X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=apps%2Fpasswd.c;h=c87369760cd01c3116afe14a7856dae2efc084c5;hb=93a8b3ba793c769a3634e56642dac55a8d44023f;hp=3ae8f9647140ddcc2fe87737568aa69181de1efa;hpb=f6c460e8f69e90fdb87129bb70951ced89c7906f;p=openssl.git diff --git a/apps/passwd.c b/apps/passwd.c index 3ae8f96471..c87369760c 100644 --- a/apps/passwd.c +++ b/apps/passwd.c @@ -1,5 +1,5 @@ /* - * Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -11,7 +11,11 @@ # define NO_MD5CRYPT_1 #endif -#if !defined(OPENSSL_NO_DES) || !defined(NO_MD5CRYPT_1) +#if defined OPENSSL_NO_SHA || defined CHARSET_EBCDIC +# define NO_SHACRYPT +#endif + +#if !defined(OPENSSL_NO_DES) || !defined(NO_MD5CRYPT_1) || !defined(NO_SHACRYPT) # include @@ -27,6 +31,9 @@ # ifndef NO_MD5CRYPT_1 # include # endif +# ifndef NO_SHACRYPT +# include +# endif static unsigned const char cov_2char[64] = { /* from crypto/des/fcrypt.c */ @@ -40,21 +47,30 @@ static unsigned const char cov_2char[64] = { 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A }; +typedef enum { + passwd_unset = 0, + passwd_crypt, + passwd_md5, + passwd_apr1, + passwd_sha256, + passwd_sha512, + passwd_aixmd5 +} passwd_modes; + static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p, char *passwd, BIO *out, int quiet, int table, - int reverse, size_t pw_maxlen, int usecrypt, int use1, - int useapr1); + int reverse, size_t pw_maxlen, passwd_modes mode); typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_IN, OPT_NOVERIFY, OPT_QUIET, OPT_TABLE, OPT_REVERSE, OPT_APR1, - OPT_1, OPT_CRYPT, OPT_SALT, OPT_STDIN + OPT_1, OPT_5, OPT_6, OPT_CRYPT, OPT_AIXMD5, OPT_SALT, OPT_STDIN } OPTION_CHOICE; -OPTIONS passwd_options[] = { +const OPTIONS passwd_options[] = { {"help", OPT_HELP, '-', "Display this summary"}, - {"in", OPT_IN, '<', "Pead passwords from file"}, + {"in", OPT_IN, '<', "Read passwords from file"}, {"noverify", OPT_NOVERIFY, '-', "Never verify when reading password from terminal"}, {"quiet", OPT_QUIET, '-', "No warnings"}, @@ -62,9 +78,14 @@ OPTIONS passwd_options[] = { {"reverse", OPT_REVERSE, '-', "Switch table columns"}, {"salt", OPT_SALT, 's', "Use provided salt"}, {"stdin", OPT_STDIN, '-', "Read passwords from stdin"}, +# ifndef NO_SHACRYPT + {"6", OPT_6, '-', "SHA512-based password algorithm"}, + {"5", OPT_5, '-', "SHA256-based password algorithm"}, +# endif # ifndef NO_MD5CRYPT_1 {"apr1", OPT_APR1, '-', "MD5-based password algorithm, Apache variant"}, {"1", OPT_1, '-', "MD5-based password algorithm"}, + {"aixmd5", OPT_AIXMD5, '-', "AIX MD5-based password algorithm"}, # endif # ifndef OPENSSL_NO_DES {"crypt", OPT_CRYPT, '-', "Standard Unix password algorithm (default)"}, @@ -79,12 +100,15 @@ int passwd_main(int argc, char **argv) char *salt_malloc = NULL, *passwd_malloc = NULL, *prog; OPTION_CHOICE o; int in_stdin = 0, pw_source_defined = 0; -#ifndef OPENSSL_NO_UI +# ifndef OPENSSL_NO_UI int in_noverify = 0; -#endif +# endif int passed_salt = 0, quiet = 0, table = 0, reverse = 0; - int ret = 1, usecrypt = 0, use1 = 0, useapr1 = 0; - size_t passwd_malloc_size = 0, pw_maxlen = 256; + int ret = 1; + passwd_modes