xref: /PHP-8.0/ext/standard/password.c (revision b0d4d6eb)
1 /*
2    +----------------------------------------------------------------------+
3    | Copyright (c) The PHP Group                                          |
4    +----------------------------------------------------------------------+
5    | This source file is subject to version 3.01 of the PHP license,      |
6    | that is bundled with this package in the file LICENSE, and is        |
7    | available through the world-wide-web at the following url:           |
8    | http://www.php.net/license/3_01.txt                                  |
9    | If you did not receive a copy of the PHP license and are unable to   |
10    | obtain it through the world-wide-web, please send a note to          |
11    | license@php.net so we can mail you a copy immediately.               |
12    +----------------------------------------------------------------------+
13    | Authors: Anthony Ferrara <ircmaxell@php.net>                         |
14    |          Charles R. Portwood II <charlesportwoodii@erianna.com>      |
15    +----------------------------------------------------------------------+
16 */
17 
18 #include <stdlib.h>
19 
20 #include "php.h"
21 
22 #include "fcntl.h"
23 #include "php_password.h"
24 #include "php_rand.h"
25 #include "php_crypt.h"
26 #include "base64.h"
27 #include "zend_interfaces.h"
28 #include "info.h"
29 #include "php_random.h"
30 #if HAVE_ARGON2LIB
31 #include "argon2.h"
32 #endif
33 
34 #ifdef PHP_WIN32
35 #include "win32/winutil.h"
36 #endif
37 
38 static zend_array php_password_algos;
39 
php_password_algo_register(const char * ident,const php_password_algo * algo)40 int php_password_algo_register(const char *ident, const php_password_algo *algo) {
41 	zend_string *key = zend_string_init_interned(ident, strlen(ident), 1);
42 	return zend_hash_add_ptr(&php_password_algos, key, (void *) algo) ? SUCCESS : FAILURE;
43 }
44 
php_password_algo_unregister(const char * ident)45 void php_password_algo_unregister(const char *ident) {
46 	zend_hash_str_del(&php_password_algos, ident, strlen(ident));
47 }
48 
php_password_salt_to64(const char * str,const size_t str_len,const size_t out_len,char * ret)49 static int php_password_salt_to64(const char *str, const size_t str_len, const size_t out_len, char *ret) /* {{{ */
50 {
51 	size_t pos = 0;
52 	zend_string *buffer;
53 	if ((int) str_len < 0) {
54 		return FAILURE;
55 	}
56 	buffer = php_base64_encode((unsigned char*) str, str_len);
57 	if (ZSTR_LEN(buffer) < out_len) {
58 		/* Too short of an encoded string generated */
59 		zend_string_release_ex(buffer, 0);
60 		return FAILURE;
61 	}
62 	for (pos = 0; pos < out_len; pos++) {
63 		if (ZSTR_VAL(buffer)[pos] == '+') {
64 			ret[pos] = '.';
65 		} else if (ZSTR_VAL(buffer)[pos] == '=') {
66 			zend_string_free(buffer);
67 			return FAILURE;
68 		} else {
69 			ret[pos] = ZSTR_VAL(buffer)[pos];
70 		}
71 	}
72 	zend_string_free(buffer);
73 	return SUCCESS;
74 }
75 /* }}} */
76 
php_password_make_salt(size_t length)77 static zend_string* php_password_make_salt(size_t length) /* {{{ */
78 {
79 	zend_string *ret, *buffer;
80 
81 	if (length > (INT_MAX / 3)) {
82 		zend_value_error("Length is too large to safely generate");
83 		return NULL;
84 	}
85 
86 	buffer = zend_string_alloc(length * 3 / 4 + 1, 0);
87 	if (FAILURE == php_random_bytes_silent(ZSTR_VAL(buffer), ZSTR_LEN(buffer))) {
88 		zend_value_error("Unable to generate salt");
