crypt.py 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113
  1. """Wrapper to the POSIX crypt library call and associated functionality."""
  2. import sys as _sys
  3. try:
  4. import _crypt
  5. except ModuleNotFoundError:
  6. if _sys.platform == 'win32':
  7. raise ImportError("The crypt module is not supported on Windows")
  8. else:
  9. raise ImportError("The required _crypt module was not built as part of CPython")
  10. import string as _string
  11. from random import SystemRandom as _SystemRandom
  12. from collections import namedtuple as _namedtuple
  13. _saltchars = _string.ascii_letters + _string.digits + './'
  14. _sr = _SystemRandom()
  15. class _Method(_namedtuple('_Method', 'name ident salt_chars total_size')):
  16. """Class representing a salt method per the Modular Crypt Format or the
  17. legacy 2-character crypt method."""
  18. def __repr__(self):
  19. return '<crypt.METHOD_{}>'.format(self.name)
  20. def mksalt(method=None, *, rounds=None):
  21. """Generate a salt for the specified method.
  22. If not specified, the strongest available method will be used.
  23. """
  24. if method is None:
  25. method = methods[0]
  26. if rounds is not None and not isinstance(rounds, int):
  27. raise TypeError(f'{rounds.__class__.__name__} object cannot be '
  28. f'interpreted as an integer')
  29. if not method.ident: # traditional
  30. s = ''
  31. else: # modular
  32. s = f'${method.ident}$'
  33. if method.ident and method.ident[0] == '2': # Blowfish variants
  34. if rounds is None:
  35. log_rounds = 12
  36. else:
  37. log_rounds = int.bit_length(rounds-1)
  38. if rounds != 1 << log_rounds:
  39. raise ValueError('rounds must be a power of 2')
  40. if not 4 <= log_rounds <= 31:
  41. raise ValueError('rounds out of the range 2**4 to 2**31')
  42. s += f'{log_rounds:02d}$'
  43. elif method.ident in ('5', '6'): # SHA-2
  44. if rounds is not None:
  45. if not 1000 <= rounds <= 999_999_999:
  46. raise ValueError('rounds out of the range 1000 to 999_999_999')
  47. s += f'rounds={rounds}$'
  48. elif rounds is not None:
  49. raise ValueError(f"{method} doesn't support the rounds argument")
  50. s += ''.join(_sr.choice(_saltchars) for char in range(method.salt_chars))
  51. return s
  52. def crypt(word, salt=None):
  53. """Return a string representing the one-way hash of a password, with a salt
  54. prepended.
  55. If ``salt`` is not specified or is ``None``, the strongest
  56. available method will be selected and a salt generated. Otherwise,
  57. ``salt`` may be one of the ``crypt.METHOD_*`` values, or a string as
  58. returned by ``crypt.mksalt()``.
  59. """
  60. if salt is None or isinstance(salt, _Method):
  61. salt = mksalt(salt)
  62. return _crypt.crypt(word, salt)
  63. # available salting/crypto methods
  64. methods = []
  65. def _add_method(name, *args, rounds=None):
  66. method = _Method(name, *args)
  67. globals()['METHOD_' + name] = method
  68. salt = mksalt(method, rounds=rounds)
  69. result = crypt('', salt)
  70. if result and len(result) == method.total_size:
  71. methods.append(method)
  72. return True
  73. return False
  74. _add_method('SHA512', '6', 16, 106)
  75. _add_method('SHA256', '5', 16, 63)
  76. # Choose the strongest supported version of Blowfish hashing.
  77. # Early versions have flaws. Version 'a' fixes flaws of
  78. # the initial implementation, 'b' fixes flaws of 'a'.
  79. # 'y' is the same as 'b', for compatibility
  80. # with openwall crypt_blowfish.
  81. for _v in 'b', 'y', 'a', '':
  82. if _add_method('BLOWFISH', '2' + _v, 22, 59 + len(_v), rounds=1<<4):
  83. break
  84. _add_method('MD5', '1', 8, 34)
  85. _add_method('CRYPT', None, 2, 13)
  86. del _v, _add_method