1 /*
2 +----------------------------------------------------------------------+
3 | Copyright (c) The PHP Group |
4 +----------------------------------------------------------------------+
5 | This source file is subject to version 3.01 of the PHP license, |
6 | that is bundled with this package in the file LICENSE, and is |
7 | available through the world-wide-web at the following url: |
8 | https://www.php.net/license/3_01.txt |
9 | If you did not receive a copy of the PHP license and are unable to |
10 | obtain it through the world-wide-web, please send a note to |
11 | license@php.net so we can mail you a copy immediately. |
12 +----------------------------------------------------------------------+
13 | Authors: Anthony Ferrara <ircmaxell@php.net> |
14 | Charles R. Portwood II <charlesportwoodii@erianna.com> |
15 +----------------------------------------------------------------------+
16 */
17
18 #include <stdlib.h>
19
20 #include "php.h"
21
22 #include "fcntl.h"
23 #include "php_password.h"
24 #include "php_crypt.h"
25 #include "base64.h"
26 #include "zend_interfaces.h"
27 #include "info.h"
28 #include "ext/random/php_random.h"
29 #ifdef HAVE_ARGON2LIB
30 #include "argon2.h"
31 #endif
32
33 #ifdef PHP_WIN32
34 #include "win32/winutil.h"
35 #endif
36
37 static zend_array php_password_algos;
38
php_password_algo_register(const char * ident,const php_password_algo * algo)39 int php_password_algo_register(const char *ident, const php_password_algo *algo) {
40 zend_string *key = zend_string_init_interned(ident, strlen(ident), 1);
41 return zend_hash_add_ptr(&php_password_algos, key, (void *) algo) ? SUCCESS : FAILURE;
42 }
43
php_password_algo_unregister(const char * ident)44 void php_password_algo_unregister(const char *ident) {
45 zend_hash_str_del(&php_password_algos, ident, strlen(ident));
46 }
47
php_password_salt_to64(const char * str,const size_t str_len,const size_t out_len,char * ret)48 static int php_password_salt_to64(const char *str, const size_t str_len, const size_t out_len, char *ret) /* {{{ */
49 {
50 size_t pos = 0;
51 zend_string *buffer;
52 if ((int) str_len < 0) {
53 return FAILURE;
54 }
55 buffer = php_base64_encode((unsigned char*) str, str_len);
56 if (ZSTR_LEN(buffer) < out_len) {
57 /* Too short of an encoded string generated */
58 zend_string_release_ex(buffer, 0);
59 return FAILURE;
60 }
61 for (pos = 0; pos < out_len; pos++) {
62 if (ZSTR_VAL(buffer)[pos] == '+') {
63 ret[pos] = '.';
64 } else if (ZSTR_VAL(buffer)[pos] == '=') {
65 zend_string_free(buffer);
66 return FAILURE;
67 } else {
68 ret[pos] = ZSTR_VAL(buffer)[pos];
69 }
70 }
71 zend_string_free(buffer);
72 return SUCCESS;
73 }
74 /* }}} */
75
php_password_make_salt(size_t length)76 static zend_string* php_password_make_salt(size_t length) /* {{{ */
77 {
78 zend_string *ret, *buffer;
79
80 if (length > (INT_MAX / 3)) {
81 zend_value_error("Length is too large to safely generate");
82 return NULL;
83 }
84
85 buffer = zend_string_alloc(length * 3 / 4 + 1, 0);
86 if (FAILURE == php_random_bytes_silent(ZSTR_VAL(buffer), ZSTR_LEN(buffer))) {
87 zend_value_error("Unable to generate salt");
88 zend_string_release_ex(buffer, 0);
89 return NULL;
90 }
91
92 ret = zend_string_alloc(length, 0);
93 if (php_password_salt_to64(ZSTR_VAL(buffer), ZSTR_LEN(buffer), length, ZSTR_VAL(ret)) == FAILURE) {
