can't get new crypt2() function to work

[d miller_2]

Hello,

I've been reading about the new crypt2 library introduced by the PHI11i3 bundle, which enabled SHA512 password hashing. I'm trying to understand exactly what the new libraries do, but get can't get my test programs to compile. Here's what I get an 'ld: Unsatisfied symbol "crypt2"' error every time I try to compile my program. Here's what I did:


# swlist PHI11i3
# Initializing...
# Contacting target "rx16u831"...
#
# Target: rx16u831:/
#
# PHI11i3 B.11.31.02 HP-UX 11.31 Password Hashing Infrastructure
PHI11i3.SHA11i3 B.11.31.02 HP-UX 11.31 SHA11i3 Product


# cat /tmp/encrypter.c
#include
#include
main()
{
char *result;
result=crypt2("aa","user1");
printf("\nThe password hash is %s\n", result);
}


# cc -Llibsec encrypter.c -o encrypter
ld: Unsatisfied symbol "crypt2" in file encrypter.o
1 errors.


I'm guessing that I need to specify another -L, but I'm not sure what it should be.

Thanks in advance for your help.

Darren

[James R. Ferguson]

Hi Darren:

I don't have 11.31 available nor do I have the PHI product for 11.23 installed, but at least in earlier interfaces you should have specified:

#include

Regards!

...JRF...

[d miller_2]

James,

I added "#include ", but still no luck. Thanks for taking a look.

Regards,
Darren

[James R. Ferguson]

Hi (again) Darren:

Try looking for a 'crypt2' header:

# find /usr/include -type f -name "crypt*"

Regards!

...JRF...

[d miller_2]

James,

I tried two variations on the find command, but the files found were already included in my program.

# find /usr/include -type f -name "crypt*"
/usr/include/crypt.h

# find /usr/include -type f -exec grep -l crypt2 {} \;
/usr/include/prot.h

# cat encrypter.c
#include
#include
#include
main()
{
char *result;
result=crypt2("aa","user1");
printf("\nThe password hash is %s\n", result);
}

# cc encrypter.c -o encrypter
ld: Unsatisfied symbol "crypt2" in file encrypter.o
1 errors.

Thanks again,
Darren

[Olivier Masse]

Try "swlist -l file PHI11i3" as root to see what files are included in the package, this could give you a hint on what needs to be included.

Good luck

[d miller_2]

Olivier,

Good idea. I actually did try that earlier, but no luck. The product appears to simply deliver a man page and a toggle file to enable the functionality. I wonder if the functionality was there in the original 11i v3 release but wasn't enabled because it hadn't been fully tested(?). Seems strange. The functionality does work, though. If I change a user's password, the resulting ciphertext is much longer than it was in the past.

Darren

# swlist -l file PHI11i3
# Initializing...
# Contacting target "rx16u831"...
#
# Target: rx16u831:/
#
# PHI11i3 B.11.31.02 HP-UX 11.31 Password Hashing Infrastructure
# PHI11i3.SHA11i3 B.11.31.02 HP-UX 11.31 SHA11i3 Product
# PHI11i3.SHA11i3.SHA-CONF B.11.31.02 SHA11i3 Configuration Files
PHI11i3.SHA11i3.SHA-CONF: /etc/default/ENABLE_CRYPT_ENHANCEMENT
# PHI11i3.SHA11i3.SHA-ENG-A-MAN B.11.31.02 SHA11i3 English Manpages
PHI11i3.SHA11i3.SHA-ENG-A-MAN: /usr/share/man/man3.Z/crypt2.3c

[kobylka]

Hello Darren!

Assuming the PHI11i3 bundle is correctly installed ( https://h20392.www2.hp.com/portal/swdepot/displayInstallInfo.do?productNumber=PHI11i3 )

you could try this:

1. Take a look at prot.h (and if you were so kind please attach it in next post since I have no 11i v3) to see how crypt2 is included, declared, defined.

