|
 |
a0fce7f |
From 05aa693b7db6b818d31e41f0cab1d5fb4f49600e Mon Sep 17 00:00:00 2001
|
|
|
a0fce7f |
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
|
|
|
a0fce7f |
Date: Thu, 15 Nov 2018 15:58:56 +0100
|
|
|
a0fce7f |
Subject: [PATCH] pam_unix: Prefer a gensalt function, that supports auto
|
|
|
a0fce7f |
entropy.
|
|
|
a0fce7f |
|
|
|
a0fce7f |
* modules/pam_unix/pam_unix_passwd.c: Initialize rounds parameter to 0.
|
|
|
a0fce7f |
* modules/pam_unix/passverify.c: Prefer gensalt with auto entropy.
|
|
|
a0fce7f |
* modules/pam_unix/support.c: Fix sanitizing of rounds parameter.
|
|
|
a0fce7f |
---
|
|
|
a0fce7f |
modules/pam_unix/pam_unix_passwd.c | 2 +-
|
|
|
a0fce7f |
modules/pam_unix/passverify.c | 13 +++++++++++++
|
|
|
a0fce7f |
modules/pam_unix/support.c | 7 +++++--
|
|
|
a0fce7f |
3 files changed, 19 insertions(+), 3 deletions(-)
|
|
|
a0fce7f |
|
|
|
a0fce7f |
Index: Linux-PAM-1.3.1/modules/pam_unix/pam_unix_passwd.c
|
|
|
a0fce7f |
===================================================================
|
|
|
a0fce7f |
--- Linux-PAM-1.3.1.orig/modules/pam_unix/pam_unix_passwd.c
|
|
|
a0fce7f |
+++ Linux-PAM-1.3.1/modules/pam_unix/pam_unix_passwd.c
|
|
|
a0fce7f |
@@ -607,7 +607,7 @@ pam_sm_chauthtok(pam_handle_t *pamh, int
|
|
|
a0fce7f |
unsigned int ctrl, lctrl;
|
|
|
a0fce7f |
int retval;
|
|
|
a0fce7f |
int remember = -1;
|
|
|
a0fce7f |
- int rounds = -1;
|
|
|
a0fce7f |
+ int rounds = 0;
|
|
|
a0fce7f |
int pass_min_len = 0;
|
|
|
a0fce7f |
|
|
|
a0fce7f |
/* <DO NOT free() THESE> */
|
|
|
a0fce7f |
Index: Linux-PAM-1.3.1/modules/pam_unix/passverify.c
|
|
|
a0fce7f |
===================================================================
|
|
|
a0fce7f |
--- Linux-PAM-1.3.1.orig/modules/pam_unix/passverify.c
|
|
|
a0fce7f |
+++ Linux-PAM-1.3.1/modules/pam_unix/passverify.c
|
|
|
a0fce7f |
@@ -375,7 +375,12 @@ PAMH_ARG_DECL(char * create_password_has
|
|
|
a0fce7f |
const char *password, unsigned int ctrl, int rounds)
|
|
|
a0fce7f |
{
|
|
|
a0fce7f |
const char *algoid;
|
|
|
a0fce7f |
+#if defined(CRYPT_GENSALT_OUTPUT_SIZE) && CRYPT_GENSALT_OUTPUT_SIZE > 64
|
|
|
a0fce7f |
+ /* Strings returned by crypt_gensalt_rn will be no longer than this. */
|
|
|
a0fce7f |
+ char salt[CRYPT_GENSALT_OUTPUT_SIZE];
|
|
|
a0fce7f |
+#else
|
|
|
a0fce7f |
char salt[64]; /* contains rounds number + max 16 bytes of salt + algo id */
|
|
|
a0fce7f |
+#endif
|
|
|
a0fce7f |
char *sp;
|
|
|
a0fce7f |
#ifdef HAVE_CRYPT_R
|
|
|
a0fce7f |
struct crypt_data *cdata = NULL;
|
|
|
a0fce7f |
@@ -406,6 +411,13 @@ PAMH_ARG_DECL(char * create_password_has
|
|
|
a0fce7f |
return crypted;
|
|
|
a0fce7f |
}
|
|
|
a0fce7f |
|
|
|
a0fce7f |
+#if defined(CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY) && CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY
|
|
|
a0fce7f |
+ /*
|
|
|
a0fce7f |
+ * Any version of libcrypt supporting auto entropy is
|
|
|
a0fce7f |
+ * guaranteed to have crypt_gensalt_rn().
|
|
|
a0fce7f |
+ */
|
|
|
a0fce7f |
+ sp = crypt_gensalt_rn(algoid, rounds, NULL, 0, salt, sizeof(salt));
|
|
|
a0fce7f |
+#else
|
|
|
a0fce7f |
#ifdef HAVE_CRYPT_GENSALT_R
|
|
|
a0fce7f |
if (on(UNIX_BLOWFISH_PASS, ctrl)) {
|
|
|
a0fce7f |
char entropy[17];
|
|
|
a0fce7f |
@@ -423,6 +435,7 @@ PAMH_ARG_DECL(char * create_password_has
|
|
|
a0fce7f |
#ifdef HAVE_CRYPT_GENSALT_R
|
|
|
a0fce7f |
}
|
|
|
a0fce7f |
#endif
|
|
|
a0fce7f |
+#endif /* CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY */
|
|
|
a0fce7f |
#ifdef HAVE_CRYPT_R
|
|
|
a0fce7f |
sp = NULL;
|
|
|
a0fce7f |
cdata = malloc(sizeof(*cdata));
|
|
|
a0fce7f |
Index: Linux-PAM-1.3.1/modules/pam_unix/support.c
|
|
|
a0fce7f |
===================================================================
|
|
|
a0fce7f |
--- Linux-PAM-1.3.1.orig/modules/pam_unix/support.c
|
|
|
a0fce7f |
+++ Linux-PAM-1.3.1/modules/pam_unix/support.c
|
|
|
a0fce7f |
@@ -175,6 +175,7 @@ int _set_ctrl(pam_handle_t *pamh, int fl
|
|
|
a0fce7f |
|
|
|
a0fce7f |
if (val) {
|
|
|
a0fce7f |
*rounds = strtol(val, NULL, 10);
|
|
|
a0fce7f |
+ set(UNIX_ALGO_ROUNDS, ctrl);
|
|
|
a0fce7f |
free (val);
|
|
|
a0fce7f |
}
|
|
|
a0fce7f |
}
|
|
|
a0fce7f |
@@ -254,11 +255,13 @@ int _set_ctrl(pam_handle_t *pamh, int fl
|
|
|
a0fce7f |
if (*rounds < 4 || *rounds > 31)
|
|
|
a0fce7f |
*rounds = 5;
|
|
|
a0fce7f |
} else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl)) {
|
|
|
a0fce7f |
- if ((*rounds < 1000) || (*rounds == INT_MAX))
|
|
|
a0fce7f |
+ if ((*rounds < 1000) || (*rounds == INT_MAX)) {
|
|
|
a0fce7f |
/* don't care about bogus values */
|
|
|
a0fce7f |
+ *rounds = 0;
|
|
|
a0fce7f |
unset(UNIX_ALGO_ROUNDS, ctrl);
|
|
|
a0fce7f |
- if (*rounds >= 10000000)
|
|
|
a0fce7f |
+ } else if (*rounds >= 10000000) {
|
|
|
a0fce7f |
*rounds = 9999999;
|
|
|
a0fce7f |
+ }
|
|
|
a0fce7f |
}
|
|
|
a0fce7f |
}
|
|
|
a0fce7f |
|