Update password hashing to use evp functions

deps/libuuid/ltmain.sh

@@ -0,0 +1 @@
+/usr/share/libtool/build-aux/ltmain.sh

src/users.c

@@ -3,11 +3,7 @@
 #include <stdlib.h>
 #include <sqlite3.h>
 #include <ctype.h>
-#ifdef __DragonFly__
+#include <openssl/evp.h>
-#include <sha.h>
-#else
-#include <openssl/sha.h>
-#endif
 #include "bbs.h"
 #include "inih/ini.h"
 
@@ -16,8 +12,10 @@ extern struct user_record *gUser;
 
 char *hash_sha256(char *pass, char *salt) {
 	char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
-	char *shash = (char *)malloc(66);
+	char *shash = NULL;
-	unsigned char hash[SHA256_DIGEST_LENGTH];
+	unsigned char hash[EVP_MAX_MD_SIZE];
+	unsigned int length_of_hash = 0;
+	int i;
 
 	if (!buffer) {
 		dolog("Out of memory!");
@@ -27,19 +25,31 @@ char *hash_sha256(char *pass, char *salt) {
 	sprintf(buffer, "%s%s", pass, salt);
 
 
-	SHA256_CTX sha256;
+	EVP_MD_CTX *context = EVP_MD_CTX_new();
-	SHA256_Init(&sha256);
-	SHA256_Update(&sha256, buffer, strlen(buffer));
-	SHA256_Final(hash, &sha256);
-	int i = 0;
-	for(i = 0; i < SHA256_DIGEST_LENGTH; i++) {
-		sprintf(shash + (i * 2), "%02x", hash[i]);
-	}
-	shash[64] = 0;
 
+	if (context != NULL) {
+		if(EVP_DigestInit_ex(context, EVP_sha256(), NULL)) {
+			if(EVP_DigestUpdate(context, buffer, strlen(buffer))) {
+				if(EVP_DigestFinal_ex(context, hash, &length_of_hash)) {
+
+					shash = (char *)malloc(length_of_hash * 2 + 1);
+        	        for(i = 0; i < length_of_hash; i++) {
+						sprintf(shash + (i * 2), "%02x", (int)hash[i]);
+                        
+                    }
+					EVP_MD_CTX_free(context);
 					free(buffer);
 					return shash;
                 }
+			}
+		}
+		EVP_MD_CTX_free(context);
+	}
+
+	free(buffer);
+	dolog("Error creating hash!");
+	exit(-1);
+}
 
 void gen_salt(char **s) {
 	FILE *fptr;

utils/magiftpd/magiftpd.c

@@ -1,7 +1,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <openssl/sha.h>
+#include <openssl/evp.h>
 #include <sqlite3.h>
 #include <limits.h>
 #include <sys/socket.h>
@@ -159,8 +159,10 @@ static int handler(void* user, const char* section, const char* name, const char
 
 char *hash_sha256(char *pass, char *salt) {
 	char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
-	char *shash = (char *)malloc(66);
+	char *shash = NULL;
-	unsigned char hash[SHA256_DIGEST_LENGTH];
+	unsigned char hash[EVP_MAX_MD_SIZE];
+	unsigned int length_of_hash = 0;
+	int i;
 
 	if (!buffer) {
 		fprintf(stderr, "Out of memory!\n");
@@ -170,19 +172,31 @@ char *hash_sha256(char *pass, char *salt) {
 	sprintf(buffer, "%s%s", pass, salt);
 
 
-	SHA256_CTX sha256;
+	EVP_MD_CTX *context = EVP_MD_CTX_new();
-	SHA256_Init(&sha256);
-	SHA256_Update(&sha256, buffer, strlen(buffer));
-	SHA256_Final(hash, &sha256);
-	int i = 0;
-	for(i = 0; i < SHA256_DIGEST_LENGTH; i++) {
-		sprintf(shash + (i * 2), "%02x", hash[i]);
-	}
-	shash[64] = 0;
 
