pam_unix: Prefer a gensalt function, that supports auto entropy.

* modules/pam_unix/pam_unix_passwd.c: Initialize rounds parameter to 0.
* modules/pam_unix/passverify.c: Prefer gensalt with auto entropy.
* modules/pam_unix/support.c: Fix sanitizing of rounds parameter.

diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
index 9d0aa73323649aa23f87e97c9046c5dd6ee22f38..f2c42513a7ca87a15eb37a88a33c4a15955c9c98 100644 (file)
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -603,7 +603,7 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)
        unsigned int ctrl, lctrl;
        int retval;
        int remember = -1;
-       int rounds = -1;
+       int rounds = 0;
        int pass_min_len = 0;
 
        /* <DO NOT free() THESE> */

diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
index 1f433b3a92b94c8be5050ed2b34256cf10e00681..0d2c80298356f727e8fea609a7ebec74b501f3d2 100644 (file)
--- a/modules/pam_unix/passverify.c
+++ b/modules/pam_unix/passverify.c
@@ -375,7 +375,12 @@ PAMH_ARG_DECL(char * create_password_hash,
        const char *password, unsigned int ctrl, int rounds)
 {
        const char *algoid;
+#if defined(CRYPT_GENSALT_OUTPUT_SIZE) && CRYPT_GENSALT_OUTPUT_SIZE > 64
+       /* Strings returned by crypt_gensalt_rn will be no longer than this. */
+       char salt[CRYPT_GENSALT_OUTPUT_SIZE];
+#else
        char salt[64]; /* contains rounds number + max 16 bytes of salt + algo id */
+#endif
        char *sp;
 #ifdef HAVE_CRYPT_R
        struct crypt_data *cdata = NULL;
@@ -406,6 +411,13 @@ PAMH_ARG_DECL(char * create_password_hash,
                return crypted;
        }
 
+#if defined(CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY) && CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY
+       /*
+        * Any version of libcrypt supporting auto entropy is
+        * guaranteed to have crypt_gensalt_rn().
+        */
+       sp = crypt_gensalt_rn(algoid, rounds, NULL, 0, salt, sizeof(salt));
+#else
 #ifdef HAVE_CRYPT_GENSALT_R
        if (on(UNIX_BLOWFISH_PASS, ctrl)) {
                char entropy[17];
@@ -423,6 +435,7 @@ PAMH_ARG_DECL(char * create_password_hash,
 #ifdef HAVE_CRYPT_GENSALT_R
        }
 #endif
+#endif /* CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY */
 #ifdef HAVE_CRYPT_R
        sp = NULL;
        cdata = malloc(sizeof(*cdata));

diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
index f2e28d35c0da6937faaaa65115ac335ae9f42b98..753e5f894461f692373bb8feeb4fcbe22e326c82 100644 (file)
--- a/modules/pam_unix/support.c
+++ b/modules/pam_unix/support.c
@@ -175,6 +175,7 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds,
 
            if (val) {
              *rounds = strtol(val, NULL, 10);
+             set(UNIX_ALGO_ROUNDS, ctrl);
              free (val);
            }
          }
@@ -254,11 +255,13 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds,
                        if (*rounds < 4 || *rounds > 31)
                                *rounds = 5;
                } else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl)) {
-                       if ((*rounds < 1000) || (*rounds == INT_MAX))
+                       if ((*rounds < 1000) || (*rounds == INT_MAX)) {
                                /* don't care about bogus values */
+                               *rounds = 0;
                                unset(UNIX_ALGO_ROUNDS, ctrl);
-                       if (*rounds >= 10000000)
+                       } else if (*rounds >= 10000000) {
                                *rounds = 9999999;
+                       {
                }
        }