[thirdparty/openssl.git] / apps / passwd.c

/* apps/passwd.c */

#if defined NO_MD5 || defined CHARSET_EBCDIC
# define NO_MD5CRYPT_1
#endif

#if !defined(NO_DES) || !defined(NO_MD5CRYPT_1)

#include <assert.h>
#include <string.h>

#include "apps.h"

#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/rand.h>

#ifndef NO_DES
# include <openssl/des.h>
#endif
#ifndef NO_MD5CRYPT_1
# include <openssl/md5.h>
#endif


#undef PROG
#define PROG passwd_main


static unsigned const char cov_2char[64]={
	/* from crypto/des/fcrypt.c */
	0x2E,0x2F,0x30,0x31,0x32,0x33,0x34,0x35,
	0x36,0x37,0x38,0x39,0x41,0x42,0x43,0x44,
	0x45,0x46,0x47,0x48,0x49,0x4A,0x4B,0x4C,
	0x4D,0x4E,0x4F,0x50,0x51,0x52,0x53,0x54,
	0x55,0x56,0x57,0x58,0x59,0x5A,0x61,0x62,
	0x63,0x64,0x65,0x66,0x67,0x68,0x69,0x6A,
	0x6B,0x6C,0x6D,0x6E,0x6F,0x70,0x71,0x72,
	0x73,0x74,0x75,0x76,0x77,0x78,0x79,0x7A
};

static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
	char *passwd, BIO *out, int quiet, int table, int reverse,
	size_t pw_maxlen, int usecrypt, int use1, int useapr1);

/* -crypt        - standard Unix password algorithm (default)
 * -1            - MD5-based password algorithm
 * -apr1         - MD5-based password algorithm, Apache variant
 * -salt string  - salt
 * -in file      - read passwords from file
 * -stdin        - read passwords from stdin
 * -quiet        - no warnings
 * -table        - format output as table
 * -reverse      - switch table columns
 */

int MAIN(int, char **);

int MAIN(int argc, char **argv)
	{
	int ret = 1;
	char *infile = NULL;
	int in_stdin = 0;
	char *salt = NULL, *passwd = NULL, **passwds = NULL;
	char *salt_malloc = NULL, *passwd_malloc = NULL;
	size_t passwd_malloc_size = 0;
	int pw_source_defined = 0;
	BIO *in = NULL, *out = NULL;
	int i, badopt, opt_done;
	int passed_salt = 0, quiet = 0, table = 0, reverse = 0;
	int usecrypt = 0, use1 = 0, useapr1 = 0;
	size_t pw_maxlen = 0;

	apps_startup();

	if (bio_err == NULL)
		if ((bio_err=BIO_new(BIO_s_file())) != NULL)
			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
	out = BIO_new(BIO_s_file());
	if (out == NULL)
		goto err;
	BIO_set_fp(out, stdout, BIO_NOCLOSE | BIO_FP_TEXT);
#ifdef VMS
	{
	BIO *tmpbio = BIO_new(BIO_f_linebuffer());
	out = BIO_push(tmpbio, out);
	}
#endif

	badopt = 0, opt_done = 0;
	i = 0;
	while (!badopt && !opt_done && argv[++i] != NULL)
		{
		if (strcmp(argv[i], "-crypt") == 0)
			usecrypt = 1;
		else if (strcmp(argv[i], "-1") == 0)
			use1 = 1;
		else if (strcmp(argv[i], "-apr1") == 0)
			useapr1 = 1;
		else if (strcmp(argv[i], "-salt") == 0)
			{
			if ((argv[i+1] != NULL) && (salt == NULL))
				{
				passed_salt = 1;
				salt = argv[++i];
				}
			else
				badopt = 1;
			}
		else if (strcmp(argv[i], "-in") == 0)
			{
			if ((argv[i+1] != NULL) && !pw_source_defined)
				{
				pw_source_defined = 1;
				infile = argv[++i];
				}
			else
				badopt = 1;
			}
		else if (strcmp(argv[i], "-stdin") == 0)
			{
			if (!pw_source_defined)
				{
				pw_source_defined = 1;
				in_stdin = 1;
				}
			else
				badopt = 1;
			}
		else if (strcmp(argv[i], "-quiet") == 0)
			quiet = 1;
		else if (strcmp(argv[i], "-table") == 0)
			table = 1;
		else if (strcmp(argv[i], "-reverse") == 0)
			reverse = 1;
		else if (argv[i][0] == '-')
			badopt = 1;
		else if (!pw_source_defined)
			/* non-option arguments, use as passwords */
			{
			pw_source_defined = 1;
			passwds = &argv[i];
			opt_done = 1;
			}
		else
			badopt = 1;
		}

	if (!usecrypt && !use1 && !useapr1) /* use default */
		usecrypt = 1;
	if (usecrypt + use1 + useapr1 > 1) /* conflict */
		badopt = 1;

