topic Re: can't get new crypt2() function to work in Operating System - HP-UX

can't get new crypt2() function to work

d miller_2 — Mon, 21 Sep 2009 18:56:34 GMT

Hello,

I've been reading about the new crypt2 library introduced by the PHI11i3 bundle, which enabled SHA512 password hashing. I'm trying to understand exactly what the new libraries do, but get can't get my test programs to compile. Here's what I get an 'ld: Unsatisfied symbol "crypt2"' error every time I try to compile my program. Here's what I did:

# swlist PHI11i3
# Initializing...
# Contacting target "rx16u831"...
#
# Target: rx16u831:/
#
# PHI11i3 B.11.31.02 HP-UX 11.31 Password Hashing Infrastructure
PHI11i3.SHA11i3 B.11.31.02 HP-UX 11.31 SHA11i3 Product

# cat /tmp/encrypter.c
#include
#include
main()
{
char *result;
result=crypt2("aa","user1");
printf("\nThe password hash is %s\n", result);
}

# cc -Llibsec encrypter.c -o encrypter
ld: Unsatisfied symbol "crypt2" in file encrypter.o
1 errors.

I'm guessing that I need to specify another -L, but I'm not sure what it should be.

Thanks in advance for your help.

Darren

Re: can't get new crypt2() function to work

James R. Ferguson — Mon, 21 Sep 2009 19:09:21 GMT

Hi Darren:

I don't have 11.31 available nor do I have the PHI product for 11.23 installed, but at least in earlier interfaces you should have specified:

#include

Regards!

...JRF...

Re: can't get new crypt2() function to work

d miller_2 — Mon, 21 Sep 2009 19:14:21 GMT

James,

I added "#include ", but still no luck. Thanks for taking a look.

Regards,
Darren

Re: can't get new crypt2() function to work

James R. Ferguson — Mon, 21 Sep 2009 19:19:30 GMT

Hi (again) Darren:

Try looking for a 'crypt2' header:

# find /usr/include -type f -name "crypt*"

Regards!

...JRF...

Re: can't get new crypt2() function to work

d miller_2 — Mon, 21 Sep 2009 19:28:54 GMT

James,

I tried two variations on the find command, but the files found were already included in my program.

# find /usr/include -type f -name "crypt*"
/usr/include/crypt.h

# find /usr/include -type f -exec grep -l crypt2 {} \;
/usr/include/prot.h

# cat encrypter.c
#include
#include
#include
main()
{
char *result;
result=crypt2("aa","user1");
printf("\nThe password hash is %s\n", result);
}

# cc encrypter.c -o encrypter
ld: Unsatisfied symbol "crypt2" in file encrypter.o
1 errors.

Thanks again,
Darren

Re: can't get new crypt2() function to work

Olivier Masse — Mon, 21 Sep 2009 22:49:21 GMT

Try "swlist -l file PHI11i3" as root to see what files are included in the package, this could give you a hint on what needs to be included.

Good luck

Re: can't get new crypt2() function to work

d miller_2 — Tue, 22 Sep 2009 01:41:30 GMT

Olivier,

Good idea. I actually did try that earlier, but no luck. The product appears to simply deliver a man page and a toggle file to enable the functionality. I wonder if the functionality was there in the original 11i v3 release but wasn't enabled because it hadn't been fully tested(?). Seems strange. The functionality does work, though. If I change a user's password, the resulting ciphertext is much longer than it was in the past.

Darren

# swlist -l file PHI11i3
# Initializing...
# Contacting target "rx16u831"...
#
# Target: rx16u831:/
#
# PHI11i3 B.11.31.02 HP-UX 11.31 Password Hashing Infrastructure
# PHI11i3.SHA11i3 B.11.31.02 HP-UX 11.31 SHA11i3 Product
# PHI11i3.SHA11i3.SHA-CONF B.11.31.02 SHA11i3 Configuration Files
PHI11i3.SHA11i3.SHA-CONF: /etc/default/ENABLE_CRYPT_ENHANCEMENT
# PHI11i3.SHA11i3.SHA-ENG-A-MAN B.11.31.02 SHA11i3 English Manpages
PHI11i3.SHA11i3.SHA-ENG-A-MAN: /usr/share/man/man3.Z/crypt2.3c

Re: can't get new crypt2() function to work

kobylka — Wed, 23 Sep 2009 13:29:45 GMT

Hello Darren!