2. Do brute force on symbol matching in libs:

find / -name '*.sl' -exec nm {} \; -print | grep -i -e crypt2 -e '^/' | more

Note the *.sl for PA-RISC (use *.so for IPF). If you're sure all your libs are only in /usr/lib and /opt:

for l in /usr/lib /opt
do
find $l -name '*.sl' -exec nm {} \; -print | grep -i -e crypt2 -e '^/'
done


If the symbol is there, it will show up...

Kind regards,

Kobylka

[d miller_2]

Kobylka,

THanks so much for looking at my issue! I ran the for loop as you suggested and got a long list of several hundred file paths. I think these might be the pertinent lines:

/usr/lib/hpux32/librwtool_v2.so
[418] | 67351168| 640|FUNC |GLOB |0| .text|crypt2
[356] | 67351840| 400|FUNC |GLOB |0| .text|crypt2_passwd_hash
[543] | 67353600| 304|FUNC |GLOB |0| .text|crypt2_passwd_match
[431] | 67352256| 1344|FUNC |GLOB |0| .text|crypt2_passwd_salt

/usr/lib/hpux64/libprocsm.so
[418] | 4611686018427643296| 656|FUNC |GLOB |0| .text|crypt2
[356] | 4611686018427644000| 400|FUNC |GLOB |0| .text|crypt2_passwd_h
ash
[543] | 4611686018427645824| 336|FUNC |GLOB |0| .text|crypt2_passwd_m
atch
[431] | 4611686018427644416| 1408|FUNC |GLOB |0| .text|crypt2_passwd_s
alt

I tried re-compiling with those libraries specifically included, though, and still got ld errors:


# cc -v -L/usr/lib/hpux32/librwtool_v2.so -L/usr/lib/hpux64/libprocsm.so /tmp/encrypter.c -o /tmp/encrypter

/usr/ccs/lbin/ecom -architecture 32 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_ILP32 -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

LPATH=/usr/lib/hpux32:/opt/langtools/lib/hpux32:/usr/lib/hpux64:/opt/langtools/lib/hpux64
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain -L /usr/lib/hpux32/librwtool_v2.so -L /usr/lib/hpux64/libprocsm.so encrypter.o -lc
ld: Unsatisfied symbol "crypt2" in file encrypter.o
ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
2 errors.
removing /var/tmp/AAA026567

Per your request, I've attached the prot.h file from my system. You probably already discovered this, but the man page is available on the web at http://docs.hp.com/en/B3921-60631/crypt2.3C.html.

Thanks again for taking a look.

Darren

[d miller_2]

Oops... previous attached copy of prot.h cot truncated. Here's the complete file.

Darren

[kobylka]

Hello Darren!


Ok, we got the symbols, now try to link them like this:

1. If your executable is 32bit you must use the 32bit library:

# cc -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux32 -lrwtool_v2

2. If 64bit:

# cc -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm


In your compile command you mixed both libraries (one is 32bit and the other 64 bit). This is not allowed.

Furthermore note the flags:

-L is used to specify a library search path
-l is used to specify the shortened name of the library to link with


Kind regards,

Kobylka

[d miller_2]

Kobylka,

Thanks for continueing to look at this. I'm on a 64-bit Itanium so I tried the hpux64 library as you suggested. Still no luck. I tried the 32-bit command, but that didn't work either. ):

# cc -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm

/usr/ccs/lbin/ecom -architecture 32 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_ILP32 -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^
LPATH=
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain encrypter.o -L /usr/lib/hpux64 -lprocsm -lc
ld: Mismatched ABI for -lprocsm, found /usr/lib/hpux64/libprocsm.so
Fatal error.
removing /var/tmp/AAA000991

[kobylka]

Hello Darren!

For 64 bit the 64bit data model flag must be included:

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm


It should work using just -L/usr/lib too.
In the case of 32 bit executable you can use +DD32 or not, by default the compiler generates 32 bit binaries.

Kind regards,

Kobylka

[d miller_2]

Really appreciate your ongoing efforts, here, Kobylka. Here's the latest attempt:

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lprocsm

/usr/ccs/lbin/ecom -architecture 64 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_LP64 -D__LP64__ -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

LPATH=
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain encrypter.o -L /usr/lib/hpux64 -lprocsm -lc
ld: Unsatisfied symbol "crypt2" in file encrypter.o
ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
2 errors.
removing /var/tmp/AAA001527

[kobylka]

Hi!

