• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1"""Wrapper to the POSIX crypt library call and associated functionality."""
2
3import _crypt
4import string as _string
5from random import SystemRandom as _SystemRandom
6from collections import namedtuple as _namedtuple
7
8
9_saltchars = _string.ascii_letters + _string.digits + './'
10_sr = _SystemRandom()
11
12
13class _Method(_namedtuple('_Method', 'name ident salt_chars total_size')):
14
15    """Class representing a salt method per the Modular Crypt Format or the
16    legacy 2-character crypt method."""
17
18    def __repr__(self):
19        return '<crypt.METHOD_{}>'.format(self.name)
20
21
22def mksalt(method=None, *, rounds=None):
23    """Generate a salt for the specified method.
24
25    If not specified, the strongest available method will be used.
26
27    """
28    if method is None:
29        method = methods[0]
30    if rounds is not None and not isinstance(rounds, int):
31        raise TypeError(f'{rounds.__class__.__name__} object cannot be '
32                        f'interpreted as an integer')
33    if not method.ident:  # traditional
34        s = ''
35    else:  # modular
36        s = f'${method.ident}$'
37
38    if method.ident and method.ident[0] == '2':  # Blowfish variants
39        if rounds is None:
40            log_rounds = 12
41        else:
42            log_rounds = int.bit_length(rounds-1)
43            if rounds != 1 << log_rounds:
44                raise ValueError('rounds must be a power of 2')
45            if not 4 <= log_rounds <= 31:
46                raise ValueError('rounds out of the range 2**4 to 2**31')
47        s += f'{log_rounds:02d}$'
48    elif method.ident in ('5', '6'):  # SHA-2
49        if rounds is not None:
50            if not 1000 <= rounds <= 999_999_999:
51                raise ValueError('rounds out of the range 1000 to 999_999_999')
52            s += f'rounds={rounds}$'
53    elif rounds is not None:
54        raise ValueError(f"{method} doesn't support the rounds argument")
55
56    s += ''.join(_sr.choice(_saltchars) for char in range(method.salt_chars))
57    return s
58
59
60def crypt(word, salt=None):
61    """Return a string representing the one-way hash of a password, with a salt
62    prepended.
63
64    If ``salt`` is not specified or is ``None``, the strongest
65    available method will be selected and a salt generated.  Otherwise,
66    ``salt`` may be one of the ``crypt.METHOD_*`` values, or a string as
67    returned by ``crypt.mksalt()``.
68
69    """
70    if salt is None or isinstance(salt, _Method):
71        salt = mksalt(salt)
72    return _crypt.crypt(word, salt)
73
74
75#  available salting/crypto methods
76methods = []
77
78def _add_method(name, *args, rounds=None):
79    method = _Method(name, *args)
80    globals()['METHOD_' + name] = method
81    salt = mksalt(method, rounds=rounds)
82    result = crypt('', salt)
83    if result and len(result) == method.total_size:
84        methods.append(method)
85        return True
86    return False
87
88_add_method('SHA512', '6', 16, 106)
89_add_method('SHA256', '5', 16, 63)
90
91# Choose the strongest supported version of Blowfish hashing.
92# Early versions have flaws.  Version 'a' fixes flaws of
93# the initial implementation, 'b' fixes flaws of 'a'.
94# 'y' is the same as 'b', for compatibility
95# with openwall crypt_blowfish.
96for _v in 'b', 'y', 'a', '':
97    if _add_method('BLOWFISH', '2' + _v, 22, 59 + len(_v), rounds=1<<4):
98        break
99
100_add_method('MD5', '1', 8, 34)
101_add_method('CRYPT', None, 2, 13)
102
103del _v, _add_method
104