Assuming the PHI11i3 bundle is correctly installed ( https://h20392.www2.hp.com/portal/swdepot/displayInstallInfo.do?productNumber=PHI11i3 )

you could try this:

1. Take a look at prot.h (and if you were so kind please attach it in next post since I have no 11i v3) to see how crypt2 is included, declared, defined.

2. Do brute force on symbol matching in libs:

find / -name '*.sl' -exec nm {} \; -print | grep -i -e crypt2 -e '^/' | more

Note the *.sl for PA-RISC (use *.so for IPF). If you're sure all your libs are only in /usr/lib and /opt:

for l in /usr/lib /opt
do
find $l -name '*.sl' -exec nm {} \; -print | grep -i -e crypt2 -e '^/'
done

If the symbol is there, it will show up...

Kind regards,

Kobylka

Re: can't get new crypt2() function to work

d miller_2 — Wed, 23 Sep 2009 14:53:11 GMT

Kobylka,

THanks so much for looking at my issue! I ran the for loop as you suggested and got a long list of several hundred file paths. I think these might be the pertinent lines:

/usr/lib/hpux32/librwtool_v2.so
[418] | 67351168| 640|FUNC |GLOB |0| .text|crypt2
[356] | 67351840| 400|FUNC |GLOB |0| .text|crypt2_passwd_hash
[543] | 67353600| 304|FUNC |GLOB |0| .text|crypt2_passwd_match
[431] | 67352256| 1344|FUNC |GLOB |0| .text|crypt2_passwd_salt

/usr/lib/hpux64/libprocsm.so
[418] | 4611686018427643296| 656|FUNC |GLOB |0| .text|crypt2
[356] | 4611686018427644000| 400|FUNC |GLOB |0| .text|crypt2_passwd_h
ash
[543] | 4611686018427645824| 336|FUNC |GLOB |0| .text|crypt2_passwd_m
atch
[431] | 4611686018427644416| 1408|FUNC |GLOB |0| .text|crypt2_passwd_s
alt

I tried re-compiling with those libraries specifically included, though, and still got ld errors:

# cc -v -L/usr/lib/hpux32/librwtool_v2.so -L/usr/lib/hpux64/libprocsm.so /tmp/encrypter.c -o /tmp/encrypter

/usr/ccs/lbin/ecom -architecture 32 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_ILP32 -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

LPATH=/usr/lib/hpux32:/opt/langtools/lib/hpux32:/usr/lib/hpux64:/opt/langtools/lib/hpux64
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain -L /usr/lib/hpux32/librwtool_v2.so -L /usr/lib/hpux64/libprocsm.so encrypter.o -lc
ld: Unsatisfied symbol "crypt2" in file encrypter.o
ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
2 errors.
removing /var/tmp/AAA026567

Per your request, I've attached the prot.h file from my system. You probably already discovered this, but the man page is available on the web at http://docs.hp.com/en/B3921-60631/crypt2.3C.html.

Thanks again for taking a look.

Darren

Re: can't get new crypt2() function to work

d miller_2 — Wed, 23 Sep 2009 14:55:30 GMT

Oops... previous attached copy of prot.h cot truncated. Here's the complete file.

Darren

Re: can't get new crypt2() function to work

kobylka — Wed, 23 Sep 2009 17:38:34 GMT

Hello Darren!

Ok, we got the symbols, now try to link them like this:

1. If your executable is 32bit you must use the 32bit library:

# cc -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux32 -lrwtool_v2

2. If 64bit:

# cc -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm

In your compile command you mixed both libraries (one is 32bit and the other 64 bit). This is not allowed.

Furthermore note the flags:

-L is used to specify a library search path
-l is used to specify the shortened name of the library to link with

Kind regards,

Kobylka

Re: can't get new crypt2() function to work

d miller_2 — Wed, 23 Sep 2009 18:03:42 GMT

Kobylka,

Thanks for continueing to look at this. I'm on a 64-bit Itanium so I tried the hpux64 library as you suggested. Still no luck. I tried the 32-bit command, but that didn't work either. ):

# cc -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm

/usr/ccs/lbin/ecom -architecture 32 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_ILP32 -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^
LPATH=
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain encrypter.o -L /usr/lib/hpux64 -lprocsm -lc
ld: Mismatched ABI for -lprocsm, found /usr/lib/hpux64/libprocsm.so
Fatal error.
removing /var/tmp/AAA000991

Re: can't get new crypt2() function to work

kobylka — Wed, 23 Sep 2009 18:18:39 GMT

Hello Darren!