94 zend_value_error("Generated salt too short");
95 zend_string_release_ex(buffer, 0);
96 zend_string_release_ex(ret, 0);
97 return NULL;
98 }
99 zend_string_release_ex(buffer, 0);
100 ZSTR_VAL(ret)[length] = 0;
101 return ret;
102 }
103 /* }}} */
104
php_password_get_salt(zval * unused_,size_t required_salt_len,HashTable * options)105 static zend_string* php_password_get_salt(zval *unused_, size_t required_salt_len, HashTable *options) {
106 if (options && zend_hash_str_exists(options, "salt", sizeof("salt") - 1)) {
107 php_error_docref(NULL, E_WARNING, "The \"salt\" option has been ignored, since providing a custom salt is no longer supported");
108 }
109
110 return php_password_make_salt(required_salt_len);
111 }
112
113 /* bcrypt implementation */
114
php_password_bcrypt_valid(const zend_string * hash)115 static bool php_password_bcrypt_valid(const zend_string *hash) {
116 const char *h = ZSTR_VAL(hash);
117 return (ZSTR_LEN(hash) == 60) &&
118 (h[0] == '$') && (h[1] == '2') && (h[2] == 'y');
119 }
120
php_password_bcrypt_get_info(zval * return_value,const zend_string * hash)121 static int php_password_bcrypt_get_info(zval *return_value, const zend_string *hash) {
122 zend_long cost = PHP_PASSWORD_BCRYPT_COST;
123
124 if (!php_password_bcrypt_valid(hash)) {
125 /* Should never get called this way. */
126 return FAILURE;
127 }
128
129 sscanf(ZSTR_VAL(hash), "$2y$" ZEND_LONG_FMT "$", &cost);
130 add_assoc_long(return_value, "cost", cost);
131
132 return SUCCESS;
133 }
134
php_password_bcrypt_needs_rehash(const zend_string * hash,zend_array * options)135 static bool php_password_bcrypt_needs_rehash(const zend_string *hash, zend_array *options) {
136 zval *znew_cost;
137 zend_long old_cost = PHP_PASSWORD_BCRYPT_COST;
138 zend_long new_cost = PHP_PASSWORD_BCRYPT_COST;
139
140 if (!php_password_bcrypt_valid(hash)) {
141 /* Should never get called this way. */
142 return 1;
143 }
144
145 sscanf(ZSTR_VAL(hash), "$2y$" ZEND_LONG_FMT "$", &old_cost);
146 if (options && (znew_cost = zend_hash_str_find(options, "cost", sizeof("cost")-1)) != NULL) {
147 new_cost = zval_get_long(znew_cost);
148 }
149
150 return old_cost != new_cost;
151 }
152
php_password_bcrypt_verify(const zend_string * password,const zend_string * hash)153 static bool php_password_bcrypt_verify(const zend_string *password, const zend_string *hash) {
154 int status = 0;
155 zend_string *ret = php_crypt(ZSTR_VAL(password), (int)ZSTR_LEN(password), ZSTR_VAL(hash), (int)ZSTR_LEN(hash), 1);
156
157 if (!ret) {
158 return 0;
159 }
160
161 if (ZSTR_LEN(hash) < 13) {
162 zend_string_free(ret);
163 return 0;
164 }
165
166 /* We're using this method instead of == in order to provide
167 * resistance towards timing attacks. This is a constant time
168 * equality check that will always check every byte of both
169 * values. */
170 status = php_safe_bcmp(ret, hash);
171
172 zend_string_free(ret);
173 return status == 0;
174 }
175
php_password_bcrypt_hash(const zend_string * password,zend_array * options)176 static zend_string* php_password_bcrypt_hash(const zend_string *password, zend_array *options) {
177 char hash_format[10];
178 size_t hash_format_len;
179 zend_string *result, *hash, *salt;
180 zval *zcost;
181 zend_long cost = PHP_PASSWORD_BCRYPT_COST;
182
183 if (memchr(ZSTR_VAL(password), '\0', ZSTR_LEN(password))) {
