diff options
| author | agc <agc@NetBSD.org> | 2002-09-30 14:15:47 +0000 |
|---|---|---|
| committer | agc <agc@NetBSD.org> | 2002-09-30 14:15:47 +0000 |
| commit | 92ef00aebaa1b02d89fcbfcbf52dac2678e445e0 (patch) | |
| tree | 71c0531c9abddd83a7d9f85a37474cf43e3e9f8d /usr.sbin/user | |
| parent | 367ebffa847612d19b1ea6e346e50b438b41cce3 (diff) | |
Update previous to reflect reality. For blowfish passwords, the salt
can be a variable length field, so check the (fixed length) password
length, rather then the length of the whole password+salt+cipher.
Use a cipher type of "$2a" for blowfish.
Diffstat (limited to 'usr.sbin/user')
| -rw-r--r-- | usr.sbin/user/user.c | 50 |
1 files changed, 30 insertions, 20 deletions
diff --git a/usr.sbin/user/user.c b/usr.sbin/user/user.c index e9025535518..06f3f67a74f 100644 --- a/usr.sbin/user/user.c +++ b/usr.sbin/user/user.c @@ -1,4 +1,4 @@ -/* $NetBSD: user.c,v 1.61 2002/09/30 10:32:40 agc Exp $ */ +/* $NetBSD: user.c,v 1.62 2002/09/30 14:15:47 agc Exp $ */ /* * Copyright (c) 1999 Alistair G. Crooks. All rights reserved. @@ -35,7 +35,7 @@ #ifndef lint __COPYRIGHT("@(#) Copyright (c) 1999 \ The NetBSD Foundation, Inc. All rights reserved."); -__RCSID("$NetBSD: user.c,v 1.61 2002/09/30 10:32:40 agc Exp $"); +__RCSID("$NetBSD: user.c,v 1.62 2002/09/30 14:15:47 agc Exp $"); #endif #include <sys/types.h> @@ -878,30 +878,42 @@ getnextuid(int sync_uid_gid, int *uid, int low_uid, int high_uid) /* structure which defines a password type */ typedef struct passwd_type_t { - char type[2]; /* optional 2-character type descriptor */ - int desc_length; /* length of type descriptor */ - int length; /* length of password (incl. descriptor) */ + const char *type; /* optional type descriptor */ + int desc_length; /* length of type descriptor */ + int length; /* length of password */ + const char *regex; /* regexp to output the password */ + int re_sub; /* subscript of regexp to use */ } passwd_type_t; static passwd_type_t passwd_types[] = { - { "$2", 2, 60 }, /* Blowfish */ - { "$1", 2, 34 }, /* MD5 passwords */ - { "", 0, 13 }, /* standard DES */ - { "", -1, -1 } /* none - terminate search */ + { "$2a", 3, 54, "\\$[^$]+\\$[^$]+\\$(.*)", 1 }, /* Blowfish */ + { "$1", 2, 34, NULL, 0 }, /* MD5 */ + { "", 0, 13, NULL, 0 }, /* standard DES */ + { NULL, -1, -1, NULL, 0 } /* none - terminate search */ }; -/* return the length of a given type of password */ +/* return non-zero if it's a valid password - check length for cipher type */ static int -password_length(char *newpasswd) +valid_password_length(char *newpasswd) { passwd_type_t *pwtp; + regmatch_t matchv[10]; + regex_t r; for (pwtp = passwd_types ; pwtp->desc_length >= 0 ; pwtp++) { if (strncmp(newpasswd, pwtp->type, pwtp->desc_length) == 0) { - return pwtp->length; + if (pwtp->regex == NULL) { + return strlen(newpasswd) == pwtp->length; + } + (void) regcomp(&r, pwtp->regex, REG_EXTENDED); + if (regexec(&r, newpasswd, 10, matchv, 0) == 0) { + regfree(&r); + return (int)(matchv[pwtp->re_sub].rm_eo - matchv[pwtp->re_sub].rm_so + 1) == pwtp->length; + } + regfree(&r); } } - return -1; + return 0; } /* add a user */ @@ -1042,7 +1054,7 @@ adduser(char *login_name, user_t *up) home); } password[sizeof(password) - 1] = '\0'; - if (up->u_password != NULL && strlen(up->u_password) == password_length(up->u_password)) { + if (up->u_password != NULL && valid_password_length(up->u_password)) { (void) strlcpy(password, up->u_password, sizeof(password)); } else { (void) memset(password, '\0', sizeof(password)); @@ -1238,7 +1250,6 @@ moduser(char *login_name, char *newlogin, user_t *up) char *buf; char *colon; char *line; - int passwdlen; int masterfd; int ptmpfd; int error; @@ -1292,13 +1303,12 @@ moduser(char *login_name, char *newlogin, user_t *up) } } if (up->u_flags & F_PASSWORD) { - if (up->u_password != NULL && - (passwdlen = password_length(up->u_password)) > 0) { - if (strlen(up->u_password) != passwdlen) { + if (up->u_password != NULL) { + if (!valid_password_length(up->u_password) > 0) { (void) close(ptmpfd); pw_abort(); - errx(EXIT_FAILURE, "Password length %d expected: got `%s' (%d)", - passwdlen, up->u_password, strlen(up->u_password)); + errx(EXIT_FAILURE, "Invalid password: `%s'", + up->u_password); } pwp->pw_passwd = up->u_password; } |