89 		zend_string_release_ex(buffer, 0);
90 		return NULL;
91 	}
92 
93 	ret = zend_string_alloc(length, 0);
94 	if (php_password_salt_to64(ZSTR_VAL(buffer), ZSTR_LEN(buffer), length, ZSTR_VAL(ret)) == FAILURE) {
95 		zend_value_error("Generated salt too short");
96 		zend_string_release_ex(buffer, 0);
97 		zend_string_release_ex(ret, 0);
98 		return NULL;
99 	}
100 	zend_string_release_ex(buffer, 0);
101 	ZSTR_VAL(ret)[length] = 0;
102 	return ret;
103 }
104 /* }}} */
105 
php_password_get_salt(zval * unused_,size_t required_salt_len,HashTable * options)106 static zend_string* php_password_get_salt(zval *unused_, size_t required_salt_len, HashTable *options) {
107 	if (options && zend_hash_str_exists(options, "salt", sizeof("salt") - 1)) {
108 		php_error_docref(NULL, E_WARNING, "The \"salt\" option has been ignored, since providing a custom salt is no longer supported");
109 	}
110 
111 	return php_password_make_salt(required_salt_len);
112 }
113 
114 /* bcrypt implementation */
115 
php_password_bcrypt_valid(const zend_string * hash)116 static zend_bool php_password_bcrypt_valid(const zend_string *hash) {
117 	const char *h = ZSTR_VAL(hash);
118 	return (ZSTR_LEN(hash) == 60) &&
119 		(h[0] == '$') && (h[1] == '2') && (h[2] == 'y');
120 }
121 
php_password_bcrypt_get_info(zval * return_value,const zend_string * hash)122 static int php_password_bcrypt_get_info(zval *return_value, const zend_string *hash) {
123 	zend_long cost = PHP_PASSWORD_BCRYPT_COST;
124 
125 	if (!php_password_bcrypt_valid(hash)) {
126 		/* Should never get called this way. */
127 		return FAILURE;
128 	}
129 
130 	sscanf(ZSTR_VAL(hash), "$2y$" ZEND_LONG_FMT "$", &cost);
131 	add_assoc_long(return_value, "cost", cost);
132 
133 	return SUCCESS;
134 }
135 
php_password_bcrypt_needs_rehash(const zend_string * hash,zend_array * options)136 static zend_bool php_password_bcrypt_needs_rehash(const zend_string *hash, zend_array *options) {
137 	zval *znew_cost;
138 	zend_long old_cost = PHP_PASSWORD_BCRYPT_COST;
139 	zend_long new_cost = PHP_PASSWORD_BCRYPT_COST;
140 
141 	if (!php_password_bcrypt_valid(hash)) {
142 		/* Should never get called this way. */
143 		return 1;
144 	}
145 
146 	sscanf(ZSTR_VAL(hash), "$2y$" ZEND_LONG_FMT "$", &old_cost);
147 	if (options && (znew_cost = zend_hash_str_find(options, "cost", sizeof("cost")-1)) != NULL) {
148 		new_cost = zval_get_long(znew_cost);
149 	}
150 
151 	return old_cost != new_cost;
152 }
153 
php_password_bcrypt_verify(const zend_string * password,const zend_string * hash)154 static zend_bool php_password_bcrypt_verify(const zend_string *password, const zend_string *hash) {
155 	size_t i;
156 	int status = 0;
157 	zend_string *ret = php_crypt(ZSTR_VAL(password), (int)ZSTR_LEN(password), ZSTR_VAL(hash), (int)ZSTR_LEN(hash), 1);
158 
159 	if (!ret) {
160 		return 0;
161 	}
162 
163 	if (ZSTR_LEN(ret) != ZSTR_LEN(hash) || ZSTR_LEN(hash) < 13) {
164 		zend_string_free(ret);
165 		return 0;
166 	}
167 
168 	/* We're using this method instead of == in order to provide
169 	 * resistance towards timing attacks. This is a constant time
170 	 * equality check that will always check every byte of both
171 	 * values. */
172 	for (i = 0; i < ZSTR_LEN(hash); i++) {
173 		status |= (ZSTR_VAL(ret)[i] ^ ZSTR_VAL(hash)[i]);
174 	}
175 
176 	zend_string_free(ret);
177 	return status == 0;
178 }
179 
php_password_bcrypt_hash(const zend_string * password,zend_array * options)180 static zend_string* php_password_bcrypt_hash(const zend_string *password, zend_array *options) {
