1 /*
2 +----------------------------------------------------------------------+
3 | Copyright (c) The PHP Group |
4 +----------------------------------------------------------------------+
5 | This source file is subject to version 3.01 of the PHP license, |
6 | that is bundled with this package in the file LICENSE, and is |
7 | available through the world-wide-web at the following url: |
8 | https://www.php.net/license/3_01.txt |
9 | If you did not receive a copy of the PHP license and are unable to |
10 | obtain it through the world-wide-web, please send a note to |
11 | license@php.net so we can mail you a copy immediately. |
12 +----------------------------------------------------------------------+
13 | Authors: Anthony Ferrara <ircmaxell@php.net> |
14 | Charles R. Portwood II <charlesportwoodii@erianna.com> |
15 +----------------------------------------------------------------------+
16 */
17
18 #include <stdlib.h>
19
20 #include "php.h"
21
22 #include "fcntl.h"
23 #include "php_password.h"
24 #include "php_rand.h"
25 #include "php_crypt.h"
26 #include "base64.h"
27 #include "zend_interfaces.h"
28 #include "info.h"
29 #include "php_random.h"
30 #if HAVE_ARGON2LIB
31 #include "argon2.h"
32 #endif
33
34 #ifdef PHP_WIN32
35 #include "win32/winutil.h"
36 #endif
37
38 static zend_array php_password_algos;
39
php_password_algo_register(const char * ident,const php_password_algo * algo)40 int php_password_algo_register(const char *ident, const php_password_algo *algo) {
41 zend_string *key = zend_string_init_interned(ident, strlen(ident), 1);
42 return zend_hash_add_ptr(&php_password_algos, key, (void *) algo) ? SUCCESS : FAILURE;
43 }
44
php_password_algo_unregister(const char * ident)45 void php_password_algo_unregister(const char *ident) {
46 zend_hash_str_del(&php_password_algos, ident, strlen(ident));
47 }
48
php_password_salt_to64(const char * str,const size_t str_len,const size_t out_len,char * ret)49 static int php_password_salt_to64(const char *str, const size_t str_len, const size_t out_len, char *ret) /* {{{ */
50 {
51 size_t pos = 0;
52 zend_string *buffer;
53 if ((int) str_len < 0) {
54 return FAILURE;
55 }
56 buffer = php_base64_encode((unsigned char*) str, str_len);
57 if (ZSTR_LEN(buffer) < out_len) {
58 /* Too short of an encoded string generated */
59 zend_string_release_ex(buffer, 0);
60 return FAILURE;
61 }
62 for (pos = 0; pos < out_len; pos++) {
63 if (ZSTR_VAL(buffer)[pos] == '+') {
64 ret[pos] = '.';
65 } else if (ZSTR_VAL(buffer)[pos] == '=') {
66 zend_string_free(buffer);
67 return FAILURE;
68 } else {
69 ret[pos] = ZSTR_VAL(buffer)[pos];
70 }
71 }
72 zend_string_free(buffer);
73 return SUCCESS;
74 }
75 /* }}} */
76
php_password_make_salt(size_t length)77 static zend_string* php_password_make_salt(size_t length) /* {{{ */
78 {
79 zend_string *ret, *buffer;
80
81 if (length > (INT_MAX / 3)) {
82 zend_value_error("Length is too large to safely generate");
83 return NULL;
84 }
85
86 buffer = zend_string_alloc(length * 3 / 4 + 1, 0);
87 if (FAILURE == php_random_bytes_silent(ZSTR_VAL(buffer), ZSTR_LEN(buffer))) {
88 zend_value_error("Unable to generate salt");
89 zend_string_release_ex(buffer, 0);
90 return NULL;
91 }
92
93 ret = zend_string_alloc(length, 0);
94 if (php_password_salt_to64(ZSTR_VAL(buffer), ZSTR_LEN(buffer), length, ZSTR_VAL(ret)) == FAILURE) {