	/* reject unsupported algorithms */
#ifdef NO_DES
	if (usecrypt) badopt = 1;
#endif
#ifdef NO_MD5CRYPT_1
	if (use1 || useapr1) badopt = 1;
#endif

	if (badopt) 
		{
		BIO_printf(bio_err, "Usage: passwd [options] [passwords]\n");
		BIO_printf(bio_err, "where options are\n");
#ifndef NO_DES
		BIO_printf(bio_err, "-crypt             standard Unix password algorithm (default)\n");
#endif
#ifndef NO_MD5CRYPT_1
		BIO_printf(bio_err, "-1                 MD5-based password algorithm\n");
		BIO_printf(bio_err, "-apr1              MD5-based password algorithm, Apache variant\n");
#endif
		BIO_printf(bio_err, "-salt string       use provided salt\n");
		BIO_printf(bio_err, "-in file           read passwords from file\n");
		BIO_printf(bio_err, "-stdin             read passwords from stdin\n");
		BIO_printf(bio_err, "-quiet             no warnings\n");
		BIO_printf(bio_err, "-table             format output as table\n");
		BIO_printf(bio_err, "-reverse           switch table columns\n");
		
		goto err;
		}

	if ((infile != NULL) || in_stdin)
		{
		in = BIO_new(BIO_s_file());
		if (in == NULL)
			goto err;
		if (infile != NULL)
			{
			assert(in_stdin == 0);
			if (BIO_read_filename(in, infile) <= 0)
				goto err;
			}
		else
			{
			assert(in_stdin);
			BIO_set_fp(in, stdin, BIO_NOCLOSE);
			}
		}
	
	if (usecrypt)
		pw_maxlen = 8;
	else if (use1 || useapr1)
		pw_maxlen = 256; /* arbitrary limit, should be enough for most passwords */

	if (passwds == NULL)
		{
		/* no passwords on the command line */

		passwd_malloc_size = pw_maxlen + 2;
		/* longer than necessary so that we can warn about truncation */
		passwd = passwd_malloc = OPENSSL_malloc(passwd_malloc_size);
		if (passwd_malloc == NULL)
			goto err;
		}

	if ((in == NULL) && (passwds == NULL))
		{
		/* build a null-terminated list */
		static char *passwds_static[2] = {NULL, NULL};
		
		passwds = passwds_static;
		if (in == NULL)
			if (EVP_read_pw_string(passwd_malloc, passwd_malloc_size, "Password: ", 0) != 0)
				goto err;
		passwds[0] = passwd_malloc;
		}

	if (in == NULL)
		{
		assert(passwds != NULL);
		assert(*passwds != NULL);
		
		do /* loop over list of passwords */
			{
			passwd = *passwds++;
			if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, out,
				quiet, table, reverse, pw_maxlen, usecrypt, use1, useapr1))
				goto err;
			}
		while (*passwds != NULL);
		}
	else
		/* in != NULL */
		{
		int done;

		assert (passwd != NULL);
		do
			{
			int r = BIO_gets(in, passwd, pw_maxlen + 1);
			if (r > 0)
				{
				char *c = (strchr(passwd, '\n')) ;
				if (c != NULL)
					*c = 0; /* truncate at newline */
				else
					{
					/* ignore rest of line */
					char trash[BUFSIZ];
					do
						r = BIO_gets(in, trash, sizeof trash);
					while ((r > 0) && (!strchr(trash, '\n')));
					}
				
				if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, out,
					quiet, table, reverse, pw_maxlen, usecrypt, use1, useapr1))
					goto err;
				}
			done = (r <= 0);
			}
		while (!done);
		}

err:
	ERR_print_errors(bio_err);
	if (salt_malloc)
		OPENSSL_free(salt_malloc);
	if (passwd_malloc)
		OPENSSL_free(passwd_malloc);
	if (in)
		BIO_free(in);
	if (out)
		BIO_free_all(out);
	EXIT(ret);
	}


#ifndef NO_MD5CRYPT_1
/* MD5-based password algorithm (should probably be available as a library
 * function; then the static buffer would not be acceptable).
 * For magic string "1", this should be compatible to the MD5-based BSD
 * password algorithm.
 * For 'magic' string "apr1", this is compatible to the MD5-based Apache
 * password algorithm.
 * (Apparently, the Apache password algorithm is identical except that the
 * 'magic' string was changed -- the laziest application of the NIH principle
 * I've ever encountered.)
 */
static char *md5crypt(const char *passwd, const char *magic, const char *salt)
	{
	static char out_buf[6 + 9 + 24 + 2]; /* "$apr1$..salt..$.......md5hash..........\0" */
	unsigned char buf[MD5_DIGEST_LENGTH];
	char *salt_out;
	int n, i;
	MD5_CTX md;
	size_t passwd_len, salt_len;

	passwd_len = strlen(passwd);
	out_buf[0] = '$';
	out_buf[1] = 0;
	assert(strlen(magic) <= 4); /* "1" or "apr1" */
	strncat(out_buf, magic, 4);
	strncat(out_buf, "$", 1);
	strncat(out_buf, salt, 8);
	assert(strlen(out_buf) <= 6 + 8); /* "$apr1$..salt.." */
	salt_out = out_buf + 6;
	salt_len = strlen(salt_out);
	assert(salt_len <= 8);
	