181 	char hash_format[10];
182 	size_t hash_format_len;
183 	zend_string *result, *hash, *salt;
184 	zval *zcost;
185 	zend_long cost = PHP_PASSWORD_BCRYPT_COST;
186 
187 	if (options && (zcost = zend_hash_str_find(options, "cost", sizeof("cost")-1)) != NULL) {
188 		cost = zval_get_long(zcost);
189 	}
190 
191 	if (cost < 4 || cost > 31) {
192 		zend_value_error("Invalid bcrypt cost parameter specified: " ZEND_LONG_FMT, cost);
193 		return NULL;
194 	}
195 
196 	hash_format_len = snprintf(hash_format, sizeof(hash_format), "$2y$%02" ZEND_LONG_FMT_SPEC "$", cost);
197 	if (!(salt = php_password_get_salt(NULL, Z_UL(22), options))) {
198 		return NULL;
199 	}
200 	ZSTR_VAL(salt)[ZSTR_LEN(salt)] = 0;
201 
202 	hash = zend_string_alloc(ZSTR_LEN(salt) + hash_format_len, 0);
203 	sprintf(ZSTR_VAL(hash), "%s%s", hash_format, ZSTR_VAL(salt));
204 	ZSTR_VAL(hash)[hash_format_len + ZSTR_LEN(salt)] = 0;
205 
206 	zend_string_release_ex(salt, 0);
207 
208 	/* This cast is safe, since both values are defined here in code and cannot overflow */
209 	result = php_crypt(ZSTR_VAL(password), (int)ZSTR_LEN(password), ZSTR_VAL(hash), (int)ZSTR_LEN(hash), 1);
210 	zend_string_release_ex(hash, 0);
211 
212 	if (!result) {
213 		return NULL;
214 	}
215 
216 	if (ZSTR_LEN(result) < 13) {
217 		zend_string_free(result);
218 		return NULL;
219 	}
220 
221 	return result;
222 }
223 
224 const php_password_algo php_password_algo_bcrypt = {
225 	"bcrypt",
226 	php_password_bcrypt_hash,
227 	php_password_bcrypt_verify,
228 	php_password_bcrypt_needs_rehash,
229 	php_password_bcrypt_get_info,
230 	php_password_bcrypt_valid,
231 };
232 
233 
234 #if HAVE_ARGON2LIB
235 /* argon2i/argon2id shared implementation */
236 
extract_argon2_parameters(const zend_string * hash,zend_long * v,zend_long * memory_cost,zend_long * time_cost,zend_long * threads)237 static int extract_argon2_parameters(const zend_string *hash,
238 									  zend_long *v, zend_long *memory_cost,
239 									  zend_long *time_cost, zend_long *threads) /* {{{ */
240 {
241 	const char *p = ZSTR_VAL(hash);
242 	if (!hash || (ZSTR_LEN(hash) < sizeof("$argon2id$"))) {
243 		return FAILURE;
244 	}
245 	if (!memcmp(p, "$argon2i$", sizeof("$argon2i$") - 1)) {
246 		p += sizeof("$argon2i$") - 1;
247 	} else if (!memcmp(p, "$argon2id$", sizeof("$argon2id$") - 1)) {
248 		p += sizeof("$argon2id$") - 1;
249 	} else {
250 		return FAILURE;
251 	}
252 
253 	sscanf(p, "v=" ZEND_LONG_FMT "$m=" ZEND_LONG_FMT ",t=" ZEND_LONG_FMT ",p=" ZEND_LONG_FMT,
254 	       v, memory_cost, time_cost, threads);
255 
256 	return SUCCESS;
257 }
258 /* }}} */
259 
php_password_argon2_get_info(zval * return_value,const zend_string * hash)260 static int php_password_argon2_get_info(zval *return_value, const zend_string *hash) {
261 	zend_long v = 0;
262 	zend_long memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST;
263 	zend_long time_cost = PHP_PASSWORD_ARGON2_TIME_COST;
264 	zend_long threads = PHP_PASSWORD_ARGON2_THREADS;
265 
266 	extract_argon2_parameters(hash, &v, &memory_cost, &time_cost, &threads);
267 
268 	add_assoc_long(return_value, "memory_cost", memory_cost);
269 	add_assoc_long(return_value, "time_cost", time_cost);
270 	add_assoc_long(return_value, "threads", threads);
271 
272 	return SUCCESS;
273 }
274 
php_password_argon2_needs_rehash(const zend_string * hash,zend_array * options)275 static zend_bool php_password_argon2_needs_rehash(const zend_string *hash, zend_array *options) {