95 zend_value_error("Generated salt too short");
96 zend_string_release_ex(buffer, 0);
97 zend_string_release_ex(ret, 0);
98 return NULL;
99 }
100 zend_string_release_ex(buffer, 0);
101 ZSTR_VAL(ret)[length] = 0;
102 return ret;
103 }
104 /* }}} */
105
php_password_get_salt(zval * unused_,size_t required_salt_len,HashTable * options)106 static zend_string* php_password_get_salt(zval *unused_, size_t required_salt_len, HashTable *options) {
107 if (options && zend_hash_str_exists(options, "salt", sizeof("salt") - 1)) {
108 php_error_docref(NULL, E_WARNING, "The \"salt\" option has been ignored, since providing a custom salt is no longer supported");
109 }
110
111 return php_password_make_salt(required_salt_len);
112 }
113
114 /* bcrypt implementation */
115
php_password_bcrypt_valid(const zend_string * hash)116 static bool php_password_bcrypt_valid(const zend_string *hash) {
117 const char *h = ZSTR_VAL(hash);
118 return (ZSTR_LEN(hash) == 60) &&
119 (h[0] == '$') && (h[1] == '2') && (h[2] == 'y');
120 }
121
php_password_bcrypt_get_info(zval * return_value,const zend_string * hash)122 static int php_password_bcrypt_get_info(zval *return_value, const zend_string *hash) {
123 zend_long cost = PHP_PASSWORD_BCRYPT_COST;
124
125 if (!php_password_bcrypt_valid(hash)) {
126 /* Should never get called this way. */
127 return FAILURE;
128 }
129
130 sscanf(ZSTR_VAL(hash), "$2y$" ZEND_LONG_FMT "$", &cost);
131 add_assoc_long(return_value, "cost", cost);
132
133 return SUCCESS;
134 }
135
php_password_bcrypt_needs_rehash(const zend_string * hash,zend_array * options)136 static bool php_password_bcrypt_needs_rehash(const zend_string *hash, zend_array *options) {
137 zval *znew_cost;
138 zend_long old_cost = PHP_PASSWORD_BCRYPT_COST;
139 zend_long new_cost = PHP_PASSWORD_BCRYPT_COST;
140
141 if (!php_password_bcrypt_valid(hash)) {
142 /* Should never get called this way. */
143 return 1;
144 }
145
146 sscanf(ZSTR_VAL(hash), "$2y$" ZEND_LONG_FMT "$", &old_cost);
147 if (options && (znew_cost = zend_hash_str_find(options, "cost", sizeof("cost")-1)) != NULL) {
148 new_cost = zval_get_long(znew_cost);
149 }
150
151 return old_cost != new_cost;
152 }
153
php_password_bcrypt_verify(const zend_string * password,const zend_string * hash)154 static bool php_password_bcrypt_verify(const zend_string *password, const zend_string *hash) {
155 size_t i;
156 int status = 0;
157 zend_string *ret = php_crypt(ZSTR_VAL(password), (int)ZSTR_LEN(password), ZSTR_VAL(hash), (int)ZSTR_LEN(hash), 1);
158
159 if (!ret) {
160 return 0;
161 }
162
163 if (ZSTR_LEN(ret) != ZSTR_LEN(hash) || ZSTR_LEN(hash) < 13) {
164 zend_string_free(ret);
165 return 0;
166 }
167
168 /* We're using this method instead of == in order to provide
169 * resistance towards timing attacks. This is a constant time
170 * equality check that will always check every byte of both
171 * values. */
172 for (i = 0; i < ZSTR_LEN(hash); i++) {
173 status |= (ZSTR_VAL(ret)[i] ^ ZSTR_VAL(hash)[i]);
174 }
175
176 zend_string_free(ret);
177 return status == 0;
178 }
179
php_password_bcrypt_hash(const zend_string * password,zend_array * options)180 static zend_string* php_password_bcrypt_hash(const zend_string *password, zend_array *options) {
181 char hash_format[10];
182 size_t hash_format_len;
183 zend_string *result, *hash, *salt;
184 zval *zcost;
185 zend_long cost = PHP_PASSWORD_BCRYPT_COST;
