From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 10 Nov 2026 19:49:02 +0000 (+0000)
Subject: BUG/MINOR: cfgparse: detect unsupported crypt() hashes on Debian/Ubuntu
X-Git-Tag: v3.5-dev12~43
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=1cca3606d7d941a1c2f6e0e74d1aa5ba2c31c7cb;p=haproxy.git

BUG/MINOR: cfgparse: detect unsupported crypt() hashes on Debian/Ubuntu

crypt() and crypt_r() may return NULL or error tokens when
encountering unsupported hash types. On Debian/Ubuntu (libxcrypt),
unsupported hashes return strings starting with '*' (e.g. '*0', '*1').
On musl, crypt() does not produce error tokens for unknown hashes, so
detection is not possible there.

Capture the return value of crypt() and check for NULL or a '*'
prefix, ensuring unsupported hash types are detected at config
validation time on platforms that report them.

Fixes isse #3568.

Must be backported to all stable branches.
---

diff --git a/src/cfgparse.c b/src/cfgparse.c
index 48b3d8bb9..5fb3c7648 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -1006,9 +1006,11 @@ int cfg_parse_users_user(char **args, int section_type, struct proxy *curproxy,
 #ifdef USE_LIBCRYPT
 			struct timeval tv_before, tv_after;
 			ulong ms_elapsed;
+			char *hash;
 
 			gettimeofday(&tv_before, NULL);
-			if (!crypt("", args[cur_arg + 1])) {
+			hash = crypt("", args[cur_arg + 1]);
+			if (!hash || hash[0] == '*') {
 				ha_alert("parsing [%s:%d]: the encrypted password used for user '%s' is not supported by crypt(3).\n",
 					 file, linenum, newuser->user);
 				err_code |= ERR_ALERT | ERR_FATAL;