logo

skeud

Simple and portable utilities to deal with user accounts (su, login)git clone https://anongit.hacktivis.me/git/skeud.git/

common.c (2513B)

    

  1. // SPDX-FileCopyrightText: 2022 Haelwenn (lanodan) Monnier <contact+skeud@hacktivis.me>
  2. // SPDX-License-Identifier: MPL-2.0
  4. #define _POSIX_C_SOURCE 200809L
  5. // for explicit_bzero and termios
  6. #define _DEFAULT_SOURCE
  8. #include "common.h"
  10. #include <errno.h>   // errno
  11. #include <stdio.h>   // fclose, fopen, fprintf, perror, getline, fileno
  12. #include <string.h>  // explicit_bzero
  13. #include <termios.h> // tcgetattr, tcsetattr
  14. #include <unistd.h>  // crypt
  16. size_t
  17. smin(size_t a, size_t b)
  18. {
  19. 	return a < b ? a : b;
  20. }
  22. // Needs to be constant-time so the hash can't be guessed via using a rainbow-table
  23. bool
  24. hash_match(const char *a, const char *b)
  25. {
  26. 	/* flawfinder: ignore CWE-126 */
  27. 	size_t len_a = strlen(a);
  28. 	/* flawfinder: ignore CWE-126 */
  29. 	size_t len_b = strlen(b);
  30. 	size_t n     = smin(len_a, len_b);
  31. 	bool ret     = true;
  33. 	for(size_t i = 0; i < n; i++)
  34. 		if(a[i] != b[i]) ret = false;
  36. 	if(len_a != len_b)
  37. 		return false;
  38. 	else
  39. 		return ret;
  40. }
  42. bool
  43. skeud_crypt_check(const char *hash, const char *password)
  44. {
  45. 	if(!hash) return false;
  46. 	if(strcmp(hash, "") == 0) return false;
  48. 	/* flawfinder: ignore CWE-327, crypt is the only relevant function */
  49. 	char *chk_hash = crypt(password, hash);
  50. 	if(chk_hash == NULL)
  51. 	{
  52. 		perror("skeud_crypt_check: error: crypt");
  53. 		return false;
  54. 	}
  56. 	bool match = hash_match(hash, chk_hash);
  58. 	// cleanup
  59. 	chk_hash = crypt("", hash);
  61. 	return match;
  62. }
  64. ssize_t
  65. skeud_getpass(char **password)
  66. {
  67. 	struct termios t;
  68. 	size_t len  = 0;
  69. 	ssize_t got = -1;
  71. 	/* flawfinder: ignore CWE-362 */
  72. 	FILE *tty = fopen("/dev/tty", "rb+");
  73. 	if(tty == NULL)
  74. 	{
  75. 		perror("skeud_getpass: error: open(\"/dev/tty\")");
  76. 		return got;
  77. 	}
  78. 	int tty_fd = fileno(tty);
  79. 	if(tty_fd < 0)
  80. 	{
  81. 		perror("skeud_getpass: error: fileno(tty)");
  82. 		goto getpass_end;
  83. 	}
  85. 	if(tcgetattr(tty_fd, &t) < 0)
  86. 	{
  87. 		perror("skeud_getpass: error: tcgetattr");
  88. 		goto getpass_end;
  89. 	}
  91. 	fprintf(tty, "Password: ");
  92. 	t.c_lflag &= ~ECHO;
  93. 	if(tcsetattr(tty_fd, TCSANOW, &t) < 0)
  94. 	{
  95. 		perror("skeud_getpass: error: tcsetattr(~ECHO)");
  96. 		goto getpass_end;
  97. 	}
  99. 	errno = 0;
  100. 	got   = getline(password, &len, tty);
  101. 	if(got < 0)
  102. 	{
  103. 		if(errno != 0) perror("skeud_getpass: error: getline");
  104. 		goto getpass_clean;
  105. 	}
  106. 	fprintf(tty, "\n");
  107. 	(*password)[got]     = 0;
  108. 	(*password)[got - 1] = 0;
  109. 	got--;
  111. getpass_clean:
  112. 	t.c_lflag ^= ECHO;
  113. 	if(tcsetattr(tty_fd, TCSANOW, &t) < 0)
  114. 	{
  115. 		perror("skeud_getpass: error: tcsetattr(ECHO)");
  116. 		explicit_bzero(password, got);
  117. 		got = -1;
  118. 		goto getpass_end;
  119. 	}
  121. getpass_end:
  122. 	fclose(tty);
  124. 	return got;
  125. }