186
187 if (memchr(ZSTR_VAL(password), '\0', ZSTR_LEN(password))) {
188 zend_value_error("Bcrypt password must not contain null character");
189 return NULL;
190 }
191
192 if (options && (zcost = zend_hash_str_find(options, "cost", sizeof("cost")-1)) != NULL) {
193 cost = zval_get_long(zcost);
194 }
195
196 if (cost < 4 || cost > 31) {
197 zend_value_error("Invalid bcrypt cost parameter specified: " ZEND_LONG_FMT, cost);
198 return NULL;
199 }
200
201 hash_format_len = snprintf(hash_format, sizeof(hash_format), "$2y$%02" ZEND_LONG_FMT_SPEC "$", cost);
202 if (!(salt = php_password_get_salt(NULL, Z_UL(22), options))) {
203 return NULL;
204 }
205 ZSTR_VAL(salt)[ZSTR_LEN(salt)] = 0;
206
207 hash = zend_string_alloc(ZSTR_LEN(salt) + hash_format_len, 0);
208 sprintf(ZSTR_VAL(hash), "%s%s", hash_format, ZSTR_VAL(salt));
209 ZSTR_VAL(hash)[hash_format_len + ZSTR_LEN(salt)] = 0;
210
211 zend_string_release_ex(salt, 0);
212
213 /* This cast is safe, since both values are defined here in code and cannot overflow */
214 result = php_crypt(ZSTR_VAL(password), (int)ZSTR_LEN(password), ZSTR_VAL(hash), (int)ZSTR_LEN(hash), 1);
215 zend_string_release_ex(hash, 0);
216
217 if (!result) {
218 return NULL;
219 }
220
221 if (ZSTR_LEN(result) < 13) {
222 zend_string_free(result);
223 return NULL;
224 }
225
226 return result;
227 }
228
229 const php_password_algo php_password_algo_bcrypt = {
230 "bcrypt",
231 php_password_bcrypt_hash,
232 php_password_bcrypt_verify,
233 php_password_bcrypt_needs_rehash,
234 php_password_bcrypt_get_info,
235 php_password_bcrypt_valid,
236 };
237
238
239 #if HAVE_ARGON2LIB
240 /* argon2i/argon2id shared implementation */
241
extract_argon2_parameters(const zend_string * hash,zend_long * v,zend_long * memory_cost,zend_long * time_cost,zend_long * threads)242 static int extract_argon2_parameters(const zend_string *hash,
243 zend_long *v, zend_long *memory_cost,
244 zend_long *time_cost, zend_long *threads) /* {{{ */
245 {
246 const char *p = ZSTR_VAL(hash);
247 if (!hash || (ZSTR_LEN(hash) < sizeof("$argon2id$"))) {
248 return FAILURE;
249 }
250 if (!memcmp(p, "$argon2i$", sizeof("$argon2i$") - 1)) {
251 p += sizeof("$argon2i$") - 1;
252 } else if (!memcmp(p, "$argon2id$", sizeof("$argon2id$") - 1)) {
253 p += sizeof("$argon2id$") - 1;
254 } else {
255 return FAILURE;
256 }
257
258 sscanf(p, "v=" ZEND_LONG_FMT "$m=" ZEND_LONG_FMT ",t=" ZEND_LONG_FMT ",p=" ZEND_LONG_FMT,
259 v, memory_cost, time_cost, threads);
260
261 return SUCCESS;
262 }
263 /* }}} */
264
php_password_argon2_get_info(zval * return_value,const zend_string * hash)265 static int php_password_argon2_get_info(zval *return_value, const zend_string *hash) {
266 zend_long v = 0;
267 zend_long memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST;
268 zend_long time_cost = PHP_PASSWORD_ARGON2_TIME_COST;
269 zend_long threads = PHP_PASSWORD_ARGON2_THREADS;
270
271 extract_argon2_parameters(hash, &v, &memory_cost, &time_cost, &threads);
272
273 add_assoc_long(return_value, "memory_cost", memory_cost);
274 add_assoc_long(return_value, "time_cost", time_cost);
275 add_assoc_long(return_value, "threads", threads);
276
277 return SUCCESS;
278 }
279
php_password_argon2_needs_rehash(const zend_string * hash,zend_array * options)280 static bool php_password_argon2_needs_rehash(const zend_string *hash, zend_array *options) {