276 	zend_long v = 0;
277 	zend_long new_memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST, memory_cost = 0;
278 	zend_long new_time_cost = PHP_PASSWORD_ARGON2_TIME_COST, time_cost = 0;
279 	zend_long new_threads = PHP_PASSWORD_ARGON2_THREADS, threads = 0;
280 	zval *option_buffer;
281 
282 	if (options && (option_buffer = zend_hash_str_find(options, "memory_cost", sizeof("memory_cost")-1)) != NULL) {
283 		new_memory_cost = zval_get_long(option_buffer);
284 	}
285 
286 	if (options && (option_buffer = zend_hash_str_find(options, "time_cost", sizeof("time_cost")-1)) != NULL) {
287 		new_time_cost = zval_get_long(option_buffer);
288 	}
289 
290 	if (options && (option_buffer = zend_hash_str_find(options, "threads", sizeof("threads")-1)) != NULL) {
291 		new_threads = zval_get_long(option_buffer);
292 	}
293 
294 	extract_argon2_parameters(hash, &v, &memory_cost, &time_cost, &threads);
295 
296 	return (new_time_cost != time_cost) ||
297 			(new_memory_cost != memory_cost) ||
298 			(new_threads != threads);
299 }
300 
php_password_argon2_hash(const zend_string * password,zend_array * options,argon2_type type)301 static zend_string *php_password_argon2_hash(const zend_string *password, zend_array *options, argon2_type type) {
302 	zval *option_buffer;
303 	zend_string *salt, *out, *encoded;
304 	size_t time_cost = PHP_PASSWORD_ARGON2_TIME_COST;
305 	size_t memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST;
306 	size_t threads = PHP_PASSWORD_ARGON2_THREADS;
307 	size_t encoded_len;
308 	int status = 0;
309 
310 	if (options && (option_buffer = zend_hash_str_find(options, "memory_cost", sizeof("memory_cost")-1)) != NULL) {
311 		memory_cost = zval_get_long(option_buffer);
312 	}
313 
314 	if (memory_cost > ARGON2_MAX_MEMORY || memory_cost < ARGON2_MIN_MEMORY) {
315 		zend_value_error("Memory cost is outside of allowed memory range");
316 		return NULL;
317 	}
318 
319 	if (options && (option_buffer = zend_hash_str_find(options, "time_cost", sizeof("time_cost")-1)) != NULL) {
320 		time_cost = zval_get_long(option_buffer);
321 	}
322 
323 	if (time_cost > ARGON2_MAX_TIME || time_cost < ARGON2_MIN_TIME) {
324 		zend_value_error("Time cost is outside of allowed time range");
325 		return NULL;
326 	}
327 
328 	if (options && (option_buffer = zend_hash_str_find(options, "threads", sizeof("threads")-1)) != NULL) {
329 		threads = zval_get_long(option_buffer);
330 	}
331 
332 	if (threads > ARGON2_MAX_LANES || threads == 0) {
333 		zend_value_error("Invalid number of threads");
334 		return NULL;
335 	}
336 
337 	if (!(salt = php_password_get_salt(NULL, Z_UL(16), options))) {
338 		return NULL;
339 	}
340 
341 	out = zend_string_alloc(32, 0);
342 	encoded_len = argon2_encodedlen(
343 		time_cost,
344 		memory_cost,
345 		threads,
346 		(uint32_t)ZSTR_LEN(salt),
347 		ZSTR_LEN(out),
348 		type
349 	);
350 
351 	encoded = zend_string_alloc(encoded_len - 1, 0);
352 	status = argon2_hash(
353 		time_cost,
354 		memory_cost,
355 		threads,
356 		ZSTR_VAL(password),
357 		ZSTR_LEN(password),
358 		ZSTR_VAL(salt),
359 		ZSTR_LEN(salt),
360 		ZSTR_VAL(out),
361 		ZSTR_LEN(out),
362 		ZSTR_VAL(encoded),
363 		encoded_len,
364 		type,
365 		ARGON2_VERSION_NUMBER
366 	);
367 
368 	zend_string_release_ex(out, 0);
369 	zend_string_release_ex(salt, 0);
370 
371 	if (status != ARGON2_OK) {
372 		zend_string_efree(encoded);
373 		zend_value_error("%s", argon2_error_message(status));
374 		return NULL;
