logo

skeud

Simple and portable utilities to deal with user accounts (su, login)git clone https://anongit.hacktivis.me/git/skeud.git/

common.c (2444B)

    

  1. // SPDX-FileCopyrightText: 2022 Haelwenn (lanodan) Monnier <contact+skeud@hacktivis.me>
  2. // SPDX-License-Identifier: MPL-2.0
  4. #define _POSIX_C_SOURCE 200809L
  5. // for explicit_bzero and termios
  6. #define _DEFAULT_SOURCE
  8. #include "common.h"
  10. #include <errno.h>   // errno
  11. #include <stdio.h>   // fclose, fopen, fprintf, perror, getline, fileno
  12. #include <string.h>  // explicit_bzero
  13. #include <termios.h> // tcgetattr, tcsetattr
  14. #include <unistd.h>  // crypt
  16. size_t
  17. smin(size_t a, size_t b)
  18. {
  19. 	return a < b ? a : b;
  20. }
  22. // Needs to be constant-time so the hash can't be guessed via using a rainbow-table
  23. bool
  24. hash_match(char *a, char *b)
  25. {
  26. 	/* flawfinder: ignore CWE-126 */
  27. 	size_t len_a = strlen(a);
  28. 	/* flawfinder: ignore CWE-126 */
  29. 	size_t len_b = strlen(b);
  30. 	size_t n     = smin(len_a, len_b);
  31. 	bool ret     = true;
  33. 	for(size_t i = 0; i < n; i++)
  34. 		if(a[i] != b[i]) ret = false;
  36. 	if(len_a != len_b)
  37. 		return false;
  38. 	else
  39. 		return ret;
  40. }
  42. bool
  43. skeud_crypt_check(char *hash, char *password)
  44. {
  45. 	if(!hash) return false;
  46. 	if(strcmp(hash, "") == 0) return false;
  48. 	/* flawfinder: ignore CWE-327, crypt is the only relevant function */
  49. 	char *chk_hash = crypt(password, hash);
  50. 	if(chk_hash == NULL)
  51. 	{
  52. 		perror("skeud_crypt_check: crypt");
  53. 		return false;
  54. 	}
  56. 	bool match = hash_match(hash, chk_hash);
  58. 	explicit_bzero(chk_hash, sizeof(chk_hash));
  60. 	return match;
  61. }
  63. ssize_t
  64. skeud_getpass(char **password)
  65. {
  66. 	struct termios t;
  67. 	size_t len  = 0;
  68. 	ssize_t got = -1;
  70. 	/* flawfinder: ignore CWE-362 */
  71. 	FILE *tty = fopen("/dev/tty", "rb+");
  72. 	if(tty == NULL)
  73. 	{
  74. 		perror("skeud_getpass: open(\"/dev/tty\")");
  75. 		return got;
  76. 	}
  77. 	int tty_fd = fileno(tty);
  78. 	if(tty_fd < 0)
  79. 	{
  80. 		perror("skeud_getpass: fileno(tty)");
  81. 		goto getpass_end;
  82. 	}
  84. 	if(tcgetattr(tty_fd, &t) < 0)
  85. 	{
  86. 		perror("skeud_getpass: tcgetattr");
  87. 		goto getpass_end;
  88. 	}
  90. 	fprintf(tty, "Password: ");
  91. 	t.c_lflag &= ~ECHO;
  92. 	if(tcsetattr(tty_fd, TCSANOW, &t) < 0)
  93. 	{
  94. 		perror("skeud_getpass: tcsetattr(~ECHO)");
  95. 		goto getpass_end;
  96. 	}
  98. 	errno = 0;
  99. 	got   = getline(password, &len, tty);
  100. 	fprintf(tty, "\n");
  101. 	if(got < 0)
  102. 	{
  103. 		if(errno != 0) perror("skeud_getpass: getline");
  104. 		goto getpass_clean;
  105. 	}
  106. 	(*password)[got]     = 0;
  107. 	(*password)[got - 1] = 0;
  108. 	got--;
  110. getpass_clean:
  111. 	t.c_lflag ^= ECHO;
  112. 	if(tcsetattr(tty_fd, TCSANOW, &t) < 0)
  113. 	{
  114. 		perror("skeud_getpass: tcsetattr(ECHO)");
  115. 		explicit_bzero(password, got);
  116. 		got = -1;
  117. 		goto getpass_end;
  118. 	}
  120. getpass_end:
  121. 	fclose(tty);
  123. 	return got;
  124. }