}
EVP_MD_CTX_free(context);
free(buffer);
return shash;
}
}
}
EVP_MD_CTX_free(context);
} }
shash[64] = 0;
free(buffer); free(buffer);
return shash; dolog("Error creating hash!");
exit(-1);
} }
void gen_salt(char **s) { void gen_salt(char **s) {

38
utils/magiftpd/magiftpd.c
View File

@ -1,7 +1,7 @@
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <openssl/sha.h> #include <openssl/evp.h>
#include <sqlite3.h> #include <sqlite3.h>
#include <limits.h> #include <limits.h>
#include <sys/socket.h> #include <sys/socket.h>
@ -159,8 +159,10 @@ static int handler(void* user, const char* section, const char* name, const char
char *hash_sha256(char *pass, char *salt) { char *hash_sha256(char *pass, char *salt) {
char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1); char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
char *shash = (char *)malloc(66); char *shash = NULL;
unsigned char hash[SHA256_DIGEST_LENGTH]; unsigned char hash[EVP_MAX_MD_SIZE];
unsigned int length_of_hash = 0;
int i;
if (!buffer) { if (!buffer) {
fprintf(stderr, "Out of memory!\n"); fprintf(stderr, "Out of memory!\n");
@ -170,18 +172,30 @@ char *hash_sha256(char *pass, char *salt) {
sprintf(buffer, "%s%s", pass, salt); sprintf(buffer, "%s%s", pass, salt);
SHA256_CTX sha256; EVP_MD_CTX *context = EVP_MD_CTX_new();
SHA256_Init(&sha256);
SHA256_Update(&sha256, buffer, strlen(buffer)); if (context != NULL) {
SHA256_Final(hash, &sha256); if(EVP_DigestInit_ex(context, EVP_sha256(), NULL)) {
int i = 0; if(EVP_DigestUpdate(context, buffer, strlen(buffer))) {
for(i = 0; i < SHA256_DIGEST_LENGTH; i++) { if(EVP_DigestFinal_ex(context, hash, &length_of_hash)) {
sprintf(shash + (i * 2), "%02x", hash[i]);
shash = (char *)malloc(length_of_hash * 2 + 1);
for(i = 0; i < length_of_hash; i++) {
sprintf(shash + (i * 2), "%02x", (int)hash[i]);
}
EVP_MD_CTX_free(context);
free(buffer);
return shash;
}
}
}
EVP_MD_CTX_free(context);
} }
shash[64] = 0;
free(buffer); free(buffer);
return shash; fprintf(stderr, "Error creating hash!\n");
exit(-1);
} }
void send_data(struct ftpclient *client, char *msg, int len) { void send_data(struct ftpclient *client, char *msg, int len) {

42
utils/reset_pass/reset_pass.c
View File

@ -3,33 +3,47 @@
#include <stdlib.h> #include <stdlib.h>
#include <sqlite3.h> #include <sqlite3.h>
#include <ctype.h> #include <ctype.h>
#include <openssl/sha.h> #include <openssl/evp.h>
char *hash_sha256(char *pass, char *salt) { cchar *hash_sha256(char *pass, char *salt) {
char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1); char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
char *shash = (char *)malloc(66); char *shash = NULL;
unsigned char hash[SHA256_DIGEST_LENGTH]; unsigned char hash[EVP_MAX_MD_SIZE];
unsigned int length_of_hash = 0;
int i;
if (!buffer) { if (!buffer) {
printf("Out of memory!"); fprintf(stderr, "Out of memory!\n");
exit(-1); exit(-1);
} }
sprintf(buffer, "%s%s", pass, salt); sprintf(buffer, "%s%s", pass, salt);
SHA256_CTX sha256; EVP_MD_CTX *context = EVP_MD_CTX_new();
SHA256_Init(&sha256);
SHA256_Update(&sha256, buffer, strlen(buffer)); if (context != NULL) {
SHA256_Final(hash, &sha256); if(EVP_DigestInit_ex(context, EVP_sha256(), NULL)) {
int i = 0; if(EVP_DigestUpdate(context, buffer, strlen(buffer))) {
for(i = 0; i < SHA256_DIGEST_LENGTH; i++) { if(EVP_DigestFinal_ex(context, hash, &length_of_hash)) {
sprintf(shash + (i * 2), "%02x", hash[i]);
shash = (char *)malloc(length_of_hash * 2 + 1);
for(i = 0; i < length_of_hash; i++) {
sprintf(shash + (i * 2), "%02x", (int)hash[i]);
}
EVP_MD_CTX_free(context);
free(buffer);
return shash;
}
}
}
EVP_MD_CTX_free(context);
} }
shash[64] = 0;
free(buffer); free(buffer);
return shash; fprintf(stderr, "Error creating hash!\n");
exit(-1);
} }
void gen_salt(char **s) { void gen_salt(char **s) {