	MD5_Init(&md);
	MD5_Update(&md, passwd, passwd_len);
	MD5_Update(&md, "$", 1);
	MD5_Update(&md, magic, strlen(magic));
	MD5_Update(&md, "$", 1);
	MD5_Update(&md, salt_out, salt_len);
	
	 {
		MD5_CTX md2;

		MD5_Init(&md2);
		MD5_Update(&md2, passwd, passwd_len);
		MD5_Update(&md2, salt_out, salt_len);
		MD5_Update(&md2, passwd, passwd_len);
		MD5_Final(buf, &md2);
	 }
	for (i = passwd_len; i > sizeof buf; i -= sizeof buf)
		MD5_Update(&md, buf, sizeof buf);
	MD5_Update(&md, buf, i);
	
	n = passwd_len;
	while (n)
		{
		MD5_Update(&md, (n & 1) ? "\0" : passwd, 1);
		n >>= 1;
		}
	MD5_Final(buf, &md);

	for (i = 0; i < 1000; i++)
		{
		MD5_CTX md2;

		MD5_Init(&md2);
		MD5_Update(&md2, (i & 1) ? (unsigned char *) passwd : buf,
		                 (i & 1) ? passwd_len : sizeof buf);
		if (i % 3)
			MD5_Update(&md2, salt_out, salt_len);
		if (i % 7)
			MD5_Update(&md2, passwd, passwd_len);
		MD5_Update(&md2, (i & 1) ? buf : (unsigned char *) passwd,
		                 (i & 1) ? sizeof buf : passwd_len);
		MD5_Final(buf, &md2);
		}
	
	 {
		/* transform buf into output string */
	
		unsigned char buf_perm[sizeof buf];
		int dest, source;
		char *output;

		/* silly output permutation */
		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
			buf_perm[dest] = buf[source];
		buf_perm[14] = buf[5];
		buf_perm[15] = buf[11];
#ifndef PEDANTIC /* Unfortunately, this generates a "no effect" warning */
		assert(16 == sizeof buf_perm);
#endif
		
		output = salt_out + salt_len;
		assert(output == out_buf + strlen(out_buf));
		
		*output++ = '$';

		for (i = 0; i < 15; i += 3)
			{
			*output++ = cov_2char[buf_perm[i+2] & 0x3f];
			*output++ = cov_2char[((buf_perm[i+1] & 0xf) << 2) |
				                  (buf_perm[i+2] >> 6)];
			*output++ = cov_2char[((buf_perm[i] & 3) << 4) |
				                  (buf_perm[i+1] >> 4)];
			*output++ = cov_2char[buf_perm[i] >> 2];
			}
		assert(i == 15);
		*output++ = cov_2char[buf_perm[i] & 0x3f];
		*output++ = cov_2char[buf_perm[i] >> 6];
		*output = 0;
		assert(strlen(out_buf) < sizeof(out_buf));
	 }

	return out_buf;
	}
#endif


static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
	char *passwd, BIO *out,	int quiet, int table, int reverse,
	size_t pw_maxlen, int usecrypt, int use1, int useapr1)
	{
	char *hash = NULL;

	assert(salt_p != NULL);
	assert(salt_malloc_p != NULL);

	/* first make sure we have a salt */
	if (!passed_salt)
		{
#ifndef NO_DES
		if (usecrypt)
			{
			if (*salt_malloc_p == NULL)
				{
				*salt_p = *salt_malloc_p = OPENSSL_malloc(3);
				if (*salt_malloc_p == NULL)
					goto err;
				}
			if (RAND_pseudo_bytes((unsigned char *)*salt_p, 2) < 0)
				goto err;
			(*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f]; /* 6 bits */
			(*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f]; /* 6 bits */
			(*salt_p)[2] = 0;
#ifdef CHARSET_EBCDIC
			ascii2ebcdic(*salt_p, *salt_p, 2); /* des_crypt will convert
			                                    * back to ASCII */
#endif
			}
#endif /* !NO_DES */