184 zend_value_error("Bcrypt password must not contain null character");
185 return NULL;
186 }
187
188 if (options && (zcost = zend_hash_str_find(options, "cost", sizeof("cost")-1)) != NULL) {
189 cost = zval_get_long(zcost);
190 }
191
192 if (cost < 4 || cost > 31) {
193 zend_value_error("Invalid bcrypt cost parameter specified: " ZEND_LONG_FMT, cost);
194 return NULL;
195 }
196
197 hash_format_len = snprintf(hash_format, sizeof(hash_format), "$2y$%02" ZEND_LONG_FMT_SPEC "$", cost);
198 if (!(salt = php_password_get_salt(NULL, Z_UL(22), options))) {
199 return NULL;
200 }
201 ZSTR_VAL(salt)[ZSTR_LEN(salt)] = 0;
202
203 hash = zend_string_alloc(ZSTR_LEN(salt) + hash_format_len, 0);
204 sprintf(ZSTR_VAL(hash), "%s%s", hash_format, ZSTR_VAL(salt));
205 ZSTR_VAL(hash)[hash_format_len + ZSTR_LEN(salt)] = 0;
206
207 zend_string_release_ex(salt, 0);
208
209 /* This cast is safe, since both values are defined here in code and cannot overflow */
210 result = php_crypt(ZSTR_VAL(password), (int)ZSTR_LEN(password), ZSTR_VAL(hash), (int)ZSTR_LEN(hash), 1);
211 zend_string_release_ex(hash, 0);
212
213 if (!result) {
214 return NULL;
215 }
216
217 if (ZSTR_LEN(result) < 13) {
218 zend_string_free(result);
219 return NULL;
220 }
221
222 return result;
223 }
224
225 const php_password_algo php_password_algo_bcrypt = {
226 "bcrypt",
227 php_password_bcrypt_hash,
228 php_password_bcrypt_verify,
229 php_password_bcrypt_needs_rehash,
230 php_password_bcrypt_get_info,
231 php_password_bcrypt_valid,
232 };
233
234
235 #ifdef HAVE_ARGON2LIB
236 /* argon2i/argon2id shared implementation */
237
extract_argon2_parameters(const zend_string * hash,zend_long * v,zend_long * memory_cost,zend_long * time_cost,zend_long * threads)238 static int extract_argon2_parameters(const zend_string *hash,
239 zend_long *v, zend_long *memory_cost,
240 zend_long *time_cost, zend_long *threads) /* {{{ */
241 {
242 const char *p = ZSTR_VAL(hash);
243 if (!hash || (ZSTR_LEN(hash) < sizeof("$argon2id$"))) {
244 return FAILURE;
245 }
246 if (!memcmp(p, "$argon2i$", sizeof("$argon2i$") - 1)) {
247 p += sizeof("$argon2i$") - 1;
248 } else if (!memcmp(p, "$argon2id$", sizeof("$argon2id$") - 1)) {
249 p += sizeof("$argon2id$") - 1;
250 } else {
251 return FAILURE;
252 }
253
254 sscanf(p, "v=" ZEND_LONG_FMT "$m=" ZEND_LONG_FMT ",t=" ZEND_LONG_FMT ",p=" ZEND_LONG_FMT,
255 v, memory_cost, time_cost, threads);
256
257 return SUCCESS;
258 }
259 /* }}} */
260
php_password_argon2_get_info(zval * return_value,const zend_string * hash)261 static int php_password_argon2_get_info(zval *return_value, const zend_string *hash) {
262 zend_long v = 0;
263 zend_long memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST;
264 zend_long time_cost = PHP_PASSWORD_ARGON2_TIME_COST;
265 zend_long threads = PHP_PASSWORD_ARGON2_THREADS;
266
267 extract_argon2_parameters(hash, &v, &memory_cost, &time_cost, &threads);
268
269 add_assoc_long(return_value, "memory_cost", memory_cost);
270 add_assoc_long(return_value, "time_cost", time_cost);
271 add_assoc_long(return_value, "threads", threads);
272
273 return SUCCESS;
274 }
275
php_password_argon2_needs_rehash(const zend_string * hash,zend_array * options)276 static bool php_password_argon2_needs_rehash(const zend_string *hash, zend_array *options) {
277 zend_long v = 0;
