提交: 9d67cfb2c07ff0b8c995bf3c344b61882bfb03d2 - pukiwiki-fork (git)

Commit MetaInfo

• 修訂: 9d67cfb2c07ff0b8c995bf3c344b61882bfb03d2 (tree)
• 時間: 2018-05-10 00:20:42
• 作者: umorigu <umorigu@gmai...>
• Commiter: umorigu

Log Message

BugTrack/2469 OpenLDAP SHA-2 Support on password (patched by henoheno)

Supported SHA-2 password schemes:
* SHA256, SHA384, SHA512 (LDAP: OpenLDAP compatible)
* SSHA256, SSHA384, SSHA512 (OpenLDAP compatible - Salted version)
* x-php-sha256, x-php-sha384, x-php-512 (Simple hex version)

RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)
https://tools.ietf.org/html/rfc6234

Internet-Draft: Lightweight Directory Access Protocol (LDAP): Hashed Attribute values for 'userPassword' (March 13, 2013)
https://tools.ietf.org/html/draft-stroeder-hashed-userpassword-values-01

Change Summary

• modified: lib/auth.php
• modified: plugin/md5.inc.php
• modified: pukiwiki.ini.php

差異

--- a/lib/auth.php
+++ b/lib/auth.php
@@ -85,6 +85,12 @@ function pkwk_hash_compute($phrase = '', $scheme = '{x-php-md5}', $prefix = TRUE
 			hash('sha256', $phrase);
 		break;
 
+	// PHP sha384
+	case '{x-php-sha384}'  :
+		$hash = ($prefix ? ($canonical ? '{x-php-sha384}' : $scheme) : '') .
+			hash('sha384', $phrase);
+		break;
+
 	// PHP sha512
 	case '{x-php-sha512}'  :
 		$hash = ($prefix ? ($canonical ? '{x-php-sha512}' : $scheme) : '') .
@@ -125,6 +131,48 @@ function pkwk_hash_compute($phrase = '', $scheme = '{x-php-md5}', $prefix = TRUE
 			base64_encode(pkwk_hex2bin(sha1($phrase . $salt)) . $salt);
 		break;
 
+	// LDAP SHA256
+	case '{sha256}'        :
+		$hash = ($prefix ? ($canonical ? '{SHA256}' : $scheme) : '') .
+			base64_encode(hash('sha256', $phrase, TRUE));
+		break;
+
+	// LDAP SSHA256
+	case '{ssha256}'        :
+		// SHA-2 SHA-256 Key length = 256bits = 32bytes
+		$salt = ($salt != '' ? substr(base64_decode($salt), 32) : substr(crypt(''), -8));
+		$hash = ($prefix ? ($canonical ? '{SSHA256}' : $scheme) : '') .
+			base64_encode(hash('sha256', $phrase . $salt, TRUE) . $salt);
+		break;
+
+	// LDAP SHA384
+	case '{sha384}'        :
+		$hash = ($prefix ? ($canonical ? '{SHA384}' : $scheme) : '') .
+			base64_encode(hash('sha384', $phrase, TRUE));
+		break;
+
+	// LDAP SSHA384
+	case '{ssha384}'        :
+		// SHA-2 SHA-384 Key length = 384bits = 48bytes
+		$salt = ($salt != '' ? substr(base64_decode($salt), 48) : substr(crypt(''), -8));
+		$hash = ($prefix ? ($canonical ? '{SSHA384}' : $scheme) : '') .
+			base64_encode(hash('sha384', $phrase . $salt, TRUE) . $salt);
+		break;
+
+	// LDAP SHA512
+	case '{sha512}'        :
+		$hash = ($prefix ? ($canonical ? '{SHA512}' : $scheme) : '') .
+			base64_encode(hash('sha512', $phrase, TRUE));
+		break;
+
+	// LDAP SSHA512
+	case '{ssha512}'        :
+		// SHA-2 SHA-512 Key length = 512bits = 64bytes
+		$salt = ($salt != '' ? substr(base64_decode($salt), 64) : substr(crypt(''), -8));
+		$hash = ($prefix ? ($canonical ? '{SSHA512}' : $scheme) : '') .
+			base64_encode(hash('sha512', $phrase . $salt, TRUE) . $salt);
+		break;
+
 	// LDAP CLEARTEXT and just cleartext
 	case '{cleartext}'   : /* FALLTHROUGH */
 	case ''              :

--- a/plugin/md5.inc.php
+++ b/plugin/md5.inc.php
@@ -37,10 +37,10 @@ function plugin_md5_action()
 			array_push($scheme_list, 'x-php-sha1', 'SHA', 'SSHA');
 		}
 		if ($algos_enabled->sha256) {
-			array_push($scheme_list, 'x-php-sha256');
+			array_push($scheme_list, 'x-php-sha256', 'SHA256', 'SSHA256');
 		}
 		if ($algos_enabled->sha512) {
-			array_push($scheme_list, 'x-php-sha512');
+			array_push($scheme_list, 'x-php-sha512', 'SHA512', 'SSHA512');
 		}
 		if (!in_array($scheme, $scheme_list)) {
 			return array(
@@ -113,7 +113,20 @@ EOD;
   <label for="_p_md5_lsmd5">LDAP SMD5 (md5 with a seed) *</label><br />
   <input type="radio" name="scheme" id="_p_md5_lmd5" value="MD5" />
   <label for="_p_md5_lmd5">LDAP MD5</label><br />
-
+EOD;
+	if ($algos_enabled->sha256) $form .= <<<EOD
+  <input type="radio" name="scheme" id="_p_md5_lssha256" value="SSHA256"/>
+  <label for="_p_md5_lssha256">LDAP SSHA256 (sha256 with a seed) *</label><br />
+  <input type="radio" name="scheme" id="_p_md5_lsha256" value="SHA256" />
+  <label for="_p_md5_lsha256">LDAP SHA256</label><br />
+EOD;
+	if ($algos_enabled->sha512) $form .= <<<EOD
+  <input type="radio" name="scheme" id="_p_md5_lssha512" value="SSHA512"/>
+  <label for="_p_md5_lssha512">LDAP SSHA512 (sha512 with a seed) *</label><br />
+  <input type="radio" name="scheme" id="_p_md5_lsha512" value="SHA512" />
+  <label for="_p_md5_lsha512">LDAP SHA512</label><br />
+EOD;
+	$form .= <<<EOD
   <input type="checkbox" name="prefix" id="_p_md5_prefix" checked="checked" />
   <label for="_p_md5_prefix">Add scheme prefix (RFC2307, Using LDAP as NIS)</label><br />
 

--- a/pukiwiki.ini.php
+++ b/pukiwiki.ini.php
@@ -185,6 +185,7 @@ $adminpass = '{x-php-md5}!';
 //$adminpass = '{CRYPT}$1$AR.Gk94x$uCe8fUUGMfxAPH83psCZG/';   // LDAP CRYPT 'pass'
 //$adminpass = '{MD5}Gh3JHJBzJcaScd3wyUS8cg==';               // LDAP MD5   'pass'
 //$adminpass = '{SMD5}o7lTdtHFJDqxFOVX09C8QnlmYmZnd2Qx';      // LDAP SMD5  'pass'
+//$adminpass = '{SHA256}10/w7o2juYBrGMh32/KbveULW9jk2tejpyUAD+uC6PE=' // LDAP SHA256 'pass'
 
 /////////////////////////////////////////////////
 // Page-reading feature settings