Issue 7468 - RFE - Add HIBP HTTP client

[jchapma]

Description:
Implement an HTTP client for querying the Have I Been Pwned (HIBP) Pwned Passwords API using the k-anonymity model. This is the first commit toward password breach detection in 389 Directory Server. Requires libcurl (optional dependency, enabled via --enable-hibp).

• HTTP transport using libcurl
• SHA-1 hashing via NSS
• Unit tests with mock transport

Fixes: #7468

Reviewed by:

Summary by Sourcery

Introduce an optional HIBP-based password breach checking client and wire it into the slapd password policy with supporting configuration, build flags, and tests.

New Features:

• Add a Have I Been Pwned (HIBP) HTTP client for password breach checking using the k-anonymity SHA-1 range API.
• Extend password policy configuration with options to enable breach checking, specify a breach database URL, and configure query timeouts.

Enhancements:

• Integrate libcurl and NSS-based SHA-1 hashing behind a pluggable hash-provider abstraction for the HIBP client.
• Initialize default breach-checking-related password policy fields and HIBP subsystem setup within slapd.

Build:

• Add an optional --enable-hibp configure flag that pulls in libcurl, defines ENABLE_HIBP, and conditionally builds the HIBP client and its tests.

Tests:

• Add unit tests for HIBP SHA-1 conversion, API response parsing, response buffer handling, mocked API integration, and concurrent request handling under the libslapd test suite.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The global g_mock_response and hibp_set_mock_response() are not thread-safe and are exposed in the production header; consider confining this mocking mechanism to test-only builds (e.g., via #ifdef TEST or a separate test header) or making it thread-safe to avoid races if used concurrently.
• The public hibp.h currently exposes several test-only helpers (hibp_parse_response_wrapper, hibp_write_callback_wrapper, hibp_set_mock_response); it would be cleaner to hide these behind a test-only interface so that the production ABI only exposes the actual client API.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The global `g_mock_response` and `hibp_set_mock_response()` are not thread-safe and are exposed in the production header; consider confining this mocking mechanism to test-only builds (e.g., via `#ifdef TEST` or a separate test header) or making it thread-safe to avoid races if used concurrently.
- The public `hibp.h` currently exposes several test-only helpers (`hibp_parse_response_wrapper`, `hibp_write_callback_wrapper`, `hibp_set_mock_response`); it would be cleaner to hide these behind a test-only interface so that the production ABI only exposes the actual client API.

## Individual Comments

### Comment 1
<location path="ldap/servers/slapd/hibp_client.c" line_range="511" />
<code_context>
+    prefix[HIBP_SHA1_HEX_PREFIX_LEN] = '\0';
+    strcpy(suffix, sha1_hex + HIBP_SHA1_HEX_PREFIX_LEN);
+
+    slapi_log_err(SLAPI_LOG_DEBUG, "hibp_check_password", "Checking prefix: %s\n", prefix);
+
+    /* Configure timeout */
</code_context>
<issue_to_address>
**🚨 issue (security):** Avoid logging the hash prefix, as it may expose sensitive password-derived data into logs.

Because the prefix is still derived from user passwords, it may be treated as sensitive in some environments. Please either remove this log, restrict it to a very-verbose/debug-only path, or log only generic status without the prefix value.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[packit-as-a-service]

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

• sudo dnf install -y 'dnf*-command(copr)'
• dnf copr enable packit/389ds-389-ds-base-7469
• And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

[vashirov]

For the testing (at this stage at least compilation), please add changes to the spec file (BuildRequires for libcurl-devel and configure options), thanks!

[vashirov]

This is quite an old version from 2015, I think we should use at least 7.61 (available in RHEL8) that contains CVE fixes.

[vashirov]

This currently works with the official HIBP API, but doesn't work with easypwned (different API). Would be nice in the future to allow defining custom offline servers.