1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "dlfcn-util.h"
#include "errno-util.h"
#include "log.h"
#include "macro.h"
#include "memory-util.h"
#include "password-quality-util.h"
#include "strv.h"
#if HAVE_PASSWDQC
static void *passwdqc_dl = NULL;
DLSYM_PROTOTYPE(passwdqc_params_reset) = NULL;
DLSYM_PROTOTYPE(passwdqc_params_load) = NULL;
DLSYM_PROTOTYPE(passwdqc_params_parse) = NULL;
DLSYM_PROTOTYPE(passwdqc_params_free) = NULL;
DLSYM_PROTOTYPE(passwdqc_check) = NULL;
DLSYM_PROTOTYPE(passwdqc_random) = NULL;
int dlopen_passwdqc(void) {
ELF_NOTE_DLOPEN("passwdqc",
"Support for password quality checks",
ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED,
"libpasswdqc.so.1");
return dlopen_many_sym_or_warn(
&passwdqc_dl, "libpasswdqc.so.1", LOG_DEBUG,
DLSYM_ARG(passwdqc_params_reset),
DLSYM_ARG(passwdqc_params_load),
DLSYM_ARG(passwdqc_params_parse),
DLSYM_ARG(passwdqc_params_free),
DLSYM_ARG(passwdqc_check),
DLSYM_ARG(passwdqc_random));
}
static int pwqc_allocate_context(passwdqc_params_t **ret) {
_cleanup_(sym_passwdqc_params_freep) passwdqc_params_t *params = NULL;
_cleanup_free_ char *load_reason = NULL;
int r;
assert(ret);
r = dlopen_passwdqc();
if (r < 0)
return r;
params = new0(passwdqc_params_t, 1);
if (!params)
return log_oom();
sym_passwdqc_params_reset(params);
r = sym_passwdqc_params_load(params, &load_reason, "/etc/passwdqc.conf");
if (r < 0) {
if (!load_reason)
return log_oom();
log_debug("Failed to load passwdqc configuration file, ignoring: %s", load_reason);
}
*ret = TAKE_PTR(params);
return 0;
}
int suggest_passwords(void) {
_cleanup_(sym_passwdqc_params_freep) passwdqc_params_t *params = NULL;
_cleanup_strv_free_erase_ char **suggestions = NULL;
_cleanup_(erase_and_freep) char *joined = NULL;
int r;
r = pwqc_allocate_context(¶ms);
if (r < 0) {
if (ERRNO_IS_NOT_SUPPORTED(r))
return 0;
return log_error_errno(r, "Failed to allocate libpasswdqc context: %m");
}
suggestions = new0(char*, N_SUGGESTIONS+1);
if (!suggestions)
return log_oom();
for (size_t i = 0; i < N_SUGGESTIONS; i++) {
suggestions[i] = sym_passwdqc_random(¶ms->qc);
if (!suggestions[i])
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to generate password, ignoring");
}
joined = strv_join(suggestions, " ");
if (!joined)
return log_oom();
printf("Password suggestions: %s\n", joined);
return 1;
}
int check_password_quality(
const char *password,
const char *old,
const char *username,
char **ret_error) {
_cleanup_(sym_passwdqc_params_freep) passwdqc_params_t *params = NULL;
const char *check_reason;
int r;
assert(password);
r = pwqc_allocate_context(¶ms);
if (r < 0)
return log_debug_errno(r, "Failed to allocate libpasswdqc context: %m");
if (username) {
const struct passwd pw = {
.pw_name = (char *) username,
/*
* passwdqc_check() could use this information to check
* whether the password is based on the personal login information,
* but we cannot provide it.
*/
.pw_passwd = (char *) "",
.pw_gecos = (char *) "",
.pw_dir = (char *) "",
.pw_shell = (char *) ""
};
check_reason = sym_passwdqc_check(¶ms->qc, password, old, &pw);
} else
check_reason = sym_passwdqc_check(¶ms->qc, password, old, /* pw */ NULL);
if (check_reason) {
if (ret_error) {
char *e = strdup(check_reason);
if (!e)
return log_oom();
*ret_error = e;
}
return 0; /* all bad */
}
return 1; /* all good */
}
#endif
|