When you tried earlier in this post to lookup the "crypt2" symbol using:

find / -name '*.sl' -exec nm {} \; -print | grep -i -e crypt2 -e '^/' | more

be sure to pick the correct libraries:

The nm gets executed first (showing the macthing symbols, if any) and THEN prints the name of the library (not before the symbols are displayed). Please make sure the libraries are the correct ones.


Kind regards,

Kobylka

[d miller_2]

Kobylka,

Still no luck. ):

Darren

# find /usr -name '*.so' -exec nm {} \; -print | grep -i -e crypt2 -e '^/' | more

[418] | 4611686018427643296| 656|FUNC |GLOB |0| .text|crypt2
[356] | 4611686018427644000| 400|FUNC |GLOB |0| .text|crypt2_passwd_h
ash
[543] | 4611686018427645824| 336|FUNC |GLOB |0| .text|crypt2_passwd_m
atch
[431] | 4611686018427644416| 1408|FUNC |GLOB |0| .text|crypt2_passwd_s
alt
/usr/lib/hpux64/libsec.so

# file /usr/lib/hpux64/libsec.so
/usr/lib/hpux64/libsec.so: ELF-64 shared object file - IA64

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -llibsec

/usr/ccs/lbin/ecom -architecture 64 -ia64abi all -ext on -lang c -exception off -sysdir /usr/include -inline_power 0 -link_type dynamic -fpeval float -tls_dyn on -target_os 11.31 --sys_include /usr/include -D__hpux -D__unix -D__ia64=1 -D_BIG_ENDIAN=1 -D_LP64 -D__LP64__ -D__unordered= -D__synchronous= -D__non_sequential= -D__side_effect_free= -D__HP_cc=61200 -D__STDC_EXT__ -D_HPUX_SOURCE -D_INCLUDE_LONGLONG -D_INLINE_ASM -D_BIND_LIBCALLS -D_Math_errhandling=MATH_ERREXCEPT -D_FLT_EVAL_METHOD=0 -ucode hdriver=optlevel%1%:inline=inl_level%0% -plusolistoption -Ol06const! -plusolistoption -Ol13moderate! -plusooption -Oq01,al,ag,cn,sz,ic,vo,Mf,Po,es,rs,Rf,Pr,sp,in,cl,om,vc,pi,fa,pe,rr,pa,pv,nf,cp,lx,Pg,ug,lu,lb,uj,dn,sg,pt,kt,em,np,ar,rp,dl,fs,bp,wp,pc,mp,lr,cx,cr,pi,so,Rc,fa,ft,fe,ap,st,lc,Bl,sr,ib,pl,sd,ll,rl,dl,Lt,ol,fl,lm,ts,rd,dp,If! /tmp/encrypter.c
"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

LPATH=
/usr/ccs/bin/ld -o /tmp/encrypter -u___exit -umain encrypter.o -L /usr/lib/hpux64 -llibsec -lc
ld: Can't find library for -llibsec
Fatal error.
removing /var/tmp/AAA009384

[kobylka]

Hi!


# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

try also

# cc +DD64 -v /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib -lsec


Kind regards,

Kobylka

[d miller_2]

Still no luck.

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib -lsec

"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

ld: Mismatched ABI (not an ELF file) for -lsec, found /usr/lib/libsec.sl
Fatal error.

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

"/tmp/encrypter.c", line 16: warning #2513-D: a value of type "int" cannot be
assigned to an entity of type "char *"
salt = crypt_2passwd_salt(oldhash, username);
^

ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
1 errors.

[kobylka · Accepted solution]

Hi!


ld: Unsatisfied symbol "crypt_2passwd_salt" in file encrypter.o
1 errors.

The symbol should be "crypt2_passwd_salt". Correct your code and compile again in 64 bit with 64 bit libpath:

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec


Kind regards,

Kobylka

[d miller_2]

Kobylka,

Boy do Ifeel sheepish! That spelling mistake was the cause of the problem from the very beginning! Thank you very, very much for your assistance. If I could, I'd give you 15 points for sticking with this issue through so many iterations. For the benefit of future ITRC users, here's the final solution. Thanks again!

