From 131242faf655f3a6325406c9eb2546cfdebf13ab Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn@redhat.com>
Date: Jul 31 2018 20:43:37 +0000
Subject: [PATCH 1/3] Revert "Revert "CRYPTO: Suppress warning Wstringop-truncation""


This reverts commit bb20d5160faed5e0076887ac4a83e550be15a8b2.

The patch introduced compile time warning
src/util/crypto/libcrypto/crypto_sha512crypt.c:280:10: error: 'stpncpy'
    output truncated before terminating nul copying 3 bytes from a string
    of the same length [-Werror=stringop-truncation]
     cp = stpncpy(buffer, sha512_salt_prefix, SALT_PREF_SIZE);
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Merges: https://pagure.io/SSSD/sssd/pull-request/3792

---

diff --git a/src/util/crypto/libcrypto/crypto_sha512crypt.c b/src/util/crypto/libcrypto/crypto_sha512crypt.c
index b074eee..5861f34 100644
--- a/src/util/crypto/libcrypto/crypto_sha512crypt.c
+++ b/src/util/crypto/libcrypto/crypto_sha512crypt.c
@@ -277,7 +277,7 @@ static int sha512_crypt_r(const char *key,
         goto done;
     }
 
-    cp = stpncpy(buffer, sha512_salt_prefix, SALT_PREF_SIZE);
+    cp = memcpy(buffer, sha512_salt_prefix, SALT_PREF_SIZE);
     buflen -= SALT_PREF_SIZE;
 
     if (rounds_custom) {
diff --git a/src/util/crypto/nss/nss_sha512crypt.c b/src/util/crypto/nss/nss_sha512crypt.c
index 2f1624e..709cf51 100644
--- a/src/util/crypto/nss/nss_sha512crypt.c
+++ b/src/util/crypto/nss/nss_sha512crypt.c
@@ -267,7 +267,7 @@ static int sha512_crypt_r(const char *key,
         goto done;
     }
 
-    cp = stpncpy(buffer, sha512_salt_prefix, SALT_PREF_SIZE);
+    cp = memcpy(buffer, sha512_salt_prefix, SALT_PREF_SIZE);
     buflen -= SALT_PREF_SIZE;
 
     if (rounds_custom) {

From 6607df713f26c3c027c737c276fc0a519f24c786 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn@redhat.com>
Date: Jul 31 2018 20:44:06 +0000
Subject: [PATCH 2/3] CRYPTO: Save prefix in s3crypt_sha512


Since commit 2951a9a84bd85f384213a3e071ffc167907df2d7 where we switched from
stpncpy to memcpy the salt prefix "$6$" is not stored at all.
This broke offline authentication if someone upgraded from old version
that stored the prefix to one that doesn't store it.

Resolves:
https://pagure.io/SSSD/sssd/issue/3791

Merges: https://pagure.io/SSSD/sssd/pull-request/3792

---

diff --git a/src/util/crypto/libcrypto/crypto_sha512crypt.c b/src/util/crypto/libcrypto/crypto_sha512crypt.c
index 5861f34..2275ccd 100644
--- a/src/util/crypto/libcrypto/crypto_sha512crypt.c
+++ b/src/util/crypto/libcrypto/crypto_sha512crypt.c
@@ -278,6 +278,7 @@ static int sha512_crypt_r(const char *key,
     }
 
     cp = memcpy(buffer, sha512_salt_prefix, SALT_PREF_SIZE);
+    cp += SALT_PREF_SIZE;
     buflen -= SALT_PREF_SIZE;
 
     if (rounds_custom) {
diff --git a/src/util/crypto/nss/nss_sha512crypt.c b/src/util/crypto/nss/nss_sha512crypt.c
index 709cf51..4d0594d 100644
--- a/src/util/crypto/nss/nss_sha512crypt.c
+++ b/src/util/crypto/nss/nss_sha512crypt.c
@@ -268,6 +268,7 @@ static int sha512_crypt_r(const char *key,
     }
 
     cp = memcpy(buffer, sha512_salt_prefix, SALT_PREF_SIZE);
+    cp += SALT_PREF_SIZE;
     buflen -= SALT_PREF_SIZE;
 
     if (rounds_custom) {

From a91589c6ceb73902fc17b09899a1ca890c397340 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn@redhat.com>
Date: Jul 31 2018 20:44:16 +0000
Subject: [PATCH 3/3] crypto-tests: Add unit test for s3crypt_sha512


Resolves:
https://pagure.io/SSSD/sssd/issue/3791

Merges: https://pagure.io/SSSD/sssd/pull-request/3792

---

diff --git a/src/tests/crypto-tests.c b/src/tests/crypto-tests.c
index 2e826a4..6f5e22a 100644
--- a/src/tests/crypto-tests.c
+++ b/src/tests/crypto-tests.c
@@ -201,6 +201,37 @@ START_TEST(test_sss_encrypt_decrypt)
 }
 END_TEST
 
+START_TEST(test_s3crypt_sha512)
+{
+    int ret;
+    char *salt;
+    char *userhash;
+    char *comphash;
+    const char *password = "password123";
+    const char *expected_hash = "$6$tU67Q/9h3tm5WJ.U$aL9gjCfiSZQewHTI6A4/MHCVWrMCiJZ.gNXEIw6HO39XGbg.s2nTyGlYXeoQyQtDll3XSbIZN41fJEC3v7ELy0";
+
+    test_ctx = talloc_new(NULL);
+    fail_if(test_ctx == NULL);
+
+    ret = s3crypt_gen_salt(test_ctx, &salt);
+    fail_if(ret != 0);
+
+    ret = s3crypt_sha512(test_ctx, password, salt, &userhash);
+    fail_if(ret != 0);
+
+    ret = s3crypt_sha512(test_ctx, password, userhash, &comphash);
+    fail_if(ret != 0);
+    ck_assert_str_eq(userhash, comphash);
+    talloc_free(comphash);
+
+    ret = s3crypt_sha512(test_ctx, password, expected_hash, &comphash);
+    fail_if(ret != 0);
+    ck_assert_str_eq(expected_hash, comphash);
+
+    talloc_free(test_ctx);
+}
+END_TEST
+
 Suite *crypto_suite(void)
 {
     Suite *s = suite_create("sss_crypto");
@@ -216,6 +247,7 @@ Suite *crypto_suite(void)
     tcase_add_test(tc, test_base64_encode);
     tcase_add_test(tc, test_base64_decode);
     tcase_add_test(tc, test_sss_encrypt_decrypt);
+    tcase_add_test(tc, test_s3crypt_sha512);
     /* Add all test cases to the test suite */
     suite_add_tcase(s, tc);