281 zend_long v = 0;
282 zend_long new_memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST, memory_cost = 0;
283 zend_long new_time_cost = PHP_PASSWORD_ARGON2_TIME_COST, time_cost = 0;
284 zend_long new_threads = PHP_PASSWORD_ARGON2_THREADS, threads = 0;
285 zval *option_buffer;
286
287 if (options && (option_buffer = zend_hash_str_find(options, "memory_cost", sizeof("memory_cost")-1)) != NULL) {
288 new_memory_cost = zval_get_long(option_buffer);
289 }
290
291 if (options && (option_buffer = zend_hash_str_find(options, "time_cost", sizeof("time_cost")-1)) != NULL) {
292 new_time_cost = zval_get_long(option_buffer);
293 }
294
295 if (options && (option_buffer = zend_hash_str_find(options, "threads", sizeof("threads")-1)) != NULL) {
296 new_threads = zval_get_long(option_buffer);
297 }
298
299 extract_argon2_parameters(hash, &v, &memory_cost, &time_cost, &threads);
300
301 return (new_time_cost != time_cost) ||
302 (new_memory_cost != memory_cost) ||
303 (new_threads != threads);
304 }
305
php_password_argon2_hash(const zend_string * password,zend_array * options,argon2_type type)306 static zend_string *php_password_argon2_hash(const zend_string *password, zend_array *options, argon2_type type) {
307 zval *option_buffer;
308 zend_string *salt, *out, *encoded;
309 size_t time_cost = PHP_PASSWORD_ARGON2_TIME_COST;
310 size_t memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST;
311 size_t threads = PHP_PASSWORD_ARGON2_THREADS;
312 size_t encoded_len;
313 int status = 0;
314
315 if (options && (option_buffer = zend_hash_str_find(options, "memory_cost", sizeof("memory_cost")-1)) != NULL) {
316 memory_cost = zval_get_long(option_buffer);
317 }
318
319 if (memory_cost > ARGON2_MAX_MEMORY || memory_cost < ARGON2_MIN_MEMORY) {
320 zend_value_error("Memory cost is outside of allowed memory range");
321 return NULL;
322 }
323
324 if (options && (option_buffer = zend_hash_str_find(options, "time_cost", sizeof("time_cost")-1)) != NULL) {
325 time_cost = zval_get_long(option_buffer);
326 }
327
328 if (time_cost > ARGON2_MAX_TIME || time_cost < ARGON2_MIN_TIME) {
329 zend_value_error("Time cost is outside of allowed time range");
330 return NULL;
331 }
332
333 if (options && (option_buffer = zend_hash_str_find(options, "threads", sizeof("threads")-1)) != NULL) {
334 threads = zval_get_long(option_buffer);
335 }
336
337 if (threads > ARGON2_MAX_LANES || threads == 0) {
338 zend_value_error("Invalid number of threads");
339 return NULL;
340 }
341
342 if (!(salt = php_password_get_salt(NULL, Z_UL(16), options))) {
343 return NULL;
344 }
345
346 out = zend_string_alloc(32, 0);
347 encoded_len = argon2_encodedlen(
348 time_cost,
349 memory_cost,
350 threads,
351 (uint32_t)ZSTR_LEN(salt),
352 ZSTR_LEN(out),
353 type
354 );
355
356 encoded = zend_string_alloc(encoded_len - 1, 0);
357 status = argon2_hash(
358 time_cost,
359 memory_cost,
360 threads,
361 ZSTR_VAL(password),
362 ZSTR_LEN(password),
363 ZSTR_VAL(salt),
364 ZSTR_LEN(salt),
365 ZSTR_VAL(out),
366 ZSTR_LEN(out),
367 ZSTR_VAL(encoded),
368 encoded_len,
369 type,
370 ARGON2_VERSION_NUMBER
371 );
372
373 zend_string_release_ex(out, 0);
374 zend_string_release_ex(salt, 0);
375
376 if (status != ARGON2_OK) {
377 zend_string_efree(encoded);
378 zend_value_error("%s", argon2_error_message(status));
379 return NULL;
380 }
381