For 64 bit the 64bit data model flag must be included:

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm

It should work using just -L/usr/lib too.
In the case of 32 bit executable you can use +DD32 or not, by default the compiler generates 32 bit binaries.

Kind regards,

Kobylka

Re: can't get new crypt2() function to work

d miller_2 — Wed, 23 Sep 2009 18:21:49 GMT

Really appreciate your ongoing efforts, here, Kobylka. Here's the latest attempt:

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm

/usr/ccs/lbin/ecom -architecture 64 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_LP64 -D__LP64__ -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

LPATH=
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain encrypter.o -L /usr/lib/hpux64 -lprocsm -lc
ld: Unsatisfied symbol "crypt2" in file encrypter.o
ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
2 errors.
removing /var/tmp/AAA001527

Re: can't get new crypt2() function to work

kobylka — Wed, 23 Sep 2009 18:44:51 GMT

Hi!

When you tried earlier in this post to lookup the "crypt2" symbol using:

find / -name '*.sl' -exec nm {} \; -print | grep -i -e crypt2 -e '^/' | more

be sure to pick the correct libraries:

The nm gets executed first (showing the macthing symbols, if any) and THEN prints the name of the library (not before the symbols are displayed). Please make sure the libraries are the correct ones.

Kind regards,

Kobylka

Re: can't get new crypt2() function to work

d miller_2 — Wed, 23 Sep 2009 18:56:42 GMT

Kobylka,

Still no luck. ):

Darren

# find /usr -name '*.so' -exec nm {} \; -print | grep -i -e crypt2 -e '^/' | more

[418] | 4611686018427643296| 656|FUNC |GLOB |0| .text|crypt2
[356] | 4611686018427644000| 400|FUNC |GLOB |0| .text|crypt2_passwd_h
ash
[543] | 4611686018427645824| 336|FUNC |GLOB |0| .text|crypt2_passwd_m
atch
[431] | 4611686018427644416| 1408|FUNC |GLOB |0| .text|crypt2_passwd_s
alt
/usr/lib/hpux64/libsec.so

# file /usr/lib/hpux64/libsec.so
/usr/lib/hpux64/libsec.so: ELF-64 shared object file - IA64

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -llibsec

/usr/ccs/lbin/ecom -architecture 64 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_LP64 -D__LP64__ -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

LPATH=
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain encrypter.o -L /usr/lib/hpux64 -llibsec -lc
ld: Can't find library for -llibsec
Fatal error.
removing /var/tmp/AAA009384

Re: can't get new crypt2() function to work

kobylka — Wed, 23 Sep 2009 19:01:02 GMT

Hi!

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

try also

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib -lsec

Kind regards,

Kobylka

Re: can't get new crypt2() function to work

d miller_2 — Wed, 23 Sep 2009 19:10:22 GMT

Still no luck.

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib -lsec

"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

ld: Mismatched ABI (not an ELF file) for -lsec, found /usr/lib/libsec.sl
Fatal error.

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
1 errors.

Re: can't get new crypt2() function to work

kobylka — Wed, 23 Sep 2009 19:19:29 GMT

Hi!

ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
1 errors.

The symbol should be "crypt2_passwd_salt". Correct your code and compile again in 64 bit with 64 bit libpath:

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

Kind regards,

Kobylka

Re: can't get new crypt2() function to work

d miller_2 — Wed, 23 Sep 2009 19:29:53 GMT

Kobylka,

Boy do Ifeel sheepish! That spelling mistake was the cause of the problem from the very beginning! Thank you very, very much for your assistance. If I could, I'd give you 15 points for sticking with this issue through so many iterations. For the benefit of future ITRC users, here's the final solution. Thanks again!

# cat /tmp/encrypter.c
#include
#include
main()
{
char *username;
char *oldhash;
char *salt;
char *key;
char *hashstring;
username = "user1";
key = "mypass";
oldhash = "$6$"; /* "$6$" = SHA512, "aa" = 3DES */
salt = crypt2_passwd_salt(oldhash, username);
hashstring = crypt2(key, salt);
printf("username = %s\n", username);
printf("salt = %s\n", salt);
printf("key = %s\n", key);
printf("hashstring = %s\n", hashstring);
}

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

# /tmp/encrypter
username = user1
salt = $6$VSw26.nD
key = mypass
hashstring = $6$VSw26.nD$yAt6TGoOlc9DLUY341qs0Kqo8D8HXFvZicqTSltK0z6ayTJ/dj9pn7RbHQ8mhC.t7QabgjRUg0Ts/QnKcAm7A1