forked from extern/egroupware
437 lines
13 KiB
PHP
437 lines
13 KiB
PHP
<?php
|
|
/**************************************************************************\
|
|
* eGroupWare API - Password auth and crypt functions *
|
|
* This file written by Miles Lott <milos@groupwhere.org> *
|
|
* Copyright (C) 2004 Miles Lott *
|
|
* Many functions based on code from Frank Thomas <frank@thomas-alfeld.de> *
|
|
* which can be seen at http://www.thomas-alfeld.de/frank/ *
|
|
* Other functions from class.common.inc.php originally from phpGroupWare *
|
|
* ------------------------------------------------------------------------ *
|
|
* This library is free software; you can redistribute it and/or modify it *
|
|
* under the terms of the GNU Lesser General Public License as published by *
|
|
* the Free Software Foundation; either version 2.1 of the License, *
|
|
* or any later version. *
|
|
* This library is distributed in the hope that it will be useful, but *
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of *
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. *
|
|
* See the GNU Lesser General Public License for more details. *
|
|
* You should have received a copy of the GNU Lesser General Public License *
|
|
* along with this library; if not, write to the Free Software Foundation, *
|
|
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
|
|
\**************************************************************************/
|
|
|
|
/* $Id$ */
|
|
|
|
if(empty($GLOBALS['egw_info']['server']['auth_type']))
|
|
{
|
|
$GLOBALS['egw_info']['server']['auth_type'] = 'sql';
|
|
}
|
|
include(EGW_API_INC.'/class.auth_'.$GLOBALS['egw_info']['server']['auth_type'].'.inc.php');
|
|
|
|
class auth extends auth_
|
|
{
|
|
var $seeded = False;
|
|
var $error = '';
|
|
|
|
/**
|
|
* return a random string of size $size
|
|
*
|
|
* @param $size int-size of random string to return
|
|
*/
|
|
function randomstring($size)
|
|
{
|
|
$s = '';
|
|
$random_char = array(
|
|
'0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f',
|
|
'g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v',
|
|
'w','x','y','z','A','B','C','D','E','F','G','H','I','J','K','L',
|
|
'M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z'
|
|
);
|
|
|
|
for ($i=0; $i<$size; $i++)
|
|
{
|
|
$s .= $random_char[mt_rand(1,61)];
|
|
}
|
|
return $s;
|
|
}
|
|
|
|
/**
|
|
* encrypt password
|
|
*
|
|
* uses the encryption type set in setup and calls the appropriate encryption functions
|
|
*
|
|
* @param $password password to encrypt
|
|
*/
|
|
function encrypt_password($password,$sql=False)
|
|
{
|
|
if($sql)
|
|
{
|
|
return $this->encrypt_sql($password);
|
|
}
|
|
return $this->encrypt_ldap($password);
|
|
}
|
|
|
|
/**
|
|
* compares an encrypted password
|
|
*
|
|
* encryption type set in setup and calls the appropriate encryption functions
|
|
*
|
|
* @param $cleartext cleartext password
|
|
* @param $encrypted encrypted password, can have a {hash} prefix, which overrides $type
|
|
* @param $type type of encryption
|
|
* @param $username used as optional key of encryption for md5_hmac
|
|
*/
|
|
function compare_password($cleartext,$encrypted,$type,$username='')
|
|
{
|
|
// allow to specify the hash type to prefix the hash, to easy migrate passwords from ldap
|
|
$saved_enc = $encrypted;
|
|
if (preg_match('/^\\{([a-z_5]+)\\}(.+)$/i',$encrypted,$matches))
|
|
{
|
|
$type = strtolower($matches[1]);
|
|
$encrypted = $matches[2];
|
|
|
|
switch($type) // some hashs are specially "packed" in ldap
|
|
{
|
|
case 'md5':
|
|
$encrypted = implode('',unpack('H*',base64_decode($encrypted)));
|
|
break;
|
|
case 'crypt':
|
|
// nothing to do
|
|
break;
|
|
default:
|
|
$encrypted = $saved_enc;
|
|
// ToDo: the others ...
