View | Details | Raw Unified | Return to bug 9611
Collapse All | Expand All

(-)a/C4/Auth.pm (-8 / +68 lines)
Lines 24-30 use Storable qw(thaw freeze); Link Here
24
use URI::Escape;
24
use URI::Escape;
25
use CGI::Session;
25
use CGI::Session;
26
use Crypt::Eksblowfish::Bcrypt qw(bcrypt en_base64);
26
use Crypt::Eksblowfish::Bcrypt qw(bcrypt en_base64);
27
use Crypt::Random::Source;
27
use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt
28
28
29
require Exporter;
29
require Exporter;
30
use C4::Context;
30
use C4::Context;
Lines 1477-1499 sub hash_password { Link Here
1477
    my $settings = shift;
1477
    my $settings = shift;
1478
    unless( defined $settings ){ # if there are no settings, we need to create a salt and append settings
1478
    unless( defined $settings ){ # if there are no settings, we need to create a salt and append settings
1479
    # Set the cost to 8 and append a NULL
1479
    # Set the cost to 8 and append a NULL
1480
      $settings = '$2a$08$'.en_base64(generate_salt('strong'));
1480
      $settings = '$2a$08$'.en_base64(generate_salt('weak', 16));
1481
    }
1481
    }
1482
    # Encrypt it
1482
    # Encrypt it
1483
    return bcrypt($password, $settings);
1483
    return bcrypt($password, $settings);
1484
}
1484
}
1485
1485
1486
# Return a random salt
1486
=head2 generate_salt
1487
1488
    use C4::Auth;
1489
    my $salt = C4::Auth::generate_salt($strength, $length);
1490
1491
=item strength
1492
1493
For general password salting a C<$strength> of C<weak> is recommend,
1494
For generating a server-salt a C<$strength> of C<strong> is recommended
1495
1496
'strong' uses /dev/random which may block until sufficient entropy is acheived.
1497
'weak' uses /dev/urandom and is non-blocking.
1498
1499
=back
1500
1501
=item length
1502
1503
C<$length> is a positive integer which specifies the desired length of the returned string
1504
1505
=back
1506
1507
=cut
1508
1509
1510
# the implementation of generate_salt is loosely based on Crypt::Random::Provider::File
1487
sub generate_salt {
1511
sub generate_salt {
1488
    my ($type) = @_;
1512
    # strength is 'strong' or 'weak'
1513
    # length is number of bytes to read, positive integer
1514
    my ($strength, $length) = @_;
1489
1515
1490
        if ($type eq 'strong') {
1516
    my $source;
1491
                return Crypt::Random::Source::get_strong(16);
1517
1492
        } else {
1518
    if( $length < 1 ){
1493
                return Crypt::Random::Source::get_weak(16);
1519
        die "non-positive strength of '$strength' passed to C4::Auth::generate_salt\n";
1520
    }
1521
1522
    if( $strength eq "strong" ){
1523
        $source = '/dev/random'; # blocking
1524
    } else {
1525
        unless( $strength eq 'weak' ){
1526
            warn "unsuppored strength of '$strength' passed to C4::Auth::generate_salt, defaulting to 'weak'\n";
1527
        }
1528
        $source = '/dev/urandom'; # non-blocking
1529
    }
1530
1531
    sysopen SOURCE, $source, O_RDONLY
1532
        or die "failed to open source '$source' in C4::Auth::generate_salt\n";
1533
1534
    # $bytes is the bytes just read
1535
    # $string is the concatenation of all the bytes read so far
1536
    my( $bytes, $string ) = ("", "");
1537
1538
    # keep reading until we have $length bytes in $strength
1539
    while( length($string) < $length ){
1540
        # return the number of bytes read, 0 (EOF), or -1 (ERROR)
1541
        my $return = sysread SOURCE, $bytes, $length - length($string);
1542
1543
        # if no bytes were read, keep reading (if using /dev/random it is possible there was insufficient entropy so this may block)
1544
        next unless $return;
1545
        if( $return == -1 ){
1546
            die "error while reading from $source in C4::Auth::generate_salt\n";
1494
        }
1547
        }
1548
1549
        $string .= $bytes;
1550
    }
1551
1552
    close SOURCE;
1553
    return $string;
1495
}
1554
}
1496
1555
1556
1497
sub checkpw {
1557
sub checkpw {
1498
1558
1499
    my ( $dbh, $userid, $password, $query ) = @_;
1559
    my ( $dbh, $userid, $password, $query ) = @_;
(-)a/C4/Installer/PerlDependencies.pm (-7 / +1 lines)
Lines 683-694 our $PERL_DEPS = { Link Here
683
        'usage'    => 'Password storage',
683
        'usage'    => 'Password storage',
684
        'required' => '1',
684
        'required' => '1',
685
        'min_ver'  => '0.008',
685
        'min_ver'  => '0.008',
686
      },
686
    },
687
      'Crypt::Random::Source' => {
688
        'usage'    => 'Password storage',
689
        'required' => '1',
690
        'min_ver'  => '0.07',
691
      },
692
};
687
};
693
688
694
1;
689
1;
695
- 

Return to bug 9611