15
utils/update_pass/Makefile
View File

@ -1,15 +0,0 @@
CC=cc
CFLAGS=-I/usr/local/include
DEPS = update_pass.c
OBJ = update_pass.o
%.o: %.c $(DEPS)
$(CC) -c -o $@ $< $(CFLAGS)
update_pass: $(OBJ)
$(CC) -o update_pass -o $@ $^ $(CFLAGS) -L/usr/local/lib -lsqlite3 -lssl -lcrypto
.PHONY: clean
clean:
rm -f $(OBJ) update_pass

126
utils/update_pass/update_pass.c
View File

@ -1,126 +0,0 @@
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sqlite3.h>
#include <ctype.h>
#include <openssl/sha.h>
char *hash_sha256(char *pass, char *salt) {
char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
char *shash = (char *)malloc(66);
unsigned char hash[SHA256_DIGEST_LENGTH];
if (!buffer) {
printf("Out of memory!");
exit(-1);
}
sprintf(buffer, "%s%s", pass, salt);
SHA256_CTX sha256;
SHA256_Init(&sha256);
SHA256_Update(&sha256, buffer, strlen(buffer));
SHA256_Final(hash, &sha256);
int i = 0;
for(i = 0; i < SHA256_DIGEST_LENGTH; i++) {
sprintf(shash + (i * 2), "%02x", hash[i]);
}
shash[64] = 0;
free(buffer);
return shash;
}
void gen_salt(char **s) {
FILE *fptr;
int i;
char c;
*s = (char *)malloc(11);
char *salt = *s;
if (!salt) {
printf("Out of memory..");
exit(-1);
}
fptr = fopen("/dev/urandom", "rb");
if (!fptr) {
printf("Unable to open /dev/urandom!");
exit(-1);
}
for (i=0;i<10;i++) {
fread(&c, 1, 1, fptr);
salt[i] = (char)((abs(c) % 93) + 33);
}
fclose(fptr);
salt[10] = '\0';
}
int main(int argc, char **argv) {
sqlite3 *db;
sqlite3_stmt *res;
sqlite3_stmt *res2;
char *alter_table_sql = "ALTER TABLE users ADD COLUMN salt TEXT";
char *select_sql = "SELECT Id,password FROM users";
char *update_sql = "UPDATE users SET password=?, salt=? WHERE Id=?";
char *err_msg = 0;
int id;
int rc;
char *password;
char *hash;
char *salt;
rc = sqlite3_open(argv[1], &db);
if (rc != SQLITE_OK) {
printf("Error opening database\n");
return -1;
}
sqlite3_busy_timeout(db, 5000);
rc = sqlite3_exec(db, alter_table_sql, 0, 0, &err_msg);
if (rc != SQLITE_OK ) {
printf("SQL error: %s\n", err_msg);
sqlite3_free(err_msg);
sqlite3_close(db);
return 1;
}
rc = sqlite3_prepare_v2(db, select_sql, -1, &res, 0);
if (rc != SQLITE_OK) {
printf("Cannot prepare statement: %s\n", sqlite3_errmsg(db));
sqlite3_close(db);
exit(1);
}
while (sqlite3_step(res) == SQLITE_ROW) {
id = sqlite3_column_int(res, 0);
password = strdup(sqlite3_column_text(res, 1));
gen_salt(&salt);
hash = hash_sha256(password, salt);
rc = sqlite3_prepare_v2(db, update_sql, -1, &res2, 0);
if (rc != SQLITE_OK) {
printf("Cannot prepare statement: %s\n", sqlite3_errmsg(db));
sqlite3_close(db);
exit(1);
}
sqlite3_bind_text(res2, 1, hash, -1, 0);
sqlite3_bind_text(res2, 2, salt, -1, 0);
sqlite3_bind_int(res2, 3, id);
rc = sqlite3_step(res2);
if (rc != SQLITE_DONE) {
printf("Error: %s\n", sqlite3_errmsg(db));
exit(1);
}
sqlite3_finalize(res2);
}
printf("Converted!\n");
sqlite3_finalize(res);
sqlite3_close(db);
}