#ifndef NO_MD5CRYPT_1
		if (use1 || useapr1)
			{
			int i;
			
			if (*salt_malloc_p == NULL)
				{
				*salt_p = *salt_malloc_p = OPENSSL_malloc(9);
				if (*salt_malloc_p == NULL)
					goto err;
				}
			if (RAND_pseudo_bytes((unsigned char *)*salt_p, 8) < 0)
				goto err;
			
			for (i = 0; i < 8; i++)
				(*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
			(*salt_p)[8] = 0;
			}
#endif /* !NO_MD5CRYPT_1 */
		}
	
	assert(*salt_p != NULL);
	
	/* truncate password if necessary */
	if ((strlen(passwd) > pw_maxlen))
		{
		if (!quiet)
			BIO_printf(bio_err, "Warning: truncating password to %u characters\n", pw_maxlen);
		passwd[pw_maxlen] = 0;
		}
	assert(strlen(passwd) <= pw_maxlen);
	
	/* now compute password hash */
#ifndef NO_DES
	if (usecrypt)
		hash = des_crypt(passwd, *salt_p);
#endif
#ifndef NO_MD5CRYPT_1
	if (use1 || useapr1)
		hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p);
#endif
	assert(hash != NULL);

	if (table && !reverse)
		BIO_printf(out, "%s\t%s\n", passwd, hash);
	else if (table && reverse)
		BIO_printf(out, "%s\t%s\n", hash, passwd);
	else
		BIO_printf(out, "%s\n", hash);
	return 1;
	
