aboutsummaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/lib.h5
-rw-r--r--lib/password.c172
2 files changed, 147 insertions, 30 deletions
diff --git a/lib/lib.h b/lib/lib.h
index fe494e72..ef688a32 100644
--- a/lib/lib.h
+++ b/lib/lib.h
@@ -187,6 +187,11 @@ mode_t string_to_mode(char *mode_str, mode_t base);
void mode_to_string(mode_t mode, char *buf);
// password helper functions
+#define MAX_SALT_LEN 20 //3 for id, 16 for key, 1 for '\0'
+#define SYS_FIRST_ID 100
+#define SYS_LAST_ID 999
+int get_salt(char *salt, char * algo);
+void is_valid_username(const char *name);
int read_password(char * buff, int buflen, char* mesg);
int update_password(char *filename, char* username, char* encrypted);
diff --git a/lib/password.c b/lib/password.c
index d1489eb3..b340ef48 100644
--- a/lib/password.c
+++ b/lib/password.c
@@ -1,19 +1,87 @@
-/* pwdutils.c - password read/update helper functions.
+/* password.c - password read/update helper functions.
*
* Copyright 2012 Ashwini Kumar <ak.ashwini@gmail.com>
*/
#include "toys.h"
+#include "xregcomp.h"
#include <time.h>
+static unsigned int random_number_generator(int fd)
+{
+ unsigned int randnum;
+
+ xreadall(fd, &randnum, sizeof(randnum));
+ return randnum;
+}
+
+static char inttoc(int i)
+{
+ // salt value uses 64 chracters in "./0-9a-zA-Z"
+ const char character_set[]="./0123456789abcdefghijklmnopqrstuvwxyz"
+ "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+
+ i &= 0x3f; // masking for using 10 bits only
+ return character_set[i];
+}
+
+int get_salt(char *salt, char *algo)
+{
+ int i, randfd, salt_length = 0, offset;
+
+ if (!strcmp(algo,"des")){
+ // 2 bytes salt value is used in des
+ salt_length = 2;
+ offset = 0;
+ } else {
+ *salt++ = '$';
+ if (!strcmp(algo,"md5")){
+ *salt++ = '1';
+ // 8 bytes salt value is used in md5
+ salt_length = 8;
+ } else if (!strcmp(algo,"sha256")){
+ *salt++ = '5';
+ // 16 bytes salt value is used in sha256
+ salt_length = 16;
+ } else if (!strcmp(algo,"sha512")){
+ *salt++ = '6';
+ // 16 bytes salt value is used in sha512
+ salt_length = 16;
+ } else return -1;
+
+ *salt++ = '$';
+ offset = 3;
+ }
+
+ randfd = xopen("/dev/urandom", O_RDONLY);
+ for (i=0; i<salt_length; i++)
+ salt[i] = inttoc(random_number_generator(randfd));
+ salt[salt_length+1] = '\0';
+ xclose(randfd);
+
+ return offset;
+}
+
+static void handle(int signo)
+{
+ //Dummy.. so that read breaks on the signal,
+ //instead of the applocation exit
+}
+
int read_password(char * buff, int buflen, char* mesg)
{
int i = 0;
struct termios termio, oldtermio;
+ struct sigaction sa, oldsa;
+
tcgetattr(0, &oldtermio);
tcflush(0, TCIFLUSH);
termio = oldtermio;
+ memset(&sa, 0, sizeof(sa));
+ sa.sa_handler = handle;
+ sigaction(SIGINT, &sa, &oldsa);
+
termio.c_iflag &= ~(IUCLC|IXON|IXOFF|IXANY);
termio.c_lflag &= ~(ECHO|ECHOE|ECHOK|ECHONL|TOSTOP);
tcsetattr(0, TCSANOW, &termio);
@@ -25,7 +93,10 @@ int read_password(char * buff, int buflen, char* mesg)
int ret = read(0, &buff[i], 1);
if ( ret < 0 ) {
buff[0] = 0;
+ sigaction(SIGINT, &oldsa, NULL);
tcsetattr(0, TCSANOW, &oldtermio);
+ xputc('\n');
+ fflush(stdout);
return 1;
} else if (ret == 0 || buff[i] == '\n' || buff[i] == '\r' || buflen == i+1)
{
@@ -34,35 +105,45 @@ int read_password(char * buff, int buflen, char* mesg)
}
i++;
}
-
+ sigaction(SIGINT, &oldsa, NULL);
tcsetattr(0, TCSANOW, &oldtermio);
puts("");
fflush(stdout);
return 0;
}
-static char *get_nextcolon(const char *line, char delim)
+static char *get_nextcolon(char *line, int cnt)
{
- char *current_ptr = NULL;
- if((current_ptr = strchr(line, ':')) == NULL) error_exit("Invalid Entry\n");
- return current_ptr;
+ while (cnt--) {
+ if (!(line = strchr(line, ':'))) error_exit("Invalid Entry\n");
+ line++; //jump past the colon
+ }
+ return line;
}
-int update_password(char *filename, char* username, char* encrypted)
+/*update_password is used by multiple utilities to update /etc/passwd,
+ * /etc/shadow, /etc/group and /etc/gshadow files,
+ * which are used as user, group databeses
+ * entry can be
+ * 1. encrypted password, when updating user password.