|
|
}
|
|
}
|
|
switch($type)
|
|
{
|
|
case 'smd5':
|
|
return $this->smd5_compare($cleartext,$encrypted);
|
|
case 'sha':
|
|
return $this->sha_compare($cleartext,$encrypted);
|
|
case 'ssha':
|
|
return $this->ssha_compare($cleartext,$encrypted);
|
|
case 'crypt':
|
|
case 'md5_crypt':
|
|
case 'blowfish_crypt':
|
|
case 'ext_crypt':
|
|
return $this->crypt_compare($cleartext,$encrypted,$type);
|
|
case 'md5_hmac':
|
|
return $this->md5_hmac_compare($cleartext,$encrypted,$username);
|
|
case 'md5':
|
|
default:
|
|
return strcmp(md5($cleartext),$encrypted) == 0 ? true : false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* encrypt password for ldap
|
|
*
|
|
* uses the encryption type set in setup and calls the appropriate encryption functions
|
|
*
|
|
* @param $password password to encrypt
|
|
*/
|
|
function encrypt_ldap($password)
|
|
{
|
|
$type = strtolower($GLOBALS['egw_info']['server']['ldap_encryption_type']);
|
|
$salt = '';
|
|
switch($type)
|
|
{
|
|
default: // eg. setup >> config never saved
|
|
case 'des':
|
|
$salt = $this->randomstring(2);
|
|
$_password = crypt($password, $salt);
|
|
$e_password = '{crypt}'.$_password;
|
|
break;
|
|
case 'md5':
|
|
/* New method taken from the openldap-software list as recommended by
|
|
* Kervin L. Pierre" <kervin@blueprint-tech.com>
|
|
*/
|
|
$e_password = '{md5}' . base64_encode(pack("H*",md5($password)));
|
|
break;
|
|
case 'smd5':
|
|
if(!function_exists('mhash'))
|
|
{
|
|
return False;
|
|
}
|
|
$salt = $this->randomstring(8);
|
|
$hash = mhash(MHASH_MD5, $password . $salt);
|
|
$e_password = '{SMD5}' . base64_encode($hash . $salt);
|
|
break;
|
|
case 'sha':
|
|
if(!function_exists('mhash'))
|
|
{
|
|
return False;
|
|
}
|
|
$e_password = '{SHA}' . base64_encode(mhash(MHASH_SHA1, $password));
|
|
break;
|
|
case 'ssha':
|
|
if(!function_exists('mhash'))
|
|
{
|
|
return False;
|
|
}
|
|
$salt = $this->randomstring(8);
|
|
$hash = mhash(MHASH_SHA1, $password . $salt);
|
|
$e_password = '{SSHA}' . base64_encode($hash . $salt);
|
|
break;
|
|
}
|
|
return $e_password;
|
|
}
|
|
|
|
/**
|
|
* Create an ldap hash from an sql hash
|
|
*
|
|
* @param string $hash
|
|
*/
|
|
function hash_sql2ldap($hash)
|
|
{
|
|
switch(strtolower($GLOBALS['egw_info']['server']['sql_encryption_type']))
|
|
{
|
|
case '': // not set sql_encryption_type
|
|
case 'md5':
|
|
$hash = '{md5}' . base64_encode(pack("H*",$hash));
|
|
break;
|
|
case 'crypt':
|
|
$hash = '{crypt}' . $hash;
|
|
break;
|
|
}
|
|
return $hash;
|
|
}
|
|
|
|
/**
|
|
* Create a password for storage in the accounts table
|
|
*
|
|
* @param string $password
|
|
* @return string hash
|
|
*/
|
|
function encrypt_sql($password)
|
|
{
|
|
/* Grab configured type, or default to md5() (old method) */
|
|
$type = @$GLOBALS['egw_info']['server']['sql_encryption_type']
|
|
? strtolower($GLOBALS['egw_info']['server']['sql_encryption_type'])
|
|
: 'md5';
|
|
switch($type)
|
|
{
|
|
case 'crypt':
|
|
if(@defined('CRYPT_STD_DES') && CRYPT_STD_DES == 1)
|
|
{
|
|
$salt = $this->randomstring(2);
|
|
return crypt($password,$salt);
|
|
}
|
|
$this->error = 'no std crypt';
|
|
break;
|
|
case 'blowfish_crypt':
|
|
if(@defined('CRYPT_BLOWFISH') && CRYPT_BLOWFISH == 1)
|
|
{
|
|