err:
	return 0;
	}
#else

int MAIN(int argc, char **argv)
	{
	fputs("Program not available.\n", stderr)
	EXIT(1);
	}
#endif
Commit	Line	Data
bb325c7d BM	1	/* apps/passwd.c */
bb325c7d BM	2
3ebf0be1	3	#if defined NO_MD5 \|\| defined CHARSET_EBCDIC
1f4643a2	4	# define NO_MD5CRYPT_1
3ebf0be1 BM	5	#endif
3ebf0be1 BM	6
1f4643a2	7	#if !defined(NO_DES) \|\| !defined(NO_MD5CRYPT_1)
bb325c7d BM	8
	9	#include <assert.h>
	10	#include <string.h>
	11
	12	#include "apps.h"
	13
	14	#include <openssl/bio.h>
	15	#include <openssl/err.h>
	16	#include <openssl/evp.h>
	17	#include <openssl/rand.h>
	18
	19	#ifndef NO_DES
	20	# include <openssl/des.h>
	21	#endif
1f4643a2	22	#ifndef NO_MD5CRYPT_1
4ec19e20	23	# include <openssl/md5.h>
e6e7b5f3 BM	24	#endif
e6e7b5f3 BM	25
bb325c7d BM	26
	27	#undef PROG
	28	#define PROG passwd_main
	29
	30
	31	static unsigned const char cov_2char[64]={
	32	/* from crypto/des/fcrypt.c */
	33	0x2E,0x2F,0x30,0x31,0x32,0x33,0x34,0x35,
	34	0x36,0x37,0x38,0x39,0x41,0x42,0x43,0x44,
	35	0x45,0x46,0x47,0x48,0x49,0x4A,0x4B,0x4C,
	36	0x4D,0x4E,0x4F,0x50,0x51,0x52,0x53,0x54,
	37	0x55,0x56,0x57,0x58,0x59,0x5A,0x61,0x62,
	38	0x63,0x64,0x65,0x66,0x67,0x68,0x69,0x6A,
	39	0x6B,0x6C,0x6D,0x6E,0x6F,0x70,0x71,0x72,
	40	0x73,0x74,0x75,0x76,0x77,0x78,0x79,0x7A
	41	};
	42
e6e7b5f3 BM	43	static int do_passwd(int passed_salt, char salt_p, char salt_malloc_p,
e6e7b5f3 BM	44	char passwd, BIO out, int quiet, int table, int reverse,
1f4643a2	45	size_t pw_maxlen, int usecrypt, int use1, int useapr1);
e6e7b5f3	46
cc244b37	47	/* -crypt - standard Unix password algorithm (default)
1f4643a2 BM	48	* -1 - MD5-based password algorithm
1f4643a2 BM	49	* -apr1 - MD5-based password algorithm, Apache variant
bb325c7d	50	* -salt string - salt
e6e7b5f3 BM	51	* -in file - read passwords from file
e6e7b5f3 BM	52	* -stdin - read passwords from stdin
bb325c7d BM	53	* -quiet - no warnings
bb325c7d BM	54	* -table - format output as table
e6e7b5f3	55	* -reverse - switch table columns
bb325c7d BM	56	*/
bb325c7d BM	57
07fb39c3 RE	58	int MAIN(int, char **);
07fb39c3 RE	59
bb325c7d BM	60	int MAIN(int argc, char **argv)
	61	{
	62	int ret = 1;
e6e7b5f3 BM	63	char *infile = NULL;
	64	int in_stdin = 0;
	65	char salt = NULL, passwd = NULL, **passwds = NULL;
bb325c7d	66	char salt_malloc = NULL, passwd_malloc = NULL;
7fc840cc	67	size_t passwd_malloc_size = 0;
e6e7b5f3 BM	68	int pw_source_defined = 0;
e6e7b5f3 BM	69	BIO in = NULL, out = NULL;
bb325c7d	70	int i, badopt, opt_done;
e6e7b5f3	71	int passed_salt = 0, quiet = 0, table = 0, reverse = 0;
1f4643a2	72	int usecrypt = 0, use1 = 0, useapr1 = 0;
bb325c7d BM	73	size_t pw_maxlen = 0;
	74
	75	apps_startup();
	76
	77	if (bio_err == NULL)
	78	if ((bio_err=BIO_new(BIO_s_file())) != NULL)
	79	BIO_set_fp(bio_err,stderr,BIO_NOCLOSE\|BIO_FP_TEXT);
	80	out = BIO_new(BIO_s_file());
	81	if (out == NULL)
	82	goto err;
	83	BIO_set_fp(out, stdout, BIO_NOCLOSE \| BIO_FP_TEXT);
645749ef RL	84	#ifdef VMS
	85	{
	86	BIO *tmpbio = BIO_new(BIO_f_linebuffer());
	87	out = BIO_push(tmpbio, out);
	88	}
	89	#endif
bb325c7d BM	90
	91	badopt = 0, opt_done = 0;
	92	i = 0;
	93	while (!badopt && !opt_done && argv[++i] != NULL)
	94	{
	95	if (strcmp(argv[i], "-crypt") == 0)
efb41629	96	usecrypt = 1;
1f4643a2 BM	97	else if (strcmp(argv[i], "-1") == 0)
1f4643a2 BM	98	use1 = 1;
e6e7b5f3 BM	99	else if (strcmp(argv[i], "-apr1") == 0)
e6e7b5f3 BM	100	useapr1 = 1;
bb325c7d BM	101	else if (strcmp(argv[i], "-salt") == 0)
	102	{
	103	if ((argv[i+1] != NULL) && (salt == NULL))
	104	{
	105	passed_salt = 1;
	106	salt = argv[++i];
	107	}
e6e7b5f3 BM	108	else
	109	badopt = 1;
	110	}
	111	else if (strcmp(argv[i], "-in") == 0)
	112	{
	113	if ((argv[i+1] != NULL) && !pw_source_defined)
	114	{
	115	pw_source_defined = 1;
	116	infile = argv[++i];
	117	}
	118	else
	119	badopt = 1;
	120	}