+ * 2. complete entry for user details, when creating new user
+ * 3. group members comma',' separated list, when adding user to group
+ * 4. complete entry for group details, when creating new group
+ */
+int update_password(char *filename, char* username, char* entry)
{
- char *filenamesfx = NULL, *namesfx = NULL;
- char *shadow = NULL, *sfx = NULL;
+ char *filenamesfx = NULL, *namesfx = NULL, *shadow = NULL,
+ *sfx = NULL, *line = NULL;
FILE *exfp, *newfp;
- int ret = -1; //fail
+ int ret = -1, found = 0;
struct flock lock;
- char *line = NULL;
shadow = strstr(filename, "shadow");
filenamesfx = xmsprintf("%s+", filename);
sfx = strchr(filenamesfx, '+');
exfp = fopen(filename, "r+");
- if(!exfp) {
+ if (!exfp) {
perror_msg("Couldn't open file %s",filename);
goto free_storage;
}
@@ -70,7 +151,7 @@ int update_password(char *filename, char* username, char* encrypted)
*sfx = '-';
ret = unlink(filenamesfx);
ret = link(filename, filenamesfx);
- if(ret < 0) error_msg("can't create backup file");
+ if (ret < 0) error_msg("can't create backup file");
*sfx = '+';
lock.l_type = F_WRLCK;
@@ -79,12 +160,12 @@ int update_password(char *filename, char* username, char* encrypted)
lock.l_len = 0;
ret = fcntl(fileno(exfp), F_SETLK, &lock);
- if(ret < 0) perror_msg("Couldn't lock file %s",filename);
+ if (ret < 0) perror_msg("Couldn't lock file %s",filename);
lock.l_type = F_UNLCK; //unlocking at a later stage
newfp = fopen(filenamesfx, "w+");
- if(!newfp) {
+ if (!newfp) {
error_msg("couldn't open file for writing");
ret = -1;
fclose(exfp);
@@ -93,29 +174,34 @@ int update_password(char *filename, char* username, char* encrypted)
ret = 0;
namesfx = xmsprintf("%s:",username);
- while((line = get_line(fileno(exfp))) != NULL)
+ while ((line = get_line(fileno(exfp))) != NULL)
{
- if(strncmp(line, namesfx, strlen(namesfx)) != 0)
+ if (strncmp(line, namesfx, strlen(namesfx)))
fprintf(newfp, "%s\n", line);
else {
char *current_ptr = NULL;
- fprintf(newfp, "%s%s:",namesfx,encrypted);
- current_ptr = get_nextcolon(line, ':'); //past username
- current_ptr++; //past colon ':' after username
- current_ptr = get_nextcolon(current_ptr, ':'); //past passwd
- current_ptr++; //past colon ':' after passwd
- if(shadow) {
- fprintf(newfp, "%u:",(unsigned)(time(NULL))/(24*60*60));
- current_ptr = get_nextcolon(current_ptr, ':');
- current_ptr++; //past time stamp colon.
- fprintf(newfp, "%s\n",current_ptr);
+
+ found = 1;
+ if (!strcmp(toys.which->name, "passwd")) {
+ fprintf(newfp, "%s%s:",namesfx, entry);
+ current_ptr = get_nextcolon(line, 2); //past passwd
+ if (shadow) {
+ fprintf(newfp, "%u:",(unsigned)(time(NULL))/(24*60*60));
+ current_ptr = get_nextcolon(current_ptr, 1);
+ fprintf(newfp, "%s\n",current_ptr);
+ } else fprintf(newfp, "%s\n",current_ptr);
+ } else if (!strcmp(toys.which->name, "groupadd") ||
+ !strcmp(toys.which->name, "addgroup")){
+ current_ptr = get_nextcolon(line, 3); //past gid/admin list
+ *current_ptr = '\0';
+ fprintf(newfp, "%s", line);
+ fprintf(newfp, "%s\n", entry);
}
- else fprintf(newfp, "%s\n",current_ptr);
}
-
free(line);
}
free(namesfx);
+ if (!found) fprintf(newfp, "%s\n", entry);
fcntl(fileno(exfp), F_SETLK, &lock);
fclose(exfp);
@@ -124,7 +210,7 @@ int update_password(char *filename, char* username, char* encrypted)
fsync(fileno(newfp));
fclose(newfp);
rename(filenamesfx, filename);
- if(errno) {
+ if (errno) {
perror_msg("File Writing/Saving failed: ");
unlink(filenamesfx);
ret = -1;
@@ -134,3 +220,29 @@ free_storage:
free(filenamesfx);
return ret;
}
+
+void is_valid_username(const char *name)
+{
+ regex_t rp;
+ regmatch_t rm[1];
+ int eval;
+ char *regex = "^[_.A-Za-z0-9][-_.A-Za-z0-9]*"; //User name REGEX
+
+ xregcomp(&rp, regex, REG_NEWLINE);
+
+ /* compare string against pattern -- remember that patterns
+ are anchored to the beginning of the line */
+ eval = regexec(&rp, name, 1, rm, 0);
+ regfree(&rp);
+ if (!eval && !rm[0].rm_so) {
+ int len = strlen(name);
+ if ((rm[0].rm_eo == len) ||
+ (rm[0].rm_eo == len - 1 && name[len - 1] == '$')) {
+ if (len >= LOGIN_NAME_MAX) error_exit("name is too long");
+ else return;
+ }
+ }
+ error_exit("'%s', not valid %sname",name,
+ (((toys.which->name[3] == 'g') ||
+ (toys.which->name[0] == 'g'))? "group" : "user"));
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-24 19:41:54 +0000