Skip to content

Commit 25cae3e

Browse files
blucabluca
authored
Merge pull request #20425 from Blarse/passwdqc-pr
Add passwdqc support
2 parents 535134b + 1d8aae4 commit 25cae3e

16 files changed

+282
-75
lines changed

‎meson.build‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1189,8 +1189,13 @@ else
11891189
endif
11901190
conf.set10('HAVE_LIBFDISK', have)
11911191

1192+
want_passwdqc = get_option('passwdqc')
11921193
want_pwquality = get_option('pwquality')
1193-
if want_pwquality != 'false' and not skip_deps
1194+
if want_passwdqc == 'true' and want_pwquality == 'true'
1195+
error('passwdqc and pwquality cannot be requested simultaneously')
1196+
endif
1197+
1198+
if want_pwquality != 'false' and want_passwdqc != 'true' and not skip_deps
11941199
libpwquality = dependency('pwquality',
11951200
version : '>= 1.4.1',
11961201
required : want_pwquality == 'true')
@@ -1201,6 +1206,16 @@ else
12011206
endif
12021207
conf.set10('HAVE_PWQUALITY', have)
12031208

1209+
if not have and want_passwdqc != 'false' and not skip_deps
1210+
libpasswdqc = dependency('passwdqc',
1211+
required : want_passwdqc == 'true')
1212+
have = libpasswdqc.found()
1213+
else
1214+
have = false
1215+
libpasswdqc = []
1216+
endif
1217+
conf.set10('HAVE_PASSWDQC', have)
1218+
12041219
want_seccomp = get_option('seccomp')
12051220
if want_seccomp != 'false' and not skip_deps
12061221
libseccomp = dependency('libseccomp',
@@ -4940,6 +4955,7 @@ foreach tuple : [
49404955
['microhttpd'],
49414956
['openssl'],
49424957
['p11kit'],
4958+
['passwdqc'],
49434959
['pcre2'],
49444960
['pwquality'],
49454961
['qrencode'],

‎meson_options.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -381,6 +381,8 @@ option('xenctrl', type : 'combo', choices : ['auto', 'true', 'false'],
381381
description : 'support for Xen kexec')
382382
option('pam', type : 'combo', choices : ['auto', 'true', 'false'],
383383
description : 'PAM support')
384+
option('passwdqc', type : 'combo', choices : ['auto', 'true', 'false'],
385+
description : 'libpasswdqc support')
384386
option('pwquality', type : 'combo', choices : ['auto', 'true', 'false'],
385387
description : 'libpwquality support')
386388
option('microhttpd', type : 'combo', choices : ['auto', 'true', 'false'],

‎src/cryptenroll/cryptenroll-password.c‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@
33
#include "ask-password-api.h"
44
#include "cryptenroll-password.h"
55
#include "env-util.h"
6+
#include "errno-util.h"
67
#include "escape.h"
78
#include "memory-util.h"
8-
#include "pwquality-util.h"
9+
#include "password-quality-util.h"
910
#include "strv.h"
1011

1112
int load_volume_key_password(
@@ -155,9 +156,13 @@ int enroll_password(
155156
}
156157
}
157158

158-
r = quality_check_password(new_password, NULL, &error);
159-
if (r < 0)
160-
return log_error_errno(r, "Failed to check password for quality: %m");
159+
r = check_password_quality(new_password, /* old */ NULL, /* user */ NULL, &error);
160+
if (r < 0) {
161+
if (ERRNO_IS_NOT_SUPPORTED(r))
162+
log_warning("Password quality check is not supported, proceeding anyway.");
163+
else
164+
return log_error_errno(r, "Failed to check password quality: %m");
165+
}
161166
if (r == 0)
162167
log_warning("Specified password does not pass quality checks (%s), proceeding anyway.", error);
163168

‎src/firstboot/firstboot.c‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
#include "creds-util.h"
2020
#include "dissect-image.h"
2121
#include "env-file.h"
22+
#include "errno-util.h"
2223
#include "fd-util.h"
2324
#include "fileio.h"
2425
#include "fs-util.h"
@@ -35,10 +36,10 @@
3536
#include "os-util.h"
3637
#include "parse-argument.h"
3738
#include "parse-util.h"
39+
#include "password-quality-util.h"
3840
#include "path-util.h"
3941
#include "pretty-print.h"
4042
#include "proc-cmdline.h"
41-
#include "pwquality-util.h"
4243
#include "random-util.h"
4344
#include "smack-util.h"
4445
#include "string-util.h"
@@ -789,9 +790,13 @@ static int prompt_root_password(int rfd) {
789790
break;
790791
}
791792