# cat /tmp/encrypter.c
#include
#include
main()
{
char *username;
char *oldhash;
char *salt;
char *key;
char *hashstring;
username = "user1";
key = "mypass";
oldhash = "$6$"; /* "$6$" = SHA512, "aa" = 3DES */
salt = crypt2_passwd_salt(oldhash, username);
hashstring = crypt2(key, salt);
printf("username = %s\n", username);
printf("salt = %s\n", salt);
printf("key = %s\n", key);
printf("hashstring = %s\n", hashstring);
}

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

# /tmp/encrypter
username = user1
salt = $6$VSw26.nD
key = mypass
hashstring = $6$VSw26.nD$yAt6TGoOlc9DLUY341qs0Kqo8D8HXFvZicqTSltK0z6ayTJ/dj9pn7RbHQ8mhC.t7QabgjRUg0Ts/QnKcAm7A1

[kobylka]

Hi!

I'm glad to see that it finally works. Congrats!

Kind regards,

Kobylka

[d miller_2]

This solution finally worked:

# cat /tmp/encrypter.c
#include
#include
main()
{
char *username;
char *oldhash;
char *salt;
char *key;
char *hashstring;
username = "user1";
key = "mypass";
oldhash = "$6$"; /* "$6$" = SHA512, "aa" = 3DES */
salt = crypt2_passwd_salt(oldhash, username);
hashstring = crypt2(key, salt);
printf("username = %s\n", username);
printf("salt = %s\n", salt);
printf("key = %s\n", key);
printf("hashstring = %s\n", hashstring);
}

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

# /tmp/encrypter
username = user1
salt = $6$VSw26.nD
key = mypass
hashstring = $6$VSw26.nD$yAt6TGoOlc9DLUY341qs0Kqo8D8HXFvZicqTSltK0z6ayTJ/dj9pn7RbH
Q8mhC.t7QabgjRUg0Ts/QnKcAm7A1

[Dennis Handly]

>I'd give you 15 points for sticking with this issue through so many iterations.

You can give points that sum more than 10, if multiple replies.

>kobylka: find $l -name '*.sl' -exec nm {} \; -print | grep -i -e crypt2 -e '^/'

You may want to use:
nm -pxNA to do more than one lib at a time:
find $l -name "lib*" -exec nm -pxAN +

> -L/usr/lib/hpux32

There is no need to specify the default lib path with -L, remove it. Let the driver select the correct path.

>It should work using just -L/usr/lib too.

Not for Integrity, there are no libs there and Darren showed it failing.

[kobylka]

Hi!

> find $l -name "lib*" -exec nm -pxAN +

Thanks for pointing this out! The -A (-r) flags are quite useful in this situation!


> There is no need to specify the default lib path with -L, remove it. Let the driver select the correct path.

What confused me a lot was that:

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib -lsec

resulted in a library named libsec.sl on Itanium hardware trying to be linked.

So we went along using

# cc +DD64 /tmp/encrypter.c -o /tmp/encrypter -L/usr/lib/hpux64 -lsec

>>It should work using just -L/usr/lib too.

>Not for Integrity, there are no libs there and Darren showed it failing.

Thanks for clarification.


Dennis, always nice to meet you in posts :)

Kind regards,

Kobylka

[d miller_2]

Thanks, guys, for continuing to post to this thread. Trying this one more time, I confirmed that -L/usr/lib doesn't work, while -L/usr/lib/hpux64 does:

# cc +DD64 /tmp/encrypter2.c -o /tmp/encrypter2 -L/usr/lib/ -lsec
ld: Mismatched ABI (not an ELF file) for -lsec, found /usr/lib//libsec.sl
Fatal error.

# cc +DD64 /tmp/encrypter2.c -o /tmp/encrypter2 -L/usr/lib/hpux64 -lsec

# echo $?
0

I wish the /usr/lib option DID work. I would rather not platform-specific compiler options in the instructions accompanying my program, but it looks like I'll have to.

Darren