[IMP] auth_crypt: port to passlib instead of using embedded/hand-rolled md5crypt
This commit is contained in:
parent
81c174b740
commit
cf41752470
|
@ -1,127 +1,20 @@
|
||||||
#
|
|
||||||
# Implements encrypting functions.
|
|
||||||
#
|
|
||||||
# Copyright (c) 2008, F S 3 Consulting Inc.
|
|
||||||
#
|
|
||||||
# Maintainer:
|
|
||||||
# Alec Joseph Rivera (agi<at>fs3.ph)
|
|
||||||
# refactored by Antony Lesuisse <al<at>openerp.com>
|
|
||||||
#
|
|
||||||
|
|
||||||
import hashlib
|
|
||||||
import hmac
|
|
||||||
import logging
|
import logging
|
||||||
from random import sample
|
|
||||||
from string import ascii_letters, digits
|
from passlib.hash import md5_crypt
|
||||||
|
|
||||||
import openerp
|
import openerp
|
||||||
from openerp.osv import fields, osv
|
from openerp.osv import fields, osv
|
||||||
|
|
||||||
_logger = logging.getLogger(__name__)
|
_logger = logging.getLogger(__name__)
|
||||||
|
|
||||||
magic_md5 = '$1$'
|
|
||||||
magic_sha256 = '$5$'
|
|
||||||
|
|
||||||
def gen_salt(length=8, symbols=None):
|
|
||||||
if symbols is None:
|
|
||||||
symbols = ascii_letters + digits
|
|
||||||
return ''.join(sample(symbols, length))
|
|
||||||
|
|
||||||
def md5crypt( raw_pw, salt, magic=magic_md5 ):
|
|
||||||
""" md5crypt FreeBSD crypt(3) based on but different from md5
|
|
||||||
|
|
||||||
The md5crypt is based on Mark Johnson's md5crypt.py, which in turn is
|
|
||||||
based on FreeBSD src/lib/libcrypt/crypt.c (1.2) by Poul-Henning Kamp.
|
|
||||||
Mark's port can be found in ActiveState ASPN Python Cookbook. Kudos to
|
|
||||||
Poul and Mark. -agi
|
|
||||||
|
|
||||||
Original license:
|
|
||||||
|
|
||||||
* "THE BEER-WARE LICENSE" (Revision 42):
|
|
||||||
*
|
|
||||||
* <phk@login.dknet.dk> wrote this file. As long as you retain this
|
|
||||||
* notice you can do whatever you want with this stuff. If we meet some
|
|
||||||
* day, and you think this stuff is worth it, you can buy me a beer in
|
|
||||||
* return.
|
|
||||||
*
|
|
||||||
* Poul-Henning Kamp
|
|
||||||
"""
|
|
||||||
raw_pw = raw_pw.encode('utf-8')
|
|
||||||
salt = salt.encode('utf-8')
|
|
||||||
hash = hashlib.md5()
|
|
||||||
hash.update( raw_pw + magic + salt )
|
|
||||||
st = hashlib.md5()
|
|
||||||
st.update( raw_pw + salt + raw_pw)
|
|
||||||
stretch = st.digest()
|
|
||||||
|
|
||||||
for i in range( 0, len( raw_pw ) ):
|
|
||||||
hash.update( stretch[i % 16] )
|
|
||||||
|
|
||||||
i = len( raw_pw )
|
|
||||||
|
|
||||||
while i:
|
|
||||||
if i & 1:
|
|
||||||
hash.update('\x00')
|
|
||||||
else:
|
|
||||||
hash.update( raw_pw[0] )
|
|
||||||
i >>= 1
|
|
||||||
|
|
||||||
saltedmd5 = hash.digest()
|
|
||||||
|
|
||||||
for i in range( 1000 ):
|
|
||||||
hash = hashlib.md5()
|
|
||||||
|
|
||||||
if i & 1:
|
|
||||||
hash.update( raw_pw )
|
|
||||||
else:
|
|
||||||
hash.update( saltedmd5 )
|
|
||||||
|
|
||||||
if i % 3:
|
|
||||||
hash.update( salt )
|
|
||||||
if i % 7:
|
|
||||||
hash.update( raw_pw )
|
|
||||||
if i & 1:
|
|
||||||
hash.update( saltedmd5 )
|
|
||||||
else:
|
|
||||||
hash.update( raw_pw )
|
|
||||||
|
|
||||||
saltedmd5 = hash.digest()
|
|
||||||
|
|
||||||
itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
|
|
||||||
|
|
||||||
rearranged = ''
|
|
||||||
for a, b, c in ((0, 6, 12), (1, 7, 13), (2, 8, 14), (3, 9, 15), (4, 10, 5)):
|
|
||||||
v = ord( saltedmd5[a] ) << 16 | ord( saltedmd5[b] ) << 8 | ord( saltedmd5[c] )
|
|
||||||
|
|
||||||
for i in range(4):
|
|
||||||
rearranged += itoa64[v & 0x3f]
|
|
||||||
v >>= 6
|
|
||||||
|
|
||||||
v = ord( saltedmd5[11] )
|
|
||||||
|
|
||||||
for i in range( 2 ):
|
|
||||||
rearranged += itoa64[v & 0x3f]
|
|
||||||
v >>= 6
|
|
||||||
|
|
||||||
return magic + salt + '$' + rearranged
|
|
||||||
|
|
||||||
def sh256crypt(cls, password, salt, magic=magic_sha256):
|
|
||||||
iterations = 1000
|
|
||||||
# see http://en.wikipedia.org/wiki/PBKDF2
|
|
||||||
result = password.encode('utf8')
|
|
||||||
for i in xrange(cls.iterations):
|
|
||||||
result = hmac.HMAC(result, salt, hashlib.sha256).digest() # uses HMAC (RFC 2104) to apply salt
|
|
||||||
result = result.encode('base64') # doesnt seem to be crypt(3) compatible
|
|
||||||
return '%s%s$%s' % (magic_sha256, salt, result)
|
|
||||||
|
|
||||||
class res_users(osv.osv):
|
class res_users(osv.osv):
