Annotate Patch Side-by-side Diff

Differences From Artifact [1a4eccad68]:

To Artifact [fb9cd24234]:

  • File misc-stml.scm — part of check-in [1b5a5d3a6e] at 2016-10-20 17:53:01 on branch crypt — Replace external openssl call with "crypt" egg.

    The OpenSSL call was using the old UNIX crypt DES password hashing, which is very weak. Crypt will default to a more sensible mechanism (Blowfish, but in the future could transparently switch).

    Old passwords will continue to work, because the crypt egg detects DES salts and happily hashes them. When creating new passwords, they will be hashed using the modern algorithm.

    The OpenSSL call passed the password to the shell, so an onlooker on the server could see it in plaintext. It also neglected to escape the password for the shell, resulting in a command injection vulnerability. (user: sjamaan, size: 9930) [annotate] [blame] [check-ins using] [more...]

︙
8
9
10
11
12
13
14

15
16
17
18
19
20
21
22
23
24

8
9
10
11
12
13
14
15
16


17
18
19
20
21
22
23








+

-
-








;;  PURPOSE.

;;======================================================================
;; dumbobj helpers
;;======================================================================

(declare (unit misc-stml))
(use (prefix crypt c:))
(use regex)
(use dbi)
(import (prefix dbi dbi:))

;; given a list of symbols give the count of the matching symbol
;; l => '(a b c)  (dumobj:indx a 'b) => 1
(define (s:get-fieldnum lst field-name)
  (let loop ((head (car lst))
             (tail (cdr lst))
             (fnum 0))
︙
125
126
127
128
129
130
131
132


133
134
135
136
137
138
139

140
141
142
143
144
145
146
147
148
149
150

124
125
126
127
128
129
130

131
132
133
134





135




136
137
138
139
140
141
142








-
+
+


-
-
-
-
-
+
-
-
-
-








(define (session:make-rand-string len)
  (let loop ((res "")
             (n   1))
    (if (> n len) res
        (loop (string-append res (session:get-rand-char))
              (+ n 1)))))

;; openssl passwd -crypt -salt xx password
;; Rely on crypt egg's default settings being secure enough, accept
;; backwards-compatible OpenSSL crypt passwords too.
;;
(define (s:crypt-passwd pw s)
  (let* ((salt (if s s (session:make-rand-string 2)))
	 (inp (open-input-pipe 
               ;;(string-append "echo " pw " | mkpasswd -S " salt " -s")))
	       ;; (conc "mkpasswd " pw " " salt)
	       (conc "openssl passwd -crypt -salt " salt " " pw)
  (c:crypt pw (or s (c:crypt-gensalt))))
               ))
         (res (read-line inp)))
    (close-input-port inp)
    res))

(define (s:password-match? password crypted)
  (let* ((salt (substring crypted 0 2))
         (pcrypted (s:crypt-passwd password salt)))
    (s:log "INFO: pcrypted=" pcrypted " crypted=" crypted)
    (and (string? password)
         (string? pcrypted)
︙