mode = passwd_unset; + size_t passwd_malloc_size = 0; + size_t pw_maxlen = 256; /* arbitrary limit, should be enough for most + * passwords */ prog = opt_init(argc, argv, passwd_options); while ((o = opt_next()) != OPT_EOF) { @@ -105,9 +129,9 @@ int passwd_main(int argc, char **argv) pw_source_defined = 1; break; case OPT_NOVERIFY: -#ifndef OPENSSL_NO_UI +# ifndef OPENSSL_NO_UI in_noverify = 1; -#endif +# endif break; case OPT_QUIET: quiet = 1; @@ -119,13 +143,34 @@ int passwd_main(int argc, char **argv) reverse = 1; break; case OPT_1: - use1 = 1; + if (mode != passwd_unset) + goto opthelp; + mode = passwd_md5; + break; + case OPT_5: + if (mode != passwd_unset) + goto opthelp; + mode = passwd_sha256; + break; + case OPT_6: + if (mode != passwd_unset) + goto opthelp; + mode = passwd_sha512; break; case OPT_APR1: - useapr1 = 1; + if (mode != passwd_unset) + goto opthelp; + mode = passwd_apr1; + break; + case OPT_AIXMD5: + if (mode != passwd_unset) + goto opthelp; + mode = passwd_aixmd5; break; case OPT_CRYPT: - usecrypt = 1; + if (mode != passwd_unset) + goto opthelp; + mode = passwd_crypt; break; case OPT_SALT: passed_salt = 1; @@ -142,28 +187,28 @@ int passwd_main(int argc, char **argv) argc = opt_num_rest(); argv = opt_rest(); - if (*argv) { + if (*argv != NULL) { if (pw_source_defined) goto opthelp; pw_source_defined = 1; passwds = argv; } - if (!usecrypt && !use1 && !useapr1) { + if (mode == passwd_unset) { /* use default */ - usecrypt = 1; - } - if (usecrypt + use1 + useapr1 > 1) { - /* conflict */ - goto opthelp; + mode = passwd_crypt; } # ifdef OPENSSL_NO_DES - if (usecrypt) + if (mode == passwd_crypt) goto opthelp; # endif # ifdef NO_MD5CRYPT_1 - if (use1 || useapr1) + if (mode == passwd_md5 || mode == passwd_apr1 || mode == passwd_aixmd5) + goto opthelp; +# endif +# ifdef NO_SHACRYPT + if (mode == passwd_sha256 || mode == passwd_sha512) goto opthelp; # endif @@ -182,11 +227,8 @@ int passwd_main(int argc, char **argv) goto end; } - if (usecrypt) + if (mode == passwd_crypt) pw_maxlen = 8; - else if (use1 || useapr1) - pw_maxlen = 256; /* arbitrary limit, should be enough for most - * passwords */ if (passwds == NULL) { /* no passwords on the command line */ @@ -198,26 +240,31 @@ int passwd_main(int argc, char **argv) } if ((in == NULL) && (passwds == NULL)) { + /* + * we use the following method to make sure what + * in the 'else' section is always compiled, to + * avoid rot of not-frequently-used code. + */ if (1) { -#ifndef OPENSSL_NO_UI +# ifndef OPENSSL_NO_UI /* build a null-terminated list */ static char *passwds_static[2] = { NULL, NULL }; passwds = passwds_static; - if (in == NULL) + if (in == NULL) { if (EVP_read_pw_string (passwd_malloc, passwd_malloc_size, "Password: ", !