summaryrefslogtreecommitdiff
path: root/usr.sbin/user
diff options
context:
space:
mode:
authoragc <agc@NetBSD.org>2002-09-30 14:15:47 +0000
committeragc <agc@NetBSD.org>2002-09-30 14:15:47 +0000
commit92ef00aebaa1b02d89fcbfcbf52dac2678e445e0 (patch)
tree71c0531c9abddd83a7d9f85a37474cf43e3e9f8d /usr.sbin/user
parent367ebffa847612d19b1ea6e346e50b438b41cce3 (diff)
Update previous to reflect reality. For blowfish passwords, the salt
can be a variable length field, so check the (fixed length) password length, rather then the length of the whole password+salt+cipher. Use a cipher type of "$2a" for blowfish.
Diffstat (limited to 'usr.sbin/user')
-rw-r--r--usr.sbin/user/user.c50
1 files changed, 30 insertions, 20 deletions
diff --git a/usr.sbin/user/user.c b/usr.sbin/user/user.c
index e9025535518..06f3f67a74f 100644
--- a/usr.sbin/user/user.c
+++ b/usr.sbin/user/user.c
@@ -1,4 +1,4 @@
-/* $NetBSD: user.c,v 1.61 2002/09/30 10:32:40 agc Exp $ */
+/* $NetBSD: user.c,v 1.62 2002/09/30 14:15:47 agc Exp $ */
/*
* Copyright (c) 1999 Alistair G. Crooks. All rights reserved.
@@ -35,7 +35,7 @@
#ifndef lint
__COPYRIGHT("@(#) Copyright (c) 1999 \
The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: user.c,v 1.61 2002/09/30 10:32:40 agc Exp $");
+__RCSID("$NetBSD: user.c,v 1.62 2002/09/30 14:15:47 agc Exp $");
#endif
#include <sys/types.h>
@@ -878,30 +878,42 @@ getnextuid(int sync_uid_gid, int *uid, int low_uid, int high_uid)
/* structure which defines a password type */
typedef struct passwd_type_t {
- char type[2]; /* optional 2-character type descriptor */
- int desc_length; /* length of type descriptor */
- int length; /* length of password (incl. descriptor) */
+ const char *type; /* optional type descriptor */
+ int desc_length; /* length of type descriptor */
+ int length; /* length of password */
+ const char *regex; /* regexp to output the password */
+ int re_sub; /* subscript of regexp to use */
} passwd_type_t;
static passwd_type_t passwd_types[] = {
- { "$2", 2, 60 }, /* Blowfish */
- { "$1", 2, 34 }, /* MD5 passwords */
- { "", 0, 13 }, /* standard DES */
- { "", -1, -1 } /* none - terminate search */
+ { "$2a", 3, 54, "\\$[^$]+\\$[^$]+\\$(.*)", 1 }, /* Blowfish */
+ { "$1", 2, 34, NULL, 0 }, /* MD5 */
+ { "", 0, 13, NULL, 0 }, /* standard DES */
+ { NULL, -1, -1, NULL, 0 } /* none - terminate search */
};
-/* return the length of a given type of password */
+/* return non-zero if it's a valid password - check length for cipher type */
static int
-password_length(char *newpasswd)
+valid_password_length(char *newpasswd)
{
passwd_type_t *pwtp;
+ regmatch_t matchv[10];
+ regex_t r;
for (pwtp = passwd_types ; pwtp->desc_length >= 0 ; pwtp++) {
if (strncmp(newpasswd, pwtp->type, pwtp->desc_length) == 0) {
- return pwtp->length;
+ if (pwtp->regex == NULL) {
+ return strlen(newpasswd) == pwtp->length;
+ }
+ (void) regcomp(&r, pwtp->regex, REG_EXTENDED);
+ if (regexec(&r, newpasswd, 10, matchv, 0) == 0) {
+ regfree(&r);
+ return (int)(matchv[pwtp->re_sub].rm_eo - matchv[pwtp->re_sub].rm_so + 1) == pwtp->length;
+ }
+ regfree(&r);
}
}
- return -1;
+ return 0;
}
/* add a user */
@@ -1042,7 +1054,7 @@ adduser(char *login_name, user_t *up)
home);
}
password[sizeof(password) - 1] = '\0';
- if (up->u_password != NULL && strlen(up->u_password) == password_length(up->u_password)) {
+ if (up->u_password != NULL && valid_password_length(up->u_password)) {
(void) strlcpy(password, up->u_password, sizeof(password));
} else {
(void) memset(password, '\0', sizeof(password));
@@ -1238,7 +1250,6 @@ moduser(char *login_name, char *newlogin, user_t *up)
char *buf;
char *colon;
char *line;
- int passwdlen;
int masterfd;
int ptmpfd;
int error;
@@ -1292,13 +1303,12 @@ moduser(char *login_name, char *newlogin, user_t *up)
}
}
if (up->u_flags & F_PASSWORD) {
- if (up->u_password != NULL &&
- (passwdlen = password_length(up->u_password)) > 0) {
- if (strlen(up->u_password) != passwdlen) {
+ if (up->u_password != NULL) {
+ if (!valid_password_length(up->u_password) > 0) {
(void) close(ptmpfd);
pw_abort();
- errx(EXIT_FAILURE, "Password length %d expected: got `%s' (%d)",
- passwdlen, up->u_password, strlen(up->u_password));
+ errx(EXIT_FAILURE, "Invalid password: `%s'",
+ up->u_password);
}
pwp->pw_passwd = up->u_password;
}