+	if (context != NULL) {
+		if(EVP_DigestInit_ex(context, EVP_sha256(), NULL)) {
+			if(EVP_DigestUpdate(context, buffer, strlen(buffer))) {
+				if(EVP_DigestFinal_ex(context, hash, &length_of_hash)) {
+
+					shash = (char *)malloc(length_of_hash * 2 + 1);
+        	        for(i = 0; i < length_of_hash; i++) {
+						sprintf(shash + (i * 2), "%02x", (int)hash[i]);
+                        
+                    }
+					EVP_MD_CTX_free(context);
 					free(buffer);
 					return shash;
                 }
+			}
+		}
+		EVP_MD_CTX_free(context);
+	}
+
+	free(buffer);
+	fprintf(stderr, "Error creating hash!\n");
+	exit(-1);
+}
 
 void send_data(struct ftpclient *client, char *msg, int len) {
     int n = 0;

utils/reset_pass/reset_pass.c

@@ -3,34 +3,48 @@
 #include <stdlib.h>
 #include <sqlite3.h>
 #include <ctype.h>
-#include <openssl/sha.h>
+#include <openssl/evp.h>
 
-char *hash_sha256(char *pass, char *salt) {
+cchar *hash_sha256(char *pass, char *salt) {
 	char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
-	char *shash = (char *)malloc(66);
+	char *shash = NULL;
-	unsigned char hash[SHA256_DIGEST_LENGTH];
+	unsigned char hash[EVP_MAX_MD_SIZE];
+	unsigned int length_of_hash = 0;
+	int i;
 
 	if (!buffer) {
-		printf("Out of memory!");
+		fprintf(stderr, "Out of memory!\n");
 		exit(-1);
 	}
 
 	sprintf(buffer, "%s%s", pass, salt);
 
 
-	SHA256_CTX sha256;
+	EVP_MD_CTX *context = EVP_MD_CTX_new();
-	SHA256_Init(&sha256);
-	SHA256_Update(&sha256, buffer, strlen(buffer));
-	SHA256_Final(hash, &sha256);
-	int i = 0;
-	for(i = 0; i < SHA256_DIGEST_LENGTH; i++) {
-		sprintf(shash + (i * 2), "%02x", hash[i]);
-	}
-	shash[64] = 0;
 
+	if (context != NULL) {
+		if(EVP_DigestInit_ex(context, EVP_sha256(), NULL)) {
+			if(EVP_DigestUpdate(context, buffer, strlen(buffer))) {
+				if(EVP_DigestFinal_ex(context, hash, &length_of_hash)) {
+
+					shash = (char *)malloc(length_of_hash * 2 + 1);
+        	        for(i = 0; i < length_of_hash; i++) {
+						sprintf(shash + (i * 2), "%02x", (int)hash[i]);
+                        
+                    }
+					EVP_MD_CTX_free(context);
 					free(buffer);
 					return shash;
                 }
+			}
+		}
+		EVP_MD_CTX_free(context);
+	}
+
+	free(buffer);
+	fprintf(stderr, "Error creating hash!\n");
+	exit(-1);
+}
 
 void gen_salt(char **s) {
 	FILE *fptr;

utils/update_pass/Makefile

@@ -1,15 +0,0 @@
-CC=cc
-CFLAGS=-I/usr/local/include
-DEPS = update_pass.c
-
-OBJ = update_pass.o
-%.o: %.c $(DEPS)
-	$(CC) -c -o $@ $< $(CFLAGS)
-
-update_pass: $(OBJ)
-	$(CC) -o update_pass -o $@ $^ $(CFLAGS) -L/usr/local/lib -lsqlite3 -lssl -lcrypto
-
-.PHONY: clean
-
-clean:
-	rm -f $(OBJ) update_pass