|
||||||
_inherit = "res.users"
|
_inherit = "res.users"
|
||||||
|
|
||||||
def set_pw(self, cr, uid, id, name, value, args, context):
|
def set_pw(self, cr, uid, id, name, value, args, context):
|
||||||
if value:
|
if value:
|
||||||
encrypted = md5crypt(value, gen_salt())
|
encrypted = md5_crypt.encrypt(value)
|
||||||
cr.execute("update res_users set password='', password_crypt=%s where id=%s", (encrypted, id))
|
cr.execute("update res_users set password='', password_crypt=%s where id=%s", (encrypted, id))
|
||||||
del value
|
|
||||||
|
|
||||||
def get_pw( self, cr, uid, ids, name, args, context ):
|
def get_pw( self, cr, uid, ids, name, args, context ):
|
||||||
cr.execute('select id, password from res_users where id in %s', (tuple(map(int, ids)),))
|
cr.execute('select id, password from res_users where id in %s', (tuple(map(int, ids)),))
|
||||||
|
@ -141,25 +34,19 @@ class res_users(osv.osv):
|
||||||
def check_credentials(self, cr, uid, password):
|
def check_credentials(self, cr, uid, password):
|
||||||
# convert to base_crypt if needed
|
# convert to base_crypt if needed
|
||||||
cr.execute('SELECT password, password_crypt FROM res_users WHERE id=%s AND active', (uid,))
|
cr.execute('SELECT password, password_crypt FROM res_users WHERE id=%s AND active', (uid,))
|
||||||
|
stored_password_crypt = None
|
||||||
if cr.rowcount:
|
if cr.rowcount:
|
||||||
stored_password, stored_password_crypt = cr.fetchone()
|
stored_password, stored_password_crypt = cr.fetchone()
|
||||||
if stored_password and not stored_password_crypt:
|
if stored_password and not stored_password_crypt:
|
||||||
salt = gen_salt()
|
stored_password_crypt = md5_crypt.encrypt(stored_password)
|
||||||
stored_password_crypt = md5crypt(stored_password, salt)
|
|
||||||
cr.execute("UPDATE res_users SET password='', password_crypt=%s WHERE id=%s", (stored_password_crypt, uid))
|
cr.execute("UPDATE res_users SET password='', password_crypt=%s WHERE id=%s", (stored_password_crypt, uid))
|
||||||
try:
|
try:
|
||||||
return super(res_users, self).check_credentials(cr, uid, password)
|
return super(res_users, self).check_credentials(cr, uid, password)
|
||||||
except openerp.exceptions.AccessDenied:
|
except openerp.exceptions.AccessDenied:
|
||||||
# check md5crypt
|
# check md5crypt
|
||||||
if stored_password_crypt:
|
if stored_password_crypt:
|
||||||
if stored_password_crypt[:len(magic_md5)] == magic_md5:
|
if md5_crypt.verify(password, stored_password_crypt):
|
||||||
salt = stored_password_crypt[len(magic_md5):11]
|
return
|
||||||
if stored_password_crypt == md5crypt(password, salt):
|
|
||||||
return
|
|
||||||
elif stored_password_crypt[:len(magic_md5)] == magic_sha256:
|
|
||||||
salt = stored_password_crypt[len(magic_md5):11]
|
|
||||||
if stored_password_crypt == md5crypt(password, salt):
|
|
||||||
return
|
|
||||||
# Reraise password incorrect
|
# Reraise password incorrect
|
||||||
raise
|
raise
|
||||||
|
|
||||||
|
|
2
setup.py
2
setup.py
|
@ -95,6 +95,7 @@ def py2exe_options():
|
||||||
"markupsafe", # dependence of jinja2 and mako
|
"markupsafe", # dependence of jinja2 and mako
|
||||||
"mock",
|
"mock",
|
||||||
"openerp",
|
"openerp",
|
||||||
|
"passlib",
|
||||||
"poplib",
|
"poplib",
|
||||||
"psutil",
|
"psutil",
|
||||||
"pychart",
|
"pychart",
|
||||||
|
@ -163,6 +164,7 @@ setuptools.setup(
|
||||||
'lxml', # windows binary http://www.lfd.uci.edu/~gohlke/pythonlibs/
|
'lxml', # windows binary http://www.lfd.uci.edu/~gohlke/pythonlibs/
|
||||||
'mako',
|
'mako',
|
||||||
'mock',
|
'mock',
|
||||||
|
'passlib',
|
||||||
'pillow', # windows binary http://www.lfd.uci.edu/~gohlke/pythonlibs/
|
'pillow', # windows binary http://www.lfd.uci.edu/~gohlke/pythonlibs/
|
||||||
'psutil', # windows binary code.google.com/p/psutil/downloads/list
|
'psutil', # windows binary code.google.com/p/psutil/downloads/list
|
||||||
'psycopg2 >= 2.2',
|
'psycopg2 >= 2.2',
|
||||||
|
|
|
@ -28,6 +28,7 @@ Depends:
|
||||||
python-mako,
|
python-mako,
|
||||||
python-mock,
|
python-mock,
|
||||||
python-openid,
|
python-openid,
|
||||||
|
python-passlib,
|
||||||
python-psutil,
|
python-psutil,
|
||||||
python-psycopg2,
|
python-psycopg2,
|
||||||
python-pybabel,
|
python-pybabel,
|
||||||
|
|
Loading…
Reference in New Issue