792-
r = quality_check_password(*a, "root", &error);
793-
if (r < 0)
794-
return log_error_errno(r, "Failed to check quality of password: %m");
793+
r = check_password_quality(*a, /* old */ NULL, "root", &error);
794+
if (r < 0) {
795+
if (ERRNO_IS_NOT_SUPPORTED(r))
796+
log_warning("Password quality check is not supported, proceeding anyway.");
797+
else
798+
return log_error_errno(r, "Failed to check password quality: %m");
799+
}
795800
if (r == 0)
796801
log_warning("Password is weak, accepting anyway: %s", error);
797802

‎src/home/homectl.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,18 +30,18 @@
3030
#include "pager.h"
3131
#include "parse-argument.h"
3232
#include "parse-util.h"
33+
#include "password-quality-util.h"
3334
#include "path-util.h"
3435
#include "percent-util.h"
3536
#include "pkcs11-util.h"
3637
#include "pretty-print.h"
3738
#include "process-util.h"
38-
#include "pwquality-util.h"
3939
#include "rlimit-util.h"
4040
#include "spawn-polkit-agent.h"
4141
#include "terminal-util.h"
4242
#include "uid-alloc-range.h"
4343
#include "user-record.h"
44-
#include "user-record-pwquality.h"
44+
#include "user-record-password-quality.h"
4545
#include "user-record-show.h"
4646
#include "user-record-util.h"
4747
#include "user-util.h"
@@ -1323,7 +1323,7 @@ static int create_home(int argc, char *argv[], void *userdata) {
13231323

13241324
/* If password quality enforcement is disabled, let's at least warn client side */
13251325

1326-
r = user_record_quality_check_password(hr, hr, &error);
1326+
r = user_record_check_password_quality(hr, hr, &error);
13271327
if (r < 0)
13281328
log_warning_errno(r, "Specified password does not pass quality checks (%s), proceeding anyway.", bus_error_message(&error, r));
13291329
}

‎src/home/homed-home.c‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131
#include "mkdir.h"
3232
#include "path-util.h"
3333
#include "process-util.h"
34-
#include "pwquality-util.h"
3534
#include "quota-util.h"
3635
#include "resize-fs.h"
3736
#include "set.h"
@@ -40,7 +39,7 @@
4039
#include "string-table.h"
4140
#include "strv.h"
4241
#include "uid-alloc-range.h"
43-
#include "user-record-pwquality.h"
42+
#include "user-record-password-quality.h"
4443
#include "user-record-sign.h"
4544
#include "user-record-util.h"
4645
#include "user-record.h"
@@ -1513,7 +1512,7 @@ int home_create(Home *h, UserRecord *secret, sd_bus_error *error) {
15131512
if (h->record->enforce_password_policy == false)
15141513
log_debug("Password quality check turned off for account, skipping.");
15151514
else {
1516-
r = user_record_quality_check_password(h->record, secret, error);
1515+
r = user_record_check_password_quality(h->record, secret, error);
15171516
if (r < 0)
15181517
return r;
15191518
}
@@ -1888,7 +1887,7 @@ int home_passwd(Home *h,
18881887
if (c->enforce_password_policy == false)
18891888
log_debug("Password quality check turned off for account, skipping.");
18901889
else {
1891-
r = user_record_quality_check_password(c, merged_secret, error);
1890+
r = user_record_check_password_quality(c, merged_secret, error);
18921891
if (r < 0)
18931892
return r;
18941893
}

‎src/home/meson.build‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ systemd_homed_sources = files(
3333
'homed-operation.c',
3434
'homed-varlink.c',
3535
'homed.c',
36-
'user-record-pwquality.c',
36+
'user-record-password-quality.c',
3737
'user-record-sign.c',
3838
'user-record-util.c',
3939
)
@@ -52,7 +52,7 @@ homectl_sources = files(
5252
'homectl-pkcs11.c',
5353
'homectl-recovery-key.c',
5454
'homectl.c',
55-
'user-record-pwquality.c',
55+
'user-record-password-quality.c',
5656
'user-record-util.c',
5757
)
5858

‎src/home/user-record-pwquality.c‎ renamed to ‎src/home/user-record-password-quality.c‎

