1 /* Blerg is (C) 2011 The Dominion of Awesome, and is distributed under a
2 * BSD-style license. Please see the COPYING file for details.
10 #include <crypto_scrypt.h>
12 #include "configuration.h"
17 int auth_set_password(const char *username, const char *password) {
18 char filename[FILENAME_MAX];
19 unsigned char pwhash[SCRYPT_OUTPUT_SIZE];
20 unsigned char salt[SCRYPT_SALT_SIZE];
23 if (!valid_name(username) || !blerg_exists(username))
27 if (n > MAX_PASSWORD_LENGTH)
30 /* Gather some salt */
31 fd = open("/dev/urandom", O_RDONLY);
33 perror("Could not open /dev/urandom\n");
36 read(fd, salt, SCRYPT_SALT_SIZE);
39 r = crypto_scrypt(password, n, salt, SCRYPT_SALT_SIZE, SCRYPT_N, SCRYPT_r, SCRYPT_p, pwhash, SCRYPT_OUTPUT_SIZE);
41 fprintf(stderr, "Failure in scrypt for %s\n", username);
45 /* Write the password */
46 snprintf(filename, FILENAME_MAX, "%s/%s/password", blergconf.data_path, username);
47 fd = open(filename, O_WRONLY | O_CREAT, 0600);
48 write(fd, pwhash, SCRYPT_OUTPUT_SIZE);
52 snprintf(filename, FILENAME_MAX, "%s/%s/password_salt", blergconf.data_path, username);
53 fd = open(filename, O_WRONLY | O_CREAT, 0600);
54 write(fd, salt, SCRYPT_SALT_SIZE);
57 /* Mark this as a version 1 password */
58 snprintf(filename, FILENAME_MAX, "%s/%s/password_version", blergconf.data_path, username);
59 fd = open(filename, O_WRONLY | O_CREAT, 0600);
66 int auth_get_password_version(const char *username) {
67 char filename[FILENAME_MAX];
72 snprintf(filename, FILENAME_MAX, "%s/%s/password_version", blergconf.data_path, username);
73 if (access(filename, F_OK) != 0) {
77 fd = open(filename, O_RDONLY);
78 len = read(fd, str, 4);
81 /* strtol returns zero if there isn't a number */
82 return strtol(str, NULL, 10);
85 int auth_get_password(const char *username, char *password) {
86 char filename[FILENAME_MAX];
90 if (!valid_name(username))
93 snprintf(filename, FILENAME_MAX, "%s/%s/password", blergconf.data_path, username);
94 fd = open(filename, O_RDONLY);
97 switch(auth_get_password_version(username)) {
99 len = read(fd, password, MD5_DIGEST_SIZE);
102 len = read(fd, password, SCRYPT_OUTPUT_SIZE);
112 int auth_get_salt(const char *username, char *salt) {
113 char filename[FILENAME_MAX];
116 if (!valid_name(username))
119 snprintf(filename, FILENAME_MAX, "%s/%s/password_salt", blergconf.data_path, username);
120 fd = open(filename, O_RDONLY);
123 len = read(fd, salt, SCRYPT_SALT_SIZE);
129 int auth_check_password_v0(const char *username, const char *password) {
130 char epw[MD5_DIGEST_SIZE + 1];
131 unsigned char givenpw[MD5_DIGEST_SIZE];
132 struct MD5Context ctx;
134 if (auth_get_password(username, epw) == 0)
138 MD5Update(&ctx, username, strlen(username));
139 MD5Update(&ctx, password, strlen(password));
140 MD5Final(givenpw, &ctx);
142 if (strncmp(givenpw, epw, MD5_DIGEST_SIZE) == 0)
148 int auth_check_password_v1(const char *username, const char *password) {
149 unsigned char epw[SCRYPT_OUTPUT_SIZE];
150 unsigned char esalt[SCRYPT_SALT_SIZE];
151 unsigned char givenpw[SCRYPT_OUTPUT_SIZE];
154 if (auth_get_password(username, epw) == 0)
157 if (auth_get_salt(username, esalt) == 0)
160 r = crypto_scrypt(password, strlen(password), esalt, SCRYPT_SALT_SIZE, SCRYPT_N, SCRYPT_r, SCRYPT_p, givenpw, SCRYPT_OUTPUT_SIZE);
162 fprintf(stderr, "Failure in scrypt for %s\n", username);
166 if (memcmp(givenpw, epw, SCRYPT_OUTPUT_SIZE) == 0)
172 int auth_check_password(const char *username, const char *password) {
173 int version = auth_get_password_version(username);
177 if (auth_check_password_v0(username, password)) {
178 /* Refresh to the newest version */
179 auth_set_password(username, password);
186 return auth_check_password_v1(username, password);
190 void hexify(char *dst, char *src, int len) {
191 static char hex[] = "0123456789abcdef";
194 for (i = 0; i < len; i++) {
195 dst[i * 2] = hex[(src[i] & 0xF0) >> 4];
196 dst[i * 2 + 1] = hex[src[i] & 0xF];
200 char *create_random_token() {
201 unsigned char buf[TOKEN_SIZE];
205 rand_fd = open("/dev/urandom", O_RDONLY);
207 perror("Could not open /dev/urandom\n");
210 read(rand_fd, buf, TOKEN_SIZE);
213 token = malloc(TOKEN_SIZE * 2 + 1);
214 hexify(token, buf, TOKEN_SIZE);
215 token[TOKEN_SIZE * 2] = 0;
220 char * auth_login(const char *username, const char *password) {
221 char filename[FILENAME_MAX];
224 if (!auth_check_password(username, password))
227 char *token = create_random_token();
229 snprintf(filename, FILENAME_MAX, "%s/%s/tokens", blergconf.data_path, username);
230 if (access(filename, F_OK) != 0) {
231 if (mkdir(filename, 0700) == -1) {
232 perror("Could not create auth token dir");
237 snprintf(filename, FILENAME_MAX, "%s/%s/tokens/%s", blergconf.data_path, username, token);
238 token_fd = open(filename, O_WRONLY | O_CREAT, 0600);
239 if (token_fd == -1) {
240 perror("Could not open token");
248 int auth_logout(const char *username, const char *token) {
249 char filename[FILENAME_MAX];
251 if (!valid_name(username))
254 snprintf(filename, FILENAME_MAX, "%s/%s/tokens", blergconf.data_path, username);
255 if (access(filename, F_OK) != 0) {
259 snprintf(filename, FILENAME_MAX, "%s/%s/tokens/%s", blergconf.data_path, username, token);
260 if (unlink(filename) == -1)
266 int auth_check_token(const char *username, const char *given_token) {
267 char filename[FILENAME_MAX];
269 snprintf(filename, FILENAME_MAX, "%s/%s/tokens/%s", blergconf.data_path, username, given_token);
271 return (access(filename, F_OK) == 0);