375 	}
376 
377 	ZSTR_VAL(encoded)[ZSTR_LEN(encoded)] = 0;
378 	return encoded;
379 }
380 
381 /* argon2i specific methods */
382 
php_password_argon2i_verify(const zend_string * password,const zend_string * hash)383 static zend_bool php_password_argon2i_verify(const zend_string *password, const zend_string *hash) {
384 	return ARGON2_OK == argon2_verify(ZSTR_VAL(hash), ZSTR_VAL(password), ZSTR_LEN(password), Argon2_i);
385 }
386 
php_password_argon2i_hash(const zend_string * password,zend_array * options)387 static zend_string *php_password_argon2i_hash(const zend_string *password, zend_array *options) {
388 	return php_password_argon2_hash(password, options, Argon2_i);
389 }
390 
391 const php_password_algo php_password_algo_argon2i = {
392 	"argon2i",
393 	php_password_argon2i_hash,
394 	php_password_argon2i_verify,
395 	php_password_argon2_needs_rehash,
396 	php_password_argon2_get_info,
397 	NULL,
398 };
399 
400 /* argon2id specific methods */
401 
php_password_argon2id_verify(const zend_string * password,const zend_string * hash)402 static zend_bool php_password_argon2id_verify(const zend_string *password, const zend_string *hash) {
403 	return ARGON2_OK == argon2_verify(ZSTR_VAL(hash), ZSTR_VAL(password), ZSTR_LEN(password), Argon2_id);
404 }
405 
php_password_argon2id_hash(const zend_string * password,zend_array * options)406 static zend_string *php_password_argon2id_hash(const zend_string *password, zend_array *options) {
407 	return php_password_argon2_hash(password, options, Argon2_id);
408 }
409 
410 const php_password_algo php_password_algo_argon2id = {
411 	"argon2id",
412 	php_password_argon2id_hash,
413 	php_password_argon2id_verify,
414 	php_password_argon2_needs_rehash,
415 	php_password_argon2_get_info,
416 	NULL,
417 };
418 #endif
419 
PHP_MINIT_FUNCTION(password)420 PHP_MINIT_FUNCTION(password) /* {{{ */
421 {
422 	zend_hash_init(&php_password_algos, 4, NULL, ZVAL_PTR_DTOR, 1);
423 	REGISTER_STRING_CONSTANT("PASSWORD_DEFAULT", "2y", CONST_CS | CONST_PERSISTENT);
424 
425 	if (FAILURE == php_password_algo_register("2y", &php_password_algo_bcrypt)) {
426 		return FAILURE;
427 	}
428 	REGISTER_STRING_CONSTANT("PASSWORD_BCRYPT", "2y", CONST_CS | CONST_PERSISTENT);
429 
430 #if HAVE_ARGON2LIB
431 	if (FAILURE == php_password_algo_register("argon2i", &php_password_algo_argon2i)) {
432 		return FAILURE;
433 	}
434 	REGISTER_STRING_CONSTANT("PASSWORD_ARGON2I", "argon2i", CONST_CS | CONST_PERSISTENT);
435 
436 	if (FAILURE == php_password_algo_register("argon2id", &php_password_algo_argon2id)) {
437 		return FAILURE;
438 	}
439 	REGISTER_STRING_CONSTANT("PASSWORD_ARGON2ID", "argon2id", CONST_CS | CONST_PERSISTENT);
440 #endif
441 
442 	REGISTER_LONG_CONSTANT("PASSWORD_BCRYPT_DEFAULT_COST", PHP_PASSWORD_BCRYPT_COST, CONST_CS | CONST_PERSISTENT);
443 #if HAVE_ARGON2LIB
444 	REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_MEMORY_COST", PHP_PASSWORD_ARGON2_MEMORY_COST, CONST_CS | CONST_PERSISTENT);
445 	REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_TIME_COST", PHP_PASSWORD_ARGON2_TIME_COST, CONST_CS | CONST_PERSISTENT);
446 	REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_THREADS", PHP_PASSWORD_ARGON2_THREADS, CONST_CS | CONST_PERSISTENT);
447 
448 	REGISTER_STRING_CONSTANT("PASSWORD_ARGON2_PROVIDER", "standard", CONST_CS | CONST_PERSISTENT);
449 #endif
450 
451 	return SUCCESS;
452 }
453 /* }}} */
454 
PHP_MSHUTDOWN_FUNCTION(password)455 PHP_MSHUTDOWN_FUNCTION(password) /* {{{ */