utils/update_pass/update_pass.c

@@ -1,126 +0,0 @@
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <sqlite3.h>
-#include <ctype.h>
-#include <openssl/sha.h>
-
-char *hash_sha256(char *pass, char *salt) {
-	char *buffer = (char *)malloc(strlen(pass) + strlen(salt) + 1);
-	char *shash = (char *)malloc(66);
-	unsigned char hash[SHA256_DIGEST_LENGTH];
-
-	if (!buffer) {
-		printf("Out of memory!");
-		exit(-1);
-	}
-
-	sprintf(buffer, "%s%s", pass, salt);
-
-
-	SHA256_CTX sha256;
-	SHA256_Init(&sha256);
-	SHA256_Update(&sha256, buffer, strlen(buffer));
-	SHA256_Final(hash, &sha256);
-	int i = 0;
-	for(i = 0; i < SHA256_DIGEST_LENGTH; i++) {
-		sprintf(shash + (i * 2), "%02x", hash[i]);
-	}
-	shash[64] = 0;
-
-	free(buffer);
-	return shash;
-}
-
-void gen_salt(char **s) {
-	FILE *fptr;
-	int i;
-	char c;
-	*s = (char *)malloc(11);
-	char *salt = *s;
-
-	if (!salt) {
-		printf("Out of memory..");
-		exit(-1);
-	}
-	fptr = fopen("/dev/urandom", "rb");
-	if (!fptr) {
-		printf("Unable to open /dev/urandom!");
-		exit(-1);
-	}
-	for (i=0;i<10;i++) {
-		fread(&c, 1, 1, fptr);
-		salt[i] = (char)((abs(c) % 93) + 33);
-	}
-	fclose(fptr);
-	salt[10] = '\0';
-}
-
-int main(int argc, char **argv) {
-	sqlite3 *db;
-	sqlite3_stmt *res;
-	sqlite3_stmt *res2;
-
-	char *alter_table_sql = "ALTER TABLE users ADD COLUMN salt TEXT";
-	char *select_sql = "SELECT Id,password FROM users";
-	char *update_sql = "UPDATE users SET password=?, salt=? WHERE Id=?";
-	char *err_msg = 0;
-	int id;
-	int rc;
-	char *password;
-	char *hash;
-	char *salt;
-
- 	rc = sqlite3_open(argv[1], &db);
-
-	if (rc != SQLITE_OK) {
-		printf("Error opening database\n");
-		return -1;
-	}
-	sqlite3_busy_timeout(db, 5000);
-	rc = sqlite3_exec(db, alter_table_sql, 0, 0, &err_msg);
-	if (rc != SQLITE_OK ) {
-
-			printf("SQL error: %s\n", err_msg);
-
-			sqlite3_free(err_msg);
-			sqlite3_close(db);
-
-			return 1;
-	}
-	rc = sqlite3_prepare_v2(db, select_sql, -1, &res, 0);
-	if (rc != SQLITE_OK) {
-			printf("Cannot prepare statement: %s\n", sqlite3_errmsg(db));
-			sqlite3_close(db);
-			exit(1);
-	}
-	while (sqlite3_step(res) == SQLITE_ROW) {
-		id = sqlite3_column_int(res, 0);
-		password = strdup(sqlite3_column_text(res, 1));
-
-		gen_salt(&salt);
-		hash = hash_sha256(password, salt);
-
-		rc = sqlite3_prepare_v2(db, update_sql, -1, &res2, 0);
-		if (rc != SQLITE_OK) {
-				printf("Cannot prepare statement: %s\n", sqlite3_errmsg(db));
-				sqlite3_close(db);
-				exit(1);
-		}
-		sqlite3_bind_text(res2, 1, hash, -1, 0);
-		sqlite3_bind_text(res2, 2, salt, -1, 0);
-		sqlite3_bind_int(res2, 3, id);
-
-		rc = sqlite3_step(res2);
-
-		if (rc != SQLITE_DONE) {
-			printf("Error: %s\n", sqlite3_errmsg(db));
-			exit(1);
-		}
-		sqlite3_finalize(res2);
-	}
-
-	printf("Converted!\n");
-	sqlite3_finalize(res);
-	sqlite3_close(db);
-}