278 zend_long new_memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST, memory_cost = 0;
279 zend_long new_time_cost = PHP_PASSWORD_ARGON2_TIME_COST, time_cost = 0;
280 zend_long new_threads = PHP_PASSWORD_ARGON2_THREADS, threads = 0;
281 zval *option_buffer;
282
283 if (options && (option_buffer = zend_hash_str_find(options, "memory_cost", sizeof("memory_cost")-1)) != NULL) {
284 new_memory_cost = zval_get_long(option_buffer);
285 }
286
287 if (options && (option_buffer = zend_hash_str_find(options, "time_cost", sizeof("time_cost")-1)) != NULL) {
288 new_time_cost = zval_get_long(option_buffer);
289 }
290
291 if (options && (option_buffer = zend_hash_str_find(options, "threads", sizeof("threads")-1)) != NULL) {
292 new_threads = zval_get_long(option_buffer);
293 }
294
295 extract_argon2_parameters(hash, &v, &memory_cost, &time_cost, &threads);
296
297 return (new_time_cost != time_cost) ||
298 (new_memory_cost != memory_cost) ||
299 (new_threads != threads);
300 }
301
php_password_argon2_hash(const zend_string * password,zend_array * options,argon2_type type)302 static zend_string *php_password_argon2_hash(const zend_string *password, zend_array *options, argon2_type type) {
303 zval *option_buffer;
304 zend_string *salt, *out, *encoded;
305 size_t time_cost = PHP_PASSWORD_ARGON2_TIME_COST;
306 size_t memory_cost = PHP_PASSWORD_ARGON2_MEMORY_COST;
307 size_t threads = PHP_PASSWORD_ARGON2_THREADS;
308 size_t encoded_len;
309 int status = 0;
310
311 if (options && (option_buffer = zend_hash_str_find(options, "memory_cost", sizeof("memory_cost")-1)) != NULL) {
312 memory_cost = zval_get_long(option_buffer);
313 }
314
315 if (memory_cost > ARGON2_MAX_MEMORY || memory_cost < ARGON2_MIN_MEMORY) {
316 zend_value_error("Memory cost is outside of allowed memory range");
317 return NULL;
318 }
319
320 if (options && (option_buffer = zend_hash_str_find(options, "time_cost", sizeof("time_cost")-1)) != NULL) {
321 time_cost = zval_get_long(option_buffer);
322 }
323
324 if (time_cost > ARGON2_MAX_TIME || time_cost < ARGON2_MIN_TIME) {
325 zend_value_error("Time cost is outside of allowed time range");
326 return NULL;
327 }
328
329 if (options && (option_buffer = zend_hash_str_find(options, "threads", sizeof("threads")-1)) != NULL) {
330 threads = zval_get_long(option_buffer);
331 }
332
333 if (threads > ARGON2_MAX_LANES || threads == 0) {
334 zend_value_error("Invalid number of threads");
335 return NULL;
336 }
337
338 if (!(salt = php_password_get_salt(NULL, Z_UL(16), options))) {
339 return NULL;
340 }
341
342 out = zend_string_alloc(32, 0);
343 encoded_len = argon2_encodedlen(
344 time_cost,
345 memory_cost,
346 threads,
347 (uint32_t)ZSTR_LEN(salt),
348 ZSTR_LEN(out),
349 type
350 );
351
352 encoded = zend_string_alloc(encoded_len - 1, 0);
353 status = argon2_hash(
354 time_cost,
355 memory_cost,
356 threads,
357 ZSTR_VAL(password),
358 ZSTR_LEN(password),
359 ZSTR_VAL(salt),
360 ZSTR_LEN(salt),
361 ZSTR_VAL(out),
362 ZSTR_LEN(out),
363 ZSTR_VAL(encoded),
364 encoded_len,
365 type,
366 ARGON2_VERSION_NUMBER
367 );
368
369 zend_string_release_ex(out, 0);
370 zend_string_release_ex(salt, 0);
371
372 if (status != ARGON2_OK) {
373 zend_string_efree(encoded);
374 zend_value_error("%s", argon2_error_message(status));
375 return NULL;
376 }
377
378 ZSTR_VAL(encoded)[ZSTR_LEN(encoded)] = 0;
379 return encoded;
380 }
381
