ITS#2906: report invalid userPassword schemes, clarify documentation

diff --git a/doc/man/man8/slappasswd.8 b/doc/man/man8/slappasswd.8
index 8eade745e6fd8327f59c8f1e66b54ebe4d4b7738..ee83f09d09e98d98dd70c1604440552b4bbe4e1c 100644 (file)
--- a/doc/man/man8/slappasswd.8
+++ b/doc/man/man8/slappasswd.8
@@ -64,6 +64,12 @@ be specified:
 The default is 
 .IR {SSHA} .
 
+Note that scheme names may need to be protected, due to
+.B {
+and
+.BR } ,
+from expansion by the user's command interpreter.
+
 .B {SHA}
 and
 .B {SSHA}

diff --git a/libraries/liblutil/passwd.c b/libraries/liblutil/passwd.c
index abf26784e76e8d9c56cf8b0c15369617c96ff5db..064343cbc3df4d0ed79ab963663b68d9503e032c 100644 (file)
--- a/libraries/liblutil/passwd.c
+++ b/libraries/liblutil/passwd.c
@@ -377,9 +377,17 @@ struct berval * lutil_passwd_hash(
 {
        const struct pw_scheme *sc = get_scheme( method );
 
+       if( sc == NULL ) {
+               *text = "scheme not recognized";
+               return NULL;
+       }
+
+       if( ! sc->hash_fn ) {
+               *text = "scheme provided no hash function";
+               return NULL;
+       }
+
        if( text ) *text = NULL;
-       if( sc == NULL ) return NULL;
-       if( ! sc->hash_fn ) return NULL;
 
        return (sc->hash_fn)( &sc->name, passwd, text );
 }

diff --git a/servers/slapd/tools/slappasswd.c b/servers/slapd/tools/slappasswd.c
index 92443e205150346f421430c1f9c9f4f28e52b43b..b144ae5937f9c923e8f957f7a14aa9e77eb279a6 100644 (file)
--- a/servers/slapd/tools/slappasswd.c
+++ b/servers/slapd/tools/slappasswd.c
@@ -131,10 +131,10 @@ main( int argc, char *argv[] )
        }
 
        hash = lutil_passwd_hash( &passwd, scheme, &text );
-
        if( hash == NULL || hash->bv_val == NULL ) {
-               fprintf( stderr, "Password generation failed. %s\n",
-                       text ? text : "" );
+               fprintf( stderr,
+                       "Password generation failed for scheme %s: %s\n",
+                       scheme, text ? text : "" );
                return EXIT_FAILURE;
        }