-
Notifications
You must be signed in to change notification settings - Fork 56
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This function can be used by portable users of libxcrypt to check whether the desired hash method is supported. There are future plans to extend the crypt_checksalt function to check the given setting string against the configuration in '/etc/crypt.conf' and report whether the hashing method and parameters it specifies are acceptable.
- Loading branch information
Showing
10 changed files
with
283 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| .\" Written by Zack Weinberg <zackw at panix.com> in 2018. | ||
| .\" | ||
| .\" To the extent possible under law, the authors have waived | ||
| .\" all copyright and related or neighboring rights to this work. | ||
| .\" See https://creativecommons.org/publicdomain/zero/1.0/ for further | ||
| .\" details. | ||
| .\" | ||
| .Dd November 8, 2018 | ||
| .Dt CRYPT_CHECKSALT 3 | ||
| .Os "libxcrypt" | ||
| .Sh NAME | ||
| .Nm crypt_checksalt | ||
| .Nd validate a crypt setting string | ||
| .Sh LIBRARY | ||
| .Lb libcrypt | ||
| .Sh SYNOPSIS | ||
| .In crypt.h | ||
| .Ft int | ||
| .Fo crypt_checksalt | ||
| .Fa "const char *setting" | ||
| .Fc | ||
| .Sh DESCRIPTION | ||
| .Nm | ||
| checks the | ||
| .Ar setting | ||
| string against the configuration in | ||
| .Pa /etc/crypt.conf | ||
| and reports whether the hashing method and parameters it specifies | ||
| are acceptable. | ||
| It is intended to be used by programs | ||
| such as | ||
| .Xr login 1 | ||
| to determine whether the user's passphrase should be re-hashed | ||
| using the currently preferred hashing method. | ||
| .Sh RETURN VALUES | ||
| The return value is 0 if there is nothing wrong with this setting. | ||
| Otherwise, it is one of the following constants: | ||
| .Bl -tag -width 4n | ||
| .It Dv CRYPT_SALT_INVALID | ||
| .Ar setting | ||
| is not a valid setting string; either it specifies a hashing method | ||
| that is not known to this version of libxcrypt, | ||
| or it specifies invalid parameters for the method. | ||
| .It Dv CRYPT_SALT_METHOD_DISABLED | ||
| .Ar setting | ||
| specifies a hashing method that is no longer allowed to be used at all; | ||
| .Nm crypt | ||
| will fail if passed this | ||
| .Ar setting . | ||
| Manual intervention will be required to reactivate the user's account. | ||
| .It Dv CRYPT_SALT_METHOD_LEGACY | ||
| .Ar setting | ||
| specifies a hashing method that is no longer considered strong enough | ||
| for use with new passphrases. | ||
| .Nm crypt | ||
| will still authenticate a passphrase against this setting, | ||
| but if authentication succeeds, | ||
| the passphrase should be re-hashed using the currently preferred method. | ||
| .It Dv CRYPT_SALT_TOO_CHEAP | ||
| .Ar setting | ||
| specifies cost parameters that are considered too cheap for use with | ||
| new passphrases. | ||
| .Nm crypt | ||
| will still authenticate a passphrase against this setting, | ||
| but if authentication succeeds, | ||
| the passphrase should be re-hashed using the currently preferred method. | ||
| .El | ||
| .Sh FEATURE TEST MACROS | ||
| .In crypt.h | ||
| will define the macro | ||
| .Dv CRYPT_CHECKSALT_AVAILABLE | ||
| if | ||
| .Nm | ||
| is available in the current version of libxcrypt. | ||
| .Sh PORTABILITY NOTES | ||
| The function | ||
| .Nm | ||
| is not part of any standard. | ||
| It was added to libxcrypt in version 4.3.0. | ||
| .Sh ATTRIBUTES | ||
| For an explanation of the terms used in this section, see | ||
| .Xr attributes 7 . | ||
| .TS | ||
| allbox; | ||
| lb lb lb | ||
| l l l. | ||
| Interface Attribute Value | ||
