[prev in list] [next in list] [prev in thread] [next in thread] 

List:       busybox
Subject:    [PATCH v3] pw_encrypt: Add option to enable bcrypt support
From:       Andreas Helmcke <ahe () helmcke ! name>
Date:       2022-05-06 8:01:57
Message-ID: 0d194913-e463-8d26-42c8-d012858f36c3 () helmcke ! name
[Download RAW message or body]

Adds an option to the Login/Password Management Utilities menu to enable 
bcrypt support in passwd and chpasswd.

Add support for bcrypt to BusyBox chpasswd & passwd.

Co-authored-by: Andreas Helmcke <ahe@helmcke.name>
Signed-off-by: Andreas Helmcke <ahe@helmcke.name>
Original-work-by: Scott Court <z5t1@z5t1.com>
---
Changes v2->v3:
  - Updated commit message to give credits to original author.

Changes v1->v2:
- better help texts (hopefully)
- check FEATURE_BCRYPT_COST parameter at compile time.

Based on patch proposed by Scott Court.
Changes to the orignal patch:
- added config option for bcrypt cost
- made code changes fully dependend on config option
- changed algorithm tag to $2b$
- help texts added for bcrypt option


  include/libbb.h       |  5 +++++
  include/usage.src.h   |  5 +++++
  libbb/pw_encrypt.c    | 14 ++++++++++++++
  loginutils/Config.src | 23 +++++++++++++++++++++++
  loginutils/chpasswd.c |  3 ++-
  5 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/include/libbb.h b/include/libbb.h
index 6aeec249d..c6f769082 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -1776,8 +1776,13 @@ extern int obscure(const char *old, const char 
*newval, const struct passwd *pwd
   * (otherwise we risk having same salt generated)
   */
  extern int crypt_make_salt(char *p, int cnt /*, int rnd*/) FAST_FUNC;
+#if ENABLE_USE_BCRYPT
+/* "$NX$10$" + bcrypt_salt_24_bytes + NUL */
+#define MAX_PW_SALT_LEN (7 + 24 + 1)
+#else
  /* "$N$" + sha_salt_16_bytes + NUL */
  #define MAX_PW_SALT_LEN (3 + 16 + 1)
+#endif
  extern char* crypt_make_pw_salt(char p[MAX_PW_SALT_LEN], const char 
*algo) FAST_FUNC;


diff --git a/include/usage.src.h b/include/usage.src.h
index 5d2038834..d8a679ab3 100644
--- a/include/usage.src.h
+++ b/include/usage.src.h
@@ -18,8 +18,13 @@
  #define scripted_full_usage ""

  #if !ENABLE_USE_BB_CRYPT || ENABLE_USE_BB_CRYPT_SHA
+#if ENABLE_USE_BCRYPT
+# define CRYPT_METHODS_HELP_STR "des,md5,sha256/512,bcrypt" \
+    " (default "CONFIG_FEATURE_DEFAULT_PASSWD_ALGO")"
+#else
  # define CRYPT_METHODS_HELP_STR "des,md5,sha256/512" \
      " (default "CONFIG_FEATURE_DEFAULT_PASSWD_ALGO")"
+#endif
  #else
  # define CRYPT_METHODS_HELP_STR "des,md5" \
      " (default "CONFIG_FEATURE_DEFAULT_PASSWD_ALGO")"
diff --git a/libbb/pw_encrypt.c b/libbb/pw_encrypt.c
index 3463fd95b..5b71a54a5 100644
--- a/libbb/pw_encrypt.c
+++ b/libbb/pw_encrypt.c
@@ -70,6 +70,20 @@ char* FAST_FUNC crypt_make_pw_salt(char 
salt[MAX_PW_SALT_LEN], const char *algo)
              salt[1] = '5' + (strcasecmp(algo, "sha512") == 0);
              len = 16/2;
          }
+#endif
+#if ENABLE_USE_BCRYPT
+#if !ENABLE_FEATURE_BCRYPT_COST || CONFIG_FEATURE_BCRYPT_COST < 4 || 
CONFIG_FEATURE_BCRYPT_COST > 31
+#error Bad FEATURE_BCRYPT_COST in .config
+#endif
+        if ((algo[0]|0x20) == 'b') { /* bcrypt */
+            salt[1] = '2';
+            salt[2] = 'b';
+            *salt_ptr++ = '$';
+            *salt_ptr++ = ((CONFIG_FEATURE_BCRYPT_COST) / 10) + '0';
+            *salt_ptr++ = ((CONFIG_FEATURE_BCRYPT_COST) % 10) + '0';
+            *salt_ptr++ = '$';
+            len = 24/2;
+        }
  #endif
      }
      crypt_make_salt(salt_ptr, len);
diff --git a/loginutils/Config.src b/loginutils/Config.src
index cbb09646b..cdf36a55f 100644
--- a/loginutils/Config.src
+++ b/loginutils/Config.src
@@ -91,6 +91,29 @@ config USE_BB_CRYPT_SHA
      With this option off, login will fail password check for any
      user which has password encrypted with these algorithms.

+config USE_BCRYPT
+    bool "Enable bcrypt and other password hashes."
+    default n
+    depends on !USE_BB_CRYPT
+    help
+    Enable this if you use newer password hashes like bcrypt. E.g.
+    if you have passwords starting with $2a$, $2y$ or $2b$ in your
+    /etc/passwd or /etc/shadow files. Requires the use of a C
+    library that supports these hashes.
+    Adds support for bcrypt to passwd, cryptpw and chpasswd.
+
+config FEATURE_BCRYPT_COST
+    int "bcrypt cost"
+    range 4 31
+    default 10
+    depends on USE_BCRYPT
+    help
+    Cost parameter for the bcrypt hashing algorithm.
+    Specifies the number of rounds to use. Must be between 4 and 31,
+    inclusive. This value is logarithmic, the actual number of
+    iterations used will be 2**rounds – increasing the rounds by +1
+    will double the amount of time taken.
+
  INSERT

  endmenu
diff --git a/loginutils/chpasswd.c b/loginutils/chpasswd.c
index a032abbed..74673fa6f 100644
--- a/loginutils/chpasswd.c
+++ b/loginutils/chpasswd.c
@@ -17,7 +17,8 @@
  //config:    default "des"
  //config:    depends on PASSWD || CRYPTPW || CHPASSWD
  //config:    help
-//config:    Possible choices are "d[es]", "m[d5]", "s[ha256]" or "sha512".
+//config:    Possible choices are "d[es]", "m[d5]", "s[ha256]",
+//config:    "sha512" or "b[crypt]" (when enabled).

  //applet:IF_CHPASSWD(APPLET(chpasswd, BB_DIR_USR_SBIN, BB_SUID_DROP))

-- 
2.34.1

_______________________________________________
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox

[prev in list] [next in list] [prev in thread] [next in thread]