1 kumpf 1.2 /*

  2 martin 1.3 //%LICENSE////////////////////////////////////////////////////////////////

  3 martin 1.4 //

  4 martin 1.3 // Licensed to The Open Group (TOG) under one or more contributor license
  5            // agreements.  Refer to the OpenPegasusNOTICE.txt file distributed with
  6            // this work for additional information regarding copyright ownership.
  7            // Each contributor licenses this file to you under the OpenPegasus Open
  8            // Source License; you may not use this file except in compliance with the
  9            // License.

 10 martin 1.4 //

 11 martin 1.3 // Permission is hereby granted, free of charge, to any person obtaining a
 12            // copy of this software and associated documentation files (the "Software"),
 13            // to deal in the Software without restriction, including without limitation
 14            // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 15            // and/or sell copies of the Software, and to permit persons to whom the
 16            // Software is furnished to do so, subject to the following conditions:

 17 martin 1.4 //

 18 martin 1.3 // The above copyright notice and this permission notice shall be included
 19            // in all copies or substantial portions of the Software.

 20 martin 1.4 //

 21 martin 1.3 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

 22 martin 1.4 // OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 23 martin 1.3 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 24            // IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 25            // CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 26            // TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 27            // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 28 martin 1.4 //

 29 martin 1.3 //////////////////////////////////////////////////////////////////////////

 30 kumpf  1.2 */
 31            
 32            #define _XOPEN_SOURCE
 33            #include <unistd.h>
 34            #include <stdio.h>
 35            #include <string.h>
 36            #include "Defines.h"
 37            #include "Strlcpy.h"
 38            #include "PasswordFile.h"
 39            
 40            /*
 41            **==============================================================================
 42            **
 43            ** CheckPasswordFile()
 44            **
 45            **     Checks whether the *password* is correct for the given *username*,
 46            **     according to the password file referred to by *path*. The file has
 47            **     the following format.
 48            **
 49            **         <usrname>:<encrypted-password>
 50            **
 51 kumpf  1.2 **     For example (smith's password is "changeme"):
 52            **
 53            **         smith:AB5bZ.JX9fQzA
 54            **         jones:XMllrzJ80fd.A
 55            **         williams:lM80ffj.jiOiO
 56            **
 57            **     Returns zero if the password matches or if password is null and the
 58            **     user exists.
 59            **
 60            **==============================================================================
 61            */
 62            
 63            int CheckPasswordFile(
 64                const char* path,
 65                const char* username,
 66                const char* password)
 67            {
 68                FILE* is;
 69                char line[EXECUTOR_BUFFER_SIZE];
 70            
 71                /* Open file. */
 72 kumpf  1.2 
 73                if ((is = fopen(path, "r")) == NULL)
 74                    return -1;
 75            
 76                /* Lookup encrypted password for this user. */
 77            
 78                while (fgets(line, sizeof(line), is) != NULL)
 79                {
 80                    char* p;
 81                    char encryptedPassword[14];
 82                    char buffer[EXECUTOR_BUFFER_SIZE];
 83                    char salt[3];
 84            
 85                    /* Skip lines starting with '#'. */
 86            
 87                    if (line[0] == '#')
 88                        continue;
 89            
 90                    /* Replace colon with null-terminator. */
 91            
 92                    if ((p = strchr(line, ':')) == NULL)
 93 kumpf  1.2             continue;
 94            
 95                    *p++ = '\0';
 96            
 97                    /* Skip this line, if username does not match. */
 98            
 99                    if (strcmp(line, username) != 0)
100                        continue;
101            
102                    /* If password is null, we are done. */
103            
104                    if (password == NULL)
105                    {
106                        fclose(is);
107                        return -1;
108                    }
109            
110                    /* Get encrypted password. */
111            
112                    Strlcpy(encryptedPassword, p, sizeof(encryptedPassword));
113            
114 kumpf  1.2         /* Get salt from encrypted password. */
115            
116                    salt[0] = encryptedPassword[0];
117                    salt[1] = encryptedPassword[1];
118                    salt[2] = '\0';
119            
120                    /* Check password. */
121            
122                    /* Flawfinder: ignore */
123                    Strlcpy(buffer, crypt(password, salt), sizeof(buffer));
124            
125                    if (strcmp(buffer, encryptedPassword) == 0)
126                    {
127                        fclose(is);
128                        return 0;
129                    }
130                    else
131                    {
132                        fclose(is);
133                        return -1;
134                    }
135 kumpf  1.2     }
136            
137                /* User entry not found. */
138            
139                fclose(is);
140                return -1;
141            }