| T{ | ||
| .Nm | ||
| T} Thread safety MT-Safe | ||
| .TE | ||
| .sp | ||
| .Sh SEE ALSO | ||
| .Xr crypt 3 , | ||
| .Xr crypt_gensalt 3 , | ||
| .Xr crypt 5 , | ||
| .Xr crypt.conf 5 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,133 @@ | ||
| /* Copyright (C) 2018 Björn Esser <[email protected]> | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without | ||
| * modification, are permitted. | ||
| * | ||
| * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND | ||
| * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| * SUCH DAMAGE. | ||
| */ | ||
|
|
||
| #include "crypt-port.h" | ||
| #include <stdio.h> | ||
|
|
||
| struct testcase | ||
| { | ||
| const char *prefix; | ||
| const int expected_output; | ||
| }; | ||
|
|
||
| static const struct testcase testcases[] = | ||
| { | ||
| #if INCLUDE_descrypt || INCLUDE_bigcrypt | ||
| { "", CRYPT_SALT_OK }, | ||
| { "..", CRYPT_SALT_OK }, | ||
| { "MN", CRYPT_SALT_OK }, | ||
| #else | ||
| { "", CRYPT_SALT_INVALID }, | ||
| { "..", CRYPT_SALT_INVALID }, | ||
| { "MN", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_bsdicrypt | ||
| { "_", CRYPT_SALT_OK }, | ||
| #else | ||
| { "_", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_md5crypt | ||
| { "$1$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$1$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_nt | ||
| { "$3$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$3$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_sunmd5 | ||
| { "$md5", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$md5", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_sha1crypt | ||
| { "$sha1", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$sha1", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_sha256crypt | ||
| { "$5$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$5$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_sha512crypt | ||
| { "$6$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$6$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_bcrypt | ||
| { "$2a$", CRYPT_SALT_OK }, | ||
| { "$2b$", CRYPT_SALT_OK }, | ||
| { "$2x$", CRYPT_SALT_OK }, | ||
| { "$2y$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$2a$", CRYPT_SALT_INVALID }, | ||
| { "$2b$", CRYPT_SALT_INVALID }, | ||
| { "$2x$", CRYPT_SALT_INVALID }, | ||
| { "$2y$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_yescrypt | ||
| { "$y$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$y$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_scrypt | ||
| { "$7$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$7$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
| #if INCLUDE_gost_yescrypt | ||
| { "$gy$", CRYPT_SALT_OK }, | ||
| #else | ||
| { "$gy$", CRYPT_SALT_INVALID }, | ||
| #endif | ||
|
|
||
| /* All of these are invalid. */ | ||
| { "$@", CRYPT_SALT_INVALID }, | ||
| { "%A", CRYPT_SALT_INVALID }, | ||
| { "A%", CRYPT_SALT_INVALID }, | ||
| { "$2$", CRYPT_SALT_INVALID }, | ||
| { "*0", CRYPT_SALT_INVALID }, | ||
| { "*1", CRYPT_SALT_INVALID }, | ||
| { NULL, CRYPT_SALT_INVALID } | ||
| }; | ||
|
|
||
| int | ||
| main (void) | ||
| { | ||
| int status = 0; | ||
| int retval = 0; | ||
|
|
||
| for (size_t i = 0; i < ARRAY_SIZE (testcases); i++) | ||
| { | ||
| retval = crypt_checksalt (testcases[i].prefix); | ||
| if (retval == testcases[i].expected_output) | ||
| printf ("PASS | %7s | result: %d\n", | ||
| testcases[i].prefix, retval); | ||
| else | ||
| { | ||
| status = 1; | ||
| printf ("FAIL | %7s | expected: %d | got: %d\n", | ||
| testcases[i].prefix, | ||
| testcases[i].expected_output, retval); | ||
| } | ||
| } | ||
|
|
||
| return status; | ||
| } |