382 ZSTR_VAL(encoded)[ZSTR_LEN(encoded)] = 0;
383 return encoded;
384 }
385
386 /* argon2i specific methods */
387
php_password_argon2i_verify(const zend_string * password,const zend_string * hash)388 static bool php_password_argon2i_verify(const zend_string *password, const zend_string *hash) {
389 return ARGON2_OK == argon2_verify(ZSTR_VAL(hash), ZSTR_VAL(password), ZSTR_LEN(password), Argon2_i);
390 }
391
php_password_argon2i_hash(const zend_string * password,zend_array * options)392 static zend_string *php_password_argon2i_hash(const zend_string *password, zend_array *options) {
393 return php_password_argon2_hash(password, options, Argon2_i);
394 }
395
396 const php_password_algo php_password_algo_argon2i = {
397 "argon2i",
398 php_password_argon2i_hash,
399 php_password_argon2i_verify,
400 php_password_argon2_needs_rehash,
401 php_password_argon2_get_info,
402 NULL,
403 };
404
405 /* argon2id specific methods */
406
php_password_argon2id_verify(const zend_string * password,const zend_string * hash)407 static bool php_password_argon2id_verify(const zend_string *password, const zend_string *hash) {
408 return ARGON2_OK == argon2_verify(ZSTR_VAL(hash), ZSTR_VAL(password), ZSTR_LEN(password), Argon2_id);
409 }
410
php_password_argon2id_hash(const zend_string * password,zend_array * options)411 static zend_string *php_password_argon2id_hash(const zend_string *password, zend_array *options) {
412 return php_password_argon2_hash(password, options, Argon2_id);
413 }
414
415 const php_password_algo php_password_algo_argon2id = {
416 "argon2id",
417 php_password_argon2id_hash,
418 php_password_argon2id_verify,
419 php_password_argon2_needs_rehash,
420 php_password_argon2_get_info,
421 NULL,
422 };
423 #endif
424
PHP_MINIT_FUNCTION(password)425 PHP_MINIT_FUNCTION(password) /* {{{ */
426 {
427 zend_hash_init(&php_password_algos, 4, NULL, ZVAL_PTR_DTOR, 1);
428 REGISTER_STRING_CONSTANT("PASSWORD_DEFAULT", "2y", CONST_CS | CONST_PERSISTENT);
429
430 if (FAILURE == php_password_algo_register("2y", &php_password_algo_bcrypt)) {
431 return FAILURE;
432 }
433 REGISTER_STRING_CONSTANT("PASSWORD_BCRYPT", "2y", CONST_CS | CONST_PERSISTENT);
434
435 #if HAVE_ARGON2LIB
436 if (FAILURE == php_password_algo_register("argon2i", &php_password_algo_argon2i)) {
437 return FAILURE;
438 }
439 REGISTER_STRING_CONSTANT("PASSWORD_ARGON2I", "argon2i", CONST_CS | CONST_PERSISTENT);
440
441 if (FAILURE == php_password_algo_register("argon2id", &php_password_algo_argon2id)) {
442 return FAILURE;
443 }
444 REGISTER_STRING_CONSTANT("PASSWORD_ARGON2ID", "argon2id", CONST_CS | CONST_PERSISTENT);
445 #endif
446
447 REGISTER_LONG_CONSTANT("PASSWORD_BCRYPT_DEFAULT_COST", PHP_PASSWORD_BCRYPT_COST, CONST_CS | CONST_PERSISTENT);
448 #if HAVE_ARGON2LIB
449 REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_MEMORY_COST", PHP_PASSWORD_ARGON2_MEMORY_COST, CONST_CS | CONST_PERSISTENT);
450 REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_TIME_COST", PHP_PASSWORD_ARGON2_TIME_COST, CONST_CS | CONST_PERSISTENT);
451 REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_THREADS", PHP_PASSWORD_ARGON2_THREADS, CONST_CS | CONST_PERSISTENT);
452
453 REGISTER_STRING_CONSTANT("PASSWORD_ARGON2_PROVIDER", "standard", CONST_CS | CONST_PERSISTENT);
454 #endif
455
456 return SUCCESS;
457 }
458 /* }}} */
459
PHP_MSHUTDOWN_FUNCTION(password)460 PHP_MSHUTDOWN_FUNCTION(password) /* {{{ */
