BUG/MINOR: cfgparse: detect unsupported crypt() hashes on Debian/Ubuntu

crypt() and crypt_r() may return NULL or error tokens when
encountering unsupported hash types. On Debian/Ubuntu (libxcrypt),
unsupported hashes return strings starting with '*' (e.g. '*0', '*1').
On musl, crypt() does not produce error tokens for unknown hashes, so
detection is not possible there.

Capture the return value of crypt() and check for NULL or a '*'
prefix, ensuring unsupported hash types are detected at config
validation time on platforms that report them.

Fixes isse #3568.

Must be backported to all stable branches.

diff --git a/src/cfgparse.c b/src/cfgparse.c
index 48b3d8bb9b3f59807618b6121feb966e634c19bc..5fb3c76489cef8637ea9277427a442177c2f01e7 100644 (file)
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -1006,9 +1006,11 @@ int cfg_parse_users_user(char **args, int section_type, struct proxy *curproxy,
 #ifdef USE_LIBCRYPT
                        struct timeval tv_before, tv_after;
                        ulong ms_elapsed;
+                       char *hash;
 
                        gettimeofday(&tv_before, NULL);
-                       if (!crypt("", args[cur_arg + 1])) {
+                       hash = crypt("", args[cur_arg + 1]);
+                       if (!hash || hash[0] == '*') {
                                ha_alert("parsing [%s:%d]: the encrypted password used for user '%s' is not supported by crypt(3).\n",
                                         file, linenum, newuser->user);
                                err_code |= ERR_ALERT | ERR_FATAL;