382 /* argon2i specific methods */
383
php_password_argon2i_verify(const zend_string * password,const zend_string * hash)384 static bool php_password_argon2i_verify(const zend_string *password, const zend_string *hash) {
385 return ARGON2_OK == argon2_verify(ZSTR_VAL(hash), ZSTR_VAL(password), ZSTR_LEN(password), Argon2_i);
386 }
387
php_password_argon2i_hash(const zend_string * password,zend_array * options)388 static zend_string *php_password_argon2i_hash(const zend_string *password, zend_array *options) {
389 return php_password_argon2_hash(password, options, Argon2_i);
390 }
391
392 const php_password_algo php_password_algo_argon2i = {
393 "argon2i",
394 php_password_argon2i_hash,
395 php_password_argon2i_verify,
396 php_password_argon2_needs_rehash,
397 php_password_argon2_get_info,
398 NULL,
399 };
400
401 /* argon2id specific methods */
402
php_password_argon2id_verify(const zend_string * password,const zend_string * hash)403 static bool php_password_argon2id_verify(const zend_string *password, const zend_string *hash) {
404 return ARGON2_OK == argon2_verify(ZSTR_VAL(hash), ZSTR_VAL(password), ZSTR_LEN(password), Argon2_id);
405 }
406
php_password_argon2id_hash(const zend_string * password,zend_array * options)407 static zend_string *php_password_argon2id_hash(const zend_string *password, zend_array *options) {
408 return php_password_argon2_hash(password, options, Argon2_id);
409 }
410
411 const php_password_algo php_password_algo_argon2id = {
412 "argon2id",
413 php_password_argon2id_hash,
414 php_password_argon2id_verify,
415 php_password_argon2_needs_rehash,
416 php_password_argon2_get_info,
417 NULL,
418 };
419 #endif
420
PHP_MINIT_FUNCTION(password)421 PHP_MINIT_FUNCTION(password) /* {{{ */
422 {
423 zend_hash_init(&php_password_algos, 4, NULL, ZVAL_PTR_DTOR, 1);
424 REGISTER_STRING_CONSTANT("PASSWORD_DEFAULT", "2y", CONST_CS | CONST_PERSISTENT);
425
426 if (FAILURE == php_password_algo_register("2y", &php_password_algo_bcrypt)) {
427 return FAILURE;
428 }
429 REGISTER_STRING_CONSTANT("PASSWORD_BCRYPT", "2y", CONST_CS | CONST_PERSISTENT);
430
431 #ifdef HAVE_ARGON2LIB
432 if (FAILURE == php_password_algo_register("argon2i", &php_password_algo_argon2i)) {
433 return FAILURE;
434 }
435 REGISTER_STRING_CONSTANT("PASSWORD_ARGON2I", "argon2i", CONST_CS | CONST_PERSISTENT);
436
437 if (FAILURE == php_password_algo_register("argon2id", &php_password_algo_argon2id)) {
438 return FAILURE;
439 }
440 REGISTER_STRING_CONSTANT("PASSWORD_ARGON2ID", "argon2id", CONST_CS | CONST_PERSISTENT);
441 #endif
442
443 REGISTER_LONG_CONSTANT("PASSWORD_BCRYPT_DEFAULT_COST", PHP_PASSWORD_BCRYPT_COST, CONST_CS | CONST_PERSISTENT);
444 #ifdef HAVE_ARGON2LIB
445 REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_MEMORY_COST", PHP_PASSWORD_ARGON2_MEMORY_COST, CONST_CS | CONST_PERSISTENT);
446 REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_TIME_COST", PHP_PASSWORD_ARGON2_TIME_COST, CONST_CS | CONST_PERSISTENT);
447 REGISTER_LONG_CONSTANT("PASSWORD_ARGON2_DEFAULT_THREADS", PHP_PASSWORD_ARGON2_THREADS, CONST_CS | CONST_PERSISTENT);
448
449 REGISTER_STRING_CONSTANT("PASSWORD_ARGON2_PROVIDER", "standard", CONST_CS | CONST_PERSISTENT);
450 #endif
451
452 return SUCCESS;
453 }
454 /* }}} */
455
PHP_MSHUTDOWN_FUNCTION(password)456 PHP_MSHUTDOWN_FUNCTION(password) /* {{{ */
457 {
458 #ifdef ZTS