461 {
462 #ifdef ZTS
463 if (!tsrm_is_main_thread()) {
464 return SUCCESS;
465 }
466 #endif
467 zend_hash_destroy(&php_password_algos);
468 return SUCCESS;
469 }
470 /* }}} */
471
php_password_algo_default(void)472 const php_password_algo* php_password_algo_default(void) {
473 return &php_password_algo_bcrypt;
474 }
475
php_password_algo_find(const zend_string * ident)476 const php_password_algo* php_password_algo_find(const zend_string *ident) {
477 zval *tmp;
478
479 if (!ident) {
480 return NULL;
481 }
482
483 tmp = zend_hash_find(&php_password_algos, (zend_string*)ident);
484 if (!tmp || (Z_TYPE_P(tmp) != IS_PTR)) {
485 return NULL;
486 }
487
488 return Z_PTR_P(tmp);
489 }
490
php_password_algo_find_zval(zend_string * arg_str,zend_long arg_long,bool arg_is_null)491 static const php_password_algo* php_password_algo_find_zval(zend_string *arg_str, zend_long arg_long, bool arg_is_null) {
492 if (arg_is_null) {
493 return php_password_algo_default();
494 }
495
496 if (arg_str) {
497 return php_password_algo_find(arg_str);
498 }
499
500 switch (arg_long) {
501 case 0: return php_password_algo_default();
502 case 1: return &php_password_algo_bcrypt;
503 #if HAVE_ARGON2LIB
504 case 2: return &php_password_algo_argon2i;
505 case 3: return &php_password_algo_argon2id;
506 #else
507 case 2:
508 {
509 zend_string *n = zend_string_init("argon2i", sizeof("argon2i")-1, 0);
510 const php_password_algo* ret = php_password_algo_find(n);
511 zend_string_release(n);
512 return ret;
513 }
514 case 3:
515 {
516 zend_string *n = zend_string_init("argon2id", sizeof("argon2id")-1, 0);
517 const php_password_algo* ret = php_password_algo_find(n);
518 zend_string_release(n);
519 return ret;
520 }
521 #endif
522 }
523
524 return NULL;
525 }
526
php_password_algo_extract_ident(const zend_string * hash)527 zend_string *php_password_algo_extract_ident(const zend_string* hash) {
528 const char *ident, *ident_end;
529
530 if (!hash || ZSTR_LEN(hash) < 3) {
531 /* Minimum prefix: "$x$" */
532 return NULL;
533 }
534
535 ident = ZSTR_VAL(hash) + 1;
536 ident_end = strchr(ident, '$');
537 if (!ident_end) {
538 /* No terminating '$' */
539 return NULL;
540 }
541
542 return zend_string_init(ident, ident_end - ident, 0);
543 }
544
php_password_algo_identify_ex(const zend_string * hash,const php_password_algo * default_algo)545 const php_password_algo* php_password_algo_identify_ex(const zend_string* hash, const php_password_algo *default_algo) {
546 const php_password_algo *algo;
547 zend_string *ident = php_password_algo_extract_ident(hash);
548
549 if (!ident) {
550 return default_algo;
551 }
552
553 algo = php_password_algo_find(ident);
554 zend_string_release(ident);
555 return (!algo || (algo->valid && !algo->valid(hash))) ? default_algo : algo;
556 }
557
558 /* {{{ Retrieves information about a given hash */
PHP_FUNCTION(password_get_info)559 PHP_FUNCTION(password_get_info)
560 {
561 const php_password_algo *algo;
562 zend_string *hash, *ident;
563 zval options;
564
565 ZEND_PARSE_PARAMETERS_START(1, 1)
566 Z_PARAM_STR(hash)
567 ZEND_PARSE_PARAMETERS_END();
568
569 array_init(return_value);
570 array_init(&options);
571
572 ident = php_password_algo_extract_ident(hash);
573 algo = php_password_algo_find(ident);
574 if (!algo || (algo->valid && !algo->valid(hash))) {
575 if (ident) {
