You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
115 lines
2.3 KiB
115 lines
2.3 KiB
6 years ago
|
From f769cb435c4db2e7f6d11e14fe87a1c81e0912fe Mon Sep 17 00:00:00 2001
|
||
|
|
From: Karel Zak <kzak@redhat.com>
|
||
|
|
Date: Wed, 23 May 2018 12:43:26 +0200
|
||
|
|
Subject: [PATCH 155/173] lslogins: fix password verification
|
||
|
|
|
||
|
|
Let's follow the standard $id$salt$encrypted password format in
|
||
|
|
verification code.
|
||
|
|
|
||
|
|
The current code is useless and for example PWD-LOCK column is always
|
||
|
|
FALSE.
|
||
|
|
|
||
|
|
Upstream: http://github.com/karelzak/util-linux/commit/214fbec40abf0432b8e7968f05024ee76d11b3c7
|
||
|
|
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1581611
|
||
|
|
Signed-off-by: Karel Zak <kzak@redhat.com>
|
||
|
|
---
|
||
|
|
login-utils/lslogins.c | 78 +++++++++++++++++++++++++++++++++++++++++++++++---
|
||
|
|
1 file changed, 74 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/login-utils/lslogins.c b/login-utils/lslogins.c
|
||
|
|
index d7a24b1fb..041053625 100644
|
||
|
|
--- a/login-utils/lslogins.c
|
||
|
|
+++ b/login-utils/lslogins.c
|
||
|
|
@@ -541,14 +541,84 @@ static int get_nprocs(const uid_t uid)
|
||
|
|
return nprocs;
|
||
|
|
}
|
||
|
|
|
||
|
|
+static const char *get_pwd_method(const char *str, const char **next, unsigned int *sz)
|
||
|
|
+{
|
||
|
|
+ const char *p = str;
|
||
|
|
+ const char *res = NULL;
|
||
|
|
+
|
||
|
|
+ if (!p || *p++ != '$')
|
||
|
|
+ return NULL;
|
||
|
|
+
|
||
|
|
+ if (sz)
|
||
|
|
+ *sz = 0;
|
||
|
|
+
|
||
|
|
+ switch (*p) {
|
||
|
|
+ case '1':
|
||
|
|
+ res = "MD5";
|
||
|
|
+ if (sz)
|
||
|
|
+ *sz = 22;
|
||
|
|
+ break;
|
||
|
|
+ case '2':
|
||
|
|
+ p++;
|
||
|
|
+ if (*p == 'a' || *p == 'y')
|
||
|
|
+ res = "Blowfish";
|
||
|
|
+ break;
|
||
|
|
+ case '5':
|
||
|
|
+ res = "SHA-256";
|
||
|
|
+ if (sz)
|
||
|
|
+ *sz = 43;
|
||
|
|
+ break;
|
||
|
|
+ case '6':
|
||
|
|
+ res = "SHA-512";
|
||
|
|
+ if (sz)
|
||
|
|
+ *sz = 86;
|
||
|
|
+ break;
|
||
|
|
+ default:
|
||
|
|
+ return NULL;
|
||
|
|
+ }
|
||
|
|
+ p++;
|
||
|
|
+
|
||
|
|
+ if (!*p || *p != '$')
|
||
|
|
+ return NULL;
|
||
|
|
+ if (next)
|
||
|
|
+ *next = ++p;
|
||
|
|
+ return res;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
+#define is_valid_pwd_char(x) (isalnum((unsigned char) (x)) || (x) == '.' || (x) == '/')
|
||
|
|
+
|
||
|
|
static int valid_pwd(const char *str)
|
||
|
|
{
|
||
|
|
- const char *p;
|
||
|
|
+ const char *p = str;
|
||
|
|
+ unsigned int sz = 0, n;
|
||
|
|
+
|
||
|
|
+ /* $id$ */
|
||
|
|
+ if (get_pwd_method(str, &p, &sz) == NULL)
|
||
|
|
+ return 0;
|
||
|
|
+ if (!*p)
|
||
|
|
+ return 0;
|
||
|
|
|
||
|
|
- for (p = str; p && *p; p++)
|
||
|
|
- if (!isalnum((unsigned int) *p))
|
||
|
|
+ /* salt$ */
|
||
|
|
+ for (; p && *p; p++) {
|
||
|
|
+ if (*p == '$') {
|
||
|
|
+ p++;
|
||
|
|
+ break;
|
||
|
|
+ }
|
||
|
|
+ if (!is_valid_pwd_char(*p))
|
||
|
|
return 0;
|
||
|
|
- return p > str ? 1 : 0;
|
||
|
|
+ }
|
||
|
|
+ if (!*p)
|
||
|
|
+ return 0;
|
||
|
|
+
|
||
|
|
+ /* encrypted */
|
||
|
|
+ for (n = 0; p && *p; p++, n++) {
|
||
|
|
+ if (!is_valid_pwd_char(*p))
|
||
|
|
+ return 0;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ if (sz && n != sz)
|
||
|
|
+ return 0;
|
||
|
|
+ return 1;
|
||
|
|
}
|
||
|
|
|
||
|
|
static struct lslogins_user *get_user_info(struct lslogins_control *ctl, const char *username)
|
||
|
|
--
|
||
|
|
2.14.4
|
||
|
|
|