459 if (!tsrm_is_main_thread()) {
460 return SUCCESS;
461 }
462 #endif
463 zend_hash_destroy(&php_password_algos);
464 return SUCCESS;
465 }
466 /* }}} */
467
php_password_algo_default(void)468 const php_password_algo* php_password_algo_default(void) {
469 return &php_password_algo_bcrypt;
470 }
471
php_password_algo_find(const zend_string * ident)472 const php_password_algo* php_password_algo_find(const zend_string *ident) {
473 zval *tmp;
474
475 if (!ident) {
476 return NULL;
477 }
478
479 tmp = zend_hash_find(&php_password_algos, (zend_string*)ident);
480 if (!tmp || (Z_TYPE_P(tmp) != IS_PTR)) {
481 return NULL;
482 }
483
484 return Z_PTR_P(tmp);
485 }
486
php_password_algo_find_zval(zend_string * arg_str,zend_long arg_long,bool arg_is_null)487 static const php_password_algo* php_password_algo_find_zval(zend_string *arg_str, zend_long arg_long, bool arg_is_null) {
488 if (arg_is_null) {
489 return php_password_algo_default();
490 }
491
492 if (arg_str) {
493 return php_password_algo_find(arg_str);
494 }
495
496 switch (arg_long) {
497 case 0: return php_password_algo_default();
498 case 1: return &php_password_algo_bcrypt;
499 #ifdef HAVE_ARGON2LIB
500 case 2: return &php_password_algo_argon2i;
501 case 3: return &php_password_algo_argon2id;
502 #else
503 case 2:
504 {
505 zend_string *n = zend_string_init("argon2i", sizeof("argon2i")-1, 0);
506 const php_password_algo* ret = php_password_algo_find(n);
507 zend_string_release(n);
508 return ret;
509 }
510 case 3:
511 {
512 zend_string *n = zend_string_init("argon2id", sizeof("argon2id")-1, 0);
513 const php_password_algo* ret = php_password_algo_find(n);
514 zend_string_release(n);
515 return ret;
516 }
517 #endif
518 }
519
520 return NULL;
521 }
522
php_password_algo_extract_ident(const zend_string * hash)523 zend_string *php_password_algo_extract_ident(const zend_string* hash) {
524 const char *ident, *ident_end;
525
526 if (!hash || ZSTR_LEN(hash) < 3) {
527 /* Minimum prefix: "$x$" */
528 return NULL;
529 }
530
531 ident = ZSTR_VAL(hash) + 1;
532 ident_end = strchr(ident, '$');
533 if (!ident_end) {
534 /* No terminating '$' */
535 return NULL;
536 }
537
538 return zend_string_init(ident, ident_end - ident, 0);
539 }
540
php_password_algo_identify_ex(const zend_string * hash,const php_password_algo * default_algo)541 const php_password_algo* php_password_algo_identify_ex(const zend_string* hash, const php_password_algo *default_algo) {
542 const php_password_algo *algo;
543 zend_string *ident = php_password_algo_extract_ident(hash);
544
545 if (!ident) {
546 return default_algo;
547 }
548
549 algo = php_password_algo_find(ident);
550 zend_string_release(ident);
551 return (!algo || (algo->valid && !algo->valid(hash))) ? default_algo : algo;
552 }
553
554 /* {{{ Retrieves information about a given hash */
PHP_FUNCTION(password_get_info)555 PHP_FUNCTION(password_get_info)
556 {
557 const php_password_algo *algo;
558 zend_string *hash, *ident;
559 zval options;
560
561 ZEND_PARSE_PARAMETERS_START(1, 1)
562 Z_PARAM_STR(hash)
563 ZEND_PARSE_PARAMETERS_END();
564
565 array_init(return_value);
566 array_init(&options);
567
568 ident = php_password_algo_extract_ident(hash);
569 algo = php_password_algo_find(ident);
570 if (!algo || (algo->valid && !algo->valid(hash))) {
571 if (ident) {
572 zend_string_release(ident);