	121	else if (strcmp(argv[i], "-stdin") == 0)
	122	{
	123	if (!pw_source_defined)
	124	{
	125	pw_source_defined = 1;
	126	in_stdin = 1;
	127	}
	128	else
	129	badopt = 1;
bb325c7d BM	130	}
	131	else if (strcmp(argv[i], "-quiet") == 0)
	132	quiet = 1;
	133	else if (strcmp(argv[i], "-table") == 0)
	134	table = 1;
e6e7b5f3 BM	135	else if (strcmp(argv[i], "-reverse") == 0)
e6e7b5f3 BM	136	reverse = 1;
bb325c7d BM	137	else if (argv[i][0] == '-')
bb325c7d BM	138	badopt = 1;
e6e7b5f3 BM	139	else if (!pw_source_defined)
e6e7b5f3 BM	140	/* non-option arguments, use as passwords */
bb325c7d	141	{
e6e7b5f3	142	pw_source_defined = 1;
bb325c7d BM	143	passwds = &argv[i];
	144	opt_done = 1;
	145	}
e6e7b5f3 BM	146	else
e6e7b5f3 BM	147	badopt = 1;
bb325c7d BM	148	}
bb325c7d BM	149
1f4643a2	150	if (!usecrypt && !use1 && !useapr1) /* use default */
efb41629	151	usecrypt = 1;
1f4643a2	152	if (usecrypt + use1 + useapr1 > 1) /* conflict */
bb325c7d BM	153	badopt = 1;
bb325c7d BM	154
e6e7b5f3 BM	155	/* reject unsupported algorithms */
	156	#ifdef NO_DES
	157	if (usecrypt) badopt = 1;
	158	#endif
1f4643a2 BM	159	#ifdef NO_MD5CRYPT_1
1f4643a2 BM	160	if (use1 \|\| useapr1) badopt = 1;
e6e7b5f3 BM	161	#endif
e6e7b5f3 BM	162
bb325c7d BM	163	if (badopt)
	164	{
	165	BIO_printf(bio_err, "Usage: passwd [options] [passwords]\n");
	166	BIO_printf(bio_err, "where options are\n");
e6e7b5f3	167	#ifndef NO_DES
bb325c7d	168	BIO_printf(bio_err, "-crypt standard Unix password algorithm (default)\n");
e6e7b5f3	169	#endif
1f4643a2 BM	170	#ifndef NO_MD5CRYPT_1
	171	BIO_printf(bio_err, "-1 MD5-based password algorithm\n");
	172	BIO_printf(bio_err, "-apr1 MD5-based password algorithm, Apache variant\n");
e6e7b5f3	173	#endif
bb325c7d	174	BIO_printf(bio_err, "-salt string use provided salt\n");
e6e7b5f3 BM	175	BIO_printf(bio_err, "-in file read passwords from file\n");
e6e7b5f3 BM	176	BIO_printf(bio_err, "-stdin read passwords from stdin\n");
bb325c7d BM	177	BIO_printf(bio_err, "-quiet no warnings\n");
bb325c7d BM	178	BIO_printf(bio_err, "-table format output as table\n");
e6e7b5f3	179	BIO_printf(bio_err, "-reverse switch table columns\n");
bb325c7d BM	180
	181	goto err;
	182	}
	183
e6e7b5f3 BM	184	if ((infile != NULL) \|\| in_stdin)
	185	{
	186	in = BIO_new(BIO_s_file());
	187	if (in == NULL)
	188	goto err;
	189	if (infile != NULL)
	190	{
	191	assert(in_stdin == 0);
	192	if (BIO_read_filename(in, infile) <= 0)
	193	goto err;
	194	}
	195	else
	196	{
	197	assert(in_stdin);
	198	BIO_set_fp(in, stdin, BIO_NOCLOSE);
	199	}
	200	}
	201
efb41629	202	if (usecrypt)
bb325c7d	203	pw_maxlen = 8;
1f4643a2	204	else if (use1 \|\| useapr1)
e6e7b5f3	205	pw_maxlen = 256; /* arbitrary limit, should be enough for most passwords */
bb325c7d BM	206
bb325c7d BM	207	if (passwds == NULL)
e6e7b5f3 BM	208	{
e6e7b5f3 BM	209	/* no passwords on the command line */
7fc840cc BM	210
7fc840cc BM	211	passwd_malloc_size = pw_maxlen + 2;
4adcfa05	212	/* longer than necessary so that we can warn about truncation */
26a3a48d	213	passwd = passwd_malloc = OPENSSL_malloc(passwd_malloc_size);
e6e7b5f3 BM	214	if (passwd_malloc == NULL)
	215	goto err;
	216	}
	217
	218	if ((in == NULL) && (passwds == NULL))
bb325c7d BM	219	{
	220	/* build a null-terminated list */
	221	static char *passwds_static[2] = {NULL, NULL};
e6e7b5f3	222
bb325c7d	223	passwds = passwds_static;
e6e7b5f3	224	if (in == NULL)
7fc840cc	225	if (EVP_read_pw_string(passwd_malloc, passwd_malloc_size, "Password: ", 0) != 0)
e6e7b5f3	226	goto err;
bb325c7d BM	227	passwds[0] = passwd_malloc;
	228	}
	229
e6e7b5f3 BM	230	if (in == NULL)
	231	{
	232	assert(passwds != NULL);
	233	assert(*passwds != NULL);
	234
	235	do /* loop over list of passwords */
	236	{
	237	passwd = *passwds++;
	238	if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, out,
1f4643a2	239	quiet, table, reverse, pw_maxlen, usecrypt, use1, useapr1))