$salt = '$2$' . $this->randomstring(13);
|
|
return crypt($password,$salt);
|
|
}
|
|
$this->error = 'no blowfish crypt';
|
|
break;
|
|
case 'md5_crypt':
|
|
if(@defined('CRYPT_MD5') && CRYPT_MD5 == 1)
|
|
{
|
|
$salt = '$1$' . $this->randomstring(9);
|
|
return crypt($password,$salt);
|
|
}
|
|
$this->error = 'no md5 crypt';
|
|
break;
|
|
case 'ext_crypt':
|
|
if(@defined('CRYPT_EXT_DES') && CRYPT_EXT_DES == 1)
|
|
{
|
|
$salt = $this->randomstring(9);
|
|
return crypt($password,$salt);
|
|
}
|
|
$this->error = 'no ext crypt';
|
|
break;
|
|
case 'smd5':
|
|
if(!function_exists('mhash'))
|
|
{
|
|
return False;
|
|
}
|
|
$salt = $this->randomstring(8);
|
|
$hash = mhash(MHASH_MD5, $password . $salt);
|
|
return '{SMD5}' . base64_encode($hash . $salt);
|
|
case 'sha':
|
|
if(!function_exists('mhash'))
|
|
{
|
|
$this->error = 'no sha';
|
|
return False;
|
|
}
|
|
return '{SHA}' . base64_encode(mhash(MHASH_SHA1,$password));
|
|
case 'ssha':
|
|
if(!function_exists('mhash'))
|
|
{
|
|
$this->error = 'no ssha';
|
|
return False;
|
|
}
|
|
$salt = $this->randomstring(8);
|
|
$hash = mhash(MHASH_SHA1, $password . $salt);
|
|
return '{SSHA}' . base64_encode($hash . $salt);
|
|
case 'md5':
|
|
default:
|
|
/* This is the old standard for password storage in SQL */
|
|
return md5($password);
|
|
}
|
|
$this->error = $this->error ? $this->error : 'no valid encryption available';
|
|
return False;
|
|
}
|
|
|
|
/**
|
|
* Checks if a given password is "safe"
|
|
*
|
|
* @param string $login
|
|
* @abstract atm a simple check in length, #digits, #uppercase and #lowercase
|
|
* could be made more safe using e.g. pecl library cracklib
|
|
* but as pecl dosn't run on any platform and isn't GPL'd
|
|
* i haven't implemented it yet
|
|
* Windows compatible check is: 7 char lenth, 1 Up, 1 Low, 1 Num and 1 Special
|
|
* @author cornelius weiss <egw at von-und-zu-weiss.de>
|
|
* @return mixed false if password is considered "safe" or a string $message if "unsafe"
|
|
*/
|
|
function crackcheck($passwd)
|
|
{
|
|
if (!preg_match('/.{'. ($noc=7). ',}/',$passwd))
|
|
{
|
|
$message = lang('Password must have at least %1 characters',$noc). '<br>';
|
|
}
|
|
if(!preg_match('/(.*\d.*){'. ($non=1). ',}/',$passwd))
|
|
{
|
|
$message .= lang('Password must contain at least %1 numbers',$non). '<br>';
|
|
}
|
|
if(!preg_match('/(.*[[:upper:]].*){'. ($nou=1). ',}/',$passwd))
|
|
{
|
|
$message .= lang('Password must contain at least %1 uppercase letters',$nou). '<br>';
|
|
}
|
|
if(!preg_match('/(.*[[:lower:]].*){'. ($nol=1). ',}/',$passwd))
|
|
{
|
|
$message .= lang('Password must contain at least %1 lowercase letters',$nol). '<br>';
|
|
}
|
|
if(!preg_match('/(.*[\\!"#$%&\'()*+,-.\/:;<=>?@\[\]\^_ {|}~`].*){'. ($nol=1). ',}/',$passwd))
|
|
{
|
|
$message .= lang('Password must contain at least %1 special characters',$nol). '<br>';
|
|
}
|
|
return $message ? $message : false;
|
|
}
|
|
|
|
/**
|
|
* compare SMD5-encrypted passwords for authentication
|
|
*
|
|
* @param string $form_val user input value for comparison
|
|
* @param string $db_val stored value (from database)
|
|
* @return boolean True on successful comparison
|
|
*/
|
|
function smd5_compare($form_val,$db_val)
|
|
{
|
|
/* Start with the first char after {SMD5} */