(passed_salt || in_noverify)) != 0) goto end; + } passwds[0] = passwd_malloc; } else { -#endif +# endif BIO_printf(bio_err, "password required\n"); goto end; } } - if (in == NULL) { assert(passwds != NULL); assert(*passwds != NULL); @@ -225,14 +272,11 @@ int passwd_main(int argc, char **argv) do { /* loop over list of passwords */ passwd = *passwds++; if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, bio_out, - quiet, table, reverse, pw_maxlen, usecrypt, use1, - useapr1)) + quiet, table, reverse, pw_maxlen, mode)) goto end; - } - while (*passwds != NULL); - } else + } while (*passwds != NULL); + } else { /* in != NULL */ - { int done; assert(passwd != NULL); @@ -240,9 +284,9 @@ int passwd_main(int argc, char **argv) int r = BIO_gets(in, passwd, pw_maxlen + 1); if (r > 0) { char *c = (strchr(passwd, '\n')); - if (c != NULL) + if (c != NULL) { *c = 0; /* truncate at newline */ - else { + } else { /* ignore rest of line */ char trash[BUFSIZ]; do @@ -252,12 +296,11 @@ int passwd_main(int argc, char **argv) if (!do_passwd (passed_salt, &salt, &salt_malloc, passwd, bio_out, quiet, - table, reverse, pw_maxlen, usecrypt, use1, useapr1)) + table, reverse, pw_maxlen, mode)) goto end; } done = (r <= 0); - } - while (!done); + } while (!done); } ret = 0; @@ -291,21 +334,29 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt) size_t passwd_len, salt_len, magic_len; passwd_len = strlen(passwd); - out_buf[0] = '$'; - out_buf[1] = 0; + + out_buf[0] = 0; magic_len = strlen(magic); - if (magic_len > 4) /* assert it's "1" or "apr1" */ - return NULL; + if (magic_len > 0) { + out_buf[0] = '$'; + out_buf[1] = 0; + + if (magic_len > 4) /* assert it's "1" or "apr1" */ + return NULL; + + OPENSSL_strlcat(out_buf, magic, sizeof out_buf); + OPENSSL_strlcat(out_buf, "$", sizeof out_buf); + } - OPENSSL_strlcat(out_buf, magic, sizeof out_buf); - OPENSSL_strlcat(out_buf, "$", sizeof out_buf); OPENSSL_strlcat(out_buf, salt, sizeof out_buf); - if (strlen(out_buf) > 6 + 8); /* assert "$apr1$..salt.." */ + if (strlen(out_buf) > 6 + 8) /* assert "$apr1$..salt.." */ return NULL; - salt_out = out_buf + 2 + magic_len; + salt_out = out_buf; + if (magic_len > 0) + salt_out += 2 + magic_len; salt_len = strlen(salt_out); if (salt_len > 8) @@ -314,11 +365,17 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt) md = EVP_MD_CTX_new(); if (md == NULL || !EVP_DigestInit_ex(md, EVP_md5(), NULL) - || !EVP_DigestUpdate(md, passwd, passwd_len) - || !EVP_DigestUpdate(md, "$", 1) - || !EVP_DigestUpdate(md, magic, magic_len) - || !EVP_DigestUpdate(md, "$", 1) - || !EVP_DigestUpdate(md, salt_out, salt_len)) + || !EVP_DigestUpdate(md, passwd, passwd_len)) + goto err; + + if (magic_len > 0) + if (!EVP_DigestUpdate(md, "$", 1) + || !EVP_DigestUpdate(md, magic, magic_len) + || !EVP_DigestUpdate(md, "$", 1)) + goto err; + + if (!EVP_DigestUpdate(md, salt_out, salt_len)) + goto err; md2 = EVP_MD_CTX_new(); if (md2 == NULL @@ -418,10 +475,269 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt) } # endif +# ifndef NO_SHACRYPT +/* + * SHA based password algorithm, describe by Ulrich Drepper here: + * https://www.akkadia.org/drepper/SHA-crypt.txt + * (note that it's in the public domain) + */ +static char *shacrypt(const char *passwd, const char *magic, const char *salt) +{ + /* Prefix for optional rounds specification. */ + static const char rounds_prefix[] = "rounds="; + /* Maximum salt string length. */ +# define SALT_LEN_MAX 16 + /* Default number of rounds if not explicitly specified. */ +# define ROUNDS_DEFAULT 5000 + /* Minimum number of rounds. */ +# define ROUNDS_MIN 1000 + /* Maximum number of rounds. */ +# define ROUNDS_MAX 999999999 + + /* "$6$rounds=$......salt......