Lines changed: 22 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,33 +4,25 @@
44
#include "errno-util.h"
55
#include "home-util.h"
66
#include "libcrypt-util.h"
7-
#include "pwquality-util.h"
7+
#include "password-quality-util.h"
88
#include "strv.h"
9-
#include "user-record-pwquality.h"
9+
#include "user-record-password-quality.h"
1010
#include "user-record-util.h"
1111

12-
#if HAVE_PWQUALITY
12+
#if HAVE_PASSWDQC || HAVE_PWQUALITY
1313

14-
int user_record_quality_check_password(
14+
int user_record_check_password_quality(
1515
UserRecord *hr,
1616
UserRecord *secret,
1717
sd_bus_error *error) {
1818

19-
_cleanup_(sym_pwquality_free_settingsp) pwquality_settings_t *pwq = NULL;
20-
char buf[PWQ_MAX_ERROR_MESSAGE_LEN];
21-
void *auxerror;
19+
_cleanup_free_ char *auxerror = NULL;
2220
int r;
2321

2422
assert(hr);
2523
assert(secret);
2624

27-
r = pwq_allocate_context(&pwq);
28-
if (ERRNO_IS_NOT_SUPPORTED(r))
29-
return 0;
30-
if (r < 0)
31-
return log_debug_errno(r, "Failed to allocate libpwquality context: %m");
32-
33-
/* This is a bit more complex than one might think at first. pwquality_check() would like to know the
25+
/* This is a bit more complex than one might think at first. check_password_quality() would like to know the
3426
* old password to make security checks. We support arbitrary numbers of passwords however, hence we
3527
* call the function once for each combination of old and new password. */
3628

@@ -56,30 +48,35 @@ int user_record_quality_check_password(
5648
if (r > 0) /* This is a new password, not suitable as old password */
5749
continue;
5850

59-
r = sym_pwquality_check(pwq, *pp, *old, hr->user_name, &auxerror);
60-
if (r < 0)
61-
return sd_bus_error_setf(error, BUS_ERROR_LOW_PASSWORD_QUALITY, "Password too weak: %s",
62-
sym_pwquality_strerror(buf, sizeof(buf), r, auxerror));
51+
r = check_password_quality(*pp, *old, hr->user_name, &auxerror);
52+
if (r <= 0)
53+
goto error;
6354

6455
called = true;
6556
}
6657

6758
if (called)
6859
continue;
6960

70-
/* If there are no old passwords, let's call pwquality_check() without any. */
71-
r = sym_pwquality_check(pwq, *pp, NULL, hr->user_name, &auxerror);
72-
if (r < 0)
73-
return sd_bus_error_setf(error, BUS_ERROR_LOW_PASSWORD_QUALITY, "Password too weak: %s",
74-
sym_pwquality_strerror(buf, sizeof(buf), r, auxerror));
61+
/* If there are no old passwords, let's call check_password_quality() without any. */
62+
r = check_password_quality(*pp, /* old */ NULL, hr->user_name, &auxerror);
63+
if (r <= 0)
64+
goto error;
7565
}
76-
7766
return 1;
67+
68+
error:
69+
if (r == 0)
70+
return sd_bus_error_setf(error, BUS_ERROR_LOW_PASSWORD_QUALITY,
71+
"Password too weak: %s", auxerror);
72+
if (ERRNO_IS_NOT_SUPPORTED(r))
73+
return 0;
74+
return log_debug_errno(r, "Failed to check password quality: %m");
7875
}
7976

8077
#else
8178

82-
int user_record_quality_check_password(
79+
int user_record_check_password_quality(
8380
UserRecord *hr,
8481
UserRecord *secret,
8582
sd_bus_error *error) {

‎src/home/user-record-pwquality.h‎ renamed to ‎src/home/user-record-password-quality.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@
44
#include "sd-bus.h"
55
#include "user-record.h"
66

7-
int user_record_quality_check_password(UserRecord *hr, UserRecord *secret, sd_bus_error *error);
7+
int user_record_check_password_quality(UserRecord *hr, UserRecord *secret, sd_bus_error *error);

‎src/shared/meson.build‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,11 +128,12 @@ shared_sources = files(
128128
'pager.c',
129129
'parse-argument.c',
130130
'parse-helpers.c',
131+
'password-quality-util-passwdqc.c',
132+
'password-quality-util-pwquality.c',
131133
'pcre2-util.c',
132134
'pkcs11-util.c',
133135
'pretty-print.c',
134136
'ptyfwd.c',
135-
'pwquality-util.c',
136137
'qrcode-util.c',
137138
'quota-util.c',
138139
'reboot-util.c',

0 commit comments

Comments
 (0)