456 {
457 #ifdef ZTS
458 	if (!tsrm_is_main_thread()) {
459 		return SUCCESS;
460 	}
461 #endif
462 	zend_hash_destroy(&php_password_algos);
463 	return SUCCESS;
464 }
465 /* }}} */
466 
php_password_algo_default(void)467 const php_password_algo* php_password_algo_default(void) {
468 	return &php_password_algo_bcrypt;
469 }
470 
php_password_algo_find(const zend_string * ident)471 const php_password_algo* php_password_algo_find(const zend_string *ident) {
472 	zval *tmp;
473 
474 	if (!ident) {
475 		return NULL;
476 	}
477 
478 	tmp = zend_hash_find(&php_password_algos, (zend_string*)ident);
479 	if (!tmp || (Z_TYPE_P(tmp) != IS_PTR)) {
480 		return NULL;
481 	}
482 
483 	return Z_PTR_P(tmp);
484 }
485 
php_password_algo_find_zval(zend_string * arg_str,zend_long arg_long,zend_bool arg_is_null)486 static const php_password_algo* php_password_algo_find_zval(zend_string *arg_str, zend_long arg_long, zend_bool arg_is_null) {
487 	if (arg_is_null) {
488 		return php_password_algo_default();
489 	}
490 
491 	if (arg_str) {
492 		return php_password_algo_find(arg_str);
493 	}
494 
495 	switch (arg_long) {
496 		case 0: return php_password_algo_default();
497 		case 1: return &php_password_algo_bcrypt;
498 #if HAVE_ARGON2LIB
499 		case 2: return &php_password_algo_argon2i;
500 		case 3: return &php_password_algo_argon2id;
501 #else
502 		case 2:
503 			{
504 			zend_string *n = zend_string_init("argon2i", sizeof("argon2i")-1, 0);
505 			const php_password_algo* ret = php_password_algo_find(n);
506 			zend_string_release(n);
507 			return ret;
508 			}
509 		case 3:
510 			{
511 			zend_string *n = zend_string_init("argon2id", sizeof("argon2id")-1, 0);
512 			const php_password_algo* ret = php_password_algo_find(n);
513 			zend_string_release(n);
514 			return ret;
515 			}
516 #endif
517 	}
518 
519 	return NULL;
520 }
521 
php_password_algo_extract_ident(const zend_string * hash)522 zend_string *php_password_algo_extract_ident(const zend_string* hash) {
523 	const char *ident, *ident_end;
524 
525 	if (!hash || ZSTR_LEN(hash) < 3) {
526 		/* Minimum prefix: "$x$" */
527 		return NULL;
528 	}
529 
530 	ident = ZSTR_VAL(hash) + 1;
531 	ident_end = strchr(ident, '$');
532 	if (!ident_end) {
533 		/* No terminating '$' */
534 		return NULL;
535 	}
536 
537 	return zend_string_init(ident, ident_end - ident, 0);
538 }
539 
php_password_algo_identify_ex(const zend_string * hash,const php_password_algo * default_algo)540 const php_password_algo* php_password_algo_identify_ex(const zend_string* hash, const php_password_algo *default_algo) {
541 	const php_password_algo *algo;
542 	zend_string *ident = php_password_algo_extract_ident(hash);
543 
544 	if (!ident) {
545 		return default_algo;
546 	}
547 
548 	algo = php_password_algo_find(ident);
549 	zend_string_release(ident);
550 	return (!algo || (algo->valid && !algo->valid(hash))) ? default_algo : algo;
551 }
552 
553 /* {{{ Retrieves information about a given hash */
PHP_FUNCTION(password_get_info)554 PHP_FUNCTION(password_get_info)
555 {
556 	const php_password_algo *algo;
557 	zend_string *hash, *ident;
558 	zval options;
559 
560 	ZEND_PARSE_PARAMETERS_START(1, 1)
561 		Z_PARAM_STR(hash)
562 	ZEND_PARSE_PARAMETERS_END();
563 
564 	array_init(return_value);
565 	array_init(&options);
566 
567 	ident = php_password_algo_extract_ident(hash);
568 	algo = php_password_algo_find(ident);
569 	if (!algo || (algo->valid && !algo->valid(hash))) {
570 		if (ident) {