576 zend_string_release(ident);
577 }
578 add_assoc_null(return_value, "algo");
579 add_assoc_string(return_value, "algoName", "unknown");
580 add_assoc_zval(return_value, "options", &options);
581 return;
582 }
583
584 add_assoc_str(return_value, "algo", php_password_algo_extract_ident(hash));
585 zend_string_release(ident);
586
587 add_assoc_string(return_value, "algoName", algo->name);
588 if (algo->get_info) {
589 algo->get_info(&options, hash);
590 }
591 add_assoc_zval(return_value, "options", &options);
592 }
593 /** }}} */
594
595 /* {{{ Determines if a given hash requires re-hashing based upon parameters */
PHP_FUNCTION(password_needs_rehash)596 PHP_FUNCTION(password_needs_rehash)
597 {
598 const php_password_algo *old_algo, *new_algo;
599 zend_string *hash;
600 zend_string *new_algo_str;
601 zend_long new_algo_long;
602 bool new_algo_is_null;
603 zend_array *options = 0;
604
605 ZEND_PARSE_PARAMETERS_START(2, 3)
606 Z_PARAM_STR(hash)
607 Z_PARAM_STR_OR_LONG_OR_NULL(new_algo_str, new_algo_long, new_algo_is_null)
608 Z_PARAM_OPTIONAL
609 Z_PARAM_ARRAY_HT(options)
610 ZEND_PARSE_PARAMETERS_END();
611
612 new_algo = php_password_algo_find_zval(new_algo_str, new_algo_long, new_algo_is_null);
613 if (!new_algo) {
614 /* Unknown new algorithm, never prompt to rehash. */
615 RETURN_FALSE;
616 }
617
618 old_algo = php_password_algo_identify_ex(hash, NULL);
619 if (old_algo != new_algo) {
620 /* Different algorithm preferred, always rehash. */
621 RETURN_TRUE;
622 }
623
624 RETURN_BOOL(old_algo->needs_rehash(hash, options));
625 }
626 /* }}} */
627
628 /* {{{ Verify a hash created using crypt() or password_hash() */
PHP_FUNCTION(password_verify)629 PHP_FUNCTION(password_verify)
630 {
631 zend_string *password, *hash;
632 const php_password_algo *algo;
633
634 ZEND_PARSE_PARAMETERS_START(2, 2)
635 Z_PARAM_STR(password)
636 Z_PARAM_STR(hash)
637 ZEND_PARSE_PARAMETERS_END();
638
639 algo = php_password_algo_identify(hash);
640 RETURN_BOOL(algo && (!algo->verify || algo->verify(password, hash)));
641 }
642 /* }}} */
643
644 /* {{{ Hash a password */
PHP_FUNCTION(password_hash)645 PHP_FUNCTION(password_hash)
646 {
647 zend_string *password, *digest = NULL;
648 zend_string *algo_str;
649 zend_long algo_long;
650 bool algo_is_null;
651 const php_password_algo *algo;
652 zend_array *options = NULL;
653
654 ZEND_PARSE_PARAMETERS_START(2, 3)
655 Z_PARAM_STR(password)
656 Z_PARAM_STR_OR_LONG_OR_NULL(algo_str, algo_long, algo_is_null)
657 Z_PARAM_OPTIONAL
658 Z_PARAM_ARRAY_HT(options)
659 ZEND_PARSE_PARAMETERS_END();
660
661 algo = php_password_algo_find_zval(algo_str, algo_long, algo_is_null);
662 if (!algo) {
663 zend_argument_value_error(2, "must be a valid password hashing algorithm");
664 RETURN_THROWS();
665 }
666
667 digest = algo->hash(password, options);
668 if (!digest) {
669 if (!EG(exception)) {
670 zend_throw_error(NULL, "Password hashing failed for unknown reason");
671 }
672 RETURN_THROWS();
673 }
674
675 RETURN_NEW_STR(digest);
676 }
677 /* }}} */
678
679 /* {{{ */
PHP_FUNCTION(password_algos)680 PHP_FUNCTION(password_algos) {
681 zend_string *algo;
682
683 ZEND_PARSE_PARAMETERS_NONE();
684
685 array_init(return_value);
686 ZEND_HASH_FOREACH_STR_KEY(&php_password_algos, algo) {
687 add_next_index_str(return_value, zend_string_copy(algo));
688 } ZEND_HASH_FOREACH_END();
689 }
690 /* }}} */
691
