Bugzilla – Attachment 17204 Details for
Bug 9611
Changing the password hashing algorithm from MD5 to more secure Bcrypt
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Removing external dependency for password salting
0006-bug-9611-removing-external-dependency-for-password-s.patch (text/plain), 4.05 KB, created by
Chris Hall
on 2013-04-05 05:09:22 UTC
(
hide
)
Description:
Removing external dependency for password salting
Filename:
MIME Type:
Creator:
Chris Hall
Created:
2013-04-05 05:09:22 UTC
Size:
4.05 KB
patch
obsolete
>From e696f63de4e736561856e081961a12f6aa3357af Mon Sep 17 00:00:00 2001 >From: Chris Hall <chrish@catalyst.net.nz> >Date: Thu, 28 Mar 2013 14:25:30 +1300 >Subject: [PATCH 6/6] bug 9611 removing external dependency for password salt > generator > >--- > C4/Auth.pm | 76 ++++++++++++++++++++++++++++++++++---- > C4/Installer/PerlDependencies.pm | 7 +--- > 2 files changed, 69 insertions(+), 14 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 9c7dfc8..fed6563 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -24,7 +24,7 @@ use Storable qw(thaw freeze); > use URI::Escape; > use CGI::Session; > use Crypt::Eksblowfish::Bcrypt qw(bcrypt en_base64); >-use Crypt::Random::Source; >+use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt > > require Exporter; > use C4::Context; >@@ -1477,23 +1477,83 @@ sub hash_password { > my $settings = shift; > unless( defined $settings ){ # if there are no settings, we need to create a salt and append settings > # Set the cost to 8 and append a NULL >- $settings = '$2a$08$'.en_base64(generate_salt('strong')); >+ $settings = '$2a$08$'.en_base64(generate_salt('weak', 16)); > } > # Encrypt it > return bcrypt($password, $settings); > } > >-# Return a random salt >+=head2 generate_salt >+ >+ use C4::Auth; >+ my $salt = C4::Auth::generate_salt($strength, $length); >+ >+=item strength >+ >+For general password salting a C<$strength> of C<weak> is recommend, >+For generating a server-salt a C<$strength> of C<strong> is recommended >+ >+'strong' uses /dev/random which may block until sufficient entropy is acheived. >+'weak' uses /dev/urandom and is non-blocking. >+ >+=back >+ >+=item length >+ >+C<$length> is a positive integer which specifies the desired length of the returned string >+ >+=back >+ >+=cut >+ >+ >+# the implementation of generate_salt is loosely based on Crypt::Random::Provider::File > sub generate_salt { >- my ($type) = @_; >+ # strength is 'strong' or 'weak' >+ # length is number of bytes to read, positive integer >+ my ($strength, $length) = @_; > >- if ($type eq 'strong') { >- return Crypt::Random::Source::get_strong(16); >- } else { >- return Crypt::Random::Source::get_weak(16); >+ my $source; >+ >+ if( $length < 1 ){ >+ die "non-positive strength of '$strength' passed to C4::Auth::generate_salt\n"; >+ } >+ >+ if( $strength eq "strong" ){ >+ $source = '/dev/random'; # blocking >+ } else { >+ unless( $strength eq 'weak' ){ >+ warn "unsuppored strength of '$strength' passed to C4::Auth::generate_salt, defaulting to 'weak'\n"; >+ } >+ $source = '/dev/urandom'; # non-blocking >+ } >+ >+ sysopen SOURCE, $source, O_RDONLY >+ or die "failed to open source '$source' in C4::Auth::generate_salt\n"; >+ >+ # $bytes is the bytes just read >+ # $string is the concatenation of all the bytes read so far >+ my( $bytes, $string ) = ("", ""); >+ >+ # keep reading until we have $length bytes in $strength >+ while( length($string) < $length ){ >+ # return the number of bytes read, 0 (EOF), or -1 (ERROR) >+ my $return = sysread SOURCE, $bytes, $length - length($string); >+ >+ # if no bytes were read, keep reading (if using /dev/random it is possible there was insufficient entropy so this may block) >+ next unless $return; >+ if( $return == -1 ){ >+ die "error while reading from $source in C4::Auth::generate_salt\n"; > } >+ >+ $string .= $bytes; >+ } >+ >+ close SOURCE; >+ return $string; > } > >+ > sub checkpw { > > my ( $dbh, $userid, $password, $query ) = @_; >diff --git a/C4/Installer/PerlDependencies.pm b/C4/Installer/PerlDependencies.pm >index 47e138e..7ebd318 100644 >--- a/C4/Installer/PerlDependencies.pm >+++ b/C4/Installer/PerlDependencies.pm >@@ -683,12 +683,7 @@ our $PERL_DEPS = { > 'usage' => 'Password storage', > 'required' => '1', > 'min_ver' => '0.008', >- }, >- 'Crypt::Random::Source' => { >- 'usage' => 'Password storage', >- 'required' => '1', >- 'min_ver' => '0.07', >- }, >+ }, > }; > > 1; >-- >1.7.10.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9611
:
15311
|
15427
|
15428
|
15429
|
15505
|
15506
|
15507
|
15508
|
15509
|
15510
|
15514
|
15515
|
15516
|
15517
|
15518
|
15519
|
15520
|
15521
|
15522
|
17203
|
17204
|
20252
|
20253
|
20254
|
20255
|
20576
|
20577
|
20578
|
20621
|
20622
|
20623
|
20624
|
21614
|
21615
|
21621
|
21622
|
21623
|
21624
|
21625
|
21626
|
21627
|
21628
|
21767
|
21768
|
21769
|
21770
|
21771
|
21772
|
21775
|
21776
|
21777
|
21789
|
21790
|
21791
|
21792
|
21793
|
21794
|
21795
|
21796