571 			zend_string_release(ident);
572 		}
573 		add_assoc_null(return_value, "algo");
574 		add_assoc_string(return_value, "algoName", "unknown");
575 		add_assoc_zval(return_value, "options", &options);
576 		return;
577 	}
578 
579 	add_assoc_str(return_value, "algo", php_password_algo_extract_ident(hash));
580 	zend_string_release(ident);
581 
582 	add_assoc_string(return_value, "algoName", algo->name);
583 	if (algo->get_info) {
584 		algo->get_info(&options, hash);
585 	}
586 	add_assoc_zval(return_value, "options", &options);
587 }
588 /** }}} */
589 
590 /* {{{ Determines if a given hash requires re-hashing based upon parameters */
PHP_FUNCTION(password_needs_rehash)591 PHP_FUNCTION(password_needs_rehash)
592 {
593 	const php_password_algo *old_algo, *new_algo;
594 	zend_string *hash;
595 	zend_string *new_algo_str;
596 	zend_long new_algo_long;
597 	zend_bool new_algo_is_null;
598 	zend_array *options = 0;
599 
600 	ZEND_PARSE_PARAMETERS_START(2, 3)
601 		Z_PARAM_STR(hash)
602 		Z_PARAM_STR_OR_LONG_OR_NULL(new_algo_str, new_algo_long, new_algo_is_null)
603 		Z_PARAM_OPTIONAL
604 		Z_PARAM_ARRAY_HT(options)
605 	ZEND_PARSE_PARAMETERS_END();
606 
607 	new_algo = php_password_algo_find_zval(new_algo_str, new_algo_long, new_algo_is_null);
608 	if (!new_algo) {
609 		/* Unknown new algorithm, never prompt to rehash. */
610 		RETURN_FALSE;
611 	}
612 
613 	old_algo = php_password_algo_identify_ex(hash, NULL);
614 	if (old_algo != new_algo) {
615 		/* Different algorithm preferred, always rehash. */
616 		RETURN_TRUE;
617 	}
618 
619 	RETURN_BOOL(old_algo->needs_rehash(hash, options));
620 }
621 /* }}} */
622 
623 /* {{{ Verify a hash created using crypt() or password_hash() */
PHP_FUNCTION(password_verify)624 PHP_FUNCTION(password_verify)
625 {
626 	zend_string *password, *hash;
627 	const php_password_algo *algo;
628 
629 	ZEND_PARSE_PARAMETERS_START(2, 2)
630 		Z_PARAM_STR(password)
631 		Z_PARAM_STR(hash)
632 	ZEND_PARSE_PARAMETERS_END();
633 
634 	algo = php_password_algo_identify(hash);
635 	RETURN_BOOL(algo && (!algo->verify || algo->verify(password, hash)));
636 }
637 /* }}} */
638 
639 /* {{{ Hash a password */
PHP_FUNCTION(password_hash)640 PHP_FUNCTION(password_hash)
641 {
642 	zend_string *password, *digest = NULL;
643 	zend_string *algo_str;
644 	zend_long algo_long;
645 	zend_bool algo_is_null;
646 	const php_password_algo *algo;
647 	zend_array *options = NULL;
648 
649 	ZEND_PARSE_PARAMETERS_START(2, 3)
650 		Z_PARAM_STR(password)
651 		Z_PARAM_STR_OR_LONG_OR_NULL(algo_str, algo_long, algo_is_null)
652 		Z_PARAM_OPTIONAL
653 		Z_PARAM_ARRAY_HT(options)
654 	ZEND_PARSE_PARAMETERS_END();
655 
656 	algo = php_password_algo_find_zval(algo_str, algo_long, algo_is_null);
657 	if (!algo) {
658 		zend_argument_value_error(2, "must be a valid password hashing algorithm");
659 		RETURN_THROWS();
660 	}
661 
662 	digest = algo->hash(password, options);
663 	if (!digest) {
664 		if (!EG(exception)) {
665 			zend_throw_error(NULL, "Password hashing failed for unknown reason");
666 		}
667 		RETURN_THROWS();
668 	}
669 
670 	RETURN_NEW_STR(digest);
671 }
672 /* }}} */
673 
674 /* {{{ */
PHP_FUNCTION(password_algos)675 PHP_FUNCTION(password_algos) {
676 	zend_string *algo;
677 
678 	ZEND_PARSE_PARAMETERS_NONE();
679 
680 	array_init(return_value);
681 	ZEND_HASH_FOREACH_STR_KEY(&php_password_algos, algo) {
682 		add_next_index_str(return_value, zend_string_copy(algo));
683 	} ZEND_HASH_FOREACH_END();
684 }
685 /* }}} */
686