Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SHA2, :smd5, :sha1 & :ssha1 password generation support #201

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add SHA2, :smd5, :sha1 & :ssha1 password generation support #201

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 13 additions & 17 deletions lib/net/ldap/password.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,33 +6,29 @@

class Net::LDAP::Password
class << self
KNOWN = [:md5, :sha, :sha1, :sha256, :sha384, :sha512]
# Generate a password-hash suitable for inclusion in an LDAP attribute.
# Pass a hash type as a symbol (:md5, :sha, :ssha) and a plaintext
# password. This function will return a hashed representation.
#
#--
# STUB: This is here to fulfill the requirements of an RFC, which
# one?
#
# TODO:
# * maybe salted-md5
# * Should we provide sha1 as a synonym for sha1? I vote no because then
# should you also provide ssha1 for symmetry?
#
attribute_value = ""
def generate(type, str)
case type
when :md5
attribute_value = '{MD5}' + Base64.encode64(Digest::MD5.digest(str)).chomp!
when :sha
attribute_value = '{SHA}' + Base64.encode64(Digest::SHA1.digest(str)).chomp!
when :ssha
salt = SecureRandom.random_bytes(16)
attribute_value = '{SSHA}' + Base64.encode64(Digest::SHA1.digest(str + salt) + salt).chomp!
if KNOWN.include?(type)
digest = type.to_s
salt = ''
elsif type[0] == 's' && KNOWN.include?(type[1..-1].to_sym)
digest = type[1..-1]
salt = SecureRandom.random_bytes(16)
else
raise Net::LDAP::HashTypeUnsupportedError, "Unsupported password-hash type (#{type})"
fail Net::LDAP::HashTypeUnsupportedError,
"Unsupported password-hash type (#{type})"
end
return attribute_value
digest = 'sha1' if digest == 'sha'
type = (type == :sha1 ? :sha : :ssha) if type[-4, 4] == 'sha1'
algo = Digest.module_eval(digest.upcase)
"{#{type.upcase}}#{Base64.encode64(algo.digest(str + salt) + salt).chomp}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we keep the same pattern here without introducing a KNOWN constant? Yes, there is more duplication, but it's simpler to reason about in my opinion and more obvious to grep for than hiding the information via lookups and module_evals.

end
end
end