e6e7b5f3 BM	240	goto err;
	241	}
	242	while (*passwds != NULL);
	243	}
	244	else
	245	/* in != NULL */
bb325c7d	246	{
e6e7b5f3 BM	247	int done;
	248
	249	assert (passwd != NULL);
	250	do
bb325c7d	251	{
e6e7b5f3 BM	252	int r = BIO_gets(in, passwd, pw_maxlen + 1);
e6e7b5f3 BM	253	if (r > 0)
bb325c7d	254	{
e6e7b5f3 BM	255	char *c = (strchr(passwd, '\n')) ;
	256	if (c != NULL)
	257	c = 0; / truncate at newline */
	258	else
bb325c7d	259	{
e6e7b5f3 BM	260	/* ignore rest of line */
	261	char trash[BUFSIZ];
	262	do
	263	r = BIO_gets(in, trash, sizeof trash);
	264	while ((r > 0) && (!strchr(trash, '\n')));
bb325c7d	265	}
e6e7b5f3 BM	266
e6e7b5f3 BM	267	if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, out,
1f4643a2	268	quiet, table, reverse, pw_maxlen, usecrypt, use1, useapr1))
bb325c7d	269	goto err;
bb325c7d	270	}
e6e7b5f3	271	done = (r <= 0);
bb325c7d	272	}
e6e7b5f3	273	while (!done);
bb325c7d	274	}
e6e7b5f3	275
bb325c7d BM	276	err:
	277	ERR_print_errors(bio_err);
	278	if (salt_malloc)
26a3a48d	279	OPENSSL_free(salt_malloc);
bb325c7d	280	if (passwd_malloc)
26a3a48d	281	OPENSSL_free(passwd_malloc);
e6e7b5f3 BM	282	if (in)
e6e7b5f3 BM	283	BIO_free(in);
bb325c7d	284	if (out)
645749ef	285	BIO_free_all(out);
bb325c7d BM	286	EXIT(ret);
bb325c7d BM	287	}
e6e7b5f3 BM	288
e6e7b5f3 BM	289
1f4643a2 BM	290	#ifndef NO_MD5CRYPT_1
	291	/* MD5-based password algorithm (should probably be available as a library
	292	* function; then the static buffer would not be acceptable).
	293	* For magic string "1", this should be compatible to the MD5-based BSD
	294	* password algorithm.
	295	* For 'magic' string "apr1", this is compatible to the MD5-based Apache
	296	* password algorithm.
	297	* (Apparently, the Apache password algorithm is identical except that the
	298	* 'magic' string was changed -- the laziest application of the NIH principle
	299	* I've ever encountered.)
	300	*/
	301	static char md5crypt(const char passwd, const char magic, const char salt)
e6e7b5f3 BM	302	{
	303	static char out_buf[6 + 9 + 24 + 2]; /* "$apr1$..salt..$.......md5hash..........\0" */
	304	unsigned char buf[MD5_DIGEST_LENGTH];
	305	char *salt_out;
	306	int n, i;
	307	MD5_CTX md;
	308	size_t passwd_len, salt_len;
	309
	310	passwd_len = strlen(passwd);
1f4643a2 BM	311	out_buf[0] = '$';
	312	out_buf[1] = 0;
	313	assert(strlen(magic) <= 4); /* "1" or "apr1" */
	314	strncat(out_buf, magic, 4);
	315	strncat(out_buf, "$", 1);
e6e7b5f3 BM	316	strncat(out_buf, salt, 8);
	317	assert(strlen(out_buf) <= 6 + 8); /* "$apr1$..salt.." */
	318	salt_out = out_buf + 6;
	319	salt_len = strlen(salt_out);
	320	assert(salt_len <= 8);
	321
	322	MD5_Init(&md);
	323	MD5_Update(&md, passwd, passwd_len);
1f4643a2 BM	324	MD5_Update(&md, "$", 1);
	325	MD5_Update(&md, magic, strlen(magic));
	326	MD5_Update(&md, "$", 1);
e6e7b5f3 BM	327	MD5_Update(&md, salt_out, salt_len);
	328
	329	{
	330	MD5_CTX md2;
	331
	332	MD5_Init(&md2);
	333	MD5_Update(&md2, passwd, passwd_len);
	334	MD5_Update(&md2, salt_out, salt_len);
	335	MD5_Update(&md2, passwd, passwd_len);
	336	MD5_Final(buf, &md2);
	337	}
	338	for (i = passwd_len; i > sizeof buf; i -= sizeof buf)
	339	MD5_Update(&md, buf, sizeof buf);
	340	MD5_Update(&md, buf, i);
	341
	342	n = passwd_len;
	343	while (n)
	344	{
	345	MD5_Update(&md, (n & 1) ? "\0" : passwd, 1);
	346	n >>= 1;
	347	}
	348	MD5_Final(buf, &md);
	349
	350	for (i = 0; i < 1000; i++)
	351	{
	352	MD5_CTX md2;
	353
	354	MD5_Init(&md2);
4ec19e20	355	MD5_Update(&md2, (i & 1) ? (unsigned char *) passwd : buf,
73c55919	356	(i & 1) ? passwd_len : sizeof buf);
e6e7b5f3 BM	357	if (i % 3)
	358	MD5_Update(&md2, salt_out, salt_len);
	359	if (i % 7)
	360	MD5_Update(&md2, passwd, passwd_len);
4ec19e20	361	MD5_Update(&md2, (i & 1) ? buf : (unsigned char *) passwd,
e6e7b5f3 BM	362	(i & 1) ? sizeof buf : passwd_len);