573 }
574 add_assoc_null(return_value, "algo");
575 add_assoc_string(return_value, "algoName", "unknown");
576 add_assoc_zval(return_value, "options", &options);
577 return;
578 }
579
580 add_assoc_str(return_value, "algo", php_password_algo_extract_ident(hash));
581 zend_string_release(ident);
582
583 add_assoc_string(return_value, "algoName", algo->name);
584 if (algo->get_info) {
585 algo->get_info(&options, hash);
586 }
587 add_assoc_zval(return_value, "options", &options);
588 }
589 /** }}} */
590
591 /* {{{ Determines if a given hash requires re-hashing based upon parameters */
PHP_FUNCTION(password_needs_rehash)592 PHP_FUNCTION(password_needs_rehash)
593 {
594 const php_password_algo *old_algo, *new_algo;
595 zend_string *hash;
596 zend_string *new_algo_str;
597 zend_long new_algo_long = 0;
598 bool new_algo_is_null;
599 zend_array *options = 0;
600
601 ZEND_PARSE_PARAMETERS_START(2, 3)
602 Z_PARAM_STR(hash)
603 Z_PARAM_STR_OR_LONG_OR_NULL(new_algo_str, new_algo_long, new_algo_is_null)
604 Z_PARAM_OPTIONAL
605 Z_PARAM_ARRAY_HT(options)
606 ZEND_PARSE_PARAMETERS_END();
607
608 new_algo = php_password_algo_find_zval(new_algo_str, new_algo_long, new_algo_is_null);
609 if (!new_algo) {
610 /* Unknown new algorithm, never prompt to rehash. */
611 RETURN_FALSE;
612 }
613
614 old_algo = php_password_algo_identify_ex(hash, NULL);
615 if (old_algo != new_algo) {
616 /* Different algorithm preferred, always rehash. */
617 RETURN_TRUE;
618 }
619
620 RETURN_BOOL(old_algo->needs_rehash(hash, options));
621 }
622 /* }}} */
623
624 /* {{{ Verify a hash created using crypt() or password_hash() */
PHP_FUNCTION(password_verify)625 PHP_FUNCTION(password_verify)
626 {
627 zend_string *password, *hash;
628 const php_password_algo *algo;
629
630 ZEND_PARSE_PARAMETERS_START(2, 2)
631 Z_PARAM_STR(password)
632 Z_PARAM_STR(hash)
633 ZEND_PARSE_PARAMETERS_END();
634
635 algo = php_password_algo_identify(hash);
636 RETURN_BOOL(algo && (!algo->verify || algo->verify(password, hash)));
637 }
638 /* }}} */
639
640 /* {{{ Hash a password */
PHP_FUNCTION(password_hash)641 PHP_FUNCTION(password_hash)
642 {
643 zend_string *password, *digest = NULL;
644 zend_string *algo_str;
645 zend_long algo_long = 0;
646 bool algo_is_null;
647 const php_password_algo *algo;
648 zend_array *options = NULL;
649
650 ZEND_PARSE_PARAMETERS_START(2, 3)
651 Z_PARAM_STR(password)
652 Z_PARAM_STR_OR_LONG_OR_NULL(algo_str, algo_long, algo_is_null)
653 Z_PARAM_OPTIONAL
654 Z_PARAM_ARRAY_HT(options)
655 ZEND_PARSE_PARAMETERS_END();
656
657 algo = php_password_algo_find_zval(algo_str, algo_long, algo_is_null);
658 if (!algo) {
659 zend_argument_value_error(2, "must be a valid password hashing algorithm");
660 RETURN_THROWS();
661 }
662
663 digest = algo->hash(password, options);
664 if (!digest) {
665 if (!EG(exception)) {
666 zend_throw_error(NULL, "Password hashing failed for unknown reason");
667 }
668 RETURN_THROWS();
669 }
670
671 RETURN_NEW_STR(digest);
672 }
673 /* }}} */
674
675 /* {{{ */
PHP_FUNCTION(password_algos)676 PHP_FUNCTION(password_algos) {
677 zend_string *algo;
678
679 ZEND_PARSE_PARAMETERS_NONE();
680
681 array_init(return_value);
682 ZEND_HASH_MAP_FOREACH_STR_KEY(&php_password_algos, algo) {
683 add_next_index_str(return_value, zend_string_copy(algo));
684 } ZEND_HASH_FOREACH_END();
685 }
686 /* }}} */
687
