openbsd/src/lib/libc/crypt/cryptutil.c, branch OPENBSD_7_9_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE 2024-01-22T19:26:55+00:00 make login.conf(5) and crypt_newhash(3) and the underlying code 2024-01-22T19:26:55+00:00 deraadt 2024-01-22T19:26:55+00:00 urn:sha1:0c727f8ea7bc10967b9f03fd9f3b59cd0b09c6b6 consistant regarding bcrypt,a instead of blowfish,a. "blowfish" is a historical alias which we don't need to document as firmly as "bcrypt". report about difficult manual page discovery from ataraxia937 ok millert Wrap <pwd.h> so that calls go direct and the symbols are all weak. 2015-09-13T15:33:48+00:00 guenther 2015-09-13T15:33:48+00:00 urn:sha1:5f424ba084ead7e716a6e98064fa03a19a93a9ac Hide bcrypt_autorounds(), prefixing with an underbar for static builds. Wrap <unistd.h> so that internal calls go direct and they're all weak symbols 2015-09-12T14:56:50+00:00 guenther 2015-09-12T14:56:50+00:00 urn:sha1:4dbec400d163cf80f90bc9f4b22a894e932174ec Delete unused 'fd' argument from internal function oldttyname() permit "bcrypt" as an alias for "blowfish". this is, after all, what 2015-07-23T22:19:03+00:00 tedu 2015-07-23T22:19:03+00:00 urn:sha1:e217f2cd00e15d8c7e2b29f02062884a4f6f298b 99% of the world calls it. allow just "bcrypt" without params to mean auto-tune ("bcrypt,a"). default remains 8 rounds (for now) ok deraadt Set errno to EINVAL, instead of letting ERANGE escape out. 2015-02-24T19:19:32+00:00 tedu 2015-02-24T19:19:32+00:00 urn:sha1:2183f1732174b17cc3ac80af51756f37e634f81d Printing strerror() in that case will say result too large, even if rounds is actually too small. invalid is less specific, but less incorrect. ok millert remove unused variable 2015-01-15T17:32:43+00:00 chl 2015-01-15T17:32:43+00:00 urn:sha1:6a7633f6a9b43d30a021cd47721a203fab779bde ok tedu@ copy bcrypt autotune from encrypt(1) and expose via crypt_newhash 2014-12-30T10:27:24+00:00 tedu 2014-12-30T10:27:24+00:00 urn:sha1:1d2efc1853353eaa45dfbe2d8bb0849c64d26884 ok deraadt miod simplify crypt_checkpass. The API promise is that this function doesn't 2014-12-24T22:10:34+00:00 tedu 2014-12-24T22:10:34+00:00 urn:sha1:2624c48e3a661801d934630f50049092517e4ebf use global data. The simplest fix is to only check blowfish passwords, and implicitly lock out DES passwords. crypt_checkpass is currently only used in one place, passwd, to verify the local user's password, so this is probably acceptable. Gives people a little more time to migrate away from DES before introduing checkpass into more places. check crypt() for null. noticed by Jonas Termansen 2014-11-24T21:36:35+00:00 tedu 2014-11-24T21:36:35+00:00 urn:sha1:64242a3cc6a21fd7a5029ca38a09c1794232ee2e Let crypt_checkpass() set EACCES after bcrypt_checkpass() failure; 2014-11-21T12:32:38+00:00 schwarze 2014-11-21T12:32:38+00:00 urn:sha1:891ef0a4b17000b796f7fa279607b8d1d5e6e667 ok tedu@