$...shahash(up to 86 chars)...\0" */ + static char out_buf[3 + 17 + 17 + 86 + 1]; + unsigned char buf[SHA512_DIGEST_LENGTH]; + unsigned char temp_buf[SHA512_DIGEST_LENGTH]; + size_t buf_size = 0; + char salt_copy[17]; /* Max 16 chars plus '\0' */ + size_t n; + EVP_MD_CTX *md = NULL, *md2 = NULL; + const EVP_MD *sha = NULL; + size_t passwd_len, salt_len, magic_len; + unsigned int rounds = 5000; /* Default */ + char rounds_custom = 0; + char *p_bytes = NULL; + char *s_bytes = NULL; + char *cp = NULL; + + passwd_len = strlen(passwd); + magic_len = strlen(magic); + + /* assert it's "5" or "6" */ + if (magic_len != 1) + return NULL; + + switch (magic[0]) { + case '5': + sha = EVP_sha256(); + buf_size = 32; + break; + case '6': + sha = EVP_sha512(); + buf_size = 64; + break; + default: + return NULL; + } + + if (strncmp(salt, rounds_prefix, sizeof(rounds_prefix) - 1) == 0) { + const char *num = salt + sizeof(rounds_prefix) - 1; + char *endp; + unsigned long int srounds = strtoul (num, &endp, 10); + if (*endp == '$') { + salt = endp + 1; + if (srounds > ROUNDS_MAX) + rounds = ROUNDS_MAX; + else if (srounds < ROUNDS_MIN) + rounds = ROUNDS_MIN; + else + rounds = (unsigned int)srounds; + rounds_custom = 1; + } else { + return NULL; + } + } + + /* The salt gets truncated to 16 chars */ + OPENSSL_strlcpy(salt_copy, salt, sizeof salt_copy); + salt_len = strlen(salt_copy); + + out_buf[0] = 0; + OPENSSL_strlcat(out_buf, "$", sizeof out_buf); + OPENSSL_strlcat(out_buf, magic, sizeof out_buf); + OPENSSL_strlcat(out_buf, "$", sizeof out_buf); + if (rounds_custom) { + char tmp_buf[80]; /* "rounds=999999999" */ + sprintf(tmp_buf, "rounds=%u", rounds); + OPENSSL_strlcat(out_buf, tmp_buf, sizeof out_buf); + OPENSSL_strlcat(out_buf, "$", sizeof out_buf); + } + OPENSSL_strlcat(out_buf, salt_copy, sizeof out_buf); + + /* assert "$5$rounds=999999999$......salt......" */ + if (strlen(out_buf) > 3 + 17 * rounds_custom + salt_len ) + return NULL; + + md = EVP_MD_CTX_new(); + if (md == NULL + || !EVP_DigestInit_ex(md, sha, NULL) + || !EVP_DigestUpdate(md, passwd, passwd_len) + || !EVP_DigestUpdate(md, salt_copy, salt_len)) + goto err; + + md2 = EVP_MD_CTX_new(); + if (md2 == NULL + || !EVP_DigestInit_ex(md2, sha, NULL) + || !EVP_DigestUpdate(md2, passwd, passwd_len) + || !EVP_DigestUpdate(md2, salt_copy, salt_len) + || !EVP_DigestUpdate(md2, passwd, passwd_len) + || !EVP_DigestFinal_ex(md2, buf, NULL)) + goto err; + + for (n = passwd_len; n > buf_size; n -= buf_size) { + if (!EVP_DigestUpdate(md, buf, buf_size)) + goto err; + } + if (!EVP_DigestUpdate(md, buf, n)) + goto err; + + n = passwd_len; + while (n) { + if (!EVP_DigestUpdate(md, + (n & 1) ? buf : (unsigned const char *)passwd, + (n & 1) ? buf_size : passwd_len)) + goto err; + n >>= 1; + } + if (!EVP_DigestFinal_ex(md, buf, NULL)) + return NULL; + + /* P sequence */ + if (!EVP_DigestInit_ex(md2, sha, NULL)) + goto err; + + for (n = passwd_len; n > 0; n--) + if (!EVP_DigestUpdate(md2, passwd, passwd_len)) + goto err; + + if (!EVP_DigestFinal_ex(md2, temp_buf, NULL)) + return NULL; + + if ((p_bytes = OPENSSL_zalloc(passwd_len)) == NULL) + goto err; + for (cp = p_bytes, n = passwd_len; n > buf_size; n -= buf_size, cp += buf_size) + memcpy(cp, temp_buf, buf_size); + memcpy(cp, temp_buf, n); + + /* S sequence */ + if (!EVP_DigestInit_ex(md2, sha, NULL)) + goto err; + + for (n = 16 + buf[0]; n > 0; n--) + if (!EVP_DigestUpdate(md2, salt, salt_len)) + goto err; + + if (!EVP_DigestFinal_ex(md2, temp_buf, NULL)) + return NULL; + + if ((s_bytes = OPENSSL_zalloc(salt_len)) == NULL) + goto err; + for (cp = s_bytes, n = salt_len; n > buf_size; n -= buf_size, cp += buf_size) + memcpy(cp, temp_buf, buf_size); + memcpy(cp, temp_buf, n); + + for (n = 0; n < rounds; n++) { + if (!EVP_DigestInit_ex(md2, sha, NULL)) + goto err; + if (!EVP_DigestUpdate(md2, + (n & 1) ? (unsigned const char *)p_bytes : buf, + (n & 1) ? passwd_len : buf_size)) + goto err; + if (n % 3) { + if (!EVP_DigestUpdate(md2, s_bytes, salt_len)) + goto err; + } + if (n % 7) { + if (!EVP_DigestUpdate(md2, p_bytes, passwd_len)) + goto err; + } + if (!EVP_DigestUpdate(md2, + (n & 1) ? buf : (unsigned const char *)p_bytes, + (n & 1) ? buf_size : passwd_len)) + goto err; + if (!EVP_DigestFinal_ex(md2, buf, NULL)) + goto err; + } + EVP_MD_CTX_free(md2); + EVP_MD_CTX_free(md); + md2 = NULL; + md = NULL; + OPENSSL_free(p_bytes); + OPENSSL_free(s_bytes); + p_bytes = NULL; + s_bytes = NULL; + + cp = out_buf + strlen(out_buf); + *cp++ = '$'; + +# define b64_from_24bit(B2, B1, B0, N) \ + do { \ + unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0); \ + int i = (N); \ + while (i-- > 0) \ + { \ + *cp++ = cov_2char[w & 0x3f]; \ + w >>= 6; \ + } \ + } while (0) + + switch (*magic) { + case '5': + b64_from_24bit (buf[0], buf[10], buf[20], 4); + b64_from_24bit (buf[21], buf[1], buf[11], 4); + b64_from_24bit (buf[12], buf[22], buf[2], 4); + b64_from_24bit (buf[3], buf[13], buf[23], 4); + b64_from_24bit (buf[24], buf[4], buf[14], 4); + b64_from_24bit (buf[15], buf[25], buf[5], 4); + b64_from_24bit (buf[6], buf[16], buf[26], 4); + b64_from_24bit (buf[27], buf[7], buf[17], 4); + b64_from_24bit (buf[18], buf[28], buf[8], 4); + b64_from_24bit (buf[9], buf[19], buf[29], 4); + b64_from_24bit (0, buf[31], buf[30], 3); + break; + case '6': + b64_from_24bit (buf[0], buf[21], buf[42], 4); + b64_from_24bit (buf[22], buf[43], buf[1], 4); + b64_from_24bit (buf[44], buf[2], buf[23], 4); + b64_from_24bit (buf[3], buf[24], buf[45], 4); + b64_from_24bit (buf[25], buf[46], buf[4], 4); + b64_from_24bit (buf[47], buf[5], buf[26], 4); + b64_from_24bit (buf[6], buf[27], buf[48], 4); + b64_from_24bit (buf[28], buf[49], buf[7], 4); + b64_from_24bit (buf[50], buf[8], buf[29], 4); + b64_from_24bit (buf[9], buf[30], buf[51], 4); + b64_from_24bit (buf[31], buf[52], buf[10], 4); + b64_from_24bit (buf[53], buf[11], buf[32], 4); + b64_from_24bit (buf[12], buf[33], buf[54], 4); + b64_from_24bit (buf[34], buf[55], buf[13], 4); + b64_from_24bit (buf[56], buf[14], buf[35], 4); + b64_from_24bit (buf[15], buf[36], buf[57], 4); + b64_from_24bit (buf[37], buf[58], buf[16], 4); + b64_from_24bit (buf[59], buf[17], buf[38], 4); + b64_from_24bit (buf[18], buf[39], buf[60], 4); + b64_from_24bit (buf[40], buf[61], buf[19], 4); + b64_from_24bit (buf[62], buf[20], buf[41], 4); + b64_from_24bit (0, 0, buf[63], 2); + break; + default: + goto err; + } + *cp = '\0'; + + return out_buf; + + err: + EVP_MD_CTX_free(md2); + EVP_MD_CTX_free(md); + OPENSSL_free(p_bytes); + OPENSSL_free(s_bytes); + return NULL; +} +# endif + static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p, char *passwd, BIO *out, int quiet, int table, - int reverse, size_t pw_maxlen, int usecrypt, int use1, - int useapr1) + int reverse, size_t pw_maxlen, passwd_modes mode) { char *hash = NULL; @@ -431,10 +747,9 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p, /* first make sure we have a salt */ if (!passed_salt) { # ifndef OPENSSL_NO_DES - if (usecrypt) { - if (*salt_malloc_p == NULL) { + if (mode == passwd_crypt) { + if (*salt_malloc_p == NULL) *salt_p = *salt_malloc_p = app_malloc(3, "salt buffer"); - } if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0) goto end; (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f]; /* 6 bits */ @@ -448,12 +763,11 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p, # endif /* !OPENSSL_NO_DES */ # ifndef NO_MD5CRYPT_1 - if (use1 || useapr1) { + if (mode == passwd_md5 || mode == passwd_apr1 || mode == passwd_aixmd5) { int i; - if (*salt_malloc_p == NULL) { + if (*salt_malloc_p == NULL) *salt_p = *salt_malloc_p = app_malloc(9, "salt buffer"); - } if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0) goto end; @@ -462,6 +776,21 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p, (*salt_p)[8] = 0; } # endif /* !NO_MD5CRYPT_1 */ + +# ifndef NO_SHACRYPT + if (mode == passwd_sha256 || mode == passwd_sha512) { + int i; + + if (*salt_malloc_p == NULL) + *salt_p = *salt_malloc_p = app_malloc(17, "salt buffer"); + if (RAND_bytes((unsigned char *)*salt_p, 16) <= 0) + goto end; + + for (i = 0; i < 16; i++) + (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */ + (*salt_p)[16] = 0; + } +# endif /* !NO_SHACRYPT */ } assert(*salt_p != NULL); @@ -481,12 +810,18 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p, /* now compute password hash */ # ifndef OPENSSL_NO_DES - if (usecrypt) + if (mode == passwd_crypt) hash = DES_crypt(passwd, *salt_p); # endif # ifndef NO_MD5CRYPT_1 - if (use1 || useapr1) - hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p); + if (mode == passwd_md5 || mode == passwd_apr1) + hash = md5crypt(passwd, (mode == passwd_md5 ? "1" : "apr1"), *salt_p); + if (mode == passwd_aixmd5) + hash = md5crypt(passwd, "", *salt_p); +# endif +# ifndef NO_SHACRYPT + if (mode == passwd_sha256 || mode == passwd_sha512) + hash = shacrypt(passwd, (mode == passwd_sha256 ? "5" : "6"), *salt_p); # endif assert(hash != NULL); @@ -496,10 +831,10 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p, BIO_printf(out, "%s\t%s\n", hash, passwd); else BIO_printf(out, "%s\n", hash); - return 0; + return 1; end: - return 1; + return 0; } #else