|
|
$hash = base64_decode(substr($db_val,6));
|
|
|
|
/* SMD5 hashes are 16 bytes long */
|
|
$orig_hash = substr($hash, 0, 16);
|
|
$salt = substr($hash, 16);
|
|
|
|
$new_hash = mhash(MHASH_MD5,$form_val . $salt);
|
|
//echo '<br> DB: ' . base64_encode($orig_hash) . '<br>FORM: ' . base64_encode($new_hash);
|
|
|
|
if(strcmp($orig_hash,$new_hash) == 0)
|
|
{
|
|
return True;
|
|
}
|
|
return False;
|
|
}
|
|
|
|
/**
|
|
* compare SHA-encrypted passwords for authentication
|
|
*
|
|
* @param string $form_val user input value for comparison
|
|
* @param string $db_val stored value (from database)
|
|
* @return boolean True on successful comparison
|
|
*/
|
|
function sha_compare($form_val,$db_val)
|
|
{
|
|
/* Start with the first char after {SHA} */
|
|
$hash = base64_decode(substr($db_val,5));
|
|
$new_hash = mhash(MHASH_SHA1,$form_val);
|
|
//echo '<br> DB: ' . base64_encode($orig_hash) . '<br>FORM: ' . base64_encode($new_hash);
|
|
|
|
if(strcmp($hash,$new_hash) == 0)
|
|
{
|
|
return True;
|
|
}
|
|
return False;
|
|
}
|
|
|
|
/**
|
|
* compare SSHA-encrypted passwords for authentication
|
|
*
|
|
* @param string $form_val user input value for comparison
|
|
* @param string $db_val stored value (from database)
|
|
* @return boolean True on successful comparison
|
|
*/
|
|
function ssha_compare($form_val,$db_val)
|
|
{
|
|
/* Start with the first char after {SSHA} */
|
|
$hash = base64_decode(substr($db_val, 6));
|
|
|
|
// SHA-1 hashes are 160 bits long
|
|
$orig_hash = substr($hash, 0, 20);
|
|
$salt = substr($hash, 20);
|
|
$new_hash = mhash(MHASH_SHA1, $form_val . $salt);
|
|
|
|
if(strcmp($orig_hash,$new_hash) == 0)
|
|
{
|
|
return True;
|
|
}
|
|
return False;
|
|
}
|
|
|
|
/**
|
|
* compare crypted passwords for authentication whether des,ext_des,md5, or blowfish crypt
|
|
*
|
|
* @param string $form_val user input value for comparison
|
|
* @param string $db_val stored value (from database)
|
|
* @param string $type crypt() type
|
|
* @return boolean True on successful comparison
|
|
*/
|
|
function crypt_compare($form_val,$db_val,$type)
|
|
{
|
|
$saltlen = array(
|
|
'blowfish_crypt' => 16,
|
|
'md5_crypt' => 12,
|
|
'ext_crypt' => 9,
|
|
'crypt' => 2
|
|
);
|
|
|
|
// PHP's crypt(): salt + hash
|
|
// notice: "The encryption type is triggered by the salt argument."
|
|
$salt = substr($db_val, 0, (int)$saltlen[$type]);
|
|
$new_hash = crypt($form_val, $salt);
|
|
|
|
if(strcmp($db_val,$new_hash) == 0)
|
|
{
|
|
return True;
|
|
}
|
|
return False;
|
|
}
|
|
|
|
/**
|
|
* compare md5_hmac-encrypted passwords for authentication (see RFC2104)
|
|
*
|
|
* @param string $form_val user input value for comparison
|
|
* @param string $db_val stored value (from database)
|
|
* @param string $key key for md5_hmac-encryption (username for imported smf users)
|
|
* @return boolean True on successful comparison
|
|
*/
|
|
function md5_hmac_compare($form_val,$db_val,$key)
|
|
{
|
|
$key = str_pad(strlen($key) <= 64 ? $key : pack('H*', md5($key)), 64, chr(0x00));
|
|
$md5_hmac = md5(($key ^ str_repeat(chr(0x5c), 64)) . pack('H*', md5(($key ^ str_repeat(chr(0x36), 64)). $form_val)));
|
|
if(strcmp($md5_hmac,$db_val) == 0)
|
|
{
|
|
return True;
|
|
}
|
|
return False;
|
|
}
|
|
}
|
|
?>
|