initial implementation of BCRYPTHasher. Tested on OpenBSD.

modoboa/core/app_settings.py

@@ -48,6 +48,7 @@ class GeneralParametersForm(parameters.AdminParametersForm):
         label=ugettext_lazy("Default password scheme"),
         choices=[("sha512crypt", "sha512crypt"),
                  ("sha256crypt", "sha256crypt"),
+                 ("bcrypt", "bcrypt"),
                  ("md5crypt", ugettext_lazy("md5crypt (weak)")),
                  ("sha256", ugettext_lazy("sha256 (weak)")),
                  ("md5", ugettext_lazy("md5 (weak)")),

modoboa/core/password_hashers/__init__.py

@@ -5,7 +5,7 @@ from modoboa.core.password_hashers.base import (
     PLAINHasher, CRYPTHasher, MD5Hasher, SHA256Hasher
 )
 from modoboa.core.password_hashers.advanced import (
-    MD5CRYPTHasher, SHA256CRYPTHasher, SHA512CRYPTHasher
+    BCRYPTHasher, MD5CRYPTHasher, SHA256CRYPTHasher, SHA512CRYPTHasher
 )
 
 

modoboa/core/password_hashers/advanced.py

@@ -3,10 +3,36 @@ Advanced (ie. stronger) password hashers.
 
 This module relies on `passlib` to provide more secure hashers.
 """
-from passlib.hash import md5_crypt, sha256_crypt, sha512_crypt
+from passlib.hash import bcrypt, md5_crypt, sha256_crypt, sha512_crypt
 from modoboa.core.password_hashers.base import PasswordHasher
 from modoboa.lib import parameters
 
+class BCRYPTHasher(PasswordHasher):
+    """
+    BLF-CRYPT password hasher.
+
+    Supports rounds and provides compatibility with dovecot on
+    *BSD systems.
+    """
+    @property
+    def scheme(self):
+        return '{BLF-CRYPT}' if self._target == 'local' else '{CRYPT}'
+
+    def _b64encode(self, pwhash):
+        return pwhash
+
+    def _encrypt(self, clearvalue, salt=None):
+        # Using the parameter for rounds will generate the error
+        # ValueError: rounds too high (bcrypt requires <= 31 rounds)
+        # when using the bcrypt hasher.
+        #rounds = int(parameters.get_admin('ROUNDS_NUMBER'))
+        # To get around this, I use the default of 12.
+        rounds = 12
+        return bcrypt.encrypt(clearvalue, rounds=rounds)
+
+    def verify(self, clearvalue, hashed_value):
+        return bcrypt.verify(clearvalue, hashed_value)
+
 
 class MD5CRYPTHasher(PasswordHasher):