	363	MD5_Final(buf, &md2);
	364	}
	365
	366	{
	367	/* transform buf into output string */
	368
	369	unsigned char buf_perm[sizeof buf];
	370	int dest, source;
	371	char *output;
	372
	373	/* silly output permutation */
	374	for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
	375	buf_perm[dest] = buf[source];
	376	buf_perm[14] = buf[5];
	377	buf_perm[15] = buf[11];
bd445703	378	#ifndef PEDANTIC /* Unfortunately, this generates a "no effect" warning */
e6e7b5f3	379	assert(16 == sizeof buf_perm);
bd445703	380	#endif
e6e7b5f3 BM	381
	382	output = salt_out + salt_len;
	383	assert(output == out_buf + strlen(out_buf));
	384
	385	*output++ = '$';
	386
	387	for (i = 0; i < 15; i += 3)
	388	{
	389	*output++ = cov_2char[buf_perm[i+2] & 0x3f];
	390	*output++ = cov_2char[((buf_perm[i+1] & 0xf) << 2) \|
	391	(buf_perm[i+2] >> 6)];
	392	*output++ = cov_2char[((buf_perm[i] & 3) << 4) \|
	393	(buf_perm[i+1] >> 4)];
	394	*output++ = cov_2char[buf_perm[i] >> 2];
	395	}
	396	assert(i == 15);
	397	*output++ = cov_2char[buf_perm[i] & 0x3f];
	398	*output++ = cov_2char[buf_perm[i] >> 6];
	399	*output = 0;
	400	assert(strlen(out_buf) < sizeof(out_buf));
	401	}
	402
	403	return out_buf;
	404	}
bb325c7d	405	#endif
e6e7b5f3 BM	406
	407
	408	static int do_passwd(int passed_salt, char salt_p, char salt_malloc_p,
	409	char passwd, BIO out, int quiet, int table, int reverse,
1f4643a2	410	size_t pw_maxlen, int usecrypt, int use1, int useapr1)
e6e7b5f3 BM	411	{
	412	char *hash = NULL;
	413
	414	assert(salt_p != NULL);
	415	assert(salt_malloc_p != NULL);
	416
	417	/* first make sure we have a salt */
	418	if (!passed_salt)
	419	{
	420	#ifndef NO_DES
	421	if (usecrypt)
	422	{
	423	if (*salt_malloc_p == NULL)
	424	{
26a3a48d	425	salt_p = salt_malloc_p = OPENSSL_malloc(3);
e6e7b5f3 BM	426	if (*salt_malloc_p == NULL)
	427	goto err;
	428	}
	429	if (RAND_pseudo_bytes((unsigned char )salt_p, 2) < 0)
	430	goto err;
	431	(salt_p)[0] = cov_2char[(salt_p)[0] & 0x3f]; /* 6 bits */
	432	(salt_p)[1] = cov_2char[(salt_p)[1] & 0x3f]; /* 6 bits */
	433	(*salt_p)[2] = 0;
	434	#ifdef CHARSET_EBCDIC
	435	ascii2ebcdic(salt_p, salt_p, 2); /* des_crypt will convert
	436	* back to ASCII */
	437	#endif
	438	}
	439	#endif /* !NO_DES */
	440
1f4643a2 BM	441	#ifndef NO_MD5CRYPT_1
1f4643a2 BM	442	if (use1 \|\| useapr1)
e6e7b5f3 BM	443	{
	444	int i;
	445
	446	if (*salt_malloc_p == NULL)
	447	{
26a3a48d	448	salt_p = salt_malloc_p = OPENSSL_malloc(9);
e6e7b5f3 BM	449	if (*salt_malloc_p == NULL)
	450	goto err;
	451	}
	452	if (RAND_pseudo_bytes((unsigned char )salt_p, 8) < 0)
	453	goto err;
	454
	455	for (i = 0; i < 8; i++)
	456	(salt_p)[i] = cov_2char[(salt_p)[i] & 0x3f]; /* 6 bits */
	457	(*salt_p)[8] = 0;
	458	}
1f4643a2	459	#endif /* !NO_MD5CRYPT_1 */
e6e7b5f3 BM	460	}
	461
	462	assert(*salt_p != NULL);
	463
	464	/* truncate password if necessary */
	465	if ((strlen(passwd) > pw_maxlen))
	466	{
	467	if (!quiet)
	468	BIO_printf(bio_err, "Warning: truncating password to %u characters\n", pw_maxlen);
	469	passwd[pw_maxlen] = 0;
	470	}
	471	assert(strlen(passwd) <= pw_maxlen);
	472
	473	/* now compute password hash */
	474	#ifndef NO_DES
	475	if (usecrypt)
	476	hash = des_crypt(passwd, *salt_p);
	477	#endif
1f4643a2 BM	478	#ifndef NO_MD5CRYPT_1
	479	if (use1 \|\| useapr1)
	480	hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p);
e6e7b5f3 BM	481	#endif
	482	assert(hash != NULL);
	483
	484	if (table && !reverse)
	485	BIO_printf(out, "%s\t%s\n", passwd, hash);
	486	else if (table && reverse)
	487	BIO_printf(out, "%s\t%s\n", hash, passwd);
	488	else
	489	BIO_printf(out, "%s\n", hash);
	490	return 1;
	491
	492	err:
	493	return 0;
	494	}
3ebf0be1	495	#else
e6e7b5f3	496
3ebf0be1 BM	497	int MAIN(int argc, char **argv)
	498	{
	499	fputs("Program not available.\n", stderr)
	500	EXIT(1);
	501	}
	502	#endif